summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--block.c135
-rw-r--r--block/block-backend.c3
-rw-r--r--block/file-posix.c19
-rw-r--r--block/qcow2.c43
-rw-r--r--block/qcow2.h19
-rw-r--r--docs/qcow2-cache.txt59
-rw-r--r--include/block/block.h1
-rw-r--r--include/qemu/units.h55
-rw-r--r--qapi/block-core.json4
-rw-r--r--qemu-io-cmds.c2
-rw-r--r--qemu-options.hx12
-rw-r--r--target/xtensa/cpu.h37
-rw-r--r--target/xtensa/helper.c6
-rw-r--r--target/xtensa/helper.h2
-rw-r--r--target/xtensa/op_helper.c73
-rw-r--r--target/xtensa/translate.c2671
-rw-r--r--tests/qemu-iotests/067.out1
-rwxr-xr-xtests/qemu-iotests/1378
-rw-r--r--tests/qemu-iotests/137.out4
-rw-r--r--tests/qemu-iotests/153.out76
-rw-r--r--tests/qemu-iotests/182.out2
-rw-r--r--tests/test-bdrv-drain.c4
-rw-r--r--tests/test-replication.c11
23 files changed, 2123 insertions, 1124 deletions
diff --git a/block.c b/block.c
index c298ca6a19..7710b399a3 100644
--- a/block.c
+++ b/block.c
@@ -764,6 +764,31 @@ static void bdrv_join_options(BlockDriverState *bs, QDict *options,
     }
 }
 
+static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
+                                                            int open_flags,
+                                                            Error **errp)
+{
+    Error *local_err = NULL;
+    char *value = qemu_opt_get_del(opts, "detect-zeroes");
+    BlockdevDetectZeroesOptions detect_zeroes =
+        qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
+                        BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
+    g_free(value);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return detect_zeroes;
+    }
+
+    if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
+        !(open_flags & BDRV_O_UNMAP))
+    {
+        error_setg(errp, "setting detect-zeroes to unmap is not allowed "
+                   "without setting discard operation to unmap");
+    }
+
+    return detect_zeroes;
+}
+
 /**
  * Set open flags for a given discard mode
  *
@@ -1094,19 +1119,19 @@ static void update_flags_from_options(int *flags, QemuOpts *opts)
     *flags &= ~BDRV_O_CACHE_MASK;
 
     assert(qemu_opt_find(opts, BDRV_OPT_CACHE_NO_FLUSH));
-    if (qemu_opt_get_bool(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
+    if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
         *flags |= BDRV_O_NO_FLUSH;
     }
 
     assert(qemu_opt_find(opts, BDRV_OPT_CACHE_DIRECT));
-    if (qemu_opt_get_bool(opts, BDRV_OPT_CACHE_DIRECT, false)) {
+    if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
         *flags |= BDRV_O_NOCACHE;
     }
 
     *flags &= ~BDRV_O_RDWR;
 
     assert(qemu_opt_find(opts, BDRV_OPT_READ_ONLY));
-    if (!qemu_opt_get_bool(opts, BDRV_OPT_READ_ONLY, false)) {
+    if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
         *flags |= BDRV_O_RDWR;
     }
 
@@ -1328,7 +1353,6 @@ static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
     const char *driver_name = NULL;
     const char *node_name = NULL;
     const char *discard;
-    const char *detect_zeroes;
     QemuOpts *opts;
     BlockDriver *drv;
     Error *local_err = NULL;
@@ -1417,29 +1441,12 @@ static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
         }
     }
 
-    detect_zeroes = qemu_opt_get(opts, "detect-zeroes");
-    if (detect_zeroes) {
-        BlockdevDetectZeroesOptions value =
-            qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup,
-                            detect_zeroes,
-                            BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF,
-                            &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            ret = -EINVAL;
-            goto fail_opts;
-        }
-
-        if (value == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
-            !(bs->open_flags & BDRV_O_UNMAP))
-        {
-            error_setg(errp, "setting detect-zeroes to unmap is not allowed "
-                             "without setting discard operation to unmap");
-            ret = -EINVAL;
-            goto fail_opts;
-        }
-
-        bs->detect_zeroes = value;
+    bs->detect_zeroes =
+        bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        ret = -EINVAL;
+        goto fail_opts;
     }
 
     if (filename != NULL) {
@@ -2763,12 +2770,15 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
         }
     }
 
-    /* Remove all children options from bs->options and bs->explicit_options */
+    /* Remove all children options and references
+     * from bs->options and bs->explicit_options */
     QLIST_FOREACH(child, &bs->children, next) {
         char *child_key_dot;
         child_key_dot = g_strdup_printf("%s.", child->name);
         qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
         qdict_extract_subqdict(bs->options, NULL, child_key_dot);
+        qdict_del(bs->explicit_options, child->name);
+        qdict_del(bs->options, child->name);
         g_free(child_key_dot);
     }
 
@@ -3153,7 +3163,7 @@ int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
     BlockDriver *drv;
     QemuOpts *opts;
     QDict *orig_reopen_opts;
-    const char *value;
+    char *discard = NULL;
     bool read_only;
 
     assert(reopen_state != NULL);
@@ -3176,18 +3186,28 @@ int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
 
     update_flags_from_options(&reopen_state->flags, opts);
 
-    /* node-name and driver must be unchanged. Put them back into the QDict, so
-     * that they are checked at the end of this function. */
-    value = qemu_opt_get(opts, "node-name");
-    if (value) {
-        qdict_put_str(reopen_state->options, "node-name", value);
+    discard = qemu_opt_get_del(opts, "discard");
+    if (discard != NULL) {
+        if (bdrv_parse_discard_flags(discard, &reopen_state->flags) != 0) {
+            error_setg(errp, "Invalid discard option");
+            ret = -EINVAL;
+            goto error;
+        }
     }
 
-    value = qemu_opt_get(opts, "driver");
-    if (value) {
-        qdict_put_str(reopen_state->options, "driver", value);
+    reopen_state->detect_zeroes =
+        bdrv_parse_detect_zeroes(opts, reopen_state->flags, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        ret = -EINVAL;
+        goto error;
     }
 
+    /* All other options (including node-name and driver) must be unchanged.
+     * Put them back into the QDict, so that they are checked at the end
+     * of this function. */
+    qemu_opts_to_qdict(opts, reopen_state->options);
+
     /* If we are to stay read-only, do not allow permission change
      * to r/w. Attempting to set to r/w may fail if either BDRV_O_ALLOW_RDWR is
      * not set, or if the BDS still has copy_on_read enabled */
@@ -3239,6 +3259,24 @@ int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
             QObject *new = entry->value;
             QObject *old = qdict_get(reopen_state->bs->options, entry->key);
 
+            /* Allow child references (child_name=node_name) as long as they
+             * point to the current child (i.e. everything stays the same). */
+            if (qobject_type(new) == QTYPE_QSTRING) {
+                BdrvChild *child;
+                QLIST_FOREACH(child, &reopen_state->bs->children, next) {
+                    if (!strcmp(child->name, entry->key)) {
+                        break;
+                    }
+                }
+
+                if (child) {
+                    const char *str = qobject_get_try_str(new);
+                    if (!strcmp(child->bs->node_name, str)) {
+                        continue; /* Found child with this name, skip option */
+                    }
+                }
+            }
+
             /*
              * TODO: When using -drive to specify blockdev options, all values
              * will be strings; however, when using -blockdev, blockdev-add or
@@ -3278,6 +3316,7 @@ int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
 error:
     qemu_opts_del(opts);
     qobject_unref(orig_reopen_opts);
+    g_free(discard);
     return ret;
 }
 
@@ -3290,6 +3329,7 @@ void bdrv_reopen_commit(BDRVReopenState *reopen_state)
 {
     BlockDriver *drv;
     BlockDriverState *bs;
+    BdrvChild *child;
     bool old_can_write, new_can_write;
 
     assert(reopen_state != NULL);
@@ -3313,6 +3353,14 @@ void bdrv_reopen_commit(BDRVReopenState *reopen_state)
     bs->options            = reopen_state->options;
     bs->open_flags         = reopen_state->flags;
     bs->read_only = !(reopen_state->flags & BDRV_O_RDWR);
+    bs->detect_zeroes      = reopen_state->detect_zeroes;
+
+    /* Remove child references from bs->options and bs->explicit_options.
+     * Child options were already removed in bdrv_reopen_queue_child() */
+    QLIST_FOREACH(child, &bs->children, next) {
+        qdict_del(bs->explicit_options, child->name);
+        qdict_del(bs->options, child->name);
+    }
 
     bdrv_refresh_limits(bs, NULL);
 
@@ -5139,23 +5187,12 @@ static bool append_open_options(QDict *d, BlockDriverState *bs)
 {
     const QDictEntry *entry;
     QemuOptDesc *desc;
-    BdrvChild *child;
     bool found_any = false;
 
     for (entry = qdict_first(bs->options); entry;
          entry = qdict_next(bs->options, entry))
     {
-        /* Exclude node-name references to children */
-        QLIST_FOREACH(child, &bs->children, next) {
-            if (!strcmp(entry->key, child->name)) {
-                break;
-            }
-        }
-        if (child) {
-            continue;
-        }
-
-        /* And exclude all non-driver-specific options */
+        /* Exclude all non-driver-specific options */
         for (desc = bdrv_runtime_opts.desc; desc->name; desc++) {
             if (!strcmp(qdict_entry_key(entry), desc->name)) {
                 break;
diff --git a/block/block-backend.c b/block/block-backend.c
index 7b1ec5071b..dc0cd57724 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -325,6 +325,9 @@ BlockBackend *blk_new(uint64_t perm, uint64_t shared_perm)
     blk->shared_perm = shared_perm;
     blk_set_enable_write_cache(blk, true);
 
+    blk->on_read_error = BLOCKDEV_ON_ERROR_REPORT;
+    blk->on_write_error = BLOCKDEV_ON_ERROR_ENOSPC;
+
     block_acct_init(&blk->stats);
 
     notifier_list_init(&blk->remove_bs_notifiers);
diff --git a/block/file-posix.c b/block/file-posix.c
index fe83cbf0eb..2da3a76355 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -741,8 +741,6 @@ static int raw_check_lock_bytes(int fd, uint64_t perm, uint64_t shared_perm,
                            "Failed to get \"%s\" lock",
                            perm_name);
                 g_free(perm_name);
-                error_append_hint(errp,
-                                  "Is another process using the image?\n");
                 return ret;
             }
         }
@@ -758,8 +756,6 @@ static int raw_check_lock_bytes(int fd, uint64_t perm, uint64_t shared_perm,
                            "Failed to get shared \"%s\" lock",
                            perm_name);
                 g_free(perm_name);
-                error_append_hint(errp,
-                                  "Is another process using the image?\n");
                 return ret;
             }
         }
@@ -796,6 +792,9 @@ static int raw_handle_perm_lock(BlockDriverState *bs,
             if (!ret) {
                 return 0;
             }
+            error_append_hint(errp,
+                              "Is another process using the image [%s]?\n",
+                              bs->filename);
         }
         op = RAW_PL_ABORT;
         /* fall through to unlock bytes. */
@@ -850,8 +849,13 @@ static int raw_reopen_prepare(BDRVReopenState *state,
         goto out;
     }
 
-    rs->check_cache_dropped = qemu_opt_get_bool(opts, "x-check-cache-dropped",
-                                                s->check_cache_dropped);
+    rs->check_cache_dropped =
+        qemu_opt_get_bool_del(opts, "x-check-cache-dropped", false);
+
+    /* This driver's reopen function doesn't currently allow changing
+     * other options, so let's put them back in the original QDict and
+     * bdrv_reopen_prepare() will detect changes and complain. */
+    qemu_opts_to_qdict(opts, state->options);
 
     if (s->type == FTYPE_CD) {
         rs->open_flags |= O_NONBLOCK;
@@ -2217,6 +2221,9 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     /* Step two: Check that nobody else has taken conflicting locks */
     result = raw_check_lock_bytes(fd, perm, shared, errp);
     if (result < 0) {
+        error_append_hint(errp,
+                          "Is another process using the image [%s]?\n",
+                          file_opts->filename);
         goto out_unlock;
     }
 
diff --git a/block/qcow2.c b/block/qcow2.c
index c13153735a..7277feda13 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -777,29 +777,35 @@ static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
                              uint64_t *refcount_cache_size, Error **errp)
 {
     BDRVQcow2State *s = bs->opaque;
-    uint64_t combined_cache_size;
+    uint64_t combined_cache_size, l2_cache_max_setting;
     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
+    uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
+    uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
 
     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
 
     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
-    *l2_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE, 0);
+    l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
+                                             DEFAULT_L2_CACHE_MAX_SIZE);
     *refcount_cache_size = qemu_opt_get_size(opts,
                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
 
     *l2_cache_entry_size = qemu_opt_get_size(
         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
 
+    *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
+
     if (combined_cache_size_set) {
         if (l2_cache_size_set && refcount_cache_size_set) {
             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
                        "at the same time");
             return;
-        } else if (*l2_cache_size > combined_cache_size) {
+        } else if (l2_cache_size_set &&
+                   (l2_cache_max_setting > combined_cache_size)) {
             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
                        QCOW2_OPT_CACHE_SIZE);
             return;
@@ -814,9 +820,6 @@ static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
         } else if (refcount_cache_size_set) {
             *l2_cache_size = combined_cache_size - *refcount_cache_size;
         } else {
-            uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
-            uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
-
             /* Assign as much memory as possible to the L2 cache, and
              * use the remainder for the refcount cache */
             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
@@ -828,16 +831,9 @@ static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
             }
         }
-    } else {
-        if (!l2_cache_size_set) {
-            *l2_cache_size = MAX(DEFAULT_L2_CACHE_BYTE_SIZE,
-                                 (uint64_t)DEFAULT_L2_CACHE_CLUSTERS
-                                 * s->cluster_size);
-        }
-        if (!refcount_cache_size_set) {
-            *refcount_cache_size = min_refcount_cache;
-        }
     }
+    /* l2_cache_size and refcount_cache_size are ensured to have at least
+     * their minimum values in qcow2_update_options_prepare() */
 
     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
         *l2_cache_entry_size > s->cluster_size ||
@@ -948,7 +944,7 @@ static int qcow2_update_options_prepare(BlockDriverState *bs,
     /* New interval for cache cleanup timer */
     r->cache_clean_interval =
         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
-                            s->cache_clean_interval);
+                            DEFAULT_CACHE_CLEAN_INTERVAL);
 #ifndef CONFIG_LINUX
     if (r->cache_clean_interval != 0) {
         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
@@ -1328,7 +1324,7 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
     s->refcount_block_size = 1 << s->refcount_block_bits;
-    bs->total_sectors = header.size / 512;
+    bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
     s->csize_shift = (62 - (s->cluster_bits - 8));
     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
@@ -3422,6 +3418,7 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
     uint64_t old_length;
     int64_t new_l1_size;
     int ret;
+    QDict *options;
 
     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
@@ -3453,7 +3450,7 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
         goto fail;
     }
 
-    old_length = bs->total_sectors * 512;
+    old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
     new_l1_size = size_to_l1(s, offset);
 
     if (offset < old_length) {
@@ -3646,6 +3643,8 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
         }
     }
 
+    bs->total_sectors = offset / BDRV_SECTOR_SIZE;
+
     /* write updated header.size */
     offset = cpu_to_be64(offset);
     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
@@ -3656,6 +3655,14 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
     }
 
     s->l1_vm_state_index = new_l1_size;
+
+    /* Update cache sizes */
+    options = qdict_clone_shallow(bs->options);
+    ret = qcow2_update_options(bs, options, s->flags, errp);
+    qobject_unref(options);
+    if (ret < 0) {
+        goto fail;
+    }
     ret = 0;
 fail:
     qemu_co_mutex_unlock(&s->lock);
diff --git a/block/qcow2.h b/block/qcow2.h
index 81b844e936..ba430316b9 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -27,6 +27,7 @@
 
 #include "crypto/block.h"
 #include "qemu/coroutine.h"
+#include "qemu/units.h"
 
 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
@@ -43,11 +44,11 @@
 
 /* 8 MB refcount table is enough for 2 PB images at 64k cluster size
  * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
-#define QCOW_MAX_REFTABLE_SIZE 0x800000
+#define QCOW_MAX_REFTABLE_SIZE S_8MiB
 
 /* 32 MB L1 table is enough for 2 PB images at 64k cluster size
  * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
-#define QCOW_MAX_L1_SIZE 0x2000000
+#define QCOW_MAX_L1_SIZE S_32MiB
 
 /* Allow for an average of 1k per snapshot table entry, should be plenty of
  * space for snapshot names and IDs */
@@ -73,12 +74,16 @@
 /* Must be at least 4 to cover all cases of refcount table growth */
 #define MIN_REFCOUNT_CACHE_SIZE 4 /* clusters */
 
-/* Whichever is more */
-#define DEFAULT_L2_CACHE_CLUSTERS 8 /* clusters */
-#define DEFAULT_L2_CACHE_BYTE_SIZE 1048576 /* bytes */
-
-#define DEFAULT_CLUSTER_SIZE 65536
+#ifdef CONFIG_LINUX
+#define DEFAULT_L2_CACHE_MAX_SIZE S_32MiB
+#define DEFAULT_CACHE_CLEAN_INTERVAL 600  /* seconds */
+#else
+#define DEFAULT_L2_CACHE_MAX_SIZE S_8MiB
+/* Cache clean interval is currently available only on Linux, so must be 0 */
+#define DEFAULT_CACHE_CLEAN_INTERVAL 0
+#endif
 
+#define DEFAULT_CLUSTER_SIZE S_64KiB
 
 #define QCOW2_OPT_LAZY_REFCOUNTS "lazy-refcounts"
 #define QCOW2_OPT_DISCARD_REQUEST "pass-discard-request"
diff --git a/docs/qcow2-cache.txt b/docs/qcow2-cache.txt
index 8a09a5cc5f..c459bf5dd3 100644
--- a/docs/qcow2-cache.txt
+++ b/docs/qcow2-cache.txt
@@ -79,14 +79,14 @@ Choosing the right cache sizes
 In order to choose the cache sizes we need to know how they relate to
 the amount of allocated space.
 
-The amount of virtual disk that can be mapped by the L2 and refcount
+The part of the virtual disk that can be mapped by the L2 and refcount
 caches (in bytes) is:
 
    disk_size = l2_cache_size * cluster_size / 8
    disk_size = refcount_cache_size * cluster_size * 8 / refcount_bits
 
 With the default values for cluster_size (64KB) and refcount_bits
-(16), that is
+(16), this becomes:
 
    disk_size = l2_cache_size * 8192
    disk_size = refcount_cache_size * 32768
@@ -97,12 +97,16 @@ need:
    l2_cache_size = disk_size_GB * 131072
    refcount_cache_size = disk_size_GB * 32768
 
-QEMU has a default L2 cache of 1MB (1048576 bytes) and a refcount
-cache of 256KB (262144 bytes), so using the formulas we've just seen
-we have
+For example, 1MB of L2 cache is needed to cover every 8 GB of the virtual
+image size (given that the default cluster size is used):
 
-   1048576 / 131072 = 8 GB of virtual disk covered by that cache
-    262144 /  32768 = 8 GB
+   8 GB / 8192 = 1 MB
+
+The refcount cache is 4 times the cluster size by default. With the default
+cluster size of 64 KB, it is 256 KB (262144 bytes). This is sufficient for
+8 GB of image size:
+
+   262144 * 32768 = 8 GB
 
 
 How to configure the cache sizes
@@ -121,8 +125,15 @@ There are a few things that need to be taken into account:
  - Both caches must have a size that is a multiple of the cluster size
    (or the cache entry size: see "Using smaller cache sizes" below).
 
- - The default L2 cache size is 8 clusters or 1MB (whichever is more),
-   and the minimum is 2 clusters (or 2 cache entries, see below).
+ - The maximum L2 cache size is 32 MB by default on Linux platforms (enough
+   for full coverage of 256 GB images, with the default cluster size). This
+   value can be modified using the "l2-cache-size" option. QEMU will not use
+   more memory than needed to hold all of the image's L2 tables, regardless
+   of this max. value.
+   On non-Linux platforms the maximal value is smaller by default (8 MB) and
+   this difference stems from the fact that on Linux the cache can be cleared
+   periodically if needed, using the "cache-clean-interval" option (see below).
+   The minimal L2 cache size is 2 clusters (or 2 cache entries, see below).
 
  - The default (and minimum) refcount cache size is 4 clusters.
 
@@ -130,6 +141,9 @@ There are a few things that need to be taken into account:
    memory as possible to the L2 cache before increasing the refcount
    cache size.
 
+ - At most two of "l2-cache-size", "refcount-cache-size", and "cache-size"
+   can be set simultaneously.
+
 Unlike L2 tables, refcount blocks are not used during normal I/O but
 only during allocations and internal snapshots. In most cases they are
 accessed sequentially (even during random guest I/O) so increasing the
@@ -177,9 +191,10 @@ Some things to take into account:
    always uses the cluster size as the entry size.
 
  - If the L2 cache is big enough to hold all of the image's L2 tables
-   (as explained in the "Choosing the right cache sizes" section
-   earlier in this document) then none of this is necessary and you
-   can omit the "l2-cache-entry-size" parameter altogether.
+   (as explained in the "Choosing the right cache sizes" and "How to
+   configure the cache sizes" sections in this document) then none of
+   this is necessary and you can omit the "l2-cache-entry-size"
+   parameter altogether.
 
 
 Reducing the memory usage
@@ -187,18 +202,18 @@ Reducing the memory usage
 It is possible to clean unused cache entries in order to reduce the
 memory usage during periods of low I/O activity.
 
