summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--.gitignore2
-rw-r--r--MAINTAINERS29
-rw-r--r--Makefile.objs1
-rw-r--r--block.c17
-rw-r--r--block/Makefile.objs3
-rw-r--r--block/backup.c59
-rw-r--r--block/curl.c25
-rw-r--r--block/linux-aio.c178
-rw-r--r--block/mirror.c13
-rw-r--r--block/qcow2-cluster.c4
-rw-r--r--block/qcow2.c5
-rw-r--r--block/qcow2.h1
-rw-r--r--block/replication.c659
-rw-r--r--block/sheepdog.c4
-rw-r--r--blockdev.c2
-rwxr-xr-xconfigure24
-rw-r--r--cpus.c7
-rw-r--r--disas.c2
-rw-r--r--disas/Makefile.objs1
-rw-r--r--disas/hppa.c2832
-rw-r--r--disas/sh4.c6
-rw-r--r--docs/block-replication.txt239
-rw-r--r--docs/throttle.txt5
-rw-r--r--fpu/softfloat.c116
-rw-r--r--hw/block/virtio-blk.c4
-rw-r--r--hw/bt/hci.c2
-rw-r--r--hw/dma/omap_dma.c2
-rw-r--r--hw/i386/kvm/i8259.c2
-rw-r--r--hw/i386/trace-events2
-rw-r--r--hw/misc/ivshmem.c1
-rw-r--r--hw/net/e1000e_core.c2
-rw-r--r--hw/nvram/fw_cfg.c4
-rw-r--r--hw/ppc/ppc405.h6
-rw-r--r--hw/s390x/sclp.c2
-rw-r--r--hw/s390x/virtio-ccw.h1
-rw-r--r--hw/scsi/mptsas.c4
-rw-r--r--hw/sh4/shix.c2
-rw-r--r--hw/tricore/tricore_testboard.c2
-rw-r--r--hw/usb/dev-mtp.c197
-rw-r--r--hw/usb/hcd-xhci.c9
-rw-r--r--hw/usb/host-libusb.c7
-rw-r--r--include/block/block.h6
-rw-r--r--include/block/block_backup.h39
-rw-r--r--include/block/block_int.h12
-rw-r--r--include/fpu/softfloat.h15
-rw-r--r--include/hw/arm/pxa.h1
-rw-r--r--include/hw/bt.h2
-rw-r--r--include/hw/i386/pc.h2
-rw-r--r--include/hw/pci-host/spapr.h2
-rw-r--r--include/hw/pci/pci_bridge.h1
-rw-r--r--include/hw/pci/pcie_port.h1
-rw-r--r--include/hw/ppc/ppc4xx.h6
-rw-r--r--include/hw/ppc/spapr.h3
-rw-r--r--include/hw/ppc/spapr_vio.h4
-rw-r--r--include/hw/scsi/scsi.h1
-rw-r--r--include/hw/virtio/virtio-bus.h3
-rw-r--r--include/migration/migration.h2
-rw-r--r--include/net/net.h2
-rw-r--r--include/qemu/bitmap.h4
-rw-r--r--include/qemu/timer.h25
-rw-r--r--include/qemu/uri.h2
-rw-r--r--include/sysemu/iothread.h1
-rw-r--r--include/sysemu/kvm.h2
-rw-r--r--include/ui/console.h2
-rw-r--r--include/ui/input.h2
-rw-r--r--include/ui/spice-display.h2
-rw-r--r--iothread.c24
-rw-r--r--linux-user/main.c2
-rw-r--r--linux-user/qemu.h4
-rw-r--r--linux-user/signal.c2
-rw-r--r--linux-user/syscall_defs.h4
-rw-r--r--qapi/block-core.json36
-rw-r--r--qemu-img.c2
-rw-r--r--qemu-options.hx2
-rw-r--r--qemu-tech.texi3
-rw-r--r--replication.c107
-rw-r--r--replication.h174
-rw-r--r--scripts/coccinelle/typecast.cocci7
-rw-r--r--target-alpha/cpu.h1
-rw-r--r--target-arm/helper.c2
-rw-r--r--target-m68k/cpu.h1
-rw-r--r--target-m68k/helper.c2
-rw-r--r--target-ppc/cpu.h2
-rw-r--r--target-ppc/mmu-hash64.h1
-rw-r--r--target-s390x/cpu.h2
-rw-r--r--target-sh4/README.sh42
-rw-r--r--target-sparc/cpu.c3
-rw-r--r--tcg/tcg.c2
-rw-r--r--tcg/tcg.h2
-rw-r--r--tcg/tci/README2
-rw-r--r--tests/.gitignore1
-rw-r--r--tests/Makefile.include4
-rw-r--r--tests/libqos/virtio.c6
-rw-r--r--tests/test-replication.c575
-rw-r--r--ui/cocoa.m107
-rw-r--r--ui/console.c1
-rw-r--r--vl.c5
97 files changed, 2630 insertions, 3083 deletions
diff --git a/.gitignore b/.gitignore
index 88ec2497b6..5ffc84ba9f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -53,6 +53,8 @@
 /qemu-bridge-helper
 /qemu-monitor.texi
 /qemu-monitor-info.texi
+/qemu-version.h
+/qemu-version.h.tmp
 /qmp-commands.txt
 /vscclient
 /fsdev/virtfs-proxy-helper
diff --git a/MAINTAINERS b/MAINTAINERS
index d48016653f..7d43026162 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -83,6 +83,7 @@ F: include/exec/cpu*.h
 F: include/exec/exec-all.h
 F: include/exec/helper*.h
 F: include/exec/tb-hash.h
+F: include/sysemu/cpus.h
 
 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
@@ -187,6 +188,7 @@ S: Odd Fixes
 F: target-sh4/
 F: hw/sh4/
 F: disas/sh4.c
+F: include/hw/sh4/
 
 SPARC
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
@@ -202,6 +204,7 @@ M: Guan Xuetao <gxt@mprc.pku.edu.cn>
 S: Maintained
 F: target-unicore32/
 F: hw/unicore32/
+F: include/hw/unicore32/
 
 X86
 M: Paolo Bonzini <pbonzini@redhat.com>
@@ -225,6 +228,7 @@ M: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
 S: Maintained
 F: target-tricore/
 F: hw/tricore/
+F: include/hw/tricore/
 
 Guest CPU Cores (KVM):
 ----------------------
@@ -456,7 +460,6 @@ S: Maintained
 F: hw/*/xilinx_*
 F: hw/*/cadence_*
 F: hw/misc/zynq_slcr.c
-F: include/hw/xilinx.h
 X: hw/ssi/xilinx_*
 
 Xilinx ZynqMP
@@ -465,7 +468,7 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
-F: include/hw/*/xlnx*.c
+F: include/hw/*/xlnx*.h
 
 ARM ACPI Subsystem
 M: Shannon Zhao <zhaoshenglong@huawei.com>
@@ -695,7 +698,7 @@ F: hw/i2c/smbus_ich9.c
 F: hw/acpi/piix4.c
 F: hw/acpi/ich9.c
 F: include/hw/acpi/ich9.h
-F: include/hw/acpi/piix.h
+F: include/hw/acpi/piix4.h
 F: hw/misc/sga.c
 
 PC Chipset
@@ -801,10 +804,8 @@ F: hw/mem/*
 F: hw/acpi/*
 F: hw/smbios/*
 F: hw/i386/acpi-build.[hc]
-F: hw/i386/*dsl
 F: hw/arm/virt-acpi-build.c
 F: include/hw/arm/virt-acpi-build.h
-F: scripts/acpi*py
 
 ppc4xx
 M: Alexander Graf <agraf@suse.de>
@@ -906,7 +907,6 @@ L: qemu-block@nongnu.org
 S: Supported
 F: hw/block/virtio-blk.c
 F: hw/block/dataplane/*
-F: hw/virtio/dataplane/*
 T: git git://github.com/stefanha/qemu.git block
 
 virtio-ccw
@@ -1068,12 +1068,6 @@ S: Supported
 F: qom/cpu.c
 F: include/qom/cpu.h
 
-ICC Bus
-M: Igor Mammedov <imammedo@redhat.com>
-S: Supported
-F: include/hw/cpu/icc_bus.h
-F: hw/cpu/icc_bus.c
-
 Device Tree
 M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alexander Graf <agraf@suse.de>
@@ -1589,7 +1583,7 @@ M: Kevin Wolf <kwolf@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/linux-aio.c
-F: block/raw-aio.h
+F: include/block/raw-aio.h
 F: block/raw-posix.c
 F: block/raw-win32.c
 F: block/raw_bsd.c
@@ -1633,6 +1627,15 @@ L: qemu-block@nongnu.org
 S: Supported
 F: tests/image-fuzzer/
 
+Replication
+M: Wen Congyang <wency@cn.fujitsu.com>
+M: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
+S: Supported
+F: replication*
+F: block/replication.c
+F: tests/test-replication.c
+F: docs/block-replication.txt
+
 Build and test automation
 -------------------------
 M: Alex Bennée <alex.bennee@linaro.org>
diff --git a/Makefile.objs b/Makefile.objs
index 6d5ddcfd3e..7301544cdd 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -15,6 +15,7 @@ block-obj-$(CONFIG_POSIX) += aio-posix.o
 block-obj-$(CONFIG_WIN32) += aio-win32.o
 block-obj-y += block/
 block-obj-y += qemu-io-cmds.o
+block-obj-$(CONFIG_REPLICATION) += replication.o
 
 block-obj-m = block/
 
diff --git a/block.c b/block.c
index 101f8c628f..66ed1c0321 100644
--- a/block.c
+++ b/block.c
@@ -1312,6 +1312,23 @@ void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd)
     /* Otherwise we won't be able to commit due to check in bdrv_commit */
     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
                     bs->backing_blocker);
+    /*
+     * We do backup in 3 ways:
+     * 1. drive backup
+     *    The target bs is new opened, and the source is top BDS
+     * 2. blockdev backup
+     *    Both the source and the target are top BDSes.
+     * 3. internal backup(used for block replication)
+     *    Both the source and the target are backing file
+     *
+     * In case 1 and 2, neither the source nor the target is the backing file.
+     * In case 3, we will block the top BDS, so there is only one block job
+     * for the top BDS and its backing chain.
+     */
+    bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
+                    bs->backing_blocker);
+    bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
+                    bs->backing_blocker);
 out:
     bdrv_refresh_limits(bs, NULL);
 }
diff --git a/block/Makefile.objs b/block/Makefile.objs
index 2593a2f8a6..55da6266fe 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -22,11 +22,12 @@ block-obj-$(CONFIG_ARCHIPELAGO) += archipelago.o
 block-obj-$(CONFIG_LIBSSH2) += ssh.o
 block-obj-y += accounting.o dirty-bitmap.o
 block-obj-y += write-threshold.o
+block-obj-y += backup.o
+block-obj-$(CONFIG_REPLICATION) += replication.o
 
 block-obj-y += crypto.o
 
 common-obj-y += stream.o
-common-obj-y += backup.o
 
 iscsi.o-cflags     := $(LIBISCSI_CFLAGS)
 iscsi.o-libs       := $(LIBISCSI_LIBS)
diff --git a/block/backup.c b/block/backup.c
index bb3bb9a9eb..582bd0f7ee 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -17,6 +17,7 @@
 #include "block/block.h"
 #include "block/block_int.h"
 #include "block/blockjob.h"
+#include "block/block_backup.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
@@ -27,13 +28,6 @@
 #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)
 #define SLICE_TIME 100000000ULL /* ns */
 
-typedef struct CowRequest {
-    int64_t start;
-    int64_t end;
-    QLIST_ENTRY(CowRequest) list;
-    CoQueue wait_queue; /* coroutines blocked on this request */
-} CowRequest;
-
 typedef struct BackupBlockJob {
     BlockJob common;
     BlockBackend *target;
@@ -255,6 +249,57 @@ static void backup_attached_aio_context(BlockJob *job, AioContext *aio_context)
     blk_set_aio_context(s->target, aio_context);
 }
 
+void backup_do_checkpoint(BlockJob *job, Error **errp)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t len;
+
+    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
+
+    if (backup_job->sync_mode != MIRROR_SYNC_MODE_NONE) {
+        error_setg(errp, "The backup job only supports block checkpoint in"
+                   " sync=none mode");
+        return;
+    }
+
+    len = DIV_ROUND_UP(backup_job->common.len, backup_job->cluster_size);
+    bitmap_zero(backup_job->done_bitmap, len);
+}
+
+void backup_wait_for_overlapping_requests(BlockJob *job, int64_t sector_num,
+                                          int nb_sectors)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
+    int64_t start, end;
+
+    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
+
+    start = sector_num / sectors_per_cluster;
+    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
+    wait_for_overlapping_requests(backup_job, start, end);
+}
+
+void backup_cow_request_begin(CowRequest *req, BlockJob *job,
+                              int64_t sector_num,
+                              int nb_sectors)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
+    int64_t start, end;
+
+    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
+
+    start = sector_num / sectors_per_cluster;
+    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
+    cow_request_begin(req, backup_job, start, end);
+}
+
+void backup_cow_request_end(CowRequest *req)
+{
+    cow_request_end(req);
+}
+
 static const BlockJobDriver backup_job_driver = {
     .instance_size          = sizeof(BackupBlockJob),
     .job_type               = BLOCK_JOB_TYPE_BACKUP,
diff --git a/block/curl.c b/block/curl.c
index 426fb4d674..571f24cac2 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -675,11 +675,28 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
     curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s);
     if (curl_easy_perform(state->curl))
         goto out;
-    curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d);
-    if (d)
-        s->len = (size_t)d;
-    else if(!s->len)
+    if (curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d)) {
         goto out;
+    }
+    /* Prior CURL 7.19.4 return value of 0 could mean that the file size is not
+     * know or the size is zero. From 7.19.4 CURL returns -1 if size is not
+     * known and zero if it is realy zero-length file. */
+#if LIBCURL_VERSION_NUM >= 0x071304
+    if (d < 0) {
+        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
+                "Server didn't report file size.");
+        goto out;
+    }
+#else
+    if (d <= 0) {
+        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
+                "Unknown file size or zero-length file.");
+        goto out;
+    }
+#endif
+
+    s->len = (size_t)d;
+
     if ((!strncasecmp(s->url, "http://", strlen("http://"))
         || !strncasecmp(s->url, "https://", strlen("https://")))
         && !s->accept_range) {
diff --git a/block/linux-aio.c b/block/linux-aio.c
index e906abebb3..d4e19d444c 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -59,7 +59,6 @@ struct LinuxAioState {
 
     /* I/O completion processing */
     QEMUBH *completion_bh;
-    struct io_event events[MAX_EVENTS];
     int event_idx;
     int event_max;
 };
@@ -95,64 +94,153 @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
 
     laiocb->ret = ret;
     if (laiocb->co) {
-        qemu_coroutine_enter(laiocb->co);
+        /* Jump and continue completion for foreign requests, don't do
+         * anything for current request, it will be completed shortly. */
+        if (laiocb->co != qemu_coroutine_self()) {
+            qemu_coroutine_enter(laiocb->co);
+        }
     } else {
         laiocb->common.cb(laiocb->common.opaque, ret);
         qemu_aio_unref(laiocb);
     }
 }
 
-/* The completion BH fetches completed I/O requests and invokes their
- * callbacks.
+/**
+ * aio_ring buffer which is shared between userspace and kernel.
  *
- * The function is somewhat tricky because it supports nested event loops, for
- * example when a request callback invokes aio_poll().  In order to do this,
- * the completion events array and index are kept in LinuxAioState.  The BH
- * reschedules itself as long as there are completions pending so it will
- * either be called again in a nested event loop or will be called after all
- * events have been completed.  When there are no events left to complete, the
- * BH returns without rescheduling.
+ * This copied from linux/fs/aio.c, common header does not exist
+ * but AIO exists for ages so we assume ABI is stable.
  */
-static void qemu_laio_completion_bh(void *opaque)
+struct aio_ring {
+    unsigned    id;    /* kernel internal index number */
+    unsigned    nr;    /* number of io_events */
+    unsigned    head;  /* Written to by userland or by kernel. */
+    unsigned    tail;
+
+    unsigned    magic;
+    unsigned    compat_features;
+    unsigned    incompat_features;
+    unsigned    header_length;  /* size of aio_ring */
+
+    struct io_event io_events[0];
+};
+
+/**
+ * io_getevents_peek:
+ * @ctx: AIO context
+ * @events: pointer on events array, output value
+
+ * Returns the number of completed events and sets a pointer
+ * on events array.  This function does not update the internal
+ * ring buffer, only reads head and tail.  When @events has been
+ * processed io_getevents_commit() must be called.
+ */
+static inline unsigned int io_getevents_peek(io_context_t ctx,
+                                             struct io_event **events)
 {
-    LinuxAioState *s = opaque;
+    struct aio_ring *ring = (struct aio_ring *)ctx;
+    unsigned int head = ring->head, tail = ring->tail;
+    unsigned int nr;
 
-    /* Fetch more completion events when empty */
-    if (s->event_idx == s->event_max) {
-        do {
-            struct timespec ts = { 0 };
-            s->event_max = io_getevents(s->ctx, MAX_EVENTS, MAX_EVENTS,
-                                        s->events, &ts);
-        } while (s->event_max == -EINTR);
-
-        s->event_idx = 0;
-        if (s->event_max <= 0) {
-            s->event_max = 0;
-            return; /* no more events */
-        }
-        s->io_q.in_flight -= s->event_max;
+    nr = tail >= head ? tail - head : ring->nr - head;
+    *events = ring->io_events + head;
+    /* To avoid speculative loads of s->events[i] before observing tail.
+       Paired with smp_wmb() inside linux/fs/aio.c: aio_complete(). */
+    smp_rmb();
+
+    return nr;
+}
+
+/**
+ * io_getevents_commit:
+ * @ctx: AIO context
+ * @nr: the number of events on which head should be advanced
+ *
+ * Advances head of a ring buffer.
+ */
+static inline void io_getevents_commit(io_context_t ctx, unsigned int nr)
+{
+    struct aio_ring *ring = (struct aio_ring *)ctx;
+
+    if (nr) {
+        ring->head = (ring->head + nr) % ring->nr;
     }
+}
+
+/**
+ * io_getevents_advance_and_peek:
+ * @ctx: AIO context
+ * @events: pointer on events array, output value
+ * @nr: the number of events on which head should be advanced
+ *
+ * Advances head of a ring buffer and returns number of elements left.
+ */
+static inline unsigned int
+io_getevents_advance_and_peek(io_context_t ctx,
+                              struct io_event **events,
+                              unsigned int nr)
+{
+    io_getevents_commit(ctx, nr);
+    return io_getevents_peek(ctx, events);
+}
+
+/**
+ * qemu_laio_process_completions:
+ * @s: AIO state
+ *
+ * Fetches completed I/O requests and invokes their callbacks.
+ *
+ * The function is somewhat tricky because it supports nested event loops, for
+ * example when a request callback invokes aio_poll().  In order to do this,
+ * indices are kept in LinuxAioState.  Function schedules BH completion so it
+ * can be called again in a nested event loop.  When there are no events left
+ * to complete the BH is being canceled.
+ */
+static void qemu_laio_process_completions(LinuxAioState *s)
+{
+    struct io_event *events;
 
     /* Reschedule so nested event loops see currently pending completions */
     qemu_bh_schedule(s->completion_bh);
 
-    /* Process completion events */
-    while (s->event_idx < s->event_max) {
-        struct iocb *iocb = s->events[s->event_idx].obj;
-        struct qemu_laiocb *laiocb =
+    while ((s->event_max = io_getevents_advance_and_peek(s->ctx, &events,
+                                                         s->event_idx))) {
+        for (s->event_idx = 0; s->event_idx < s->event_max; ) {
+            struct iocb *iocb = events[s->event_idx].obj;
+            struct qemu_laiocb *laiocb =
                 container_of(iocb, struct qemu_laiocb, iocb);
 
-        laiocb->ret = io_event_ret(&s->events[s->event_idx]);
-        s->event_idx++;
+            laiocb->ret = io_event_ret(&events[s->event_idx]);
 
-        qemu_laio_process_completion(laiocb);
+            /* Change counters one-by-one because we can be nested. */
+            s->io_q.in_flight--;
+            s->event_idx++;
+            qemu_laio_process_completion(laiocb);
+        }
     }
 
+    qemu_bh_cancel(s->completion_bh);
+
+    /* If we are nested we have to notify the level above that we are done
+     * by setting event_max to zero, upper level will then jump out of it's
+     * own `for` loop.  If we are the last all counters droped to zero. */
+    s->event_max = 0;
+    s->event_idx = 0;
+}
+
+static void qemu_laio_process_completions_and_submit(LinuxAioState *s)
+{
+    qemu_laio_process_completions(s);
     if (!s->io_q.plugged && !QSIMPLEQ_EMPTY(&s->io_q.pending)) {
         ioq_submit(s);
     }
+}
 
-    qemu_bh_cancel(s->completion_bh);
+static void qemu_laio_completion_bh(void *opaque)
+{
+    LinuxAioState *s = opaque;
+
+    qemu_laio_process_completions_and_submit(s);
 }
 
 static void qemu_laio_completion_cb(EventNotifier *e)
@@ -160,7 +248,7 @@ static void qemu_laio_completion_cb(EventNotifier *e)
     LinuxAioState *s = container_of(e, LinuxAioState, e);
 
     if (event_notifier_test_and_clear(&s->e)) {
-        qemu_laio_completion_bh(s);
+        qemu_laio_process_completions_and_submit(s);
     }
 }
 
@@ -236,6 +324,19 @@ static void ioq_submit(LinuxAioState *s)
         QSIMPLEQ_SPLIT_AFTER(&s->io_q.pending, aiocb, next, &completed);
     } while (ret == len && !QSIMPLEQ_EMPTY(&s->io_q.pending));
     s->io_q.blocked = (s->io_q.in_queue > 0);
+
+    if (s->io_q.in_flight) {
+        /* We can try to complete something just right away if there are
+         * still requests in-flight. */
+        qemu_laio_process_completions(s);
+        /*
+         * Even we have completed everything (in_flight == 0), the queue can
+         * have still pended requests (in_queue > 0).  We do not attempt to
+         * repeat submission to avoid IO hang.  The reason is simple: s->e is
+         * still set and completion callback will be called shortly and all
+         * pended requests will be submitted from there.
+         */
+    }
 }
 
 void laio_io_plug(BlockDriverState *bs, LinuxAioState *s)
@@ -293,6 +394,7 @@ int coroutine_fn laio_co_submit(BlockDriverState *bs, LinuxAioState *s, int fd,
         .co         = qemu_coroutine_self(),
         .nbytes     = qiov->size,
         .ctx        = s,
+        .ret        = -EINPROGRESS,
         .is_read    = (type == QEMU_AIO_READ),
         .qiov       = qiov,
     };
@@ -302,7 +404,9 @@ int coroutine_fn laio_co_submit(BlockDriverState *bs, LinuxAioState *s, int fd,
         return ret;
     }
 
-    qemu_coroutine_yield();
+    if (laiocb.ret == -EINPROGRESS) {
+        qemu_coroutine_yield();
+    }
     return laiocb.ret;
 }
 
diff --git a/block/mirror.c b/block/mirror.c
index e0b3f4180f..f9d1fecaa0 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -916,7 +916,8 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
                              BlockCompletionFunc *cb,
                              void *opaque, Error **errp,
                              const BlockJobDriver *driver,
-                             bool is_none_mode, BlockDriverState *base)
+                             bool is_none_mode, BlockDriverState *base,
+                             bool auto_complete)
 {
     MirrorBlockJob *s;
 
@@ -952,6 +953,9 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
     s->granularity = granularity;
     s->buf_size = ROUND_UP(buf_size, granularity);
     s->unmap = unmap;
+    if (auto_complete) {
+        s->should_complete = true;
+    }
 
     s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, NULL, errp);
     if (!s->dirty_bitmap) {
@@ -990,14 +994,15 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
     mirror_start_job(job_id, bs, target, replaces,
                      speed, granularity, buf_size, backing_mode,
                      on_source_error, on_target_error, unmap, cb, opaque, errp,
-                     &mirror_job_driver, is_none_mode, base);
+                     &mirror_job_driver, is_none_mode, base, false);
 }
 
 void commit_active_start(const char *job_id, BlockDriverState *bs,
                          BlockDriverState *base, int64_t speed,
                          BlockdevOnError on_error,
                          BlockCompletionFunc *cb,
-                         void *opaque, Error **errp)
+                         void *opaque, Error **errp,
+                         bool auto_complete)
 {
     int64_t length, base_length;
     int orig_base_flags;
@@ -1038,7 +1043,7 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
     mirror_start_job(job_id, bs, base, NULL, speed, 0, 0,
                      MIRROR_LEAVE_BACKING_CHAIN,
                      on_error, on_error, false, cb, opaque, &local_err,
-                     &commit_active_job_driver, false, base);
+                     &commit_active_job_driver, false, base, auto_complete);
     if (local_err) {
         error_propagate(errp, local_err);
         goto error_restore_flags;
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index f94183529c..9ab445dd17 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -83,7 +83,9 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
     }
     memset(new_l1_table, 0, align_offset(new_l1_size2, 512));
 
-    memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
+    if (s->l1_size) {
+        memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
+    }
 
