summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--.cirrus.yml4
-rw-r--r--.travis.yml1
-rw-r--r--target/xtensa/cpu.c2
-rw-r--r--target/xtensa/cpu.h58
-rw-r--r--target/xtensa/helper.c1
-rw-r--r--target/xtensa/helper.h6
-rw-r--r--target/xtensa/mmu_helper.c532
-rw-r--r--target/xtensa/op_helper.c42
-rw-r--r--target/xtensa/overlay_tool.h43
-rw-r--r--target/xtensa/translate.c2947
-rw-r--r--tests/device-introspect-test.c85
-rw-r--r--tests/hd-geo-test.c76
-rw-r--r--tests/libqos/virtio-mmio.c2
-rw-r--r--tests/libqos/virtio-pci.c3
-rw-r--r--tests/libqos/virtio.c18
-rw-r--r--tests/libqos/virtio.h3
-rw-r--r--tests/libqtest.c11
-rw-r--r--tests/libqtest.h112
-rw-r--r--tests/numa-test.c53
-rw-r--r--tests/q35-test.c39
-rwxr-xr-xtests/qemu-iotests/0011
-rwxr-xr-xtests/qemu-iotests/0021
-rwxr-xr-xtests/qemu-iotests/0031
-rwxr-xr-xtests/qemu-iotests/0041
-rwxr-xr-xtests/qemu-iotests/0059
-rwxr-xr-xtests/qemu-iotests/0071
-rwxr-xr-xtests/qemu-iotests/0081
-rwxr-xr-xtests/qemu-iotests/0091
-rwxr-xr-xtests/qemu-iotests/0101
-rwxr-xr-xtests/qemu-iotests/0111
-rwxr-xr-xtests/qemu-iotests/0121
-rwxr-xr-xtests/qemu-iotests/0151
-rwxr-xr-xtests/qemu-iotests/0171
-rwxr-xr-xtests/qemu-iotests/0201
-rwxr-xr-xtests/qemu-iotests/0211
-rwxr-xr-xtests/qemu-iotests/0221
-rwxr-xr-xtests/qemu-iotests/0251
-rwxr-xr-xtests/qemu-iotests/0261
-rwxr-xr-xtests/qemu-iotests/0271
-rwxr-xr-xtests/qemu-iotests/0291
-rwxr-xr-xtests/qemu-iotests/0311
-rwxr-xr-xtests/qemu-iotests/0321
-rwxr-xr-xtests/qemu-iotests/0331
-rwxr-xr-xtests/qemu-iotests/0351
-rwxr-xr-xtests/qemu-iotests/0361
-rwxr-xr-xtests/qemu-iotests/0371
-rwxr-xr-xtests/qemu-iotests/0421
-rwxr-xr-xtests/qemu-iotests/0431
-rwxr-xr-xtests/qemu-iotests/0461
-rwxr-xr-xtests/qemu-iotests/0471
-rwxr-xr-xtests/qemu-iotests/0491
-rwxr-xr-xtests/qemu-iotests/0501
-rwxr-xr-xtests/qemu-iotests/0511
-rwxr-xr-xtests/qemu-iotests/0521
-rwxr-xr-xtests/qemu-iotests/0531
-rwxr-xr-xtests/qemu-iotests/0541
-rwxr-xr-xtests/qemu-iotests/0621
-rwxr-xr-xtests/qemu-iotests/0631
-rwxr-xr-xtests/qemu-iotests/0661
-rwxr-xr-xtests/qemu-iotests/0671
-rwxr-xr-xtests/qemu-iotests/0681
-rwxr-xr-xtests/qemu-iotests/0691
-rwxr-xr-xtests/qemu-iotests/0711
-rwxr-xr-xtests/qemu-iotests/0721
-rwxr-xr-xtests/qemu-iotests/0731
-rwxr-xr-xtests/qemu-iotests/0791
-rwxr-xr-xtests/qemu-iotests/0821
-rwxr-xr-xtests/qemu-iotests/0851
-rwxr-xr-xtests/qemu-iotests/0891
-rwxr-xr-xtests/qemu-iotests/0901
-rwxr-xr-xtests/qemu-iotests/0941
-rwxr-xr-xtests/qemu-iotests/0951
-rwxr-xr-xtests/qemu-iotests/0981
-rwxr-xr-xtests/qemu-iotests/1021
-rwxr-xr-xtests/qemu-iotests/1031
-rwxr-xr-xtests/qemu-iotests/1041
-rwxr-xr-xtests/qemu-iotests/1051
-rwxr-xr-xtests/qemu-iotests/1071
-rwxr-xr-xtests/qemu-iotests/1101
-rwxr-xr-xtests/qemu-iotests/1111
-rwxr-xr-xtests/qemu-iotests/1121
-rwxr-xr-xtests/qemu-iotests/1141
-rwxr-xr-xtests/qemu-iotests/1151
-rwxr-xr-xtests/qemu-iotests/1171
-rwxr-xr-xtests/qemu-iotests/1201
-rwxr-xr-xtests/qemu-iotests/1251
-rwxr-xr-xtests/qemu-iotests/1261
-rwxr-xr-xtests/qemu-iotests/1271
-rwxr-xr-xtests/qemu-iotests/1331
-rwxr-xr-xtests/qemu-iotests/1341
-rwxr-xr-xtests/qemu-iotests/1421
-rwxr-xr-xtests/qemu-iotests/1431
-rwxr-xr-xtests/qemu-iotests/1441
-rwxr-xr-xtests/qemu-iotests/1451
-rwxr-xr-xtests/qemu-iotests/1531
-rwxr-xr-xtests/qemu-iotests/1561
-rwxr-xr-xtests/qemu-iotests/1571
-rwxr-xr-xtests/qemu-iotests/1581
-rwxr-xr-xtests/qemu-iotests/1591
-rwxr-xr-xtests/qemu-iotests/1621
-rwxr-xr-xtests/qemu-iotests/1701
-rwxr-xr-xtests/qemu-iotests/1731
-rwxr-xr-xtests/qemu-iotests/1821
-rwxr-xr-xtests/qemu-iotests/1831
-rwxr-xr-xtests/qemu-iotests/1861
-rwxr-xr-xtests/qemu-iotests/1871
-rwxr-xr-xtests/qemu-iotests/1901
-rwxr-xr-xtests/qemu-iotests/1911
-rwxr-xr-xtests/qemu-iotests/1921
-rwxr-xr-xtests/qemu-iotests/1951
-rwxr-xr-xtests/qemu-iotests/1971
-rwxr-xr-xtests/qemu-iotests/2001
-rwxr-xr-xtests/qemu-iotests/2141
-rwxr-xr-xtests/qemu-iotests/2151
-rwxr-xr-xtests/qemu-iotests/2171
-rwxr-xr-xtests/qemu-iotests/2271
-rwxr-xr-xtests/qemu-iotests/2311
-rwxr-xr-xtests/qemu-iotests/2331
-rwxr-xr-xtests/qemu-iotests/2392
-rwxr-xr-xtests/qemu-iotests/2403
-rwxr-xr-xtests/qemu-iotests/2412
-rwxr-xr-xtests/qemu-iotests/2432
-rwxr-xr-xtests/qemu-iotests/2442
-rwxr-xr-xtests/qemu-iotests/2471
-rwxr-xr-xtests/qemu-iotests/check13
-rw-r--r--tests/qom-test.c28
-rw-r--r--tests/tcg/xtensa/test_exclusive.S48
127 files changed, 2767 insertions, 1478 deletions
diff --git a/.cirrus.yml b/.cirrus.yml
index 47ef5bc604..8326a3a4b1 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -7,7 +7,7 @@ freebsd_12_task:
     cpu: 8
     memory: 8G
   install_script: pkg install -y
-    bison curl cyrus-sasl git glib gmake gnutls
+    bash bison curl cyrus-sasl git glib gmake gnutls gsed
     nettle perl5 pixman pkgconf png usbredir
   script:
     - mkdir build
@@ -20,7 +20,7 @@ macos_task:
   osx_instance:
     image: mojave-base
   install_script:
-    - brew install pkg-config python glib pixman make sdl2
+    - brew install pkg-config python gnu-sed glib pixman make sdl2
   script:
     - ./configure --python=/usr/local/bin/python3 || { cat config.log; exit 1; }
     - gmake -j$(sysctl -n hw.ncpu)
diff --git a/.travis.yml b/.travis.yml
index 66448d99d6..6fd89b3d91 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -42,6 +42,7 @@ addons:
     packages:
       - glib
       - pixman
+      - gnu-sed
 
 
 # The channel name "irc.oftc.net#qemu" is encrypted against qemu/qemu
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index da1236377e..c79dc75bfe 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -78,11 +78,11 @@ static void xtensa_cpu_reset(CPUState *s)
     env->sregs[VECBASE] = env->config->vecbase;
     env->sregs[IBREAKENABLE] = 0;
     env->sregs[MEMCTL] = MEMCTL_IL0EN & env->config->memctl_mask;
-    env->sregs[CACHEATTR] = 0x22222222;
     env->sregs[ATOMCTL] = xtensa_option_enabled(env->config,
             XTENSA_OPTION_ATOMCTL) ? 0x28 : 0x15;
     env->sregs[CONFIGID0] = env->config->configid[0];
     env->sregs[CONFIGID1] = env->config->configid[1];
+    env->exclusive_addr = -1;
 
 #ifndef CONFIG_USER_ONLY
     reset_mmu(env);
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index 68d89f8faf..a0df46f73b 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -99,6 +99,7 @@ enum {
     /* Memory protection and translation */
     XTENSA_OPTION_REGION_PROTECTION,
     XTENSA_OPTION_REGION_TRANSLATION,
+    XTENSA_OPTION_MPU,
     XTENSA_OPTION_MMU,
     XTENSA_OPTION_CACHEATTR,
 
@@ -137,13 +138,23 @@ enum {
     PTEVADDR = 83,
     MMID = 89,
     RASID = 90,
+    MPUENB = 90,
     ITLBCFG = 91,
     DTLBCFG = 92,
+    MPUCFG = 92,
+    ERACCESS = 95,
     IBREAKENABLE = 96,
     MEMCTL = 97,
     CACHEATTR = 98,
+    CACHEADRDIS = 98,
     ATOMCTL = 99,
     DDR = 104,
+    MEPC = 106,
+    MEPS = 107,
+    MESAVE = 108,
+    MESR = 109,
+    MECR = 110,
+    MEVADDR = 111,
     IBREAKA = 128,
     DBREAKA = 144,
     DBREAKC = 160,
@@ -228,6 +239,7 @@ enum {
 #define MAX_TLB_WAY_SIZE 8
 #define MAX_NDBREAK 2
 #define MAX_NMEMORY 4
+#define MAX_MPU_FOREGROUND_SEGMENTS 32
 
 #define REGION_PAGE_MASK 0xe0000000
 
@@ -268,14 +280,15 @@ enum {
     LEVEL1_INTERRUPT_CAUSE,
     ALLOCA_CAUSE,
     INTEGER_DIVIDE_BY_ZERO_CAUSE,
-    PRIVILEGED_CAUSE = 8,
+    PC_VALUE_ERROR_CAUSE,
+    PRIVILEGED_CAUSE,
     LOAD_STORE_ALIGNMENT_CAUSE,
-
-    INSTR_PIF_DATA_ERROR_CAUSE = 12,
+    EXTERNAL_REG_PRIVILEGE_CAUSE,
+    EXCLUSIVE_ERROR_CAUSE,
+    INSTR_PIF_DATA_ERROR_CAUSE,
     LOAD_STORE_PIF_DATA_ERROR_CAUSE,
     INSTR_PIF_ADDR_ERROR_CAUSE,
     LOAD_STORE_PIF_ADDR_ERROR_CAUSE,
-
     INST_TLB_MISS_CAUSE,
     INST_TLB_MULTI_HIT_CAUSE,
     INST_FETCH_PRIVILEGE_CAUSE,
@@ -298,6 +311,9 @@ typedef enum {
     INTTYPE_DEBUG,
     INTTYPE_WRITE_ERR,
     INTTYPE_PROFILING,
+    INTTYPE_IDMA_DONE,
+    INTTYPE_IDMA_ERR,
+    INTTYPE_GS_ERR,
     INTTYPE_MAX
 } interrupt_type;
 
@@ -318,6 +334,11 @@ typedef struct xtensa_tlb {
     unsigned nrefillentries;
 } xtensa_tlb;
 
+typedef struct xtensa_mpu_entry {
+    uint32_t vaddr;
+    uint32_t attr;
+} xtensa_mpu_entry;
+
 typedef struct XtensaGdbReg {
     int targno;
     unsigned flags;
@@ -446,6 +467,7 @@ struct XtensaConfig {
 
     unsigned icache_ways;
     unsigned dcache_ways;
+    unsigned dcache_line_bytes;
     uint32_t memctl_mask;
 
     XtensaMemory instrom;
@@ -468,6 +490,11 @@ struct XtensaConfig {
 
     xtensa_tlb itlb;
     xtensa_tlb dtlb;
+
+    uint32_t mpu_align;
+    unsigned n_mpu_fg_segments;
+    unsigned n_mpu_bg_segments;
+    const xtensa_mpu_entry *mpu_bg;
 };
 
 typedef struct XtensaConfigList {
@@ -500,10 +527,13 @@ typedef struct CPUXtensaState {
     } fregs[16];
     float_status fp_status;
     uint32_t windowbase_next;
+    uint32_t exclusive_addr;
+    uint32_t exclusive_val;
 
 #ifndef CONFIG_USER_ONLY
     xtensa_tlb_entry itlb[7][MAX_TLB_WAY_SIZE];
     xtensa_tlb_entry dtlb[10][MAX_TLB_WAY_SIZE];
+    xtensa_mpu_entry mpu_fg[MAX_MPU_FOREGROUND_SEGMENTS];
     unsigned autorefill_idx;
     bool runstall;
     AddressSpace *address_space_er;
@@ -590,6 +620,7 @@ void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
 #define XTENSA_DEFAULT_CPU_NOMMU_TYPE \
     XTENSA_CPU_TYPE_NAME(XTENSA_DEFAULT_CPU_NOMMU_MODEL)
 
+void xtensa_collect_sr_names(const XtensaConfig *config);
 void xtensa_translate_init(void);
 void **xtensa_get_regfile_by_name(const char *name);
 void xtensa_breakpoint_handler(CPUState *cs);
@@ -658,17 +689,6 @@ static inline int xtensa_get_cring(const CPUXtensaState *env)
 }
 
 #ifndef CONFIG_USER_ONLY
-uint32_t xtensa_tlb_get_addr_mask(const CPUXtensaState *env,
-                                  bool dtlb, uint32_t way);
-void split_tlb_entry_spec_way(const CPUXtensaState *env, uint32_t v, bool dtlb,
-        uint32_t *vpn, uint32_t wi, uint32_t *ei);
-int xtensa_tlb_lookup(const CPUXtensaState *env, uint32_t addr, bool dtlb,
-        uint32_t *pwi, uint32_t *pei, uint8_t *pring);
-void xtensa_tlb_set_entry_mmu(const CPUXtensaState *env,
-        xtensa_tlb_entry *entry, bool dtlb,
-        unsigned wi, unsigned ei, uint32_t vpn, uint32_t pte);
-void xtensa_tlb_set_entry(CPUXtensaState *env, bool dtlb,
-        unsigned wi, unsigned ei, uint32_t vpn, uint32_t pte);
 int xtensa_get_physical_addr(CPUXtensaState *env, bool update_tlb,
         uint32_t vaddr, int is_write, int mmu_idx,
         uint32_t *paddr, uint32_t *page_size, unsigned *access);
@@ -679,14 +699,6 @@ static inline MemoryRegion *xtensa_get_er_region(CPUXtensaState *env)
 {
     return env->system_er;
 }
-
-static inline xtensa_tlb_entry *xtensa_tlb_get_entry(CPUXtensaState *env,
-        bool dtlb, unsigned wi, unsigned ei)
-{
-    return dtlb ?
-        env->dtlb[wi] + ei :
-        env->itlb[wi] + ei;
-}
 #endif
 
 static inline uint32_t xtensa_replicate_windowstart(CPUXtensaState *env)
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index efb966b3bf..f2d07e4a2f 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -141,6 +141,7 @@ static void init_libisa(XtensaConfig *config)
         }
 #endif
     }
+    xtensa_collect_sr_names(config);
 }
 
 static void xtensa_finalize_config(XtensaConfig *config)
diff --git a/target/xtensa/helper.h b/target/xtensa/helper.h
index 0b9ec670c8..8532de0b35 100644
--- a/target/xtensa/helper.h
+++ b/target/xtensa/helper.h
@@ -24,6 +24,7 @@ DEF_HELPER_1(check_interrupts, void, env)
 DEF_HELPER_2(intset, void, env, i32)
 DEF_HELPER_2(intclear, void, env, i32)
 DEF_HELPER_3(check_atomctl, void, env, i32, i32)
+DEF_HELPER_4(check_exclusive, void, env, i32, i32, i32)
 DEF_HELPER_2(wsr_memctl, void, env, i32)
 
 DEF_HELPER_2(itlb_hit_test, void, env, i32)
@@ -33,6 +34,11 @@ DEF_HELPER_FLAGS_3(rtlb1, TCG_CALL_NO_RWG_SE, i32, env, i32, i32)
 DEF_HELPER_3(itlb, void, env, i32, i32)
 DEF_HELPER_3(ptlb, i32, env, i32, i32)
 DEF_HELPER_4(wtlb, void, env, i32, i32, i32)
+DEF_HELPER_2(wsr_mpuenb, void, env, i32)
+DEF_HELPER_3(wptlb, void, env, i32, i32)
+DEF_HELPER_FLAGS_2(rptlb0, TCG_CALL_NO_RWG_SE, i32, env, i32)
+DEF_HELPER_FLAGS_2(rptlb1, TCG_CALL_NO_RWG_SE, i32, env, i32)
+DEF_HELPER_2(pptlb, i32, env, i32)
 
 DEF_HELPER_2(wsr_ibreakenable, void, env, i32)
 DEF_HELPER_3(wsr_ibreaka, void, env, i32, i32)
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index 79a10da231..cab39f687a 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -35,6 +35,31 @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 
+#define XTENSA_MPU_SEGMENT_MASK 0x0000001f
+#define XTENSA_MPU_ACC_RIGHTS_MASK 0x00000f00
+#define XTENSA_MPU_ACC_RIGHTS_SHIFT 8
+#define XTENSA_MPU_MEM_TYPE_MASK 0x001ff000
+#define XTENSA_MPU_MEM_TYPE_SHIFT 12
+#define XTENSA_MPU_ATTR_MASK 0x001fff00
+
+#define XTENSA_MPU_PROBE_B 0x40000000
+#define XTENSA_MPU_PROBE_V 0x80000000
+
+#define XTENSA_MPU_SYSTEM_TYPE_DEVICE 0x0001
+#define XTENSA_MPU_SYSTEM_TYPE_NC     0x0002
+#define XTENSA_MPU_SYSTEM_TYPE_C      0x0003
+#define XTENSA_MPU_SYSTEM_TYPE_MASK   0x0003
+
+#define XTENSA_MPU_TYPE_SYS_C     0x0010
+#define XTENSA_MPU_TYPE_SYS_W     0x0020
+#define XTENSA_MPU_TYPE_SYS_R     0x0040
+#define XTENSA_MPU_TYPE_CPU_C     0x0100
+#define XTENSA_MPU_TYPE_CPU_W     0x0200
+#define XTENSA_MPU_TYPE_CPU_R     0x0400
+#define XTENSA_MPU_TYPE_CPU_CACHE 0x0800
+#define XTENSA_MPU_TYPE_B         0x1000
+#define XTENSA_MPU_TYPE_INT       0x2000
+
 void HELPER(itlb_hit_test)(CPUXtensaState *env, uint32_t vaddr)
 {
     /*
@@ -78,8 +103,8 @@ static uint32_t get_page_size(const CPUXtensaState *env,
 /*!
  * Get bit mask for the virtual address bits translated by the TLB way
  */
-uint32_t xtensa_tlb_get_addr_mask(const CPUXtensaState *env,
-                                  bool dtlb, uint32_t way)
+static uint32_t xtensa_tlb_get_addr_mask(const CPUXtensaState *env,
+                                         bool dtlb, uint32_t way)
 {
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
         bool varway56 = dtlb ?
@@ -145,8 +170,9 @@ static uint32_t get_vpn_mask(const CPUXtensaState *env, bool dtlb, uint32_t way)
  * Split virtual address into VPN (with index) and entry index
  * for the given TLB way
  */
-void split_tlb_entry_spec_way(const CPUXtensaState *env, uint32_t v, bool dtlb,
-        uint32_t *vpn, uint32_t wi, uint32_t *ei)
+static void split_tlb_entry_spec_way(const CPUXtensaState *env, uint32_t v,
+                                     bool dtlb, uint32_t *vpn,
+                                     uint32_t wi, uint32_t *ei)
 {
     bool varway56 = dtlb ?
         env->config->dtlb.varway56 :
@@ -213,6 +239,14 @@ static void split_tlb_entry_spec(CPUXtensaState *env, uint32_t v, bool dtlb,
     }
 }
 
+static xtensa_tlb_entry *xtensa_tlb_get_entry(CPUXtensaState *env, bool dtlb,
+                                              unsigned wi, unsigned ei)
+{
+    return dtlb ?
+        env->dtlb[wi] + ei :
+        env->itlb[wi] + ei;
+}
+
 static xtensa_tlb_entry *get_tlb_entry(CPUXtensaState *env,
         uint32_t v, bool dtlb, uint32_t *pwi)
 {
@@ -227,65 +261,10 @@ static xtensa_tlb_entry *get_tlb_entry(CPUXtensaState *env,
     return xtensa_tlb_get_entry(env, dtlb, wi, ei);
 }
 
-uint32_t HELPER(rtlb0)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
-{
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
-        uint32_t wi;
-        const xtensa_tlb_entry *entry = get_tlb_entry(env, v, dtlb, &wi);
-        return (entry->vaddr & get_vpn_mask(env, dtlb, wi)) | entry->asid;
-    } else {
-        return v & REGION_PAGE_MASK;
-    }
-}
-
-uint32_t HELPER(rtlb1)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
-{
-    const xtensa_tlb_entry *entry = get_tlb_entry(env, v, dtlb, NULL);
-    return entry->paddr | entry->attr;
-}
-
-void HELPER(itlb)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
-{
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
-        uint32_t wi;
-        xtensa_tlb_entry *entry = get_tlb_entry(env, v, dtlb, &wi);
-        if (entry->variable && entry->asid) {
-            tlb_flush_page(CPU(xtensa_env_get_cpu(env)), entry->vaddr);
-            entry->asid = 0;
-        }
-    }
-}
-
-uint32_t HELPER(ptlb)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
-{
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
-        uint32_t wi;
-        uint32_t ei;
-        uint8_t ring;
-        int res = xtensa_tlb_lookup(env, v, dtlb, &wi, &ei, &ring);
-
-        switch (res) {
-        case 0:
-            if (ring >= xtensa_get_ring(env)) {
-                return (v & 0xfffff000) | wi | (dtlb ? 0x10 : 0x8);
-            }
-            break;
-
-        case INST_TLB_MULTI_HIT_CAUSE:
-        case LOAD_STORE_TLB_MULTI_HIT_CAUSE:
-            HELPER(exception_cause_vaddr)(env, env->pc, res, v);
-            break;
-        }
-        return 0;
-    } else {
-        return (v & REGION_PAGE_MASK) | 0x1;
-    }
-}
-
-void xtensa_tlb_set_entry_mmu(const CPUXtensaState *env,
-                              xtensa_tlb_entry *entry, bool dtlb,
-                              unsigned wi, unsigned ei, uint32_t vpn,
-                              uint32_t pte)
+static void xtensa_tlb_set_entry_mmu(const CPUXtensaState *env,
+                                     xtensa_tlb_entry *entry, bool dtlb,
+                                     unsigned wi, unsigned ei, uint32_t vpn,
+                                     uint32_t pte)
 {
     entry->vaddr = vpn;
     entry->paddr = pte & xtensa_tlb_get_addr_mask(env, dtlb, wi);
@@ -293,8 +272,9 @@ void xtensa_tlb_set_entry_mmu(const CPUXtensaState *env,
     entry->attr = pte & 0xf;
 }
 
-void xtensa_tlb_set_entry(CPUXtensaState *env, bool dtlb,
-                          unsigned wi, unsigned ei, uint32_t vpn, uint32_t pte)
+static void xtensa_tlb_set_entry(CPUXtensaState *env, bool dtlb,
+                                 unsigned wi, unsigned ei,
+                                 uint32_t vpn, uint32_t pte)
 {
     XtensaCPU *cpu = xtensa_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
@@ -322,15 +302,6 @@ void xtensa_tlb_set_entry(CPUXtensaState *env, bool dtlb,
     }
 }
 