-The parameter "cache-clean-interval" defines an interval (in seconds).
-All cache entries that haven't been accessed during that interval are
-removed from memory.
+The parameter "cache-clean-interval" defines an interval (in seconds),
+after which all the cache entries that haven't been accessed during the
+interval are removed from memory. Setting this parameter to 0 disables this
+feature.
 
-This example removes all unused cache entries every 15 minutes:
+The following example removes all unused cache entries every 15 minutes:
 
    -drive file=hd.qcow2,cache-clean-interval=900
 
-If unset, the default value for this parameter is 0 and it disables
-this feature.
+If unset, the default value for this parameter is 600 on platforms which
+support this functionality, and is 0 (disabled) on other platforms.
 
-Note that this functionality currently relies on the MADV_DONTNEED
-argument for madvise() to actually free the memory. This is a
-Linux-specific feature, so cache-clean-interval is not supported in
-other systems.
+This functionality currently relies on the MADV_DONTNEED argument for
+madvise() to actually free the memory. This is a Linux-specific feature,
+so cache-clean-interval is not supported on other systems.
diff --git a/include/block/block.h b/include/block/block.h
index 4edc1e8afa..b189cf422e 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -184,6 +184,7 @@ typedef QSIMPLEQ_HEAD(BlockReopenQueue, BlockReopenQueueEntry) BlockReopenQueue;
 typedef struct BDRVReopenState {
     BlockDriverState *bs;
     int flags;
+    BlockdevDetectZeroesOptions detect_zeroes;
     uint64_t perm, shared_perm;
     QDict *options;
     QDict *explicit_options;
diff --git a/include/qemu/units.h b/include/qemu/units.h
index 692db3fbb2..68a7758650 100644
--- a/include/qemu/units.h
+++ b/include/qemu/units.h
@@ -17,4 +17,59 @@
 #define PiB     (INT64_C(1) << 50)
 #define EiB     (INT64_C(1) << 60)
 
+#define S_1KiB                  1024
+#define S_2KiB                  2048
+#define S_4KiB                  4096
+#define S_8KiB                  8192
+#define S_16KiB                16384
+#define S_32KiB                32768
+#define S_64KiB                65536
+#define S_128KiB              131072
+#define S_256KiB              262144
+#define S_512KiB              524288
+#define S_1MiB               1048576
+#define S_2MiB               2097152
+#define S_4MiB               4194304
+#define S_8MiB               8388608
+#define S_16MiB             16777216
+#define S_32MiB             33554432
+#define S_64MiB             67108864
+#define S_128MiB           134217728
+#define S_256MiB           268435456
+#define S_512MiB           536870912
+#define S_1GiB            1073741824
+#define S_2GiB            2147483648
+#define S_4GiB            4294967296
+#define S_8GiB            8589934592
+#define S_16GiB          17179869184
+#define S_32GiB          34359738368
+#define S_64GiB          68719476736
+#define S_128GiB        137438953472
+#define S_256GiB        274877906944
+#define S_512GiB        549755813888
+#define S_1TiB         1099511627776
+#define S_2TiB         2199023255552
+#define S_4TiB         4398046511104
+#define S_8TiB         8796093022208
+#define S_16TiB       17592186044416
+#define S_32TiB       35184372088832
+#define S_64TiB       70368744177664
+#define S_128TiB     140737488355328
+#define S_256TiB     281474976710656
+#define S_512TiB     562949953421312
+#define S_1PiB      1125899906842624
+#define S_2PiB      2251799813685248
+#define S_4PiB      4503599627370496
+#define S_8PiB      9007199254740992
+#define S_16PiB    18014398509481984
+#define S_32PiB    36028797018963968
+#define S_64PiB    72057594037927936
+#define S_128PiB  144115188075855872
+#define S_256PiB  288230376151711744
+#define S_512PiB  576460752303423488
+#define S_1EiB   1152921504606846976
+#define S_2EiB   2305843009213693952
+#define S_4EiB   4611686018427387904
+#define S_8EiB   9223372036854775808
+
 #endif
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 58ec9931c7..cfb37f8c1d 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2897,7 +2897,9 @@
 #
 # @cache-clean-interval:  clean unused entries in the L2 and refcount
 #                         caches. The interval is in seconds. The default value
-#                         is 0 and it disables this feature (since 2.5)
+#                         is 600 on supporting platforms, and 0 on other
+#                         platforms. 0 disables this feature. (since 2.5)
+#
 # @encrypt:               Image decryption options. Mandatory for
 #                         encrypted images, except when doing a metadata-only
 #                         probe of the image. (since 2.10)
diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
index 5bf5f28178..db0b3ee5ef 100644
--- a/qemu-io-cmds.c
+++ b/qemu-io-cmds.c
@@ -2025,7 +2025,7 @@ static int reopen_f(BlockBackend *blk, int argc, char **argv)
         return -EINVAL;
     }
 
-    if (writethrough != blk_enable_write_cache(blk) &&
+    if (!writethrough != blk_enable_write_cache(blk) &&
         blk_get_attached_dev(blk))
     {
         error_report("Cannot change cache.writeback: Device attached");
diff --git a/qemu-options.hx b/qemu-options.hx
index a642ad297f..f139459e80 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -732,19 +732,23 @@ image file)
 
 @item cache-size
 The maximum total size of the L2 table and refcount block caches in bytes
-(default: 1048576 bytes or 8 clusters, whichever is larger)
+(default: the sum of l2-cache-size and refcount-cache-size)
 
 @item l2-cache-size
 The maximum size of the L2 table cache in bytes
-(default: 4/5 of the total cache size)
+(default: if cache-size is not specified - 32M on Linux platforms, and 8M on
+non-Linux platforms; otherwise, as large as possible within the cache-size,
+while permitting the requested or the minimal refcount cache size)
 
 @item refcount-cache-size
 The maximum size of the refcount block cache in bytes
-(default: 1/5 of the total cache size)
+(default: 4 times the cluster size; or if cache-size is specified, the part of
+it which is not used for the L2 cache)
 
 @item cache-clean-interval
 Clean unused entries in the L2 and refcount caches. The interval is in seconds.
-The default value is 0 and it disables this feature.
+The default value is 600 on supporting platforms, and 0 on other platforms.
+Setting it to 0 disables this feature.
 
 @item pass-discard-request
 Whether discard requests to the qcow2 device should be forwarded to the data
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index 1362772617..34e5ccd9f1 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -217,6 +217,7 @@ enum {
 #define MEMCTL_IL0EN 0x1
 
 #define MAX_INSN_LENGTH 64
+#define MAX_INSN_SLOTS 32
 #define MAX_OPCODE_ARGS 16
 #define MAX_NAREG 64
 #define MAX_NINTERRUPT 32
@@ -347,11 +348,40 @@ typedef struct XtensaMemory {
 typedef struct DisasContext DisasContext;
 typedef void (*XtensaOpcodeOp)(DisasContext *dc, const uint32_t arg[],
                                const uint32_t par[]);
+typedef bool (*XtensaOpcodeBoolTest)(DisasContext *dc,
+                                     const uint32_t arg[],
+                                     const uint32_t par[]);
+typedef uint32_t (*XtensaOpcodeUintTest)(DisasContext *dc,
+                                         const uint32_t arg[],
+                                         const uint32_t par[]);
+
+enum {
+    XTENSA_OP_ILL = 0x1,
+    XTENSA_OP_PRIVILEGED = 0x2,
+    XTENSA_OP_SYSCALL = 0x4,
+    XTENSA_OP_DEBUG_BREAK = 0x8,
+
+    XTENSA_OP_OVERFLOW = 0x10,
+    XTENSA_OP_UNDERFLOW = 0x20,
+    XTENSA_OP_ALLOCA = 0x40,
+    XTENSA_OP_COPROCESSOR = 0x80,
+
+    XTENSA_OP_DIVIDE_BY_ZERO = 0x100,
+
+    XTENSA_OP_CHECK_INTERRUPTS = 0x200,
+    XTENSA_OP_EXIT_TB_M1 = 0x400,
+    XTENSA_OP_EXIT_TB_0 = 0x800,
+};
 
 typedef struct XtensaOpcodeOps {
     const char *name;
     XtensaOpcodeOp translate;
+    XtensaOpcodeBoolTest test_ill;
+    XtensaOpcodeUintTest test_overflow;
     const uint32_t *par;
+    uint32_t op_flags;
+    uint32_t windowed_register_op;
+    uint32_t coprocessor;
 } XtensaOpcodeOps;
 
 typedef struct XtensaOpcodeTranslators {
@@ -661,6 +691,9 @@ static inline int cpu_mmu_index(CPUXtensaState *env, bool ifetch)
 #define XTENSA_TBFLAG_WINDOW_MASK 0x18000
 #define XTENSA_TBFLAG_WINDOW_SHIFT 15
 #define XTENSA_TBFLAG_YIELD 0x20000
+#define XTENSA_TBFLAG_CWOE 0x40000
+#define XTENSA_TBFLAG_CALLINC_MASK 0x180000
+#define XTENSA_TBFLAG_CALLINC_SHIFT 19
 
 static inline void cpu_get_tb_cpu_state(CPUXtensaState *env, target_ulong *pc,
         target_ulong *cs_base, uint32_t *flags)
@@ -698,7 +731,9 @@ static inline void cpu_get_tb_cpu_state(CPUXtensaState *env, target_ulong *pc,
             (env->sregs[WINDOW_BASE] + 1);
         uint32_t w = ctz32(windowstart | 0x8);
 
-        *flags |= w << XTENSA_TBFLAG_WINDOW_SHIFT;
+        *flags |= (w << XTENSA_TBFLAG_WINDOW_SHIFT) | XTENSA_TBFLAG_CWOE;
+        *flags |= extract32(env->sregs[PS], PS_CALLINC_SHIFT,
+                            PS_CALLINC_LEN) << XTENSA_TBFLAG_CALLINC_SHIFT;
     } else {
         *flags |= 3 << XTENSA_TBFLAG_WINDOW_SHIFT;
     }
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index 4fceb4424a..501082f55b 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -57,12 +57,18 @@ static void init_libisa(XtensaConfig *config)
 {
     unsigned i, j;
     unsigned opcodes;
+    unsigned formats;
 
     config->isa = xtensa_isa_init(config->isa_internal, NULL, NULL);
     assert(xtensa_isa_maxlength(config->isa) <= MAX_INSN_LENGTH);
     opcodes = xtensa_isa_num_opcodes(config->isa);
+    formats = xtensa_isa_num_formats(config->isa);
     config->opcode_ops = g_new(XtensaOpcodeOps *, opcodes);
 
+    for (i = 0; i < formats; ++i) {
+        assert(xtensa_format_num_slots(config->isa, i) <= MAX_INSN_SLOTS);
+    }
+
     for (i = 0; i < opcodes; ++i) {
         const char *opc_name = xtensa_opcode_name(config->isa, i);
         XtensaOpcodeOps *ops = NULL;
diff --git a/target/xtensa/helper.h b/target/xtensa/helper.h
index 73444ae02c..10153c2453 100644
--- a/target/xtensa/helper.h
+++ b/target/xtensa/helper.h
@@ -5,6 +5,8 @@ DEF_HELPER_3(debug_exception, noreturn, env, i32, i32)
 
 DEF_HELPER_2(wsr_windowbase, void, env, i32)
 DEF_HELPER_4(entry, void, env, i32, i32, i32)
+DEF_HELPER_2(test_ill_retw, void, env, i32)
+DEF_HELPER_2(test_underflow_retw, void, env, i32)
 DEF_HELPER_2(retw, i32, env, i32)
 DEF_HELPER_2(rotw, void, env, i32)
 DEF_HELPER_3(window_check, noreturn, env, i32, i32)
diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c
index 06fe346f02..e4b42ab3e5 100644
--- a/target/xtensa/op_helper.c
+++ b/target/xtensa/op_helper.c
@@ -253,22 +253,11 @@ void HELPER(wsr_windowbase)(CPUXtensaState *env, uint32_t v)
 void HELPER(entry)(CPUXtensaState *env, uint32_t pc, uint32_t s, uint32_t imm)
 {
     int callinc = (env->sregs[PS] & PS_CALLINC) >> PS_CALLINC_SHIFT;
-    if (s > 3 || ((env->sregs[PS] & (PS_WOE | PS_EXCM)) ^ PS_WOE) != 0) {
-        qemu_log_mask(LOG_GUEST_ERROR, "Illegal entry instruction(pc = %08x), PS = %08x\n",
-                      pc, env->sregs[PS]);
-        HELPER(exception_cause)(env, pc, ILLEGAL_INSTRUCTION_CAUSE);
-    } else {
-        uint32_t windowstart = xtensa_replicate_windowstart(env) >>
-            (env->sregs[WINDOW_BASE] + 1);
 
-        if (windowstart & ((1 << callinc) - 1)) {
-            HELPER(window_check)(env, pc, callinc);
-        }
-        env->regs[(callinc << 2) | (s & 3)] = env->regs[s] - imm;
-        xtensa_rotate_window(env, callinc);
-        env->sregs[WINDOW_START] |=
-            windowstart_bit(env->sregs[WINDOW_BASE], env);
-    }
+    env->regs[(callinc << 2) | (s & 3)] = env->regs[s] - imm;
+    xtensa_rotate_window(env, callinc);
+    env->sregs[WINDOW_START] |=
+        windowstart_bit(env->sregs[WINDOW_BASE], env);
 }
 
 void HELPER(window_check)(CPUXtensaState *env, uint32_t pc, uint32_t w)
@@ -298,13 +287,12 @@ void HELPER(window_check)(CPUXtensaState *env, uint32_t pc, uint32_t w)
     }
 }
 
-uint32_t HELPER(retw)(CPUXtensaState *env, uint32_t pc)
+void HELPER(test_ill_retw)(CPUXtensaState *env, uint32_t pc)
 {
     int n = (env->regs[0] >> 30) & 0x3;
     int m = 0;
     uint32_t windowbase = windowbase_bound(env->sregs[WINDOW_BASE], env);
     uint32_t windowstart = env->sregs[WINDOW_START];
-    uint32_t ret_pc = 0;
 
     if (windowstart & windowstart_bit(windowbase - 1, env)) {
         m = 1;
@@ -314,35 +302,46 @@ uint32_t HELPER(retw)(CPUXtensaState *env, uint32_t pc)
         m = 3;
     }
 
-    if (n == 0 || (m != 0 && m != n) ||
-            ((env->sregs[PS] & (PS_WOE | PS_EXCM)) ^ PS_WOE) != 0) {
+    if (n == 0 || (m != 0 && m != n)) {
         qemu_log_mask(LOG_GUEST_ERROR, "Illegal retw instruction(pc = %08x), "
                       "PS = %08x, m = %d, n = %d\n",
                       pc, env->sregs[PS], m, n);
         HELPER(exception_cause)(env, pc, ILLEGAL_INSTRUCTION_CAUSE);
-    } else {
-        int owb = windowbase;
+    }
+}
+
+void HELPER(test_underflow_retw)(CPUXtensaState *env, uint32_t pc)
+{
+    int n = (env->regs[0] >> 30) & 0x3;
 
-        ret_pc = (pc & 0xc0000000) | (env->regs[0] & 0x3fffffff);
+    if (!(env->sregs[WINDOW_START] &
+          windowstart_bit(env->sregs[WINDOW_BASE] - n, env))) {
+        uint32_t windowbase = windowbase_bound(env->sregs[WINDOW_BASE], env);
 
         xtensa_rotate_window(env, -n);
-        if (windowstart & windowstart_bit(env->sregs[WINDOW_BASE], env)) {
-            env->sregs[WINDOW_START] &= ~windowstart_bit(owb, env);
-        } else {
-            /* window underflow */
-            env->sregs[PS] = (env->sregs[PS] & ~PS_OWB) |
-                (windowbase << PS_OWB_SHIFT) | PS_EXCM;
-            env->sregs[EPC1] = env->pc = pc;
-
-            if (n == 1) {
-                HELPER(exception)(env, EXC_WINDOW_UNDERFLOW4);
-            } else if (n == 2) {
-                HELPER(exception)(env, EXC_WINDOW_UNDERFLOW8);
-            } else if (n == 3) {
-                HELPER(exception)(env, EXC_WINDOW_UNDERFLOW12);
-            }
+        /* window underflow */
+        env->sregs[PS] = (env->sregs[PS] & ~PS_OWB) |
+            (windowbase << PS_OWB_SHIFT) | PS_EXCM;
+        env->sregs[EPC1] = env->pc = pc;
+
+        if (n == 1) {
+            HELPER(exception)(env, EXC_WINDOW_UNDERFLOW4);
+        } else if (n == 2) {
+            HELPER(exception)(env, EXC_WINDOW_UNDERFLOW8);
+        } else if (n == 3) {
+            HELPER(exception)(env, EXC_WINDOW_UNDERFLOW12);
         }
     }
+}
+
+uint32_t HELPER(retw)(CPUXtensaState *env, uint32_t pc)
+{
+    int n = (env->regs[0] >> 30) & 0x3;
+    uint32_t windowbase = windowbase_bound(env->sregs[WINDOW_BASE], env);
+    uint32_t ret_pc = (pc & 0xc0000000) | (env->regs[0] & 0x3fffffff);
+
+    xtensa_rotate_window(env, -n);
+    env->sregs[WINDOW_START] &= ~windowstart_bit(windowbase, env);
     return ret_pc;
 }
 
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index c626583cd9..46e1338448 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -62,6 +62,8 @@ struct DisasContext {
     TCGv_i32 sar_m32;
 
     unsigned window;
+    unsigned callinc;
+    bool cwoe;
 
     bool debug;
     bool icount;
@@ -349,11 +351,12 @@ static bool gen_check_privilege(DisasContext *dc)
     return false;
 }
 
-static bool gen_check_cpenable(DisasContext *dc, unsigned cp)
+static bool gen_check_cpenable(DisasContext *dc, uint32_t cp_mask)
 {
-    if (option_enabled(dc, XTENSA_OPTION_COPROCESSOR) &&
-            !(dc->cpenable & (1 << cp))) {
-        gen_exception_cause(dc, COPROCESSOR0_DISABLED + cp);
+    cp_mask &= ~dc->cpenable;
+
+    if (option_enabled(dc, XTENSA_OPTION_COPROCESSOR) && cp_mask) {
+        gen_exception_cause(dc, COPROCESSOR0_DISABLED + ctz32(cp_mask));
         dc->base.is_jmp = DISAS_NORETURN;
         return false;
     }
@@ -469,7 +472,7 @@ static void gen_brcondi(DisasContext *dc, TCGCond cond,
     tcg_temp_free(tmp);
 }
 
-static bool gen_check_sr(DisasContext *dc, uint32_t sr, unsigned access)
+static bool check_sr(DisasContext *dc, uint32_t sr, unsigned access)
 {
     if (!xtensa_option_bits_enabled(dc->config, sregnames[sr].opt_bits)) {
         if (sregnames[sr].name) {
@@ -477,7 +480,6 @@ static bool gen_check_sr(DisasContext *dc, uint32_t sr, unsigned access)
         } else {
             qemu_log_mask(LOG_UNIMP, "SR %d is not implemented\n", sr);
         }
-        gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE);
         return false;
     } else if (!(sregnames[sr].access & access)) {
         static const char * const access_text[] = {
@@ -488,14 +490,13 @@ static bool gen_check_sr(DisasContext *dc, uint32_t sr, unsigned access)
         assert(access < ARRAY_SIZE(access_text) && access_text[access]);
         qemu_log_mask(LOG_GUEST_ERROR, "SR %s is not available for %s\n", sregnames[sr].name,
                       access_text[access]);
-        gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE);
         return false;
     }
     return true;
 }
 
 #ifndef CONFIG_USER_ONLY
-static bool gen_rsr_ccount(DisasContext *dc, TCGv_i32 d, uint32_t sr)
+static void gen_rsr_ccount(DisasContext *dc, TCGv_i32 d, uint32_t sr)
 {
     if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
         gen_io_start();
@@ -504,24 +505,21 @@ static bool gen_rsr_ccount(DisasContext *dc, TCGv_i32 d, uint32_t sr)
     tcg_gen_mov_i32(d, cpu_SR[sr]);
     if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
         gen_io_end();
-        return true;
     }
-    return false;
 }
 
-static bool gen_rsr_ptevaddr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
+static void gen_rsr_ptevaddr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
 {
     tcg_gen_shri_i32(d, cpu_SR[EXCVADDR], 10);
     tcg_gen_or_i32(d, d, cpu_SR[sr]);
     tcg_gen_andi_i32(d, d, 0xfffffffc);
-    return false;
 }
 #endif
 
-static bool gen_rsr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
+static void gen_rsr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
 {
-    static bool (* const rsr_handler[256])(DisasContext *dc,
-            TCGv_i32 d, uint32_t sr) = {
+    static void (* const rsr_handler[256])(DisasContext *dc,
+                                           TCGv_i32 d, uint32_t sr) = {
 #ifndef CONFIG_USER_ONLY
         [CCOUNT] = gen_rsr_ccount,
         [INTSET] = gen_rsr_ccount,
@@ -530,28 +528,23 @@ static bool gen_rsr(DisasContext *dc, TCGv_i32 d, uint32_t sr)
     };
 
     if (rsr_handler[sr]) {
-        return rsr_handler[sr](dc, d, sr);
+        rsr_handler[sr](dc, d, sr);
     } else {
         tcg_gen_mov_i32(d, cpu_SR[sr]);
-        return false;
     }
 }
 
-static bool gen_wsr_lbeg(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr_lbeg(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
     gen_helper_wsr_lbeg(cpu_env, s);
-    gen_jumpi_check_loop_end(dc, 0);
-    return false;
 }
 
-static bool gen_wsr_lend(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr_lend(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
     gen_helper_wsr_lend(cpu_env, s);
-    gen_jumpi_check_loop_end(dc, 0);
-    return false;
 }
 