     /* write new table (align to cluster) */
     BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);
diff --git a/block/qcow2.c b/block/qcow2.c
index c079aa83b6..0e53a4d666 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1804,7 +1804,10 @@ static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
         .magic  = cpu_to_be32(magic),
         .len    = cpu_to_be32(len),
     };
-    memcpy(buf + sizeof(QCowExtension), s, len);
+
+    if (len) {
+        memcpy(buf + sizeof(QCowExtension), s, len);
+    }
 
     return ext_len;
 }
diff --git a/block/qcow2.h b/block/qcow2.h
index b36a7bf8ad..9ce5a37d3a 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -530,7 +530,6 @@ int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,
 int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
                         bool exact_size);
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
-void qcow2_l2_cache_reset(BlockDriverState *bs);
 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
                           uint8_t *out_buf, const uint8_t *in_buf,
diff --git a/block/replication.c b/block/replication.c
new file mode 100644
index 0000000000..3bd1cf1809
--- /dev/null
+++ b/block/replication.c
@@ -0,0 +1,659 @@
+/*
+ * Replication Block filter
+ *
+ * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
+ * Copyright (c) 2016 Intel Corporation
+ * Copyright (c) 2016 FUJITSU LIMITED
+ *
+ * Author:
+ *   Wen Congyang <wency@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "block/nbd.h"
+#include "block/blockjob.h"
+#include "block/block_int.h"
+#include "block/block_backup.h"
+#include "sysemu/block-backend.h"
+#include "qapi/error.h"
+#include "replication.h"
+
+typedef struct BDRVReplicationState {
+    ReplicationMode mode;
+    int replication_state;
+    BdrvChild *active_disk;
+    BdrvChild *hidden_disk;
+    BdrvChild *secondary_disk;
+    char *top_id;
+    ReplicationState *rs;
+    Error *blocker;
+    int orig_hidden_flags;
+    int orig_secondary_flags;
+    int error;
+} BDRVReplicationState;
+
+enum {
+    BLOCK_REPLICATION_NONE,             /* block replication is not started */
+    BLOCK_REPLICATION_RUNNING,          /* block replication is running */
+    BLOCK_REPLICATION_FAILOVER,         /* failover is running in background */
+    BLOCK_REPLICATION_FAILOVER_FAILED,  /* failover failed */
+    BLOCK_REPLICATION_DONE,             /* block replication is done */
+};
+
+static void replication_start(ReplicationState *rs, ReplicationMode mode,
+                              Error **errp);
+static void replication_do_checkpoint(ReplicationState *rs, Error **errp);
+static void replication_get_error(ReplicationState *rs, Error **errp);
+static void replication_stop(ReplicationState *rs, bool failover,
+                             Error **errp);
+
+#define REPLICATION_MODE        "mode"
+#define REPLICATION_TOP_ID      "top-id"
+static QemuOptsList replication_runtime_opts = {
+    .name = "replication",
+    .head = QTAILQ_HEAD_INITIALIZER(replication_runtime_opts.head),
+    .desc = {
+        {
+            .name = REPLICATION_MODE,
+            .type = QEMU_OPT_STRING,
+        },
+        {
+            .name = REPLICATION_TOP_ID,
+            .type = QEMU_OPT_STRING,
+        },
+        { /* end of list */ }
+    },
+};
+
+static ReplicationOps replication_ops = {
+    .start = replication_start,
+    .checkpoint = replication_do_checkpoint,
+    .get_error = replication_get_error,
+    .stop = replication_stop,
+};
+
+static int replication_open(BlockDriverState *bs, QDict *options,
+                            int flags, Error **errp)
+{
+    int ret;
+    BDRVReplicationState *s = bs->opaque;
+    Error *local_err = NULL;
+    QemuOpts *opts = NULL;
+    const char *mode;
+    const char *top_id;
+
+    ret = -EINVAL;
+    opts = qemu_opts_create(&replication_runtime_opts, NULL, 0, &error_abort);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (local_err) {
+        goto fail;
+    }
+
+    mode = qemu_opt_get(opts, REPLICATION_MODE);
+    if (!mode) {
+        error_setg(&local_err, "Missing the option mode");
+        goto fail;
+    }
+
+    if (!strcmp(mode, "primary")) {
+        s->mode = REPLICATION_MODE_PRIMARY;
+    } else if (!strcmp(mode, "secondary")) {
+        s->mode = REPLICATION_MODE_SECONDARY;
+        top_id = qemu_opt_get(opts, REPLICATION_TOP_ID);
+        s->top_id = g_strdup(top_id);
+        if (!s->top_id) {
+            error_setg(&local_err, "Missing the option top-id");
+            goto fail;
+        }
+    } else {
+        error_setg(&local_err,
+                   "The option mode's value should be primary or secondary");
+        goto fail;
+    }
+
+    s->rs = replication_new(bs, &replication_ops);
+
+    ret = 0;
+
+fail:
+    qemu_opts_del(opts);
+    error_propagate(errp, local_err);
+
+    return ret;
+}
+
+static void replication_close(BlockDriverState *bs)
+{
+    BDRVReplicationState *s = bs->opaque;
+
+    if (s->replication_state == BLOCK_REPLICATION_RUNNING) {
+        replication_stop(s->rs, false, NULL);
+    }
+
+    if (s->mode == REPLICATION_MODE_SECONDARY) {
+        g_free(s->top_id);
+    }
+
+    replication_remove(s->rs);
+}
+
+static int64_t replication_getlength(BlockDriverState *bs)
+{
+    return bdrv_getlength(bs->file->bs);
+}
+
+static int replication_get_io_status(BDRVReplicationState *s)
+{
+    switch (s->replication_state) {
+    case BLOCK_REPLICATION_NONE:
+        return -EIO;
+    case BLOCK_REPLICATION_RUNNING:
+        return 0;
+    case BLOCK_REPLICATION_FAILOVER:
+        return s->mode == REPLICATION_MODE_PRIMARY ? -EIO : 0;
+    case BLOCK_REPLICATION_FAILOVER_FAILED:
+        return s->mode == REPLICATION_MODE_PRIMARY ? -EIO : 1;
+    case BLOCK_REPLICATION_DONE:
+        /*
+         * active commit job completes, and active disk and secondary_disk
+         * is swapped, so we can operate bs->file directly
+         */
+        return s->mode == REPLICATION_MODE_PRIMARY ? -EIO : 0;
+    default:
+        abort();
+    }
+}
+
+static int replication_return_value(BDRVReplicationState *s, int ret)
+{
+    if (s->mode == REPLICATION_MODE_SECONDARY) {
+        return ret;
+    }
+
+    if (ret < 0) {
+        s->error = ret;
+        ret = 0;
+    }
+
+    return ret;
+}
+
+static coroutine_fn int replication_co_readv(BlockDriverState *bs,
+                                             int64_t sector_num,
+                                             int remaining_sectors,
+                                             QEMUIOVector *qiov)
+{
+    BDRVReplicationState *s = bs->opaque;
+    BdrvChild *child = s->secondary_disk;
+    BlockJob *job = NULL;
+    CowRequest req;
+    int ret;
+
+    if (s->mode == REPLICATION_MODE_PRIMARY) {
+        /* We only use it to forward primary write requests */
+        return -EIO;
+    }
+
+    ret = replication_get_io_status(s);
+    if (ret < 0) {
+        return ret;
+    }
+
+    if (child && child->bs) {
+        job = child->bs->job;
+    }
+
+    if (job) {
+        backup_wait_for_overlapping_requests(child->bs->job, sector_num,
+                                             remaining_sectors);
+        backup_cow_request_begin(&req, child->bs->job, sector_num,
+                                 remaining_sectors);
+        ret = bdrv_co_readv(bs->file, sector_num, remaining_sectors,
+                            qiov);
+        backup_cow_request_end(&req);
+        goto out;
+    }
+
+    ret = bdrv_co_readv(bs->file, sector_num, remaining_sectors, qiov);
+out:
+    return replication_return_value(s, ret);
+}
+
+static coroutine_fn int replication_co_writev(BlockDriverState *bs,
+                                              int64_t sector_num,
+                                              int remaining_sectors,
+                                              QEMUIOVector *qiov)
+{
+    BDRVReplicationState *s = bs->opaque;
+    QEMUIOVector hd_qiov;
+    uint64_t bytes_done = 0;
+    BdrvChild *top = bs->file;
+    BdrvChild *base = s->secondary_disk;
+    BdrvChild *target;
+    int ret, n;
+
+    ret = replication_get_io_status(s);
+    if (ret < 0) {
+        goto out;
+    }
+
+    if (ret == 0) {
+        ret = bdrv_co_writev(top, sector_num,
+                             remaining_sectors, qiov);
+        return replication_return_value(s, ret);
+    }
+
+    /*
+     * Failover failed, only write to active disk if the sectors
+     * have already been allocated in active disk/hidden disk.
+     */
+    qemu_iovec_init(&hd_qiov, qiov->niov);
+    while (remaining_sectors > 0) {
+        ret = bdrv_is_allocated_above(top->bs, base->bs, sector_num,
+                                      remaining_sectors, &n);
+        if (ret < 0) {
+            goto out1;
+        }
+
+        qemu_iovec_reset(&hd_qiov);
+        qemu_iovec_concat(&hd_qiov, qiov, bytes_done, n * BDRV_SECTOR_SIZE);
+
+        target = ret ? top : base;
+        ret = bdrv_co_writev(target, sector_num, n, &hd_qiov);
+        if (ret < 0) {
+            goto out1;
+        }
+
+        remaining_sectors -= n;
+        sector_num += n;
+        bytes_done += n * BDRV_SECTOR_SIZE;
+    }
+
+out1:
+    qemu_iovec_destroy(&hd_qiov);
+out:
+    return ret;
+}
+
+static bool replication_recurse_is_first_non_filter(BlockDriverState *bs,
+                                                    BlockDriverState *candidate)
+{
+    return bdrv_recurse_is_first_non_filter(bs->file->bs, candidate);
+}
+
+static void secondary_do_checkpoint(BDRVReplicationState *s, Error **errp)
+{
+    Error *local_err = NULL;
+    int ret;
+
+    if (!s->secondary_disk->bs->job) {
+        error_setg(errp, "Backup job was cancelled unexpectedly");
+        return;
+    }
+
+    backup_do_checkpoint(s->secondary_disk->bs->job, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    ret = s->active_disk->bs->drv->bdrv_make_empty(s->active_disk->bs);
+    if (ret < 0) {
+        error_setg(errp, "Cannot make active disk empty");
+        return;
+    }
+
+    ret = s->hidden_disk->bs->drv->bdrv_make_empty(s->hidden_disk->bs);
+    if (ret < 0) {
+        error_setg(errp, "Cannot make hidden disk empty");
+        return;
+    }
+}
+
+static void reopen_backing_file(BDRVReplicationState *s, bool writable,
+                                Error **errp)
+{
+    BlockReopenQueue *reopen_queue = NULL;
+    int orig_hidden_flags, orig_secondary_flags;
+    int new_hidden_flags, new_secondary_flags;
+    Error *local_err = NULL;
+
+    if (writable) {
+        orig_hidden_flags = s->orig_hidden_flags =
+                                bdrv_get_flags(s->hidden_disk->bs);
+        new_hidden_flags = (orig_hidden_flags | BDRV_O_RDWR) &
+                                                    ~BDRV_O_INACTIVE;
+        orig_secondary_flags = s->orig_secondary_flags =
+                                bdrv_get_flags(s->secondary_disk->bs);
+        new_secondary_flags = (orig_secondary_flags | BDRV_O_RDWR) &
+                                                     ~BDRV_O_INACTIVE;
+    } else {
+        orig_hidden_flags = (s->orig_hidden_flags | BDRV_O_RDWR) &
+                                                    ~BDRV_O_INACTIVE;
+        new_hidden_flags = s->orig_hidden_flags;
+        orig_secondary_flags = (s->orig_secondary_flags | BDRV_O_RDWR) &
+                                                    ~BDRV_O_INACTIVE;
+        new_secondary_flags = s->orig_secondary_flags;
+    }
+
+    if (orig_hidden_flags != new_hidden_flags) {
+        reopen_queue = bdrv_reopen_queue(reopen_queue, s->hidden_disk->bs, NULL,
+                                         new_hidden_flags);
+    }
+
+    if (!(orig_secondary_flags & BDRV_O_RDWR)) {
+        reopen_queue = bdrv_reopen_queue(reopen_queue, s->secondary_disk->bs,
+                                         NULL, new_secondary_flags);
+    }
+
+    if (reopen_queue) {
+        bdrv_reopen_multiple(reopen_queue, &local_err);
+        error_propagate(errp, local_err);
+    }
+}
+
+static void backup_job_cleanup(BDRVReplicationState *s)
+{
+    BlockDriverState *top_bs;
+
+    top_bs = bdrv_lookup_bs(s->top_id, s->top_id, NULL);
+    if (!top_bs) {
+        return;
+    }
+    bdrv_op_unblock_all(top_bs, s->blocker);
+    error_free(s->blocker);
+    reopen_backing_file(s, false, NULL);
+}
+
+static void backup_job_completed(void *opaque, int ret)
+{
+    BDRVReplicationState *s = opaque;
+
+    if (s->replication_state != BLOCK_REPLICATION_FAILOVER) {
+        /* The backup job is cancelled unexpectedly */
+        s->error = -EIO;
+    }
+
+    backup_job_cleanup(s);
+}
+
+static bool check_top_bs(BlockDriverState *top_bs, BlockDriverState *bs)
+{
+    BdrvChild *child;
+
+    /* The bs itself is the top_bs */
+    if (top_bs == bs) {
+        return true;
+    }
+
+    /* Iterate over top_bs's children */
+    QLIST_FOREACH(child, &top_bs->children, next) {
+        if (child->bs == bs || check_top_bs(child->bs, bs)) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static void replication_start(ReplicationState *rs, ReplicationMode mode,
+                              Error **errp)
+{
+    BlockDriverState *bs = rs->opaque;
+    BDRVReplicationState *s;
+    BlockDriverState *top_bs;
+    int64_t active_length, hidden_length, disk_length;
+    AioContext *aio_context;
+    Error *local_err = NULL;
+
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+    s = bs->opaque;
+
+    if (s->replication_state != BLOCK_REPLICATION_NONE) {
+        error_setg(errp, "Block replication is running or done");
+        aio_context_release(aio_context);
+        return;
+    }
+
+    if (s->mode != mode) {
+        error_setg(errp, "The parameter mode's value is invalid, needs %d,"
+                   " but got %d", s->mode, mode);
+        aio_context_release(aio_context);
+        return;
+    }
+
+    switch (s->mode) {
+    case REPLICATION_MODE_PRIMARY:
+        break;
+    case REPLICATION_MODE_SECONDARY:
+        s->active_disk = bs->file;
+        if (!s->active_disk || !s->active_disk->bs ||
+                                    !s->active_disk->bs->backing) {
+            error_setg(errp, "Active disk doesn't have backing file");
+            aio_context_release(aio_context);
+            return;
+        }
+
+        s->hidden_disk = s->active_disk->bs->backing;
+        if (!s->hidden_disk->bs || !s->hidden_disk->bs->backing) {
+            error_setg(errp, "Hidden disk doesn't have backing file");
+            aio_context_release(aio_context);
+            return;
+        }
+
+        s->secondary_disk = s->hidden_disk->bs->backing;
+        if (!s->secondary_disk->bs || !bdrv_has_blk(s->secondary_disk->bs)) {
+            error_setg(errp, "The secondary disk doesn't have block backend");
+            aio_context_release(aio_context);
+            return;
+        }
+
+        /* verify the length */
+        active_length = bdrv_getlength(s->active_disk->bs);
+        hidden_length = bdrv_getlength(s->hidden_disk->bs);
+        disk_length = bdrv_getlength(s->secondary_disk->bs);
+        if (active_length < 0 || hidden_length < 0 || disk_length < 0 ||
+            active_length != hidden_length || hidden_length != disk_length) {
+            error_setg(errp, "Active disk, hidden disk, secondary disk's length"
+                       " are not the same");
+            aio_context_release(aio_context);
+            return;
+        }
+
+        if (!s->active_disk->bs->drv->bdrv_make_empty ||
+            !s->hidden_disk->bs->drv->bdrv_make_empty) {
+            error_setg(errp,
+                       "Active disk or hidden disk doesn't support make_empty");
+            aio_context_release(aio_context);
+            return;
+        }
+
+        /* reopen the backing file in r/w mode */
+        reopen_backing_file(s, true, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            aio_context_release(aio_context);
+            return;
+        }
+
+        /* start backup job now */
+        error_setg(&s->blocker,
+                   "Block device is in use by internal backup job");
+
+        top_bs = bdrv_lookup_bs(s->top_id, s->top_id, NULL);
+        if (!top_bs || !bdrv_is_root_node(top_bs) ||
+            !check_top_bs(top_bs, bs)) {
+            error_setg(errp, "No top_bs or it is invalid");
+            reopen_backing_file(s, false, NULL);
+            aio_context_release(aio_context);
+            return;
+        }
+        bdrv_op_block_all(top_bs, s->blocker);
+        bdrv_op_unblock(top_bs, BLOCK_OP_TYPE_DATAPLANE, s->blocker);
+
+        backup_start("replication-backup", s->secondary_disk->bs,
+                     s->hidden_disk->bs, 0, MIRROR_SYNC_MODE_NONE, NULL, false,
+                     BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
+                     backup_job_completed, s, NULL, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            backup_job_cleanup(s);
+            aio_context_release(aio_context);
+            return;
+        }
+        break;
+    default:
+        aio_context_release(aio_context);
+        abort();
+    }
+
+    s->replication_state = BLOCK_REPLICATION_RUNNING;
+
+    if (s->mode == REPLICATION_MODE_SECONDARY) {
+        secondary_do_checkpoint(s, errp);
+    }
+
+    s->error = 0;
+    aio_context_release(aio_context);
+}
+
+static void replication_do_checkpoint(ReplicationState *rs, Error **errp)
+{
+    BlockDriverState *bs = rs->opaque;
+    BDRVReplicationState *s;
+    AioContext *aio_context;
+
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+    s = bs->opaque;
+
+    if (s->mode == REPLICATION_MODE_SECONDARY) {
+        secondary_do_checkpoint(s, errp);
+    }
+    aio_context_release(aio_context);
+}
+
+static void replication_get_error(ReplicationState *rs, Error **errp)
+{
+    BlockDriverState *bs = rs->opaque;
+    BDRVReplicationState *s;
+    AioContext *aio_context;
+
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+    s = bs->opaque;
+
+    if (s->replication_state != BLOCK_REPLICATION_RUNNING) {
+        error_setg(errp, "Block replication is not running");
+        aio_context_release(aio_context);
+        return;
+    }
+
+    if (s->error) {
+        error_setg(errp, "I/O error occurred");
+        aio_context_release(aio_context);
+        return;
+    }
+    aio_context_release(aio_context);
+}
+
+static void replication_done(void *opaque, int ret)
+{
+    BlockDriverState *bs = opaque;
+    BDRVReplicationState *s = bs->opaque;
+
+    if (ret == 0) {
+        s->replication_state = BLOCK_REPLICATION_DONE;
+
+        /* refresh top bs's filename */
+        bdrv_refresh_filename(bs);
+        s->active_disk = NULL;
+        s->secondary_disk = NULL;
+        s->hidden_disk = NULL;
+        s->error = 0;
+    } else {
+        s->replication_state = BLOCK_REPLICATION_FAILOVER_FAILED;
+        s->error = -EIO;
+    }
+}
+
+static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
+{
+    BlockDriverState *bs = rs->opaque;
+    BDRVReplicationState *s;
+    AioContext *aio_context;
+
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+    s = bs->opaque;
+
+    if (s->replication_state != BLOCK_REPLICATION_RUNNING) {
+        error_setg(errp, "Block replication is not running");
+        aio_context_release(aio_context);
+        return;
+    }
+
+    switch (s->mode) {
+    case REPLICATION_MODE_PRIMARY:
+        s->replication_state = BLOCK_REPLICATION_DONE;
+        s->error = 0;
+        break;
+    case REPLICATION_MODE_SECONDARY:
+        /*
+         * This BDS will be closed, and the job should be completed
+         * before the BDS is closed, because we will access hidden
+         * disk, secondary disk in backup_job_completed().
+         */
+        if (s->secondary_disk->bs->job) {
+            block_job_cancel_sync(s->secondary_disk->bs->job);
+        }
+
+        if (!failover) {
+            secondary_do_checkpoint(s, errp);
+            s->replication_state = BLOCK_REPLICATION_DONE;
+            aio_context_release(aio_context);
+            return;
+        }
+
+        s->replication_state = BLOCK_REPLICATION_FAILOVER;
+        commit_active_start("replication-commit", s->active_disk->bs,
+                            s->secondary_disk->bs, 0, BLOCKDEV_ON_ERROR_REPORT,
+                            replication_done,
+                            bs, errp, true);
+        break;
+    default:
+        aio_context_release(aio_context);
+        abort();
+    }
+    aio_context_release(aio_context);
+}
+
+BlockDriver bdrv_replication = {
+    .format_name                = "replication",
+    .protocol_name              = "replication",
+    .instance_size              = sizeof(BDRVReplicationState),
+
+    .bdrv_open                  = replication_open,
+    .bdrv_close                 = replication_close,
+
+    .bdrv_getlength             = replication_getlength,
+    .bdrv_co_readv              = replication_co_readv,
+    .bdrv_co_writev             = replication_co_writev,
+
+    .is_filter                  = true,
+    .bdrv_recurse_is_first_non_filter = replication_recurse_is_first_non_filter,
+
+    .has_variable_length        = true,
+};
+
+static void bdrv_replication_init(void)
+{
+    bdrv_register(&bdrv_replication);
+}
+
+block_init(bdrv_replication_init);
diff --git a/block/sheepdog.c b/block/sheepdog.c
index 66e1cb2b2d..ccbf7e1fa6 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1049,7 +1049,7 @@ static int parse_vdiname(BDRVSheepdogState *s, const char *filename,
     const char *host_spec, *vdi_spec;
     int nr_sep, ret;
 
-    strstart(filename, "sheepdog:", (const char **)&filename);
+    strstart(filename, "sheepdog:", &filename);
     p = q = g_strdup(filename);
 
     /* count the number of separators */
@@ -2652,7 +2652,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
     req.opcode = SD_OP_READ_VDIS;
     req.data_length = max;
 
-    ret = do_req(fd, s->aio_context, (SheepdogReq *)&req,
+    ret = do_req(fd, s->aio_context, &req,
                  vdi_inuse, &wlen, &rlen);
 
     closesocket(fd);
diff --git a/blockdev.c b/blockdev.c
index c3b05934d7..301039392c 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -3090,7 +3090,7 @@ void qmp_block_commit(bool has_job_id, const char *job_id, const char *device,
             goto out;
         }
         commit_active_start(has_job_id ? job_id : NULL, bs, base_bs, speed,
-                            on_error, block_job_cb, bs, &local_err);
+                            on_error, block_job_cb, bs, &local_err, false);
     } else {
         commit_start(has_job_id ? job_id : NULL, bs, base_bs, top_bs, speed,
                      on_error, block_job_cb, bs,
diff --git a/configure b/configure
index 7e09b79fe5..7d083bdd85 100755
--- a/configure
+++ b/configure
@@ -321,6 +321,7 @@ vhdx=""
 numa=""
 tcmalloc="no"
 jemalloc="no"
+replication="yes"
 
 # parse CC options first
 for opt do
@@ -389,7 +390,11 @@ sdl2_config="${SDL2_CONFIG-${cross_prefix}sdl2-config}"
 ARFLAGS="${ARFLAGS-rv}"
 
 # default flags for all hosts
-QEMU_CFLAGS="-fno-strict-aliasing -fno-common $QEMU_CFLAGS"
+# We use -fwrapv to tell the compiler that we require a C dialect where
+# left shift of signed integers is well defined and has the expected
+# 2s-complement style results. (Both clang and gcc agree that it
+# provides these semantics.)
+QEMU_CFLAGS="-fno-strict-aliasing -fno-common -fwrapv $QEMU_CFLAGS"
 QEMU_CFLAGS="-Wall -Wundef -Wwrite-strings -Wmissing-prototypes $QEMU_CFLAGS"
 QEMU_CFLAGS="-Wstrict-prototypes -Wredundant-decls $QEMU_CFLAGS"
 QEMU_CFLAGS="-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE $QEMU_CFLAGS"
@@ -506,8 +511,6 @@ elif check_define __arm__ ; then
   cpu="arm"
 elif check_define __aarch64__ ; then
   cpu="aarch64"
-elif check_define __hppa__ ; then
-  cpu="hppa"
 else
   cpu=$(uname -m)
 fi
@@ -1156,6 +1159,10 @@ for opt do
   ;;
   --enable-jemalloc) jemalloc="yes"
   ;;
+  --disable-replication) replication="no"
+  ;;
+  --enable-replication) replication="yes"
+  ;;
   *)
       echo "ERROR: unknown option $opt"
       echo "Try '$0 --help' for more information"
@@ -1386,6 +1393,7 @@ disabled with --disable-FEATURE, default is enabled if available:
   numa            libnuma support
   tcmalloc        tcmalloc support
   jemalloc        jemalloc support
+  replication     replication support
 
 NOTE: The object files are built at the place where configure is launched
 EOF
@@ -3006,7 +3014,7 @@ fi
 
 # g_test_trap_subprocess added in 2.38. Used by some tests.
 glib_subprocess=yes
-if ! $pkg_config --atleast-version=2.38 glib-2.0; then
+if test "$mingw32" = "yes" || ! $pkg_config --atleast-version=2.38 glib-2.0; then
     glib_subprocess=no
 fi
 