-void HELPER(wtlb)(CPUXtensaState *env, uint32_t p, uint32_t v, uint32_t dtlb)
-{
-    uint32_t vpn;
-    uint32_t wi;
-    uint32_t ei;
-    split_tlb_entry_spec(env, v, dtlb, &vpn, &wi, &ei);
-    xtensa_tlb_set_entry(env, dtlb, wi, ei, vpn, p);
-}
-
 hwaddr xtensa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
     XtensaCPU *cpu = XTENSA_CPU(cs);
@@ -436,7 +407,20 @@ void reset_mmu(CPUXtensaState *env)
         reset_tlb_mmu_all_ways(env, &env->config->dtlb, env->dtlb);
         reset_tlb_mmu_ways56(env, &env->config->itlb, env->itlb);
         reset_tlb_mmu_ways56(env, &env->config->dtlb, env->dtlb);
+    } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_MPU)) {
+        unsigned i;
+
+        env->sregs[MPUENB] = 0;
+        env->sregs[MPUCFG] = env->config->n_mpu_fg_segments;
+        env->sregs[CACHEADRDIS] = 0;
+        assert(env->config->n_mpu_bg_segments > 0 &&
+               env->config->mpu_bg[0].vaddr == 0);
+        for (i = 1; i < env->config->n_mpu_bg_segments; ++i) {
+            assert(env->config->mpu_bg[i].vaddr >=
+                   env->config->mpu_bg[i - 1].vaddr);
+        }
     } else {
+        env->sregs[CACHEATTR] = 0x22222222;
         reset_tlb_region_way0(env, env->itlb);
         reset_tlb_region_way0(env, env->dtlb);
     }
@@ -462,8 +446,9 @@ static unsigned get_ring(const CPUXtensaState *env, uint8_t asid)
  * \param pring: [out] access ring
  * \return 0 if ok, exception cause code otherwise
  */
-int xtensa_tlb_lookup(const CPUXtensaState *env, uint32_t addr, bool dtlb,
-                      uint32_t *pwi, uint32_t *pei, uint8_t *pring)
+static int xtensa_tlb_lookup(const CPUXtensaState *env,
+                             uint32_t addr, bool dtlb,
+                             uint32_t *pwi, uint32_t *pei, uint8_t *pring)
 {
     const xtensa_tlb *tlb = dtlb ?
         &env->config->dtlb : &env->config->itlb;
@@ -495,6 +480,70 @@ int xtensa_tlb_lookup(const CPUXtensaState *env, uint32_t addr, bool dtlb,
         (dtlb ? LOAD_STORE_TLB_MISS_CAUSE : INST_TLB_MISS_CAUSE);
 }
 
+uint32_t HELPER(rtlb0)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
+{
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
+        uint32_t wi;
+        const xtensa_tlb_entry *entry = get_tlb_entry(env, v, dtlb, &wi);
+        return (entry->vaddr & get_vpn_mask(env, dtlb, wi)) | entry->asid;
+    } else {
+        return v & REGION_PAGE_MASK;
+    }
+}
+
+uint32_t HELPER(rtlb1)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
+{
+    const xtensa_tlb_entry *entry = get_tlb_entry(env, v, dtlb, NULL);
+    return entry->paddr | entry->attr;
+}
+
+void HELPER(itlb)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
+{
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
+        uint32_t wi;
+        xtensa_tlb_entry *entry = get_tlb_entry(env, v, dtlb, &wi);
+        if (entry->variable && entry->asid) {
+            tlb_flush_page(CPU(xtensa_env_get_cpu(env)), entry->vaddr);
+            entry->asid = 0;
+        }
+    }
+}
+
+uint32_t HELPER(ptlb)(CPUXtensaState *env, uint32_t v, uint32_t dtlb)
+{
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
+        uint32_t wi;
+        uint32_t ei;
+        uint8_t ring;
+        int res = xtensa_tlb_lookup(env, v, dtlb, &wi, &ei, &ring);
+
+        switch (res) {
+        case 0:
+            if (ring >= xtensa_get_ring(env)) {
+                return (v & 0xfffff000) | wi | (dtlb ? 0x10 : 0x8);
+            }
+            break;
+
+        case INST_TLB_MULTI_HIT_CAUSE:
+        case LOAD_STORE_TLB_MULTI_HIT_CAUSE:
+            HELPER(exception_cause_vaddr)(env, env->pc, res, v);
+            break;
+        }
+        return 0;
+    } else {
+        return (v & REGION_PAGE_MASK) | 0x1;
+    }
+}
+
+void HELPER(wtlb)(CPUXtensaState *env, uint32_t p, uint32_t v, uint32_t dtlb)
+{
+    uint32_t vpn;
+    uint32_t wi;
+    uint32_t ei;
+    split_tlb_entry_spec(env, v, dtlb, &vpn, &wi, &ei);
+    xtensa_tlb_set_entry(env, dtlb, wi, ei, vpn, p);
+}
+
 /*!
  * Convert MMU ATTR to PAGE_{READ,WRITE,EXEC} mask.
  * See ISA, 4.6.5.10
@@ -568,6 +617,149 @@ static unsigned cacheattr_attr_to_access(uint32_t attr)
     return access[attr & 0xf];
 }
 
+struct attr_pattern {
+    uint32_t mask;
+    uint32_t value;
+};
+
+static int attr_pattern_match(uint32_t attr,
+                              const struct attr_pattern *pattern,
+                              size_t n)
+{
+    size_t i;
+
+    for (i = 0; i < n; ++i) {
+        if ((attr & pattern[i].mask) == pattern[i].value) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+static unsigned mpu_attr_to_cpu_cache(uint32_t attr)
+{
+    static const struct attr_pattern cpu_c[] = {
+        { .mask = 0x18f, .value = 0x089 },
+        { .mask = 0x188, .value = 0x080 },
+        { .mask = 0x180, .value = 0x180 },
+    };
+
+    unsigned type = 0;
+
+    if (attr_pattern_match(attr, cpu_c, ARRAY_SIZE(cpu_c))) {
+        type |= XTENSA_MPU_TYPE_CPU_CACHE;
+        if (attr & 0x10) {
+            type |= XTENSA_MPU_TYPE_CPU_C;
+        }
+        if (attr & 0x20) {
+            type |= XTENSA_MPU_TYPE_CPU_W;
+        }
+        if (attr & 0x40) {
+            type |= XTENSA_MPU_TYPE_CPU_R;
+        }
+    }
+    return type;
+}
+
+static unsigned mpu_attr_to_type(uint32_t attr)
+{
+    static const struct attr_pattern device_type[] = {
+        { .mask = 0x1f6, .value = 0x000 },
+        { .mask = 0x1f6, .value = 0x006 },
+    };
+    static const struct attr_pattern sys_nc_type[] = {
+        { .mask = 0x1fe, .value = 0x018 },
+        { .mask = 0x1fe, .value = 0x01e },
+        { .mask = 0x18f, .value = 0x089 },
+    };
+    static const struct attr_pattern sys_c_type[] = {
+        { .mask = 0x1f8, .value = 0x010 },
+        { .mask = 0x188, .value = 0x080 },
+        { .mask = 0x1f0, .value = 0x030 },
+        { .mask = 0x180, .value = 0x180 },
+    };
+    static const struct attr_pattern b[] = {
+        { .mask = 0x1f7, .value = 0x001 },
+        { .mask = 0x1f7, .value = 0x007 },
+        { .mask = 0x1ff, .value = 0x019 },
+        { .mask = 0x1ff, .value = 0x01f },
+    };
+
+    unsigned type = 0;
+
+    attr = (attr & XTENSA_MPU_MEM_TYPE_MASK) >> XTENSA_MPU_MEM_TYPE_SHIFT;
+    if (attr_pattern_match(attr, device_type, ARRAY_SIZE(device_type))) {
+        type |= XTENSA_MPU_SYSTEM_TYPE_DEVICE;
+        if (attr & 0x80) {
+            type |= XTENSA_MPU_TYPE_INT;
+        }
+    }
+    if (attr_pattern_match(attr, sys_nc_type, ARRAY_SIZE(sys_nc_type))) {
+        type |= XTENSA_MPU_SYSTEM_TYPE_NC;
+    }
+    if (attr_pattern_match(attr, sys_c_type, ARRAY_SIZE(sys_c_type))) {
+        type |= XTENSA_MPU_SYSTEM_TYPE_C;
+        if (attr & 0x1) {
+            type |= XTENSA_MPU_TYPE_SYS_C;
+        }
+        if (attr & 0x2) {
+            type |= XTENSA_MPU_TYPE_SYS_W;
+        }
+        if (attr & 0x4) {
+            type |= XTENSA_MPU_TYPE_SYS_R;
+        }
+    }
+    if (attr_pattern_match(attr, b, ARRAY_SIZE(b))) {
+        type |= XTENSA_MPU_TYPE_B;
+    }
+    type |= mpu_attr_to_cpu_cache(attr);
+
+    return type;
+}
+
+static unsigned mpu_attr_to_access(uint32_t attr, unsigned ring)
+{
+    static const unsigned access[2][16] = {
+        [0] = {
+             [4] = PAGE_READ,
+             [5] = PAGE_READ              | PAGE_EXEC,
+             [6] = PAGE_READ | PAGE_WRITE,
+             [7] = PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+             [8] =             PAGE_WRITE,
+             [9] = PAGE_READ | PAGE_WRITE,
+            [10] = PAGE_READ | PAGE_WRITE,
+            [11] = PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+            [12] = PAGE_READ,
+            [13] = PAGE_READ              | PAGE_EXEC,
+            [14] = PAGE_READ | PAGE_WRITE,
+            [15] = PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+        },
+        [1] = {
+             [8] =             PAGE_WRITE,
+             [9] = PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+            [10] = PAGE_READ,
+            [11] = PAGE_READ              | PAGE_EXEC,
+            [12] = PAGE_READ,
+            [13] = PAGE_READ              | PAGE_EXEC,
+            [14] = PAGE_READ | PAGE_WRITE,
+            [15] = PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+        },
+    };
+    unsigned rv;
+    unsigned type;
+
+    type = mpu_attr_to_cpu_cache(attr);
+    rv = access[ring != 0][(attr & XTENSA_MPU_ACC_RIGHTS_MASK) >>
+        XTENSA_MPU_ACC_RIGHTS_SHIFT];
+
+    if (type & XTENSA_MPU_TYPE_CPU_CACHE) {
+        rv |= (type & XTENSA_MPU_TYPE_CPU_C) ? PAGE_CACHE_WB : PAGE_CACHE_WT;
+    } else {
+        rv |= PAGE_CACHE_BYPASS;
+    }
+    return rv;
+}
+
 static bool is_access_granted(unsigned access, int is_write)
 {
     switch (is_write) {
@@ -712,6 +904,129 @@ static int get_physical_addr_region(CPUXtensaState *env,
     return 0;
 }
 
+static int xtensa_mpu_lookup(const xtensa_mpu_entry *entry, unsigned n,
+                             uint32_t vaddr, unsigned *segment)
+{
+    unsigned nhits = 0;
+    unsigned i;
+
+    for (i = 0; i < n; ++i) {
+        if (vaddr >= entry[i].vaddr &&
+            (i == n - 1 || vaddr < entry[i + 1].vaddr)) {
+            if (nhits++) {
+                break;
+            }
+            *segment = i;
+        }
+    }
+    return nhits;
+}
+
+void HELPER(wsr_mpuenb)(CPUXtensaState *env, uint32_t v)
+{
+    XtensaCPU *cpu = xtensa_env_get_cpu(env);
+
+    v &= (2u << (env->config->n_mpu_fg_segments - 1)) - 1;
+
+    if (v != env->sregs[MPUENB]) {
+        env->sregs[MPUENB] = v;
+        tlb_flush(CPU(cpu));
+    }
+}
+
+void HELPER(wptlb)(CPUXtensaState *env, uint32_t p, uint32_t v)
+{
+    unsigned segment = p & XTENSA_MPU_SEGMENT_MASK;
+
+    if (segment < env->config->n_mpu_fg_segments) {
+        env->mpu_fg[segment].vaddr = v & -env->config->mpu_align;
+        env->mpu_fg[segment].attr = p & XTENSA_MPU_ATTR_MASK;
+        env->sregs[MPUENB] = deposit32(env->sregs[MPUENB], segment, 1, v);
+        tlb_flush(CPU(xtensa_env_get_cpu(env)));
+    }
+}
+
+uint32_t HELPER(rptlb0)(CPUXtensaState *env, uint32_t s)
+{
+    unsigned segment = s & XTENSA_MPU_SEGMENT_MASK;
+
+    if (segment < env->config->n_mpu_fg_segments) {
+        return env->mpu_fg[segment].vaddr |
+            extract32(env->sregs[MPUENB], segment, 1);
+    } else {
+        return 0;
+    }
+}
+
+uint32_t HELPER(rptlb1)(CPUXtensaState *env, uint32_t s)
+{
+    unsigned segment = s & XTENSA_MPU_SEGMENT_MASK;
+
+    if (segment < env->config->n_mpu_fg_segments) {
+        return env->mpu_fg[segment].attr;
+    } else {
+        return 0;
+    }
+}
+
+uint32_t HELPER(pptlb)(CPUXtensaState *env, uint32_t v)
+{
+    unsigned nhits;
+    unsigned segment = XTENSA_MPU_PROBE_B;
+    unsigned bg_segment;
+
+    nhits = xtensa_mpu_lookup(env->mpu_fg, env->config->n_mpu_fg_segments,
+                              v, &segment);
+    if (nhits > 1) {
+        HELPER(exception_cause_vaddr)(env, env->pc,
+                                      LOAD_STORE_TLB_MULTI_HIT_CAUSE, v);
+    } else if (nhits == 1 && (env->sregs[MPUENB] & (1u << segment))) {
+        return env->mpu_fg[segment].attr | segment | XTENSA_MPU_PROBE_V;
+    } else {
+        xtensa_mpu_lookup(env->config->mpu_bg,
+                          env->config->n_mpu_bg_segments,
+                          v, &bg_segment);
+        return env->config->mpu_bg[bg_segment].attr | segment;
+    }
+}
+
+static int get_physical_addr_mpu(CPUXtensaState *env,
+                                 uint32_t vaddr, int is_write, int mmu_idx,
+                                 uint32_t *paddr, uint32_t *page_size,
+                                 unsigned *access)
+{
+    unsigned nhits;
+    unsigned segment;
+    uint32_t attr;
+
+    nhits = xtensa_mpu_lookup(env->mpu_fg, env->config->n_mpu_fg_segments,
+                              vaddr, &segment);
+    if (nhits > 1) {
+        return is_write < 2 ?
+            LOAD_STORE_TLB_MULTI_HIT_CAUSE :
+            INST_TLB_MULTI_HIT_CAUSE;
+    } else if (nhits == 1 && (env->sregs[MPUENB] & (1u << segment))) {
+        attr = env->mpu_fg[segment].attr;
+    } else {
+        xtensa_mpu_lookup(env->config->mpu_bg,
+                          env->config->n_mpu_bg_segments,
+                          vaddr, &segment);
+        attr = env->config->mpu_bg[segment].attr;
+    }
+
+    *access = mpu_attr_to_access(attr, mmu_idx);
+    if (!is_access_granted(*access, is_write)) {
+        return is_write < 2 ?
+            (is_write ?
+             STORE_PROHIBITED_CAUSE :
+             LOAD_PROHIBITED_CAUSE) :
+            INST_FETCH_PROHIBITED_CAUSE;
+    }
+    *paddr = vaddr;
+    *page_size = env->config->mpu_align;
+    return 0;
+}
+
 /*!
  * Convert virtual address to physical addr.
  * MMU may issue pagewalk and change xtensa autorefill TLB way entry.
@@ -732,6 +1047,9 @@ int xtensa_get_physical_addr(CPUXtensaState *env, bool update_tlb,
                 XTENSA_OPTION_BIT(XTENSA_OPTION_REGION_TRANSLATION))) {
         return get_physical_addr_region(env, vaddr, is_write, mmu_idx,
                                         paddr, page_size, access);
+    } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_MPU)) {
+        return get_physical_addr_mpu(env, vaddr, is_write, mmu_idx,
+                                     paddr, page_size, access);
     } else {
         *paddr = vaddr;
         *page_size = TARGET_PAGE_SIZE;
@@ -799,6 +1117,63 @@ static void dump_tlb(CPUXtensaState *env, bool dtlb)
     }
 }
 
+static void dump_mpu(CPUXtensaState *env,
+                     const xtensa_mpu_entry *entry, unsigned n)
+{
+    unsigned i;
+
+    qemu_printf("\t%s  Vaddr       Attr        Ring0  Ring1  System Type    CPU cache\n"
+                "\t%s  ----------  ----------  -----  -----  -------------  ---------\n",
+                env ? "En" : "  ",
+                env ? "--" : "  ");
+
+    for (i = 0; i < n; ++i) {
+        uint32_t attr = entry[i].attr;
+        unsigned access0 = mpu_attr_to_access(attr, 0);
+        unsigned access1 = mpu_attr_to_access(attr, 1);
+        unsigned type = mpu_attr_to_type(attr);
+        char cpu_cache = (type & XTENSA_MPU_TYPE_CPU_CACHE) ? '-' : ' ';
+
+        qemu_printf("\t %c  0x%08x  0x%08x   %c%c%c    %c%c%c   ",
+                    env ?
+                    ((env->sregs[MPUENB] & (1u << i)) ? '+' : '-') : ' ',
+                    entry[i].vaddr, attr,
+                    (access0 & PAGE_READ) ? 'R' : '-',
+                    (access0 & PAGE_WRITE) ? 'W' : '-',
+                    (access0 & PAGE_EXEC) ? 'X' : '-',
+                    (access1 & PAGE_READ) ? 'R' : '-',
+                    (access1 & PAGE_WRITE) ? 'W' : '-',
+                    (access1 & PAGE_EXEC) ? 'X' : '-');
+
+        switch (type & XTENSA_MPU_SYSTEM_TYPE_MASK) {
+        case XTENSA_MPU_SYSTEM_TYPE_DEVICE:
+            qemu_printf("Device %cB %3s\n",
+                        (type & XTENSA_MPU_TYPE_B) ? ' ' : 'n',
+                        (type & XTENSA_MPU_TYPE_INT) ? "int" : "");
+            break;
+        case XTENSA_MPU_SYSTEM_TYPE_NC:
+            qemu_printf("Sys NC %cB      %c%c%c\n",
+                        (type & XTENSA_MPU_TYPE_B) ? ' ' : 'n',
+                        (type & XTENSA_MPU_TYPE_CPU_R) ? 'r' : cpu_cache,
+                        (type & XTENSA_MPU_TYPE_CPU_W) ? 'w' : cpu_cache,
+                        (type & XTENSA_MPU_TYPE_CPU_C) ? 'c' : cpu_cache);
+            break;
+        case XTENSA_MPU_SYSTEM_TYPE_C:
+            qemu_printf("Sys  C %c%c%c     %c%c%c\n",
+                        (type & XTENSA_MPU_TYPE_SYS_R) ? 'R' : '-',
+                        (type & XTENSA_MPU_TYPE_SYS_W) ? 'W' : '-',
+                        (type & XTENSA_MPU_TYPE_SYS_C) ? 'C' : '-',
+                        (type & XTENSA_MPU_TYPE_CPU_R) ? 'r' : cpu_cache,
+                        (type & XTENSA_MPU_TYPE_CPU_W) ? 'w' : cpu_cache,
+                        (type & XTENSA_MPU_TYPE_CPU_C) ? 'c' : cpu_cache);
+            break;
+        default:
+            qemu_printf("Unknown\n");
+            break;
+        }
+    }
+}
+
 void dump_mmu(CPUXtensaState *env)
 {
     if (xtensa_option_bits_enabled(env->config,
@@ -810,6 +1185,11 @@ void dump_mmu(CPUXtensaState *env)
         dump_tlb(env, false);
         qemu_printf("\nDTLB:\n");
         dump_tlb(env, true);
+    } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_MPU)) {
+        qemu_printf("Foreground map:\n");
+        dump_mpu(env, env->mpu_fg, env->config->n_mpu_fg_segments);
+        qemu_printf("\nBackground map:\n");
+        dump_mpu(NULL, env->config->mpu_bg, env->config->n_mpu_bg_segments);
     } else {
         qemu_printf("No TLB for this CPU core\n");
     }
diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c
index 04971b044f..09f4962d00 100644
--- a/target/xtensa/op_helper.c
+++ b/target/xtensa/op_helper.c
@@ -130,6 +130,48 @@ void HELPER(check_atomctl)(CPUXtensaState *env, uint32_t pc, uint32_t vaddr)
     }
 }
 
+void HELPER(check_exclusive)(CPUXtensaState *env, uint32_t pc, uint32_t vaddr,
+                             uint32_t is_write)
+{
+    uint32_t paddr, page_size, access;
+    uint32_t atomctl = env->sregs[ATOMCTL];
+    int rc = xtensa_get_physical_addr(env, true, vaddr, is_write,
+                                      xtensa_get_cring(env), &paddr,
+                                      &page_size, &access);
+
+    if (rc) {
+        HELPER(exception_cause_vaddr)(env, pc, rc, vaddr);
+    }
+
+    /* When data cache is not configured use ATOMCTL bypass field. */
+    if (!xtensa_option_enabled(env->config, XTENSA_OPTION_DCACHE)) {
+        access = PAGE_CACHE_BYPASS;
+    }
+
+    switch (access & PAGE_CACHE_MASK) {
+    case PAGE_CACHE_WB:
+        atomctl >>= 2;
+        /* fall through */
+    case PAGE_CACHE_WT:
+        atomctl >>= 2;
+        /* fall through */
+    case PAGE_CACHE_BYPASS:
+        if ((atomctl & 0x3) == 0) {
+            HELPER(exception_cause_vaddr)(env, pc,
+                                          EXCLUSIVE_ERROR_CAUSE, vaddr);
+        }
+        break;
+
+    case PAGE_CACHE_ISOLATE:
+        HELPER(exception_cause_vaddr)(env, pc,
+                LOAD_STORE_ERROR_CAUSE, vaddr);
+        break;
+
+    default:
+        break;
+    }
+}
+
 void HELPER(wsr_memctl)(CPUXtensaState *env, uint32_t v)
 {
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_ICACHE)) {
diff --git a/target/xtensa/overlay_tool.h b/target/xtensa/overlay_tool.h
index ea07576bc9..f0cc33adfe 100644
--- a/target/xtensa/overlay_tool.h
+++ b/target/xtensa/overlay_tool.h
@@ -72,6 +72,14 @@
 #define XCHAL_HAVE_EXTERN_REGS 0
 #endif
 
+#ifndef XCHAL_HAVE_MPU
+#define XCHAL_HAVE_MPU 0
+#endif
+
+#ifndef XCHAL_HAVE_EXCLUSIVE
+#define XCHAL_HAVE_EXCLUSIVE 0
+#endif
+
 #define XCHAL_OPTION(xchal, qemu) ((xchal) ? XTENSA_OPTION_BIT(qemu) : 0)
 
 #define XTENSA_OPTIONS ( \
@@ -92,8 +100,8 @@
     XCHAL_OPTION(XCHAL_HAVE_FP, XTENSA_OPTION_FP_COPROCESSOR) | \
     XCHAL_OPTION(XCHAL_HAVE_RELEASE_SYNC, XTENSA_OPTION_MP_SYNCHRO) | \
     XCHAL_OPTION(XCHAL_HAVE_S32C1I, XTENSA_OPTION_CONDITIONAL_STORE) | \
-    XCHAL_OPTION(XCHAL_HAVE_S32C1I && XCHAL_HW_MIN_VERSION >= 230000, \
-        XTENSA_OPTION_ATOMCTL) | \
+    XCHAL_OPTION(((XCHAL_HAVE_S32C1I && XCHAL_HW_MIN_VERSION >= 230000) || \
+                  XCHAL_HAVE_EXCLUSIVE), XTENSA_OPTION_ATOMCTL) | \
     XCHAL_OPTION(XCHAL_HAVE_DEPBITS, XTENSA_OPTION_DEPBITS) | \
     /* Interrupts and exceptions */ \
     XCHAL_OPTION(XCHAL_HAVE_EXCEPTIONS, XTENSA_OPTION_EXCEPTION) | \
@@ -112,11 +120,14 @@
     XCHAL_OPTION(XCHAL_DCACHE_LINE_LOCKABLE, \
             XTENSA_OPTION_DCACHE_INDEX_LOCK) | \
     XCHAL_OPTION(XCHAL_UNALIGNED_LOAD_HW, XTENSA_OPTION_HW_ALIGNMENT) | \
+    XCHAL_OPTION(XCHAL_HAVE_MEM_ECC_PARITY, \
+                 XTENSA_OPTION_MEMORY_ECC_PARITY) | \
     /* Memory protection and translation */ \
     XCHAL_OPTION(XCHAL_HAVE_MIMIC_CACHEATTR, \
             XTENSA_OPTION_REGION_PROTECTION) | \
     XCHAL_OPTION(XCHAL_HAVE_XLT_CACHEATTR, \
             XTENSA_OPTION_REGION_TRANSLATION) | \
+    XCHAL_OPTION(XCHAL_HAVE_MPU, XTENSA_OPTION_MPU) | \
     XCHAL_OPTION(XCHAL_HAVE_PTP_MMU, XTENSA_OPTION_MMU) | \
     XCHAL_OPTION(XCHAL_HAVE_CACHEATTR, XTENSA_OPTION_CACHEATTR) | \
     /* Other, TODO */ \
@@ -200,6 +211,9 @@
 #define XTHAL_INTTYPE_TBD2 INTTYPE_WRITE_ERR
 #define XTHAL_INTTYPE_WRITE_ERROR INTTYPE_WRITE_ERR
 #define XTHAL_INTTYPE_PROFILING INTTYPE_PROFILING
+#define XTHAL_INTTYPE_IDMA_DONE INTTYPE_IDMA_DONE
+#define XTHAL_INTTYPE_IDMA_ERR INTTYPE_IDMA_ERR
+#define XTHAL_INTTYPE_GS_ERR INTTYPE_GS_ERR
 