-static bool gen_wsr_sar(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr_sar(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
     tcg_gen_andi_i32(cpu_SR[sr], s, 0x3f);
     if (dc->sar_m32_5bit) {
@@ -559,129 +552,97 @@ static bool gen_wsr_sar(DisasContext *dc, uint32_t sr, TCGv_i32 s)
     }
     dc->sar_5bit = false;
     dc->sar_m32_5bit = false;
-    return false;
 }
 
-static bool gen_wsr_br(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr_br(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
     tcg_gen_andi_i32(cpu_SR[sr], s, 0xffff);
-    return false;
 }
 
-static bool gen_wsr_litbase(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr_litbase(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
     tcg_gen_andi_i32(cpu_SR[sr], s, 0xfffff001);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
-static bool gen_wsr_acchi(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr_acchi(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
     tcg_gen_ext8s_i32(cpu_SR[sr], s);
-    return false;
 }
 
 #ifndef CONFIG_USER_ONLY
-static bool gen_wsr_windowbase(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_windowbase(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     gen_helper_wsr_windowbase(cpu_env, v);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
-static bool gen_wsr_windowstart(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_windowstart(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v, (1 << dc->config->nareg / 4) - 1);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
-static bool gen_wsr_ptevaddr(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_ptevaddr(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v, 0xffc00000);
-    return false;
 }
 
-static bool gen_wsr_rasid(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_rasid(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     gen_helper_wsr_rasid(cpu_env, v);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
-static bool gen_wsr_tlbcfg(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_tlbcfg(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v, 0x01130000);
-    return false;
 }
 
-static bool gen_wsr_ibreakenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_ibreakenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     gen_helper_wsr_ibreakenable(cpu_env, v);
-    gen_jumpi_check_loop_end(dc, 0);
-    return true;
 }
 
-static bool gen_wsr_memctl(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_memctl(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     gen_helper_wsr_memctl(cpu_env, v);
-    return false;
 }
 
-static bool gen_wsr_atomctl(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_atomctl(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v, 0x3f);
-    return false;
 }
 
-static bool gen_wsr_ibreaka(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_ibreaka(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     unsigned id = sr - IBREAKA;
+    TCGv_i32 tmp = tcg_const_i32(id);
 
-    if (id < dc->config->nibreak) {
-        TCGv_i32 tmp = tcg_const_i32(id);
-        gen_helper_wsr_ibreaka(cpu_env, tmp, v);
-        tcg_temp_free(tmp);
-        gen_jumpi_check_loop_end(dc, 0);
-        return true;
-    }
-    return false;
+    assert(id < dc->config->nibreak);
+    gen_helper_wsr_ibreaka(cpu_env, tmp, v);
+    tcg_temp_free(tmp);
 }
 
-static bool gen_wsr_dbreaka(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_dbreaka(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     unsigned id = sr - DBREAKA;
+    TCGv_i32 tmp = tcg_const_i32(id);
 
-    if (id < dc->config->ndbreak) {
-        TCGv_i32 tmp = tcg_const_i32(id);
-        gen_helper_wsr_dbreaka(cpu_env, tmp, v);
-        tcg_temp_free(tmp);
-    }
-    return false;
+    assert(id < dc->config->ndbreak);
+    gen_helper_wsr_dbreaka(cpu_env, tmp, v);
+    tcg_temp_free(tmp);
 }
 
-static bool gen_wsr_dbreakc(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_dbreakc(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     unsigned id = sr - DBREAKC;
+    TCGv_i32 tmp = tcg_const_i32(id);
 
-    if (id < dc->config->ndbreak) {
-        TCGv_i32 tmp = tcg_const_i32(id);
-        gen_helper_wsr_dbreakc(cpu_env, tmp, v);
-        tcg_temp_free(tmp);
-    }
-    return false;
+    assert(id < dc->config->ndbreak);
+    gen_helper_wsr_dbreakc(cpu_env, tmp, v);
+    tcg_temp_free(tmp);
 }
 
-static bool gen_wsr_cpenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_cpenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v, 0xff);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
 static void gen_check_interrupts(DisasContext *dc)
@@ -695,16 +656,13 @@ static void gen_check_interrupts(DisasContext *dc)
     }
 }
 
-static bool gen_wsr_intset(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_intset(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v,
             dc->config->inttype_mask[INTTYPE_SOFTWARE]);
-    gen_check_interrupts(dc);
-    gen_jumpi_check_loop_end(dc, 0);
-    return true;
 }
 
-static bool gen_wsr_intclear(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_intclear(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
 
@@ -714,20 +672,14 @@ static bool gen_wsr_intclear(DisasContext *dc, uint32_t sr, TCGv_i32 v)
             dc->config->inttype_mask[INTTYPE_SOFTWARE]);
     tcg_gen_andc_i32(cpu_SR[INTSET], cpu_SR[INTSET], tmp);
     tcg_temp_free(tmp);
-    gen_check_interrupts(dc);
-    gen_jumpi_check_loop_end(dc, 0);
-    return true;
 }
 
-static bool gen_wsr_intenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_intenable(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_mov_i32(cpu_SR[sr], v);
-    gen_check_interrupts(dc);
-    gen_jumpi_check_loop_end(dc, 0);
-    return true;
 }
 
-static bool gen_wsr_ps(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_ps(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     uint32_t mask = PS_WOE | PS_CALLINC | PS_OWB |
         PS_UM | PS_EXCM | PS_INTLEVEL;
@@ -736,13 +688,9 @@ static bool gen_wsr_ps(DisasContext *dc, uint32_t sr, TCGv_i32 v)
         mask |= PS_RING;
     }
     tcg_gen_andi_i32(cpu_SR[sr], v, mask);
-    gen_check_interrupts(dc);
-    /* This can change mmu index and tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
-static bool gen_wsr_ccount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_ccount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
         gen_io_start();
@@ -750,53 +698,40 @@ static bool gen_wsr_ccount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
     gen_helper_wsr_ccount(cpu_env, v);
     if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
         gen_io_end();
-        gen_jumpi_check_loop_end(dc, 0);
-        return true;
     }
-    return false;
 }
 
-static bool gen_wsr_icount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_icount(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     if (dc->icount) {
         tcg_gen_mov_i32(dc->next_icount, v);
     } else {
         tcg_gen_mov_i32(cpu_SR[sr], v);
     }
-    return false;
 }
 
-static bool gen_wsr_icountlevel(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_icountlevel(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     tcg_gen_andi_i32(cpu_SR[sr], v, 0xf);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
-    return true;
 }
 
-static bool gen_wsr_ccompare(DisasContext *dc, uint32_t sr, TCGv_i32 v)
+static void gen_wsr_ccompare(DisasContext *dc, uint32_t sr, TCGv_i32 v)
 {
     uint32_t id = sr - CCOMPARE;
-    bool ret = false;
+    uint32_t int_bit = 1 << dc->config->timerint[id];
+    TCGv_i32 tmp = tcg_const_i32(id);
 
-    if (id < dc->config->nccompare) {
-        uint32_t int_bit = 1 << dc->config->timerint[id];
-        TCGv_i32 tmp = tcg_const_i32(id);
-
-        tcg_gen_mov_i32(cpu_SR[sr], v);
-        tcg_gen_andi_i32(cpu_SR[INTSET], cpu_SR[INTSET], ~int_bit);
-        if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-            gen_io_start();
-        }
-        gen_helper_update_ccompare(cpu_env, tmp);
-        if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
-            gen_io_end();
-            gen_jumpi_check_loop_end(dc, 0);
-            ret = true;
-        }
-        tcg_temp_free(tmp);
+    assert(id < dc->config->nccompare);
+    tcg_gen_mov_i32(cpu_SR[sr], v);
+    tcg_gen_andi_i32(cpu_SR[INTSET], cpu_SR[INTSET], ~int_bit);
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
+    gen_helper_update_ccompare(cpu_env, tmp);
+    tcg_temp_free(tmp);
+    if (tb_cflags(dc->base.tb) & CF_USE_ICOUNT) {
+        gen_io_end();
     }
-    return ret;
 }
 #else
 static void gen_check_interrupts(DisasContext *dc)
@@ -804,10 +739,10 @@ static void gen_check_interrupts(DisasContext *dc)
 }
 #endif
 
-static bool gen_wsr(DisasContext *dc, uint32_t sr, TCGv_i32 s)
+static void gen_wsr(DisasContext *dc, uint32_t sr, TCGv_i32 s)
 {
-    static bool (* const wsr_handler[256])(DisasContext *dc,
-            uint32_t sr, TCGv_i32 v) = {
+    static void (* const wsr_handler[256])(DisasContext *dc,
+                                           uint32_t sr, TCGv_i32 v) = {
         [LBEG] = gen_wsr_lbeg,
         [LEND] = gen_wsr_lend,
         [SAR] = gen_wsr_sar,
@@ -845,10 +780,9 @@ static bool gen_wsr(DisasContext *dc, uint32_t sr, TCGv_i32 s)
     };
 
     if (wsr_handler[sr]) {
-        return wsr_handler[sr](dc, sr, s);
+        wsr_handler[sr](dc, sr, s);
     } else {
         tcg_gen_mov_i32(cpu_SR[sr], s);
-        return false;
     }
 }
 
@@ -901,15 +835,16 @@ static void gen_waiti(DisasContext *dc, uint32_t imm4)
     }
     tcg_temp_free(pc);
     tcg_temp_free(intlevel);
-    gen_jumpi_check_loop_end(dc, 0);
 }
 #endif
 
-static bool gen_window_check1(DisasContext *dc, unsigned r1)
+static bool gen_window_check(DisasContext *dc, uint32_t mask)
 {
-    if (r1 / 4 > dc->window) {
+    unsigned r = 31 - clz32(mask);
+
+    if (r / 4 > dc->window) {
         TCGv_i32 pc = tcg_const_i32(dc->pc);
-        TCGv_i32 w = tcg_const_i32(r1 / 4);
+        TCGv_i32 w = tcg_const_i32(r / 4);
 
         gen_helper_window_check(cpu_env, pc, w);
         dc->base.is_jmp = DISAS_NORETURN;
@@ -918,17 +853,6 @@ static bool gen_window_check1(DisasContext *dc, unsigned r1)
     return true;
 }
 
-static bool gen_window_check2(DisasContext *dc, unsigned r1, unsigned r2)
-{
-    return gen_window_check1(dc, r1 > r2 ? r1 : r2);
-}
-
-static bool gen_window_check3(DisasContext *dc, unsigned r1, unsigned r2,
-        unsigned r3)
-{
-    return gen_window_check2(dc, r1, r2 > r3 ? r2 : r3);
-}
-
 static TCGv_i32 gen_mac16_m(TCGv_i32 v, bool hi, bool is_unsigned)
 {
     TCGv_i32 m = tcg_temp_new_i32();
@@ -941,6 +865,15 @@ static TCGv_i32 gen_mac16_m(TCGv_i32 v, bool hi, bool is_unsigned)
     return m;
 }
 
+static void gen_zero_check(DisasContext *dc, const uint32_t arg[])
+{
+    TCGLabel *label = gen_new_label();
+
+    tcg_gen_brcondi_i32(TCG_COND_NE, cpu_R[arg[2]], 0, label);
+    gen_exception_cause(dc, INTEGER_DIVIDE_BY_ZERO_CAUSE);
+    gen_set_label(label);
+}
+
 static inline unsigned xtensa_op0_insn_len(DisasContext *dc, uint8_t op0)
 {
     return xtensa_isa_length_from_chars(dc->config->isa, &op0);
@@ -954,6 +887,15 @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
     xtensa_format fmt;
     int slot, slots;
     unsigned i;
+    uint32_t op_flags = 0;
+    struct {
+        XtensaOpcodeOps *ops;
+        uint32_t arg[MAX_OPCODE_ARGS];
+        uint32_t raw_arg[MAX_OPCODE_ARGS];
+    } slot_prop[MAX_INSN_SLOTS];
+    uint32_t debug_cause = 0;
+    uint32_t windowed_register = 0;
+    uint32_t coprocessor = 0;
 
     if (len == XTENSA_UNDEFINED) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -987,8 +929,8 @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
     for (slot = 0; slot < slots; ++slot) {
         xtensa_opcode opc;
         int opnd, vopnd, opnds;
-        uint32_t raw_arg[MAX_OPCODE_ARGS];
-        uint32_t arg[MAX_OPCODE_ARGS];
+        uint32_t *raw_arg = slot_prop[slot].raw_arg;
+        uint32_t *arg = slot_prop[slot].arg;
         XtensaOpcodeOps *ops;
 
         dc->raw_arg = raw_arg;
@@ -1020,16 +962,105 @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
             }
         }
         ops = dc->config->opcode_ops[opc];
+        slot_prop[slot].ops = ops;
+
         if (ops) {
-            ops->translate(dc, arg, ops->par);
+            op_flags |= ops->op_flags;
         } else {
-            qemu_log_mask(LOG_GUEST_ERROR,
+            qemu_log_mask(LOG_UNIMP,
                           "unimplemented opcode '%s' in slot %d (pc = %08x)\n",
                           xtensa_opcode_name(isa, opc), slot, dc->pc);
+            op_flags |= XTENSA_OP_ILL;
+        }
+        if ((op_flags & XTENSA_OP_ILL) ||
+            (ops && ops->test_ill && ops->test_ill(dc, arg, ops->par))) {
             gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE);
             return;
         }
+        if (ops->op_flags & XTENSA_OP_DEBUG_BREAK) {
+            debug_cause |= ops->par[0];
+        }
+        if (ops->test_overflow) {
+            windowed_register |= ops->test_overflow(dc, arg, ops->par);
+        }
+        if (ops->windowed_register_op) {
+            uint32_t reg_opnd = ops->windowed_register_op;
+
+            while (reg_opnd) {
+                unsigned i = ctz32(reg_opnd);
+
+                windowed_register |= 1 << arg[i];
+                reg_opnd ^= 1 << i;
+            }
+        }
+        coprocessor |= ops->coprocessor;
+    }
+
+    if ((op_flags & XTENSA_OP_PRIVILEGED) &&
+        !gen_check_privilege(dc)) {
+        return;
+    }
+
+    if (op_flags & XTENSA_OP_SYSCALL) {
+        gen_exception_cause(dc, SYSCALL_CAUSE);
+        return;
+    }
+
+    if ((op_flags & XTENSA_OP_DEBUG_BREAK) && dc->debug) {
+        gen_debug_exception(dc, debug_cause);
+        return;
+    }
+
+    if (windowed_register && !gen_window_check(dc, windowed_register)) {
+        return;
+    }
+
+    if (op_flags & XTENSA_OP_UNDERFLOW) {
+        TCGv_i32 tmp = tcg_const_i32(dc->pc);
+
+        gen_helper_test_underflow_retw(cpu_env, tmp);
+        tcg_temp_free(tmp);
+    }
+
+    if (op_flags & XTENSA_OP_ALLOCA) {
+        TCGv_i32 tmp = tcg_const_i32(dc->pc);
+
+        gen_helper_movsp(cpu_env, tmp);
+        tcg_temp_free(tmp);
+    }
+
+    if (coprocessor && !gen_check_cpenable(dc, coprocessor)) {
+        return;
+    }
+
+    if (op_flags & XTENSA_OP_DIVIDE_BY_ZERO) {
+        for (slot = 0; slot < slots; ++slot) {
+            if (slot_prop[slot].ops->op_flags & XTENSA_OP_DIVIDE_BY_ZERO) {
+                gen_zero_check(dc, slot_prop[slot].arg);
+            }
+        }
+    }
+
+    for (slot = 0; slot < slots; ++slot) {
+        XtensaOpcodeOps *ops = slot_prop[slot].ops;
+
+        dc->raw_arg = slot_prop[slot].raw_arg;
+        ops->translate(dc, slot_prop[slot].arg, ops->par);
+    }
+
+    if (dc->base.is_jmp == DISAS_NEXT) {
+        if (op_flags & XTENSA_OP_CHECK_INTERRUPTS) {
+            gen_check_interrupts(dc);
+        }
+
+        if (op_flags & XTENSA_OP_EXIT_TB_M1) {
+            /* Change in mmu index, memory mapping or tb->flags; exit tb */
+            gen_jumpi_check_loop_end(dc, -1);
+        } else if (op_flags & XTENSA_OP_EXIT_TB_0) {
+            gen_jumpi_check_loop_end(dc, 0);
+        }
     }
+
     if (dc->base.is_jmp == DISAS_NEXT) {
         gen_check_loop_end(dc, 0);
     }
@@ -1074,6 +1105,9 @@ static void xtensa_tr_init_disas_context(DisasContextBase *dcbase,
         XTENSA_TBFLAG_CPENABLE_SHIFT;
     dc->window = ((tb_flags & XTENSA_TBFLAG_WINDOW_MASK) >>
                  XTENSA_TBFLAG_WINDOW_SHIFT);
+    dc->cwoe = tb_flags & XTENSA_TBFLAG_CWOE;
+    dc->callinc = ((tb_flags & XTENSA_TBFLAG_CALLINC_MASK) >>
+                   XTENSA_TBFLAG_CALLINC_SHIFT);
 
     if (dc->config->isa) {
         dc->insnbuf = xtensa_insnbuf_alloc(dc->config->isa);
@@ -1295,43 +1329,35 @@ xtensa_find_opcode_ops(const XtensaOpcodeTranslators *t,
 static void translate_abs(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 zero = tcg_const_i32(0);
-        TCGv_i32 neg = tcg_temp_new_i32();
+    TCGv_i32 zero = tcg_const_i32(0);
+    TCGv_i32 neg = tcg_temp_new_i32();
 
-        tcg_gen_neg_i32(neg, cpu_R[arg[1]]);
-        tcg_gen_movcond_i32(TCG_COND_GE, cpu_R[arg[0]],
-                            cpu_R[arg[1]], zero, cpu_R[arg[1]], neg);
-        tcg_temp_free(neg);
-        tcg_temp_free(zero);
-    }
+    tcg_gen_neg_i32(neg, cpu_R[arg[1]]);
+    tcg_gen_movcond_i32(TCG_COND_GE, cpu_R[arg[0]],
+                        cpu_R[arg[1]], zero, cpu_R[arg[1]], neg);
+    tcg_temp_free(neg);
+    tcg_temp_free(zero);
 }
 
 static void translate_add(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_add_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_add_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_addi(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_addi_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
-    }
+    tcg_gen_addi_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
 }
 
 static void translate_addx(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_shli_i32(tmp, cpu_R[arg[1]], par[0]);
-        tcg_gen_add_i32(cpu_R[arg[0]], tmp, cpu_R[arg[2]]);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_shli_i32(tmp, cpu_R[arg[1]], par[0]);
+    tcg_gen_add_i32(cpu_R[arg[0]], tmp, cpu_R[arg[2]]);
+    tcg_temp_free(tmp);
 }
 
 static void translate_all(DisasContext *dc, const uint32_t arg[],
@@ -1357,93 +1383,77 @@ static void translate_all(DisasContext *dc, const uint32_t arg[],
 static void translate_and(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_and_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_and_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_ball(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_and_i32(tmp, cpu_R[arg[0]], cpu_R[arg[1]]);
-        gen_brcond(dc, par[0], tmp, cpu_R[arg[1]], arg[2]);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_and_i32(tmp, cpu_R[arg[0]], cpu_R[arg[1]]);
+    gen_brcond(dc, par[0], tmp, cpu_R[arg[1]], arg[2]);
+    tcg_temp_free(tmp);
 }
 
 static void translate_bany(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_and_i32(tmp, cpu_R[arg[0]], cpu_R[arg[1]]);
-        gen_brcondi(dc, par[0], tmp, 0, arg[2]);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_and_i32(tmp, cpu_R[arg[0]], cpu_R[arg[1]]);
+    gen_brcondi(dc, par[0], tmp, 0, arg[2]);
+    tcg_temp_free(tmp);
 }
 
 static void translate_b(DisasContext *dc, const uint32_t arg[],
                         const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        gen_brcond(dc, par[0], cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
-    }
+    gen_brcond(dc, par[0], cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
 }
 
 static void translate_bb(DisasContext *dc, const uint32_t arg[],
                          const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
 #ifdef TARGET_WORDS_BIGENDIAN
-        TCGv_i32 bit = tcg_const_i32(0x80000000u);
+    TCGv_i32 bit = tcg_const_i32(0x80000000u);
 #else
-        TCGv_i32 bit = tcg_const_i32(0x00000001u);
+    TCGv_i32 bit = tcg_const_i32(0x00000001u);
 #endif
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_andi_i32(tmp, cpu_R[arg[1]], 0x1f);
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_andi_i32(tmp, cpu_R[arg[1]], 0x1f);
 #ifdef TARGET_WORDS_BIGENDIAN
-        tcg_gen_shr_i32(bit, bit, tmp);
+    tcg_gen_shr_i32(bit, bit, tmp);
 #else
-        tcg_gen_shl_i32(bit, bit, tmp);
+    tcg_gen_shl_i32(bit, bit, tmp);
 #endif
-        tcg_gen_and_i32(tmp, cpu_R[arg[0]], bit);
-        gen_brcondi(dc, par[0], tmp, 0, arg[2]);
-        tcg_temp_free(tmp);
-        tcg_temp_free(bit);
-    }
+    tcg_gen_and_i32(tmp, cpu_R[arg[0]], bit);
+    gen_brcondi(dc, par[0], tmp, 0, arg[2]);
+    tcg_temp_free(tmp);
+    tcg_temp_free(bit);
 }
 
 static void translate_bbi(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
+    TCGv_i32 tmp = tcg_temp_new_i32();
 #ifdef TARGET_WORDS_BIGENDIAN
-        tcg_gen_andi_i32(tmp, cpu_R[arg[0]], 0x80000000u >> arg[1]);
+    tcg_gen_andi_i32(tmp, cpu_R[arg[0]], 0x80000000u >> arg[1]);
 #else
-        tcg_gen_andi_i32(tmp, cpu_R[arg[0]], 0x00000001u << arg[1]);
+    tcg_gen_andi_i32(tmp, cpu_R[arg[0]], 0x00000001u << arg[1]);
 #endif
-        gen_brcondi(dc, par[0], tmp, 0, arg[2]);
-        tcg_temp_free(tmp);
-    }
+    gen_brcondi(dc, par[0], tmp, 0, arg[2]);
+    tcg_temp_free(tmp);
 }
 
 static void translate_bi(DisasContext *dc, const uint32_t arg[],
                          const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        gen_brcondi(dc, par[0], cpu_R[arg[0]], arg[1], arg[2]);
-    }
+    gen_brcondi(dc, par[0], cpu_R[arg[0]], arg[1], arg[2]);
 }
 
 static void translate_bz(DisasContext *dc, const uint32_t arg[],
                          const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        gen_brcondi(dc, par[0], cpu_R[arg[0]], 0, arg[1]);
-    }
+    gen_brcondi(dc, par[0], cpu_R[arg[0]], 0, arg[1]);
 }
 
 enum {
@@ -1486,14 +1496,6 @@ static void translate_bp(DisasContext *dc, const uint32_t arg[],
     tcg_temp_free(tmp);
 }
 