@@ -4918,6 +4926,7 @@ echo "NUMA host support $numa"
 echo "tcmalloc support  $tcmalloc"
 echo "jemalloc support  $jemalloc"
 echo "avx2 optimization $avx2_opt"
+echo "replication support $replication"
 
 if test "$sdl_too_old" = "yes"; then
 echo "-> Your SDL version is too old - please upgrade to have SDL support"
@@ -5498,6 +5507,10 @@ if test "$have_rtnetlink" = "yes" ; then
   echo "CONFIG_RTNETLINK=y" >> $config_host_mak
 fi
 
+if test "$replication" = "yes" ; then
+  echo "CONFIG_REPLICATION=y" >> $config_host_mak
+fi
+
 # Hold two types of flag:
 #   CONFIG_THREAD_SETNAME_BYTHREAD  - we've got a way of setting the name on
 #                                     a thread we have a handle to
@@ -5884,9 +5897,6 @@ for i in $ARCH $TARGET_BASE_ARCH ; do
   cris)
     disas_config "CRIS"
   ;;
-  hppa)
-    disas_config "HPPA"
-  ;;
   i386|x86_64|x32)
     disas_config "I386"
   ;;
diff --git a/cpus.c b/cpus.c
index 030843132f..e39ccb7f30 100644
--- a/cpus.c
+++ b/cpus.c
@@ -234,7 +234,8 @@ static int64_t cpu_get_clock_locked(void)
 }
 
 /* Return the monotonic time elapsed in VM, i.e.,
- * the time between vm_start and vm_stop */
+ * the time between vm_start and vm_stop
+ */
 int64_t cpu_get_clock(void)
 {
     int64_t ti;
@@ -249,7 +250,7 @@ int64_t cpu_get_clock(void)
 }
 
 /* enable cpu_get_ticks()
- * Caller must hold BQL which server as mutex for vm_clock_seqlock.
+ * Caller must hold BQL which serves as mutex for vm_clock_seqlock.
  */
 void cpu_enable_ticks(void)
 {
@@ -265,7 +266,7 @@ void cpu_enable_ticks(void)
 