 
 #define INTERRUPT(i) { \
@@ -356,6 +370,30 @@
 #define XCHAL_SYSRAM0_SIZE  0x04000000
 #endif
 
+#elif XCHAL_HAVE_MPU
+
+#ifndef XTENSA_MPU_BG_MAP
+#define XTENSA_MPU_BG_MAP (xtensa_mpu_entry []){\
+    { .vaddr = 0, .attr = 0x00006700, }, \
+}
+#endif
+
+#define TLB_SECTION \
+    .mpu_align = XCHAL_MPU_ALIGN, \
+    .n_mpu_fg_segments = XCHAL_MPU_ENTRIES, \
+    .n_mpu_bg_segments = 1, \
+    .mpu_bg = XTENSA_MPU_BG_MAP
+
+#ifndef XCHAL_SYSROM0_PADDR
+#define XCHAL_SYSROM0_PADDR 0x50000000
+#define XCHAL_SYSROM0_SIZE  0x04000000
+#endif
+
+#ifndef XCHAL_SYSRAM0_PADDR
+#define XCHAL_SYSRAM0_PADDR 0x60000000
+#define XCHAL_SYSRAM0_SIZE  0x04000000
+#endif
+
 #else
 
 #ifndef XCHAL_SYSROM0_PADDR
@@ -391,6 +429,7 @@
 #define CACHE_SECTION \
     .icache_ways = XCHAL_ICACHE_WAYS, \
     .dcache_ways = XCHAL_DCACHE_WAYS, \
+    .dcache_line_bytes = XCHAL_DCACHE_LINESIZE, \
     .memctl_mask = \
         (XCHAL_ICACHE_SIZE ? MEMCTL_IUSEWAYS_MASK : 0) | \
         (XCHAL_DCACHE_SIZE ? \
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index b063fa85f2..53dce470c1 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -87,133 +87,47 @@ static TCGv_i32 cpu_BR8[2];
 static TCGv_i32 cpu_SR[256];
 static TCGv_i32 cpu_UR[256];
 static TCGv_i32 cpu_windowbase_next;
+static TCGv_i32 cpu_exclusive_addr;
+static TCGv_i32 cpu_exclusive_val;
 
 static GHashTable *xtensa_regfile_table;
 
 #include "exec/gen-icount.h"
 
-typedef struct XtensaReg {
-    const char *name;
-    uint64_t opt_bits;
-    enum {
-        SR_R = 1,
-        SR_W = 2,
-        SR_X = 4,
-        SR_RW = 3,
-        SR_RWX = 7,
-    } access;
-} XtensaReg;
-
-#define XTENSA_REG_ACCESS(regname, opt, acc) { \
-        .name = (regname), \
-        .opt_bits = XTENSA_OPTION_BIT(opt), \
-        .access = (acc), \
-    }
+static char *sr_name[256];
+static char *ur_name[256];
 
-#define XTENSA_REG(regname, opt) XTENSA_REG_ACCESS(regname, opt, SR_RWX)
+void xtensa_collect_sr_names(const XtensaConfig *config)
+{
+    xtensa_isa isa = config->isa;
+    int n = xtensa_isa_num_sysregs(isa);
+    int i;
 
-#define XTENSA_REG_BITS_ACCESS(regname, opt, acc) { \
-        .name = (regname), \
-        .opt_bits = (opt), \
-        .access = (acc), \
+    for (i = 0; i < n; ++i) {
+        int sr = xtensa_sysreg_number(isa, i);
+
+        if (sr >= 0 && sr < 256) {
+            const char *name = xtensa_sysreg_name(isa, i);
+            char **pname =
+                (xtensa_sysreg_is_user(isa, i) ? ur_name : sr_name) + sr;
+
+            if (*pname) {
+                if (strstr(*pname, name) == NULL) {
+                    char *new_name =
+                        malloc(strlen(*pname) + strlen(name) + 2);
+
+                    strcpy(new_name, *pname);
+                    strcat(new_name, "/");
+                    strcat(new_name, name);
+                    free(*pname);
+                    *pname = new_name;
+                }
+            } else {
+                *pname = strdup(name);
+            }
+        }
     }
-
-#define XTENSA_REG_BITS(regname, opt) \
-    XTENSA_REG_BITS_ACCESS(regname, opt, SR_RWX)
-
-static const XtensaReg sregnames[256] = {
-    [LBEG] = XTENSA_REG("LBEG", XTENSA_OPTION_LOOP),
-    [LEND] = XTENSA_REG("LEND", XTENSA_OPTION_LOOP),
-    [LCOUNT] = XTENSA_REG("LCOUNT", XTENSA_OPTION_LOOP),
-    [SAR] = XTENSA_REG_BITS("SAR", XTENSA_OPTION_ALL),
-    [BR] = XTENSA_REG("BR", XTENSA_OPTION_BOOLEAN),
-    [LITBASE] = XTENSA_REG("LITBASE", XTENSA_OPTION_EXTENDED_L32R),
-    [SCOMPARE1] = XTENSA_REG("SCOMPARE1", XTENSA_OPTION_CONDITIONAL_STORE),
-    [ACCLO] = XTENSA_REG("ACCLO", XTENSA_OPTION_MAC16),
-    [ACCHI] = XTENSA_REG("ACCHI", XTENSA_OPTION_MAC16),
-    [MR] = XTENSA_REG("MR0", XTENSA_OPTION_MAC16),
-    [MR + 1] = XTENSA_REG("MR1", XTENSA_OPTION_MAC16),
-    [MR + 2] = XTENSA_REG("MR2", XTENSA_OPTION_MAC16),
-    [MR + 3] = XTENSA_REG("MR3", XTENSA_OPTION_MAC16),
-    [PREFCTL] = XTENSA_REG_BITS("PREFCTL", XTENSA_OPTION_ALL),
-    [WINDOW_BASE] = XTENSA_REG("WINDOW_BASE", XTENSA_OPTION_WINDOWED_REGISTER),
-    [WINDOW_START] = XTENSA_REG("WINDOW_START",
-            XTENSA_OPTION_WINDOWED_REGISTER),
-    [PTEVADDR] = XTENSA_REG("PTEVADDR", XTENSA_OPTION_MMU),
-    [MMID] = XTENSA_REG_BITS("MMID", XTENSA_OPTION_ALL),
-    [RASID] = XTENSA_REG("RASID", XTENSA_OPTION_MMU),
-    [ITLBCFG] = XTENSA_REG("ITLBCFG", XTENSA_OPTION_MMU),
-    [DTLBCFG] = XTENSA_REG("DTLBCFG", XTENSA_OPTION_MMU),
-    [IBREAKENABLE] = XTENSA_REG("IBREAKENABLE", XTENSA_OPTION_DEBUG),
-    [MEMCTL] = XTENSA_REG_BITS("MEMCTL", XTENSA_OPTION_ALL),
-    [CACHEATTR] = XTENSA_REG("CACHEATTR", XTENSA_OPTION_CACHEATTR),
-    [ATOMCTL] = XTENSA_REG("ATOMCTL", XTENSA_OPTION_ATOMCTL),
-    [DDR] = XTENSA_REG("DDR", XTENSA_OPTION_DEBUG),
-    [IBREAKA] = XTENSA_REG("IBREAKA0", XTENSA_OPTION_DEBUG),
-    [IBREAKA + 1] = XTENSA_REG("IBREAKA1", XTENSA_OPTION_DEBUG),
-    [DBREAKA] = XTENSA_REG("DBREAKA0", XTENSA_OPTION_DEBUG),
-    [DBREAKA + 1] = XTENSA_REG("DBREAKA1", XTENSA_OPTION_DEBUG),
-    [DBREAKC] = XTENSA_REG("DBREAKC0", XTENSA_OPTION_DEBUG),
-    [DBREAKC + 1] = XTENSA_REG("DBREAKC1", XTENSA_OPTION_DEBUG),
-    [CONFIGID0] = XTENSA_REG_BITS_ACCESS("CONFIGID0", XTENSA_OPTION_ALL, SR_R),
-    [EPC1] = XTENSA_REG("EPC1", XTENSA_OPTION_EXCEPTION),
-    [EPC1 + 1] = XTENSA_REG("EPC2", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPC1 + 2] = XTENSA_REG("EPC3", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPC1 + 3] = XTENSA_REG("EPC4", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPC1 + 4] = XTENSA_REG("EPC5", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPC1 + 5] = XTENSA_REG("EPC6", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPC1 + 6] = XTENSA_REG("EPC7", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [DEPC] = XTENSA_REG("DEPC", XTENSA_OPTION_EXCEPTION),
-    [EPS2] = XTENSA_REG("EPS2", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPS2 + 1] = XTENSA_REG("EPS3", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPS2 + 2] = XTENSA_REG("EPS4", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPS2 + 3] = XTENSA_REG("EPS5", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPS2 + 4] = XTENSA_REG("EPS6", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EPS2 + 5] = XTENSA_REG("EPS7", XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [CONFIGID1] = XTENSA_REG_BITS_ACCESS("CONFIGID1", XTENSA_OPTION_ALL, SR_R),
-    [EXCSAVE1] = XTENSA_REG("EXCSAVE1", XTENSA_OPTION_EXCEPTION),
-    [EXCSAVE1 + 1] = XTENSA_REG("EXCSAVE2",
-            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EXCSAVE1 + 2] = XTENSA_REG("EXCSAVE3",
-            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EXCSAVE1 + 3] = XTENSA_REG("EXCSAVE4",
-            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EXCSAVE1 + 4] = XTENSA_REG("EXCSAVE5",
-            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EXCSAVE1 + 5] = XTENSA_REG("EXCSAVE6",
-            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [EXCSAVE1 + 6] = XTENSA_REG("EXCSAVE7",
-            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT),
-    [CPENABLE] = XTENSA_REG("CPENABLE", XTENSA_OPTION_COPROCESSOR),
-    [INTSET] = XTENSA_REG_ACCESS("INTSET", XTENSA_OPTION_INTERRUPT, SR_RW),
-    [INTCLEAR] = XTENSA_REG_ACCESS("INTCLEAR", XTENSA_OPTION_INTERRUPT, SR_W),
-    [INTENABLE] = XTENSA_REG("INTENABLE", XTENSA_OPTION_INTERRUPT),
-    [PS] = XTENSA_REG_BITS("PS", XTENSA_OPTION_ALL),
-    [VECBASE] = XTENSA_REG("VECBASE", XTENSA_OPTION_RELOCATABLE_VECTOR),
-    [EXCCAUSE] = XTENSA_REG("EXCCAUSE", XTENSA_OPTION_EXCEPTION),
-    [DEBUGCAUSE] = XTENSA_REG_ACCESS("DEBUGCAUSE", XTENSA_OPTION_DEBUG, SR_R),
-    [CCOUNT] = XTENSA_REG("CCOUNT", XTENSA_OPTION_TIMER_INTERRUPT),
-    [PRID] = XTENSA_REG_ACCESS("PRID", XTENSA_OPTION_PROCESSOR_ID, SR_R),
-    [ICOUNT] = XTENSA_REG("ICOUNT", XTENSA_OPTION_DEBUG),
-    [ICOUNTLEVEL] = XTENSA_REG("ICOUNTLEVEL", XTENSA_OPTION_DEBUG),
-    [EXCVADDR] = XTENSA_REG("EXCVADDR", XTENSA_OPTION_EXCEPTION),
-    [CCOMPARE] = XTENSA_REG("CCOMPARE0", XTENSA_OPTION_TIMER_INTERRUPT),
-    [CCOMPARE + 1] = XTENSA_REG("CCOMPARE1",
-            XTENSA_OPTION_TIMER_INTERRUPT),
-    [CCOMPARE + 2] = XTENSA_REG("CCOMPARE2",
-            XTENSA_OPTION_TIMER_INTERRUPT),
-    [MISC] = XTENSA_REG("MISC0", XTENSA_OPTION_MISC_SR),
-    [MISC + 1] = XTENSA_REG("MISC1", XTENSA_OPTION_MISC_SR),
-    [MISC + 2] = XTENSA_REG("MISC2", XTENSA_OPTION_MISC_SR),
-    [MISC + 3] = XTENSA_REG("MISC3", XTENSA_OPTION_MISC_SR),
-};
-
-static const XtensaReg uregnames[256] = {
-    [EXPSTATE] = XTENSA_REG_BITS("EXPSTATE", XTENSA_OPTION_ALL),
-    [THREADPTR] = XTENSA_REG("THREADPTR", XTENSA_OPTION_THREAD_POINTER),
-    [FCR] = XTENSA_REG("FCR", XTENSA_OPTION_FP_COPROCESSOR),
-    [FSR] = XTENSA_REG("FSR", XTENSA_OPTION_FP_COPROCESSOR),
-};
+}
 
 void xtensa_translate_init(void)
 {
@@ -283,18 +197,20 @@ void xtensa_translate_init(void)
     }
 
     for (i = 0; i < 256; ++i) {
-        if (sregnames[i].name) {
+        if (sr_name[i]) {
             cpu_SR[i] = tcg_global_mem_new_i32(cpu_env,
-                    offsetof(CPUXtensaState, sregs[i]),
-                    sregnames[i].name);
+                                               offsetof(CPUXtensaState,
+                                                        sregs[i]),
+                                               sr_name[i]);
         }
     }
 
     for (i = 0; i < 256; ++i) {
-        if (uregnames[i].name) {
+        if (ur_name[i]) {
             cpu_UR[i] = tcg_global_mem_new_i32(cpu_env,
-                    offsetof(CPUXtensaState, uregs[i]),
-                    uregnames[i].name);
+                                               offsetof(CPUXtensaState,
+                                                        uregs[i]),
+                                               ur_name[i]);
         }
     }
 
@@ -302,6 +218,14 @@ void xtensa_translate_init(void)
         tcg_global_mem_new_i32(cpu_env,
                                offsetof(CPUXtensaState, windowbase_next),
                                "windowbase_next");
+    cpu_exclusive_addr =
+        tcg_global_mem_new_i32(cpu_env,
+                               offsetof(CPUXtensaState, exclusive_addr),
+                               "exclusive_addr");
+    cpu_exclusive_val =
+        tcg_global_mem_new_i32(cpu_env,
+                               offsetof(CPUXtensaState, exclusive_val),
+                               "exclusive_val");
 }
 
 void **xtensa_get_regfile_by_name(const char *name)
@@ -536,313 +460,57 @@ static void gen_brcondi(DisasContext *dc, TCGCond cond,
     tcg_temp_free(tmp);
 }
 
-static bool check_sr(DisasContext *dc, uint32_t sr, unsigned access)
-{
-    if (!xtensa_option_bits_enabled(dc->config, sregnames[sr].opt_bits)) {
-        if (sregnames[sr].name) {
-            qemu_log_mask(LOG_GUEST_ERROR, "SR %s is not configured\n", sregnames[sr].name);
-        } else {
-            qemu_log_mask(LOG_UNIMP, "SR %d is not implemented\n", sr);
-        }
-        return false;
-    } else if (!(sregnames[sr].access & access)) {
-        static const char * const access_text[] = {
-            [SR_R] = "rsr",
-            [SR_W] = "wsr",
-            [SR_X] = "xsr",
-        };
-        assert(access < ARRAY_SIZE(access_text) && access_text[access]);
-        qemu_log_mask(LOG_GUEST_ERROR, "SR %s is not available for %s\n", sregnames[sr].name,
-                      access_text[access]);
-        return false;
-    }
-    return true;
-}
-
-#ifndef CONFIG_USER_ONLY
-static void gen_rsr_ccount(DisasContext *dc, TCGv_i32 d, uint32_t sr)
-{
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_start();
-    }
-    gen_helper_update_ccount(cpu_env);
-    tcg_gen_mov_i32(d, cpu_SR[sr]);
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_end();
-    }
-}
-
-static void gen_rsr_ptevaddr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
-{
-    tcg_gen_shri_i32(d, cpu_SR[EXCVADDR], 10);
-    tcg_gen_or_i32(d, d, cpu_SR[sr]);
-    tcg_gen_andi_i32(d, d, 0xfffffffc);
-}
-#endif
-
-static void gen_rsr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
-{
-    static void (* const rsr_handler[256])(DisasContext *dc,
-                                           TCGv_i32 d, uint32_t sr) = {
-#ifndef CONFIG_USER_ONLY
-        [CCOUNT] = gen_rsr_ccount,
-        [INTSET] = gen_rsr_ccount,
-        [PTEVADDR] = gen_rsr_ptevaddr,
-#endif
-    };
-
-    if (rsr_handler[sr]) {
-        rsr_handler[sr](dc, d, sr);
-    } else {
-        tcg_gen_mov_i32(d, cpu_SR[sr]);
-    }
-}
-
-static void gen_wsr_sar(DisasContext *dc, uint32_t sr, TCGv_i32 s)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], s, 0x3f);
-    if (dc->sar_m32_5bit) {
-        tcg_gen_discard_i32(dc->sar_m32);
-    }
-    dc->sar_5bit = false;
-    dc->sar_m32_5bit = false;
-}
-
-static void gen_wsr_br(DisasContext *dc, uint32_t sr, TCGv_i32 s)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], s, 0xffff);
-}
-
-static void gen_wsr_litbase(DisasContext *dc, uint32_t sr, TCGv_i32 s)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], s, 0xfffff001);
-}
-
-static void gen_wsr_acchi(DisasContext *dc, uint32_t sr, TCGv_i32 s)
-{
-    tcg_gen_ext8s_i32(cpu_SR[sr], s);
-}
-
-#ifndef CONFIG_USER_ONLY
-static void gen_wsr_windowbase(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_mov_i32(cpu_windowbase_next, v);
-}
-
-static void gen_wsr_windowstart(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], v, (1 << dc->config->nareg / 4) - 1);
-}
-
-static void gen_wsr_ptevaddr(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], v, 0xffc00000);
-}
-
-static void gen_wsr_rasid(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    gen_helper_wsr_rasid(cpu_env, v);
-}
-
-static void gen_wsr_tlbcfg(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], v, 0x01130000);
-}
-
-static void gen_wsr_ibreakenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    gen_helper_wsr_ibreakenable(cpu_env, v);
-}
-
-static void gen_wsr_memctl(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    gen_helper_wsr_memctl(cpu_env, v);
-}
-
-static void gen_wsr_atomctl(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], v, 0x3f);
-}
-
-static void gen_wsr_ibreaka(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    unsigned id = sr - IBREAKA;
-    TCGv_i32 tmp = tcg_const_i32(id);
-
-    assert(id < dc->config->nibreak);
-    gen_helper_wsr_ibreaka(cpu_env, tmp, v);
-    tcg_temp_free(tmp);
-}
-
-static void gen_wsr_dbreaka(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    unsigned id = sr - DBREAKA;
-    TCGv_i32 tmp = tcg_const_i32(id);
-
-    assert(id < dc->config->ndbreak);
-    gen_helper_wsr_dbreaka(cpu_env, tmp, v);
-    tcg_temp_free(tmp);
-}
-
-static void gen_wsr_dbreakc(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    unsigned id = sr - DBREAKC;
-    TCGv_i32 tmp = tcg_const_i32(id);
-
-    assert(id < dc->config->ndbreak);
-    gen_helper_wsr_dbreakc(cpu_env, tmp, v);
-    tcg_temp_free(tmp);
-}
-
-static void gen_wsr_cpenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], v, 0xff);
-}
-
-static void gen_check_interrupts(DisasContext *dc)
-{
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_start();
-    }
-    gen_helper_check_interrupts(cpu_env);
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_end();
-    }
-}
-
-static void gen_wsr_intset(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static bool test_ill_sr(DisasContext *dc, const OpcodeArg arg[],
+                        const uint32_t par[])
 {
-    gen_helper_intset(cpu_env, v);
+    return !xtensa_option_enabled(dc->config, par[1]);
 }
 
-static void gen_wsr_intclear(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static bool test_ill_ccompare(DisasContext *dc, const OpcodeArg arg[],
+                              const uint32_t par[])
 {
-    gen_helper_intclear(cpu_env, v);
-}
+    unsigned n = par[0] - CCOMPARE;
 
-static void gen_wsr_intenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_mov_i32(cpu_SR[sr], v);
+    return test_ill_sr(dc, arg, par) || n >= dc->config->nccompare;
 }
 
-static void gen_wsr_ps(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static bool test_ill_dbreak(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
 {
-    uint32_t mask = PS_WOE | PS_CALLINC | PS_OWB |
-        PS_UM | PS_EXCM | PS_INTLEVEL;
+    unsigned n = MAX_NDBREAK;
 
-    if (option_enabled(dc, XTENSA_OPTION_MMU)) {
-        mask |= PS_RING;
+    if (par[0] >= DBREAKA && par[0] < DBREAKA + MAX_NDBREAK) {
+        n = par[0] - DBREAKA;
     }
-    tcg_gen_andi_i32(cpu_SR[sr], v, mask);
-}
-
-static void gen_wsr_ccount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_start();
-    }
-    gen_helper_wsr_ccount(cpu_env, v);
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_end();
+    if (par[0] >= DBREAKC && par[0] < DBREAKC + MAX_NDBREAK) {
+        n = par[0] - DBREAKC;
     }
+    return test_ill_sr(dc, arg, par) || n >= dc->config->ndbreak;
 }
 
-static void gen_wsr_icount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static bool test_ill_ibreak(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
 {
-    if (dc->icount) {
-        tcg_gen_mov_i32(dc->next_icount, v);
-    } else {
-        tcg_gen_mov_i32(cpu_SR[sr], v);
-    }
-}
+    unsigned n = par[0] - IBREAKA;
 
-static void gen_wsr_icountlevel(DisasContext *dc, uint32_t sr, TCGv_i32 v)
-{
-    tcg_gen_andi_i32(cpu_SR[sr], v, 0xf);
+    return test_ill_sr(dc, arg, par) || n >= dc->config->nibreak;
 }
 
-static void gen_wsr_ccompare(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static bool test_ill_hpi(DisasContext *dc, const OpcodeArg arg[],
+                         const uint32_t par[])
 {
-    uint32_t id = sr - CCOMPARE;
-    TCGv_i32 tmp = tcg_const_i32(id);
+    unsigned n = MAX_NLEVEL + 1;
 