-static void translate_break(DisasContext *dc, const uint32_t arg[],
-                            const uint32_t par[])
-{
-    if (dc->debug) {
-        gen_debug_exception(dc, par[0]);
-    }
-}
-
 static void translate_call0(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
@@ -1501,50 +1503,48 @@ static void translate_call0(DisasContext *dc, const uint32_t arg[],
     gen_jumpi(dc, arg[0], 0);
 }
 
+static uint32_t test_overflow_callw(DisasContext *dc, const uint32_t arg[],
+                                    const uint32_t par[])
+{
+    return 1 << (par[0] * 4);
+}
+
 static void translate_callw(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check1(dc, par[0] << 2)) {
-        gen_callwi(dc, par[0], arg[0], 0);
-    }
+    gen_callwi(dc, par[0], arg[0], 0);
 }
 
 static void translate_callx0(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
-        tcg_gen_movi_i32(cpu_R[0], dc->base.pc_next);
-        gen_jump(dc, tmp);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
+    tcg_gen_movi_i32(cpu_R[0], dc->base.pc_next);
+    gen_jump(dc, tmp);
+    tcg_temp_free(tmp);
 }
 
 static void translate_callxw(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], par[0] << 2)) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-        tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
-        gen_callw(dc, par[0], tmp);
-        tcg_temp_free(tmp);
-    }
+    tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
+    gen_callw(dc, par[0], tmp);
+    tcg_temp_free(tmp);
 }
 
 static void translate_clamps(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 tmp1 = tcg_const_i32(-1u << arg[2]);
-        TCGv_i32 tmp2 = tcg_const_i32((1 << arg[2]) - 1);
+    TCGv_i32 tmp1 = tcg_const_i32(-1u << arg[2]);
+    TCGv_i32 tmp2 = tcg_const_i32((1 << arg[2]) - 1);
 
-        tcg_gen_smax_i32(tmp1, tmp1, cpu_R[arg[1]]);
-        tcg_gen_smin_i32(cpu_R[arg[0]], tmp1, tmp2);
-        tcg_temp_free(tmp1);
-        tcg_temp_free(tmp2);
-    }
+    tcg_gen_smax_i32(tmp1, tmp1, cpu_R[arg[1]]);
+    tcg_gen_smin_i32(cpu_R[arg[0]], tmp1, tmp2);
+    tcg_temp_free(tmp1);
+    tcg_temp_free(tmp2);
 }
 
 static void translate_clrb_expstate(DisasContext *dc, const uint32_t arg[],
@@ -1557,39 +1557,49 @@ static void translate_clrb_expstate(DisasContext *dc, const uint32_t arg[],
 static void translate_const16(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        TCGv_i32 c = tcg_const_i32(arg[1]);
+    TCGv_i32 c = tcg_const_i32(arg[1]);
 
-        tcg_gen_deposit_i32(cpu_R[arg[0]], c, cpu_R[arg[0]], 16, 16);
-        tcg_temp_free(c);
-    }
+    tcg_gen_deposit_i32(cpu_R[arg[0]], c, cpu_R[arg[0]], 16, 16);
+    tcg_temp_free(c);
 }
 
-/* par[0]: privileged, par[1]: check memory access */
 static void translate_dcache(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if ((!par[0] || gen_check_privilege(dc)) &&
-        gen_window_check1(dc, arg[0]) && par[1]) {
-        TCGv_i32 addr = tcg_temp_new_i32();
-        TCGv_i32 res = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 res = tcg_temp_new_i32();
 
-        tcg_gen_addi_i32(addr, cpu_R[arg[0]], arg[1]);
-        tcg_gen_qemu_ld8u(res, addr, dc->cring);
-        tcg_temp_free(addr);
-        tcg_temp_free(res);
-    }
+    tcg_gen_addi_i32(addr, cpu_R[arg[0]], arg[1]);
+    tcg_gen_qemu_ld8u(res, addr, dc->cring);
+    tcg_temp_free(addr);
+    tcg_temp_free(res);
 }
 
 static void translate_depbits(DisasContext *dc, const uint32_t arg[],
                               const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_deposit_i32(cpu_R[arg[1]], cpu_R[arg[1]], cpu_R[arg[0]],
-                            arg[2], arg[3]);
+    tcg_gen_deposit_i32(cpu_R[arg[1]], cpu_R[arg[1]], cpu_R[arg[0]],
+                        arg[2], arg[3]);
+}
+
+static bool test_ill_entry(DisasContext *dc, const uint32_t arg[],
+                           const uint32_t par[])
+{
+    if (arg[0] > 3 || !dc->cwoe) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Illegal entry instruction(pc = %08x)\n", dc->pc);
+        return true;
+    } else {
+        return false;
     }
 }
 
+static uint32_t test_overflow_entry(DisasContext *dc, const uint32_t arg[],
+                                    const uint32_t par[])
+{
+    return 1 << (dc->callinc * 4);
+}
+
 static void translate_entry(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
@@ -1600,60 +1610,41 @@ static void translate_entry(DisasContext *dc, const uint32_t arg[],
     tcg_temp_free(imm);
     tcg_temp_free(s);
     tcg_temp_free(pc);
-    /* This can change tb->flags, so exit tb */
-    gen_jumpi_check_loop_end(dc, -1);
 }
 
 static void translate_extui(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        int maskimm = (1 << arg[3]) - 1;
+    int maskimm = (1 << arg[3]) - 1;
 
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_shri_i32(tmp, cpu_R[arg[1]], arg[2]);
-        tcg_gen_andi_i32(cpu_R[arg[0]], tmp, maskimm);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_shri_i32(tmp, cpu_R[arg[1]], arg[2]);
+    tcg_gen_andi_i32(cpu_R[arg[0]], tmp, maskimm);
+    tcg_temp_free(tmp);
 }
 
-/* par[0]: privileged, par[1]: check memory access */
 static void translate_icache(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if ((!par[0] || gen_check_privilege(dc)) &&
-        gen_window_check1(dc, arg[0]) && par[1]) {
 #ifndef CONFIG_USER_ONLY
-        TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
 
-        tcg_gen_movi_i32(cpu_pc, dc->pc);
-        tcg_gen_addi_i32(addr, cpu_R[arg[0]], arg[1]);
-        gen_helper_itlb_hit_test(cpu_env, addr);
-        tcg_temp_free(addr);
+    tcg_gen_movi_i32(cpu_pc, dc->pc);
+    tcg_gen_addi_i32(addr, cpu_R[arg[0]], arg[1]);
+    gen_helper_itlb_hit_test(cpu_env, addr);
+    tcg_temp_free(addr);
 #endif
-    }
 }
 
 static void translate_itlb(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check1(dc, arg[0])) {
 #ifndef CONFIG_USER_ONLY
-        TCGv_i32 dtlb = tcg_const_i32(par[0]);
+    TCGv_i32 dtlb = tcg_const_i32(par[0]);
 
-        gen_helper_itlb(cpu_env, cpu_R[arg[0]], dtlb);
-        /* This could change memory mapping, so exit tb */
-        gen_jumpi_check_loop_end(dc, -1);
-        tcg_temp_free(dtlb);
+    gen_helper_itlb(cpu_env, cpu_R[arg[0]], dtlb);
+    tcg_temp_free(dtlb);
 #endif
-    }
-}
-
-static void translate_ill(DisasContext *dc, const uint32_t arg[],
-                          const uint32_t par[])
-{
-    gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE);
 }
 
 static void translate_j(DisasContext *dc, const uint32_t arg[],
@@ -1665,88 +1656,77 @@ static void translate_j(DisasContext *dc, const uint32_t arg[],
 static void translate_jx(DisasContext *dc, const uint32_t arg[],
                          const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        gen_jump(dc, cpu_R[arg[0]]);
-    }
+    gen_jump(dc, cpu_R[arg[0]]);
 }
 
 static void translate_l32e(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
 
-        tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
-        gen_load_store_alignment(dc, 2, addr, false);
-        tcg_gen_qemu_ld_tl(cpu_R[arg[0]], addr, dc->ring, MO_TEUL);
-        tcg_temp_free(addr);
-    }
+    tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
+    gen_load_store_alignment(dc, 2, addr, false);
+    tcg_gen_qemu_ld_tl(cpu_R[arg[0]], addr, dc->ring, MO_TEUL);
+    tcg_temp_free(addr);
 }
 
 static void translate_ldst(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
 
-        tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
-        if (par[0] & MO_SIZE) {
-            gen_load_store_alignment(dc, par[0] & MO_SIZE, addr, par[1]);
+    tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
+    if (par[0] & MO_SIZE) {
+        gen_load_store_alignment(dc, par[0] & MO_SIZE, addr, par[1]);
+    }
+    if (par[2]) {
+        if (par[1]) {
+            tcg_gen_mb(TCG_BAR_STRL | TCG_MO_ALL);
         }
-        if (par[2]) {
-            if (par[1]) {
-                tcg_gen_mb(TCG_BAR_STRL | TCG_MO_ALL);
-            }
-            tcg_gen_qemu_st_tl(cpu_R[arg[0]], addr, dc->cring, par[0]);
-        } else {
-            tcg_gen_qemu_ld_tl(cpu_R[arg[0]], addr, dc->cring, par[0]);
-            if (par[1]) {
-                tcg_gen_mb(TCG_BAR_LDAQ | TCG_MO_ALL);
-            }
+        tcg_gen_qemu_st_tl(cpu_R[arg[0]], addr, dc->cring, par[0]);
+    } else {
+        tcg_gen_qemu_ld_tl(cpu_R[arg[0]], addr, dc->cring, par[0]);
+        if (par[1]) {
+            tcg_gen_mb(TCG_BAR_LDAQ | TCG_MO_ALL);
         }
-        tcg_temp_free(addr);
     }
+    tcg_temp_free(addr);
 }
 
 static void translate_l32r(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        TCGv_i32 tmp;
+    TCGv_i32 tmp;
 
-        if (dc->base.tb->flags & XTENSA_TBFLAG_LITBASE) {
-            tmp = tcg_const_i32(dc->raw_arg[1] - 1);
-            tcg_gen_add_i32(tmp, cpu_SR[LITBASE], tmp);
-        } else {
-            tmp = tcg_const_i32(arg[1]);
-        }
-        tcg_gen_qemu_ld32u(cpu_R[arg[0]], tmp, dc->cring);
-        tcg_temp_free(tmp);
+    if (dc->base.tb->flags & XTENSA_TBFLAG_LITBASE) {
+        tmp = tcg_const_i32(dc->raw_arg[1] - 1);
+        tcg_gen_add_i32(tmp, cpu_SR[LITBASE], tmp);
+    } else {
+        tmp = tcg_const_i32(arg[1]);
     }
+    tcg_gen_qemu_ld32u(cpu_R[arg[0]], tmp, dc->cring);
+    tcg_temp_free(tmp);
 }
 
 static void translate_loop(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        uint32_t lend = arg[1];
-        TCGv_i32 tmp = tcg_const_i32(lend);
-
-        tcg_gen_subi_i32(cpu_SR[LCOUNT], cpu_R[arg[0]], 1);
-        tcg_gen_movi_i32(cpu_SR[LBEG], dc->base.pc_next);
-        gen_helper_wsr_lend(cpu_env, tmp);
-        tcg_temp_free(tmp);
+    uint32_t lend = arg[1];
+    TCGv_i32 tmp = tcg_const_i32(lend);
 
-        if (par[0] != TCG_COND_NEVER) {
-            TCGLabel *label = gen_new_label();
-            tcg_gen_brcondi_i32(par[0], cpu_R[arg[0]], 0, label);
-            gen_jumpi(dc, lend, 1);
-            gen_set_label(label);
-        }
+    tcg_gen_subi_i32(cpu_SR[LCOUNT], cpu_R[arg[0]], 1);
+    tcg_gen_movi_i32(cpu_SR[LBEG], dc->base.pc_next);
+    gen_helper_wsr_lend(cpu_env, tmp);
+    tcg_temp_free(tmp);
 
-        gen_jumpi(dc, dc->base.pc_next, 0);
+    if (par[0] != TCG_COND_NEVER) {
+        TCGLabel *label = gen_new_label();
+        tcg_gen_brcondi_i32(par[0], cpu_R[arg[0]], 0, label);
+        gen_jumpi(dc, lend, 1);
+        gen_set_label(label);
     }
+
+    gen_jumpi(dc, dc->base.pc_next, 0);
 }
 
 enum {
@@ -1786,78 +1766,60 @@ static void translate_mac16(DisasContext *dc, const uint32_t arg[],
     unsigned half = par[2];
     uint32_t ld_offset = par[3];
     unsigned off = ld_offset ? 2 : 0;
-    uint32_t ar[3] = {0};
-    unsigned n_ar = 0;
-
-    if (op != MAC16_NONE) {
-        if (!is_m1_sr) {
-            ar[n_ar++] = arg[off];
-        }
-        if (!is_m2_sr) {
-            ar[n_ar++] = arg[off + 1];
-        }
-    }
+    TCGv_i32 vaddr = tcg_temp_new_i32();
+    TCGv_i32 mem32 = tcg_temp_new_i32();
 
     if (ld_offset) {
-        ar[n_ar++] = arg[1];
+        tcg_gen_addi_i32(vaddr, cpu_R[arg[1]], ld_offset);
+        gen_load_store_alignment(dc, 2, vaddr, false);
+        tcg_gen_qemu_ld32u(mem32, vaddr, dc->cring);
     }
-
-    if (gen_window_check3(dc, ar[0], ar[1], ar[2])) {
-        TCGv_i32 vaddr = tcg_temp_new_i32();
-        TCGv_i32 mem32 = tcg_temp_new_i32();
-
-        if (ld_offset) {
-            tcg_gen_addi_i32(vaddr, cpu_R[arg[1]], ld_offset);
-            gen_load_store_alignment(dc, 2, vaddr, false);
-            tcg_gen_qemu_ld32u(mem32, vaddr, dc->cring);
-        }
-        if (op != MAC16_NONE) {
-            TCGv_i32 m1 = gen_mac16_m(is_m1_sr ?
-                                      cpu_SR[MR + arg[off]] :
-                                      cpu_R[arg[off]],
-                                      half & MAC16_HX, op == MAC16_UMUL);
-            TCGv_i32 m2 = gen_mac16_m(is_m2_sr ?
-                                      cpu_SR[MR + arg[off + 1]] :
-                                      cpu_R[arg[off + 1]],
-                                      half & MAC16_XH, op == MAC16_UMUL);
-
-            if (op == MAC16_MUL || op == MAC16_UMUL) {
-                tcg_gen_mul_i32(cpu_SR[ACCLO], m1, m2);
-                if (op == MAC16_UMUL) {
-                    tcg_gen_movi_i32(cpu_SR[ACCHI], 0);
-                } else {
-                    tcg_gen_sari_i32(cpu_SR[ACCHI], cpu_SR[ACCLO], 31);
-                }
+    if (op != MAC16_NONE) {
+        TCGv_i32 m1 = gen_mac16_m(is_m1_sr ?
+                                  cpu_SR[MR + arg[off]] :
+                                  cpu_R[arg[off]],
+                                  half & MAC16_HX, op == MAC16_UMUL);
+        TCGv_i32 m2 = gen_mac16_m(is_m2_sr ?
+                                  cpu_SR[MR + arg[off + 1]] :
+                                  cpu_R[arg[off + 1]],
+                                  half & MAC16_XH, op == MAC16_UMUL);
+
+        if (op == MAC16_MUL || op == MAC16_UMUL) {
+            tcg_gen_mul_i32(cpu_SR[ACCLO], m1, m2);
+            if (op == MAC16_UMUL) {
+                tcg_gen_movi_i32(cpu_SR[ACCHI], 0);
             } else {
-                TCGv_i32 lo = tcg_temp_new_i32();
-                TCGv_i32 hi = tcg_temp_new_i32();
-
-                tcg_gen_mul_i32(lo, m1, m2);
-                tcg_gen_sari_i32(hi, lo, 31);
-                if (op == MAC16_MULA) {
-                    tcg_gen_add2_i32(cpu_SR[ACCLO], cpu_SR[ACCHI],
-                                     cpu_SR[ACCLO], cpu_SR[ACCHI],
-                                     lo, hi);
-                } else {
-                    tcg_gen_sub2_i32(cpu_SR[ACCLO], cpu_SR[ACCHI],
-                                     cpu_SR[ACCLO], cpu_SR[ACCHI],
-                                     lo, hi);
-                }
-                tcg_gen_ext8s_i32(cpu_SR[ACCHI], cpu_SR[ACCHI]);
-
-                tcg_temp_free_i32(lo);
-                tcg_temp_free_i32(hi);
+                tcg_gen_sari_i32(cpu_SR[ACCHI], cpu_SR[ACCLO], 31);
             }
-            tcg_temp_free(m1);
-            tcg_temp_free(m2);
-        }
-        if (ld_offset) {
-            tcg_gen_mov_i32(cpu_R[arg[1]], vaddr);
-            tcg_gen_mov_i32(cpu_SR[MR + arg[0]], mem32);
+        } else {
+            TCGv_i32 lo = tcg_temp_new_i32();
+            TCGv_i32 hi = tcg_temp_new_i32();
+
+            tcg_gen_mul_i32(lo, m1, m2);
+            tcg_gen_sari_i32(hi, lo, 31);
+            if (op == MAC16_MULA) {
+                tcg_gen_add2_i32(cpu_SR[ACCLO], cpu_SR[ACCHI],
+                                 cpu_SR[ACCLO], cpu_SR[ACCHI],
+                                 lo, hi);
+            } else {
+                tcg_gen_sub2_i32(cpu_SR[ACCLO], cpu_SR[ACCHI],
+                                 cpu_SR[ACCLO], cpu_SR[ACCHI],
+                                 lo, hi);
+            }
+            tcg_gen_ext8s_i32(cpu_SR[ACCHI], cpu_SR[ACCHI]);
+
+            tcg_temp_free_i32(lo);
+            tcg_temp_free_i32(hi);
         }
-        tcg_temp_free(vaddr);
-        tcg_temp_free(mem32);
+        tcg_temp_free(m1);
+        tcg_temp_free(m2);
     }
+    if (ld_offset) {
+        tcg_gen_mov_i32(cpu_R[arg[1]], vaddr);
+        tcg_gen_mov_i32(cpu_SR[MR + arg[0]], mem32);
+    }
+    tcg_temp_free(vaddr);
+    tcg_temp_free(mem32);
 }
 
 static void translate_memw(DisasContext *dc, const uint32_t arg[],
@@ -1869,139 +1831,110 @@ static void translate_memw(DisasContext *dc, const uint32_t arg[],
 static void translate_smin(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_smin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_smin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_umin(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_umin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_umin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_smax(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_smax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_smax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_umax(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_umax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_umax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_mov(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_mov_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
-    }
+    tcg_gen_mov_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
 }
 
 static void translate_movcond(DisasContext *dc, const uint32_t arg[],
                               const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGv_i32 zero = tcg_const_i32(0);
+    TCGv_i32 zero = tcg_const_i32(0);
 
-        tcg_gen_movcond_i32(par[0], cpu_R[arg[0]],
-                            cpu_R[arg[2]], zero, cpu_R[arg[1]], cpu_R[arg[0]]);
-        tcg_temp_free(zero);
-    }
+    tcg_gen_movcond_i32(par[0], cpu_R[arg[0]],
+                        cpu_R[arg[2]], zero, cpu_R[arg[1]], cpu_R[arg[0]]);
+    tcg_temp_free(zero);
 }
 
 static void translate_movi(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        tcg_gen_movi_i32(cpu_R[arg[0]], arg[1]);
-    }
+    tcg_gen_movi_i32(cpu_R[arg[0]], arg[1]);
 }
 
 static void translate_movp(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 zero = tcg_const_i32(0);
-        TCGv_i32 tmp = tcg_temp_new_i32();
+    TCGv_i32 zero = tcg_const_i32(0);
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-        tcg_gen_andi_i32(tmp, cpu_SR[BR], 1 << arg[2]);
-        tcg_gen_movcond_i32(par[0],
-                            cpu_R[arg[0]], tmp, zero,
-                            cpu_R[arg[1]], cpu_R[arg[0]]);
-        tcg_temp_free(tmp);
-        tcg_temp_free(zero);
-    }
+    tcg_gen_andi_i32(tmp, cpu_SR[BR], 1 << arg[2]);
+    tcg_gen_movcond_i32(par[0],
+                        cpu_R[arg[0]], tmp, zero,
+                        cpu_R[arg[1]], cpu_R[arg[0]]);
+    tcg_temp_free(tmp);
+    tcg_temp_free(zero);
 }
 
 static void translate_movsp(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 pc = tcg_const_i32(dc->pc);
-        gen_helper_movsp(cpu_env, pc);
-        tcg_gen_mov_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
-        tcg_temp_free(pc);
-    }
+    tcg_gen_mov_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
 }
 
 static void translate_mul16(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGv_i32 v1 = tcg_temp_new_i32();
-        TCGv_i32 v2 = tcg_temp_new_i32();
+    TCGv_i32 v1 = tcg_temp_new_i32();
+    TCGv_i32 v2 = tcg_temp_new_i32();
 