 /* disable cpu_get_ticks() : the clock is stopped. You must not call
  * cpu_get_ticks() after that.
- * Caller must hold BQL which server as mutex for vm_clock_seqlock.
+ * Caller must hold BQL which serves as mutex for vm_clock_seqlock.
  */
 void cpu_disable_ticks(void)
 {
diff --git a/disas.c b/disas.c
index 05a7a1260a..67f116a19b 100644
--- a/disas.c
+++ b/disas.c
@@ -310,8 +310,6 @@ void disas(FILE *out, void *code, unsigned long size)
     print_insn = print_insn_m68k;
 #elif defined(__s390__)
     print_insn = print_insn_s390;
-#elif defined(__hppa__)
-    print_insn = print_insn_hppa;
 #elif defined(__ia64__)
     print_insn = print_insn_ia64;
 #endif
diff --git a/disas/Makefile.objs b/disas/Makefile.objs
index abeba84661..09bc992883 100644
--- a/disas/Makefile.objs
+++ b/disas/Makefile.objs
@@ -9,7 +9,6 @@ libvixldir = $(SRC_PATH)/disas/libvixl
 # versions do not.
 arm-a64.o-cflags := -I$(libvixldir) -Wno-sign-compare
 common-obj-$(CONFIG_CRIS_DIS) += cris.o
-common-obj-$(CONFIG_HPPA_DIS) += hppa.o
 common-obj-$(CONFIG_I386_DIS) += i386.o
 common-obj-$(CONFIG_IA64_DIS) += ia64.o
 common-obj-$(CONFIG_M68K_DIS) += m68k.o
diff --git a/disas/hppa.c b/disas/hppa.c
deleted file mode 100644
index 43facdc47b..0000000000
--- a/disas/hppa.c
+++ /dev/null
@@ -1,2832 +0,0 @@
-/* Disassembler for the PA-RISC. Somewhat derived from sparc-pinsn.c.
-   Copyright 1989, 1990, 1992, 1993, 1994, 1995, 1998, 1999, 2000, 2001, 2003,
-   2005 Free Software Foundation, Inc.
-
-   Contributed by the Center for Software Science at the
-   University of Utah (pa-gdb-bugs@cs.utah.edu).
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, see <http://www.gnu.org/licenses/>. */
-
-#include "qemu/osdep.h"
-#include "disas/bfd.h"
-
-/* HP PA-RISC SOM object file format:  definitions internal to BFD.
-   Copyright 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000,
-   2003 Free Software Foundation, Inc.
-
-   Contributed by the Center for Software Science at the
-   University of Utah (pa-gdb-bugs@cs.utah.edu).
-
-   This file is part of BFD, the Binary File Descriptor library.
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, see <http://www.gnu.org/licenses/>.  */
-
-#ifndef _LIBHPPA_H
-#define _LIBHPPA_H
-
-#define BYTES_IN_WORD 4
-#define PA_PAGESIZE 0x1000
-
-/* The PA instruction set variants.  */
-enum pa_arch {pa10 = 10, pa11 = 11, pa20 = 20, pa20w = 25};
-
-/* HP PA-RISC relocation types */
-
-enum hppa_reloc_field_selector_type
-  {
-    R_HPPA_FSEL = 0x0,
-    R_HPPA_LSSEL = 0x1,
-    R_HPPA_RSSEL = 0x2,
-    R_HPPA_LSEL = 0x3,
-    R_HPPA_RSEL = 0x4,
-    R_HPPA_LDSEL = 0x5,
-    R_HPPA_RDSEL = 0x6,
-    R_HPPA_LRSEL = 0x7,
-    R_HPPA_RRSEL = 0x8,
-    R_HPPA_NSEL  = 0x9,
-    R_HPPA_NLSEL  = 0xa,
-    R_HPPA_NLRSEL  = 0xb,
-    R_HPPA_PSEL = 0xc,
-    R_HPPA_LPSEL = 0xd,
-    R_HPPA_RPSEL = 0xe,
-    R_HPPA_TSEL = 0xf,
-    R_HPPA_LTSEL = 0x10,
-    R_HPPA_RTSEL = 0x11,
-    R_HPPA_LTPSEL = 0x12,
-    R_HPPA_RTPSEL = 0x13
-  };
-
-/* /usr/include/reloc.h defines these to constants.  We want to use
-   them in enums, so #undef them before we start using them.  We might
-   be able to fix this another way by simply managing not to include
-   /usr/include/reloc.h, but currently GDB picks up these defines
-   somewhere.  */
-#undef e_fsel
-#undef e_lssel
-#undef e_rssel
-#undef e_lsel
-#undef e_rsel
-#undef e_ldsel
-#undef e_rdsel
-#undef e_lrsel
-#undef e_rrsel
-#undef e_nsel
-#undef e_nlsel
-#undef e_nlrsel
-#undef e_psel
-#undef e_lpsel
-#undef e_rpsel
-#undef e_tsel
-#undef e_ltsel
-#undef e_rtsel
-#undef e_one
-#undef e_two
-#undef e_pcrel
-#undef e_con
-#undef e_plabel
-#undef e_abs
-
-/* for compatibility */
-enum hppa_reloc_field_selector_type_alt
-  {
-    e_fsel = R_HPPA_FSEL,
-    e_lssel = R_HPPA_LSSEL,
-    e_rssel = R_HPPA_RSSEL,
-    e_lsel = R_HPPA_LSEL,
-    e_rsel = R_HPPA_RSEL,
-    e_ldsel = R_HPPA_LDSEL,
-    e_rdsel = R_HPPA_RDSEL,
-    e_lrsel = R_HPPA_LRSEL,
-    e_rrsel = R_HPPA_RRSEL,
-    e_nsel = R_HPPA_NSEL,
-    e_nlsel = R_HPPA_NLSEL,
-    e_nlrsel = R_HPPA_NLRSEL,
-    e_psel = R_HPPA_PSEL,
-    e_lpsel = R_HPPA_LPSEL,
-    e_rpsel = R_HPPA_RPSEL,
-    e_tsel = R_HPPA_TSEL,
-    e_ltsel = R_HPPA_LTSEL,
-    e_rtsel = R_HPPA_RTSEL,
-    e_ltpsel = R_HPPA_LTPSEL,
-    e_rtpsel = R_HPPA_RTPSEL
-  };
-
-enum hppa_reloc_expr_type
-  {
-    R_HPPA_E_ONE = 0,
-    R_HPPA_E_TWO = 1,
-    R_HPPA_E_PCREL = 2,
-    R_HPPA_E_CON = 3,
-    R_HPPA_E_PLABEL = 7,
-    R_HPPA_E_ABS = 18
-  };
-
-/* for compatibility */
-enum hppa_reloc_expr_type_alt
-  {
-    e_one = R_HPPA_E_ONE,
-    e_two = R_HPPA_E_TWO,
-    e_pcrel = R_HPPA_E_PCREL,
-    e_con = R_HPPA_E_CON,
-    e_plabel = R_HPPA_E_PLABEL,
-    e_abs = R_HPPA_E_ABS
-  };
-
-
-/* Relocations for function calls must be accompanied by parameter
-   relocation bits.  These bits describe exactly where the caller has
-   placed the function's arguments and where it expects to find a return
-   value.
-
-   Both ELF and SOM encode this information within the addend field
-   of the call relocation.  (Note this could break very badly if one
-   was to make a call like bl foo + 0x12345678).
-
-   The high order 10 bits contain parameter relocation information,
-   the low order 22 bits contain the constant offset.  */
-
-#define HPPA_R_ARG_RELOC(a)	\
-  (((a) >> 22) & 0x3ff)
-#define HPPA_R_CONSTANT(a)	\
-  ((((bfd_signed_vma)(a)) << (BFD_ARCH_SIZE-22)) >> (BFD_ARCH_SIZE-22))
-#define HPPA_R_ADDEND(r, c)	\
-  (((r) << 22) + ((c) & 0x3fffff))
-
-
-/* Some functions to manipulate PA instructions.  */
-
-/* Declare the functions with the unused attribute to avoid warnings.  */
-static inline int sign_extend (int, int) ATTRIBUTE_UNUSED;
-static inline int low_sign_extend (int, int) ATTRIBUTE_UNUSED;
-static inline int sign_unext (int, int) ATTRIBUTE_UNUSED;
-static inline int low_sign_unext (int, int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_3 (int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_12 (int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_14 (int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_16 (int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_17 (int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_21 (int) ATTRIBUTE_UNUSED;
-static inline int re_assemble_22 (int) ATTRIBUTE_UNUSED;
-static inline bfd_signed_vma hppa_field_adjust
-  (bfd_vma, bfd_signed_vma, enum hppa_reloc_field_selector_type_alt)
-  ATTRIBUTE_UNUSED;
-static inline int hppa_rebuild_insn (int, int, int) ATTRIBUTE_UNUSED;
-
-
-/* The *sign_extend functions are used to assemble various bitfields
-   taken from an instruction and return the resulting immediate
-   value.  */
-
-static inline int
-sign_extend (int x, int len)
-{
-  int signbit = (1 << (len - 1));
-  int mask = (signbit << 1) - 1;
-  return ((x & mask) ^ signbit) - signbit;
-}
-
-static inline int
-low_sign_extend (int x, int len)
-{
-  return (x >> 1) - ((x & 1) << (len - 1));
-}
-
-
-/* The re_assemble_* functions prepare an immediate value for
-   insertion into an opcode. pa-risc uses all sorts of weird bitfields
-   in the instruction to hold the value.  */
-
-static inline int
-sign_unext (int x, int len)
-{
-  int len_ones;
-
-  len_ones = (1 << len) - 1;
-
-  return x & len_ones;
-}
-
-static inline int
-low_sign_unext (int x, int len)
-{
-  int temp;
-  int sign;
-
-  sign = (x >> (len-1)) & 1;
-
-  temp = sign_unext (x, len-1);
-
-  return (temp << 1) | sign;
-}
-
-static inline int
-re_assemble_3 (int as3)
-{
-  return ((  (as3 & 4) << (13-2))
-	  | ((as3 & 3) << (13+1)));
-}
-
-static inline int
-re_assemble_12 (int as12)
-{
-  return ((  (as12 & 0x800) >> 11)
-	  | ((as12 & 0x400) >> (10 - 2))
-	  | ((as12 & 0x3ff) << (1 + 2)));
-}
-
-static inline int
-re_assemble_14 (int as14)
-{
-  return ((  (as14 & 0x1fff) << 1)
-	  | ((as14 & 0x2000) >> 13));
-}
-
-static inline int
-re_assemble_16 (int as16)
-{
-  int s, t;
-
-  /* Unusual 16-bit encoding, for wide mode only.  */
-  t = (as16 << 1) & 0xffff;
-  s = (as16 & 0x8000);
-  return (t ^ s ^ (s >> 1)) | (s >> 15);
-}
-
-static inline int
-re_assemble_17 (int as17)
-{
-  return ((  (as17 & 0x10000) >> 16)
-	  | ((as17 & 0x0f800) << (16 - 11))
-	  | ((as17 & 0x00400) >> (10 - 2))
-	  | ((as17 & 0x003ff) << (1 + 2)));
-}
-
-static inline int
-re_assemble_21 (int as21)
-{
-  return ((  (as21 & 0x100000) >> 20)
-	  | ((as21 & 0x0ffe00) >> 8)
-	  | ((as21 & 0x000180) << 7)
-	  | ((as21 & 0x00007c) << 14)
-	  | ((as21 & 0x000003) << 12));
-}
-
-static inline int
-re_assemble_22 (int as22)
-{
-  return ((  (as22 & 0x200000) >> 21)
-	  | ((as22 & 0x1f0000) << (21 - 16))
-	  | ((as22 & 0x00f800) << (16 - 11))
-	  | ((as22 & 0x000400) >> (10 - 2))
-	  | ((as22 & 0x0003ff) << (1 + 2)));
-}
-
-
-/* Handle field selectors for PA instructions.
-   The L and R (and LS, RS etc.) selectors are used in pairs to form a
-   full 32 bit address.  eg.
-
-   LDIL	L'start,%r1		; put left part into r1
-   LDW	R'start(%r1),%r2	; add r1 and right part to form address
-
-   This function returns sign extended values in all cases.
-*/
-
-static inline bfd_signed_vma
-hppa_field_adjust (bfd_vma sym_val,
-		   bfd_signed_vma addend,
-		   enum hppa_reloc_field_selector_type_alt r_field)
-{
-  bfd_signed_vma value;
-
-  value = sym_val + addend;
-  switch (r_field)
-    {
-    case e_fsel:
-      /* F: No change.  */
-      break;
-
-    case e_nsel:
-      /* N: null selector.  I don't really understand what this is all
-	 about, but HP's documentation says "this indicates that zero
-	 bits are to be used for the displacement on the instruction.
-	 This fixup is used to identify three-instruction sequences to
-	 access data (for importing shared library data)."  */
-      value = 0;
-      break;
-
-    case e_lsel:
-    case e_nlsel:
-      /* L:  Select top 21 bits.  */
-      value = value >> 11;
-      break;
-
-    case e_rsel:
-      /* R:  Select bottom 11 bits.  */
-      value = value & 0x7ff;
-      break;
-
-    case e_lssel:
-      /* LS:  Round to nearest multiple of 2048 then select top 21 bits.  */
-      value = value + 0x400;
-      value = value >> 11;
-      break;
-
-    case e_rssel:
-      /* RS:  Select bottom 11 bits for LS.
-	 We need to return a value such that 2048 * LS'x + RS'x == x.
-	 ie. RS'x = x - ((x + 0x400) & -0x800)
-	 this is just a sign extension from bit 21.  */
-      value = ((value & 0x7ff) ^ 0x400) - 0x400;
-      break;
-
-    case e_ldsel:
-      /* LD:  Round to next multiple of 2048 then select top 21 bits.
-	 Yes, if we are already on a multiple of 2048, we go up to the
-	 next one.  RD in this case will be -2048.  */
-      value = value + 0x800;
-      value = value >> 11;
-      break;
-
-    case e_rdsel:
-      /* RD:  Set bits 0-20 to one.  */
-      value = value | -0x800;
-      break;
-
-    case e_lrsel:
-    case e_nlrsel:
-      /* LR:  L with rounding of the addend to nearest 8k.  */
-      value = sym_val + ((addend + 0x1000) & -0x2000);
-      value = value >> 11;
-      break;
-
-    case e_rrsel:
-      /* RR:  R with rounding of the addend to nearest 8k.
-	 We need to return a value such that 2048 * LR'x + RR'x == x
-	 ie. RR'x = s+a - (s + (((a + 0x1000) & -0x2000) & -0x800))
-	 .	  = s+a - ((s & -0x800) + ((a + 0x1000) & -0x2000))
-	 .	  = (s & 0x7ff) + a - ((a + 0x1000) & -0x2000)  */
-      value = (sym_val & 0x7ff) + (((addend & 0x1fff) ^ 0x1000) - 0x1000);
-      break;
-
-    default:
-      abort ();
-    }
-  return value;
-}
-
-/* PA-RISC OPCODES */
-#define get_opcode(insn)	(((insn) >> 26) & 0x3f)
-
-enum hppa_opcode_type
-{
-  /* None of the opcodes in the first group generate relocs, so we
-     aren't too concerned about them.  */
-  OP_SYSOP   = 0x00,
-  OP_MEMMNG  = 0x01,
-  OP_ALU     = 0x02,
-  OP_NDXMEM  = 0x03,
-  OP_SPOP    = 0x04,
-  OP_DIAG    = 0x05,
-  OP_FMPYADD = 0x06,
-  OP_UNDEF07 = 0x07,
-  OP_COPRW   = 0x09,
-  OP_COPRDW  = 0x0b,
-  OP_COPR    = 0x0c,
-  OP_FLOAT   = 0x0e,
-  OP_PRDSPEC = 0x0f,
-  OP_UNDEF15 = 0x15,
-  OP_UNDEF1d = 0x1d,
-  OP_FMPYSUB = 0x26,
-  OP_FPFUSED = 0x2e,
-  OP_SHEXDP0 = 0x34,
-  OP_SHEXDP1 = 0x35,
-  OP_SHEXDP2 = 0x36,
-  OP_UNDEF37 = 0x37,
-  OP_SHEXDP3 = 0x3c,
-  OP_SHEXDP4 = 0x3d,
-  OP_MULTMED = 0x3e,
-  OP_UNDEF3f = 0x3f,
-
-  OP_LDIL    = 0x08,
-  OP_ADDIL   = 0x0a,
-
-  OP_LDO     = 0x0d,
-  OP_LDB     = 0x10,
-  OP_LDH     = 0x11,
-  OP_LDW     = 0x12,
-  OP_LDWM    = 0x13,
-  OP_STB     = 0x18,
-  OP_STH     = 0x19,
-  OP_STW     = 0x1a,
-  OP_STWM    = 0x1b,
-
-  OP_LDD     = 0x14,
-  OP_STD     = 0x1c,
-
-  OP_FLDW    = 0x16,
-  OP_LDWL    = 0x17,
-  OP_FSTW    = 0x1e,
-  OP_STWL    = 0x1f,
-
-  OP_COMBT   = 0x20,
-  OP_COMIBT  = 0x21,
-  OP_COMBF   = 0x22,
-  OP_COMIBF  = 0x23,
-  OP_CMPBDT  = 0x27,
-  OP_ADDBT   = 0x28,
-  OP_ADDIBT  = 0x29,
-  OP_ADDBF   = 0x2a,
-  OP_ADDIBF  = 0x2b,
-  OP_CMPBDF  = 0x2f,
-  OP_BVB     = 0x30,
-  OP_BB      = 0x31,
-  OP_MOVB    = 0x32,
-  OP_MOVIB   = 0x33,
-  OP_CMPIBD  = 0x3b,
-
-  OP_COMICLR = 0x24,
-  OP_SUBI    = 0x25,
-  OP_ADDIT   = 0x2c,
-  OP_ADDI    = 0x2d,
-
-  OP_BE      = 0x38,
-  OP_BLE     = 0x39,
-  OP_BL      = 0x3a
-};
-
-
-/* Insert VALUE into INSN using R_FORMAT to determine exactly what
-   bits to change.  */
-
-static inline int
-hppa_rebuild_insn (int insn, int value, int r_format)
-{
-  switch (r_format)
-    {
-    case 11:
-      return (insn & ~ 0x7ff) | low_sign_unext (value, 11);
-
-    case 12:
-      return (insn & ~ 0x1ffd) | re_assemble_12 (value);
-
-
-    case 10:
-      return (insn & ~ 0x3ff1) | re_assemble_14 (value & -8);
-
-    case -11:
-      return (insn & ~ 0x3ff9) | re_assemble_14 (value & -4);
-
-    case 14:
-      return (insn & ~ 0x3fff) | re_assemble_14 (value);
-
-
-    case -10:
-      return (insn & ~ 0xfff1) | re_assemble_16 (value & -8);
-
-    case -16:
-      return (insn & ~ 0xfff9) | re_assemble_16 (value & -4);
-
-    case 16:
-      return (insn & ~ 0xffff) | re_assemble_16 (value);
-
-
-    case 17:
-      return (insn & ~ 0x1f1ffd) | re_assemble_17 (value);
-
-    case 21:
-      return (insn & ~ 0x1fffff) | re_assemble_21 (value);
-
-    case 22:
-      return (insn & ~ 0x3ff1ffd) | re_assemble_22 (value);
-
-    case 32:
-      return value;
-
-    default:
-      abort ();
-    }
-  return insn;
-}
-
-#endif /* _LIBHPPA_H */
-/* Table of opcodes for the PA-RISC.
-   Copyright 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000,
-   2001, 2002, 2003, 2004, 2005
-   Free Software Foundation, Inc.
-
-   Contributed by the Center for Software Science at the
-   University of Utah (pa-gdb-bugs@cs.utah.edu).
-
-This file is part of GAS, the GNU Assembler, and GDB, the GNU disassembler.
-
-GAS/GDB is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 1, or (at your option)
-any later version.
-
-GAS/GDB is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with GAS or GDB; see the file COPYING.
-If not, see <http://www.gnu.org/licenses/>. */
-
-#if !defined(__STDC__) && !defined(const)
-#define const
-#endif
-
-/*
- * Structure of an opcode table entry.
- */
-
-/* There are two kinds of delay slot nullification: normal which is
- * controlled by the nullification bit, and conditional, which depends
- * on the direction of the branch and its success or failure.
- *
- * NONE is unfortunately #defined in the hiux system include files.
- * #undef it away.
- */
-#undef NONE
-struct pa_opcode
-{
-    const char *name;
-    unsigned long int match;	/* Bits that must be set...  */
-    unsigned long int mask;	/* ... in these bits. */
-    const char *args;
-    enum pa_arch arch;
-    char flags;
-};
-
-/* Enables strict matching.  Opcodes with match errors are skipped
-   when this bit is set.  */
-#define FLAG_STRICT 0x1
-
-/*
-   All hppa opcodes are 32 bits.
-
-   The match component is a mask saying which bits must match a
-   particular opcode in order for an instruction to be an instance
-   of that opcode.
-
-   The args component is a string containing one character for each operand of
-   the instruction.  Characters used as a prefix allow any second character to
-   be used without conflicting with the main operand characters.
-
-   Bit positions in this description follow HP usage of lsb = 31,
-   "at" is lsb of field.
-
-   In the args field, the following characters must match exactly:
-
-	'+,() '
-
-   In the args field, the following characters are unused:
-
-	'  "         -  /   34 6789:;    '
-	'@  C         M             [\]  '
-	'`    e g                     }  '
-
-   Here are all the characters:
-
-	' !"#$%&'()*+-,./0123456789:;<=>?'
-	'@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_'
-	'`abcdefghijklmnopqrstuvwxyz{|}~ '
-
-Kinds of operands:
-   x    integer register field at 15.
-   b    integer register field at 10.
-   t    integer register field at 31.
-   a	integer register field at 10 and 15 (for PERMH)
-   5    5 bit immediate at 15.
-   s    2 bit space specifier at 17.
-   S    3 bit space specifier at 18.
-   V    5 bit immediate value at 31
-   i    11 bit immediate value at 31
-   j    14 bit immediate value at 31
-   k    21 bit immediate value at 31
-   l    16 bit immediate value at 31 (wide mode only, unusual encoding).
-   n	nullification for branch instructions
-   N	nullification for spop and copr instructions
-   w    12 bit branch displacement
-   W    17 bit branch displacement (PC relative)
-   X    22 bit branch displacement (PC relative)
-   z    17 bit branch displacement (just a number, not an address)
-
-Also these:
-
-   .    2 bit shift amount at 25
-   *    4 bit shift amount at 25
-   p    5 bit shift count at 26 (to support the SHD instruction) encoded as
-        31-p
-   ~    6 bit shift count at 20,22:26 encoded as 63-~.
-   P    5 bit bit position at 26
-   q    6 bit bit position at 20,22:26
-   T    5 bit field length at 31 (encoded as 32-T)
-   %	6 bit field length at 23,27:31 (variable extract/deposit)
-   |	6 bit field length at 19,27:31 (fixed extract/deposit)
-   A    13 bit immediate at 18 (to support the BREAK instruction)
-   ^	like b, but describes a control register
-   !    sar (cr11) register
-   D    26 bit immediate at 31 (to support the DIAG instruction)
-   $    9 bit immediate at 28 (to support POPBTS)
-
-   v    3 bit Special Function Unit identifier at 25
-   O    20 bit Special Function Unit operation split between 15 bits at 20
-        and 5 bits at 31
-   o    15 bit Special Function Unit operation at 20
-   2    22 bit Special Function Unit operation split between 17 bits at 20
-        and 5 bits at 31
-   1    15 bit Special Function Unit operation split between 10 bits at 20
-        and 5 bits at 31
-   0    10 bit Special Function Unit operation split between 5 bits at 20
-        and 5 bits at 31
-   u    3 bit coprocessor unit identifier at 25
-   F    Source Floating Point Operand Format Completer encoded 2 bits at 20
-   I    Source Floating Point Operand Format Completer encoded 1 bits at 20
-	(for 0xe format FP instructions)
-   G    Destination Floating Point Operand Format Completer encoded 2 bits at 18
-   H    Floating Point Operand Format at 26 for 'fmpyadd' and 'fmpysub'
-        (very similar to 'F')
-
-   r	5 bit immediate value at 31 (for the break instruction)
-	(very similar to V above, except the value is unsigned instead of
-	low_sign_ext)
-   R	5 bit immediate value at 15 (for the ssm, rsm, probei instructions)
-	(same as r above, except the value is in a different location)
-   U	10 bit immediate value at 15 (for SSM, RSM on pa2.0)
-   Q	5 bit immediate value at 10 (a bit position specified in
-	the bb instruction. It's the same as r above, except the
-        value is in a different location)
-   B	5 bit immediate value at 10 (a bit position specified in
-	the bb instruction. Similar to Q, but 64 bit handling is
-	different.
-   Z    %r1 -- implicit target of addil instruction.
-   L    ,%r2 completer for new syntax branch
-   {    Source format completer for fcnv
-   _    Destination format completer for fcnv
-   h    cbit for fcmp
-   =    gfx tests for ftest
-   d    14 bit offset for single precision FP long load/store.
-   #    14 bit offset for double precision FP load long/store.
-   J    Yet another 14 bit offset for load/store with ma,mb completers.
-   K    Yet another 14 bit offset for load/store with ma,mb completers.
-   y    16 bit offset for word aligned load/store (PA2.0 wide).
-   &    16 bit offset for dword aligned load/store (PA2.0 wide).
-   <    16 bit offset for load/store with ma,mb completers (PA2.0 wide).
-   >    16 bit offset for load/store with ma,mb completers (PA2.0 wide).
-   Y    %sr0,%r31 -- implicit target of be,l instruction.
-   @	implicit immediate value of 0
-
-Completer operands all have 'c' as the prefix:
-
-   cx   indexed load and store completer.
-   cX   indexed load and store completer.  Like cx, but emits a space
-	after in disassembler.
-   cm   short load and store completer.
-   cM   short load and store completer.  Like cm, but emits a space
-        after in disassembler.
-   cq   long load and store completer (like cm, but inserted into a
-	different location in the target instruction).
-   cs   store bytes short completer.
-   cA   store bytes short completer.  Like cs, but emits a space
-        after in disassembler.
-   ce   long load/store completer for LDW/STW with a different encoding
-	than the others
-   cc   load cache control hint
-   cd   load and clear cache control hint
-   cC   store cache control hint
-   co	ordered access
-
-   cp	branch link and push completer
-   cP	branch pop completer
-   cl	branch link completer
-   cg	branch gate completer
-
-   cw	read/write completer for PROBE
-   cW	wide completer for MFCTL
-   cL	local processor completer for cache control
-   cZ   System Control Completer (to support LPA, LHA, etc.)
-
-   ci	correction completer for DCOR
-   ca	add completer
-   cy	32 bit add carry completer
-   cY	64 bit add carry completer
-   cv	signed overflow trap completer
-   ct	trap on condition completer for ADDI, SUB
-   cT	trap on condition completer for UADDCM
-   cb	32 bit borrow completer for SUB
-   cB	64 bit borrow completer for SUB
-
-   ch	left/right half completer
-   cH	signed/unsigned saturation completer
-   cS	signed/unsigned completer at 21
-   cz	zero/sign extension completer.
-   c*	permutation completer
-
-Condition operands all have '?' as the prefix:
-
-   ?f   Floating point compare conditions (encoded as 5 bits at 31)
-
-   ?a	add conditions
-   ?A	64 bit add conditions
-   ?@   add branch conditions followed by nullify
-   ?d	non-negated add branch conditions
-   ?D	negated add branch conditions
-   ?w	wide mode non-negated add branch conditions
-   ?W	wide mode negated add branch conditions
-
-   ?s   compare/subtract conditions
-   ?S	64 bit compare/subtract conditions
-   ?t   non-negated compare and branch conditions
-   ?n   32 bit compare and branch conditions followed by nullify
-   ?N   64 bit compare and branch conditions followed by nullify
-   ?Q	64 bit compare and branch conditions for CMPIB instruction
-
-   ?l   logical conditions
-   ?L	64 bit logical conditions
-
-   ?b   branch on bit conditions
-   ?B	64 bit branch on bit conditions
-
-   ?x   shift/extract/deposit conditions
-   ?X	64 bit shift/extract/deposit conditions
-   ?y   shift/extract/deposit conditions followed by nullify for conditional
-        branches
-
-   ?u   unit conditions
-   ?U   64 bit unit conditions
-
-Floating point registers all have 'f' as a prefix:
-
-   ft	target register at 31
-   fT	target register with L/R halves at 31
-   fa	operand 1 register at 10
-   fA   operand 1 register with L/R halves at 10
-   fX   Same as fA, except prints a space before register during disasm
-   fb	operand 2 register at 15
-   fB   operand 2 register with L/R halves at 15
-   fC   operand 3 register with L/R halves at 16:18,21:23
-   fe   Like fT, but encoding is different.
-   fE   Same as fe, except prints a space before register during disasm.
-   fx	target register at 15 (only for PA 2.0 long format FLDD/FSTD).
-
-Float registers for fmpyadd and fmpysub:
-
-   fi	mult operand 1 register at 10
-   fj	mult operand 2 register at 15
-   fk	mult target register at 20
-   fl	add/sub operand register at 25
-   fm	add/sub target register at 31
-
-*/
-
-
-#if 0
-/* List of characters not to put a space after.  Note that
-   "," is included, as the "spopN" operations use literal
-   commas in their completer sections.  */
-static const char *const completer_chars = ",CcY<>?!@+&U~FfGHINnOoZMadu|/=0123%e$m}";
-#endif
-
-/* The order of the opcodes in this table is significant:
-
-   * The assembler requires that all instances of the same mnemonic be
-     consecutive.  If they aren't, the assembler will bomb at runtime.
-
-   * Immediate fields use pa_get_absolute_expression to parse the
-     string.  It will generate a "bad expression" error if passed
-     a register name.  Thus, register index variants of an opcode
-     need to precede immediate variants.
-
-   * The disassembler does not care about the order of the opcodes
-     except in cases where implicit addressing is used.
-
-   Here are the rules for ordering the opcodes of a mnemonic:
-
-   1) Opcodes with FLAG_STRICT should precede opcodes without
-      FLAG_STRICT.
-
-   2) Opcodes with FLAG_STRICT should be ordered as follows:
-      register index opcodes, short immediate opcodes, and finally
-      long immediate opcodes.  When both pa10 and pa11 variants
-      of the same opcode are available, the pa10 opcode should
-      come first for correct architectural promotion.
-
-   3) When implicit addressing is available for an opcode, the
-      implicit opcode should precede the explicit opcode.
-
-   4) Opcodes without FLAG_STRICT should be ordered as follows:
-      register index opcodes, long immediate opcodes, and finally
-      short immediate opcodes.  */
-
-static const struct pa_opcode pa_opcodes[] =
-{
-
-/* Pseudo-instructions.  */
-
-{ "ldi",	0x34000000, 0xffe00000, "l,x", pa20w, 0},/* ldo val(r0),r */
-{ "ldi",	0x34000000, 0xffe0c000, "j,x", pa10, 0},/* ldo val(r0),r */
-
-{ "cmpib",	0xec000000, 0xfc000000, "?Qn5,b,w", pa20, FLAG_STRICT},
-{ "cmpib", 	0x84000000, 0xf4000000, "?nn5,b,w", pa10, FLAG_STRICT},
-{ "comib", 	0x84000000, 0xfc000000, "?nn5,b,w", pa10, 0}, /* comib{tf}*/
-/* This entry is for the disassembler only.  It will never be used by
-   assembler.  */
-{ "comib", 	0x8c000000, 0xfc000000, "?nn5,b,w", pa10, 0}, /* comib{tf}*/