-    assert(id < dc->config->nccompare);
-    tcg_gen_mov_i32(cpu_SR[sr], v);
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_start();
+    if (par[0] >= EXCSAVE1 && par[0] < EXCSAVE1 + MAX_NLEVEL) {
+        n = par[0] - EXCSAVE1 + 1;
     }
-    gen_helper_update_ccompare(cpu_env, tmp);
-    tcg_temp_free(tmp);
-    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-        gen_io_end();
+    if (par[0] >= EPC1 && par[0] < EPC1 + MAX_NLEVEL) {
+        n = par[0] - EPC1 + 1;
     }
-}
-#else
-static void gen_check_interrupts(DisasContext *dc)
-{
-}
-#endif
-
-static void gen_wsr(DisasContext *dc, uint32_t sr, TCGv_i32 s)
-{
-    static void (* const wsr_handler[256])(DisasContext *dc,
-                                           uint32_t sr, TCGv_i32 v) = {
-        [SAR] = gen_wsr_sar,
-        [BR] = gen_wsr_br,
-        [LITBASE] = gen_wsr_litbase,
-        [ACCHI] = gen_wsr_acchi,
-#ifndef CONFIG_USER_ONLY
-        [WINDOW_BASE] = gen_wsr_windowbase,
-        [WINDOW_START] = gen_wsr_windowstart,
-        [PTEVADDR] = gen_wsr_ptevaddr,
-        [RASID] = gen_wsr_rasid,
-        [ITLBCFG] = gen_wsr_tlbcfg,
-        [DTLBCFG] = gen_wsr_tlbcfg,
-        [IBREAKENABLE] = gen_wsr_ibreakenable,
-        [MEMCTL] = gen_wsr_memctl,
-        [ATOMCTL] = gen_wsr_atomctl,
-        [IBREAKA] = gen_wsr_ibreaka,
-        [IBREAKA + 1] = gen_wsr_ibreaka,
-        [DBREAKA] = gen_wsr_dbreaka,
-        [DBREAKA + 1] = gen_wsr_dbreaka,
-        [DBREAKC] = gen_wsr_dbreakc,
-        [DBREAKC + 1] = gen_wsr_dbreakc,
-        [CPENABLE] = gen_wsr_cpenable,
-        [INTSET] = gen_wsr_intset,
-        [INTCLEAR] = gen_wsr_intclear,
-        [INTENABLE] = gen_wsr_intenable,
-        [PS] = gen_wsr_ps,
-        [CCOUNT] = gen_wsr_ccount,
-        [ICOUNT] = gen_wsr_icount,
-        [ICOUNTLEVEL] = gen_wsr_icountlevel,
-        [CCOMPARE] = gen_wsr_ccompare,
-        [CCOMPARE + 1] = gen_wsr_ccompare,
-        [CCOMPARE + 2] = gen_wsr_ccompare,
-#endif
-    };
-
-    if (wsr_handler[sr]) {
-        wsr_handler[sr](dc, sr, s);
-    } else {
-        tcg_gen_mov_i32(cpu_SR[sr], s);
-    }
-}
-
-static void gen_wur(uint32_t ur, TCGv_i32 s)
-{
-    switch (ur) {
-    case FCR:
-        gen_helper_wur_fcr(cpu_env, s);
-        break;
-
-    case FSR:
-        tcg_gen_andi_i32(cpu_UR[ur], s, 0xffffff80);
-        break;
-
-    default:
-        tcg_gen_mov_i32(cpu_UR[ur], s);
-        break;
+    if (par[0] >= EPS2 && par[0] < EPS2 + MAX_NLEVEL - 1) {
+        n = par[0] - EPS2 + 2;
     }
+    return test_ill_sr(dc, arg, par) || n > dc->config->nlevel;
 }
 
 static void gen_load_store_alignment(DisasContext *dc, int shift,
@@ -925,9 +593,17 @@ static int gen_postprocess(DisasContext *dc, int slot)
 {
     uint32_t op_flags = dc->op_flags;
 
+#ifndef CONFIG_USER_ONLY
     if (op_flags & XTENSA_OP_CHECK_INTERRUPTS) {
-        gen_check_interrupts(dc);
+        if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+            gen_io_start();
+        }
+        gen_helper_check_interrupts(cpu_env);
+        if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+            gen_io_end();
+        }
     }
+#endif
     if (op_flags & XTENSA_OP_SYNC_REGISTER_WINDOW) {
         gen_helper_sync_windowbase(cpu_env);
     }
@@ -1645,24 +1321,20 @@ void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     XtensaCPU *cpu = XTENSA_CPU(cs);
     CPUXtensaState *env = &cpu->env;
+    xtensa_isa isa = env->config->isa;
     int i, j;
 
     qemu_fprintf(f, "PC=%08x\n\n", env->pc);
 
-    for (i = j = 0; i < 256; ++i) {
-        if (xtensa_option_bits_enabled(env->config, sregnames[i].opt_bits)) {
-            qemu_fprintf(f, "%12s=%08x%c",
-                         sregnames[i].name, env->sregs[i],
-                         (j++ % 4) == 3 ? '\n' : ' ');
-        }
-    }
-
-    qemu_fprintf(f, (j % 4) == 0 ? "\n" : "\n\n");
+    for (i = j = 0; i < xtensa_isa_num_sysregs(isa); ++i) {
+        const uint32_t *reg =
+            xtensa_sysreg_is_user(isa, i) ? env->uregs : env->sregs;
+        int regno = xtensa_sysreg_number(isa, i);
 
-    for (i = j = 0; i < 256; ++i) {
-        if (xtensa_option_bits_enabled(env->config, uregnames[i].opt_bits)) {
-            qemu_fprintf(f, "%s=%08x%c",
-                         uregnames[i].name, env->uregs[i],
+        if (regno >= 0) {
+            qemu_fprintf(f, "%12s=%08x%c",
+                         xtensa_sysreg_name(isa, i),
+                         reg[regno],
                          (j++ % 4) == 3 ? '\n' : ' ');
         }
     }
@@ -1923,6 +1595,12 @@ static void translate_clrb_expstate(DisasContext *dc, const OpcodeArg arg[],
     tcg_gen_andi_i32(cpu_UR[EXPSTATE], cpu_UR[EXPSTATE], ~(1u << arg[0].imm));
 }
 
+static void translate_clrex(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
+{
+    tcg_gen_movi_i32(cpu_exclusive_addr, -1);
+}
+
 static void translate_const16(DisasContext *dc, const OpcodeArg arg[],
                              const uint32_t par[])
 {
@@ -1951,6 +1629,12 @@ static void translate_depbits(DisasContext *dc, const OpcodeArg arg[],
                         arg[2].imm, arg[3].imm);
 }
 
+static void translate_diwbuip(DisasContext *dc, const OpcodeArg arg[],
+                              const uint32_t par[])
+{
+    tcg_gen_addi_i32(arg[0].out, arg[0].in, dc->config->dcache_line_bytes);
+}
+
 static bool test_ill_entry(DisasContext *dc, const OpcodeArg arg[],
                            const uint32_t par[])
 {
@@ -1992,6 +1676,17 @@ static void translate_extui(DisasContext *dc, const OpcodeArg arg[],
     tcg_temp_free(tmp);
 }
 
+static void translate_getex(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_extract_i32(tmp, cpu_SR[ATOMCTL], 8, 1);
+    tcg_gen_deposit_i32(cpu_SR[ATOMCTL], cpu_SR[ATOMCTL], arg[0].in, 8, 1);
+    tcg_gen_mov_i32(arg[0].out, tmp);
+    tcg_temp_free(tmp);
+}
+
 static void translate_icache(DisasContext *dc, const OpcodeArg arg[],
                              const uint32_t par[])
 {
@@ -2039,6 +1734,38 @@ static void translate_l32e(DisasContext *dc, const OpcodeArg arg[],
     tcg_temp_free(addr);
 }
 
+#ifdef CONFIG_USER_ONLY
+static void gen_check_exclusive(DisasContext *dc, TCGv_i32 addr, bool is_write)
+{
+}
+#else
+static void gen_check_exclusive(DisasContext *dc, TCGv_i32 addr, bool is_write)
+{
+    if (!option_enabled(dc, XTENSA_OPTION_MPU)) {
+        TCGv_i32 tpc = tcg_const_i32(dc->pc);
+        TCGv_i32 write = tcg_const_i32(is_write);
+
+        gen_helper_check_exclusive(cpu_env, tpc, addr, write);
+        tcg_temp_free(tpc);
+        tcg_temp_free(write);
+    }
+}
+#endif
+
+static void translate_l32ex(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
+{
+    TCGv_i32 addr = tcg_temp_new_i32();
+
+    tcg_gen_mov_i32(addr, arg[1].in);
+    gen_load_store_alignment(dc, 2, addr, true);
+    gen_check_exclusive(dc, addr, false);
+    tcg_gen_qemu_ld_i32(arg[0].out, addr, dc->ring, MO_TEUL);
+    tcg_gen_mov_i32(cpu_exclusive_addr, addr);
+    tcg_gen_mov_i32(cpu_exclusive_val, arg[0].out);
+    tcg_temp_free(addr);
+}
+
 static void translate_ldst(DisasContext *dc, const OpcodeArg arg[],
                            const uint32_t par[])
 {
@@ -2323,6 +2050,15 @@ static void translate_ptlb(DisasContext *dc, const OpcodeArg arg[],
 #endif
 }
 
+static void translate_pptlb(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    tcg_gen_movi_i32(cpu_pc, dc->pc);
+    gen_helper_pptlb(arg[0].out, cpu_env, arg[1].in);
+#endif
+}
+
 static void translate_quos(DisasContext *dc, const OpcodeArg arg[],
                            const uint32_t par[])
 {
@@ -2465,16 +2201,38 @@ static void translate_rsil(DisasContext *dc, const OpcodeArg arg[],
     tcg_gen_ori_i32(cpu_SR[PS], cpu_SR[PS], arg[1].imm);
 }
 
-static bool test_ill_rsr(DisasContext *dc, const OpcodeArg arg[],
-                         const uint32_t par[])
+static void translate_rsr(DisasContext *dc, const OpcodeArg arg[],
+                          const uint32_t par[])
 {
-    return !check_sr(dc, par[0], SR_R);
+    tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
 }
 
-static void translate_rsr(DisasContext *dc, const OpcodeArg arg[],
-                          const uint32_t par[])
+static void translate_rsr_ccount(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
 {
-    gen_rsr(dc, arg[0].out, par[0]);
+#ifndef CONFIG_USER_ONLY
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
+    gen_helper_update_ccount(cpu_env);
+    tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_end();
+    }
+#endif
+}
+
+static void translate_rsr_ptevaddr(DisasContext *dc, const OpcodeArg arg[],
+                                   const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_shri_i32(tmp, cpu_SR[EXCVADDR], 10);
+    tcg_gen_or_i32(tmp, tmp, cpu_SR[PTEVADDR]);
+    tcg_gen_andi_i32(arg[0].out, tmp, 0xfffffffc);
+    tcg_temp_free(tmp);
+#endif
 }
 
 static void translate_rtlb(DisasContext *dc, const OpcodeArg arg[],
@@ -2493,14 +2251,26 @@ static void translate_rtlb(DisasContext *dc, const OpcodeArg arg[],
 #endif
 }
 
+static void translate_rptlb0(DisasContext *dc, const OpcodeArg arg[],
+                             const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_rptlb0(arg[0].out, cpu_env, arg[1].in);
+#endif
+}
+
+static void translate_rptlb1(DisasContext *dc, const OpcodeArg arg[],
+                             const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_rptlb1(arg[0].out, cpu_env, arg[1].in);
+#endif
+}
+
 static void translate_rur(DisasContext *dc, const OpcodeArg arg[],
                           const uint32_t par[])
 {
-    if (uregnames[par[0]].name) {
-        tcg_gen_mov_i32(arg[0].out, cpu_UR[par[0]]);
-    } else {
-        qemu_log_mask(LOG_UNIMP, "RUR %d not implemented\n", par[0]);
-    }
+    tcg_gen_mov_i32(arg[0].out, cpu_UR[par[0]]);
 }
 
 static void translate_setb_expstate(DisasContext *dc, const OpcodeArg arg[],
@@ -2551,6 +2321,33 @@ static void translate_s32e(DisasContext *dc, const OpcodeArg arg[],
     tcg_temp_free(addr);
 }
 
+static void translate_s32ex(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
+{
+    TCGv_i32 prev = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_local_new_i32();
+    TCGv_i32 res = tcg_temp_local_new_i32();
+    TCGLabel *label = gen_new_label();
+
+    tcg_gen_movi_i32(res, 0);
+    tcg_gen_mov_i32(addr, arg[1].in);
+    gen_load_store_alignment(dc, 2, addr, true);
+    tcg_gen_brcond_i32(TCG_COND_NE, addr, cpu_exclusive_addr, label);
+    gen_check_exclusive(dc, addr, true);
+    tcg_gen_atomic_cmpxchg_i32(prev, cpu_exclusive_addr, cpu_exclusive_val,
+                               arg[0].in, dc->cring, MO_TEUL);
+    tcg_gen_setcond_i32(TCG_COND_EQ, res, prev, cpu_exclusive_val);
+    tcg_gen_movcond_i32(TCG_COND_EQ, cpu_exclusive_val,
+                        prev, cpu_exclusive_val, prev, cpu_exclusive_val);
+    tcg_gen_movi_i32(cpu_exclusive_addr, -1);
+    gen_set_label(label);
+    tcg_gen_extract_i32(arg[0].out, cpu_SR[ATOMCTL], 8, 1);
+    tcg_gen_deposit_i32(cpu_SR[ATOMCTL], cpu_SR[ATOMCTL], res, 8, 1);
+    tcg_temp_free(prev);
+    tcg_temp_free(addr);
+    tcg_temp_free(res);
+}
+
 static void translate_salt(DisasContext *dc, const OpcodeArg arg[],
                            const uint32_t par[])
 {
@@ -2758,6 +2555,14 @@ static void translate_wtlb(DisasContext *dc, const OpcodeArg arg[],
 #endif
 }
 
+static void translate_wptlb(DisasContext *dc, const OpcodeArg arg[],
+                            const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wptlb(cpu_env, arg[0].in, arg[1].in);
+#endif
+}
+
 static void translate_wer(DisasContext *dc, const OpcodeArg arg[],
                           const uint32_t par[])
 {
@@ -2771,38 +2576,221 @@ static void translate_wrmsk_expstate(DisasContext *dc, const OpcodeArg arg[],
     tcg_gen_and_i32(cpu_UR[EXPSTATE], arg[0].in, arg[1].in);
 }
 
-static bool test_ill_wsr(DisasContext *dc, const OpcodeArg arg[],
-                         const uint32_t par[])
+static void translate_wsr(DisasContext *dc, const OpcodeArg arg[],
+                          const uint32_t par[])
 {
-    return !check_sr(dc, par[0], SR_W);
+    tcg_gen_mov_i32(cpu_SR[par[0]], arg[0].in);
 }
 
-static void translate_wsr(DisasContext *dc, const OpcodeArg arg[],
-                          const uint32_t par[])
+static void translate_wsr_mask(DisasContext *dc, const OpcodeArg arg[],
+                               const uint32_t par[])
 {
-    gen_wsr(dc, par[0], arg[0].in);
+    tcg_gen_andi_i32(cpu_SR[par[0]], arg[0].in, par[2]);
 }
 
-static void translate_wur(DisasContext *dc, const OpcodeArg arg[],
-                          const uint32_t par[])
+static void translate_wsr_acchi(DisasContext *dc, const OpcodeArg arg[],
+                                const uint32_t par[])
 {
-    if (uregnames[par[0]].name) {
-        gen_wur(par[0], arg[0].in);
+    tcg_gen_ext8s_i32(cpu_SR[par[0]], arg[0].in);
+}
+
+static void translate_wsr_ccompare(DisasContext *dc, const OpcodeArg arg[],
+                                   const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    uint32_t id = par[0] - CCOMPARE;
+    TCGv_i32 tmp = tcg_const_i32(id);
+
+    assert(id < dc->config->nccompare);
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
+    tcg_gen_mov_i32(cpu_SR[par[0]], arg[0].in);
+    gen_helper_update_ccompare(cpu_env, tmp);
+    tcg_temp_free(tmp);
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_end();
+    }
+#endif
+}
+
+static void translate_wsr_ccount(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
+    gen_helper_wsr_ccount(cpu_env, arg[0].in);
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_end();
+    }
+#endif
+}
+
+static void translate_wsr_dbreaka(DisasContext *dc, const OpcodeArg arg[],
+                                  const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    unsigned id = par[0] - DBREAKA;
+    TCGv_i32 tmp = tcg_const_i32(id);
+
+    assert(id < dc->config->ndbreak);
+    gen_helper_wsr_dbreaka(cpu_env, tmp, arg[0].in);
+    tcg_temp_free(tmp);
+#endif
+}
+
+static void translate_wsr_dbreakc(DisasContext *dc, const OpcodeArg arg[],
+                                  const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    unsigned id = par[0] - DBREAKC;
+    TCGv_i32 tmp = tcg_const_i32(id);
+
+    assert(id < dc->config->ndbreak);
+    gen_helper_wsr_dbreakc(cpu_env, tmp, arg[0].in);
+    tcg_temp_free(tmp);
+#endif
+}
+
+static void translate_wsr_ibreaka(DisasContext *dc, const OpcodeArg arg[],
+                                  const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    unsigned id = par[0] - IBREAKA;
+    TCGv_i32 tmp = tcg_const_i32(id);
+
+    assert(id < dc->config->nibreak);
+    gen_helper_wsr_ibreaka(cpu_env, tmp, arg[0].in);
+    tcg_temp_free(tmp);
+#endif
+}
+
+static void translate_wsr_ibreakenable(DisasContext *dc, const OpcodeArg arg[],
+                                       const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wsr_ibreakenable(cpu_env, arg[0].in);
+#endif
+}
+
+static void translate_wsr_icount(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    if (dc->icount) {
+        tcg_gen_mov_i32(dc->next_icount, arg[0].in);
     } else {
-        qemu_log_mask(LOG_UNIMP, "WUR %d not implemented\n", par[0]);
+        tcg_gen_mov_i32(cpu_SR[par[0]], arg[0].in);
     }
+#endif
 }
 
-static void translate_xor(DisasContext *dc, const OpcodeArg arg[],
+static void translate_wsr_intclear(DisasContext *dc, const OpcodeArg arg[],
+                                   const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_intclear(cpu_env, arg[0].in);
+#endif
+}
+
+static void translate_wsr_intset(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_intset(cpu_env, arg[0].in);
+#endif
+}
+
+static void translate_wsr_memctl(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wsr_memctl(cpu_env, arg[0].in);
+#endif
+}
+
+static void translate_wsr_mpuenb(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wsr_mpuenb(cpu_env, arg[0].in);
+#endif
+}
+
+static void translate_wsr_ps(DisasContext *dc, const OpcodeArg arg[],
+                             const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    uint32_t mask = PS_WOE | PS_CALLINC | PS_OWB |
+        PS_UM | PS_EXCM | PS_INTLEVEL;
+
+    if (option_enabled(dc, XTENSA_OPTION_MMU)) {
+        mask |= PS_RING;
+    }
+    tcg_gen_andi_i32(cpu_SR[par[0]], arg[0].in, mask);
+#endif
+}
+
+static void translate_wsr_rasid(DisasContext *dc, const OpcodeArg arg[],
+                                const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wsr_rasid(cpu_env, arg[0].in);
+#endif
+}
+
+static void translate_wsr_sar(DisasContext *dc, const OpcodeArg arg[],
+                              const uint32_t par[])
+{
+    tcg_gen_andi_i32(cpu_SR[par[0]], arg[0].in, 0x3f);
+    if (dc->sar_m32_5bit) {
+        tcg_gen_discard_i32(dc->sar_m32);
+    }
+    dc->sar_5bit = false;
+    dc->sar_m32_5bit = false;
+}
+
+static void translate_wsr_windowbase(DisasContext *dc, const OpcodeArg arg[],
+                                     const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    tcg_gen_mov_i32(cpu_windowbase_next, arg[0].in);
+#endif
+}
+
+static void translate_wsr_windowstart(DisasContext *dc, const OpcodeArg arg[],
+                                      const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    tcg_gen_andi_i32(cpu_SR[par[0]], arg[0].in,
+                     (1 << dc->config->nareg / 4) - 1);
+#endif
+}
+
+static void translate_wur(DisasContext *dc, const OpcodeArg arg[],
                           const uint32_t par[])
 {
-    tcg_gen_xor_i32(arg[0].out, arg[1].in, arg[2].in);
+    tcg_gen_mov_i32(cpu_UR[par[0]], arg[0].in);
 }
 
-static bool test_ill_xsr(DisasContext *dc, const OpcodeArg arg[],
-                         const uint32_t par[])
+static void translate_wur_fcr(DisasContext *dc, const OpcodeArg arg[],
+                              const uint32_t par[])
 {
-    return !check_sr(dc, par[0], SR_X);
+    gen_helper_wur_fcr(cpu_env, arg[0].in);
+}
+
+static void translate_wur_fsr(DisasContext *dc, const OpcodeArg arg[],
+                              const uint32_t par[])
+{
+    tcg_gen_andi_i32(cpu_UR[par[0]], arg[0].in, 0xffffff80);
+}
+
+static void translate_xor(DisasContext *dc, const OpcodeArg arg[],
+                          const uint32_t par[])
+{
+    tcg_gen_xor_i32(arg[0].out, arg[1].in, arg[2].in);
 }
 
 static void translate_xsr(DisasContext *dc, const OpcodeArg arg[],
@@ -2811,11 +2799,73 @@ static void translate_xsr(DisasContext *dc, const OpcodeArg arg[],
     TCGv_i32 tmp = tcg_temp_new_i32();
 
     tcg_gen_mov_i32(tmp, arg[0].in);
-    gen_rsr(dc, arg[0].out, par[0]);
-    gen_wsr(dc, par[0], tmp);
+    tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+    tcg_gen_mov_i32(cpu_SR[par[0]], tmp);
+    tcg_temp_free(tmp);
+}
+
+static void translate_xsr_mask(DisasContext *dc, const OpcodeArg arg[],
+                               const uint32_t par[])
+{
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_mov_i32(tmp, arg[0].in);
+    tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+    tcg_gen_andi_i32(cpu_SR[par[0]], tmp, par[2]);
     tcg_temp_free(tmp);
 }
 