-        if (par[0]) {
-            tcg_gen_ext16s_i32(v1, cpu_R[arg[1]]);
-            tcg_gen_ext16s_i32(v2, cpu_R[arg[2]]);
-        } else {
-            tcg_gen_ext16u_i32(v1, cpu_R[arg[1]]);
-            tcg_gen_ext16u_i32(v2, cpu_R[arg[2]]);
-        }
-        tcg_gen_mul_i32(cpu_R[arg[0]], v1, v2);
-        tcg_temp_free(v2);
-        tcg_temp_free(v1);
+    if (par[0]) {
+        tcg_gen_ext16s_i32(v1, cpu_R[arg[1]]);
+        tcg_gen_ext16s_i32(v2, cpu_R[arg[2]]);
+    } else {
+        tcg_gen_ext16u_i32(v1, cpu_R[arg[1]]);
+        tcg_gen_ext16u_i32(v2, cpu_R[arg[2]]);
     }
+    tcg_gen_mul_i32(cpu_R[arg[0]], v1, v2);
+    tcg_temp_free(v2);
+    tcg_temp_free(v1);
 }
 
 static void translate_mull(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_mul_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_mul_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_mulh(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGv_i32 lo = tcg_temp_new();
+    TCGv_i32 lo = tcg_temp_new();
 
-        if (par[0]) {
-            tcg_gen_muls2_i32(lo, cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-        } else {
-            tcg_gen_mulu2_i32(lo, cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-        }
-        tcg_temp_free(lo);
+    if (par[0]) {
+        tcg_gen_muls2_i32(lo, cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
+    } else {
+        tcg_gen_mulu2_i32(lo, cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
     }
+    tcg_temp_free(lo);
 }
 
 static void translate_neg(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_neg_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
-    }
+    tcg_gen_neg_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
 }
 
 static void translate_nop(DisasContext *dc, const uint32_t arg[],
@@ -2012,110 +1945,82 @@ static void translate_nop(DisasContext *dc, const uint32_t arg[],
 static void translate_nsa(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_clrsb_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
-    }
+    tcg_gen_clrsb_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
 }
 
 static void translate_nsau(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_clzi_i32(cpu_R[arg[0]], cpu_R[arg[1]], 32);
-    }
+    tcg_gen_clzi_i32(cpu_R[arg[0]], cpu_R[arg[1]], 32);
 }
 
 static void translate_or(DisasContext *dc, const uint32_t arg[],
                          const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_or_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_or_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_ptlb(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
 #ifndef CONFIG_USER_ONLY
-        TCGv_i32 dtlb = tcg_const_i32(par[0]);
+    TCGv_i32 dtlb = tcg_const_i32(par[0]);
 
-        tcg_gen_movi_i32(cpu_pc, dc->pc);
-        gen_helper_ptlb(cpu_R[arg[0]], cpu_env, cpu_R[arg[1]], dtlb);
-        tcg_temp_free(dtlb);
+    tcg_gen_movi_i32(cpu_pc, dc->pc);
+    gen_helper_ptlb(cpu_R[arg[0]], cpu_env, cpu_R[arg[1]], dtlb);
+    tcg_temp_free(dtlb);
 #endif
-    }
-}
-
-static void gen_zero_check(DisasContext *dc, const uint32_t arg[])
-{
-    TCGLabel *label = gen_new_label();
-
-    tcg_gen_brcondi_i32(TCG_COND_NE, cpu_R[arg[2]], 0, label);
-    gen_exception_cause(dc, INTEGER_DIVIDE_BY_ZERO_CAUSE);
-    gen_set_label(label);
 }
 
 static void translate_quos(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGLabel *label1 = gen_new_label();
-        TCGLabel *label2 = gen_new_label();
-
-        gen_zero_check(dc, arg);
-
-        tcg_gen_brcondi_i32(TCG_COND_NE, cpu_R[arg[1]], 0x80000000,
-                            label1);
-        tcg_gen_brcondi_i32(TCG_COND_NE, cpu_R[arg[2]], 0xffffffff,
-                            label1);
-        tcg_gen_movi_i32(cpu_R[arg[0]],
-                         par[0] ? 0x80000000 : 0);
-        tcg_gen_br(label2);
-        gen_set_label(label1);
-        if (par[0]) {
-            tcg_gen_div_i32(cpu_R[arg[0]],
-                            cpu_R[arg[1]], cpu_R[arg[2]]);
-        } else {
-            tcg_gen_rem_i32(cpu_R[arg[0]],
-                            cpu_R[arg[1]], cpu_R[arg[2]]);
-        }
-        gen_set_label(label2);
+    TCGLabel *label1 = gen_new_label();
+    TCGLabel *label2 = gen_new_label();
+
+    tcg_gen_brcondi_i32(TCG_COND_NE, cpu_R[arg[1]], 0x80000000,
+                        label1);
+    tcg_gen_brcondi_i32(TCG_COND_NE, cpu_R[arg[2]], 0xffffffff,
+                        label1);
+    tcg_gen_movi_i32(cpu_R[arg[0]],
+                     par[0] ? 0x80000000 : 0);
+    tcg_gen_br(label2);
+    gen_set_label(label1);
+    if (par[0]) {
+        tcg_gen_div_i32(cpu_R[arg[0]],
+                        cpu_R[arg[1]], cpu_R[arg[2]]);
+    } else {
+        tcg_gen_rem_i32(cpu_R[arg[0]],
+                        cpu_R[arg[1]], cpu_R[arg[2]]);
     }
+    gen_set_label(label2);
 }
 
 static void translate_quou(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        gen_zero_check(dc, arg);
-        if (par[0]) {
-            tcg_gen_divu_i32(cpu_R[arg[0]],
-                             cpu_R[arg[1]], cpu_R[arg[2]]);
-        } else {
-            tcg_gen_remu_i32(cpu_R[arg[0]],
-                             cpu_R[arg[1]], cpu_R[arg[2]]);
-        }
-    }
+    tcg_gen_divu_i32(cpu_R[arg[0]],
+                     cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_read_impwire(DisasContext *dc, const uint32_t arg[],
                                    const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        /* TODO: GPIO32 may be a part of coprocessor */
-        tcg_gen_movi_i32(cpu_R[arg[0]], 0);
-    }
+    /* TODO: GPIO32 may be a part of coprocessor */
+    tcg_gen_movi_i32(cpu_R[arg[0]], 0);
+}
+
+static void translate_remu(DisasContext *dc, const uint32_t arg[],
+                           const uint32_t par[])
+{
+    tcg_gen_remu_i32(cpu_R[arg[0]],
+                     cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_rer(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
-        gen_helper_rer(cpu_R[arg[0]], cpu_env, cpu_R[arg[1]]);
-    }
+    gen_helper_rer(cpu_R[arg[0]], cpu_env, cpu_R[arg[1]]);
 }
 
 static void translate_ret(DisasContext *dc, const uint32_t arg[],
@@ -2124,6 +2029,22 @@ static void translate_ret(DisasContext *dc, const uint32_t arg[],
     gen_jump(dc, cpu_R[0]);
 }
 
+static bool test_ill_retw(DisasContext *dc, const uint32_t arg[],
+                          const uint32_t par[])
+{
+    if (!dc->cwoe) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Illegal retw instruction(pc = %08x)\n", dc->pc);
+        return true;
+    } else {
+        TCGv_i32 tmp = tcg_const_i32(dc->pc);
+
+        gen_helper_test_ill_retw(cpu_env, tmp);
+        tcg_temp_free(tmp);
+        return false;
+    }
+}
+
 static void translate_retw(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
@@ -2136,122 +2057,95 @@ static void translate_retw(DisasContext *dc, const uint32_t arg[],
 static void translate_rfde(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc)) {
-        gen_jump(dc, cpu_SR[dc->config->ndepc ? DEPC : EPC1]);
-    }
+    gen_jump(dc, cpu_SR[dc->config->ndepc ? DEPC : EPC1]);
 }
 
 static void translate_rfe(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_privilege(dc)) {
-        tcg_gen_andi_i32(cpu_SR[PS], cpu_SR[PS], ~PS_EXCM);
-        gen_check_interrupts(dc);
-        gen_jump(dc, cpu_SR[EPC1]);
-    }
+    tcg_gen_andi_i32(cpu_SR[PS], cpu_SR[PS], ~PS_EXCM);
+    gen_jump(dc, cpu_SR[EPC1]);
 }
 
 static void translate_rfi(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_privilege(dc)) {
-        tcg_gen_mov_i32(cpu_SR[PS], cpu_SR[EPS2 + arg[0] - 2]);
-        gen_check_interrupts(dc);
-        gen_jump(dc, cpu_SR[EPC1 + arg[0] - 1]);
-    }
+    tcg_gen_mov_i32(cpu_SR[PS], cpu_SR[EPS2 + arg[0] - 2]);
+    gen_jump(dc, cpu_SR[EPC1 + arg[0] - 1]);
 }
 
 static void translate_rfw(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_privilege(dc)) {
-        TCGv_i32 tmp = tcg_const_i32(1);
-
-        tcg_gen_andi_i32(cpu_SR[PS], cpu_SR[PS], ~PS_EXCM);
-        tcg_gen_shl_i32(tmp, tmp, cpu_SR[WINDOW_BASE]);
-
-        if (par[0]) {
-            tcg_gen_andc_i32(cpu_SR[WINDOW_START],
-                             cpu_SR[WINDOW_START], tmp);
-        } else {
-            tcg_gen_or_i32(cpu_SR[WINDOW_START],
-                           cpu_SR[WINDOW_START], tmp);
-        }
+    TCGv_i32 tmp = tcg_const_i32(1);
 
-        gen_helper_restore_owb(cpu_env);
-        gen_check_interrupts(dc);
-        gen_jump(dc, cpu_SR[EPC1]);
+    tcg_gen_andi_i32(cpu_SR[PS], cpu_SR[PS], ~PS_EXCM);
+    tcg_gen_shl_i32(tmp, tmp, cpu_SR[WINDOW_BASE]);
 
-        tcg_temp_free(tmp);
+    if (par[0]) {
+        tcg_gen_andc_i32(cpu_SR[WINDOW_START],
+                         cpu_SR[WINDOW_START], tmp);
+    } else {
+        tcg_gen_or_i32(cpu_SR[WINDOW_START],
+                       cpu_SR[WINDOW_START], tmp);
     }
+
+    tcg_temp_free(tmp);
+    gen_helper_restore_owb(cpu_env);
+    gen_jump(dc, cpu_SR[EPC1]);
 }
 
 static void translate_rotw(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc)) {
-        TCGv_i32 tmp = tcg_const_i32(arg[0]);
-        gen_helper_rotw(cpu_env, tmp);
-        tcg_temp_free(tmp);
-        /* This can change tb->flags, so exit tb */
-        gen_jumpi_check_loop_end(dc, -1);
-    }
+    TCGv_i32 tmp = tcg_const_i32(arg[0]);
+    gen_helper_rotw(cpu_env, tmp);
+    tcg_temp_free(tmp);
 }
 
 static void translate_rsil(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check1(dc, arg[0])) {
-        tcg_gen_mov_i32(cpu_R[arg[0]], cpu_SR[PS]);
-        tcg_gen_andi_i32(cpu_SR[PS], cpu_SR[PS], ~PS_INTLEVEL);
-        tcg_gen_ori_i32(cpu_SR[PS], cpu_SR[PS], arg[1]);
-        gen_check_interrupts(dc);
-        gen_jumpi_check_loop_end(dc, 0);
-    }
+    tcg_gen_mov_i32(cpu_R[arg[0]], cpu_SR[PS]);
+    tcg_gen_andi_i32(cpu_SR[PS], cpu_SR[PS], ~PS_INTLEVEL);
+    tcg_gen_ori_i32(cpu_SR[PS], cpu_SR[PS], arg[1]);
+}
+
+static bool test_ill_rsr(DisasContext *dc, const uint32_t arg[],
+                         const uint32_t par[])
+{
+    return !check_sr(dc, par[0], SR_R);
 }
 
 static void translate_rsr(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_sr(dc, par[0], SR_R) &&
-        (par[0] < 64 || gen_check_privilege(dc)) &&
-        gen_window_check1(dc, arg[0])) {
-        if (gen_rsr(dc, cpu_R[arg[0]], par[0])) {
-            gen_jumpi_check_loop_end(dc, 0);
-        }
-    }
+    gen_rsr(dc, cpu_R[arg[0]], par[0]);
 }
 
 static void translate_rtlb(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
+#ifndef CONFIG_USER_ONLY
     static void (* const helper[])(TCGv_i32 r, TCGv_env env, TCGv_i32 a1,
                                    TCGv_i32 a2) = {
-#ifndef CONFIG_USER_ONLY
         gen_helper_rtlb0,
         gen_helper_rtlb1,
-#endif
     };
+    TCGv_i32 dtlb = tcg_const_i32(par[0]);
 
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 dtlb = tcg_const_i32(par[0]);
-
-        helper[par[1]](cpu_R[arg[0]], cpu_env, cpu_R[arg[1]], dtlb);
-        tcg_temp_free(dtlb);
-    }
+    helper[par[1]](cpu_R[arg[0]], cpu_env, cpu_R[arg[1]], dtlb);
+    tcg_temp_free(dtlb);
+#endif
 }
 
 static void translate_rur(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        if (uregnames[par[0]].name) {
-            tcg_gen_mov_i32(cpu_R[arg[0]], cpu_UR[par[0]]);
-        } else {
-            qemu_log_mask(LOG_UNIMP, "RUR %d not implemented\n", par[0]);
-        }
+    if (uregnames[par[0]].name) {
+        tcg_gen_mov_i32(cpu_R[arg[0]], cpu_UR[par[0]]);
+    } else {
+        qemu_log_mask(LOG_UNIMP, "RUR %d not implemented\n", par[0]);
     }
 }
 
@@ -2279,78 +2173,75 @@ static void gen_check_atomctl(DisasContext *dc, TCGv_i32 addr)
 static void translate_s32c1i(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 tmp = tcg_temp_local_new_i32();
-        TCGv_i32 addr = tcg_temp_local_new_i32();
-
-        tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
-        tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
-        gen_load_store_alignment(dc, 2, addr, true);
-        gen_check_atomctl(dc, addr);
-        tcg_gen_atomic_cmpxchg_i32(cpu_R[arg[0]], addr, cpu_SR[SCOMPARE1],
-                                   tmp, dc->cring, MO_TEUL);
-        tcg_temp_free(addr);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_local_new_i32();
+    TCGv_i32 addr = tcg_temp_local_new_i32();
+
+    tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
+    tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
+    gen_load_store_alignment(dc, 2, addr, true);
+    gen_check_atomctl(dc, addr);
+    tcg_gen_atomic_cmpxchg_i32(cpu_R[arg[0]], addr, cpu_SR[SCOMPARE1],
+                               tmp, dc->cring, MO_TEUL);
+    tcg_temp_free(addr);
+    tcg_temp_free(tmp);
 }
 
 static void translate_s32e(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
-        TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
 
-        tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
-        gen_load_store_alignment(dc, 2, addr, false);
-        tcg_gen_qemu_st_tl(cpu_R[arg[0]], addr, dc->ring, MO_TEUL);
-        tcg_temp_free(addr);
-    }
+    tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
+    gen_load_store_alignment(dc, 2, addr, false);
+    tcg_gen_qemu_st_tl(cpu_R[arg[0]], addr, dc->ring, MO_TEUL);
+    tcg_temp_free(addr);
 }
 
 static void translate_salt(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_setcond_i32(par[0],
-                            cpu_R[arg[0]],
-                            cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_setcond_i32(par[0],
+                        cpu_R[arg[0]],
+                        cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_sext(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        int shift = 31 - arg[2];
+    int shift = 31 - arg[2];
 
-        if (shift == 24) {
-            tcg_gen_ext8s_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
-        } else if (shift == 16) {
-            tcg_gen_ext16s_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
-        } else {
-            TCGv_i32 tmp = tcg_temp_new_i32();
-            tcg_gen_shli_i32(tmp, cpu_R[arg[1]], shift);
-            tcg_gen_sari_i32(cpu_R[arg[0]], tmp, shift);
-            tcg_temp_free(tmp);
-        }
+    if (shift == 24) {
+        tcg_gen_ext8s_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
+    } else if (shift == 16) {
+        tcg_gen_ext16s_i32(cpu_R[arg[0]], cpu_R[arg[1]]);
+    } else {
+        TCGv_i32 tmp = tcg_temp_new_i32();
+        tcg_gen_shli_i32(tmp, cpu_R[arg[1]], shift);
+        tcg_gen_sari_i32(cpu_R[arg[0]], tmp, shift);
+        tcg_temp_free(tmp);
+    }
+}
+
+static bool test_ill_simcall(DisasContext *dc, const uint32_t arg[],
+                             const uint32_t par[])
+{
+#ifdef CONFIG_USER_ONLY
+    bool ill = true;
+#else
+    bool ill = !semihosting_enabled();
+#endif
+    if (ill) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SIMCALL but semihosting is disabled\n");
     }
+    return ill;
 }
 
 static void translate_simcall(DisasContext *dc, const uint32_t arg[],
                               const uint32_t par[])
 {
 #ifndef CONFIG_USER_ONLY
-    if (semihosting_enabled()) {
-        if (gen_check_privilege(dc)) {
-            gen_helper_simcall(cpu_env);
-        }
-    } else
+    gen_helper_simcall(cpu_env);
 #endif
-    {
-        qemu_log_mask(LOG_GUEST_ERROR, "SIMCALL but semihosting is disabled\n");
-        gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE);
-    }
 }
 
 /*
@@ -2371,76 +2262,64 @@ static void translate_simcall(DisasContext *dc, const uint32_t arg[],
 static void translate_sll(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        if (dc->sar_m32_5bit) {
-            tcg_gen_shl_i32(cpu_R[arg[0]], cpu_R[arg[1]], dc->sar_m32);
-        } else {
-            TCGv_i64 v = tcg_temp_new_i64();
-            TCGv_i32 s = tcg_const_i32(32);
-            tcg_gen_sub_i32(s, s, cpu_SR[SAR]);
-            tcg_gen_andi_i32(s, s, 0x3f);
-            tcg_gen_extu_i32_i64(v, cpu_R[arg[1]]);
-            gen_shift_reg(shl, s);
-            tcg_temp_free(s);
-        }
+    if (dc->sar_m32_5bit) {
+        tcg_gen_shl_i32(cpu_R[arg[0]], cpu_R[arg[1]], dc->sar_m32);
+    } else {
+        TCGv_i64 v = tcg_temp_new_i64();
+        TCGv_i32 s = tcg_const_i32(32);
+        tcg_gen_sub_i32(s, s, cpu_SR[SAR]);
+        tcg_gen_andi_i32(s, s, 0x3f);
+        tcg_gen_extu_i32_i64(v, cpu_R[arg[1]]);
+        gen_shift_reg(shl, s);
+        tcg_temp_free(s);
     }
 }
 
 static void translate_slli(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        if (arg[2] == 32) {
-            qemu_log_mask(LOG_GUEST_ERROR, "slli a%d, a%d, 32 is undefined\n",
-                          arg[0], arg[1]);
-        }
-        tcg_gen_shli_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2] & 0x1f);
+    if (arg[2] == 32) {
+        qemu_log_mask(LOG_GUEST_ERROR, "slli a%d, a%d, 32 is undefined\n",
+                      arg[0], arg[1]);
     }
+    tcg_gen_shli_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2] & 0x1f);
 }
 
 static void translate_sra(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        if (dc->sar_m32_5bit) {
-            tcg_gen_sar_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_SR[SAR]);
-        } else {
-            TCGv_i64 v = tcg_temp_new_i64();
-            tcg_gen_ext_i32_i64(v, cpu_R[arg[1]]);
-            gen_shift(sar);
-        }
+    if (dc->sar_m32_5bit) {
+        tcg_gen_sar_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_SR[SAR]);
+    } else {
+        TCGv_i64 v = tcg_temp_new_i64();
+        tcg_gen_ext_i32_i64(v, cpu_R[arg[1]]);
+        gen_shift(sar);
     }
 }
 
 static void translate_srai(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_sari_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
-    }
+    tcg_gen_sari_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
 }
 
 static void translate_src(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGv_i64 v = tcg_temp_new_i64();
-        tcg_gen_concat_i32_i64(v, cpu_R[arg[2]], cpu_R[arg[1]]);
-        gen_shift(shr);
-    }
+    TCGv_i64 v = tcg_temp_new_i64();
+    tcg_gen_concat_i32_i64(v, cpu_R[arg[2]], cpu_R[arg[1]]);
+    gen_shift(shr);
 }
 
 static void translate_srl(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        if (dc->sar_m32_5bit) {
-            tcg_gen_shr_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_SR[SAR]);
-        } else {
-            TCGv_i64 v = tcg_temp_new_i64();
-            tcg_gen_extu_i32_i64(v, cpu_R[arg[1]]);
-            gen_shift(shr);
-        }
+    if (dc->sar_m32_5bit) {
+        tcg_gen_shr_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_SR[SAR]);
+    } else {
+        TCGv_i64 v = tcg_temp_new_i64();
+        tcg_gen_extu_i32_i64(v, cpu_R[arg[1]]);
+        gen_shift(shr);
     }
 }
 