-{ "cmpb",	0x9c000000, 0xdc000000, "?Nnx,b,w", pa20, FLAG_STRICT},
-{ "cmpb",	0x80000000, 0xf4000000, "?nnx,b,w", pa10, FLAG_STRICT},
-{ "comb",	0x80000000, 0xfc000000, "?nnx,b,w", pa10, 0}, /* comb{tf} */
-/* This entry is for the disassembler only.  It will never be used by
-   assembler.  */
-{ "comb",	0x88000000, 0xfc000000, "?nnx,b,w", pa10, 0}, /* comb{tf} */
-{ "addb",	0xa0000000, 0xf4000000, "?Wnx,b,w", pa20w, FLAG_STRICT},
-{ "addb",	0xa0000000, 0xfc000000, "?@nx,b,w", pa10, 0}, /* addb{tf} */
-/* This entry is for the disassembler only.  It will never be used by
-   assembler.  */
-{ "addb",	0xa8000000, 0xfc000000, "?@nx,b,w", pa10, 0},
-{ "addib",	0xa4000000, 0xf4000000, "?Wn5,b,w", pa20w, FLAG_STRICT},
-{ "addib",	0xa4000000, 0xfc000000, "?@n5,b,w", pa10, 0}, /* addib{tf}*/
-/* This entry is for the disassembler only.  It will never be used by
-   assembler.  */
-{ "addib",	0xac000000, 0xfc000000, "?@n5,b,w", pa10, 0}, /* addib{tf}*/
-{ "nop",	0x08000240, 0xffffffff, "", pa10, 0},      /* or 0,0,0 */
-{ "copy",	0x08000240, 0xffe0ffe0, "x,t", pa10, 0},   /* or r,0,t */
-{ "mtsar",	0x01601840, 0xffe0ffff, "x", pa10, 0}, /* mtctl r,cr11 */
-
-/* Loads and Stores for integer registers.  */
-
-{ "ldd",	0x0c0000c0, 0xfc00d3c0, "cxccx(b),t", pa20, FLAG_STRICT},
-{ "ldd",	0x0c0000c0, 0xfc0013c0, "cxccx(s,b),t", pa20, FLAG_STRICT},
-{ "ldd",	0x0c0010e0, 0xfc1ff3e0, "cocc@(b),t", pa20, FLAG_STRICT},
-{ "ldd",	0x0c0010e0, 0xfc1f33e0, "cocc@(s,b),t", pa20, FLAG_STRICT},
-{ "ldd",	0x0c0010c0, 0xfc00d3c0, "cmcc5(b),t", pa20, FLAG_STRICT},
-{ "ldd",	0x0c0010c0, 0xfc0013c0, "cmcc5(s,b),t", pa20, FLAG_STRICT},
-{ "ldd",	0x50000000, 0xfc000002, "cq&(b),x", pa20w, FLAG_STRICT},
-{ "ldd",	0x50000000, 0xfc00c002, "cq#(b),x", pa20, FLAG_STRICT},
-{ "ldd",	0x50000000, 0xfc000002, "cq#(s,b),x", pa20, FLAG_STRICT},
-{ "ldw",	0x0c000080, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldw",	0x0c000080, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldw",	0x0c000080, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldw",	0x0c000080, 0xfc0013c0, "cxccx(s,b),t", pa11, FLAG_STRICT},
-{ "ldw",	0x0c0010a0, 0xfc1ff3e0, "cocc@(b),t", pa20, FLAG_STRICT},
-{ "ldw",	0x0c0010a0, 0xfc1f33e0, "cocc@(s,b),t", pa20, FLAG_STRICT},
-{ "ldw",	0x0c001080, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldw",	0x0c001080, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldw",	0x0c001080, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldw",	0x0c001080, 0xfc0013c0, "cmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "ldw",	0x4c000000, 0xfc000000, "ce<(b),x", pa20w, FLAG_STRICT},
-{ "ldw",	0x5c000004, 0xfc000006, "ce>(b),x", pa20w, FLAG_STRICT},
-{ "ldw",	0x48000000, 0xfc000000, "l(b),x", pa20w, FLAG_STRICT},
-{ "ldw",	0x5c000004, 0xfc00c006, "ceK(b),x", pa20, FLAG_STRICT},
-{ "ldw",	0x5c000004, 0xfc000006, "ceK(s,b),x", pa20, FLAG_STRICT},
-{ "ldw",	0x4c000000, 0xfc00c000, "ceJ(b),x", pa10, FLAG_STRICT},
-{ "ldw",	0x4c000000, 0xfc000000, "ceJ(s,b),x", pa10, FLAG_STRICT},
-{ "ldw",	0x48000000, 0xfc00c000, "j(b),x", pa10, 0},
-{ "ldw",	0x48000000, 0xfc000000, "j(s,b),x", pa10, 0},
-{ "ldh",	0x0c000040, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldh",	0x0c000040, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldh",	0x0c000040, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldh",	0x0c000040, 0xfc0013c0, "cxccx(s,b),t", pa11, FLAG_STRICT},
-{ "ldh",	0x0c001060, 0xfc1ff3e0, "cocc@(b),t", pa20, FLAG_STRICT},
-{ "ldh",	0x0c001060, 0xfc1f33e0, "cocc@(s,b),t", pa20, FLAG_STRICT},
-{ "ldh",	0x0c001040, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldh",	0x0c001040, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldh",	0x0c001040, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldh",	0x0c001040, 0xfc0013c0, "cmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "ldh",	0x44000000, 0xfc000000, "l(b),x", pa20w, FLAG_STRICT},
-{ "ldh",	0x44000000, 0xfc00c000, "j(b),x", pa10, 0},
-{ "ldh",	0x44000000, 0xfc000000, "j(s,b),x", pa10, 0},
-{ "ldb",	0x0c000000, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldb",	0x0c000000, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldb",	0x0c000000, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldb",	0x0c000000, 0xfc0013c0, "cxccx(s,b),t", pa11, FLAG_STRICT},
-{ "ldb",	0x0c001020, 0xfc1ff3e0, "cocc@(b),t", pa20, FLAG_STRICT},
-{ "ldb",	0x0c001020, 0xfc1f33e0, "cocc@(s,b),t", pa20, FLAG_STRICT},
-{ "ldb",	0x0c001000, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldb",	0x0c001000, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldb",	0x0c001000, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldb",	0x0c001000, 0xfc0013c0, "cmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "ldb",	0x40000000, 0xfc000000, "l(b),x", pa20w, FLAG_STRICT},
-{ "ldb",	0x40000000, 0xfc00c000, "j(b),x", pa10, 0},
-{ "ldb",	0x40000000, 0xfc000000, "j(s,b),x", pa10, 0},
-{ "std",	0x0c0012e0, 0xfc00f3ff, "cocCx,@(b)", pa20, FLAG_STRICT},
-{ "std",	0x0c0012e0, 0xfc0033ff, "cocCx,@(s,b)", pa20, FLAG_STRICT},
-{ "std",	0x0c0012c0, 0xfc00d3c0, "cmcCx,V(b)", pa20, FLAG_STRICT},
-{ "std",	0x0c0012c0, 0xfc0013c0, "cmcCx,V(s,b)", pa20, FLAG_STRICT},
-{ "std",	0x70000000, 0xfc000002, "cqx,&(b)", pa20w, FLAG_STRICT},
-{ "std",	0x70000000, 0xfc00c002, "cqx,#(b)", pa20, FLAG_STRICT},
-{ "std",	0x70000000, 0xfc000002, "cqx,#(s,b)", pa20, FLAG_STRICT},
-{ "stw",	0x0c0012a0, 0xfc00f3ff, "cocCx,@(b)", pa20, FLAG_STRICT},
-{ "stw",	0x0c0012a0, 0xfc0033ff, "cocCx,@(s,b)", pa20, FLAG_STRICT},
-{ "stw",	0x0c001280, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "stw",	0x0c001280, 0xfc001fc0, "cMx,V(s,b)", pa10, FLAG_STRICT},
-{ "stw",	0x0c001280, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "stw",	0x0c001280, 0xfc0013c0, "cmcCx,V(s,b)", pa11, FLAG_STRICT},
-{ "stw",	0x6c000000, 0xfc000000, "cex,<(b)", pa20w, FLAG_STRICT},
-{ "stw",	0x7c000004, 0xfc000006, "cex,>(b)", pa20w, FLAG_STRICT},
-{ "stw",	0x68000000, 0xfc000000, "x,l(b)", pa20w, FLAG_STRICT},
-{ "stw",	0x7c000004, 0xfc00c006, "cex,K(b)", pa20, FLAG_STRICT},
-{ "stw",	0x7c000004, 0xfc000006, "cex,K(s,b)", pa20, FLAG_STRICT},
-{ "stw",	0x6c000000, 0xfc00c000, "cex,J(b)", pa10, FLAG_STRICT},
-{ "stw",	0x6c000000, 0xfc000000, "cex,J(s,b)", pa10, FLAG_STRICT},
-{ "stw",	0x68000000, 0xfc00c000, "x,j(b)", pa10, 0},
-{ "stw",	0x68000000, 0xfc000000, "x,j(s,b)", pa10, 0},
-{ "sth",	0x0c001260, 0xfc00f3ff, "cocCx,@(b)", pa20, FLAG_STRICT},
-{ "sth",	0x0c001260, 0xfc0033ff, "cocCx,@(s,b)", pa20, FLAG_STRICT},
-{ "sth",	0x0c001240, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "sth",	0x0c001240, 0xfc001fc0, "cMx,V(s,b)", pa10, FLAG_STRICT},
-{ "sth",	0x0c001240, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "sth",	0x0c001240, 0xfc0013c0, "cmcCx,V(s,b)", pa11, FLAG_STRICT},
-{ "sth",	0x64000000, 0xfc000000, "x,l(b)", pa20w, FLAG_STRICT},
-{ "sth",	0x64000000, 0xfc00c000, "x,j(b)", pa10, 0},
-{ "sth",	0x64000000, 0xfc000000, "x,j(s,b)", pa10, 0},
-{ "stb",	0x0c001220, 0xfc00f3ff, "cocCx,@(b)", pa20, FLAG_STRICT},
-{ "stb",	0x0c001220, 0xfc0033ff, "cocCx,@(s,b)", pa20, FLAG_STRICT},
-{ "stb",	0x0c001200, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "stb",	0x0c001200, 0xfc001fc0, "cMx,V(s,b)", pa10, FLAG_STRICT},
-{ "stb",	0x0c001200, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "stb",	0x0c001200, 0xfc0013c0, "cmcCx,V(s,b)", pa11, FLAG_STRICT},
-{ "stb",	0x60000000, 0xfc000000, "x,l(b)", pa20w, FLAG_STRICT},
-{ "stb",	0x60000000, 0xfc00c000, "x,j(b)", pa10, 0},
-{ "stb",	0x60000000, 0xfc000000, "x,j(s,b)", pa10, 0},
-{ "ldwm",	0x4c000000, 0xfc00c000, "j(b),x", pa10, 0},
-{ "ldwm",	0x4c000000, 0xfc000000, "j(s,b),x", pa10, 0},
-{ "stwm",	0x6c000000, 0xfc00c000, "x,j(b)", pa10, 0},
-{ "stwm",	0x6c000000, 0xfc000000, "x,j(s,b)", pa10, 0},
-{ "ldwx",	0x0c000080, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldwx",	0x0c000080, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldwx",	0x0c000080, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldwx",	0x0c000080, 0xfc0013c0, "cxccx(s,b),t", pa11, FLAG_STRICT},
-{ "ldwx",	0x0c000080, 0xfc00dfc0, "cXx(b),t", pa10, 0},
-{ "ldwx",	0x0c000080, 0xfc001fc0, "cXx(s,b),t", pa10, 0},
-{ "ldhx",	0x0c000040, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldhx",	0x0c000040, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldhx",	0x0c000040, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldhx",	0x0c000040, 0xfc0013c0, "cxccx(s,b),t", pa11, FLAG_STRICT},
-{ "ldhx",	0x0c000040, 0xfc00dfc0, "cXx(b),t", pa10, 0},
-{ "ldhx",	0x0c000040, 0xfc001fc0, "cXx(s,b),t", pa10, 0},
-{ "ldbx",	0x0c000000, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldbx",	0x0c000000, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldbx",	0x0c000000, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldbx",	0x0c000000, 0xfc0013c0, "cxccx(s,b),t", pa11, FLAG_STRICT},
-{ "ldbx",	0x0c000000, 0xfc00dfc0, "cXx(b),t", pa10, 0},
-{ "ldbx",	0x0c000000, 0xfc001fc0, "cXx(s,b),t", pa10, 0},
-{ "ldwa",	0x0c000180, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldwa",	0x0c000180, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldwa",	0x0c0011a0, 0xfc1ff3e0, "cocc@(b),t", pa20, FLAG_STRICT},
-{ "ldwa",	0x0c001180, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldwa",	0x0c001180, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldcw",	0x0c0001c0, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldcw",	0x0c0001c0, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldcw",	0x0c0001c0, 0xfc00d3c0, "cxcdx(b),t", pa11, FLAG_STRICT},
-{ "ldcw",	0x0c0001c0, 0xfc0013c0, "cxcdx(s,b),t", pa11, FLAG_STRICT},
-{ "ldcw",	0x0c0011c0, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldcw",	0x0c0011c0, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldcw",	0x0c0011c0, 0xfc00d3c0, "cmcd5(b),t", pa11, FLAG_STRICT},
-{ "ldcw",	0x0c0011c0, 0xfc0013c0, "cmcd5(s,b),t", pa11, FLAG_STRICT},
-{ "stwa",	0x0c0013a0, 0xfc00d3ff, "cocCx,@(b)", pa20, FLAG_STRICT},
-{ "stwa",	0x0c001380, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "stwa",	0x0c001380, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "stby",	0x0c001300, 0xfc00dfc0, "cAx,V(b)", pa10, FLAG_STRICT},
-{ "stby",	0x0c001300, 0xfc001fc0, "cAx,V(s,b)", pa10, FLAG_STRICT},
-{ "stby",	0x0c001300, 0xfc00d3c0, "cscCx,V(b)", pa11, FLAG_STRICT},
-{ "stby",	0x0c001300, 0xfc0013c0, "cscCx,V(s,b)", pa11, FLAG_STRICT},
-{ "ldda",	0x0c000100, 0xfc00d3c0, "cxccx(b),t", pa20, FLAG_STRICT},
-{ "ldda",	0x0c001120, 0xfc1ff3e0, "cocc@(b),t", pa20, FLAG_STRICT},
-{ "ldda",	0x0c001100, 0xfc00d3c0, "cmcc5(b),t", pa20, FLAG_STRICT},
-{ "ldcd",	0x0c000140, 0xfc00d3c0, "cxcdx(b),t", pa20, FLAG_STRICT},
-{ "ldcd",	0x0c000140, 0xfc0013c0, "cxcdx(s,b),t", pa20, FLAG_STRICT},
-{ "ldcd",	0x0c001140, 0xfc00d3c0, "cmcd5(b),t", pa20, FLAG_STRICT},
-{ "ldcd",	0x0c001140, 0xfc0013c0, "cmcd5(s,b),t", pa20, FLAG_STRICT},
-{ "stda",	0x0c0013e0, 0xfc00f3ff, "cocCx,@(b)", pa20, FLAG_STRICT},
-{ "stda",	0x0c0013c0, 0xfc00d3c0, "cmcCx,V(b)", pa20, FLAG_STRICT},
-{ "ldwax",	0x0c000180, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldwax",	0x0c000180, 0xfc00d3c0, "cxccx(b),t", pa11, FLAG_STRICT},
-{ "ldwax",	0x0c000180, 0xfc00dfc0, "cXx(b),t", pa10, 0},
-{ "ldcwx",	0x0c0001c0, 0xfc00dfc0, "cXx(b),t", pa10, FLAG_STRICT},
-{ "ldcwx",	0x0c0001c0, 0xfc001fc0, "cXx(s,b),t", pa10, FLAG_STRICT},
-{ "ldcwx",	0x0c0001c0, 0xfc00d3c0, "cxcdx(b),t", pa11, FLAG_STRICT},
-{ "ldcwx",	0x0c0001c0, 0xfc0013c0, "cxcdx(s,b),t", pa11, FLAG_STRICT},
-{ "ldcwx",	0x0c0001c0, 0xfc00dfc0, "cXx(b),t", pa10, 0},
-{ "ldcwx",	0x0c0001c0, 0xfc001fc0, "cXx(s,b),t", pa10, 0},
-{ "ldws",	0x0c001080, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldws",	0x0c001080, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldws",	0x0c001080, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldws",	0x0c001080, 0xfc0013c0, "cmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "ldws",	0x0c001080, 0xfc00dfc0, "cM5(b),t", pa10, 0},
-{ "ldws",	0x0c001080, 0xfc001fc0, "cM5(s,b),t", pa10, 0},
-{ "ldhs",	0x0c001040, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldhs",	0x0c001040, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldhs",	0x0c001040, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldhs",	0x0c001040, 0xfc0013c0, "cmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "ldhs",	0x0c001040, 0xfc00dfc0, "cM5(b),t", pa10, 0},
-{ "ldhs",	0x0c001040, 0xfc001fc0, "cM5(s,b),t", pa10, 0},
-{ "ldbs",	0x0c001000, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldbs",	0x0c001000, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldbs",	0x0c001000, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldbs",	0x0c001000, 0xfc0013c0, "cmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "ldbs",	0x0c001000, 0xfc00dfc0, "cM5(b),t", pa10, 0},
-{ "ldbs",	0x0c001000, 0xfc001fc0, "cM5(s,b),t", pa10, 0},
-{ "ldwas",	0x0c001180, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldwas",	0x0c001180, 0xfc00d3c0, "cmcc5(b),t", pa11, FLAG_STRICT},
-{ "ldwas",	0x0c001180, 0xfc00dfc0, "cM5(b),t", pa10, 0},
-{ "ldcws",	0x0c0011c0, 0xfc00dfc0, "cM5(b),t", pa10, FLAG_STRICT},
-{ "ldcws",	0x0c0011c0, 0xfc001fc0, "cM5(s,b),t", pa10, FLAG_STRICT},
-{ "ldcws",	0x0c0011c0, 0xfc00d3c0, "cmcd5(b),t", pa11, FLAG_STRICT},
-{ "ldcws",	0x0c0011c0, 0xfc0013c0, "cmcd5(s,b),t", pa11, FLAG_STRICT},
-{ "ldcws",	0x0c0011c0, 0xfc00dfc0, "cM5(b),t", pa10, 0},
-{ "ldcws",	0x0c0011c0, 0xfc001fc0, "cM5(s,b),t", pa10, 0},
-{ "stws",	0x0c001280, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "stws",	0x0c001280, 0xfc001fc0, "cMx,V(s,b)", pa10, FLAG_STRICT},
-{ "stws",	0x0c001280, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "stws",	0x0c001280, 0xfc0013c0, "cmcCx,V(s,b)", pa11, FLAG_STRICT},
-{ "stws",	0x0c001280, 0xfc00dfc0, "cMx,V(b)", pa10, 0},
-{ "stws",	0x0c001280, 0xfc001fc0, "cMx,V(s,b)", pa10, 0},
-{ "sths",	0x0c001240, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "sths",	0x0c001240, 0xfc001fc0, "cMx,V(s,b)", pa10, FLAG_STRICT},
-{ "sths",	0x0c001240, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "sths",	0x0c001240, 0xfc0013c0, "cmcCx,V(s,b)", pa11, FLAG_STRICT},
-{ "sths",	0x0c001240, 0xfc00dfc0, "cMx,V(b)", pa10, 0},
-{ "sths",	0x0c001240, 0xfc001fc0, "cMx,V(s,b)", pa10, 0},
-{ "stbs",	0x0c001200, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "stbs",	0x0c001200, 0xfc001fc0, "cMx,V(s,b)", pa10, FLAG_STRICT},
-{ "stbs",	0x0c001200, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "stbs",	0x0c001200, 0xfc0013c0, "cmcCx,V(s,b)", pa11, FLAG_STRICT},
-{ "stbs",	0x0c001200, 0xfc00dfc0, "cMx,V(b)", pa10, 0},
-{ "stbs",	0x0c001200, 0xfc001fc0, "cMx,V(s,b)", pa10, 0},
-{ "stwas",	0x0c001380, 0xfc00dfc0, "cMx,V(b)", pa10, FLAG_STRICT},
-{ "stwas",	0x0c001380, 0xfc00d3c0, "cmcCx,V(b)", pa11, FLAG_STRICT},
-{ "stwas",	0x0c001380, 0xfc00dfc0, "cMx,V(b)", pa10, 0},
-{ "stdby",	0x0c001340, 0xfc00d3c0, "cscCx,V(b)", pa20, FLAG_STRICT},
-{ "stdby",	0x0c001340, 0xfc0013c0, "cscCx,V(s,b)", pa20, FLAG_STRICT},
-{ "stbys",	0x0c001300, 0xfc00dfc0, "cAx,V(b)", pa10, FLAG_STRICT},
-{ "stbys",	0x0c001300, 0xfc001fc0, "cAx,V(s,b)", pa10, FLAG_STRICT},
-{ "stbys",	0x0c001300, 0xfc00d3c0, "cscCx,V(b)", pa11, FLAG_STRICT},
-{ "stbys",	0x0c001300, 0xfc0013c0, "cscCx,V(s,b)", pa11, FLAG_STRICT},
-{ "stbys",	0x0c001300, 0xfc00dfc0, "cAx,V(b)", pa10, 0},
-{ "stbys",	0x0c001300, 0xfc001fc0, "cAx,V(s,b)", pa10, 0},
-
-/* Immediate instructions.  */
-{ "ldo",	0x34000000, 0xfc000000, "l(b),x", pa20w, 0},
-{ "ldo",	0x34000000, 0xfc00c000, "j(b),x", pa10, 0},
-{ "ldil",	0x20000000, 0xfc000000, "k,b", pa10, 0},
-{ "addil",	0x28000000, 0xfc000000, "k,b,Z", pa10, 0},
-{ "addil",	0x28000000, 0xfc000000, "k,b", pa10, 0},
-
-/* Branching instructions.  */
-{ "b",		0xe8008000, 0xfc00e000, "cpnXL", pa20, FLAG_STRICT},
-{ "b",		0xe800a000, 0xfc00e000, "clnXL", pa20, FLAG_STRICT},
-{ "b",		0xe8000000, 0xfc00e000, "clnW,b", pa10, FLAG_STRICT},
-{ "b",		0xe8002000, 0xfc00e000, "cgnW,b", pa10, FLAG_STRICT},
-{ "b",		0xe8000000, 0xffe0e000, "nW", pa10, 0},  /* b,l foo,r0 */
-{ "bl",		0xe8000000, 0xfc00e000, "nW,b", pa10, 0},
-{ "gate",	0xe8002000, 0xfc00e000, "nW,b", pa10, 0},
-{ "blr",	0xe8004000, 0xfc00e001, "nx,b", pa10, 0},
-{ "bv",		0xe800c000, 0xfc00fffd, "nx(b)", pa10, 0},
-{ "bv",		0xe800c000, 0xfc00fffd, "n(b)", pa10, 0},
-{ "bve",	0xe800f001, 0xfc1ffffd, "cpn(b)L", pa20, FLAG_STRICT},
-{ "bve",	0xe800f000, 0xfc1ffffd, "cln(b)L", pa20, FLAG_STRICT},
-{ "bve",	0xe800d001, 0xfc1ffffd, "cPn(b)", pa20, FLAG_STRICT},
-{ "bve",	0xe800d000, 0xfc1ffffd, "n(b)", pa20, FLAG_STRICT},
-{ "be",		0xe4000000, 0xfc000000, "clnz(S,b),Y", pa10, FLAG_STRICT},
-{ "be",		0xe4000000, 0xfc000000, "clnz(b),Y", pa10, FLAG_STRICT},
-{ "be",		0xe0000000, 0xfc000000, "nz(S,b)", pa10, 0},
-{ "be",		0xe0000000, 0xfc000000, "nz(b)", pa10, 0},
-{ "ble",	0xe4000000, 0xfc000000, "nz(S,b)", pa10, 0},
-{ "movb",	0xc8000000, 0xfc000000, "?ynx,b,w", pa10, 0},
-{ "movib",	0xcc000000, 0xfc000000, "?yn5,b,w", pa10, 0},
-{ "combt",	0x80000000, 0xfc000000, "?tnx,b,w", pa10, 0},
-{ "combf",	0x88000000, 0xfc000000, "?tnx,b,w", pa10, 0},
-{ "comibt",	0x84000000, 0xfc000000, "?tn5,b,w", pa10, 0},
-{ "comibf",	0x8c000000, 0xfc000000, "?tn5,b,w", pa10, 0},
-{ "addbt",	0xa0000000, 0xfc000000, "?dnx,b,w", pa10, 0},
-{ "addbf",	0xa8000000, 0xfc000000, "?dnx,b,w", pa10, 0},
-{ "addibt",	0xa4000000, 0xfc000000, "?dn5,b,w", pa10, 0},
-{ "addibf",	0xac000000, 0xfc000000, "?dn5,b,w", pa10, 0},
-{ "bb",		0xc0004000, 0xffe06000, "?bnx,!,w", pa10, FLAG_STRICT},
-{ "bb",		0xc0006000, 0xffe06000, "?Bnx,!,w", pa20, FLAG_STRICT},
-{ "bb",		0xc4004000, 0xfc006000, "?bnx,Q,w", pa10, FLAG_STRICT},
-{ "bb",		0xc4004000, 0xfc004000, "?Bnx,B,w", pa20, FLAG_STRICT},
-{ "bvb",	0xc0004000, 0xffe04000, "?bnx,w", pa10, 0},
-{ "clrbts",	0xe8004005, 0xffffffff, "", pa20, FLAG_STRICT},
-{ "popbts",	0xe8004005, 0xfffff007, "$", pa20, FLAG_STRICT},
-{ "pushnom",	0xe8004001, 0xffffffff, "", pa20, FLAG_STRICT},
-{ "pushbts",	0xe8004001, 0xffe0ffff, "x", pa20, FLAG_STRICT},
-
-/* Computation Instructions.  */
-
-{ "cmpclr",	0x080008a0, 0xfc000fe0, "?Sx,b,t", pa20, FLAG_STRICT},
-{ "cmpclr",	0x08000880, 0xfc000fe0, "?sx,b,t", pa10, FLAG_STRICT},
-{ "comclr",	0x08000880, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "or",		0x08000260, 0xfc000fe0, "?Lx,b,t", pa20, FLAG_STRICT},
-{ "or",		0x08000240, 0xfc000fe0, "?lx,b,t", pa10, 0},
-{ "xor",	0x080002a0, 0xfc000fe0, "?Lx,b,t", pa20, FLAG_STRICT},
-{ "xor",	0x08000280, 0xfc000fe0, "?lx,b,t", pa10, 0},
-{ "and",	0x08000220, 0xfc000fe0, "?Lx,b,t", pa20, FLAG_STRICT},
-{ "and",	0x08000200, 0xfc000fe0, "?lx,b,t", pa10, 0},
-{ "andcm",	0x08000020, 0xfc000fe0, "?Lx,b,t", pa20, FLAG_STRICT},
-{ "andcm",	0x08000000, 0xfc000fe0, "?lx,b,t", pa10, 0},
-{ "uxor",	0x080003a0, 0xfc000fe0, "?Ux,b,t", pa20, FLAG_STRICT},
-{ "uxor",	0x08000380, 0xfc000fe0, "?ux,b,t", pa10, 0},
-{ "uaddcm",	0x080009a0, 0xfc000fa0, "cT?Ux,b,t", pa20, FLAG_STRICT},
-{ "uaddcm",	0x08000980, 0xfc000fa0, "cT?ux,b,t", pa10, FLAG_STRICT},
-{ "uaddcm",	0x08000980, 0xfc000fe0, "?ux,b,t", pa10, 0},
-{ "uaddcmt",	0x080009c0, 0xfc000fe0, "?ux,b,t", pa10, 0},
-{ "dcor",	0x08000ba0, 0xfc1f0fa0, "ci?Ub,t", pa20, FLAG_STRICT},
-{ "dcor",	0x08000b80, 0xfc1f0fa0, "ci?ub,t", pa10, FLAG_STRICT},
-{ "dcor",	0x08000b80, 0xfc1f0fe0, "?ub,t",   pa10, 0},
-{ "idcor",	0x08000bc0, 0xfc1f0fe0, "?ub,t",   pa10, 0},
-{ "addi",	0xb0000000, 0xfc000000, "ct?ai,b,x", pa10, FLAG_STRICT},
-{ "addi",	0xb4000000, 0xfc000000, "cv?ai,b,x", pa10, FLAG_STRICT},
-{ "addi",	0xb4000000, 0xfc000800, "?ai,b,x", pa10, 0},
-{ "addio",	0xb4000800, 0xfc000800, "?ai,b,x", pa10, 0},
-{ "addit",	0xb0000000, 0xfc000800, "?ai,b,x", pa10, 0},
-{ "addito",	0xb0000800, 0xfc000800, "?ai,b,x", pa10, 0},
-{ "add",	0x08000720, 0xfc0007e0, "cY?Ax,b,t", pa20, FLAG_STRICT},
-{ "add",	0x08000700, 0xfc0007e0, "cy?ax,b,t", pa10, FLAG_STRICT},
-{ "add",	0x08000220, 0xfc0003e0, "ca?Ax,b,t", pa20, FLAG_STRICT},
-{ "add",	0x08000200, 0xfc0003e0, "ca?ax,b,t", pa10, FLAG_STRICT},
-{ "add",	0x08000600, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "addl",	0x08000a00, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "addo",	0x08000e00, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "addc",	0x08000700, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "addco",	0x08000f00, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sub",	0x080004e0, 0xfc0007e0, "ct?Sx,b,t", pa20, FLAG_STRICT},
-{ "sub",	0x080004c0, 0xfc0007e0, "ct?sx,b,t", pa10, FLAG_STRICT},
-{ "sub",	0x08000520, 0xfc0007e0, "cB?Sx,b,t", pa20, FLAG_STRICT},
-{ "sub",	0x08000500, 0xfc0007e0, "cb?sx,b,t", pa10, FLAG_STRICT},
-{ "sub",	0x08000420, 0xfc0007e0, "cv?Sx,b,t", pa20, FLAG_STRICT},
-{ "sub",	0x08000400, 0xfc0007e0, "cv?sx,b,t", pa10, FLAG_STRICT},
-{ "sub",	0x08000400, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "subo",	0x08000c00, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "subb",	0x08000500, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "subbo",	0x08000d00, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "subt",	0x080004c0, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "subto",	0x08000cc0, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "ds",		0x08000440, 0xfc000fe0, "?sx,b,t", pa10, 0},
-{ "subi",	0x94000000, 0xfc000000, "cv?si,b,x", pa10, FLAG_STRICT},
-{ "subi",	0x94000000, 0xfc000800, "?si,b,x", pa10, 0},
-{ "subio",	0x94000800, 0xfc000800, "?si,b,x", pa10, 0},
-{ "cmpiclr",	0x90000800, 0xfc000800, "?Si,b,x", pa20, FLAG_STRICT},
-{ "cmpiclr",	0x90000000, 0xfc000800, "?si,b,x", pa10, FLAG_STRICT},
-{ "comiclr",	0x90000000, 0xfc000800, "?si,b,x", pa10, 0},
-{ "shladd",	0x08000220, 0xfc000320, "ca?Ax,.,b,t", pa20, FLAG_STRICT},
-{ "shladd",	0x08000200, 0xfc000320, "ca?ax,.,b,t", pa10, FLAG_STRICT},
-{ "sh1add",	0x08000640, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh1addl",	0x08000a40, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh1addo",	0x08000e40, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh2add",	0x08000680, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh2addl",	0x08000a80, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh2addo",	0x08000e80, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh3add",	0x080006c0, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh3addl",	0x08000ac0, 0xfc000fe0, "?ax,b,t", pa10, 0},
-{ "sh3addo",	0x08000ec0, 0xfc000fe0, "?ax,b,t", pa10, 0},
-
-/* Subword Operation Instructions.  */
-
-{ "hadd",	0x08000300, 0xfc00ff20, "cHx,b,t", pa20, FLAG_STRICT},
-{ "havg",	0x080002c0, 0xfc00ffe0, "x,b,t", pa20, FLAG_STRICT},
-{ "hshl",	0xf8008800, 0xffe0fc20, "x,*,t", pa20, FLAG_STRICT},
-{ "hshladd",	0x08000700, 0xfc00ff20, "x,.,b,t", pa20, FLAG_STRICT},
-{ "hshr",	0xf800c800, 0xfc1ff820, "cSb,*,t", pa20, FLAG_STRICT},
-{ "hshradd",	0x08000500, 0xfc00ff20, "x,.,b,t", pa20, FLAG_STRICT},
-{ "hsub",	0x08000100, 0xfc00ff20, "cHx,b,t", pa20, FLAG_STRICT},
-{ "mixh",	0xf8008400, 0xfc009fe0, "chx,b,t", pa20, FLAG_STRICT},
-{ "mixw",	0xf8008000, 0xfc009fe0, "chx,b,t", pa20, FLAG_STRICT},
-{ "permh",	0xf8000000, 0xfc009020, "c*a,t", pa20, FLAG_STRICT},
-
-
-/* Extract and Deposit Instructions.  */
-
-{ "shrpd",	0xd0000200, 0xfc001fe0, "?Xx,b,!,t", pa20, FLAG_STRICT},
-{ "shrpd",	0xd0000400, 0xfc001400, "?Xx,b,~,t", pa20, FLAG_STRICT},
-{ "shrpw",	0xd0000000, 0xfc001fe0, "?xx,b,!,t", pa10, FLAG_STRICT},
-{ "shrpw",	0xd0000800, 0xfc001c00, "?xx,b,p,t", pa10, FLAG_STRICT},
-{ "vshd",	0xd0000000, 0xfc001fe0, "?xx,b,t", pa10, 0},
-{ "shd",	0xd0000800, 0xfc001c00, "?xx,b,p,t", pa10, 0},
-{ "extrd",	0xd0001200, 0xfc001ae0, "cS?Xb,!,%,x", pa20, FLAG_STRICT},
-{ "extrd",	0xd8000000, 0xfc000000, "cS?Xb,q,|,x", pa20, FLAG_STRICT},
-{ "extrw",	0xd0001000, 0xfc001be0, "cS?xb,!,T,x", pa10, FLAG_STRICT},
-{ "extrw",	0xd0001800, 0xfc001800, "cS?xb,P,T,x", pa10, FLAG_STRICT},
-{ "vextru",	0xd0001000, 0xfc001fe0, "?xb,T,x", pa10, 0},
-{ "vextrs",	0xd0001400, 0xfc001fe0, "?xb,T,x", pa10, 0},
-{ "extru",	0xd0001800, 0xfc001c00, "?xb,P,T,x", pa10, 0},
-{ "extrs",	0xd0001c00, 0xfc001c00, "?xb,P,T,x", pa10, 0},
-{ "depd",	0xd4000200, 0xfc001ae0, "cz?Xx,!,%,b", pa20, FLAG_STRICT},
-{ "depd",	0xf0000000, 0xfc000000, "cz?Xx,~,|,b", pa20, FLAG_STRICT},
-{ "depdi",	0xd4001200, 0xfc001ae0, "cz?X5,!,%,b", pa20, FLAG_STRICT},
-{ "depdi",	0xf4000000, 0xfc000000, "cz?X5,~,|,b", pa20, FLAG_STRICT},
-{ "depw",	0xd4000000, 0xfc001be0, "cz?xx,!,T,b", pa10, FLAG_STRICT},
-{ "depw",	0xd4000800, 0xfc001800, "cz?xx,p,T,b", pa10, FLAG_STRICT},
-{ "depwi",	0xd4001000, 0xfc001be0, "cz?x5,!,T,b", pa10, FLAG_STRICT},
-{ "depwi",	0xd4001800, 0xfc001800, "cz?x5,p,T,b", pa10, FLAG_STRICT},
-{ "zvdep",	0xd4000000, 0xfc001fe0, "?xx,T,b", pa10, 0},
-{ "vdep",	0xd4000400, 0xfc001fe0, "?xx,T,b", pa10, 0},
-{ "zdep",	0xd4000800, 0xfc001c00, "?xx,p,T,b", pa10, 0},
-{ "dep",	0xd4000c00, 0xfc001c00, "?xx,p,T,b", pa10, 0},
-{ "zvdepi",	0xd4001000, 0xfc001fe0, "?x5,T,b", pa10, 0},
-{ "vdepi",	0xd4001400, 0xfc001fe0, "?x5,T,b", pa10, 0},
-{ "zdepi",	0xd4001800, 0xfc001c00, "?x5,p,T,b", pa10, 0},
-{ "depi",	0xd4001c00, 0xfc001c00, "?x5,p,T,b", pa10, 0},
-
-/* System Control Instructions.  */
-
-{ "break",	0x00000000, 0xfc001fe0, "r,A", pa10, 0},
-{ "rfi",	0x00000c00, 0xffffff1f, "cr", pa10, FLAG_STRICT},
-{ "rfi",	0x00000c00, 0xffffffff, "", pa10, 0},
-{ "rfir",	0x00000ca0, 0xffffffff, "", pa11, 0},
-{ "ssm",	0x00000d60, 0xfc00ffe0, "U,t", pa20, FLAG_STRICT},
-{ "ssm",	0x00000d60, 0xffe0ffe0, "R,t", pa10, 0},
-{ "rsm",	0x00000e60, 0xfc00ffe0, "U,t", pa20, FLAG_STRICT},
-{ "rsm",	0x00000e60, 0xffe0ffe0, "R,t", pa10, 0},
-{ "mtsm",	0x00001860, 0xffe0ffff, "x", pa10, 0},
-{ "ldsid",	0x000010a0, 0xfc1fffe0, "(b),t", pa10, 0},
-{ "ldsid",	0x000010a0, 0xfc1f3fe0, "(s,b),t", pa10, 0},
-{ "mtsp",	0x00001820, 0xffe01fff, "x,S", pa10, 0},
-{ "mtctl",	0x00001840, 0xfc00ffff, "x,^", pa10, 0},
-{ "mtsarcm",	0x016018C0, 0xffe0ffff, "x", pa20, FLAG_STRICT},
-{ "mfia",	0x000014A0, 0xffffffe0, "t", pa20, FLAG_STRICT},
-{ "mfsp",	0x000004a0, 0xffff1fe0, "S,t", pa10, 0},
-{ "mfctl",	0x016048a0, 0xffffffe0, "cW!,t", pa20, FLAG_STRICT},
-{ "mfctl",	0x000008a0, 0xfc1fffe0, "^,t", pa10, 0},
-{ "sync",	0x00000400, 0xffffffff, "", pa10, 0},
-{ "syncdma",	0x00100400, 0xffffffff, "", pa10, 0},
-{ "probe",	0x04001180, 0xfc00ffa0, "cw(b),x,t", pa10, FLAG_STRICT},
-{ "probe",	0x04001180, 0xfc003fa0, "cw(s,b),x,t", pa10, FLAG_STRICT},
-{ "probei",	0x04003180, 0xfc00ffa0, "cw(b),R,t", pa10, FLAG_STRICT},
-{ "probei",	0x04003180, 0xfc003fa0, "cw(s,b),R,t", pa10, FLAG_STRICT},