+static void translate_xsr_ccount(DisasContext *dc, const OpcodeArg arg[],
+                                 const uint32_t par[])
+{
+#ifndef CONFIG_USER_ONLY
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
+
+    gen_helper_update_ccount(cpu_env);
+    tcg_gen_mov_i32(tmp, cpu_SR[par[0]]);
+    gen_helper_wsr_ccount(cpu_env, arg[0].in);
+    tcg_gen_mov_i32(arg[0].out, tmp);
+    tcg_temp_free(tmp);
+
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_end();
+    }
+#endif
+}
+
+#define gen_translate_xsr(name) \
+    static void translate_xsr_##name(DisasContext *dc, const OpcodeArg arg[], \
+                                     const uint32_t par[]) \
+{ \
+    TCGv_i32 tmp = tcg_temp_new_i32(); \
+ \
+    tcg_gen_mov_i32(tmp, cpu_SR[par[0]]); \
+    translate_wsr_##name(dc, arg, par); \
+    tcg_gen_mov_i32(arg[0].out, tmp); \
+    tcg_temp_free(tmp); \
+}
+
+gen_translate_xsr(acchi)
+gen_translate_xsr(ccompare)
+gen_translate_xsr(dbreaka)
+gen_translate_xsr(dbreakc)
+gen_translate_xsr(ibreaka)
+gen_translate_xsr(ibreakenable)
+gen_translate_xsr(icount)
+gen_translate_xsr(memctl)
+gen_translate_xsr(mpuenb)
+gen_translate_xsr(ps)
+gen_translate_xsr(rasid)
+gen_translate_xsr(sar)
+gen_translate_xsr(windowbase)
+gen_translate_xsr(windowstart)
+
+#undef gen_translate_xsr
+
 static const XtensaOpcodeOps core_ops[] = {
     {
         .name = "abs",
@@ -3097,6 +3147,9 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "clrb_expstate",
         .translate = translate_clrb_expstate,
     }, {
+        .name = "clrex",
+        .translate = translate_clrex,
+    }, {
         .name = "const16",
         .translate = translate_const16,
     }, {
@@ -3107,6 +3160,9 @@ static const XtensaOpcodeOps core_ops[] = {
         .translate = translate_dcache,
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "dhi.b",
+        .translate = translate_nop,
+    }, {
         .name = "dhu",
         .translate = translate_dcache,
         .op_flags = XTENSA_OP_PRIVILEGED,
@@ -3114,9 +3170,15 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "dhwb",
         .translate = translate_dcache,
     }, {
+        .name = "dhwb.b",
+        .translate = translate_nop,
+    }, {
         .name = "dhwbi",
         .translate = translate_dcache,
     }, {
+        .name = "dhwbi.b",
+        .translate = translate_nop,
+    }, {
         .name = "dii",
         .translate = translate_nop,
         .op_flags = XTENSA_OP_PRIVILEGED,
@@ -3133,19 +3195,41 @@ static const XtensaOpcodeOps core_ops[] = {
         .translate = translate_nop,
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "diwbui.p",
+        .translate = translate_diwbuip,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
         .name = "dpfl",
         .translate = translate_dcache,
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "dpfm.b",
+        .translate = translate_nop,
+    }, {
+        .name = "dpfm.bf",
+        .translate = translate_nop,
+    }, {
         .name = "dpfr",
         .translate = translate_nop,
     }, {
+        .name = "dpfr.b",
+        .translate = translate_nop,
+    }, {
+        .name = "dpfr.bf",
+        .translate = translate_nop,
+    }, {
         .name = "dpfro",
         .translate = translate_nop,
     }, {
         .name = "dpfw",
         .translate = translate_nop,
     }, {
+        .name = "dpfw.b",
+        .translate = translate_nop,
+    }, {
+        .name = "dpfw.bf",
+        .translate = translate_nop,
+    }, {
         .name = "dpfwo",
         .translate = translate_nop,
     }, {
@@ -3171,6 +3255,9 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "extw",
         .translate = translate_memw,
     }, {
+        .name = "getex",
+        .translate = translate_getex,
+    }, {
         .name = "hwwdtlba",
         .op_flags = XTENSA_OP_ILL,
     }, {
@@ -3242,6 +3329,10 @@ static const XtensaOpcodeOps core_ops[] = {
         .translate = translate_l32e,
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_LOAD,
     }, {
+        .name = "l32ex",
+        .translate = translate_l32ex,
+        .op_flags = XTENSA_OP_LOAD,
+    }, {
         .name = (const char * const[]) {
             "l32i", "l32i.n", NULL,
         },
@@ -3653,11 +3744,30 @@ static const XtensaOpcodeOps core_ops[] = {
         .par = (const uint32_t[]){true},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "pfend.a",
+        .translate = translate_nop,
+    }, {
+        .name = "pfend.o",
+        .translate = translate_nop,
+    }, {
+        .name = "pfnxt.f",
+        .translate = translate_nop,
+    }, {
+        .name = "pfwait.a",
+        .translate = translate_nop,
+    }, {
+        .name = "pfwait.o",
+        .translate = translate_nop,
+    }, {
         .name = "pitlb",
         .translate = translate_ptlb,
         .par = (const uint32_t[]){false},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "pptlb",
+        .translate = translate_pptlb,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
         .name = "quos",
         .translate = translate_quos,
         .par = (const uint32_t[]){true},
@@ -3744,6 +3854,14 @@ static const XtensaOpcodeOps core_ops[] = {
         .par = (const uint32_t[]){false, 1},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "rptlb0",
+        .translate = translate_rptlb0,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rptlb1",
+        .translate = translate_rptlb1,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
         .name = "rotw",
         .translate = translate_rotw,
         .op_flags = XTENSA_OP_PRIVILEGED |
@@ -3759,450 +3877,739 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "rsr.176",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){176},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.208",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){208},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.acchi",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){ACCHI},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ACCHI,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "rsr.acclo",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){ACCLO},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ACCLO,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "rsr.atomctl",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){ATOMCTL},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ATOMCTL,
+            XTENSA_OPTION_ATOMCTL,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.br",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){BR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            BR,
+            XTENSA_OPTION_BOOLEAN,
+        },
+    }, {
+        .name = "rsr.cacheadrdis",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CACHEADRDIS,
+            XTENSA_OPTION_MPU,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.cacheattr",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){CACHEATTR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CACHEATTR,
+            XTENSA_OPTION_CACHEATTR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ccompare0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){CCOMPARE},
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ccompare1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){CCOMPARE + 1},
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE + 1,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ccompare2",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){CCOMPARE + 2},
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE + 2,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ccount",
-        .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){CCOUNT},
+        .translate = translate_rsr_ccount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CCOUNT,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "rsr.configid0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CONFIGID0},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.configid1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CONFIGID1},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.cpenable",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){CPENABLE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CPENABLE,
+            XTENSA_OPTION_COPROCESSOR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.dbreaka0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DBREAKA},
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKA,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.dbreaka1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DBREAKA + 1},
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKA + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.dbreakc0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DBREAKC},
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKC,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.dbreakc1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DBREAKC + 1},
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKC + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ddr",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DDR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DDR,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.debugcause",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DEBUGCAUSE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DEBUGCAUSE,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.depc",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DEPC},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DEPC,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.dtlbcfg",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){DTLBCFG},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DTLBCFG,
+            XTENSA_OPTION_MMU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EPC1,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc2",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc3",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc4",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc5",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc6",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.epc7",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPC1 + 6},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 6,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.eps2",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPS2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.eps3",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPS2 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.eps4",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPS2 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.eps5",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPS2 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.eps6",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPS2 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.eps7",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EPS2 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.eraccess",
+        .translate = translate_rsr,
+        .par = (const uint32_t[]){ERACCESS},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.exccause",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCCAUSE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCCAUSE,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCSAVE1,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave2",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave3",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave4",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave5",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave6",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excsave7",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 6},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 6,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.excvaddr",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){EXCVADDR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCVADDR,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ibreaka0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){IBREAKA},
+        .test_ill = test_ill_ibreak,
+        .par = (const uint32_t[]){
+            IBREAKA,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ibreaka1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){IBREAKA + 1},
+        .test_ill = test_ill_ibreak,
+        .par = (const uint32_t[]){
+            IBREAKA + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ibreakenable",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){IBREAKENABLE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            IBREAKENABLE,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.icount",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){ICOUNT},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ICOUNT,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.icountlevel",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){ICOUNTLEVEL},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ICOUNTLEVEL,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.intclear",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){INTCLEAR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTCLEAR,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.intenable",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){INTENABLE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTENABLE,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.interrupt",
-        .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){INTSET},
+        .translate = translate_rsr_ccount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTSET,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "rsr.intset",
-        .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){INTSET},
+        .translate = translate_rsr_ccount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTSET,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "rsr.itlbcfg",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){ITLBCFG},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ITLBCFG,
+            XTENSA_OPTION_MMU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.lbeg",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){LBEG},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LBEG,
+            XTENSA_OPTION_LOOP,
+        },
     }, {
         .name = "rsr.lcount",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){LCOUNT},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LCOUNT,
+            XTENSA_OPTION_LOOP,
+        },
     }, {
         .name = "rsr.lend",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){LEND},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LEND,
+            XTENSA_OPTION_LOOP,
+        },
     }, {
         .name = "rsr.litbase",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){LITBASE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LITBASE,
+            XTENSA_OPTION_EXTENDED_L32R,
+        },
     }, {
         .name = "rsr.m0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "rsr.m1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MR + 1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 1,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "rsr.m2",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MR + 2},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 2,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "rsr.m3",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MR + 3},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 3,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "rsr.memctl",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MEMCTL},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "rsr.mecr",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MECR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.mepc",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MEPC,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.meps",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MEPS,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.mesave",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESAVE,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.mesr",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.mevaddr",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
         .name = "rsr.misc0",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MISC},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.misc1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MISC + 1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 1,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.misc2",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MISC + 2},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 2,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.misc3",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){MISC + 3},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 3,
+            XTENSA_OPTION_MISC_SR,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.mpucfg",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MPUCFG,
+            XTENSA_OPTION_MPU,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "rsr.mpuenb",
+        .translate = translate_rsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MPUENB,
+            XTENSA_OPTION_MPU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.prefctl",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){PREFCTL},
     }, {
         .name = "rsr.prid",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){PRID},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PRID,
+            XTENSA_OPTION_PROCESSOR_ID,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ps",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){PS},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PS,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.ptevaddr",
-        .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){PTEVADDR},
+        .translate = translate_rsr_ptevaddr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PTEVADDR,
+            XTENSA_OPTION_MMU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.rasid",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){RASID},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            RASID,
+            XTENSA_OPTION_MMU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.sar",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){SAR},
     }, {
         .name = "rsr.scompare1",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){SCOMPARE1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            SCOMPARE1,
+            XTENSA_OPTION_CONDITIONAL_STORE,
+        },
     }, {
         .name = "rsr.vecbase",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){VECBASE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            VECBASE,
+            XTENSA_OPTION_RELOCATABLE_VECTOR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.windowbase",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){WINDOW_BASE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            WINDOW_BASE,
+            XTENSA_OPTION_WINDOWED_REGISTER,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsr.windowstart",
         .translate = translate_rsr,
-        .test_ill = test_ill_rsr,
-        .par = (const uint32_t[]){WINDOW_START},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            WINDOW_START,
+            XTENSA_OPTION_WINDOWED_REGISTER,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rsync",
@@ -4239,6 +4646,10 @@ static const XtensaOpcodeOps core_ops[] = {
         .translate = translate_s32e,
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_STORE,
     }, {
+        .name = "s32ex",
+        .translate = translate_s32ex,
+        .op_flags = XTENSA_OP_LOAD | XTENSA_OP_STORE,
+    }, {
         .name = (const char * const[]) {
             "s32i", "s32i.n", "s32nb", NULL,
         },
@@ -4363,304 +4774,452 @@ static const XtensaOpcodeOps core_ops[] = {
         .par = (const uint32_t[]){false},
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
+        .name = "wptlb",
+        .translate = translate_wptlb,
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+    }, {
         .name = "wrmsk_expstate",
         .translate = translate_wrmsk_expstate,
     }, {
         .name = "wsr.176",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){176},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "wsr.208",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){208},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "wsr.acchi",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){ACCHI},
+        .translate = translate_wsr_acchi,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ACCHI,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "wsr.acclo",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){ACCLO},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ACCLO,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "wsr.atomctl",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){ATOMCTL},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ATOMCTL,
+            XTENSA_OPTION_ATOMCTL,
+            0x3f,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.br",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){BR},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            BR,
+            XTENSA_OPTION_BOOLEAN,
+            0xffff,
+        },
+    }, {
+        .name = "wsr.cacheadrdis",
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CACHEADRDIS,
+            XTENSA_OPTION_MPU,
+            0xff,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.cacheattr",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CACHEATTR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CACHEATTR,
+            XTENSA_OPTION_CACHEATTR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.ccompare0",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CCOMPARE},
+        .translate = translate_wsr_ccompare,
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.ccompare1",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CCOMPARE + 1},
+        .translate = translate_wsr_ccompare,
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE + 1,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.ccompare2",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CCOMPARE + 2},
+        .translate = translate_wsr_ccompare,
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE + 2,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.ccount",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CCOUNT},
+        .translate = translate_wsr_ccount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CCOUNT,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.configid0",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CONFIGID0},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "wsr.configid1",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CONFIGID1},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "wsr.cpenable",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){CPENABLE},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CPENABLE,
+            XTENSA_OPTION_COPROCESSOR,
+            0xff,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wsr.dbreaka0",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DBREAKA},
+        .translate = translate_wsr_dbreaka,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKA,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.dbreaka1",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DBREAKA + 1},
+        .translate = translate_wsr_dbreaka,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKA + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.dbreakc0",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DBREAKC},
+        .translate = translate_wsr_dbreakc,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKC,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.dbreakc1",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DBREAKC + 1},
+        .translate = translate_wsr_dbreakc,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKC + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.ddr",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DDR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DDR,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.debugcause",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DEBUGCAUSE},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "wsr.depc",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DEPC},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DEPC,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.dtlbcfg",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){DTLBCFG},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DTLBCFG,
+            XTENSA_OPTION_MMU,
+            0x01130000,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc1",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EPC1,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc2",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc3",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc4",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc5",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc6",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.epc7",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPC1 + 6},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 6,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.eps2",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPS2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.eps3",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPS2 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.eps4",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPS2 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.eps5",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPS2 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.eps6",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPS2 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.eps7",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EPS2 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "wsr.eraccess",
+        .translate = translate_wsr_mask,
+        .par = (const uint32_t[]){
+            ERACCESS,
+            0,
+            0xffff,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.exccause",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCCAUSE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCCAUSE,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave1",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCSAVE1,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave2",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave3",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave4",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave5",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave6",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excsave7",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 6},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 6,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.excvaddr",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){EXCVADDR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCVADDR,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.ibreaka0",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){IBREAKA},
+        .translate = translate_wsr_ibreaka,
+        .test_ill = test_ill_ibreak,
+        .par = (const uint32_t[]){
+            IBREAKA,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.ibreaka1",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){IBREAKA + 1},
+        .translate = translate_wsr_ibreaka,
+        .test_ill = test_ill_ibreak,
+        .par = (const uint32_t[]){
+            IBREAKA + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.ibreakenable",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){IBREAKENABLE},
+        .translate = translate_wsr_ibreakenable,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            IBREAKENABLE,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wsr.icount",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){ICOUNT},
+        .translate = translate_wsr_icount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ICOUNT,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.icountlevel",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){ICOUNTLEVEL},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ICOUNTLEVEL,
+            XTENSA_OPTION_DEBUG,
+            0xf,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wsr.intclear",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){INTCLEAR},
+        .translate = translate_wsr_intclear,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTCLEAR,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_0 |
@@ -4668,8 +5227,11 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "wsr.intenable",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){INTENABLE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTENABLE,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_0 |
@@ -4677,167 +5239,296 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "wsr.interrupt",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){INTSET},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTSET,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_0 |
             XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "wsr.intset",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){INTSET},
+        .translate = translate_wsr_intset,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTSET,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_0 |
             XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "wsr.itlbcfg",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){ITLBCFG},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ITLBCFG,
+            XTENSA_OPTION_MMU,
+            0x01130000,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.lbeg",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){LBEG},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LBEG,
+            XTENSA_OPTION_LOOP,
+        },
         .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wsr.lcount",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){LCOUNT},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LCOUNT,
+            XTENSA_OPTION_LOOP,
+        },
     }, {
         .name = "wsr.lend",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){LEND},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LEND,
+            XTENSA_OPTION_LOOP,
+        },
         .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wsr.litbase",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){LITBASE},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LITBASE,
+            XTENSA_OPTION_EXTENDED_L32R,
+            0xfffff001,
+        },
         .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wsr.m0",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "wsr.m1",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MR + 1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 1,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "wsr.m2",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MR + 2},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 2,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "wsr.m3",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MR + 3},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 3,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "wsr.memctl",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
+        .translate = translate_wsr_memctl,
         .par = (const uint32_t[]){MEMCTL},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "wsr.mecr",
+        .translate = translate_wsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MECR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "wsr.mepc",
+        .translate = translate_wsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MEPC,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "wsr.meps",
+        .translate = translate_wsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MEPS,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "wsr.mesave",
+        .translate = translate_wsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESAVE,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "wsr.mesr",
+        .translate = translate_wsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "wsr.mevaddr",
+        .translate = translate_wsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
         .name = "wsr.misc0",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MISC},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.misc1",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MISC + 1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 1,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.misc2",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MISC + 2},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 2,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.misc3",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MISC + 3},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 3,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.mmid",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){MMID},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MMID,
+            XTENSA_OPTION_TRACE_PORT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "wsr.mpuenb",
+        .translate = translate_wsr_mpuenb,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MPUENB,
+            XTENSA_OPTION_MPU,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+    }, {
         .name = "wsr.prefctl",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){PREFCTL},
     }, {
         .name = "wsr.prid",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){PRID},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "wsr.ps",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){PS},
+        .translate = translate_wsr_ps,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PS,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_M1 |
             XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "wsr.ptevaddr",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){PTEVADDR},
+        .translate = translate_wsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PTEVADDR,
+            XTENSA_OPTION_MMU,
+            0xffc00000,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.rasid",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){RASID},
+        .translate = translate_wsr_rasid,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            RASID,
+            XTENSA_OPTION_MMU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wsr.sar",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
+        .translate = translate_wsr_sar,
         .par = (const uint32_t[]){SAR},
     }, {
         .name = "wsr.scompare1",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){SCOMPARE1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            SCOMPARE1,
+            XTENSA_OPTION_CONDITIONAL_STORE,
+        },
     }, {
         .name = "wsr.vecbase",
         .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){VECBASE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            VECBASE,
+            XTENSA_OPTION_RELOCATABLE_VECTOR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "wsr.windowbase",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){WINDOW_BASE},
+        .translate = translate_wsr_windowbase,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            WINDOW_BASE,
+            XTENSA_OPTION_WINDOWED_REGISTER,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_M1 |
             XTENSA_OP_SYNC_REGISTER_WINDOW,
     }, {
         .name = "wsr.windowstart",
-        .translate = translate_wsr,
-        .test_ill = test_ill_wsr,
-        .par = (const uint32_t[]){WINDOW_START},
+        .translate = translate_wsr_windowstart,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            WINDOW_START,
+            XTENSA_OPTION_WINDOWED_REGISTER,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "wur.expstate",
@@ -4845,12 +5536,12 @@ static const XtensaOpcodeOps core_ops[] = {
         .par = (const uint32_t[]){EXPSTATE},
     }, {
         .name = "wur.fcr",
-        .translate = translate_wur,
+        .translate = translate_wur_fcr,
         .par = (const uint32_t[]){FCR},
         .coprocessor = 0x1,
     }, {
         .name = "wur.fsr",
-        .translate = translate_wur,
+        .translate = translate_wur_fsr,
         .par = (const uint32_t[]){FSR},
         .coprocessor = 0x1,
     }, {
@@ -4866,471 +5557,717 @@ static const XtensaOpcodeOps core_ops[] = {
         .par = (const uint32_t[]){BOOLEAN_XOR},
     }, {
         .name = "xsr.176",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){176},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.208",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){208},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.acchi",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){ACCHI},
+        .translate = translate_xsr_acchi,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ACCHI,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "xsr.acclo",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){ACCLO},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ACCLO,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "xsr.atomctl",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){ATOMCTL},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ATOMCTL,
+            XTENSA_OPTION_ATOMCTL,
+            0x3f,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.br",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){BR},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            BR,
+            XTENSA_OPTION_BOOLEAN,
+            0xffff,
+        },
+    }, {
+        .name = "xsr.cacheadrdis",
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CACHEADRDIS,
+            XTENSA_OPTION_MPU,
+            0xff,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.cacheattr",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CACHEATTR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CACHEATTR,
+            XTENSA_OPTION_CACHEATTR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.ccompare0",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CCOMPARE},
+        .translate = translate_xsr_ccompare,
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.ccompare1",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CCOMPARE + 1},
+        .translate = translate_xsr_ccompare,
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE + 1,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.ccompare2",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CCOMPARE + 2},
+        .translate = translate_xsr_ccompare,
+        .test_ill = test_ill_ccompare,
+        .par = (const uint32_t[]){
+            CCOMPARE + 2,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.ccount",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CCOUNT},
+        .translate = translate_xsr_ccount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CCOUNT,
+            XTENSA_OPTION_TIMER_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.configid0",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CONFIGID0},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.configid1",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CONFIGID1},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.cpenable",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){CPENABLE},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            CPENABLE,
+            XTENSA_OPTION_COPROCESSOR,
+            0xff,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "xsr.dbreaka0",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DBREAKA},
+        .translate = translate_xsr_dbreaka,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKA,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.dbreaka1",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DBREAKA + 1},
+        .translate = translate_xsr_dbreaka,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKA + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.dbreakc0",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DBREAKC},
+        .translate = translate_xsr_dbreakc,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKC,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.dbreakc1",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DBREAKC + 1},
+        .translate = translate_xsr_dbreakc,
+        .test_ill = test_ill_dbreak,
+        .par = (const uint32_t[]){
+            DBREAKC + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.ddr",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DDR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DDR,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.debugcause",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DEBUGCAUSE},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.depc",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DEPC},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DEPC,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.dtlbcfg",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){DTLBCFG},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            DTLBCFG,
+            XTENSA_OPTION_MMU,
+            0x01130000,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc1",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EPC1,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc2",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc3",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc4",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc5",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc6",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.epc7",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPC1 + 6},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPC1 + 6,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.eps2",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPS2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.eps3",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPS2 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.eps4",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPS2 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.eps5",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPS2 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.eps6",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPS2 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.eps7",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EPS2 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EPS2 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "xsr.eraccess",
+        .translate = translate_xsr_mask,
+        .par = (const uint32_t[]){
+            ERACCESS,
+            0,
+            0xffff,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.exccause",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCCAUSE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCCAUSE,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave1",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCSAVE1,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave2",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 1},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 1,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave3",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 2},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 2,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave4",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 3},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 3,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave5",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 4},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 4,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave6",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 5},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 5,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excsave7",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCSAVE1 + 6},
+        .test_ill = test_ill_hpi,
+        .par = (const uint32_t[]){
+            EXCSAVE1 + 6,
+            XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.excvaddr",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){EXCVADDR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            EXCVADDR,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.ibreaka0",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){IBREAKA},
+        .translate = translate_xsr_ibreaka,
+        .test_ill = test_ill_ibreak,
+        .par = (const uint32_t[]){
+            IBREAKA,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.ibreaka1",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){IBREAKA + 1},
+        .translate = translate_xsr_ibreaka,
+        .test_ill = test_ill_ibreak,
+        .par = (const uint32_t[]){
+            IBREAKA + 1,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.ibreakenable",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){IBREAKENABLE},
+        .translate = translate_xsr_ibreakenable,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            IBREAKENABLE,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "xsr.icount",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){ICOUNT},
+        .translate = translate_xsr_icount,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ICOUNT,
+            XTENSA_OPTION_DEBUG,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.icountlevel",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){ICOUNTLEVEL},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ICOUNTLEVEL,
+            XTENSA_OPTION_DEBUG,
+            0xf,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "xsr.intclear",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){INTCLEAR},
-        .op_flags =
-            XTENSA_OP_PRIVILEGED |
-            XTENSA_OP_EXIT_TB_0 |
-            XTENSA_OP_CHECK_INTERRUPTS,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.intenable",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){INTENABLE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            INTENABLE,
+            XTENSA_OPTION_INTERRUPT,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_0 |
             XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "xsr.interrupt",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){INTSET},
-        .op_flags =
-            XTENSA_OP_PRIVILEGED |
-            XTENSA_OP_EXIT_TB_0 |
-            XTENSA_OP_CHECK_INTERRUPTS,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.intset",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){INTSET},
-        .op_flags =
-            XTENSA_OP_PRIVILEGED |
-            XTENSA_OP_EXIT_TB_0 |
-            XTENSA_OP_CHECK_INTERRUPTS,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.itlbcfg",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){ITLBCFG},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            ITLBCFG,
+            XTENSA_OPTION_MMU,
+            0x01130000,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.lbeg",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){LBEG},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LBEG,
+            XTENSA_OPTION_LOOP,
+        },
         .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "xsr.lcount",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){LCOUNT},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LCOUNT,
+            XTENSA_OPTION_LOOP,
+        },
     }, {
         .name = "xsr.lend",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){LEND},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LEND,
+            XTENSA_OPTION_LOOP,
+        },
         .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "xsr.litbase",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){LITBASE},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            LITBASE,
+            XTENSA_OPTION_EXTENDED_L32R,
+            0xfffff001,
+        },
         .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "xsr.m0",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MR},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "xsr.m1",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MR + 1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 1,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "xsr.m2",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MR + 2},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 2,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "xsr.m3",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MR + 3},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MR + 3,
+            XTENSA_OPTION_MAC16,
+        },
     }, {
         .name = "xsr.memctl",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
+        .translate = translate_xsr_memctl,
         .par = (const uint32_t[]){MEMCTL},
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "xsr.mecr",
+        .translate = translate_xsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MECR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "xsr.mepc",
+        .translate = translate_xsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MEPC,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "xsr.meps",
+        .translate = translate_xsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MEPS,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "xsr.mesave",
+        .translate = translate_xsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESAVE,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "xsr.mesr",
+        .translate = translate_xsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
+        .name = "xsr.mevaddr",
+        .translate = translate_xsr,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MESR,
+            XTENSA_OPTION_MEMORY_ECC_PARITY,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED,
+    }, {
         .name = "xsr.misc0",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MISC},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.misc1",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MISC + 1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 1,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.misc2",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MISC + 2},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 2,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.misc3",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){MISC + 3},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MISC + 3,
+            XTENSA_OPTION_MISC_SR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
+        .name = "xsr.mpuenb",
+        .translate = translate_xsr_mpuenb,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            MPUENB,
+            XTENSA_OPTION_MPU,
+        },
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+    }, {
         .name = "xsr.prefctl",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){PREFCTL},
     }, {
         .name = "xsr.prid",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){PRID},
-        .op_flags = XTENSA_OP_PRIVILEGED,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "xsr.ps",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){PS},
+        .translate = translate_xsr_ps,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PS,
+            XTENSA_OPTION_EXCEPTION,
+        },
         .op_flags =
             XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_M1 |
             XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "xsr.ptevaddr",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){PTEVADDR},
+        .translate = translate_xsr_mask,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            PTEVADDR,
+            XTENSA_OPTION_MMU,
+            0xffc00000,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.rasid",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){RASID},
+        .translate = translate_xsr_rasid,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            RASID,
+            XTENSA_OPTION_MMU,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "xsr.sar",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
+        .translate = translate_xsr_sar,
         .par = (const uint32_t[]){SAR},
     }, {
         .name = "xsr.scompare1",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){SCOMPARE1},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            SCOMPARE1,
+            XTENSA_OPTION_CONDITIONAL_STORE,
+        },
     }, {
         .name = "xsr.vecbase",
         .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){VECBASE},
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            VECBASE,
+            XTENSA_OPTION_RELOCATABLE_VECTOR,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "xsr.windowbase",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){WINDOW_BASE},
+        .translate = translate_xsr_windowbase,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            WINDOW_BASE,
+            XTENSA_OPTION_WINDOWED_REGISTER,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED |
             XTENSA_OP_EXIT_TB_M1 |
             XTENSA_OP_SYNC_REGISTER_WINDOW,
     }, {
         .name = "xsr.windowstart",
-        .translate = translate_xsr,
-        .test_ill = test_ill_xsr,
-        .par = (const uint32_t[]){WINDOW_START},
+        .translate = translate_xsr_windowstart,
+        .test_ill = test_ill_sr,
+        .par = (const uint32_t[]){
+            WINDOW_START,
+            XTENSA_OPTION_WINDOWED_REGISTER,
+        },
         .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     },
 };
diff --git a/tests/device-introspect-test.c b/tests/device-introspect-test.c
index a25092dfaa..04f22903b0 100644
--- a/tests/device-introspect-test.c
+++ b/tests/device-introspect-test.c
@@ -26,7 +26,8 @@
 
 const char common_args[] = "-nodefaults -machine none";
 