@@ -2450,31 +2329,25 @@ static void translate_srl(DisasContext *dc, const uint32_t arg[],
 static void translate_srli(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        tcg_gen_shri_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
-    }
+    tcg_gen_shri_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2]);
 }
 
 static void translate_ssa8b(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_shli_i32(tmp, cpu_R[arg[0]], 3);
-        gen_left_shift_sar(dc, tmp);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_shli_i32(tmp, cpu_R[arg[0]], 3);
+    gen_left_shift_sar(dc, tmp);
+    tcg_temp_free(tmp);
 }
 
 static void translate_ssa8l(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_shli_i32(tmp, cpu_R[arg[0]], 3);
-        gen_right_shift_sar(dc, tmp);
-        tcg_temp_free(tmp);
-    }
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_shli_i32(tmp, cpu_R[arg[0]], 3);
+    gen_right_shift_sar(dc, tmp);
+    tcg_temp_free(tmp);
 }
 
 static void translate_ssai(DisasContext *dc, const uint32_t arg[],
@@ -2488,168 +2361,147 @@ static void translate_ssai(DisasContext *dc, const uint32_t arg[],
 static void translate_ssl(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        gen_left_shift_sar(dc, cpu_R[arg[0]]);
-    }
+    gen_left_shift_sar(dc, cpu_R[arg[0]]);
 }
 
 static void translate_ssr(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        gen_right_shift_sar(dc, cpu_R[arg[0]]);
-    }
+    gen_right_shift_sar(dc, cpu_R[arg[0]]);
 }
 
 static void translate_sub(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_sub_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_sub_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 }
 
 static void translate_subx(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_shli_i32(tmp, cpu_R[arg[1]], par[0]);
-        tcg_gen_sub_i32(cpu_R[arg[0]], tmp, cpu_R[arg[2]]);
-        tcg_temp_free(tmp);
-    }
-}
-
-static void translate_syscall(DisasContext *dc, const uint32_t arg[],
-                              const uint32_t par[])
-{
-    gen_exception_cause(dc, SYSCALL_CAUSE);
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    tcg_gen_shli_i32(tmp, cpu_R[arg[1]], par[0]);
+    tcg_gen_sub_i32(cpu_R[arg[0]], tmp, cpu_R[arg[2]]);
+    tcg_temp_free(tmp);
 }
 
 static void translate_waiti(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_privilege(dc)) {
 #ifndef CONFIG_USER_ONLY
-        gen_waiti(dc, arg[0]);
+    gen_waiti(dc, arg[0]);
 #endif
-    }
 }
 
 static void translate_wtlb(DisasContext *dc, const uint32_t arg[],
                            const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
 #ifndef CONFIG_USER_ONLY
-        TCGv_i32 dtlb = tcg_const_i32(par[0]);
+    TCGv_i32 dtlb = tcg_const_i32(par[0]);
 
-        gen_helper_wtlb(cpu_env, cpu_R[arg[0]], cpu_R[arg[1]], dtlb);
-        /* This could change memory mapping, so exit tb */
-        gen_jumpi_check_loop_end(dc, -1);
-        tcg_temp_free(dtlb);
+    gen_helper_wtlb(cpu_env, cpu_R[arg[0]], cpu_R[arg[1]], dtlb);
+    tcg_temp_free(dtlb);
 #endif
-    }
 }
 
 static void translate_wer(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_privilege(dc) &&
-        gen_window_check2(dc, arg[0], arg[1])) {
-        gen_helper_wer(cpu_env, cpu_R[arg[0]], cpu_R[arg[1]]);
-    }
+    gen_helper_wer(cpu_env, cpu_R[arg[0]], cpu_R[arg[1]]);
 }
 
 static void translate_wrmsk_expstate(DisasContext *dc, const uint32_t arg[],
                                      const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[0], arg[1])) {
-        /* TODO: GPIO32 may be a part of coprocessor */
-        tcg_gen_and_i32(cpu_UR[EXPSTATE], cpu_R[arg[0]], cpu_R[arg[1]]);
-    }
+    /* TODO: GPIO32 may be a part of coprocessor */
+    tcg_gen_and_i32(cpu_UR[EXPSTATE], cpu_R[arg[0]], cpu_R[arg[1]]);
+}
+
+static bool test_ill_wsr(DisasContext *dc, const uint32_t arg[],
+                         const uint32_t par[])
+{
+    return !check_sr(dc, par[0], SR_W);
 }
 
 static void translate_wsr(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_sr(dc, par[0], SR_W) &&
-        (par[0] < 64 || gen_check_privilege(dc)) &&
-        gen_window_check1(dc, arg[0])) {
-        gen_wsr(dc, par[0], cpu_R[arg[0]]);
-    }
+    gen_wsr(dc, par[0], cpu_R[arg[0]]);
 }
 
 static void translate_wur(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0])) {
-        if (uregnames[par[0]].name) {
-            gen_wur(par[0], cpu_R[arg[0]]);
-        } else {
-            qemu_log_mask(LOG_UNIMP, "WUR %d not implemented\n", par[0]);
-        }
+    if (uregnames[par[0]].name) {
+        gen_wur(par[0], cpu_R[arg[0]]);
+    } else {
+        qemu_log_mask(LOG_UNIMP, "WUR %d not implemented\n", par[0]);
     }
 }
 
 static void translate_xor(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_xor_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-    }
+    tcg_gen_xor_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
+}
+
+static bool test_ill_xsr(DisasContext *dc, const uint32_t arg[],
+                         const uint32_t par[])
+{
+    return !check_sr(dc, par[0], SR_X);
 }
 
 static void translate_xsr(DisasContext *dc, const uint32_t arg[],
                           const uint32_t par[])
 {
-    if (gen_check_sr(dc, par[0], SR_X) &&
-        (par[0] < 64 || gen_check_privilege(dc)) &&
-        gen_window_check1(dc, arg[0])) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        bool rsr_end, wsr_end;
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-        tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
-        rsr_end = gen_rsr(dc, cpu_R[arg[0]], par[0]);
-        wsr_end = gen_wsr(dc, par[0], tmp);
-        tcg_temp_free(tmp);
-        if (rsr_end && !wsr_end) {
-            gen_jumpi_check_loop_end(dc, 0);
-        }
-    }
+    tcg_gen_mov_i32(tmp, cpu_R[arg[0]]);
+    gen_rsr(dc, cpu_R[arg[0]], par[0]);
+    gen_wsr(dc, par[0], tmp);
+    tcg_temp_free(tmp);
 }
 