-{ "prober",	0x04001180, 0xfc00ffe0, "(b),x,t", pa10, 0},
-{ "prober",	0x04001180, 0xfc003fe0, "(s,b),x,t", pa10, 0},
-{ "proberi",	0x04003180, 0xfc00ffe0, "(b),R,t", pa10, 0},
-{ "proberi",	0x04003180, 0xfc003fe0, "(s,b),R,t", pa10, 0},
-{ "probew",	0x040011c0, 0xfc00ffe0, "(b),x,t", pa10, 0},
-{ "probew",	0x040011c0, 0xfc003fe0, "(s,b),x,t", pa10, 0},
-{ "probewi",	0x040031c0, 0xfc00ffe0, "(b),R,t", pa10, 0},
-{ "probewi",	0x040031c0, 0xfc003fe0, "(s,b),R,t", pa10, 0},
-{ "lpa",	0x04001340, 0xfc00ffc0, "cZx(b),t", pa10, 0},
-{ "lpa",	0x04001340, 0xfc003fc0, "cZx(s,b),t", pa10, 0},
-{ "lci",	0x04001300, 0xfc00ffe0, "x(b),t", pa11, 0},
-{ "lci",	0x04001300, 0xfc003fe0, "x(s,b),t", pa11, 0},
-{ "pdtlb",	0x04001600, 0xfc00ffdf, "cLcZx(b)", pa20, FLAG_STRICT},
-{ "pdtlb",	0x04001600, 0xfc003fdf, "cLcZx(s,b)", pa20, FLAG_STRICT},
-{ "pdtlb",	0x04001600, 0xfc1fffdf, "cLcZ@(b)", pa20, FLAG_STRICT},
-{ "pdtlb",	0x04001600, 0xfc1f3fdf, "cLcZ@(s,b)", pa20, FLAG_STRICT},
-{ "pdtlb",	0x04001200, 0xfc00ffdf, "cZx(b)", pa10, 0},
-{ "pdtlb",	0x04001200, 0xfc003fdf, "cZx(s,b)", pa10, 0},
-{ "pitlb",	0x04000600, 0xfc001fdf, "cLcZx(S,b)", pa20, FLAG_STRICT},
-{ "pitlb",	0x04000600, 0xfc1f1fdf, "cLcZ@(S,b)", pa20, FLAG_STRICT},
-{ "pitlb",	0x04000200, 0xfc001fdf, "cZx(S,b)", pa10, 0},
-{ "pdtlbe",	0x04001240, 0xfc00ffdf, "cZx(b)", pa10, 0},
-{ "pdtlbe",	0x04001240, 0xfc003fdf, "cZx(s,b)", pa10, 0},
-{ "pitlbe",	0x04000240, 0xfc001fdf, "cZx(S,b)", pa10, 0},
-{ "idtlba",	0x04001040, 0xfc00ffff, "x,(b)", pa10, 0},
-{ "idtlba",	0x04001040, 0xfc003fff, "x,(s,b)", pa10, 0},
-{ "iitlba",	0x04000040, 0xfc001fff, "x,(S,b)", pa10, 0},
-{ "idtlbp",	0x04001000, 0xfc00ffff, "x,(b)", pa10, 0},
-{ "idtlbp",	0x04001000, 0xfc003fff, "x,(s,b)", pa10, 0},
-{ "iitlbp",	0x04000000, 0xfc001fff, "x,(S,b)", pa10, 0},
-{ "pdc",	0x04001380, 0xfc00ffdf, "cZx(b)", pa10, 0},
-{ "pdc",	0x04001380, 0xfc003fdf, "cZx(s,b)", pa10, 0},
-{ "fdc",	0x04001280, 0xfc00ffdf, "cZx(b)", pa10, FLAG_STRICT},
-{ "fdc",	0x04001280, 0xfc003fdf, "cZx(s,b)", pa10, FLAG_STRICT},
-{ "fdc",	0x04003280, 0xfc00ffff, "5(b)", pa20, FLAG_STRICT},
-{ "fdc",	0x04003280, 0xfc003fff, "5(s,b)", pa20, FLAG_STRICT},
-{ "fdc",	0x04001280, 0xfc00ffdf, "cZx(b)", pa10, 0},
-{ "fdc",	0x04001280, 0xfc003fdf, "cZx(s,b)", pa10, 0},
-{ "fic",	0x040013c0, 0xfc00dfdf, "cZx(b)", pa20, FLAG_STRICT},
-{ "fic",	0x04000280, 0xfc001fdf, "cZx(S,b)", pa10, 0},
-{ "fdce",	0x040012c0, 0xfc00ffdf, "cZx(b)", pa10, 0},
-{ "fdce",	0x040012c0, 0xfc003fdf, "cZx(s,b)", pa10, 0},
-{ "fice",	0x040002c0, 0xfc001fdf, "cZx(S,b)", pa10, 0},
-{ "diag",	0x14000000, 0xfc000000, "D", pa10, 0},
-{ "idtlbt",	0x04001800, 0xfc00ffff, "x,b", pa20, FLAG_STRICT},
-{ "iitlbt",	0x04000800, 0xfc00ffff, "x,b", pa20, FLAG_STRICT},
-
-/* These may be specific to certain versions of the PA.  Joel claimed
-   they were 72000 (7200?) specific.  However, I'm almost certain the
-   mtcpu/mfcpu were undocumented, but available in the older 700 machines.  */
-{ "mtcpu",	0x14001600, 0xfc00ffff, "x,^", pa10, 0},
-{ "mfcpu",	0x14001A00, 0xfc00ffff, "^,x", pa10, 0},
-{ "tocen",	0x14403600, 0xffffffff, "", pa10, 0},
-{ "tocdis",	0x14401620, 0xffffffff, "", pa10, 0},
-{ "shdwgr",	0x14402600, 0xffffffff, "", pa10, 0},
-{ "grshdw",	0x14400620, 0xffffffff, "", pa10, 0},
-
-/* gfw and gfr are not in the HP PA 1.1 manual, but they are in either
-   the Timex FPU or the Mustang ERS (not sure which) manual.  */
-{ "gfw",	0x04001680, 0xfc00ffdf, "cZx(b)", pa11, 0},
-{ "gfw",	0x04001680, 0xfc003fdf, "cZx(s,b)", pa11, 0},
-{ "gfr",	0x04001a80, 0xfc00ffdf, "cZx(b)", pa11, 0},
-{ "gfr",	0x04001a80, 0xfc003fdf, "cZx(s,b)", pa11, 0},
-
-/* Floating Point Coprocessor Instructions.  */
-
-{ "fldw",	0x24000000, 0xfc00df80, "cXx(b),fT", pa10, FLAG_STRICT},
-{ "fldw",	0x24000000, 0xfc001f80, "cXx(s,b),fT", pa10, FLAG_STRICT},
-{ "fldw",	0x24000000, 0xfc00d380, "cxccx(b),fT", pa11, FLAG_STRICT},
-{ "fldw",	0x24000000, 0xfc001380, "cxccx(s,b),fT", pa11, FLAG_STRICT},
-{ "fldw",	0x24001020, 0xfc1ff3a0, "cocc@(b),fT", pa20, FLAG_STRICT},
-{ "fldw",	0x24001020, 0xfc1f33a0, "cocc@(s,b),fT", pa20, FLAG_STRICT},
-{ "fldw",	0x24001000, 0xfc00df80, "cM5(b),fT", pa10, FLAG_STRICT},
-{ "fldw",	0x24001000, 0xfc001f80, "cM5(s,b),fT", pa10, FLAG_STRICT},
-{ "fldw",	0x24001000, 0xfc00d380, "cmcc5(b),fT", pa11, FLAG_STRICT},
-{ "fldw",	0x24001000, 0xfc001380, "cmcc5(s,b),fT", pa11, FLAG_STRICT},
-{ "fldw",	0x5c000000, 0xfc000004, "y(b),fe", pa20w, FLAG_STRICT},
-{ "fldw",	0x58000000, 0xfc000000, "cJy(b),fe", pa20w, FLAG_STRICT},
-{ "fldw",	0x5c000000, 0xfc00c004, "d(b),fe", pa20, FLAG_STRICT},
-{ "fldw",	0x5c000000, 0xfc000004, "d(s,b),fe", pa20, FLAG_STRICT},
-{ "fldw",	0x58000000, 0xfc00c000, "cJd(b),fe", pa20, FLAG_STRICT},
-{ "fldw",	0x58000000, 0xfc000000, "cJd(s,b),fe", pa20, FLAG_STRICT},
-{ "fldd",	0x2c000000, 0xfc00dfc0, "cXx(b),ft", pa10, FLAG_STRICT},
-{ "fldd",	0x2c000000, 0xfc001fc0, "cXx(s,b),ft", pa10, FLAG_STRICT},
-{ "fldd",	0x2c000000, 0xfc00d3c0, "cxccx(b),ft", pa11, FLAG_STRICT},
-{ "fldd",	0x2c000000, 0xfc0013c0, "cxccx(s,b),ft", pa11, FLAG_STRICT},
-{ "fldd",	0x2c001020, 0xfc1ff3e0, "cocc@(b),ft", pa20, FLAG_STRICT},
-{ "fldd",	0x2c001020, 0xfc1f33e0, "cocc@(s,b),ft", pa20, FLAG_STRICT},
-{ "fldd",	0x2c001000, 0xfc00dfc0, "cM5(b),ft", pa10, FLAG_STRICT},
-{ "fldd",	0x2c001000, 0xfc001fc0, "cM5(s,b),ft", pa10, FLAG_STRICT},
-{ "fldd",	0x2c001000, 0xfc00d3c0, "cmcc5(b),ft", pa11, FLAG_STRICT},
-{ "fldd",	0x2c001000, 0xfc0013c0, "cmcc5(s,b),ft", pa11, FLAG_STRICT},
-{ "fldd",	0x50000002, 0xfc000002, "cq&(b),fx", pa20w, FLAG_STRICT},
-{ "fldd",	0x50000002, 0xfc00c002, "cq#(b),fx", pa20, FLAG_STRICT},
-{ "fldd",	0x50000002, 0xfc000002, "cq#(s,b),fx", pa20, FLAG_STRICT},
-{ "fstw",	0x24000200, 0xfc00df80, "cXfT,x(b)", pa10, FLAG_STRICT},
-{ "fstw",	0x24000200, 0xfc001f80, "cXfT,x(s,b)", pa10, FLAG_STRICT},
-{ "fstw",	0x24000200, 0xfc00d380, "cxcCfT,x(b)", pa11, FLAG_STRICT},
-{ "fstw",	0x24000200, 0xfc001380, "cxcCfT,x(s,b)", pa11, FLAG_STRICT},
-{ "fstw",	0x24001220, 0xfc1ff3a0, "cocCfT,@(b)", pa20, FLAG_STRICT},
-{ "fstw",	0x24001220, 0xfc1f33a0, "cocCfT,@(s,b)", pa20, FLAG_STRICT},
-{ "fstw",	0x24001200, 0xfc00df80, "cMfT,5(b)", pa10, FLAG_STRICT},
-{ "fstw",	0x24001200, 0xfc001f80, "cMfT,5(s,b)", pa10, FLAG_STRICT},
-{ "fstw",	0x24001200, 0xfc00df80, "cMfT,5(b)", pa10, FLAG_STRICT},
-{ "fstw",	0x24001200, 0xfc001f80, "cMfT,5(s,b)", pa10, FLAG_STRICT},
-{ "fstw",	0x7c000000, 0xfc000004, "fE,y(b)", pa20w, FLAG_STRICT},
-{ "fstw",	0x78000000, 0xfc000000, "cJfE,y(b)", pa20w, FLAG_STRICT},
-{ "fstw",	0x7c000000, 0xfc00c004, "fE,d(b)", pa20, FLAG_STRICT},
-{ "fstw",	0x7c000000, 0xfc000004, "fE,d(s,b)", pa20, FLAG_STRICT},
-{ "fstw",	0x78000000, 0xfc00c000, "cJfE,d(b)", pa20, FLAG_STRICT},
-{ "fstw",	0x78000000, 0xfc000000, "cJfE,d(s,b)", pa20, FLAG_STRICT},
-{ "fstd",	0x2c000200, 0xfc00dfc0, "cXft,x(b)", pa10, FLAG_STRICT},
-{ "fstd",	0x2c000200, 0xfc001fc0, "cXft,x(s,b)", pa10, FLAG_STRICT},
-{ "fstd",	0x2c000200, 0xfc00d3c0, "cxcCft,x(b)", pa11, FLAG_STRICT},
-{ "fstd",	0x2c000200, 0xfc0013c0, "cxcCft,x(s,b)", pa11, FLAG_STRICT},
-{ "fstd",	0x2c001220, 0xfc1ff3e0, "cocCft,@(b)", pa20, FLAG_STRICT},
-{ "fstd",	0x2c001220, 0xfc1f33e0, "cocCft,@(s,b)", pa20, FLAG_STRICT},
-{ "fstd",	0x2c001200, 0xfc00dfc0, "cMft,5(b)", pa10, FLAG_STRICT},
-{ "fstd",	0x2c001200, 0xfc001fc0, "cMft,5(s,b)", pa10, FLAG_STRICT},
-{ "fstd",	0x2c001200, 0xfc00d3c0, "cmcCft,5(b)", pa11, FLAG_STRICT},
-{ "fstd",	0x2c001200, 0xfc0013c0, "cmcCft,5(s,b)", pa11, FLAG_STRICT},
-{ "fstd",	0x70000002, 0xfc000002, "cqfx,&(b)", pa20w, FLAG_STRICT},
-{ "fstd",	0x70000002, 0xfc00c002, "cqfx,#(b)", pa20, FLAG_STRICT},
-{ "fstd",	0x70000002, 0xfc000002, "cqfx,#(s,b)", pa20, FLAG_STRICT},
-{ "fldwx",	0x24000000, 0xfc00df80, "cXx(b),fT", pa10, FLAG_STRICT},
-{ "fldwx",	0x24000000, 0xfc001f80, "cXx(s,b),fT", pa10, FLAG_STRICT},
-{ "fldwx",	0x24000000, 0xfc00d380, "cxccx(b),fT", pa11, FLAG_STRICT},
-{ "fldwx",	0x24000000, 0xfc001380, "cxccx(s,b),fT", pa11, FLAG_STRICT},
-{ "fldwx",	0x24000000, 0xfc00df80, "cXx(b),fT", pa10, 0},
-{ "fldwx",	0x24000000, 0xfc001f80, "cXx(s,b),fT", pa10, 0},
-{ "flddx",	0x2c000000, 0xfc00dfc0, "cXx(b),ft", pa10, FLAG_STRICT},
-{ "flddx",	0x2c000000, 0xfc001fc0, "cXx(s,b),ft", pa10, FLAG_STRICT},
-{ "flddx",	0x2c000000, 0xfc00d3c0, "cxccx(b),ft", pa11, FLAG_STRICT},
-{ "flddx",	0x2c000000, 0xfc0013c0, "cxccx(s,b),ft", pa11, FLAG_STRICT},
-{ "flddx",	0x2c000000, 0xfc00dfc0, "cXx(b),ft", pa10, 0},
-{ "flddx",	0x2c000000, 0xfc001fc0, "cXx(s,b),ft", pa10, 0},
-{ "fstwx",	0x24000200, 0xfc00df80, "cxfT,x(b)", pa10, FLAG_STRICT},
-{ "fstwx",	0x24000200, 0xfc001f80, "cxfT,x(s,b)", pa10, FLAG_STRICT},
-{ "fstwx",	0x24000200, 0xfc00d380, "cxcCfT,x(b)", pa11, FLAG_STRICT},
-{ "fstwx",	0x24000200, 0xfc001380, "cxcCfT,x(s,b)", pa11, FLAG_STRICT},
-{ "fstwx",	0x24000200, 0xfc00df80, "cxfT,x(b)", pa10, 0},
-{ "fstwx",	0x24000200, 0xfc001f80, "cxfT,x(s,b)", pa10, 0},
-{ "fstdx",	0x2c000200, 0xfc00dfc0, "cxft,x(b)", pa10, FLAG_STRICT},
-{ "fstdx",	0x2c000200, 0xfc001fc0, "cxft,x(s,b)", pa10, FLAG_STRICT},
-{ "fstdx",	0x2c000200, 0xfc00d3c0, "cxcCft,x(b)", pa11, FLAG_STRICT},
-{ "fstdx",	0x2c000200, 0xfc0013c0, "cxcCft,x(s,b)", pa11, FLAG_STRICT},
-{ "fstdx",	0x2c000200, 0xfc00dfc0, "cxft,x(b)", pa10, 0},
-{ "fstdx",	0x2c000200, 0xfc001fc0, "cxft,x(s,b)", pa10, 0},
-{ "fstqx",	0x3c000200, 0xfc00dfc0, "cxft,x(b)", pa10, 0},
-{ "fstqx",	0x3c000200, 0xfc001fc0, "cxft,x(s,b)", pa10, 0},
-{ "fldws",	0x24001000, 0xfc00df80, "cm5(b),fT", pa10, FLAG_STRICT},
-{ "fldws",	0x24001000, 0xfc001f80, "cm5(s,b),fT", pa10, FLAG_STRICT},
-{ "fldws",	0x24001000, 0xfc00d380, "cmcc5(b),fT", pa11, FLAG_STRICT},
-{ "fldws",	0x24001000, 0xfc001380, "cmcc5(s,b),fT", pa11, FLAG_STRICT},
-{ "fldws",	0x24001000, 0xfc00df80, "cm5(b),fT", pa10, 0},
-{ "fldws",	0x24001000, 0xfc001f80, "cm5(s,b),fT", pa10, 0},
-{ "fldds",	0x2c001000, 0xfc00dfc0, "cm5(b),ft", pa10, FLAG_STRICT},
-{ "fldds",	0x2c001000, 0xfc001fc0, "cm5(s,b),ft", pa10, FLAG_STRICT},
-{ "fldds",	0x2c001000, 0xfc00d3c0, "cmcc5(b),ft", pa11, FLAG_STRICT},
-{ "fldds",	0x2c001000, 0xfc0013c0, "cmcc5(s,b),ft", pa11, FLAG_STRICT},
-{ "fldds",	0x2c001000, 0xfc00dfc0, "cm5(b),ft", pa10, 0},
-{ "fldds",	0x2c001000, 0xfc001fc0, "cm5(s,b),ft", pa10, 0},
-{ "fstws",	0x24001200, 0xfc00df80, "cmfT,5(b)", pa10, FLAG_STRICT},
-{ "fstws",	0x24001200, 0xfc001f80, "cmfT,5(s,b)", pa10, FLAG_STRICT},
-{ "fstws",	0x24001200, 0xfc00d380, "cmcCfT,5(b)", pa11, FLAG_STRICT},
-{ "fstws",	0x24001200, 0xfc001380, "cmcCfT,5(s,b)", pa11, FLAG_STRICT},
-{ "fstws",	0x24001200, 0xfc00df80, "cmfT,5(b)", pa10, 0},
-{ "fstws",	0x24001200, 0xfc001f80, "cmfT,5(s,b)", pa10, 0},
-{ "fstds",	0x2c001200, 0xfc00dfc0, "cmft,5(b)", pa10, FLAG_STRICT},
-{ "fstds",	0x2c001200, 0xfc001fc0, "cmft,5(s,b)", pa10, FLAG_STRICT},
-{ "fstds",	0x2c001200, 0xfc00d3c0, "cmcCft,5(b)", pa11, FLAG_STRICT},
-{ "fstds",	0x2c001200, 0xfc0013c0, "cmcCft,5(s,b)", pa11, FLAG_STRICT},
-{ "fstds",	0x2c001200, 0xfc00dfc0, "cmft,5(b)", pa10, 0},
-{ "fstds",	0x2c001200, 0xfc001fc0, "cmft,5(s,b)", pa10, 0},
-{ "fstqs",	0x3c001200, 0xfc00dfc0, "cmft,5(b)", pa10, 0},
-{ "fstqs",	0x3c001200, 0xfc001fc0, "cmft,5(s,b)", pa10, 0},
-{ "fadd",	0x30000600, 0xfc00e7e0, "Ffa,fb,fT", pa10, 0},
-{ "fadd",	0x38000600, 0xfc00e720, "IfA,fB,fT", pa10, 0},
-{ "fsub",	0x30002600, 0xfc00e7e0, "Ffa,fb,fT", pa10, 0},
-{ "fsub",	0x38002600, 0xfc00e720, "IfA,fB,fT", pa10, 0},
-{ "fmpy",	0x30004600, 0xfc00e7e0, "Ffa,fb,fT", pa10, 0},
-{ "fmpy",	0x38004600, 0xfc00e720, "IfA,fB,fT", pa10, 0},
-{ "fdiv",	0x30006600, 0xfc00e7e0, "Ffa,fb,fT", pa10, 0},
-{ "fdiv",	0x38006600, 0xfc00e720, "IfA,fB,fT", pa10, 0},
-{ "fsqrt",	0x30008000, 0xfc1fe7e0, "Ffa,fT", pa10, 0},
-{ "fsqrt",	0x38008000, 0xfc1fe720, "FfA,fT", pa10, 0},
-{ "fabs",	0x30006000, 0xfc1fe7e0, "Ffa,fT", pa10, 0},
-{ "fabs",	0x38006000, 0xfc1fe720, "FfA,fT", pa10, 0},
-{ "frem",	0x30008600, 0xfc00e7e0, "Ffa,fb,fT", pa10, 0},
-{ "frem",	0x38008600, 0xfc00e720, "FfA,fB,fT", pa10, 0},
-{ "frnd",	0x3000a000, 0xfc1fe7e0, "Ffa,fT", pa10, 0},
-{ "frnd",	0x3800a000, 0xfc1fe720, "FfA,fT", pa10, 0},
-{ "fcpy",	0x30004000, 0xfc1fe7e0, "Ffa,fT", pa10, 0},
-{ "fcpy",	0x38004000, 0xfc1fe720, "FfA,fT", pa10, 0},
-{ "fcnvff",	0x30000200, 0xfc1f87e0, "FGfa,fT", pa10, 0},
-{ "fcnvff",	0x38000200, 0xfc1f8720, "FGfA,fT", pa10, 0},
-{ "fcnvxf",	0x30008200, 0xfc1f87e0, "FGfa,fT", pa10, 0},
-{ "fcnvxf",	0x38008200, 0xfc1f8720, "FGfA,fT", pa10, 0},
-{ "fcnvfx",	0x30010200, 0xfc1f87e0, "FGfa,fT", pa10, 0},
-{ "fcnvfx",	0x38010200, 0xfc1f8720, "FGfA,fT", pa10, 0},
-{ "fcnvfxt",	0x30018200, 0xfc1f87e0, "FGfa,fT", pa10, 0},
-{ "fcnvfxt",	0x38018200, 0xfc1f8720, "FGfA,fT", pa10, 0},
-{ "fmpyfadd",	0xb8000000, 0xfc000020, "IfA,fB,fC,fT", pa20, FLAG_STRICT},
-{ "fmpynfadd",	0xb8000020, 0xfc000020, "IfA,fB,fC,fT", pa20, FLAG_STRICT},
-{ "fneg",	0x3000c000, 0xfc1fe7e0, "Ffa,fT", pa20, FLAG_STRICT},
-{ "fneg",	0x3800c000, 0xfc1fe720, "IfA,fT", pa20, FLAG_STRICT},
-{ "fnegabs",	0x3000e000, 0xfc1fe7e0, "Ffa,fT", pa20, FLAG_STRICT},
-{ "fnegabs",	0x3800e000, 0xfc1fe720, "IfA,fT", pa20, FLAG_STRICT},
-{ "fcnv",	0x30000200, 0xfc1c0720, "{_fa,fT", pa20, FLAG_STRICT},
-{ "fcnv",	0x38000200, 0xfc1c0720, "FGfA,fT", pa20, FLAG_STRICT},
-{ "fcmp",	0x30000400, 0xfc00e7e0, "F?ffa,fb", pa10, FLAG_STRICT},
-{ "fcmp",	0x38000400, 0xfc00e720, "I?ffA,fB", pa10, FLAG_STRICT},
-{ "fcmp",	0x30000400, 0xfc0007e0, "F?ffa,fb,h", pa20, FLAG_STRICT},
-{ "fcmp",	0x38000400, 0xfc000720, "I?ffA,fB,h", pa20, FLAG_STRICT},
-{ "fcmp",	0x30000400, 0xfc00e7e0, "F?ffa,fb", pa10, 0},
-{ "fcmp",	0x38000400, 0xfc00e720, "I?ffA,fB", pa10, 0},
-{ "xmpyu",	0x38004700, 0xfc00e720, "fX,fB,fT", pa11, 0},
-{ "fmpyadd",	0x18000000, 0xfc000000, "Hfi,fj,fk,fl,fm", pa11, 0},
-{ "fmpysub",	0x98000000, 0xfc000000, "Hfi,fj,fk,fl,fm", pa11, 0},
-{ "ftest",	0x30002420, 0xffffffff, "", pa10, FLAG_STRICT},
-{ "ftest",	0x30002420, 0xffffffe0, ",=", pa20, FLAG_STRICT},
-{ "ftest",	0x30000420, 0xffff1fff, "m", pa20, FLAG_STRICT},
-{ "fid",	0x30000000, 0xffffffff, "", pa11, 0},
-
-/* Performance Monitor Instructions.  */
-
-{ "pmdis",	0x30000280, 0xffffffdf, "N", pa20, FLAG_STRICT},
-{ "pmenb",	0x30000680, 0xffffffff, "", pa20, FLAG_STRICT},
-
-/* Assist Instructions.  */
-
-{ "spop0",	0x10000000, 0xfc000600, "v,ON", pa10, 0},
-{ "spop1",	0x10000200, 0xfc000600, "v,oNt", pa10, 0},
-{ "spop2",	0x10000400, 0xfc000600, "v,1Nb", pa10, 0},
-{ "spop3",	0x10000600, 0xfc000600, "v,0Nx,b", pa10, 0},
-{ "copr",	0x30000000, 0xfc000000, "u,2N", pa10, 0},
-{ "cldw",	0x24000000, 0xfc00de00, "ucXx(b),t", pa10, FLAG_STRICT},
-{ "cldw",	0x24000000, 0xfc001e00, "ucXx(s,b),t", pa10, FLAG_STRICT},
-{ "cldw",	0x24000000, 0xfc00d200, "ucxccx(b),t", pa11, FLAG_STRICT},
-{ "cldw",	0x24000000, 0xfc001200, "ucxccx(s,b),t", pa11, FLAG_STRICT},
-{ "cldw",	0x24001000, 0xfc00d200, "ucocc@(b),t", pa20, FLAG_STRICT},
-{ "cldw",	0x24001000, 0xfc001200, "ucocc@(s,b),t", pa20, FLAG_STRICT},
-{ "cldw",	0x24001000, 0xfc00de00, "ucM5(b),t", pa10, FLAG_STRICT},
-{ "cldw",	0x24001000, 0xfc001e00, "ucM5(s,b),t", pa10, FLAG_STRICT},
-{ "cldw",	0x24001000, 0xfc00d200, "ucmcc5(b),t", pa11, FLAG_STRICT},
-{ "cldw",	0x24001000, 0xfc001200, "ucmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "cldd",	0x2c000000, 0xfc00de00, "ucXx(b),t", pa10, FLAG_STRICT},
-{ "cldd",	0x2c000000, 0xfc001e00, "ucXx(s,b),t", pa10, FLAG_STRICT},
-{ "cldd",	0x2c000000, 0xfc00d200, "ucxccx(b),t", pa11, FLAG_STRICT},
-{ "cldd",	0x2c000000, 0xfc001200, "ucxccx(s,b),t", pa11, FLAG_STRICT},
-{ "cldd",	0x2c001000, 0xfc00d200, "ucocc@(b),t", pa20, FLAG_STRICT},
-{ "cldd",	0x2c001000, 0xfc001200, "ucocc@(s,b),t", pa20, FLAG_STRICT},
-{ "cldd",	0x2c001000, 0xfc00de00, "ucM5(b),t", pa10, FLAG_STRICT},
-{ "cldd",	0x2c001000, 0xfc001e00, "ucM5(s,b),t", pa10, FLAG_STRICT},
-{ "cldd",	0x2c001000, 0xfc00d200, "ucmcc5(b),t", pa11, FLAG_STRICT},
-{ "cldd",	0x2c001000, 0xfc001200, "ucmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "cstw",	0x24000200, 0xfc00de00, "ucXt,x(b)", pa10, FLAG_STRICT},
-{ "cstw",	0x24000200, 0xfc001e00, "ucXt,x(s,b)", pa10, FLAG_STRICT},
-{ "cstw",	0x24000200, 0xfc00d200, "ucxcCt,x(b)", pa11, FLAG_STRICT},
-{ "cstw",	0x24000200, 0xfc001200, "ucxcCt,x(s,b)", pa11, FLAG_STRICT},
-{ "cstw",	0x24001200, 0xfc00d200, "ucocCt,@(b)", pa20, FLAG_STRICT},
-{ "cstw",	0x24001200, 0xfc001200, "ucocCt,@(s,b)", pa20, FLAG_STRICT},
-{ "cstw",	0x24001200, 0xfc00de00, "ucMt,5(b)", pa10, FLAG_STRICT},
-{ "cstw",	0x24001200, 0xfc001e00, "ucMt,5(s,b)", pa10, FLAG_STRICT},
-{ "cstw",	0x24001200, 0xfc00d200, "ucmcCt,5(b)", pa11, FLAG_STRICT},
-{ "cstw",	0x24001200, 0xfc001200, "ucmcCt,5(s,b)", pa11, FLAG_STRICT},
-{ "cstd",	0x2c000200, 0xfc00de00, "ucXt,x(b)", pa10, FLAG_STRICT},
-{ "cstd",	0x2c000200, 0xfc001e00, "ucXt,x(s,b)", pa10, FLAG_STRICT},
-{ "cstd",	0x2c000200, 0xfc00d200, "ucxcCt,x(b)", pa11, FLAG_STRICT},
-{ "cstd",	0x2c000200, 0xfc001200, "ucxcCt,x(s,b)", pa11, FLAG_STRICT},
-{ "cstd",	0x2c001200, 0xfc00d200, "ucocCt,@(b)", pa20, FLAG_STRICT},
-{ "cstd",	0x2c001200, 0xfc001200, "ucocCt,@(s,b)", pa20, FLAG_STRICT},
-{ "cstd",	0x2c001200, 0xfc00de00, "ucMt,5(b)", pa10, FLAG_STRICT},
-{ "cstd",	0x2c001200, 0xfc001e00, "ucMt,5(s,b)", pa10, FLAG_STRICT},
-{ "cstd",	0x2c001200, 0xfc00d200, "ucmcCt,5(b)", pa11, FLAG_STRICT},
-{ "cstd",	0x2c001200, 0xfc001200, "ucmcCt,5(s,b)", pa11, FLAG_STRICT},
-{ "cldwx",	0x24000000, 0xfc00de00, "ucXx(b),t", pa10, FLAG_STRICT},
-{ "cldwx",	0x24000000, 0xfc001e00, "ucXx(s,b),t", pa10, FLAG_STRICT},
-{ "cldwx",	0x24000000, 0xfc00d200, "ucxccx(b),t", pa11, FLAG_STRICT},
-{ "cldwx",	0x24000000, 0xfc001200, "ucxccx(s,b),t", pa11, FLAG_STRICT},
-{ "cldwx",	0x24000000, 0xfc00de00, "ucXx(b),t", pa10, 0},
-{ "cldwx",	0x24000000, 0xfc001e00, "ucXx(s,b),t", pa10, 0},
-{ "clddx",	0x2c000000, 0xfc00de00, "ucXx(b),t", pa10, FLAG_STRICT},
-{ "clddx",	0x2c000000, 0xfc001e00, "ucXx(s,b),t", pa10, FLAG_STRICT},
-{ "clddx",	0x2c000000, 0xfc00d200, "ucxccx(b),t", pa11, FLAG_STRICT},
-{ "clddx",	0x2c000000, 0xfc001200, "ucxccx(s,b),t", pa11, FLAG_STRICT},
-{ "clddx",	0x2c000000, 0xfc00de00, "ucXx(b),t", pa10, 0},
-{ "clddx",	0x2c000000, 0xfc001e00, "ucXx(s,b),t", pa10, 0},
-{ "cstwx",	0x24000200, 0xfc00de00, "ucXt,x(b)", pa10, FLAG_STRICT},
-{ "cstwx",	0x24000200, 0xfc001e00, "ucXt,x(s,b)", pa10, FLAG_STRICT},
-{ "cstwx",	0x24000200, 0xfc00d200, "ucxcCt,x(b)", pa11, FLAG_STRICT},
-{ "cstwx",	0x24000200, 0xfc001200, "ucxcCt,x(s,b)", pa11, FLAG_STRICT},
-{ "cstwx",	0x24000200, 0xfc00de00, "ucXt,x(b)", pa10, 0},
-{ "cstwx",	0x24000200, 0xfc001e00, "ucXt,x(s,b)", pa10, 0},
-{ "cstdx",	0x2c000200, 0xfc00de00, "ucXt,x(b)", pa10, FLAG_STRICT},
-{ "cstdx",	0x2c000200, 0xfc001e00, "ucXt,x(s,b)", pa10, FLAG_STRICT},
-{ "cstdx",	0x2c000200, 0xfc00d200, "ucxcCt,x(b)", pa11, FLAG_STRICT},
-{ "cstdx",	0x2c000200, 0xfc001200, "ucxcCt,x(s,b)", pa11, FLAG_STRICT},
-{ "cstdx",	0x2c000200, 0xfc00de00, "ucXt,x(b)", pa10, 0},
-{ "cstdx",	0x2c000200, 0xfc001e00, "ucXt,x(s,b)", pa10, 0},
-{ "cldws",	0x24001000, 0xfc00de00, "ucM5(b),t", pa10, FLAG_STRICT},
-{ "cldws",	0x24001000, 0xfc001e00, "ucM5(s,b),t", pa10, FLAG_STRICT},
-{ "cldws",	0x24001000, 0xfc00d200, "ucmcc5(b),t", pa11, FLAG_STRICT},
-{ "cldws",	0x24001000, 0xfc001200, "ucmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "cldws",	0x24001000, 0xfc00de00, "ucM5(b),t", pa10, 0},
-{ "cldws",	0x24001000, 0xfc001e00, "ucM5(s,b),t", pa10, 0},
-{ "cldds",	0x2c001000, 0xfc00de00, "ucM5(b),t", pa10, FLAG_STRICT},
-{ "cldds",	0x2c001000, 0xfc001e00, "ucM5(s,b),t", pa10, FLAG_STRICT},
-{ "cldds",	0x2c001000, 0xfc00d200, "ucmcc5(b),t", pa11, FLAG_STRICT},
-{ "cldds",	0x2c001000, 0xfc001200, "ucmcc5(s,b),t", pa11, FLAG_STRICT},
-{ "cldds",	0x2c001000, 0xfc00de00, "ucM5(b),t", pa10, 0},
-{ "cldds",	0x2c001000, 0xfc001e00, "ucM5(s,b),t", pa10, 0},
-{ "cstws",	0x24001200, 0xfc00de00, "ucMt,5(b)", pa10, FLAG_STRICT},
-{ "cstws",	0x24001200, 0xfc001e00, "ucMt,5(s,b)", pa10, FLAG_STRICT},
-{ "cstws",	0x24001200, 0xfc00d200, "ucmcCt,5(b)", pa11, FLAG_STRICT},
-{ "cstws",	0x24001200, 0xfc001200, "ucmcCt,5(s,b)", pa11, FLAG_STRICT},
-{ "cstws",	0x24001200, 0xfc00de00, "ucMt,5(b)", pa10, 0},
-{ "cstws",	0x24001200, 0xfc001e00, "ucMt,5(s,b)", pa10, 0},
-{ "cstds",	0x2c001200, 0xfc00de00, "ucMt,5(b)", pa10, FLAG_STRICT},
-{ "cstds",	0x2c001200, 0xfc001e00, "ucMt,5(s,b)", pa10, FLAG_STRICT},
-{ "cstds",	0x2c001200, 0xfc00d200, "ucmcCt,5(b)", pa11, FLAG_STRICT},
-{ "cstds",	0x2c001200, 0xfc001200, "ucmcCt,5(s,b)", pa11, FLAG_STRICT},
-{ "cstds",	0x2c001200, 0xfc00de00, "ucMt,5(b)", pa10, 0},
-{ "cstds",	0x2c001200, 0xfc001e00, "ucMt,5(s,b)", pa10, 0},
-
-/* More pseudo instructions which must follow the main table.  */
-{ "call",	0xe800f000, 0xfc1ffffd, "n(b)", pa20, FLAG_STRICT},
-{ "call",	0xe800a000, 0xffe0e000, "nW", pa10, FLAG_STRICT},
-{ "ret",	0xe840d000, 0xfffffffd, "n", pa20, FLAG_STRICT},
-
-};
-
-#define NUMOPCODES ((sizeof pa_opcodes)/(sizeof pa_opcodes[0]))
-
-/* SKV 12/18/92. Added some denotations for various operands.  */
-
-#define PA_IMM11_AT_31 'i'
-#define PA_IMM14_AT_31 'j'
-#define PA_IMM21_AT_31 'k'
-#define PA_DISP12 'w'
-#define PA_DISP17 'W'
-
-#define N_HPPA_OPERAND_FORMATS 5
-
-/* Integer register names, indexed by the numbers which appear in the
-   opcodes.  */
-static const char *const reg_names[] =
-{
-  "flags", "r1", "rp", "r3", "r4", "r5", "r6", "r7", "r8", "r9",
-  "r10", "r11", "r12", "r13", "r14", "r15", "r16", "r17", "r18", "r19",
-  "r20", "r21", "r22", "r23", "r24", "r25", "r26", "dp", "ret0", "ret1",
-  "sp", "r31"
-};
-
-/* Floating point register names, indexed by the numbers which appear in the
-   opcodes.  */
-static const char *const fp_reg_names[] =
-{
-  "fpsr", "fpe2", "fpe4", "fpe6",
-  "fr4", "fr5", "fr6", "fr7", "fr8",
-  "fr9", "fr10", "fr11", "fr12", "fr13", "fr14", "fr15",
-  "fr16", "fr17", "fr18", "fr19", "fr20", "fr21", "fr22", "fr23",
-  "fr24", "fr25", "fr26", "fr27", "fr28", "fr29", "fr30", "fr31"
-};
-
-typedef unsigned int CORE_ADDR;
-
-/* Get at various relevant fields of an instruction word.  */
-
-#define MASK_5  0x1f
-#define MASK_10 0x3ff
-#define MASK_11 0x7ff
-#define MASK_14 0x3fff
-#define MASK_16 0xffff
-#define MASK_21 0x1fffff
-
-/* These macros get bit fields using HP's numbering (MSB = 0).  */
-
-#define GET_FIELD(X, FROM, TO) \
-  ((X) >> (31 - (TO)) & ((1 << ((TO) - (FROM) + 1)) - 1))
-
-#define GET_BIT(X, WHICH) \
-  GET_FIELD (X, WHICH, WHICH)
-
-/* Some of these have been converted to 2-d arrays because they
-   consume less storage this way.  If the maintenance becomes a
-   problem, convert them back to const 1-d pointer arrays.  */
-static const char *const control_reg[] =
-{
-  "rctr", "cr1", "cr2", "cr3", "cr4", "cr5", "cr6", "cr7",
-  "pidr1", "pidr2", "ccr", "sar", "pidr3", "pidr4",
-  "iva", "eiem", "itmr", "pcsq", "pcoq", "iir", "isr",
-  "ior", "ipsw", "eirr", "tr0", "tr1", "tr2", "tr3",
-  "tr4", "tr5", "tr6", "tr7"
-};
-
-static const char *const compare_cond_names[] =
-{
-  "", ",=", ",<", ",<=", ",<<", ",<<=", ",sv", ",od",
-  ",tr", ",<>", ",>=", ",>", ",>>=", ",>>", ",nsv", ",ev"
-};
-static const char *const compare_cond_64_names[] =
-{
-  "", ",*=", ",*<", ",*<=", ",*<<", ",*<<=", ",*sv", ",*od",
-  ",*tr", ",*<>", ",*>=", ",*>", ",*>>=", ",*>>", ",*nsv", ",*ev"
-};
-static const char *const cmpib_cond_64_names[] =
-{
-  ",*<<", ",*=", ",*<", ",*<=", ",*>>=", ",*<>", ",*>=", ",*>"
-};
-static const char *const add_cond_names[] =
-{
-  "", ",=", ",<", ",<=", ",nuv", ",znv", ",sv", ",od",
-  ",tr", ",<>", ",>=", ",>", ",uv", ",vnz", ",nsv", ",ev"
-};
-static const char *const add_cond_64_names[] =
-{
-  "", ",*=", ",*<", ",*<=", ",*nuv", ",*znv", ",*sv", ",*od",
-  ",*tr", ",*<>", ",*>=", ",*>", ",*uv", ",*vnz", ",*nsv", ",*ev"
-};
-static const char *const wide_add_cond_names[] =
-{
-  "", ",=", ",<", ",<=", ",nuv", ",*=", ",*<", ",*<=",
-  ",tr", ",<>", ",>=", ",>", ",uv", ",*<>", ",*>=", ",*>"
-};
-static const char *const logical_cond_names[] =
-{
-  "", ",=", ",<", ",<=", 0, 0, 0, ",od",
-  ",tr", ",<>", ",>=", ",>", 0, 0, 0, ",ev"};
-static const char *const logical_cond_64_names[] =
-{
-  "", ",*=", ",*<", ",*<=", 0, 0, 0, ",*od",
-  ",*tr", ",*<>", ",*>=", ",*>", 0, 0, 0, ",*ev"};
-static const char *const unit_cond_names[] =
-{
-  "", ",swz", ",sbz", ",shz", ",sdc", ",swc", ",sbc", ",shc",
-  ",tr", ",nwz", ",nbz", ",nhz", ",ndc", ",nwc", ",nbc", ",nhc"
-};
-static const char *const unit_cond_64_names[] =
-{
-  "", ",*swz", ",*sbz", ",*shz", ",*sdc", ",*swc", ",*sbc", ",*shc",
-  ",*tr", ",*nwz", ",*nbz", ",*nhz", ",*ndc", ",*nwc", ",*nbc", ",*nhc"
-};
-static const char *const shift_cond_names[] =
-{
-  "", ",=", ",<", ",od", ",tr", ",<>", ",>=", ",ev"
-};
-static const char *const shift_cond_64_names[] =
-{
-  "", ",*=", ",*<", ",*od", ",*tr", ",*<>", ",*>=", ",*ev"
-};
-static const char *const bb_cond_64_names[] =
-{
-  ",*<", ",*>="
-};
-static const char *const index_compl_names[] = {"", ",m", ",s", ",sm"};
-static const char *const short_ldst_compl_names[] = {"", ",ma", "", ",mb"};
-static const char *const short_bytes_compl_names[] =
-{
-  "", ",b,m", ",e", ",e,m"
-};
-static const char *const float_format_names[] = {",sgl", ",dbl", "", ",quad"};
-static const char *const fcnv_fixed_names[] = {",w", ",dw", "", ",qw"};
-static const char *const fcnv_ufixed_names[] = {",uw", ",udw", "", ",uqw"};
-static const char *const float_comp_names[] =
-{
-  ",false?", ",false", ",?", ",!<=>", ",=", ",=t", ",?=", ",!<>",
-  ",!?>=", ",<", ",?<", ",!>=", ",!?>", ",<=", ",?<=", ",!>",
-  ",!?<=", ",>", ",?>", ",!<=", ",!?<", ",>=", ",?>=", ",!<",
-  ",!?=", ",<>", ",!=", ",!=t", ",!?", ",<=>", ",true?", ",true"
-};
-static const char *const signed_unsigned_names[] = {",u", ",s"};
-static const char *const mix_half_names[] = {",l", ",r"};
-static const char *const saturation_names[] = {",us", ",ss", 0, ""};
-static const char *const read_write_names[] = {",r", ",w"};
-static const char *const add_compl_names[] = { 0, "", ",l", ",tsv" };
-
-/* For a bunch of different instructions form an index into a
-   completer name table.  */
-#define GET_COMPL(insn) (GET_FIELD (insn, 26, 26) | \
-			 GET_FIELD (insn, 18, 18) << 1)
-
-#define GET_COND(insn) (GET_FIELD ((insn), 16, 18) + \
-			(GET_FIELD ((insn), 19, 19) ? 8 : 0))
-
-/* Utility function to print registers.  Put these first, so gcc's function
-   inlining can do its stuff.  */
-
-#define fputs_filtered(STR,F)	(*info->fprintf_func) (info->stream, "%s", STR)
-
-static void