-static QList *qom_list_types(const char *implements, bool abstract)
+static QList *qom_list_types(QTestState * qts, const char *implements,
+                             bool abstract)
 {
     QDict *resp;
     QList *ret;
@@ -36,8 +37,8 @@ static QList *qom_list_types(const char *implements, bool abstract)
     if (implements) {
         qdict_put_str(args, "implements", implements);
     }
-    resp = qmp("{'execute': 'qom-list-types',"
-               " 'arguments': %p }", args);
+    resp = qtest_qmp(qts, "{'execute': 'qom-list-types', 'arguments': %p }",
+                     args);
     g_assert(qdict_haskey(resp, "return"));
     ret = qdict_get_qlist(resp, "return");
     qobject_ref(ret);
@@ -95,12 +96,12 @@ static QDict *type_list_find(QList *types, const char *name)
     return NULL;
 }
 
-static QList *device_type_list(bool abstract)
+static QList *device_type_list(QTestState *qts, bool abstract)
 {
-    return qom_list_types("device", abstract);
+    return qom_list_types(qts, "device", abstract);
 }
 
-static void test_one_device(const char *type)
+static void test_one_device(QTestState *qts, const char *type)
 {
     QDict *resp;
     char *help;
@@ -109,15 +110,15 @@ static void test_one_device(const char *type)
 
     g_test_message("Testing device '%s'", type);
 
-    qom_tree_start = hmp("info qom-tree");
-    qtree_start = hmp("info qtree");
+    qom_tree_start = qtest_hmp(qts, "info qom-tree");
+    qtree_start = qtest_hmp(qts, "info qtree");
 
-    resp = qmp("{'execute': 'device-list-properties',"
-               " 'arguments': {'typename': %s}}",
+    resp = qtest_qmp(qts, "{'execute': 'device-list-properties',"
+                          " 'arguments': {'typename': %s}}",
                type);
     qobject_unref(resp);
 
-    help = hmp("device_add \"%s,help\"", type);
+    help = qtest_hmp(qts, "device_add \"%s,help\"", type);
     g_free(help);
 
     /*
@@ -125,12 +126,12 @@ static void test_one_device(const char *type)
      * "info qom-tree" or "info qtree" have a good chance at crashing then.
      * Also make sure that the tree did not change.
      */
-    qom_tree_end = hmp("info qom-tree");
+    qom_tree_end = qtest_hmp(qts, "info qom-tree");
     g_assert_cmpstr(qom_tree_start, ==, qom_tree_end);
     g_free(qom_tree_start);
     g_free(qom_tree_end);
 
-    qtree_end = hmp("info qtree");
+    qtree_end = qtest_hmp(qts, "info qtree");
     g_assert_cmpstr(qtree_start, ==, qtree_end);
     g_free(qtree_start);
     g_free(qtree_end);
@@ -140,29 +141,30 @@ static void test_device_intro_list(void)
 {
     QList *types;
     char *help;
+    QTestState *qts;
 
-    qtest_start(common_args);
+    qts = qtest_init(common_args);
 
-    types = device_type_list(true);
+    types = device_type_list(qts, true);
     qobject_unref(types);
 
-    help = hmp("device_add help");
+    help = qtest_hmp(qts, "device_add help");
     g_free(help);
 
-    qtest_end();
+    qtest_quit(qts);
 }
 
 /*
  * Ensure all entries returned by qom-list-types implements=<parent>
  * have <parent> as a parent.
  */
-static void test_qom_list_parents(const char *parent)
+static void test_qom_list_parents(QTestState *qts, const char *parent)
 {
     QList *types;
     QListEntry *e;
     QDict *index;
 
-    types = qom_list_types(parent, true);
+    types = qom_list_types(qts, parent, true);
     index = qom_type_index(types);
 
     QLIST_FOREACH_ENTRY(types, e) {
@@ -181,11 +183,12 @@ static void test_qom_list_fields(void)
     QList *all_types;
     QList *non_abstract;
     QListEntry *e;
+    QTestState *qts;
 
-    qtest_start(common_args);
+    qts = qtest_init(common_args);
 
-    all_types = qom_list_types(NULL, true);
-    non_abstract = qom_list_types(NULL, false);
+    all_types = qom_list_types(qts, NULL, true);
+    non_abstract = qom_list_types(qts, NULL, false);
 
     QLIST_FOREACH_ENTRY(all_types, e) {
         QDict *d = qobject_to(QDict, qlist_entry_obj(e));
@@ -198,27 +201,29 @@ static void test_qom_list_fields(void)
         g_assert(abstract == expected_abstract);
     }
 
-    test_qom_list_parents("object");
-    test_qom_list_parents("device");
-    test_qom_list_parents("sys-bus-device");
+    test_qom_list_parents(qts, "object");
+    test_qom_list_parents(qts, "device");
+    test_qom_list_parents(qts, "sys-bus-device");
 
     qobject_unref(all_types);
     qobject_unref(non_abstract);
-    qtest_end();
+    qtest_quit(qts);
 }
 
 static void test_device_intro_none(void)
 {
-    qtest_start(common_args);
-    test_one_device("nonexistent");
-    qtest_end();
+    QTestState *qts = qtest_init(common_args);
+
+    test_one_device(qts, "nonexistent");
+    qtest_quit(qts);
 }
 
 static void test_device_intro_abstract(void)
 {
-    qtest_start(common_args);
-    test_one_device("device");
-    qtest_end();
+    QTestState *qts = qtest_init(common_args);
+
+    test_one_device(qts, "device");
+    qtest_quit(qts);
 }
 
 static void test_device_intro_concrete(const void *args)
@@ -226,19 +231,20 @@ static void test_device_intro_concrete(const void *args)
     QList *types;
     QListEntry *entry;
     const char *type;
+    QTestState *qts;
 
-    qtest_start(args);
-    types = device_type_list(false);
+    qts = qtest_init(args);
+    types = device_type_list(qts, false);
 
     QLIST_FOREACH_ENTRY(types, entry) {
         type = qdict_get_try_str(qobject_to(QDict, qlist_entry_obj(entry)),
                                  "name");
         g_assert(type);
-        test_one_device(type);
+        test_one_device(qts, type);
     }
 
     qobject_unref(types);
-    qtest_end();
+    qtest_quit(qts);
     g_free((void *)args);
 }
 
@@ -247,10 +253,11 @@ static void test_abstract_interfaces(void)
     QList *all_types;
     QListEntry *e;
     QDict *index;
+    QTestState *qts;
 
-    qtest_start(common_args);
+    qts = qtest_init(common_args);
 
-    all_types = qom_list_types("interface", true);
+    all_types = qom_list_types(qts, "interface", true);
     index = qom_type_index(all_types);
 
     QLIST_FOREACH_ENTRY(all_types, e) {
@@ -273,7 +280,7 @@ static void test_abstract_interfaces(void)
 
     qobject_unref(all_types);
     qobject_unref(index);
-    qtest_end();
+    qtest_quit(qts);
 }
 
 static void add_machine_test_case(const char *mname)
diff --git a/tests/hd-geo-test.c b/tests/hd-geo-test.c
index ce665f1f83..62eb624726 100644
--- a/tests/hd-geo-test.c
+++ b/tests/hd-geo-test.c
@@ -77,33 +77,35 @@ static bool is_hd(const CHST *expected_chst)
     return expected_chst && expected_chst->cyls;
 }
 
-static void test_cmos_byte(int reg, int expected)
+static void test_cmos_byte(QTestState *qts, int reg, int expected)
 {
     enum { cmos_base = 0x70 };
     int actual;
 
-    outb(cmos_base + 0, reg);
-    actual = inb(cmos_base + 1);
+    qtest_outb(qts, cmos_base + 0, reg);
+    actual = qtest_inb(qts, cmos_base + 1);
     g_assert(actual == expected);
 }
 
-static void test_cmos_bytes(int reg0, int n, uint8_t expected[])
+static void test_cmos_bytes(QTestState *qts, int reg0, int n,
+                            uint8_t expected[])
 {
     int i;
 
     for (i = 0; i < 9; i++) {
-        test_cmos_byte(reg0 + i, expected[i]);
+        test_cmos_byte(qts, reg0 + i, expected[i]);
     }
 }
 
-static void test_cmos_disk_data(void)
+static void test_cmos_disk_data(QTestState *qts)
 {
-    test_cmos_byte(0x12,
+    test_cmos_byte(qts, 0x12,
                    (is_hd(cur_ide[0]) ? 0xf0 : 0) |
                    (is_hd(cur_ide[1]) ? 0x0f : 0));
 }
 
-static void test_cmos_drive_cyl(int reg0, const CHST *expected_chst)
+static void test_cmos_drive_cyl(QTestState *qts, int reg0,
+                                const CHST *expected_chst)
 {
     if (is_hd(expected_chst)) {
         int c = expected_chst->cyls;
@@ -113,29 +115,29 @@ static void test_cmos_drive_cyl(int reg0, const CHST *expected_chst)
             c & 0xff, c >> 8, h, 0xff, 0xff, 0xc0 | ((h > 8) << 3),
             c & 0xff, c >> 8, s
         };
-        test_cmos_bytes(reg0, 9, expected_bytes);
+        test_cmos_bytes(qts, reg0, 9, expected_bytes);
     } else {
         int i;
 
         for (i = 0; i < 9; i++) {
-            test_cmos_byte(reg0 + i, 0);
+            test_cmos_byte(qts, reg0 + i, 0);
         }
     }
 }
 
-static void test_cmos_drive1(void)
+static void test_cmos_drive1(QTestState *qts)
 {
-    test_cmos_byte(0x19, is_hd(cur_ide[0]) ? 47 : 0);
-    test_cmos_drive_cyl(0x1b, cur_ide[0]);
+    test_cmos_byte(qts, 0x19, is_hd(cur_ide[0]) ? 47 : 0);
+    test_cmos_drive_cyl(qts, 0x1b, cur_ide[0]);
 }
 
-static void test_cmos_drive2(void)
+static void test_cmos_drive2(QTestState *qts)
 {
-    test_cmos_byte(0x1a, is_hd(cur_ide[1]) ? 47 : 0);
-    test_cmos_drive_cyl(0x24, cur_ide[1]);
+    test_cmos_byte(qts, 0x1a, is_hd(cur_ide[1]) ? 47 : 0);
+    test_cmos_drive_cyl(qts, 0x24, cur_ide[1]);
 }
 
-static void test_cmos_disktransflag(void)
+static void test_cmos_disktransflag(QTestState *qts)
 {
     int val, i;
 
@@ -145,15 +147,15 @@ static void test_cmos_disktransflag(void)
             val |= cur_ide[i]->trans << (2 * i);
         }
     }
-    test_cmos_byte(0x39, val);
+    test_cmos_byte(qts, 0x39, val);
 }
 
-static void test_cmos(void)
+static void test_cmos(QTestState *qts)
 {
-    test_cmos_disk_data();
-    test_cmos_drive1();
-    test_cmos_drive2();
-    test_cmos_disktransflag();
+    test_cmos_disk_data(qts);
+    test_cmos_drive1(qts);
+    test_cmos_drive2(qts);
+    test_cmos_disktransflag(qts);
 }
 
 static int append_arg(int argc, char *argv[], int argv_sz, char *arg)
@@ -238,14 +240,15 @@ static void test_ide_none(void)
 {
     char **argv = g_new0(char *, ARGV_SIZE);
     char *args;
+    QTestState *qts;
 
     setup_common(argv, ARGV_SIZE);
     args = g_strjoinv(" ", argv);
-    qtest_start(args);
+    qts = qtest_init(args);
     g_strfreev(argv);
     g_free(args);
-    test_cmos();
-    qtest_end();
+    test_cmos(qts);
+    qtest_quit(qts);
 }
 
 static void test_ide_mbr(bool use_device, MBRcontents mbr)
@@ -255,6 +258,7 @@ static void test_ide_mbr(bool use_device, MBRcontents mbr)
     int argc;
     Backend i;
     const char *dev;
+    QTestState *qts;
 
     argc = setup_common(argv, ARGV_SIZE);
     for (i = 0; i < backend_last; i++) {
@@ -263,11 +267,11 @@ static void test_ide_mbr(bool use_device, MBRcontents mbr)
         argc = setup_ide(argc, argv, ARGV_SIZE, i, dev, i, mbr);
     }
     args = g_strjoinv(" ", argv);
-    qtest_start(args);
+    qts = qtest_init(args);
     g_strfreev(argv);
     g_free(args);
-    test_cmos();
-    qtest_end();
+    test_cmos(qts);
+    qtest_quit(qts);
 }
 
 /*
@@ -325,6 +329,7 @@ static void test_ide_drive_user(const char *dev, bool trans)
     int argc;
     int secs = img_secs[backend_small];
     const CHST expected_chst = { secs / (4 * 32) , 4, 32, trans };
+    QTestState *qts;
 
     argc = setup_common(argv, ARGV_SIZE);
     opts = g_strdup_printf("%s,%scyls=%d,heads=%d,secs=%d",
@@ -335,11 +340,11 @@ static void test_ide_drive_user(const char *dev, bool trans)
     argc = setup_ide(argc, argv, ARGV_SIZE, 0, opts, backend_small, mbr_chs);
     g_free(opts);
     args = g_strjoinv(" ", argv);
-    qtest_start(args);
+    qts = qtest_init(args);
     g_strfreev(argv);
     g_free(args);
-    test_cmos();
-    qtest_end();
+    test_cmos(qts);
+    qtest_quit(qts);
 }
 
 /*
@@ -367,6 +372,7 @@ static void test_ide_drive_cd_0(void)
     char *args;
     int argc, ide_idx;
     Backend i;
+    QTestState *qts;
 
     argc = setup_common(argv, ARGV_SIZE);
     for (i = 0; i <= backend_empty; i++) {
@@ -375,11 +381,11 @@ static void test_ide_drive_cd_0(void)
         argc = setup_ide(argc, argv, ARGV_SIZE, ide_idx, NULL, i, mbr_blank);
     }
     args = g_strjoinv(" ", argv);
-    qtest_start(args);
+    qts = qtest_init(args);
     g_strfreev(argv);
     g_free(args);
-    test_cmos();
-    qtest_end();
+    test_cmos(qts);
+    qtest_quit(qts);
 }
 
 int main(int argc, char **argv)
diff --git a/tests/libqos/virtio-mmio.c b/tests/libqos/virtio-mmio.c
index 3678c07ef0..213a5f9de0 100644
--- a/tests/libqos/virtio-mmio.c
+++ b/tests/libqos/virtio-mmio.c
@@ -148,7 +148,7 @@ static QVirtQueue *qvirtio_mmio_virtqueue_setup(QVirtioDevice *d,
     g_assert_cmpint(vq->size & (vq->size - 1), ==, 0);
 
     addr = guest_alloc(alloc, qvring_size(vq->size, dev->page_size));
-    qvring_init(alloc, vq, addr);
+    qvring_init(dev->qts, alloc, vq, addr);
     qvirtio_mmio_set_queue_address(d, vq->desc / dev->page_size);
 
     return vq;
diff --git a/tests/libqos/virtio-pci.c b/tests/libqos/virtio-pci.c
index 993d347830..a622ca26ca 100644
--- a/tests/libqos/virtio-pci.c
+++ b/tests/libqos/virtio-pci.c
@@ -199,6 +199,7 @@ static QVirtQueue *qvirtio_pci_virtqueue_setup(QVirtioDevice *d,
     uint32_t feat;
     uint64_t addr;
     QVirtQueuePCI *vqpci;
+    QVirtioPCIDevice *qvpcidev = container_of(d, QVirtioPCIDevice, vdev);
 
     vqpci = g_malloc0(sizeof(*vqpci));
     feat = qvirtio_pci_get_guest_features(d);
@@ -224,7 +225,7 @@ static QVirtQueue *qvirtio_pci_virtqueue_setup(QVirtioDevice *d,
 
     addr = guest_alloc(alloc, qvring_size(vqpci->vq.size,
                                           VIRTIO_PCI_VRING_ALIGN));
-    qvring_init(alloc, &vqpci->vq, addr);
+    qvring_init(qvpcidev->pdev->bus->qts, alloc, &vqpci->vq, addr);
     qvirtio_pci_set_queue_address(d, vqpci->vq.desc / VIRTIO_PCI_VRING_ALIGN);
 
     return &vqpci->vq;
diff --git a/tests/libqos/virtio.c b/tests/libqos/virtio.c
index 5e8f39b4d3..b4c01dc0c1 100644
--- a/tests/libqos/virtio.c
+++ b/tests/libqos/virtio.c
@@ -162,7 +162,8 @@ void qvirtio_wait_config_isr(QVirtioDevice *d, gint64 timeout_us)
     }
 }
 
-void qvring_init(const QGuestAllocator *alloc, QVirtQueue *vq, uint64_t addr)
+void qvring_init(QTestState *qts, const QGuestAllocator *alloc, QVirtQueue *vq,
+                 uint64_t addr)
 {
     int i;
 
@@ -173,22 +174,23 @@ void qvring_init(const QGuestAllocator *alloc, QVirtQueue *vq, uint64_t addr)
 
     for (i = 0; i < vq->size - 1; i++) {
         /* vq->desc[i].addr */
-        writeq(vq->desc + (16 * i), 0);
+        qtest_writeq(qts, vq->desc + (16 * i), 0);
         /* vq->desc[i].next */
-        writew(vq->desc + (16 * i) + 14, i + 1);
+        qtest_writew(qts, vq->desc + (16 * i) + 14, i + 1);
     }
 
     /* vq->avail->flags */
-    writew(vq->avail, 0);
+    qtest_writew(qts, vq->avail, 0);
     /* vq->avail->idx */
-    writew(vq->avail + 2, 0);
+    qtest_writew(qts, vq->avail + 2, 0);
     /* vq->avail->used_event */
-    writew(vq->avail + 4 + (2 * vq->size), 0);
+    qtest_writew(qts, vq->avail + 4 + (2 * vq->size), 0);
 
     /* vq->used->flags */
-    writew(vq->used, 0);
+    qtest_writew(qts, vq->used, 0);
     /* vq->used->avail_event */
-    writew(vq->used + 2 + sizeof(struct vring_used_elem) * vq->size, 0);
+    qtest_writew(qts, vq->used + 2 + sizeof(struct vring_used_elem) * vq->size,
+                 0);
 }
 
 QVRingIndirectDesc *qvring_indirect_desc_setup(QVirtioDevice *d,
diff --git a/tests/libqos/virtio.h b/tests/libqos/virtio.h
index 51d2359ace..7b97f5e567 100644
--- a/tests/libqos/virtio.h
+++ b/tests/libqos/virtio.h
@@ -129,7 +129,8 @@ QVirtQueue *qvirtqueue_setup(QVirtioDevice *d,
 void qvirtqueue_cleanup(const QVirtioBus *bus, QVirtQueue *vq,
                         QGuestAllocator *alloc);
 
-void qvring_init(const QGuestAllocator *alloc, QVirtQueue *vq, uint64_t addr);
+void qvring_init(QTestState *qts, const QGuestAllocator *alloc, QVirtQueue *vq,
+                 uint64_t addr);
 QVRingIndirectDesc *qvring_indirect_desc_setup(QVirtioDevice *d,
                                         QGuestAllocator *alloc, uint16_t elem);
 void qvring_indirect_desc_add(QVRingIndirectDesc *indirect, uint64_t data,
diff --git a/tests/libqtest.c b/tests/libqtest.c
index c49b85482d..8ac0c02af4 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -1038,15 +1038,6 @@ QDict *qmp(const char *fmt, ...)
     return response;
 }
 
-void qmp_send(const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start(ap, fmt);
-    qtest_qmp_vsend(global_qtest, fmt, ap);
-    va_end(ap);
-}
-
 char *hmp(const char *fmt, ...)
 {
     va_list ap;
@@ -1232,7 +1223,7 @@ void qtest_qmp_device_del(const char *id)
                                     &got_event);
     qobject_unref(rsp);
     if (!got_event) {
-        rsp = qmp_receive();
+        rsp = qtest_qmp_receive(global_qtest);
         g_assert_cmpstr(qdict_get_try_str(rsp, "event"),
                         ==, "DEVICE_DELETED");
         qobject_unref(rsp);
diff --git a/tests/libqtest.h b/tests/libqtest.h
index a16acd58a6..a98ea15b7d 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -29,7 +29,7 @@ extern QTestState *global_qtest;
  * @fmt...: Format for creating other arguments to pass to QEMU, formatted
  * like sprintf().
  *
- * Convenience wrapper around qtest_start().
+ * Convenience wrapper around qtest_init().
  *
  * Returns: #QTestState instance.
  */
@@ -41,7 +41,7 @@ QTestState *qtest_initf(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
  * like vsprintf().
  * @ap: Format arguments.
  *
- * Convenience wrapper around qtest_start().
+ * Convenience wrapper around qtest_init().
  *
  * Returns: #QTestState instance.
  */
@@ -619,26 +619,6 @@ static inline void qtest_end(void)
 QDict *qmp(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
 
 /**
- * qmp_send:
- * @fmt...: QMP message to send to qemu, formatted like
- * qobject_from_jsonf_nofail().  See parse_escape() for what's
- * supported after '%'.
- *
- * Sends a QMP message to QEMU and leaves the response in the stream.
- */
-void qmp_send(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
-
-/**
- * qmp_receive:
- *
- * Reads a QMP message from QEMU and returns the response.
- */
-static inline QDict *qmp_receive(void)
-{
-    return qtest_qmp_receive(global_qtest);
-}
-
-/**
  * qmp_eventwait:
  * @s: #event event to wait for.
  *
@@ -650,18 +630,6 @@ static inline void qmp_eventwait(const char *event)
 }
 
 /**
- * qmp_eventwait_ref:
- * @s: #event event to wait for.
- *
- * Continuously polls for QMP responses until it receives the desired event.
- * Returns a copy of the event for further investigation.
- */
-static inline QDict *qmp_eventwait_ref(const char *event)
-{
-    return qtest_qmp_eventwait_ref(global_qtest, event);
-}
-
-/**
  * hmp:
  * @fmt...: HMP command to send to QEMU, formats arguments like sprintf().
  *
@@ -683,30 +651,6 @@ static inline bool get_irq(int num)
 }
 
 /**
- * irq_intercept_in:
- * @string: QOM path of a device.
- *
- * Associate qtest irqs with the GPIO-in pins of the device
- * whose path is specified by @string.
- */
-static inline void irq_intercept_in(const char *string)
-{
-    qtest_irq_intercept_in(global_qtest, string);
-}
-
-/**
- * qtest_irq_intercept_out:
- * @string: QOM path of a device.
- *
- * Associate qtest irqs with the GPIO-out pins of the device
- * whose path is specified by @string.
- */
-static inline void irq_intercept_out(const char *string)
-{
-    qtest_irq_intercept_out(global_qtest, string);
-}
-
-/**
  * outb:
  * @addr: I/O port to write to.
  * @value: Value being written.
@@ -895,19 +839,6 @@ static inline void memread(uint64_t addr, void *data, size_t size)
 }
 
 /**
- * bufread:
- * @addr: Guest address to read from.
- * @data: Pointer to where memory contents will be stored.
- * @size: Number of bytes to read.
- *
- * Read guest memory into a buffer, receive using a base64 encoding.
- */
-static inline void bufread(uint64_t addr, void *data, size_t size)
-{
-    qtest_bufread(global_qtest, addr, data, size);
-}
-
-/**
  * memwrite:
  * @addr: Guest address to write to.
  * @data: Pointer to the bytes that will be written to guest memory.
@@ -921,32 +852,6 @@ static inline void memwrite(uint64_t addr, const void *data, size_t size)
 }
 
 /**
- * bufwrite:
- * @addr: Guest address to write to.
- * @data: Pointer to the bytes that will be written to guest memory.
- * @size: Number of bytes to write.
- *
- * Write a buffer to guest memory, transmit using a base64 encoding.
- */
-static inline void bufwrite(uint64_t addr, const void *data, size_t size)
-{
-    qtest_bufwrite(global_qtest, addr, data, size);
-}
-
-/**
- * qmemset:
- * @addr: Guest address to write to.
- * @patt: Byte pattern to fill the guest memory region with.
- * @size: Number of bytes to write.
- *
- * Write a pattern to guest memory.
- */
-static inline void qmemset(uint64_t addr, uint8_t patt, size_t size)
-{
-    qtest_memset(global_qtest, addr, patt, size);
-}
-
-/**
  * clock_step_next:
  *
  * Advance the QEMU_CLOCK_VIRTUAL to the next deadline.
@@ -971,19 +876,6 @@ static inline int64_t clock_step(int64_t step)
     return qtest_clock_step(global_qtest, step);
 }
 