 static const XtensaOpcodeOps core_ops[] = {
     {
         .name = "abs",
         .translate = translate_abs,
+        .windowed_register_op = 0x3,
     }, {
         .name = "add",
         .translate = translate_add,
+        .windowed_register_op = 0x7,
     }, {
         .name = "add.n",
         .translate = translate_add,
+        .windowed_register_op = 0x7,
     }, {
         .name = "addi",
         .translate = translate_addi,
+        .windowed_register_op = 0x3,
     }, {
         .name = "addi.n",
         .translate = translate_addi,
+        .windowed_register_op = 0x3,
     }, {
         .name = "addmi",
         .translate = translate_addi,
+        .windowed_register_op = 0x3,
     }, {
         .name = "addx2",
         .translate = translate_addx,
         .par = (const uint32_t[]){1},
+        .windowed_register_op = 0x7,
     }, {
         .name = "addx4",
         .translate = translate_addx,
         .par = (const uint32_t[]){2},
+        .windowed_register_op = 0x7,
     }, {
         .name = "addx8",
         .translate = translate_addx,
         .par = (const uint32_t[]){3},
+        .windowed_register_op = 0x7,
     }, {
         .name = "all4",
         .translate = translate_all,
@@ -2661,6 +2513,7 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "and",
         .translate = translate_and,
+        .windowed_register_op = 0x7,
     }, {
         .name = "andb",
         .translate = translate_boolean,
@@ -2681,42 +2534,52 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "ball",
         .translate = translate_ball,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bany",
         .translate = translate_bany,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bbc",
         .translate = translate_bb,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bbci",
         .translate = translate_bbi,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bbs",
         .translate = translate_bb,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bbsi",
         .translate = translate_bbi,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "beq",
         .translate = translate_b,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x3,
     }, {
         .name = "beqi",
         .translate = translate_bi,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x1,
     }, {
         .name = "beqz",
         .translate = translate_bz,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x1,
     }, {
         .name = "beqz.n",
         .translate = translate_bz,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bf",
         .translate = translate_bp,
@@ -2725,74 +2588,92 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "bge",
         .translate = translate_b,
         .par = (const uint32_t[]){TCG_COND_GE},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bgei",
         .translate = translate_bi,
         .par = (const uint32_t[]){TCG_COND_GE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bgeu",
         .translate = translate_b,
         .par = (const uint32_t[]){TCG_COND_GEU},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bgeui",
         .translate = translate_bi,
         .par = (const uint32_t[]){TCG_COND_GEU},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bgez",
         .translate = translate_bz,
         .par = (const uint32_t[]){TCG_COND_GE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "blt",
         .translate = translate_b,
         .par = (const uint32_t[]){TCG_COND_LT},
+        .windowed_register_op = 0x3,
     }, {
         .name = "blti",
         .translate = translate_bi,
         .par = (const uint32_t[]){TCG_COND_LT},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bltu",
         .translate = translate_b,
         .par = (const uint32_t[]){TCG_COND_LTU},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bltui",
         .translate = translate_bi,
         .par = (const uint32_t[]){TCG_COND_LTU},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bltz",
         .translate = translate_bz,
         .par = (const uint32_t[]){TCG_COND_LT},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bnall",
         .translate = translate_ball,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bne",
         .translate = translate_b,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x3,
     }, {
         .name = "bnei",
         .translate = translate_bi,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bnez",
         .translate = translate_bz,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bnez.n",
         .translate = translate_bz,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "bnone",
         .translate = translate_bany,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x3,
     }, {
         .name = "break",
-        .translate = translate_break,
+        .translate = translate_nop,
         .par = (const uint32_t[]){DEBUGCAUSE_BI},
+        .op_flags = XTENSA_OP_DEBUG_BREAK,
     }, {
         .name = "break.n",
-        .translate = translate_break,
+        .translate = translate_nop,
         .par = (const uint32_t[]){DEBUGCAUSE_BN},
+        .op_flags = XTENSA_OP_DEBUG_BREAK,
     }, {
         .name = "bt",
         .translate = translate_bp,
@@ -2803,100 +2684,123 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "call12",
         .translate = translate_callw,
+        .test_overflow = test_overflow_callw,
         .par = (const uint32_t[]){3},
     }, {
         .name = "call4",
         .translate = translate_callw,
+        .test_overflow = test_overflow_callw,
         .par = (const uint32_t[]){1},
     }, {
         .name = "call8",
         .translate = translate_callw,
+        .test_overflow = test_overflow_callw,
         .par = (const uint32_t[]){2},
     }, {
         .name = "callx0",
         .translate = translate_callx0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "callx12",
         .translate = translate_callxw,
+        .test_overflow = test_overflow_callw,
         .par = (const uint32_t[]){3},
+        .windowed_register_op = 0x1,
     }, {
         .name = "callx4",
         .translate = translate_callxw,
+        .test_overflow = test_overflow_callw,
         .par = (const uint32_t[]){1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "callx8",
         .translate = translate_callxw,
+        .test_overflow = test_overflow_callw,
         .par = (const uint32_t[]){2},
+        .windowed_register_op = 0x1,
     }, {
         .name = "clamps",
         .translate = translate_clamps,
+        .windowed_register_op = 0x3,
     }, {
         .name = "clrb_expstate",
         .translate = translate_clrb_expstate,
     }, {
         .name = "const16",
         .translate = translate_const16,
+        .windowed_register_op = 0x1,
     }, {
         .name = "depbits",
         .translate = translate_depbits,
+        .windowed_register_op = 0x3,
     }, {
         .name = "dhi",
         .translate = translate_dcache,
-        .par = (const uint32_t[]){true, true},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dhu",
         .translate = translate_dcache,
-        .par = (const uint32_t[]){true, true},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dhwb",
         .translate = translate_dcache,
-        .par = (const uint32_t[]){false, true},
+        .windowed_register_op = 0x1,
     }, {
         .name = "dhwbi",
         .translate = translate_dcache,
-        .par = (const uint32_t[]){false, true},
+        .windowed_register_op = 0x1,
     }, {
         .name = "dii",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){true, false},
+        .translate = translate_nop,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "diu",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){true, false},
+        .translate = translate_nop,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "diwb",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){true, false},
+        .translate = translate_nop,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "diwbi",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){true, false},
+        .translate = translate_nop,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dpfl",
         .translate = translate_dcache,
-        .par = (const uint32_t[]){true, true},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dpfr",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){false, false},
+        .translate = translate_nop,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dpfro",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){false, false},
+        .translate = translate_nop,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dpfw",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){false, false},
+        .translate = translate_nop,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dpfwo",
-        .translate = translate_dcache,
-        .par = (const uint32_t[]){false, false},
+        .translate = translate_nop,
+        .windowed_register_op = 0x1,
     }, {
         .name = "dsync",
         .translate = translate_nop,
     }, {
         .name = "entry",
         .translate = translate_entry,
+        .test_ill = test_ill_entry,
+        .test_overflow = test_overflow_entry,
+        .op_flags = XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "esync",
         .translate = translate_nop,
@@ -2906,53 +2810,62 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "extui",
         .translate = translate_extui,
+        .windowed_register_op = 0x3,
     }, {
         .name = "extw",
         .translate = translate_memw,
     }, {
         .name = "hwwdtlba",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "hwwitlba",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "idtlb",
         .translate = translate_itlb,
         .par = (const uint32_t[]){true},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "ihi",
         .translate = translate_icache,
-        .par = (const uint32_t[]){false, true},
+        .windowed_register_op = 0x1,
     }, {
         .name = "ihu",
         .translate = translate_icache,
-        .par = (const uint32_t[]){true, true},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "iii",
-        .translate = translate_icache,
-        .par = (const uint32_t[]){true, false},
+        .translate = translate_nop,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "iitlb",
         .translate = translate_itlb,
         .par = (const uint32_t[]){false},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "iiu",
-        .translate = translate_icache,
-        .par = (const uint32_t[]){true, false},
+        .translate = translate_nop,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "ill",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "ill.n",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "ipf",
-        .translate = translate_icache,
-        .par = (const uint32_t[]){false, false},
+        .translate = translate_nop,
+        .windowed_register_op = 0x1,
     }, {
         .name = "ipfl",
         .translate = translate_icache,
-        .par = (const uint32_t[]){true, true},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "isync",
         .translate = translate_nop,
@@ -2962,161 +2875,204 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "jx",
         .translate = translate_jx,
+        .windowed_register_op = 0x1,
     }, {
         .name = "l16si",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TESW, false, false},
+        .windowed_register_op = 0x3,
     }, {
         .name = "l16ui",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUW, false, false},
+        .windowed_register_op = 0x3,
     }, {
         .name = "l32ai",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, true, false},
+        .windowed_register_op = 0x3,
     }, {
         .name = "l32e",
         .translate = translate_l32e,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "l32i",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, false, false},
+        .windowed_register_op = 0x3,
     }, {
         .name = "l32i.n",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, false, false},
+        .windowed_register_op = 0x3,
     }, {
         .name = "l32r",
         .translate = translate_l32r,
+        .windowed_register_op = 0x1,
     }, {
         .name = "l8ui",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_UB, false, false},
+        .windowed_register_op = 0x3,
     }, {
         .name = "lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_NONE, 0, 0, -4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_NONE, 0, 0, 4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "ldpte",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "loop",
         .translate = translate_loop,
         .par = (const uint32_t[]){TCG_COND_NEVER},
+        .windowed_register_op = 0x1,
     }, {
         .name = "loopgtz",
         .translate = translate_loop,
         .par = (const uint32_t[]){TCG_COND_GT},
+        .windowed_register_op = 0x1,
     }, {
         .name = "loopnez",
         .translate = translate_loop,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "max",
         .translate = translate_smax,
+        .windowed_register_op = 0x7,
     }, {
         .name = "maxu",
         .translate = translate_umax,
+        .windowed_register_op = 0x7,
     }, {
         .name = "memw",
         .translate = translate_memw,
     }, {
         .name = "min",
         .translate = translate_smin,
+        .windowed_register_op = 0x7,
     }, {
         .name = "minu",
         .translate = translate_umin,
+        .windowed_register_op = 0x7,
     }, {
         .name = "mov",
         .translate = translate_mov,
+        .windowed_register_op = 0x3,
     }, {
         .name = "mov.n",
         .translate = translate_mov,
+        .windowed_register_op = 0x3,
     }, {
         .name = "moveqz",
         .translate = translate_movcond,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x7,
     }, {
         .name = "movf",
         .translate = translate_movp,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x3,
     }, {
         .name = "movgez",
         .translate = translate_movcond,
         .par = (const uint32_t[]){TCG_COND_GE},
+        .windowed_register_op = 0x7,
     }, {
         .name = "movi",
         .translate = translate_movi,
+        .windowed_register_op = 0x1,
     }, {
         .name = "movi.n",
         .translate = translate_movi,
+        .windowed_register_op = 0x1,
     }, {
         .name = "movltz",
         .translate = translate_movcond,
         .par = (const uint32_t[]){TCG_COND_LT},
+        .windowed_register_op = 0x7,
     }, {
         .name = "movnez",
         .translate = translate_movcond,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x7,
     }, {
         .name = "movsp",
         .translate = translate_movsp,
+        .windowed_register_op = 0x3,
+        .op_flags = XTENSA_OP_ALLOCA,
     }, {
         .name = "movt",
         .translate = translate_movp,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mul.aa.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AA, MAC16_HH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mul.aa.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AA, MAC16_HL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mul.aa.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AA, MAC16_LH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mul.aa.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AA, MAC16_LL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mul.ad.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AD, MAC16_HH, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mul.ad.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AD, MAC16_HL, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mul.ad.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AD, MAC16_LH, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mul.ad.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_AD, MAC16_LL, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mul.da.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_DA, MAC16_HH, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mul.da.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_DA, MAC16_HL, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mul.da.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_DA, MAC16_LH, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mul.da.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MUL, MAC16_DA, MAC16_LL, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mul.dd.hh",
         .translate = translate_mac16,
@@ -3137,90 +3093,112 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "mul16s",
         .translate = translate_mul16,
         .par = (const uint32_t[]){true},
+        .windowed_register_op = 0x7,
     }, {
         .name = "mul16u",
         .translate = translate_mul16,
         .par = (const uint32_t[]){false},
+        .windowed_register_op = 0x7,
     }, {
         .name = "mula.aa.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AA, MAC16_HH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mula.aa.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AA, MAC16_HL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mula.aa.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AA, MAC16_LH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mula.aa.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AA, MAC16_LL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "mula.ad.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AD, MAC16_HH, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mula.ad.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AD, MAC16_HL, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mula.ad.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AD, MAC16_LH, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mula.ad.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_AD, MAC16_LL, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "mula.da.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_HH, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.da.hh.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_HH, -4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.hh.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_HH, 4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_HL, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.da.hl.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_HL, -4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.hl.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_HL, 4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_LH, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.da.lh.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_LH, -4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.lh.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_LH, 4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_LL, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.da.ll.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_LL, -4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.da.ll.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DA, MAC16_LL, 4},
+        .windowed_register_op = 0xa,
     }, {
         .name = "mula.dd.hh",
         .translate = translate_mac16,
@@ -3229,10 +3207,12 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "mula.dd.hh.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_HH, -4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.hh.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_HH, 4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.hl",
         .translate = translate_mac16,
@@ -3241,10 +3221,12 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "mula.dd.hl.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_HL, -4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.hl.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_HL, 4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.lh",
         .translate = translate_mac16,
@@ -3253,10 +3235,12 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "mula.dd.lh.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_LH, -4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.lh.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_LH, 4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.ll",
         .translate = translate_mac16,
@@ -3265,61 +3249,76 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "mula.dd.ll.lddec",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_LL, -4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mula.dd.ll.ldinc",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULA, MAC16_DD, MAC16_LL, 4},
+        .windowed_register_op = 0x2,
     }, {
         .name = "mull",
         .translate = translate_mull,
+        .windowed_register_op = 0x7,
     }, {
         .name = "muls.aa.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AA, MAC16_HH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "muls.aa.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AA, MAC16_HL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "muls.aa.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AA, MAC16_LH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "muls.aa.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AA, MAC16_LL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "muls.ad.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AD, MAC16_HH, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "muls.ad.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AD, MAC16_HL, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "muls.ad.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AD, MAC16_LH, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "muls.ad.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_AD, MAC16_LL, 0},
+        .windowed_register_op = 0x1,
     }, {
         .name = "muls.da.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_DA, MAC16_HH, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "muls.da.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_DA, MAC16_HL, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "muls.da.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_DA, MAC16_LH, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "muls.da.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_MULS, MAC16_DA, MAC16_LL, 0},
+        .windowed_register_op = 0x2,
     }, {
         .name = "muls.dd.hh",
         .translate = translate_mac16,
@@ -3340,13 +3339,16 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "mulsh",
         .translate = translate_mulh,
         .par = (const uint32_t[]){true},
+        .windowed_register_op = 0x7,
     }, {
         .name = "muluh",
         .translate = translate_mulh,
         .par = (const uint32_t[]){false},
+        .windowed_register_op = 0x7,
     }, {
         .name = "neg",
         .translate = translate_neg,
+        .windowed_register_op = 0x3,
     }, {
         .name = "nop",
         .translate = translate_nop,
@@ -3356,12 +3358,15 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "nsa",
         .translate = translate_nsa,
+        .windowed_register_op = 0x3,
     }, {
         .name = "nsau",
         .translate = translate_nsau,
+        .windowed_register_op = 0x3,
     }, {
         .name = "or",
         .translate = translate_or,
+        .windowed_register_op = 0x7,
     }, {
         .name = "orb",
         .translate = translate_boolean,
@@ -3374,40 +3379,57 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "pdtlb",
         .translate = translate_ptlb,
         .par = (const uint32_t[]){true},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "pitlb",
         .translate = translate_ptlb,
         .par = (const uint32_t[]){false},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "quos",
         .translate = translate_quos,
         .par = (const uint32_t[]){true},
+        .op_flags = XTENSA_OP_DIVIDE_BY_ZERO,
+        .windowed_register_op = 0x7,
     }, {
         .name = "quou",
         .translate = translate_quou,
-        .par = (const uint32_t[]){true},
+        .op_flags = XTENSA_OP_DIVIDE_BY_ZERO,
+        .windowed_register_op = 0x7,
     }, {
         .name = "rdtlb0",
         .translate = translate_rtlb,
         .par = (const uint32_t[]){true, 0},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "rdtlb1",
         .translate = translate_rtlb,
         .par = (const uint32_t[]){true, 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "read_impwire",
         .translate = translate_read_impwire,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rems",
         .translate = translate_quos,
         .par = (const uint32_t[]){false},
+        .op_flags = XTENSA_OP_DIVIDE_BY_ZERO,
+        .windowed_register_op = 0x7,
     }, {
         .name = "remu",
-        .translate = translate_quou,
-        .par = (const uint32_t[]){false},
+        .translate = translate_remu,
+        .op_flags = XTENSA_OP_DIVIDE_BY_ZERO,
+        .windowed_register_op = 0x7,
     }, {
         .name = "rer",
         .translate = translate_rer,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "ret",
         .translate = translate_ret,
@@ -3417,350 +3439,584 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "retw",
         .translate = translate_retw,
+        .test_ill = test_ill_retw,
+        .op_flags = XTENSA_OP_UNDERFLOW,
     }, {
         .name = "retw.n",
         .translate = translate_retw,
+        .test_ill = test_ill_retw,
+        .op_flags = XTENSA_OP_UNDERFLOW,
     }, {
         .name = "rfdd",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "rfde",
         .translate = translate_rfde,
+        .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "rfdo",
-        .translate = translate_ill,
+        .op_flags = XTENSA_OP_ILL,
     }, {
         .name = "rfe",
         .translate = translate_rfe,
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "rfi",
         .translate = translate_rfi,
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "rfwo",
         .translate = translate_rfw,
         .par = (const uint32_t[]){true},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "rfwu",
         .translate = translate_rfw,
         .par = (const uint32_t[]){false},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_CHECK_INTERRUPTS,
     }, {
         .name = "ritlb0",
         .translate = translate_rtlb,
         .par = (const uint32_t[]){false, 0},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "ritlb1",
         .translate = translate_rtlb,
         .par = (const uint32_t[]){false, 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "rotw",
         .translate = translate_rotw,
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
     }, {
         .name = "rsil",
         .translate = translate_rsil,
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.176",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){176},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.208",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){208},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.acchi",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){ACCHI},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.acclo",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){ACCLO},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.atomctl",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){ATOMCTL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.br",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){BR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.cacheattr",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CACHEATTR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ccompare0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CCOMPARE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ccompare1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CCOMPARE + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ccompare2",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CCOMPARE + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ccount",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CCOUNT},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.configid0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CONFIGID0},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.configid1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CONFIGID1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.cpenable",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){CPENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.dbreaka0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DBREAKA},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.dbreaka1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DBREAKA + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.dbreakc0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DBREAKC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.dbreakc1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DBREAKC + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ddr",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.debugcause",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DEBUGCAUSE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.depc",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DEPC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.dtlbcfg",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){DTLBCFG},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc2",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc3",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc4",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc5",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc6",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.epc7",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPC1 + 6},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.eps2",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPS2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.eps3",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPS2 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.eps4",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPS2 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.eps5",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPS2 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.eps6",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPS2 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.eps7",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EPS2 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.exccause",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCCAUSE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave2",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave3",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave4",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave5",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave6",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excsave7",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCSAVE1 + 6},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.excvaddr",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){EXCVADDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ibreaka0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){IBREAKA},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ibreaka1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){IBREAKA + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ibreakenable",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){IBREAKENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.icount",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){ICOUNT},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.icountlevel",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){ICOUNTLEVEL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.intclear",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){INTCLEAR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.intenable",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){INTENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.interrupt",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){INTSET},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.intset",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){INTSET},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.itlbcfg",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){ITLBCFG},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.lbeg",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){LBEG},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.lcount",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){LCOUNT},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.lend",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){LEND},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.litbase",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){LITBASE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.m0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.m1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MR + 1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.m2",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MR + 2},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.m3",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MR + 3},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.memctl",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MEMCTL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.misc0",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MISC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.misc1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MISC + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.misc2",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MISC + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.misc3",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){MISC + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.prid",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){PRID},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ps",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){PS},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.ptevaddr",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){PTEVADDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.rasid",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){RASID},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.sar",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){SAR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.scompare1",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){SCOMPARE1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.vecbase",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){VECBASE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.windowbase",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){WINDOW_BASE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsr.windowstart",
         .translate = translate_rsr,
+        .test_ill = test_ill_rsr,
         .par = (const uint32_t[]){WINDOW_START},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "rsync",
         .translate = translate_nop,
@@ -3768,479 +4024,769 @@ static const XtensaOpcodeOps core_ops[] = {
         .name = "rur.expstate",
         .translate = translate_rur,
         .par = (const uint32_t[]){EXPSTATE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "rur.fcr",
         .translate = translate_rur,
         .par = (const uint32_t[]){FCR},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "rur.fsr",
         .translate = translate_rur,
         .par = (const uint32_t[]){FSR},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "rur.threadptr",
         .translate = translate_rur,
         .par = (const uint32_t[]){THREADPTR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "s16i",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUW, false, true},
+        .windowed_register_op = 0x3,
     }, {
         .name = "s32c1i",
         .translate = translate_s32c1i,
+        .windowed_register_op = 0x3,
     }, {
         .name = "s32e",
         .translate = translate_s32e,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "s32i",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, false, true},
+        .windowed_register_op = 0x3,
     }, {
         .name = "s32i.n",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, false, true},
+        .windowed_register_op = 0x3,
     }, {
         .name = "s32nb",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, false, true},
+        .windowed_register_op = 0x3,
     }, {
         .name = "s32ri",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_TEUL, true, true},
+        .windowed_register_op = 0x3,
     }, {
         .name = "s8i",
         .translate = translate_ldst,
         .par = (const uint32_t[]){MO_UB, false, true},
+        .windowed_register_op = 0x3,
     }, {
         .name = "salt",
         .translate = translate_salt,
         .par = (const uint32_t[]){TCG_COND_LT},
+        .windowed_register_op = 0x7,
     }, {
         .name = "saltu",
         .translate = translate_salt,
         .par = (const uint32_t[]){TCG_COND_LTU},
+        .windowed_register_op = 0x7,
     }, {
         .name = "setb_expstate",
         .translate = translate_setb_expstate,
     }, {
         .name = "sext",
         .translate = translate_sext,
+        .windowed_register_op = 0x3,
     }, {
         .name = "simcall",
         .translate = translate_simcall,
+        .test_ill = test_ill_simcall,
+        .op_flags = XTENSA_OP_PRIVILEGED,
     }, {
         .name = "sll",
         .translate = translate_sll,
+        .windowed_register_op = 0x3,
     }, {
         .name = "slli",
         .translate = translate_slli,
+        .windowed_register_op = 0x3,
     }, {
         .name = "sra",
         .translate = translate_sra,
+        .windowed_register_op = 0x3,
     }, {
         .name = "srai",
         .translate = translate_srai,
+        .windowed_register_op = 0x3,
     }, {
         .name = "src",
         .translate = translate_src,
+        .windowed_register_op = 0x7,
     }, {
         .name = "srl",
         .translate = translate_srl,
+        .windowed_register_op = 0x3,
     }, {
         .name = "srli",
         .translate = translate_srli,
+        .windowed_register_op = 0x3,
     }, {
         .name = "ssa8b",
         .translate = translate_ssa8b,
+        .windowed_register_op = 0x1,
     }, {
         .name = "ssa8l",
         .translate = translate_ssa8l,
+        .windowed_register_op = 0x1,
     }, {
         .name = "ssai",
         .translate = translate_ssai,
     }, {
         .name = "ssl",
         .translate = translate_ssl,
+        .windowed_register_op = 0x1,
     }, {
         .name = "ssr",
         .translate = translate_ssr,
+        .windowed_register_op = 0x1,
     }, {
         .name = "sub",
         .translate = translate_sub,
+        .windowed_register_op = 0x7,
     }, {
         .name = "subx2",
         .translate = translate_subx,
         .par = (const uint32_t[]){1},
+        .windowed_register_op = 0x7,
     }, {
         .name = "subx4",
         .translate = translate_subx,
         .par = (const uint32_t[]){2},
+        .windowed_register_op = 0x7,
     }, {
         .name = "subx8",
         .translate = translate_subx,
         .par = (const uint32_t[]){3},
+        .windowed_register_op = 0x7,
     }, {
         .name = "syscall",
-        .translate = translate_syscall,
+        .op_flags = XTENSA_OP_SYSCALL,
     }, {
         .name = "umul.aa.hh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_UMUL, MAC16_AA, MAC16_HH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "umul.aa.hl",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_UMUL, MAC16_AA, MAC16_HL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "umul.aa.lh",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_UMUL, MAC16_AA, MAC16_LH, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "umul.aa.ll",
         .translate = translate_mac16,
         .par = (const uint32_t[]){MAC16_UMUL, MAC16_AA, MAC16_LL, 0},
+        .windowed_register_op = 0x3,
     }, {
         .name = "waiti",
         .translate = translate_waiti,
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
     }, {
         .name = "wdtlb",
         .translate = translate_wtlb,
         .par = (const uint32_t[]){true},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x3,
     }, {
         .name = "wer",
         .translate = translate_wer,
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x3,
     }, {
         .name = "witlb",
         .translate = translate_wtlb,
         .par = (const uint32_t[]){false},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x3,
     }, {
         .name = "wrmsk_expstate",
         .translate = translate_wrmsk_expstate,
+        .windowed_register_op = 0x3,
     }, {
         .name = "wsr.176",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){176},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.208",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){208},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.acchi",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){ACCHI},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.acclo",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){ACCLO},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.atomctl",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){ATOMCTL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.br",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){BR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.cacheattr",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CACHEATTR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ccompare0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CCOMPARE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ccompare1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CCOMPARE + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ccompare2",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CCOMPARE + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ccount",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CCOUNT},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.configid0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CONFIGID0},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.configid1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CONFIGID1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.cpenable",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){CPENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.dbreaka0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DBREAKA},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.dbreaka1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DBREAKA + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.dbreakc0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DBREAKC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.dbreakc1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DBREAKC + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ddr",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.debugcause",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DEBUGCAUSE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.depc",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DEPC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.dtlbcfg",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){DTLBCFG},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc2",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc3",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc4",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc5",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc6",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.epc7",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPC1 + 6},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.eps2",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPS2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.eps3",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPS2 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.eps4",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPS2 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.eps5",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPS2 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.eps6",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPS2 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.eps7",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EPS2 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.exccause",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCCAUSE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave2",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave3",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave4",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave5",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave6",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excsave7",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCSAVE1 + 6},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.excvaddr",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){EXCVADDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ibreaka0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){IBREAKA},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ibreaka1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){IBREAKA + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ibreakenable",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){IBREAKENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.icount",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){ICOUNT},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.icountlevel",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){ICOUNTLEVEL},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.intclear",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){INTCLEAR},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.intenable",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){INTENABLE},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.interrupt",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){INTSET},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.intset",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){INTSET},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.itlbcfg",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){ITLBCFG},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.lbeg",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){LBEG},
+        .op_flags = XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.lcount",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){LCOUNT},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.lend",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){LEND},
+        .op_flags = XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.litbase",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){LITBASE},
+        .op_flags = XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.m0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.m1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MR + 1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.m2",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MR + 2},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.m3",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MR + 3},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.memctl",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MEMCTL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.misc0",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MISC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.misc1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MISC + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.misc2",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MISC + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.misc3",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MISC + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.mmid",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){MMID},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.prid",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){PRID},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ps",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){PS},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_M1 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.ptevaddr",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){PTEVADDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.rasid",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){RASID},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.sar",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){SAR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.scompare1",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){SCOMPARE1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.vecbase",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){VECBASE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.windowbase",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){WINDOW_BASE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wsr.windowstart",
         .translate = translate_wsr,
+        .test_ill = test_ill_wsr,
         .par = (const uint32_t[]){WINDOW_START},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "wur.expstate",
         .translate = translate_wur,
         .par = (const uint32_t[]){EXPSTATE},
+        .windowed_register_op = 0x1,
     }, {
         .name = "wur.fcr",
         .translate = translate_wur,
         .par = (const uint32_t[]){FCR},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "wur.fsr",
         .translate = translate_wur,
         .par = (const uint32_t[]){FSR},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "wur.threadptr",
         .translate = translate_wur,
         .par = (const uint32_t[]){THREADPTR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xor",
         .translate = translate_xor,
+        .windowed_register_op = 0x7,
     }, {
         .name = "xorb",
         .translate = translate_boolean,
@@ -4248,307 +4794,540 @@ static const XtensaOpcodeOps core_ops[] = {
     }, {
         .name = "xsr.176",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){176},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.208",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){208},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.acchi",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){ACCHI},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.acclo",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){ACCLO},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.atomctl",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){ATOMCTL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.br",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){BR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.cacheattr",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CACHEATTR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ccompare0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CCOMPARE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ccompare1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CCOMPARE + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ccompare2",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CCOMPARE + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ccount",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CCOUNT},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.configid0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CONFIGID0},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.configid1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CONFIGID1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.cpenable",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){CPENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.dbreaka0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DBREAKA},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.dbreaka1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DBREAKA + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.dbreakc0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DBREAKC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.dbreakc1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DBREAKC + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ddr",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.debugcause",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DEBUGCAUSE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.depc",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DEPC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.dtlbcfg",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){DTLBCFG},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc2",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc3",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc4",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc5",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc6",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.epc7",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPC1 + 6},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.eps2",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPS2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.eps3",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPS2 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.eps4",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPS2 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.eps5",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPS2 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.eps6",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPS2 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.eps7",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EPS2 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.exccause",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCCAUSE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave2",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1 + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave3",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1 + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave4",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1 + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave5",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1 + 4},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave6",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1 + 5},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excsave7",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCSAVE1 + 6},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.excvaddr",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){EXCVADDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ibreaka0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){IBREAKA},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ibreaka1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){IBREAKA + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ibreakenable",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){IBREAKENABLE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.icount",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){ICOUNT},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.icountlevel",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){ICOUNTLEVEL},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.intclear",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){INTCLEAR},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.intenable",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){INTENABLE},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.interrupt",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){INTSET},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.intset",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){INTSET},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_0 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.itlbcfg",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){ITLBCFG},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.lbeg",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){LBEG},
+        .op_flags = XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.lcount",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){LCOUNT},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.lend",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){LEND},
+        .op_flags = XTENSA_OP_EXIT_TB_0,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.litbase",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){LITBASE},
+        .op_flags = XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.m0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.m1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MR + 1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.m2",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MR + 2},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.m3",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MR + 3},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.memctl",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MEMCTL},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.misc0",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MISC},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.misc1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MISC + 1},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.misc2",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MISC + 2},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.misc3",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){MISC + 3},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.prid",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){PRID},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ps",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){PS},
+        .op_flags =
+            XTENSA_OP_PRIVILEGED |
+            XTENSA_OP_EXIT_TB_M1 |
+            XTENSA_OP_CHECK_INTERRUPTS,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.ptevaddr",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){PTEVADDR},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.rasid",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){RASID},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.sar",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){SAR},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.scompare1",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){SCOMPARE1},
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.vecbase",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){VECBASE},
+        .op_flags = XTENSA_OP_PRIVILEGED,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.windowbase",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){WINDOW_BASE},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     }, {
         .name = "xsr.windowstart",
         .translate = translate_xsr,
+        .test_ill = test_ill_xsr,
         .par = (const uint32_t[]){WINDOW_START},
+        .op_flags = XTENSA_OP_PRIVILEGED | XTENSA_OP_EXIT_TB_M1,
+        .windowed_register_op = 0x1,
     },
 };
 
@@ -4561,18 +5340,14 @@ const XtensaOpcodeTranslators xtensa_core_opcodes = {
 static void translate_abs_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_abs_s(cpu_FR[arg[0]], cpu_FR[arg[1]]);
-    }
+    gen_helper_abs_s(cpu_FR[arg[0]], cpu_FR[arg[1]]);
 }
 
 static void translate_add_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_add_s(cpu_FR[arg[0]], cpu_env,
-                         cpu_FR[arg[1]], cpu_FR[arg[2]]);
-    }
+    gen_helper_add_s(cpu_FR[arg[0]], cpu_env,
+                     cpu_FR[arg[1]], cpu_FR[arg[2]]);
 }
 
 enum {
@@ -4598,331 +5373,357 @@ static void translate_compare_s(DisasContext *dc, const uint32_t arg[],
         [COMPARE_OLE] = gen_helper_ole_s,
         [COMPARE_ULE] = gen_helper_ule_s,
     };
+    TCGv_i32 bit = tcg_const_i32(1 << arg[0]);
 
-    if (gen_check_cpenable(dc, 0)) {
-        TCGv_i32 bit = tcg_const_i32(1 << arg[0]);
-
-        helper[par[0]](cpu_env, bit, cpu_FR[arg[1]], cpu_FR[arg[2]]);
-        tcg_temp_free(bit);
-    }
+    helper[par[0]](cpu_env, bit, cpu_FR[arg[1]], cpu_FR[arg[2]]);
+    tcg_temp_free(bit);
 }
 
 static void translate_float_s(DisasContext *dc, const uint32_t arg[],
                               const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[1]) && gen_check_cpenable(dc, 0)) {
-        TCGv_i32 scale = tcg_const_i32(-arg[2]);
+    TCGv_i32 scale = tcg_const_i32(-arg[2]);
 
-        if (par[0]) {
-            gen_helper_uitof(cpu_FR[arg[0]], cpu_env, cpu_R[arg[1]], scale);
-        } else {
-            gen_helper_itof(cpu_FR[arg[0]], cpu_env, cpu_R[arg[1]], scale);
-        }
-        tcg_temp_free(scale);
+    if (par[0]) {
+        gen_helper_uitof(cpu_FR[arg[0]], cpu_env, cpu_R[arg[1]], scale);
+    } else {
+        gen_helper_itof(cpu_FR[arg[0]], cpu_env, cpu_R[arg[1]], scale);
     }
+    tcg_temp_free(scale);
 }
 
 static void translate_ftoi_s(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0]) && gen_check_cpenable(dc, 0)) {
-        TCGv_i32 rounding_mode = tcg_const_i32(par[0]);
-        TCGv_i32 scale = tcg_const_i32(arg[2]);
+    TCGv_i32 rounding_mode = tcg_const_i32(par[0]);
+    TCGv_i32 scale = tcg_const_i32(arg[2]);
 
-        if (par[1]) {
-            gen_helper_ftoui(cpu_R[arg[0]], cpu_FR[arg[1]],
-                             rounding_mode, scale);
-        } else {
-            gen_helper_ftoi(cpu_R[arg[0]], cpu_FR[arg[1]],
-                            rounding_mode, scale);
-        }
-        tcg_temp_free(rounding_mode);
-        tcg_temp_free(scale);
+    if (par[1]) {
+        gen_helper_ftoui(cpu_R[arg[0]], cpu_FR[arg[1]],
+                         rounding_mode, scale);
+    } else {
+        gen_helper_ftoi(cpu_R[arg[0]], cpu_FR[arg[1]],
+                        rounding_mode, scale);
     }
+    tcg_temp_free(rounding_mode);
+    tcg_temp_free(scale);
 }
 
 static void translate_ldsti(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[1]) && gen_check_cpenable(dc, 0)) {
-        TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
 
-        tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
-        gen_load_store_alignment(dc, 2, addr, false);
-        if (par[0]) {
-            tcg_gen_qemu_st32(cpu_FR[arg[0]], addr, dc->cring);
-        } else {
-            tcg_gen_qemu_ld32u(cpu_FR[arg[0]], addr, dc->cring);
-        }
-        if (par[1]) {
-            tcg_gen_mov_i32(cpu_R[arg[1]], addr);
-        }
-        tcg_temp_free(addr);
+    tcg_gen_addi_i32(addr, cpu_R[arg[1]], arg[2]);
+    gen_load_store_alignment(dc, 2, addr, false);
+    if (par[0]) {
+        tcg_gen_qemu_st32(cpu_FR[arg[0]], addr, dc->cring);
+    } else {
+        tcg_gen_qemu_ld32u(cpu_FR[arg[0]], addr, dc->cring);
     }
+    if (par[1]) {
+        tcg_gen_mov_i32(cpu_R[arg[1]], addr);
+    }
+    tcg_temp_free(addr);
 }
 
 static void translate_ldstx(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check2(dc, arg[1], arg[2]) && gen_check_cpenable(dc, 0)) {
-        TCGv_i32 addr = tcg_temp_new_i32();
+    TCGv_i32 addr = tcg_temp_new_i32();
 