-fput_reg (unsigned reg, disassemble_info *info)
-{
-  (*info->fprintf_func) (info->stream, "%s", reg ? reg_names[reg] : "r0");
-}
-
-static void
-fput_fp_reg (unsigned reg, disassemble_info *info)
-{
-  (*info->fprintf_func) (info->stream, "%s", reg ? fp_reg_names[reg] : "fr0");
-}
-
-static void
-fput_fp_reg_r (unsigned reg, disassemble_info *info)
-{
-  /* Special case floating point exception registers.  */
-  if (reg < 4)
-    (*info->fprintf_func) (info->stream, "fpe%d", reg * 2 + 1);
-  else
-    (*info->fprintf_func) (info->stream, "%sR",
-			   reg ? fp_reg_names[reg] : "fr0");
-}
-
-static void
-fput_creg (unsigned reg, disassemble_info *info)
-{
-  (*info->fprintf_func) (info->stream, "%s", control_reg[reg]);
-}
-
-/* Print constants with sign.  */
-
-static void
-fput_const (unsigned num, disassemble_info *info)
-{
-  if ((int) num < 0)
-    (*info->fprintf_func) (info->stream, "-%x", - (int) num);
-  else
-    (*info->fprintf_func) (info->stream, "%x", num);
-}
-
-/* Routines to extract various sized constants out of hppa
-   instructions.  */
-
-/* Extract a 3-bit space register number from a be, ble, mtsp or mfsp.  */
-static int
-extract_3 (unsigned word)
-{
-  return GET_FIELD (word, 18, 18) << 2 | GET_FIELD (word, 16, 17);
-}
-
-static int
-extract_5_load (unsigned word)
-{
-  return low_sign_extend (word >> 16 & MASK_5, 5);
-}
-
-/* Extract the immediate field from a st{bhw}s instruction.  */
-
-static int
-extract_5_store (unsigned word)
-{
-  return low_sign_extend (word & MASK_5, 5);
-}
-
-/* Extract the immediate field from a break instruction.  */
-
-static unsigned
-extract_5r_store (unsigned word)
-{
-  return (word & MASK_5);
-}
-
-/* Extract the immediate field from a {sr}sm instruction.  */
-
-static unsigned
-extract_5R_store (unsigned word)
-{
-  return (word >> 16 & MASK_5);
-}
-
-/* Extract the 10 bit immediate field from a {sr}sm instruction.  */
-
-static unsigned
-extract_10U_store (unsigned word)
-{
-  return (word >> 16 & MASK_10);
-}
-
-/* Extract the immediate field from a bb instruction.  */
-
-static unsigned
-extract_5Q_store (unsigned word)
-{
-  return (word >> 21 & MASK_5);
-}
-
-/* Extract an 11 bit immediate field.  */
-
-static int
-extract_11 (unsigned word)
-{
-  return low_sign_extend (word & MASK_11, 11);
-}
-
-/* Extract a 14 bit immediate field.  */
-
-static int
-extract_14 (unsigned word)
-{
-  return low_sign_extend (word & MASK_14, 14);
-}
-
-/* Extract a 16 bit immediate field (PA2.0 wide only).  */
-
-static int
-extract_16 (unsigned word)
-{
-  int m15, m0, m1;
-
-  m0 = GET_BIT (word, 16);
-  m1 = GET_BIT (word, 17);
-  m15 = GET_BIT (word, 31);
-  word = (word >> 1) & 0x1fff;
-  word = word | (m15 << 15) | ((m15 ^ m0) << 14) | ((m15 ^ m1) << 13);
-  return sign_extend (word, 16);
-}
-
-/* Extract a 21 bit constant.  */
-
-static int
-extract_21 (unsigned word)
-{
-  int val;
-
-  word &= MASK_21;
-  word <<= 11;
-  val = GET_FIELD (word, 20, 20);
-  val <<= 11;
-  val |= GET_FIELD (word, 9, 19);
-  val <<= 2;
-  val |= GET_FIELD (word, 5, 6);
-  val <<= 5;
-  val |= GET_FIELD (word, 0, 4);
-  val <<= 2;
-  val |= GET_FIELD (word, 7, 8);
-  return sign_extend (val, 21) << 11;
-}
-
-/* Extract a 12 bit constant from branch instructions.  */
-
-static int
-extract_12 (unsigned word)
-{
-  return sign_extend (GET_FIELD (word, 19, 28)
-		      | GET_FIELD (word, 29, 29) << 10
-		      | (word & 0x1) << 11, 12) << 2;
-}
-
-/* Extract a 17 bit constant from branch instructions, returning the
-   19 bit signed value.  */
-
-static int
-extract_17 (unsigned word)
-{
-  return sign_extend (GET_FIELD (word, 19, 28)
-		      | GET_FIELD (word, 29, 29) << 10
-		      | GET_FIELD (word, 11, 15) << 11
-		      | (word & 0x1) << 16, 17) << 2;
-}
-
-static int
-extract_22 (unsigned word)
-{
-  return sign_extend (GET_FIELD (word, 19, 28)
-		      | GET_FIELD (word, 29, 29) << 10
-		      | GET_FIELD (word, 11, 15) << 11
-		      | GET_FIELD (word, 6, 10) << 16
-		      | (word & 0x1) << 21, 22) << 2;
-}
-
-/* Print one instruction.  */
-
-int
-print_insn_hppa (bfd_vma memaddr, disassemble_info *info)
-{
-  bfd_byte buffer[4];
-  unsigned int insn, i;
-
-  {
-    int status =
-      (*info->read_memory_func) (memaddr, buffer, sizeof (buffer), info);
-    if (status != 0)
-      {
-	(*info->memory_error_func) (status, memaddr, info);
-	return -1;
-      }
-  }
-
-  insn = bfd_getb32 (buffer);
-
-  for (i = 0; i < NUMOPCODES; ++i)
-    {
-      const struct pa_opcode *opcode = &pa_opcodes[i];
-
-      if ((insn & opcode->mask) == opcode->match)
-	{
-	  const char *s;
-#ifndef BFD64
-	  if (opcode->arch == pa20w)
-	    continue;
-#endif
-	  (*info->fprintf_func) (info->stream, "%s", opcode->name);
-
-	  if (!strchr ("cfCY?-+nHNZFIuv{", opcode->args[0]))
-	    (*info->fprintf_func) (info->stream, " ");
-	  for (s = opcode->args; *s != '\0'; ++s)
-	    {
-	      switch (*s)
-		{
-		case 'x':
-		  fput_reg (GET_FIELD (insn, 11, 15), info);
-		  break;
-		case 'a':
-		case 'b':
-		  fput_reg (GET_FIELD (insn, 6, 10), info);
-		  break;
-		case '^':
-		  fput_creg (GET_FIELD (insn, 6, 10), info);
-		  break;
-		case 't':
-		  fput_reg (GET_FIELD (insn, 27, 31), info);
-		  break;
-
-		  /* Handle floating point registers.  */
-		case 'f':
-		  switch (*++s)
-		    {
-		    case 't':
-		      fput_fp_reg (GET_FIELD (insn, 27, 31), info);
-		      break;
-		    case 'T':
-		      if (GET_FIELD (insn, 25, 25))
-			fput_fp_reg_r (GET_FIELD (insn, 27, 31), info);
-		      else
-			fput_fp_reg (GET_FIELD (insn, 27, 31), info);
-		      break;
-		    case 'a':
-		      if (GET_FIELD (insn, 25, 25))
-			fput_fp_reg_r (GET_FIELD (insn, 6, 10), info);
-		      else
-			fput_fp_reg (GET_FIELD (insn, 6, 10), info);
-		      break;
-
-		      /* 'fA' will not generate a space before the regsiter
-			 name.  Normally that is fine.  Except that it
-			 causes problems with xmpyu which has no FP format
-			 completer.  */
-		    case 'X':
-		      fputs_filtered (" ", info);
-		      /* FALLTHRU */
-
-		    case 'A':
-		      if (GET_FIELD (insn, 24, 24))
-			fput_fp_reg_r (GET_FIELD (insn, 6, 10), info);
-		      else
-			fput_fp_reg (GET_FIELD (insn, 6, 10), info);
-		      break;
-		    case 'b':
-		      if (GET_FIELD (insn, 25, 25))
-			fput_fp_reg_r (GET_FIELD (insn, 11, 15), info);
-		      else
-			fput_fp_reg (GET_FIELD (insn, 11, 15), info);
-		      break;
-		    case 'B':
-		      if (GET_FIELD (insn, 19, 19))
-			fput_fp_reg_r (GET_FIELD (insn, 11, 15), info);
-		      else
-			fput_fp_reg (GET_FIELD (insn, 11, 15), info);
-		      break;
-		    case 'C':
-		      {
-			int reg = GET_FIELD (insn, 21, 22);
-			reg |= GET_FIELD (insn, 16, 18) << 2;
-			if (GET_FIELD (insn, 23, 23) != 0)
-			  fput_fp_reg_r (reg, info);
-			else
-			  fput_fp_reg (reg, info);
-			break;
-		      }
-		    case 'i':
-		      {
-			int reg = GET_FIELD (insn, 6, 10);
-
-			reg |= (GET_FIELD (insn, 26, 26) << 4);
-			fput_fp_reg (reg, info);
-			break;
-		      }
-		    case 'j':
-		      {
-			int reg = GET_FIELD (insn, 11, 15);
-
-			reg |= (GET_FIELD (insn, 26, 26) << 4);
-			fput_fp_reg (reg, info);
-			break;
-		      }
-		    case 'k':
-		      {
-			int reg = GET_FIELD (insn, 27, 31);
-
-			reg |= (GET_FIELD (insn, 26, 26) << 4);
-			fput_fp_reg (reg, info);
-			break;
-		      }
-		    case 'l':
-		      {
-			int reg = GET_FIELD (insn, 21, 25);
-
-			reg |= (GET_FIELD (insn, 26, 26) << 4);
-			fput_fp_reg (reg, info);
-			break;
-		      }
-		    case 'm':
-		      {
-			int reg = GET_FIELD (insn, 16, 20);
-
-			reg |= (GET_FIELD (insn, 26, 26) << 4);
-			fput_fp_reg (reg, info);
-			break;
-		      }
-
-		      /* 'fe' will not generate a space before the register
-			 name.  Normally that is fine.  Except that it
-			 causes problems with fstw fe,y(b) which has no FP
-			 format completer.  */
-		    case 'E':
-		      fputs_filtered (" ", info);
-		      /* FALLTHRU */
-
-		    case 'e':
-		      if (GET_FIELD (insn, 30, 30))
-			fput_fp_reg_r (GET_FIELD (insn, 11, 15), info);
-		      else
-			fput_fp_reg (GET_FIELD (insn, 11, 15), info);
-		      break;
-		    case 'x':
-		      fput_fp_reg (GET_FIELD (insn, 11, 15), info);
-		      break;
-		    }
-		  break;
-
-		case '5':
-		  fput_const (extract_5_load (insn), info);
-		  break;
-		case 's':
-		  {
-		    int space = GET_FIELD (insn, 16, 17);
-		    /* Zero means implicit addressing, not use of sr0.  */
-		    if (space != 0)
-		      (*info->fprintf_func) (info->stream, "sr%d", space);
-		  }
-		  break;
-
-		case 'S':
-		  (*info->fprintf_func) (info->stream, "sr%d",
-					 extract_3 (insn));
-		  break;
-
-		  /* Handle completers.  */
-		case 'c':
-		  switch (*++s)
-		    {
-		    case 'x':
-		      (*info->fprintf_func)
-			(info->stream, "%s",
-			 index_compl_names[GET_COMPL (insn)]);
-		      break;
-		    case 'X':
-		      (*info->fprintf_func)
-			(info->stream, "%s ",
-			 index_compl_names[GET_COMPL (insn)]);
-		      break;
-		    case 'm':
-		      (*info->fprintf_func)
-			(info->stream, "%s",
-			 short_ldst_compl_names[GET_COMPL (insn)]);
-		      break;
-		    case 'M':
-		      (*info->fprintf_func)
-			(info->stream, "%s ",
-			 short_ldst_compl_names[GET_COMPL (insn)]);
-		      break;
-		    case 'A':
-		      (*info->fprintf_func)
-			(info->stream, "%s ",
-			 short_bytes_compl_names[GET_COMPL (insn)]);
-		      break;
-		    case 's':
-		      (*info->fprintf_func)
-			(info->stream, "%s",
-			 short_bytes_compl_names[GET_COMPL (insn)]);
-		      break;
-		    case 'c':
-		    case 'C':
-		      switch (GET_FIELD (insn, 20, 21))
-			{
-			case 1:
-			  (*info->fprintf_func) (info->stream, ",bc ");
-			  break;
-			case 2:
-			  (*info->fprintf_func) (info->stream, ",sl ");
-			  break;
-			default:
-			  (*info->fprintf_func) (info->stream, " ");
-			}
-		      break;
-		    case 'd':
-		      switch (GET_FIELD (insn, 20, 21))
-			{
-			case 1:
-			  (*info->fprintf_func) (info->stream, ",co ");
-			  break;
-			default:
-			  (*info->fprintf_func) (info->stream, " ");
-			}
-		      break;
-		    case 'o':
-		      (*info->fprintf_func) (info->stream, ",o");
-		      break;
-		    case 'g':
-		      (*info->fprintf_func) (info->stream, ",gate");
-		      break;
-		    case 'p':
-		      (*info->fprintf_func) (info->stream, ",l,push");
-		      break;
-		    case 'P':
-		      (*info->fprintf_func) (info->stream, ",pop");
-		      break;
-		    case 'l':
-		    case 'L':
-		      (*info->fprintf_func) (info->stream, ",l");
-		      break;
-		    case 'w':
-		      (*info->fprintf_func)
-			(info->stream, "%s ",
-			 read_write_names[GET_FIELD (insn, 25, 25)]);
-		      break;
-		    case 'W':
-		      (*info->fprintf_func) (info->stream, ",w ");
-		      break;
-		    case 'r':
-		      if (GET_FIELD (insn, 23, 26) == 5)
-			(*info->fprintf_func) (info->stream, ",r");
-		      break;
-		    case 'Z':
-		      if (GET_FIELD (insn, 26, 26))
-			(*info->fprintf_func) (info->stream, ",m ");
-		      else
-			(*info->fprintf_func) (info->stream, " ");
-		      break;
-		    case 'i':
-		      if (GET_FIELD (insn, 25, 25))
-			(*info->fprintf_func) (info->stream, ",i");
-		      break;
-		    case 'z':
-		      if (!GET_FIELD (insn, 21, 21))
-			(*info->fprintf_func) (info->stream, ",z");
-		      break;
-		    case 'a':
-		      (*info->fprintf_func)
-			(info->stream, "%s",
-			 add_compl_names[GET_FIELD (insn, 20, 21)]);
-		      break;
-		    case 'Y':
-		      (*info->fprintf_func)
-			(info->stream, ",dc%s",
-			 add_compl_names[GET_FIELD (insn, 20, 21)]);
-		      break;
-		    case 'y':
-		      (*info->fprintf_func)
-			(info->stream, ",c%s",
-			 add_compl_names[GET_FIELD (insn, 20, 21)]);
-		      break;
-		    case 'v':
-		      if (GET_FIELD (insn, 20, 20))
-			(*info->fprintf_func) (info->stream, ",tsv");
-		      break;
-		    case 't':
-		      (*info->fprintf_func) (info->stream, ",tc");
-		      if (GET_FIELD (insn, 20, 20))
-			(*info->fprintf_func) (info->stream, ",tsv");
-		      break;
-		    case 'B':
-		      (*info->fprintf_func) (info->stream, ",db");
-		      if (GET_FIELD (insn, 20, 20))
-			(*info->fprintf_func) (info->stream, ",tsv");
-		      break;
-		    case 'b':
-		      (*info->fprintf_func) (info->stream, ",b");
-		      if (GET_FIELD (insn, 20, 20))
-			(*info->fprintf_func) (info->stream, ",tsv");
-		      break;
-		    case 'T':
-		      if (GET_FIELD (insn, 25, 25))
-			(*info->fprintf_func) (info->stream, ",tc");
-		      break;
-		    case 'S':
-		      /* EXTRD/W has a following condition.  */
-		      if (*(s + 1) == '?')
-			(*info->fprintf_func)
-			  (info->stream, "%s",
-			   signed_unsigned_names[GET_FIELD (insn, 21, 21)]);
-		      else
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   signed_unsigned_names[GET_FIELD (insn, 21, 21)]);
-		      break;
-		    case 'h':
-		      (*info->fprintf_func)
-			(info->stream, "%s",
-			 mix_half_names[GET_FIELD (insn, 17, 17)]);
-		      break;
-		    case 'H':
-		      (*info->fprintf_func)
-			(info->stream, "%s ",
-			 saturation_names[GET_FIELD (insn, 24, 25)]);
-		      break;
-		    case '*':
-		      (*info->fprintf_func)
-			(info->stream, ",%d%d%d%d ",
-			 GET_FIELD (insn, 17, 18), GET_FIELD (insn, 20, 21),
-			 GET_FIELD (insn, 22, 23), GET_FIELD (insn, 24, 25));
-		      break;
-
-		    case 'q':
-		      {
-			int m, a;
-
-			m = GET_FIELD (insn, 28, 28);
-			a = GET_FIELD (insn, 29, 29);
-
-			if (m && !a)
-			  fputs_filtered (",ma ", info);
-			else if (m && a)
-			  fputs_filtered (",mb ", info);
-			else
-			  fputs_filtered (" ", info);
-			break;
-		      }
-
-		    case 'J':
-		      {
-			int opc = GET_FIELD (insn, 0, 5);
-
-			if (opc == 0x16 || opc == 0x1e)
-			  {
-			    if (GET_FIELD (insn, 29, 29) == 0)
-			      fputs_filtered (",ma ", info);
-			    else
-			      fputs_filtered (",mb ", info);
-			  }
-			else
-			  fputs_filtered (" ", info);
-			break;
-		      }
-
-		    case 'e':
-		      {
-			int opc = GET_FIELD (insn, 0, 5);
-
-			if (opc == 0x13 || opc == 0x1b)
-			  {
-			    if (GET_FIELD (insn, 18, 18) == 1)
-			      fputs_filtered (",mb ", info);
-			    else
-			      fputs_filtered (",ma ", info);
-			  }
-			else if (opc == 0x17 || opc == 0x1f)
-			  {
-			    if (GET_FIELD (insn, 31, 31) == 1)
-			      fputs_filtered (",ma ", info);
-			    else
-			      fputs_filtered (",mb ", info);
-			  }
-			else
-			  fputs_filtered (" ", info);
-
-			break;
-		      }
-		    }
-		  break;
-
-		  /* Handle conditions.  */
-		case '?':
-		  {
-		    s++;
-		    switch (*s)
-		      {
-		      case 'f':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   float_comp_names[GET_FIELD (insn, 27, 31)]);
-			break;
-
-			/* These four conditions are for the set of instructions
-			   which distinguish true/false conditions by opcode
-			   rather than by the 'f' bit (sigh): comb, comib,
-			   addb, addib.  */
-		      case 't':
-			fputs_filtered
-			  (compare_cond_names[GET_FIELD (insn, 16, 18)], info);
-			break;
-		      case 'n':
-			fputs_filtered
-			  (compare_cond_names[GET_FIELD (insn, 16, 18)
-					      + GET_FIELD (insn, 4, 4) * 8],
-			   info);
-			break;
-		      case 'N':
-			fputs_filtered
-			  (compare_cond_64_names[GET_FIELD (insn, 16, 18)
-						 + GET_FIELD (insn, 2, 2) * 8],
-			   info);
-			break;
-		      case 'Q':
-			fputs_filtered
-			  (cmpib_cond_64_names[GET_FIELD (insn, 16, 18)],
-			   info);
-			break;
-		      case '@':
-			fputs_filtered
-			  (add_cond_names[GET_FIELD (insn, 16, 18)
-					  + GET_FIELD (insn, 4, 4) * 8],
-			   info);
-			break;
-		      case 's':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   compare_cond_names[GET_COND (insn)]);
-			break;
-		      case 'S':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   compare_cond_64_names[GET_COND (insn)]);
-			break;
-		      case 'a':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   add_cond_names[GET_COND (insn)]);
-			break;
-		      case 'A':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   add_cond_64_names[GET_COND (insn)]);
-			break;
-		      case 'd':
-			(*info->fprintf_func)
-			  (info->stream, "%s",
-			   add_cond_names[GET_FIELD (insn, 16, 18)]);
-			break;
-
-		      case 'W':
-			(*info->fprintf_func)
-			  (info->stream, "%s",
-			   wide_add_cond_names[GET_FIELD (insn, 16, 18) +
-					       GET_FIELD (insn, 4, 4) * 8]);
-			break;
-
-		      case 'l':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   logical_cond_names[GET_COND (insn)]);
-			break;
-		      case 'L':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   logical_cond_64_names[GET_COND (insn)]);
-			break;
-		      case 'u':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   unit_cond_names[GET_COND (insn)]);
-			break;
-		      case 'U':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   unit_cond_64_names[GET_COND (insn)]);
-			break;
-		      case 'y':
-		      case 'x':
-		      case 'b':
-			(*info->fprintf_func)
-			  (info->stream, "%s",
-			   shift_cond_names[GET_FIELD (insn, 16, 18)]);
-
-			/* If the next character in args is 'n', it will handle
-			   putting out the space.  */
-			if (s[1] != 'n')
-			  (*info->fprintf_func) (info->stream, " ");
-			break;
-		      case 'X':
-			(*info->fprintf_func)
-			  (info->stream, "%s ",
-			   shift_cond_64_names[GET_FIELD (insn, 16, 18)]);
-			break;
-		      case 'B':
-			(*info->fprintf_func)
-			  (info->stream, "%s",
-			   bb_cond_64_names[GET_FIELD (insn, 16, 16)]);
-
-			/* If the next character in args is 'n', it will handle
-			   putting out the space.  */
-			if (s[1] != 'n')
-			  (*info->fprintf_func) (info->stream, " ");
-			break;
-		      }
-		    break;
-		  }
-
-		case 'V':
-		  fput_const (extract_5_store (insn), info);
-		  break;
-		case 'r':
-		  fput_const (extract_5r_store (insn), info);
-		  break;
-		case 'R':
-		  fput_const (extract_5R_store (insn), info);
-		  break;
-		case 'U':
-		  fput_const (extract_10U_store (insn), info);
-		  break;
-		case 'B':
-		case 'Q':
-		  fput_const (extract_5Q_store (insn), info);
-		  break;
-		case 'i':
-		  fput_const (extract_11 (insn), info);
-		  break;
-		case 'j':
-		  fput_const (extract_14 (insn), info);
-		  break;
-		case 'k':
-		  fputs_filtered ("L%", info);
-		  fput_const (extract_21 (insn), info);
-		  break;
-		case '<':
-		case 'l':
-		  /* 16-bit long disp., PA2.0 wide only.  */
-		  fput_const (extract_16 (insn), info);
-		  break;
-		case 'n':
-		  if (insn & 0x2)
-		    (*info->fprintf_func) (info->stream, ",n ");
-		  else
-		    (*info->fprintf_func) (info->stream, " ");
-		  break;
-		case 'N':
-		  if ((insn & 0x20) && s[1])
-		    (*info->fprintf_func) (info->stream, ",n ");
-		  else if (insn & 0x20)
-		    (*info->fprintf_func) (info->stream, ",n");
-		  else if (s[1])
-		    (*info->fprintf_func) (info->stream, " ");
-		  break;
-		case 'w':
-		  (*info->print_address_func)
-		    (memaddr + 8 + extract_12 (insn), info);
-		  break;
-		case 'W':
-		  /* 17 bit PC-relative branch.  */
-		  (*info->print_address_func)
-		    ((memaddr + 8 + extract_17 (insn)), info);
-		  break;
-		case 'z':
-		  /* 17 bit displacement.  This is an offset from a register
-		     so it gets disasssembled as just a number, not any sort
-		     of address.  */
-		  fput_const (extract_17 (insn), info);
-		  break;
-
-		case 'Z':
-		  /* addil %r1 implicit output.  */
-		  fputs_filtered ("r1", info);
-		  break;
-
-		case 'Y':
-		  /* be,l %sr0,%r31 implicit output.  */
-		  fputs_filtered ("sr0,r31", info);
-		  break;
-
-		case '@':
-		  (*info->fprintf_func) (info->stream, "0");
-		  break;
-
-		case '.':
-		  (*info->fprintf_func) (info->stream, "%d",
-					 GET_FIELD (insn, 24, 25));
-		  break;
-		case '*':
-		  (*info->fprintf_func) (info->stream, "%d",
-					 GET_FIELD (insn, 22, 25));
-		  break;
-		case '!':
-		  fputs_filtered ("sar", info);
-		  break;
-		case 'p':
-		  (*info->fprintf_func) (info->stream, "%d",
-					 31 - GET_FIELD (insn, 22, 26));
-		  break;
-		case '~':
-		  {
-		    int num;
-		    num = GET_FIELD (insn, 20, 20) << 5;
-		    num |= GET_FIELD (insn, 22, 26);
-		    (*info->fprintf_func) (info->stream, "%d", 63 - num);
-		    break;
-		  }
-		case 'P':
-		  (*info->fprintf_func) (info->stream, "%d",
-					 GET_FIELD (insn, 22, 26));
-		  break;
-		case 'q':
-		  {
-		    int num;
-		    num = GET_FIELD (insn, 20, 20) << 5;
-		    num |= GET_FIELD (insn, 22, 26);
-		    (*info->fprintf_func) (info->stream, "%d", num);
-		    break;
-		  }
-		case 'T':
-		  (*info->fprintf_func) (info->stream, "%d",
-					 32 - GET_FIELD (insn, 27, 31));
-		  break;
-		case '%':
-		  {
-		    int num;
-		    num = (GET_FIELD (insn, 23, 23) + 1) * 32;
-		    num -= GET_FIELD (insn, 27, 31);
-		    (*info->fprintf_func) (info->stream, "%d", num);
-		    break;
-		  }
-		case '|':
-		  {
-		    int num;
-		    num = (GET_FIELD (insn, 19, 19) + 1) * 32;
-		    num -= GET_FIELD (insn, 27, 31);
-		    (*info->fprintf_func) (info->stream, "%d", num);
-		    break;
-		  }
-		case '$':
-		  fput_const (GET_FIELD (insn, 20, 28), info);
-		  break;
-		case 'A':
-		  fput_const (GET_FIELD (insn, 6, 18), info);
-		  break;
-		case 'D':
-		  fput_const (GET_FIELD (insn, 6, 31), info);
-		  break;
-		case 'v':
-		  (*info->fprintf_func) (info->stream, ",%d",
-					 GET_FIELD (insn, 23, 25));
-		  break;
-		case 'O':
-		  fput_const ((GET_FIELD (insn, 6,20) << 5 |
-			       GET_FIELD (insn, 27, 31)), info);
-		  break;
-		case 'o':
-		  fput_const (GET_FIELD (insn, 6, 20), info);
-		  break;
-		case '2':
-		  fput_const ((GET_FIELD (insn, 6, 22) << 5 |
-			       GET_FIELD (insn, 27, 31)), info);
-		  break;
-		case '1':
-		  fput_const ((GET_FIELD (insn, 11, 20) << 5 |
-			       GET_FIELD (insn, 27, 31)), info);
-		  break;
-		case '0':
-		  fput_const ((GET_FIELD (insn, 16, 20) << 5 |
-			       GET_FIELD (insn, 27, 31)), info);
-		  break;
-		case 'u':
-		  (*info->fprintf_func) (info->stream, ",%d",
-					 GET_FIELD (insn, 23, 25));
-		  break;
-		case 'F':
-		  /* If no destination completer and not before a completer
-		     for fcmp, need a space here.  */
-		  if (s[1] == 'G' || s[1] == '?')
-		    fputs_filtered
-		      (float_format_names[GET_FIELD (insn, 19, 20)], info);
-		  else
-		    (*info->fprintf_func)
-		      (info->stream, "%s ",
-		       float_format_names[GET_FIELD (insn, 19, 20)]);
-		  break;
-		case 'G':
-		  (*info->fprintf_func)
-		    (info->stream, "%s ",
-		     float_format_names[GET_FIELD (insn, 17, 18)]);
-		  break;
-		case 'H':
-		  if (GET_FIELD (insn, 26, 26) == 1)
-		    (*info->fprintf_func) (info->stream, "%s ",
-					   float_format_names[0]);
-		  else
-		    (*info->fprintf_func) (info->stream, "%s ",
-					   float_format_names[1]);
-		  break;
-		case 'I':
-		  /* If no destination completer and not before a completer
-		     for fcmp, need a space here.  */
-		  if (s[1] == '?')
-		    fputs_filtered
-		      (float_format_names[GET_FIELD (insn, 20, 20)], info);
-		  else
-		    (*info->fprintf_func)
-		      (info->stream, "%s ",
-		       float_format_names[GET_FIELD (insn, 20, 20)]);
-		  break;
-
-		case 'J':
-		  fput_const (extract_14 (insn), info);
-		  break;
-
-		case '#':
-		  {
-		    int sign = GET_FIELD (insn, 31, 31);
-		    int imm10 = GET_FIELD (insn, 18, 27);
-		    int disp;
-
-		    if (sign)
-		      disp = (-1 << 10) | imm10;
-		    else
-		      disp = imm10;
-
-		    disp <<= 3;
-		    fput_const (disp, info);
-		    break;
-		  }
-		case 'K':
-		case 'd':
-		  {
-		    int sign = GET_FIELD (insn, 31, 31);
-		    int imm11 = GET_FIELD (insn, 18, 28);
-		    int disp;
-
-		    if (sign)
-		      disp = (-1 << 11) | imm11;
-		    else
-		      disp = imm11;
-
-		    disp <<= 2;
-		    fput_const (disp, info);
-		    break;
-		  }
-
-		case '>':
-		case 'y':
-		  {
-		    /* 16-bit long disp., PA2.0 wide only.  */
-		    int disp = extract_16 (insn);
-		    disp &= ~3;
-		    fput_const (disp, info);
-		    break;
-		  }
-
-		case '&':
-		  {
-		    /* 16-bit long disp., PA2.0 wide only.  */
-		    int disp = extract_16 (insn);
-		    disp &= ~7;
-		    fput_const (disp, info);
-		    break;
-		  }
-
-		case '_':
-		  break; /* Dealt with by '{' */
-
-		case '{':
-		  {
-		    int sub = GET_FIELD (insn, 14, 16);
-		    int df = GET_FIELD (insn, 17, 18);
-		    int sf = GET_FIELD (insn, 19, 20);
-		    const char * const * source = float_format_names;
-		    const char * const * dest = float_format_names;
-		    const char *t = "";
-
-		    if (sub == 4)
-		      {
-			fputs_filtered (",UND ", info);
-			break;
-		      }
-		    if ((sub & 3) == 3)
-		      t = ",t";
-		    if ((sub & 3) == 1)
-		      source = sub & 4 ? fcnv_ufixed_names : fcnv_fixed_names;
-		    if (sub & 2)
-		      dest = sub & 4 ? fcnv_ufixed_names : fcnv_fixed_names;
-
-		    (*info->fprintf_func) (info->stream, "%s%s%s ",
-					   t, source[sf], dest[df]);
-		    break;
-		  }
-
-		case 'm':
-		  {
-		    int y = GET_FIELD (insn, 16, 18);
-
-		    if (y != 1)
-		      fput_const ((y ^ 1) - 1, info);
-		  }
-		  break;
-
-		case 'h':
-		  {
-		    int cbit;
-
-		    cbit = GET_FIELD (insn, 16, 18);
-
-		    if (cbit > 0)
-		      (*info->fprintf_func) (info->stream, ",%d", cbit - 1);
-		    break;
-		  }
-
-		case '=':
-		  {
-		    int cond = GET_FIELD (insn, 27, 31);
-
-		    switch (cond)
-		      {
-		      case  0: fputs_filtered (" ", info); break;
-		      case  1: fputs_filtered ("acc ", info); break;
-		      case  2: fputs_filtered ("rej ", info); break;
-		      case  5: fputs_filtered ("acc8 ", info); break;
-		      case  6: fputs_filtered ("rej8 ", info); break;
-		      case  9: fputs_filtered ("acc6 ", info); break;
-		      case 13: fputs_filtered ("acc4 ", info); break;
-		      case 17: fputs_filtered ("acc2 ", info); break;
-		      default: break;
-		      }
-		    break;
-		  }
-
-		case 'X':
-		  (*info->print_address_func)
-		    (memaddr + 8 + extract_22 (insn), info);
-		  break;
-		case 'L':
-		  fputs_filtered (",rp", info);
-		  break;
-		default:
-		  (*info->fprintf_func) (info->stream, "%c", *s);
-		  break;
-		}
-	    }
-	  return sizeof (insn);
-	}
-    }
-  (*info->fprintf_func) (info->stream, "#%8x", insn);
-  return sizeof (insn);
-}
diff --git a/disas/sh4.c b/disas/sh4.c
index 8b0415dfe9..6b66176bed 100644
--- a/disas/sh4.c
+++ b/disas/sh4.c
@@ -264,12 +264,6 @@ sh_dsp_reg_nums;
    be some confusion between DSP and FPU etc.  */
 #define SH_ARCH_UNKNOWN_ARCH 0xffffffff
 