-/**
- * clock_set:
- * @val: Nanoseconds value to advance the clock to.
- *
- * Advance the QEMU_CLOCK_VIRTUAL to @val nanoseconds since the VM was launched.
- *
- * Returns: The current value of the QEMU_CLOCK_VIRTUAL in nanoseconds.
- */
-static inline int64_t clock_set(int64_t val)
-{
-    return qtest_clock_set(global_qtest, val);
-}
-
 QDict *qmp_fd_receive(int fd);
 void qmp_fd_vsend(int fd, const char *fmt, va_list ap) GCC_FMT_ATTR(2, 0);
 void qmp_fd_send(int fd, const char *fmt, ...) GCC_FMT_ATTR(2, 3);
diff --git a/tests/numa-test.c b/tests/numa-test.c
index 9824fdd587..8de8581231 100644
--- a/tests/numa-test.c
+++ b/tests/numa-test.c
@@ -23,18 +23,19 @@ static void test_mon_explicit(const void *data)
 {
     char *s;
     char *cli;
+    QTestState *qts;
 
     cli = make_cli(data, "-smp 8 "
                    "-numa node,nodeid=0,cpus=0-3 "
                    "-numa node,nodeid=1,cpus=4-7 ");
-    qtest_start(cli);
+    qts = qtest_init(cli);
 
-    s = hmp("info numa");
+    s = qtest_hmp(qts, "info numa");
     g_assert(strstr(s, "node 0 cpus: 0 1 2 3"));
     g_assert(strstr(s, "node 1 cpus: 4 5 6 7"));
     g_free(s);
 
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
@@ -42,16 +43,17 @@ static void test_mon_default(const void *data)
 {
     char *s;
     char *cli;
+    QTestState *qts;
 
     cli = make_cli(data, "-smp 8 -numa node -numa node");
-    qtest_start(cli);
+    qts = qtest_init(cli);
 
-    s = hmp("info numa");
+    s = qtest_hmp(qts, "info numa");
     g_assert(strstr(s, "node 0 cpus: 0 2 4 6"));
     g_assert(strstr(s, "node 1 cpus: 1 3 5 7"));
     g_free(s);
 
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
@@ -59,24 +61,25 @@ static void test_mon_partial(const void *data)
 {
     char *s;
     char *cli;
+    QTestState *qts;
 
     cli = make_cli(data, "-smp 8 "
                    "-numa node,nodeid=0,cpus=0-1 "
                    "-numa node,nodeid=1,cpus=4-5 ");
-    qtest_start(cli);
+    qts = qtest_init(cli);
 
-    s = hmp("info numa");
+    s = qtest_hmp(qts, "info numa");
     g_assert(strstr(s, "node 0 cpus: 0 1 2 3 6 7"));
     g_assert(strstr(s, "node 1 cpus: 4 5"));
     g_free(s);
 
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
-static QList *get_cpus(QDict **resp)
+static QList *get_cpus(QTestState *qts, QDict **resp)
 {
-    *resp = qmp("{ 'execute': 'query-cpus' }");
+    *resp = qtest_qmp(qts, "{ 'execute': 'query-cpus' }");
     g_assert(*resp);
     g_assert(qdict_haskey(*resp, "return"));
     return qdict_get_qlist(*resp, "return");
@@ -88,10 +91,11 @@ static void test_query_cpus(const void *data)
     QDict *resp;
     QList *cpus;
     QObject *e;
+    QTestState *qts;
 
     cli = make_cli(data, "-smp 8 -numa node,cpus=0-3 -numa node,cpus=4-7");
-    qtest_start(cli);
-    cpus = get_cpus(&resp);
+    qts = qtest_init(cli);
+    cpus = get_cpus(qts, &resp);
     g_assert(cpus);
 
     while ((e = qlist_pop(cpus))) {
@@ -115,7 +119,7 @@ static void test_query_cpus(const void *data)
     }
 
     qobject_unref(resp);
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
@@ -125,6 +129,7 @@ static void pc_numa_cpu(const void *data)
     QDict *resp;
     QList *cpus;
     QObject *e;
+    QTestState *qts;
 
     cli = make_cli(data, "-cpu pentium -smp 8,sockets=2,cores=2,threads=2 "
         "-numa node,nodeid=0 -numa node,nodeid=1 "
@@ -132,8 +137,8 @@ static void pc_numa_cpu(const void *data)
         "-numa cpu,node-id=0,socket-id=1,core-id=0 "
         "-numa cpu,node-id=0,socket-id=1,core-id=1,thread-id=0 "
         "-numa cpu,node-id=1,socket-id=1,core-id=1,thread-id=1");
-    qtest_start(cli);
-    cpus = get_cpus(&resp);
+    qts = qtest_init(cli);
+    cpus = get_cpus(qts, &resp);
     g_assert(cpus);
 
     while ((e = qlist_pop(cpus))) {
@@ -168,7 +173,7 @@ static void pc_numa_cpu(const void *data)
     }
 
     qobject_unref(resp);
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
@@ -178,6 +183,7 @@ static void spapr_numa_cpu(const void *data)
     QDict *resp;
     QList *cpus;
     QObject *e;
+    QTestState *qts;
 
     cli = make_cli(data, "-smp 4,cores=4 "
         "-numa node,nodeid=0 -numa node,nodeid=1 "
@@ -185,8 +191,8 @@ static void spapr_numa_cpu(const void *data)
         "-numa cpu,node-id=0,core-id=1 "
         "-numa cpu,node-id=0,core-id=2 "
         "-numa cpu,node-id=1,core-id=3");
-    qtest_start(cli);
-    cpus = get_cpus(&resp);
+    qts = qtest_init(cli);
+    cpus = get_cpus(qts, &resp);
     g_assert(cpus);
 
     while ((e = qlist_pop(cpus))) {
@@ -213,7 +219,7 @@ static void spapr_numa_cpu(const void *data)
     }
 
     qobject_unref(resp);
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
@@ -223,13 +229,14 @@ static void aarch64_numa_cpu(const void *data)
     QDict *resp;
     QList *cpus;
     QObject *e;
+    QTestState *qts;
 
     cli = make_cli(data, "-smp 2 "
         "-numa node,nodeid=0 -numa node,nodeid=1 "
         "-numa cpu,node-id=1,thread-id=0 "
         "-numa cpu,node-id=0,thread-id=1");
-    qtest_start(cli);
-    cpus = get_cpus(&resp);
+    qts = qtest_init(cli);
+    cpus = get_cpus(qts, &resp);
     g_assert(cpus);
 
     while ((e = qlist_pop(cpus))) {
@@ -256,7 +263,7 @@ static void aarch64_numa_cpu(const void *data)
     }
 
     qobject_unref(resp);
-    qtest_end();
+    qtest_quit(qts);
     g_free(cli);
 }
 
diff --git a/tests/q35-test.c b/tests/q35-test.c
index 34b34bc2b9..a68183d513 100644
--- a/tests/q35-test.c
+++ b/tests/q35-test.c
@@ -84,10 +84,11 @@ static void test_smram_lock(void)
     QPCIBus *pcibus;
     QPCIDevice *pcidev;
     QDict *response;
+    QTestState *qts;
 
-    qtest_start("-M q35");
+    qts = qtest_init("-M q35");
 
-    pcibus = qpci_new_pc(global_qtest, NULL);
+    pcibus = qpci_new_pc(qts, NULL);
     g_assert(pcibus != NULL);
 
     pcidev = qpci_device_find(pcibus, 0);
@@ -106,7 +107,7 @@ static void test_smram_lock(void)
     g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
 
     /* reset */
-    response = qmp("{'execute': 'system_reset', 'arguments': {} }");
+    response = qtest_qmp(qts, "{'execute': 'system_reset', 'arguments': {} }");
     g_assert(response);
     g_assert(!qdict_haskey(response, "error"));
     qobject_unref(response);
@@ -120,33 +121,29 @@ static void test_smram_lock(void)
     g_free(pcidev);
     qpci_free_pc(pcibus);
 
-    qtest_end();
+    qtest_quit(qts);
 }
 
 static void test_tseg_size(const void *data)
 {
     const TsegSizeArgs *args = data;
-    char *cmdline;
     QPCIBus *pcibus;
     QPCIDevice *pcidev;
     uint8_t smram_val;
     uint8_t esmramc_val;
     uint32_t ram_offs;
+    QTestState *qts;
 
     if (args->esmramc_tseg_sz == MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK) {
-        cmdline = g_strdup_printf("-M q35 -m %uM "
-                                  "-global mch.extended-tseg-mbytes=%u",
-                                  TSEG_SIZE_TEST_GUEST_RAM_MBYTES,
-                                  args->extended_tseg_mbytes);
+        qts = qtest_initf("-M q35 -m %uM -global mch.extended-tseg-mbytes=%u",
+                          TSEG_SIZE_TEST_GUEST_RAM_MBYTES,
+                          args->extended_tseg_mbytes);
     } else {
-        cmdline = g_strdup_printf("-M q35 -m %uM",
-                                  TSEG_SIZE_TEST_GUEST_RAM_MBYTES);
+        qts = qtest_initf("-M q35 -m %uM", TSEG_SIZE_TEST_GUEST_RAM_MBYTES);
     }
-    qtest_start(cmdline);
-    g_free(cmdline);
 
     /* locate the DRAM controller */
-    pcibus = qpci_new_pc(global_qtest, NULL);
+    pcibus = qpci_new_pc(qts, NULL);
     g_assert(pcibus != NULL);
     pcidev = qpci_device_find(pcibus, 0);
     g_assert(pcidev != NULL);
@@ -175,18 +172,18 @@ static void test_tseg_size(const void *data)
      */
     ram_offs = (TSEG_SIZE_TEST_GUEST_RAM_MBYTES - args->expected_tseg_mbytes) *
                1024 * 1024 - 1;
-    g_assert_cmpint(readb(ram_offs), ==, 0);
-    writeb(ram_offs, 1);
-    g_assert_cmpint(readb(ram_offs), ==, 1);
+    g_assert_cmpint(qtest_readb(qts, ram_offs), ==, 0);
+    qtest_writeb(qts, ram_offs, 1);
+    g_assert_cmpint(qtest_readb(qts, ram_offs), ==, 1);
 
     ram_offs++;
-    g_assert_cmpint(readb(ram_offs), ==, 0xff);
-    writeb(ram_offs, 1);
-    g_assert_cmpint(readb(ram_offs), ==, 0xff);
+    g_assert_cmpint(qtest_readb(qts, ram_offs), ==, 0xff);
+    qtest_writeb(qts, ram_offs, 1);
+    g_assert_cmpint(qtest_readb(qts, ram_offs), ==, 0xff);
 
     g_free(pcidev);
     qpci_free_pc(pcibus);
-    qtest_end();
+    qtest_quit(qts);
 }
 
 int main(int argc, char **argv)
diff --git a/tests/qemu-iotests/001 b/tests/qemu-iotests/001
index 5d266e170a..d87a535c33 100755
--- a/tests/qemu-iotests/001
+++ b/tests/qemu-iotests/001
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/002 b/tests/qemu-iotests/002
index 7fb85084a1..fd413bce48 100755
--- a/tests/qemu-iotests/002
+++ b/tests/qemu-iotests/002
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/003 b/tests/qemu-iotests/003
index f008c57cdc..ccd3a39dfb 100755
--- a/tests/qemu-iotests/003
+++ b/tests/qemu-iotests/003
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 size=128M
 offset=67M
diff --git a/tests/qemu-iotests/004 b/tests/qemu-iotests/004
index 64fab3e714..d308dc4b49 100755
--- a/tests/qemu-iotests/004
+++ b/tests/qemu-iotests/004
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt raw qcow qcow2 qed vdi vmdk vhdx luks
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/005 b/tests/qemu-iotests/005
index 2fef63af88..9c7681c19b 100755
--- a/tests/qemu-iotests/005
+++ b/tests/qemu-iotests/005
@@ -55,6 +55,15 @@ if [ "$IMGPROTO" = "sheepdog" ]; then
     _notrun "image protocol $IMGPROTO does not support large image sizes"
 fi
 
+# Sanity check: For raw, we require a file system that permits the creation
+# of a HUGE (but very sparse) file. Check we can create it before continuing.
+if [ "$IMGFMT" = "raw" ]; then
+    if ! truncate --size=5T "$TEST_IMG"; then
+        _notrun "file system on $TEST_DIR does not support large enough files"
+    fi
+    rm "$TEST_IMG"
+fi
+
 echo
 echo "creating large image"
 _make_test_img 5000G
diff --git a/tests/qemu-iotests/007 b/tests/qemu-iotests/007
index 3ab5490db3..6abd402423 100755
--- a/tests/qemu-iotests/007
+++ b/tests/qemu-iotests/007
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # currently only qcow2 allows for consistency checks using qemu-img
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 # refcount_bits must be at least 4 so we can create ten internal snapshots
 # (1 bit supports none, 2 bits support two, 4 bits support 14)
 _unsupported_imgopts 'refcount_bits=\(1\|2\)[^0-9]'
diff --git a/tests/qemu-iotests/008 b/tests/qemu-iotests/008
index 75067e36ad..2b81b119bf 100755
--- a/tests/qemu-iotests/008
+++ b/tests/qemu-iotests/008
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/009 b/tests/qemu-iotests/009
index bc4b461122..51b200db1d 100755
--- a/tests/qemu-iotests/009
+++ b/tests/qemu-iotests/009
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=6G
diff --git a/tests/qemu-iotests/010 b/tests/qemu-iotests/010
index 6920408d28..48c533f632 100755
--- a/tests/qemu-iotests/010
+++ b/tests/qemu-iotests/010
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=6G
diff --git a/tests/qemu-iotests/011 b/tests/qemu-iotests/011
index b4c7e8f799..8b1fce069a 100755
--- a/tests/qemu-iotests/011
+++ b/tests/qemu-iotests/011
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=6G
diff --git a/tests/qemu-iotests/012 b/tests/qemu-iotests/012
index 2c3b42d9dd..12957285b3 100755
--- a/tests/qemu-iotests/012
+++ b/tests/qemu-iotests/012
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 
 # Remove once all tests are fixed to use TEST_IMG_FILE
 # correctly and common.rc sets it unconditionally
diff --git a/tests/qemu-iotests/015 b/tests/qemu-iotests/015
index 5a4063e4f5..eec5387f3d 100755
--- a/tests/qemu-iotests/015
+++ b/tests/qemu-iotests/015
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # actually any format that supports snapshots
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 # Internal snapshots are (currently) impossible with refcount_bits=1
 _unsupported_imgopts 'refcount_bits=1[^0-9]'
 
diff --git a/tests/qemu-iotests/017 b/tests/qemu-iotests/017
index 83744f29a3..79875de454 100755
--- a/tests/qemu-iotests/017
+++ b/tests/qemu-iotests/017
@@ -41,7 +41,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow qcow2 vmdk qed
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat"
 
 TEST_OFFSETS="0 4294967296"
diff --git a/tests/qemu-iotests/020 b/tests/qemu-iotests/020
index 71fa753b4e..6b0ebb37d2 100755
--- a/tests/qemu-iotests/020
+++ b/tests/qemu-iotests/020
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Any format supporting backing files
 _supported_fmt qcow qcow2 vmdk qed
 _supported_proto file
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" \
                      "subformat=twoGbMaxExtentFlat" \
                      "subformat=twoGbMaxExtentSparse"
diff --git a/tests/qemu-iotests/021 b/tests/qemu-iotests/021
index f6555f3b74..f888269fd4 100755
--- a/tests/qemu-iotests/021
+++ b/tests/qemu-iotests/021
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/022 b/tests/qemu-iotests/022
index b68cd64b33..99eb08f57f 100755
--- a/tests/qemu-iotests/022
+++ b/tests/qemu-iotests/022
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Any format that supports snapshots
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 
 TEST_OFFSETS="10485760 4294967296"
 CLUSTER_SIZE="4096"
diff --git a/tests/qemu-iotests/025 b/tests/qemu-iotests/025
index d9a4ebc5e7..e05d833452 100755
--- a/tests/qemu-iotests/025
+++ b/tests/qemu-iotests/025
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt raw qcow2 qed luks
 _supported_proto file sheepdog rbd nfs
-_supported_os Linux
 
 echo "=== Creating image"
 echo
diff --git a/tests/qemu-iotests/026 b/tests/qemu-iotests/026
index ca89ad7048..e30243608b 100755
--- a/tests/qemu-iotests/026
+++ b/tests/qemu-iotests/026
@@ -41,7 +41,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Currently only qcow2 supports rebasing
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 _default_cache_mode "writethrough"
 _supported_cache_modes "writethrough" "none"
 # The refcount table tests expect a certain minimum width for refcount entries
diff --git a/tests/qemu-iotests/027 b/tests/qemu-iotests/027
index b7df9701f7..4cb638022a 100755
--- a/tests/qemu-iotests/027
+++ b/tests/qemu-iotests/027
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt vmdk qcow qcow2 qed
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/029 b/tests/qemu-iotests/029
index 5f42f76cc6..94c2713132 100755
--- a/tests/qemu-iotests/029
+++ b/tests/qemu-iotests/029
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow2
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 # Internal snapshots are (currently) impossible with refcount_bits=1
 _unsupported_imgopts 'refcount_bits=1[^0-9]'
 
diff --git a/tests/qemu-iotests/031 b/tests/qemu-iotests/031
index ef92d8eee3..a3c25ec237 100755
--- a/tests/qemu-iotests/031
+++ b/tests/qemu-iotests/031
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This tests qcow2-specific low-level functionality
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 CLUSTER_SIZE=65536
 
diff --git a/tests/qemu-iotests/032 b/tests/qemu-iotests/032
index a1757bb15e..23c216c549 100755
--- a/tests/qemu-iotests/032
+++ b/tests/qemu-iotests/032
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This works for any image format (though unlikely to segfault for raw)
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 echo
 echo === Prepare image ===
diff --git a/tests/qemu-iotests/033 b/tests/qemu-iotests/033
index cfdf1ec2ba..362a48c0a0 100755
--- a/tests/qemu-iotests/033
+++ b/tests/qemu-iotests/033
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/035 b/tests/qemu-iotests/035
index 46aa835936..ad6fa3115a 100755
--- a/tests/qemu-iotests/035
+++ b/tests/qemu-iotests/035
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 
 
 size=6G
diff --git a/tests/qemu-iotests/036 b/tests/qemu-iotests/036
index 1b56394129..f06ff67408 100755
--- a/tests/qemu-iotests/036
+++ b/tests/qemu-iotests/036
@@ -43,7 +43,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This tests qcow2-specific low-level functionality
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 # Only qcow2v3 and later supports feature bits
 IMGOPTS="compat=1.1"
diff --git a/tests/qemu-iotests/037 b/tests/qemu-iotests/037
index 0781bebefe..819a2a52d2 100755
--- a/tests/qemu-iotests/037
+++ b/tests/qemu-iotests/037
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow qcow2 vmdk qed
 _supported_proto file
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" \
                      "subformat=twoGbMaxExtentFlat" \
                      "subformat=twoGbMaxExtentSparse"
diff --git a/tests/qemu-iotests/042 b/tests/qemu-iotests/042
index a9a7fc3041..0e85b356b7 100755
--- a/tests/qemu-iotests/042
+++ b/tests/qemu-iotests/042
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2 qed
 _supported_proto file
-_supported_os Linux
 
 echo
 echo "== Creating zero size image =="
diff --git a/tests/qemu-iotests/043 b/tests/qemu-iotests/043
index 9894b154ec..67cc7e74c2 100755
--- a/tests/qemu-iotests/043
+++ b/tests/qemu-iotests/043
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Any format supporting backing files
 _supported_fmt qcow2 qed
 _supported_proto file
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/046 b/tests/qemu-iotests/046
index 95160bea4c..543355c64f 100755
--- a/tests/qemu-iotests/046
+++ b/tests/qemu-iotests/046
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 CLUSTER_SIZE=64k
 size=128M
diff --git a/tests/qemu-iotests/047 b/tests/qemu-iotests/047
index ce81fc6fa7..4528465fb0 100755
--- a/tests/qemu-iotests/047
+++ b/tests/qemu-iotests/047
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 
 size=128M
 
diff --git a/tests/qemu-iotests/049 b/tests/qemu-iotests/049
index bc09cd6717..c100d30ed0 100755
--- a/tests/qemu-iotests/049
+++ b/tests/qemu-iotests/049
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 filter_test_dir()
 {
diff --git a/tests/qemu-iotests/050 b/tests/qemu-iotests/050
index dd7b2c72eb..211fc00797 100755
--- a/tests/qemu-iotests/050
+++ b/tests/qemu-iotests/050
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2 qed
 _supported_proto file
-_supported_os Linux
 
 if test "$IMGFMT" = qcow2 && test $IMGOPTS = ""; then
   IMGOPTS=compat=1.1
diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 02ac960da4..a3deb1fcad 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 # A compat=0.10 image is created in this test which does not support anything
 # other than refcount_bits=16
 _unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)'
diff --git a/tests/qemu-iotests/052 b/tests/qemu-iotests/052
index b3a2dc1143..6e2ecbfe21 100755
--- a/tests/qemu-iotests/052
+++ b/tests/qemu-iotests/052
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 
 # Don't do O_DIRECT on tmpfs
 _supported_cache_modes "writeback" "writethrough" "unsafe"
diff --git a/tests/qemu-iotests/053 b/tests/qemu-iotests/053
index 50c62f0f56..e82bb69881 100755
--- a/tests/qemu-iotests/053
+++ b/tests/qemu-iotests/053
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2 qcow
 _supported_proto file
-_supported_os Linux
 
 echo
 echo "== Creating single sector image =="
diff --git a/tests/qemu-iotests/054 b/tests/qemu-iotests/054
index 0d5e14f847..a8905b60d0 100755
--- a/tests/qemu-iotests/054
+++ b/tests/qemu-iotests/054
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 echo
 echo "creating too large image (1 EB)"
diff --git a/tests/qemu-iotests/062 b/tests/qemu-iotests/062
index ed7400fed2..d5f818fcce 100755
--- a/tests/qemu-iotests/062
+++ b/tests/qemu-iotests/062
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This tests qocw2-specific low-level functionality
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 
 IMGOPTS="compat=1.1"
 IMG_SIZE=64M
diff --git a/tests/qemu-iotests/063 b/tests/qemu-iotests/063
index 2d5c0ce9fb..fe4892e467 100755
--- a/tests/qemu-iotests/063
+++ b/tests/qemu-iotests/063
@@ -41,7 +41,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow qcow2 vmdk qed raw
 _supported_proto file
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" \
                      "subformat=twoGbMaxExtentFlat" \
                      "subformat=twoGbMaxExtentSparse"
diff --git a/tests/qemu-iotests/066 b/tests/qemu-iotests/066
index f480986e35..28f8c98412 100755
--- a/tests/qemu-iotests/066
+++ b/tests/qemu-iotests/066
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This tests qocw2-specific low-level functionality
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 
 # Intentionally create an unaligned image
 IMGOPTS="compat=1.1"
diff --git a/tests/qemu-iotests/067 b/tests/qemu-iotests/067
index fda16a6b0d..926c79b37c 100755
--- a/tests/qemu-iotests/067
+++ b/tests/qemu-iotests/067
@@ -32,7 +32,6 @@ status=1	# failure is the default!
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 # Because anything other than 16 would change the output of query-block
 _unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)'
 
diff --git a/tests/qemu-iotests/068 b/tests/qemu-iotests/068
index 881a022107..22f5ca3ba6 100755
--- a/tests/qemu-iotests/068
+++ b/tests/qemu-iotests/068
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This tests qocw2-specific low-level functionality
 _supported_fmt qcow2
 _supported_proto generic
-_supported_os Linux
 
 IMGOPTS="compat=1.1"
 IMG_SIZE=128K
diff --git a/tests/qemu-iotests/069 b/tests/qemu-iotests/069
index 6a8e4aa22e..3974714852 100755
--- a/tests/qemu-iotests/069
+++ b/tests/qemu-iotests/069
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qed qcow qcow2 vmdk
 _supported_proto file
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat"
 
 IMG_SIZE=128K
diff --git a/tests/qemu-iotests/071 b/tests/qemu-iotests/071
index 7f3e5abd57..1cca9233d0 100755
--- a/tests/qemu-iotests/071
+++ b/tests/qemu-iotests/071
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 do_run_qemu()
 {
diff --git a/tests/qemu-iotests/072 b/tests/qemu-iotests/072
index 6f9f247fa5..661b36da2d 100755
--- a/tests/qemu-iotests/072
+++ b/tests/qemu-iotests/072
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt vpc vmdk vhdx vdi qed qcow2 qcow
 _supported_proto file
-_supported_os Linux
 