-        tcg_gen_add_i32(addr, cpu_R[arg[1]], cpu_R[arg[2]]);
-        gen_load_store_alignment(dc, 2, addr, false);
-        if (par[0]) {
-            tcg_gen_qemu_st32(cpu_FR[arg[0]], addr, dc->cring);
-        } else {
-            tcg_gen_qemu_ld32u(cpu_FR[arg[0]], addr, dc->cring);
-        }
-        if (par[1]) {
-            tcg_gen_mov_i32(cpu_R[arg[1]], addr);
-        }
-        tcg_temp_free(addr);
+    tcg_gen_add_i32(addr, cpu_R[arg[1]], cpu_R[arg[2]]);
+    gen_load_store_alignment(dc, 2, addr, false);
+    if (par[0]) {
+        tcg_gen_qemu_st32(cpu_FR[arg[0]], addr, dc->cring);
+    } else {
+        tcg_gen_qemu_ld32u(cpu_FR[arg[0]], addr, dc->cring);
+    }
+    if (par[1]) {
+        tcg_gen_mov_i32(cpu_R[arg[1]], addr);
     }
+    tcg_temp_free(addr);
 }
 
 static void translate_madd_s(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_madd_s(cpu_FR[arg[0]], cpu_env,
-                          cpu_FR[arg[0]], cpu_FR[arg[1]], cpu_FR[arg[2]]);
-    }
+    gen_helper_madd_s(cpu_FR[arg[0]], cpu_env,
+                      cpu_FR[arg[0]], cpu_FR[arg[1]], cpu_FR[arg[2]]);
 }
 
 static void translate_mov_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        tcg_gen_mov_i32(cpu_FR[arg[0]], cpu_FR[arg[1]]);
-    }
+    tcg_gen_mov_i32(cpu_FR[arg[0]], cpu_FR[arg[1]]);
 }
 
 static void translate_movcond_s(DisasContext *dc, const uint32_t arg[],
                                 const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[2]) && gen_check_cpenable(dc, 0)) {
-        TCGv_i32 zero = tcg_const_i32(0);
+    TCGv_i32 zero = tcg_const_i32(0);
 
-        tcg_gen_movcond_i32(par[0], cpu_FR[arg[0]],
-                            cpu_R[arg[2]], zero,
-                            cpu_FR[arg[1]], cpu_FR[arg[0]]);
-        tcg_temp_free(zero);
-    }
+    tcg_gen_movcond_i32(par[0], cpu_FR[arg[0]],
+                        cpu_R[arg[2]], zero,
+                        cpu_FR[arg[1]], cpu_FR[arg[0]]);
+    tcg_temp_free(zero);
 }
 
 static void translate_movp_s(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        TCGv_i32 zero = tcg_const_i32(0);
-        TCGv_i32 tmp = tcg_temp_new_i32();
+    TCGv_i32 zero = tcg_const_i32(0);
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-        tcg_gen_andi_i32(tmp, cpu_SR[BR], 1 << arg[2]);
-        tcg_gen_movcond_i32(par[0],
-                            cpu_FR[arg[0]], tmp, zero,
-                            cpu_FR[arg[1]], cpu_FR[arg[0]]);
-        tcg_temp_free(tmp);
-        tcg_temp_free(zero);
-    }
+    tcg_gen_andi_i32(tmp, cpu_SR[BR], 1 << arg[2]);
+    tcg_gen_movcond_i32(par[0],
+                        cpu_FR[arg[0]], tmp, zero,
+                        cpu_FR[arg[1]], cpu_FR[arg[0]]);
+    tcg_temp_free(tmp);
+    tcg_temp_free(zero);
 }
 
 static void translate_mul_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_mul_s(cpu_FR[arg[0]], cpu_env,
-                         cpu_FR[arg[1]], cpu_FR[arg[2]]);
-    }
+    gen_helper_mul_s(cpu_FR[arg[0]], cpu_env,
+                     cpu_FR[arg[1]], cpu_FR[arg[2]]);
 }
 
 static void translate_msub_s(DisasContext *dc, const uint32_t arg[],
                              const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_msub_s(cpu_FR[arg[0]], cpu_env,
-                          cpu_FR[arg[0]], cpu_FR[arg[1]], cpu_FR[arg[2]]);
-    }
+    gen_helper_msub_s(cpu_FR[arg[0]], cpu_env,
+                      cpu_FR[arg[0]], cpu_FR[arg[1]], cpu_FR[arg[2]]);
 }
 
 static void translate_neg_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_neg_s(cpu_FR[arg[0]], cpu_FR[arg[1]]);
-    }
+    gen_helper_neg_s(cpu_FR[arg[0]], cpu_FR[arg[1]]);
 }
 
 static void translate_rfr_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[0]) &&
-        gen_check_cpenable(dc, 0)) {
-        tcg_gen_mov_i32(cpu_R[arg[0]], cpu_FR[arg[1]]);
-    }
+    tcg_gen_mov_i32(cpu_R[arg[0]], cpu_FR[arg[1]]);
 }
 
 static void translate_sub_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_check_cpenable(dc, 0)) {
-        gen_helper_sub_s(cpu_FR[arg[0]], cpu_env,
-                         cpu_FR[arg[1]], cpu_FR[arg[2]]);
-    }
+    gen_helper_sub_s(cpu_FR[arg[0]], cpu_env,
+                     cpu_FR[arg[1]], cpu_FR[arg[2]]);
 }
 
 static void translate_wfr_s(DisasContext *dc, const uint32_t arg[],
                             const uint32_t par[])
 {
-    if (gen_window_check1(dc, arg[1]) &&
-        gen_check_cpenable(dc, 0)) {
-        tcg_gen_mov_i32(cpu_FR[arg[0]], cpu_R[arg[1]]);
-    }
+    tcg_gen_mov_i32(cpu_FR[arg[0]], cpu_R[arg[1]]);
 }
 
 static const XtensaOpcodeOps fpu2000_ops[] = {
     {
         .name = "abs.s",
         .translate = translate_abs_s,
+        .coprocessor = 0x1,
     }, {
         .name = "add.s",
         .translate = translate_add_s,
+        .coprocessor = 0x1,
     }, {
         .name = "ceil.s",
         .translate = translate_ftoi_s,
         .par = (const uint32_t[]){float_round_up, false},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "float.s",
         .translate = translate_float_s,
         .par = (const uint32_t[]){false},
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     }, {
         .name = "floor.s",
         .translate = translate_ftoi_s,
         .par = (const uint32_t[]){float_round_down, false},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "lsi",
         .translate = translate_ldsti,
         .par = (const uint32_t[]){false, false},
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     }, {
         .name = "lsiu",
         .translate = translate_ldsti,
         .par = (const uint32_t[]){false, true},
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     }, {
         .name = "lsx",
         .translate = translate_ldstx,
         .par = (const uint32_t[]){false, false},
+        .windowed_register_op = 0x6,
+        .coprocessor = 0x1,
     }, {
         .name = "lsxu",
         .translate = translate_ldstx,
         .par = (const uint32_t[]){false, true},
+        .windowed_register_op = 0x6,
+        .coprocessor = 0x1,
     }, {
         .name = "madd.s",
         .translate = translate_madd_s,
+        .coprocessor = 0x1,
     }, {
         .name = "mov.s",
         .translate = translate_mov_s,
+        .coprocessor = 0x1,
     }, {
         .name = "moveqz.s",
         .translate = translate_movcond_s,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .windowed_register_op = 0x4,
+        .coprocessor = 0x1,
     }, {
         .name = "movf.s",
         .translate = translate_movp_s,
         .par = (const uint32_t[]){TCG_COND_EQ},
+        .coprocessor = 0x1,
     }, {
         .name = "movgez.s",
         .translate = translate_movcond_s,
         .par = (const uint32_t[]){TCG_COND_GE},
+        .windowed_register_op = 0x4,
+        .coprocessor = 0x1,
     }, {
         .name = "movltz.s",
         .translate = translate_movcond_s,
         .par = (const uint32_t[]){TCG_COND_LT},
+        .windowed_register_op = 0x4,
+        .coprocessor = 0x1,
     }, {
         .name = "movnez.s",
         .translate = translate_movcond_s,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .windowed_register_op = 0x4,
+        .coprocessor = 0x1,
     }, {
         .name = "movt.s",
         .translate = translate_movp_s,
         .par = (const uint32_t[]){TCG_COND_NE},
+        .coprocessor = 0x1,
     }, {
         .name = "msub.s",
         .translate = translate_msub_s,
+        .coprocessor = 0x1,
     }, {
         .name = "mul.s",
         .translate = translate_mul_s,
+        .coprocessor = 0x1,
     }, {
         .name = "neg.s",
         .translate = translate_neg_s,
+        .coprocessor = 0x1,
     }, {
         .name = "oeq.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_OEQ},
+        .coprocessor = 0x1,
     }, {
         .name = "ole.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_OLE},
+        .coprocessor = 0x1,
     }, {
         .name = "olt.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_OLT},
+        .coprocessor = 0x1,
     }, {
         .name = "rfr",
         .translate = translate_rfr_s,
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "round.s",
         .translate = translate_ftoi_s,
         .par = (const uint32_t[]){float_round_nearest_even, false},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "ssi",
         .translate = translate_ldsti,
         .par = (const uint32_t[]){true, false},
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     }, {
         .name = "ssiu",
         .translate = translate_ldsti,
         .par = (const uint32_t[]){true, true},
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     }, {
         .name = "ssx",
         .translate = translate_ldstx,
         .par = (const uint32_t[]){true, false},
+        .windowed_register_op = 0x6,
+        .coprocessor = 0x1,
     }, {
         .name = "ssxu",
         .translate = translate_ldstx,
         .par = (const uint32_t[]){true, true},
+        .windowed_register_op = 0x6,
+        .coprocessor = 0x1,
     }, {
         .name = "sub.s",
         .translate = translate_sub_s,
+        .coprocessor = 0x1,
     }, {
         .name = "trunc.s",
         .translate = translate_ftoi_s,
         .par = (const uint32_t[]){float_round_to_zero, false},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "ueq.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_UEQ},
+        .coprocessor = 0x1,
     }, {
         .name = "ufloat.s",
         .translate = translate_float_s,
         .par = (const uint32_t[]){true},
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     }, {
         .name = "ule.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_ULE},
+        .coprocessor = 0x1,
     }, {
         .name = "ult.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_ULT},
+        .coprocessor = 0x1,
     }, {
         .name = "un.s",
         .translate = translate_compare_s,
         .par = (const uint32_t[]){COMPARE_UN},
+        .coprocessor = 0x1,
     }, {
         .name = "utrunc.s",
         .translate = translate_ftoi_s,
         .par = (const uint32_t[]){float_round_to_zero, true},
+        .windowed_register_op = 0x1,
+        .coprocessor = 0x1,
     }, {
         .name = "wfr",
         .translate = translate_wfr_s,
+        .windowed_register_op = 0x2,
+        .coprocessor = 0x1,
     },
 };
 
diff --git a/tests/qemu-iotests/067.out b/tests/qemu-iotests/067.out
index 2e71cff3ce..b10c71db03 100644
--- a/tests/qemu-iotests/067.out
+++ b/tests/qemu-iotests/067.out
@@ -385,6 +385,7 @@ Testing: -device virtio-scsi -device scsi-cd,id=cd0
 {
     "return": [
         {
+            "io-status": "ok",
             "device": "",
             "locked": false,
             "removable": true,
diff --git a/tests/qemu-iotests/137 b/tests/qemu-iotests/137
index 87965625d8..19e8597306 100755
--- a/tests/qemu-iotests/137
+++ b/tests/qemu-iotests/137
@@ -109,7 +109,6 @@ $QEMU_IO \
     -c "reopen -o cache-size=1M,l2-cache-size=64k,refcount-cache-size=64k" \
     -c "reopen -o cache-size=1M,l2-cache-size=2M" \
     -c "reopen -o cache-size=1M,refcount-cache-size=2M" \
-    -c "reopen -o l2-cache-size=256T" \
     -c "reopen -o l2-cache-entry-size=33k" \
     -c "reopen -o l2-cache-entry-size=128k" \
     -c "reopen -o refcount-cache-size=256T" \
@@ -119,6 +118,13 @@ $QEMU_IO \
     -c "reopen -o cache-clean-interval=-1" \
     "$TEST_IMG" | _filter_qemu_io
 
+IMGOPTS="cluster_size=256k" _make_test_img 32P
+$QEMU_IO \
+    -c "reopen -o l2-cache-entry-size=512,l2-cache-size=1T" \
+    "$TEST_IMG" | _filter_qemu_io
+
+_make_test_img 64M
+
 echo
 echo === Test transaction semantics ===
 echo
diff --git a/tests/qemu-iotests/137.out b/tests/qemu-iotests/137.out
index 6a2ffc71fd..2c080b72f3 100644
--- a/tests/qemu-iotests/137.out
+++ b/tests/qemu-iotests/137.out
@@ -19,7 +19,6 @@ Parameter 'lazy-refcounts' expects 'on' or 'off'
 cache-size, l2-cache-size and refcount-cache-size may not be set at the same time
 l2-cache-size may not exceed cache-size
 refcount-cache-size may not exceed cache-size
-L2 cache size too big
 L2 cache entry size must be a power of two between 512 and the cluster size (65536)
 L2 cache entry size must be a power of two between 512 and the cluster size (65536)
 Refcount cache size too big
@@ -27,6 +26,9 @@ Conflicting values for qcow2 options 'overlap-check' ('constant') and 'overlap-c
 Unsupported value 'blubb' for qcow2 option 'overlap-check'. Allowed are any of the following: none, constant, cached, all
 Unsupported value 'blubb' for qcow2 option 'overlap-check'. Allowed are any of the following: none, constant, cached, all
 Cache clean interval too big
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=36028797018963968
+L2 cache size too big
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 
 === Test transaction semantics ===
 
diff --git a/tests/qemu-iotests/153.out b/tests/qemu-iotests/153.out
index 93eaf10486..884254868c 100644
--- a/tests/qemu-iotests/153.out
+++ b/tests/qemu-iotests/153.out
@@ -12,11 +12,11 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t
 
 == Launching another QEMU, opts: '' ==
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=none,: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Launching another QEMU, opts: 'read-only=on' ==
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=none,read-only=on: Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Launching another QEMU, opts: 'read-only=on,force-share=on' ==
 
@@ -24,77 +24,77 @@ Is another process using the image?
 
 _qemu_io_wrapper -c read 0 512 TEST_DIR/t.qcow2
 can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_io_wrapper -r -c read 0 512 TEST_DIR/t.qcow2
 can't open device TEST_DIR/t.qcow2: Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_io_wrapper -c open  TEST_DIR/t.qcow2 -c read 0 512
 can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 no file open, try 'help open'
 
 _qemu_io_wrapper -c open -r  TEST_DIR/t.qcow2 -c read 0 512
 can't open device TEST_DIR/t.qcow2: Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 no file open, try 'help open'
 
 _qemu_img_wrapper info TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper check TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper compare TEST_DIR/t.qcow2 TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper map TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper amend -o  TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper commit TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper resize TEST_DIR/t.qcow2 32M
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper snapshot -l TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper convert TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.convert
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper dd if=TEST_DIR/t.qcow2 of=TEST_DIR/t.qcow2.convert bs=512 count=1
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper bench -c 1 TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper bench -w -c 1 TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
 qemu-img: TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 file format: IMGFMT
 
 == Running utility commands -U ==
@@ -132,7 +132,7 @@ Try 'qemu-img --help' for more information
 
 _qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper snapshot -l -U TEST_DIR/t.qcow2
 
@@ -157,7 +157,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t
 
 == Launching another QEMU, opts: '' ==
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=none,: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Launching another QEMU, opts: 'read-only=on' ==
 
@@ -167,13 +167,13 @@ Is another process using the image?
 
 _qemu_io_wrapper -c read 0 512 TEST_DIR/t.qcow2
 can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_io_wrapper -r -c read 0 512 TEST_DIR/t.qcow2
 
 _qemu_io_wrapper -c open  TEST_DIR/t.qcow2 -c read 0 512
 can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 no file open, try 'help open'
 
 _qemu_io_wrapper -c open -r  TEST_DIR/t.qcow2 -c read 0 512
@@ -188,19 +188,19 @@ _qemu_img_wrapper map TEST_DIR/t.qcow2
 
 _qemu_img_wrapper amend -o  TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper commit TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper resize TEST_DIR/t.qcow2 32M
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper snapshot -l TEST_DIR/t.qcow2
 
@@ -212,11 +212,11 @@ _qemu_img_wrapper bench -c 1 TEST_DIR/t.qcow2
 
 _qemu_img_wrapper bench -w -c 1 TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
 qemu-img: TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 file format: IMGFMT
 
 == Running utility commands -U ==
@@ -254,7 +254,7 @@ Try 'qemu-img --help' for more information
 
 _qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 _qemu_img_wrapper snapshot -l -U TEST_DIR/t.qcow2
 
@@ -372,17 +372,17 @@ Round done
 
 == Two devices with the same image (read-only=off - read-only=off) ==
 QEMU_PROG: -drive if=none,file=TEST_DIR/t.qcow2,read-only=off: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Two devices with the same image (read-only=off - read-only=on) ==
 QEMU_PROG: -drive if=none,file=TEST_DIR/t.qcow2,read-only=on: Failed to get shared "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Two devices with the same image (read-only=off - read-only=on,force-share=on) ==
 
 == Two devices with the same image (read-only=on - read-only=off) ==
 QEMU_PROG: -drive if=none,file=TEST_DIR/t.qcow2,read-only=off: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Two devices with the same image (read-only=on - read-only=on) ==
 
@@ -403,13 +403,13 @@ Formatting 'TEST_DIR/t.IMGFMT.c', fmt=IMGFMT size=33554432 backing_file=TEST_DIR
 
 == Backing image also as an active device ==
 QEMU_PROG: -drive if=none,file=TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Backing image also as an active device (ro) ==
 
 == Symbolic link ==
 QEMU_PROG: -drive if=none,file=TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 
 == Active commit to intermediate layer should work when base in use ==
 {"return": {}}
@@ -420,7 +420,7 @@ Adding drive
 
 _qemu_io_wrapper TEST_DIR/t.qcow2 -c write 0 512
 can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 Creating overlay with qemu-img when the guest is running should be allowed
 
 _qemu_img_wrapper create -f qcow2 -b TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.overlay
@@ -433,7 +433,7 @@ _qemu_img_wrapper info TEST_DIR/t.qcow2
 
 _qemu_io_wrapper TEST_DIR/t.qcow2 -c write 0 512
 can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 Closing the other
 
 _qemu_io_wrapper TEST_DIR/t.qcow2 -c write 0 512
diff --git a/tests/qemu-iotests/182.out b/tests/qemu-iotests/182.out
index 23a4dbf809..f1463c8862 100644
--- a/tests/qemu-iotests/182.out
+++ b/tests/qemu-iotests/182.out
@@ -4,5 +4,5 @@ Starting QEMU
 
 Starting a second QEMU using the same image should fail
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=none,id=drive0,file.locking=on: Failed to get "write" lock
-Is another process using the image?
+Is another process using the image [TEST_DIR/t.qcow2]?
 *** done
diff --git a/tests/test-bdrv-drain.c b/tests/test-bdrv-drain.c
index c9f29c8b10..ee1740ff06 100644
--- a/tests/test-bdrv-drain.c
+++ b/tests/test-bdrv-drain.c
@@ -694,6 +694,8 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
     s->bh_indirection_ctx = ctx_b;
 
     aio_ret = -EINPROGRESS;
+    qemu_event_reset(&done_event);
+
     if (drain_thread == 0) {
         acb = blk_aio_preadv(blk, 0, &qiov, 0, test_iothread_aio_cb, &aio_ret);
     } else {
@@ -723,7 +725,6 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
          * but the drain in this thread can continue immediately after
          * bdrv_dec_in_flight() and aio_ret might be assigned only slightly
          * later. */
-        qemu_event_reset(&done_event);
         do_drain_begin(drain_type, bs);
         g_assert_cmpint(bs->in_flight, ==, 0);
 
@@ -743,7 +744,6 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
         }
         break;
     case 1:
-        qemu_event_reset(&done_event);
         aio_bh_schedule_oneshot(ctx_a, test_iothread_drain_entry, &data);
         qemu_event_wait(&done_event);
         break;
diff --git a/tests/test-replication.c b/tests/test-replication.c
index c8165ae954..f085d1993a 100644
--- a/tests/test-replication.c
+++ b/tests/test-replication.c
@@ -207,13 +207,17 @@ static BlockBackend *start_primary(void)
 static void teardown_primary(void)
 {
     BlockBackend *blk;
+    AioContext *ctx;
 
     /* remove P_ID */
     blk = blk_by_name(P_ID);
     assert(blk);
 
+    ctx = blk_get_aio_context(blk);
+    aio_context_acquire(ctx);
     monitor_remove_blk(blk);
     blk_unref(blk);
+    aio_context_release(ctx);
 }
 
 static void test_primary_read(void)
@@ -365,20 +369,27 @@ static void teardown_secondary(void)
 {
     /* only need to destroy two BBs */
     BlockBackend *blk;
+    AioContext *ctx;
 
     /* remove S_LOCAL_DISK_ID */
     blk = blk_by_name(S_LOCAL_DISK_ID);
     assert(blk);
 
+    ctx = blk_get_aio_context(blk);
+    aio_context_acquire(ctx);
     monitor_remove_blk(blk);
     blk_unref(blk);
+    aio_context_release(ctx);
 
     /* remove S_ID */
     blk = blk_by_name(S_ID);
     assert(blk);
 
+    ctx = blk_get_aio_context(blk);
+    aio_context_acquire(ctx);
     monitor_remove_blk(blk);
     blk_unref(blk);
+    aio_context_release(ctx);
 }
 
 static void test_secondary_read(void)