 IMG_SIZE=64M
 
diff --git a/tests/qemu-iotests/073 b/tests/qemu-iotests/073
index 990f90acbd..e684b1b780 100755
--- a/tests/qemu-iotests/073
+++ b/tests/qemu-iotests/073
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow2
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 
 CLUSTER_SIZE=64k
 size=128M
diff --git a/tests/qemu-iotests/079 b/tests/qemu-iotests/079
index 1b6594ebef..81f0c21f53 100755
--- a/tests/qemu-iotests/079
+++ b/tests/qemu-iotests/079
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file nfs
-_supported_os Linux
 
 echo "=== Check option preallocation and cluster_size ==="
 echo
diff --git a/tests/qemu-iotests/082 b/tests/qemu-iotests/082
index 278511dba4..bbbdf555dc 100755
--- a/tests/qemu-iotests/082
+++ b/tests/qemu-iotests/082
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file nfs
-_supported_os Linux
 
 run_qemu_img()
 {
diff --git a/tests/qemu-iotests/085 b/tests/qemu-iotests/085
index 68cb665987..d40fdab542 100755
--- a/tests/qemu-iotests/085
+++ b/tests/qemu-iotests/085
@@ -56,7 +56,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 
 # ${1}: unique identifier for the snapshot filename
diff --git a/tests/qemu-iotests/089 b/tests/qemu-iotests/089
index 6609954908..ad029f1f09 100755
--- a/tests/qemu-iotests/089
+++ b/tests/qemu-iotests/089
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 # Because anything other than 16 would change the output of qemu_io -c info
 _unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)'
 
diff --git a/tests/qemu-iotests/090 b/tests/qemu-iotests/090
index 193bae7d77..9f8cfbb80f 100755
--- a/tests/qemu-iotests/090
+++ b/tests/qemu-iotests/090
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file nfs
-_supported_os Linux
 
 IMG_SIZE=128K
 
diff --git a/tests/qemu-iotests/094 b/tests/qemu-iotests/094
index 0bcca77261..9343e09492 100755
--- a/tests/qemu-iotests/094
+++ b/tests/qemu-iotests/094
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto nbd
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat"
 
 _make_test_img 64M
diff --git a/tests/qemu-iotests/095 b/tests/qemu-iotests/095
index 18505b7181..58fe174b5e 100755
--- a/tests/qemu-iotests/095
+++ b/tests/qemu-iotests/095
@@ -44,7 +44,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 size_smaller=5M
 size_larger=100M
diff --git a/tests/qemu-iotests/098 b/tests/qemu-iotests/098
index 461144c831..1c1d1c468f 100755
--- a/tests/qemu-iotests/098
+++ b/tests/qemu-iotests/098
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 IMGOPTS="compat=1.1"
 
diff --git a/tests/qemu-iotests/102 b/tests/qemu-iotests/102
index cedd2b25dc..749ff66b8a 100755
--- a/tests/qemu-iotests/102
+++ b/tests/qemu-iotests/102
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 IMG_SIZE=64K
 
diff --git a/tests/qemu-iotests/103 b/tests/qemu-iotests/103
index 6773e94d9f..554b9de054 100755
--- a/tests/qemu-iotests/103
+++ b/tests/qemu-iotests/103
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file nfs
-_supported_os Linux
 # Internal snapshots are (currently) impossible with refcount_bits=1
 _unsupported_imgopts 'refcount_bits=1[^0-9]'
 
diff --git a/tests/qemu-iotests/104 b/tests/qemu-iotests/104
index 390167bad4..c70f28a9a1 100755
--- a/tests/qemu-iotests/104
+++ b/tests/qemu-iotests/104
@@ -34,7 +34,6 @@ trap "exit \$status" 0 1 2 3 15
 
 _supported_fmt raw qcow qcow2 qed vdi vmdk vhdx
 _supported_proto generic
-_supported_os Linux
 
 echo "=== Check qemu-img info output ==="
 echo
diff --git a/tests/qemu-iotests/105 b/tests/qemu-iotests/105
index 3b5a596844..3346e8cb25 100755
--- a/tests/qemu-iotests/105
+++ b/tests/qemu-iotests/105
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2 vmdk vhdx qed
 _supported_proto generic
-_supported_os Linux
 _unsupported_imgopts "subformat=twoGbMaxExtentFlat" \
                      "subformat=twoGbMaxExtentSparse"
 
diff --git a/tests/qemu-iotests/107 b/tests/qemu-iotests/107
index fcd5a24dfe..268ba27688 100755
--- a/tests/qemu-iotests/107
+++ b/tests/qemu-iotests/107
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file nfs
-_supported_os Linux
 
 
 IMG_SIZE=64K
diff --git a/tests/qemu-iotests/110 b/tests/qemu-iotests/110
index 33b169ffd4..2cdc7c8a72 100755
--- a/tests/qemu-iotests/110
+++ b/tests/qemu-iotests/110
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Any format supporting backing files
 _supported_fmt qed qcow qcow2 vmdk
 _supported_proto file
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat"
 
 TEST_IMG_REL=$(basename "$TEST_IMG")
diff --git a/tests/qemu-iotests/111 b/tests/qemu-iotests/111
index 57395be64c..490a5bbcb5 100755
--- a/tests/qemu-iotests/111
+++ b/tests/qemu-iotests/111
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qed qcow qcow2 vmdk
 _supported_proto file
-_supported_os Linux
 _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat"
 
 $QEMU_IMG create -f $IMGFMT -b "$TEST_IMG.inexistent" "$TEST_IMG" 2>&1 \
diff --git a/tests/qemu-iotests/112 b/tests/qemu-iotests/112
index 6d81c75a9c..706c10b600 100755
--- a/tests/qemu-iotests/112
+++ b/tests/qemu-iotests/112
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This tests qcow2-specific low-level functionality
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 # This test will set refcount_bits on its own which would conflict with the
 # manual setting; compat will be overridden as well
 _unsupported_imgopts refcount_bits 'compat=0.10'
diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114
index f36b88f3f3..f90a744fc0 100755
--- a/tests/qemu-iotests/114
+++ b/tests/qemu-iotests/114
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow2
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 
 
 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
diff --git a/tests/qemu-iotests/115 b/tests/qemu-iotests/115
index 7ed347010f..9ed3cb6a83 100755
--- a/tests/qemu-iotests/115
+++ b/tests/qemu-iotests/115
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 # This test relies on refcounts being 64 bits wide (which does not work with
 # compat=0.10)
 _unsupported_imgopts 'refcount_bits=\([^6]\|.\([^4]\|$\)\)' 'compat=0.10'
diff --git a/tests/qemu-iotests/117 b/tests/qemu-iotests/117
index 0af0f31c5a..f37b34f8b1 100755
--- a/tests/qemu-iotests/117
+++ b/tests/qemu-iotests/117
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 _make_test_img 64k
 
diff --git a/tests/qemu-iotests/120 b/tests/qemu-iotests/120
index ca95b9276e..e9b4fbb009 100755
--- a/tests/qemu-iotests/120
+++ b/tests/qemu-iotests/120
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 _unsupported_fmt luks
 
 _make_test_img 64M
diff --git a/tests/qemu-iotests/125 b/tests/qemu-iotests/125
index 212dcd8f0d..dc4b8f5fb9 100755
--- a/tests/qemu-iotests/125
+++ b/tests/qemu-iotests/125
@@ -44,7 +44,6 @@ get_image_size_on_host()
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 if [ -z "$TEST_IMG_FILE" ]; then
     TEST_IMG_FILE=$TEST_IMG
diff --git a/tests/qemu-iotests/126 b/tests/qemu-iotests/126
index e3ee65c606..9b0dcf9255 100755
--- a/tests/qemu-iotests/126
+++ b/tests/qemu-iotests/126
@@ -37,7 +37,6 @@ _supported_fmt qcow qcow2 qed vmdk
 # colons which separate a protocol prefix from the rest and colons which are
 # just part of the filename, so we cannot test protocols which require a prefix)
 _supported_proto file
-_supported_os Linux
 
 echo
 echo '=== Testing plain files ==='
diff --git a/tests/qemu-iotests/127 b/tests/qemu-iotests/127
index 3e941f74d4..b64926ab31 100755
--- a/tests/qemu-iotests/127
+++ b/tests/qemu-iotests/127
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 IMG_SIZE=64K
 
diff --git a/tests/qemu-iotests/133 b/tests/qemu-iotests/133
index 1f6056d144..6f7cacc091 100755
--- a/tests/qemu-iotests/133
+++ b/tests/qemu-iotests/133
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
 _make_test_img -b "$TEST_IMG.base"
diff --git a/tests/qemu-iotests/134 b/tests/qemu-iotests/134
index e9e3e84c2a..141a2eaa7e 100755
--- a/tests/qemu-iotests/134
+++ b/tests/qemu-iotests/134
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow qcow2
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/142 b/tests/qemu-iotests/142
index d9b98cf60a..6b62271876 100755
--- a/tests/qemu-iotests/142
+++ b/tests/qemu-iotests/142
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 # We test all cache modes anyway, but O_DIRECT needs to be supported
 _default_cache_mode none
diff --git a/tests/qemu-iotests/143 b/tests/qemu-iotests/143
index c223867cb3..92249ac8da 100755
--- a/tests/qemu-iotests/143
+++ b/tests/qemu-iotests/143
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 keep_stderr=y \
 _launch_qemu 2> >(_filter_nbd)
diff --git a/tests/qemu-iotests/144 b/tests/qemu-iotests/144
index 15157f33d7..011ed4f2bc 100755
--- a/tests/qemu-iotests/144
+++ b/tests/qemu-iotests/144
@@ -46,7 +46,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 size=512M
 
diff --git a/tests/qemu-iotests/145 b/tests/qemu-iotests/145
index 28878dc8a1..9427549651 100755
--- a/tests/qemu-iotests/145
+++ b/tests/qemu-iotests/145
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 _make_test_img 1M
 
diff --git a/tests/qemu-iotests/153 b/tests/qemu-iotests/153
index 08ad8a6730..c969a1a16f 100755
--- a/tests/qemu-iotests/153
+++ b/tests/qemu-iotests/153
@@ -62,7 +62,6 @@ _check_ofd || _notrun "OFD lock not available"
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 _run_cmd()
 {
diff --git a/tests/qemu-iotests/156 b/tests/qemu-iotests/156
index 8d134029c6..2ffa3ca942 100755
--- a/tests/qemu-iotests/156
+++ b/tests/qemu-iotests/156
@@ -49,7 +49,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow2 qed
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 
 # Create source disk
 TEST_IMG="$TEST_IMG.backing" _make_test_img 1M
diff --git a/tests/qemu-iotests/157 b/tests/qemu-iotests/157
index 69b25cab30..7cbac38099 100755
--- a/tests/qemu-iotests/157
+++ b/tests/qemu-iotests/157
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 
 do_run_qemu()
 {
diff --git a/tests/qemu-iotests/158 b/tests/qemu-iotests/158
index 8c0928a7f9..ba4db6116a 100755
--- a/tests/qemu-iotests/158
+++ b/tests/qemu-iotests/158
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt qcow qcow2
 _supported_proto generic
 _unsupported_proto vxhs
-_supported_os Linux
 
 
 size=128M
diff --git a/tests/qemu-iotests/159 b/tests/qemu-iotests/159
index 29066eebde..2557140ac2 100755
--- a/tests/qemu-iotests/159
+++ b/tests/qemu-iotests/159
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 _unsupported_fmt luks
 
 TEST_SIZES="5 512 1024 1999 1K 64K 1M"
diff --git a/tests/qemu-iotests/162 b/tests/qemu-iotests/162
index 2e9947fd9a..4e5ed74fd5 100755
--- a/tests/qemu-iotests/162
+++ b/tests/qemu-iotests/162
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 . ./common.filter
 
 _supported_fmt generic
-_supported_os Linux
 
 test_ssh=$($QEMU_IMG --help | grep '^Supported formats:.* ssh\( \|$\)')
 [ "$test_ssh" = "" ] && _notrun "ssh support required"
diff --git a/tests/qemu-iotests/170 b/tests/qemu-iotests/170
index 7deb7563c9..05dd6ed6c3 100755
--- a/tests/qemu-iotests/170
+++ b/tests/qemu-iotests/170
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 _unsupported_fmt luks
 
 echo
diff --git a/tests/qemu-iotests/173 b/tests/qemu-iotests/173
index 47036a5564..9e2fa2e73c 100755
--- a/tests/qemu-iotests/173
+++ b/tests/qemu-iotests/173
@@ -41,7 +41,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto nfs
-_supported_os Linux
 
 size=100M
 
diff --git a/tests/qemu-iotests/182 b/tests/qemu-iotests/182
index 38959bf276..3a90ebfbfd 100755
--- a/tests/qemu-iotests/182
+++ b/tests/qemu-iotests/182
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 size=32M
 
diff --git a/tests/qemu-iotests/183 b/tests/qemu-iotests/183
index 93b7bd798a..fbe5a99beb 100755
--- a/tests/qemu-iotests/183
+++ b/tests/qemu-iotests/183
@@ -44,7 +44,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2 raw qed quorum
 _supported_proto file
-_supported_os Linux
 
 size=64M
 _make_test_img $size
diff --git a/tests/qemu-iotests/186 b/tests/qemu-iotests/186
index 5dd2177b89..7e7d45babc 100755
--- a/tests/qemu-iotests/186
+++ b/tests/qemu-iotests/186
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 if [ "$QEMU_DEFAULT_MACHINE" != "pc" ]; then
     _notrun "Requires a PC machine"
diff --git a/tests/qemu-iotests/187 b/tests/qemu-iotests/187
index a45addde09..2fcef9e2bd 100755
--- a/tests/qemu-iotests/187
+++ b/tests/qemu-iotests/187
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 size=64M
 _make_test_img $size
diff --git a/tests/qemu-iotests/190 b/tests/qemu-iotests/190
index e1c1d407f0..eb766ad09f 100755
--- a/tests/qemu-iotests/190
+++ b/tests/qemu-iotests/190
@@ -41,7 +41,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # See 178 for more extensive tests across more formats
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 echo "== Huge file =="
 echo
diff --git a/tests/qemu-iotests/191 b/tests/qemu-iotests/191
index 1ea908ce3d..528022e8d8 100755
--- a/tests/qemu-iotests/191
+++ b/tests/qemu-iotests/191
@@ -43,7 +43,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 size=64M
 
diff --git a/tests/qemu-iotests/192 b/tests/qemu-iotests/192
index 61a88ac88d..6193257764 100755
--- a/tests/qemu-iotests/192
+++ b/tests/qemu-iotests/192
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 
 if [ "$QEMU_DEFAULT_MACHINE" != "pc" ]; then
     _notrun "Requires a PC machine"
diff --git a/tests/qemu-iotests/195 b/tests/qemu-iotests/195
index bd1b71ae5e..ef7b9a94e2 100755
--- a/tests/qemu-iotests/195
+++ b/tests/qemu-iotests/195
@@ -39,7 +39,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 do_run_qemu()
 {
diff --git a/tests/qemu-iotests/197 b/tests/qemu-iotests/197
index 2c664793f4..383d7d7f61 100755
--- a/tests/qemu-iotests/197
+++ b/tests/qemu-iotests/197
@@ -51,7 +51,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Test is supported for any backing file; but we force qcow2 for our wrapper.
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 # LUKS support may be possible, but it complicates things.
 _unsupported_fmt luks
 
diff --git a/tests/qemu-iotests/200 b/tests/qemu-iotests/200
index 1c0f8cafc2..72d431f251 100755
--- a/tests/qemu-iotests/200
+++ b/tests/qemu-iotests/200
@@ -42,7 +42,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2 qed
 _supported_proto file
-_supported_os Linux
 
 BACKING_IMG="${TEST_DIR}/backing.img"
 TEST_IMG="${TEST_DIR}/test.img"
diff --git a/tests/qemu-iotests/214 b/tests/qemu-iotests/214
index c1a452ff9a..21ec8a2ad8 100755
--- a/tests/qemu-iotests/214
+++ b/tests/qemu-iotests/214
@@ -36,7 +36,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 # Repairing the corrupted image requires qemu-img check to store a
 # refcount up to 3, which requires at least two refcount bits.
diff --git a/tests/qemu-iotests/215 b/tests/qemu-iotests/215
index 7b063d7cfa..958c14f5a0 100755
--- a/tests/qemu-iotests/215
+++ b/tests/qemu-iotests/215
@@ -48,7 +48,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Test is supported for any backing file; but we force qcow2 for our wrapper.
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 # LUKS support may be possible, but it complicates things.
 _unsupported_fmt luks
 
diff --git a/tests/qemu-iotests/217 b/tests/qemu-iotests/217
index f5482bb669..58a78a6098 100755
--- a/tests/qemu-iotests/217
+++ b/tests/qemu-iotests/217
@@ -37,7 +37,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # This test is specific to qcow2
 _supported_fmt qcow2
 _supported_proto file
-_supported_os Linux
 
 # This test needs clusters with at least a refcount of 2 so that
 # OFLAG_COPIED is not set.  refcount_bits=1 is therefore unsupported.
diff --git a/tests/qemu-iotests/227 b/tests/qemu-iotests/227
index 10cf144eb0..bdd727a721 100755
--- a/tests/qemu-iotests/227
+++ b/tests/qemu-iotests/227
@@ -38,7 +38,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto file
-_supported_os Linux
 
 do_run_qemu()
 {
diff --git a/tests/qemu-iotests/231 b/tests/qemu-iotests/231
index 5b2cbab9ac..c0b053ac30 100755
--- a/tests/qemu-iotests/231
+++ b/tests/qemu-iotests/231
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt generic
 _supported_proto rbd
-_supported_os Linux
 
 BOGUS_CONF=${TEST_DIR}/ceph-$$.conf
 touch "${BOGUS_CONF}"
diff --git a/tests/qemu-iotests/233 b/tests/qemu-iotests/233
index 41b4d46560..057cad2044 100755
--- a/tests/qemu-iotests/233
+++ b/tests/qemu-iotests/233
@@ -47,7 +47,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt raw qcow2
 _supported_proto file
 # If porting to non-Linux, consider using socat instead of ss in common.nbd
-_supported_os Linux
 _require_command QEMU_NBD
 
 nbd_server_set_tcp_port
diff --git a/tests/qemu-iotests/239 b/tests/qemu-iotests/239
index 6f085d573d..b0991ffe59 100755
--- a/tests/qemu-iotests/239
+++ b/tests/qemu-iotests/239
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Test case for dmg
 #
diff --git a/tests/qemu-iotests/240 b/tests/qemu-iotests/240
index 65cc3b39b1..b4cf95096d 100755
--- a/tests/qemu-iotests/240
+++ b/tests/qemu-iotests/240
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Test hot plugging and unplugging with iothreads
 #
@@ -33,7 +33,6 @@ status=1	# failure is the default!
 
 _supported_fmt generic
 _supported_proto generic
-_supported_os Linux
 
 do_run_qemu()
 {
diff --git a/tests/qemu-iotests/241 b/tests/qemu-iotests/241
index 017a736aab..58b64ebf41 100755
--- a/tests/qemu-iotests/241
+++ b/tests/qemu-iotests/241
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Test qemu-nbd vs. unaligned images
 #
diff --git a/tests/qemu-iotests/243 b/tests/qemu-iotests/243
index 5838c6e89c..e563761307 100755
--- a/tests/qemu-iotests/243
+++ b/tests/qemu-iotests/243
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Test qcow2 preallocation
 #
diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244
index d8e7122305..13978f93d2 100755
--- a/tests/qemu-iotests/244
+++ b/tests/qemu-iotests/244
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Test qcow2 with external data files
 #
diff --git a/tests/qemu-iotests/247 b/tests/qemu-iotests/247
index fc50eb5dc1..546a794d3d 100755
--- a/tests/qemu-iotests/247
+++ b/tests/qemu-iotests/247
@@ -40,7 +40,6 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # Requires backing files and .bdrv_change_backing_file support
 _supported_fmt qcow2 qed
 _supported_proto file
-_supported_os Linux
 
 size=128M
 
diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check
index f9c24b6753..922c5d1d3d 100755
--- a/tests/qemu-iotests/check
+++ b/tests/qemu-iotests/check
@@ -130,7 +130,6 @@ export CACHEMODE="writeback"
 export QEMU_IO_OPTIONS=""
 export QEMU_IO_OPTIONS_NO_FMT=""
 export CACHEMODE_IS_DEFAULT=true
-export QEMU_OPTIONS="-nodefaults -machine accel=qtest"
 export VALGRIND_QEMU=
 export IMGKEYSECRET=
 export IMGOPTSSYNTAX=false
@@ -564,6 +563,18 @@ then
 fi
 export QEMU_PROG="$(type -p "$QEMU_PROG")"
 
+case "$QEMU_PROG" in
+    *qemu-system-arm|*qemu-system-aarch64)
+        export QEMU_OPTIONS="-nodefaults -machine virt,accel=qtest"
+        ;;
+    *qemu-system-tricore)
+        export QEMU_OPTIONS="-nodefaults -machine tricore_testboard,accel=qtest"
+        ;;
+    *)
+        export QEMU_OPTIONS="-nodefaults -machine accel=qtest"
+        ;;
+esac
+
 if [ -z "$QEMU_IMG_PROG" ]; then
     if [ -x "$build_iotests/qemu-img" ]; then
         export QEMU_IMG_PROG="$build_iotests/qemu-img"
diff --git a/tests/qom-test.c b/tests/qom-test.c
index 73c52af3bb..4f94cc678c 100644
--- a/tests/qom-test.c
+++ b/tests/qom-test.c
@@ -44,7 +44,7 @@ static bool is_blacklisted(const char *arch, const char *mach)
     return false;
 }
 
-static void test_properties(const char *path, bool recurse)
+static void test_properties(QTestState *qts, const char *path, bool recurse)
 {
     char *child_path;
     QDict *response, *tuple, *tmp;
@@ -52,8 +52,8 @@ static void test_properties(const char *path, bool recurse)
     QListEntry *entry;
 
     g_test_message("Obtaining properties of %s", path);
-    response = qmp("{ 'execute': 'qom-list',"
-                   "  'arguments': { 'path': %s } }", path);
+    response = qtest_qmp(qts, "{ 'execute': 'qom-list',"
+                              "  'arguments': { 'path': %s } }", path);
     g_assert(response);
 
     if (!recurse) {
@@ -71,15 +71,15 @@ static void test_properties(const char *path, bool recurse)
         if (is_child || is_link) {
             child_path = g_strdup_printf("%s/%s",
                                          path, qdict_get_str(tuple, "name"));
-            test_properties(child_path, is_child);
+            test_properties(qts, child_path, is_child);
             g_free(child_path);
         } else {
             const char *prop = qdict_get_str(tuple, "name");
             g_test_message("Testing property %s.%s", path, prop);
-            tmp = qmp("{ 'execute': 'qom-get',"
-                      "  'arguments': { 'path': %s,"
-                      "                 'property': %s } }",
-                      path, prop);
+            tmp = qtest_qmp(qts,
+                            "{ 'execute': 'qom-get',"
+                            "  'arguments': { 'path': %s, 'property': %s } }",
+                            path, prop);
             /* qom-get may fail but should not, e.g., segfault. */
             g_assert(tmp);
             qobject_unref(tmp);
@@ -91,20 +91,18 @@ static void test_properties(const char *path, bool recurse)
 static void test_machine(gconstpointer data)
 {
     const char *machine = data;
-    char *args;
     QDict *response;
+    QTestState *qts;
 
-    args = g_strdup_printf("-machine %s", machine);
-    qtest_start(args);
+    qts = qtest_initf("-machine %s", machine);
 
-    test_properties("/machine", true);
+    test_properties(qts, "/machine", true);
 
-    response = qmp("{ 'execute': 'quit' }");
+    response = qtest_qmp(qts, "{ 'execute': 'quit' }");
     g_assert(qdict_haskey(response, "return"));
     qobject_unref(response);
 
-    qtest_end();
-    g_free(args);
+    qtest_quit(qts);
     g_free((void *)machine);
 }
 
diff --git a/tests/tcg/xtensa/test_exclusive.S b/tests/tcg/xtensa/test_exclusive.S
new file mode 100644
index 0000000000..7757a552ea
--- /dev/null
+++ b/tests/tcg/xtensa/test_exclusive.S
@@ -0,0 +1,48 @@
+#include "macros.inc"
+
+test_suite exclusive
+
+#if XCHAL_HAVE_EXCLUSIVE
+
+test exclusive_nowrite
+    movi    a2, 0x29
+    wsr     a2, atomctl
+    clrex
+    movi    a2, 1f
+    movi    a3, 1
+    s32ex   a3, a2
+    getex   a3
+    assert  eqi, a3, 0
+    l32i    a3, a2, 0
+    assert  eqi, a3, 3
+
+.data
+.align 4
+1:
+    .word   3
+.text
+test_end
+
+test exclusive_write
+    movi    a2, 0x29
+    wsr     a2, atomctl
+    movi    a2, 1f
+    l32ex   a3, a2
+    assert  eqi, a3, 3
+    movi    a3, 2
+    s32ex   a3, a2
+    getex   a3
+    assert  eqi, a3, 1
+    l32i    a3, a2, 0
+    assert  eqi, a3, 2
+
+.data
+.align 4
+1:
+    .word   3
+.text
+test_end
+
+#endif
+
+test_suite_end