-/* These are defined in bfd/cpu-sh.c .  */
-unsigned int sh_get_arch_from_bfd_mach (unsigned long mach);
-unsigned int sh_get_arch_up_from_bfd_mach (unsigned long mach);
-unsigned long sh_get_bfd_mach_from_arch_set (unsigned int arch_set);
-/* bfd_boolean sh_merge_bfd_arch (bfd *ibfd, bfd *obfd); */
-
 /* Below are the 'architecture sets'.
    They describe the following inheritance graph:
 
diff --git a/docs/block-replication.txt b/docs/block-replication.txt
new file mode 100644
index 0000000000..6bde6737fb
--- /dev/null
+++ b/docs/block-replication.txt
@@ -0,0 +1,239 @@
+Block replication
+----------------------------------------
+Copyright Fujitsu, Corp. 2016
+Copyright (c) 2016 Intel Corporation
+Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
+
+This work is licensed under the terms of the GNU GPL, version 2 or later.
+See the COPYING file in the top-level directory.
+
+Block replication is used for continuous checkpoints. It is designed
+for COLO (COarse-grain LOck-stepping) where the Secondary VM is running.
+It can also be applied for FT/HA (Fault-tolerance/High Assurance) scenario,
+where the Secondary VM is not running.
+
+This document gives an overview of block replication's design.
+
+== Background ==
+High availability solutions such as micro checkpoint and COLO will do
+consecutive checkpoints. The VM state of the Primary and Secondary VM is
+identical right after a VM checkpoint, but becomes different as the VM
+executes till the next checkpoint. To support disk contents checkpoint,
+the modified disk contents in the Secondary VM must be buffered, and are
+only dropped at next checkpoint time. To reduce the network transportation
+effort during a vmstate checkpoint, the disk modification operations of
+the Primary disk are asynchronously forwarded to the Secondary node.
+
+== Workflow ==
+The following is the image of block replication workflow:
+
+        +----------------------+            +------------------------+
+        |Primary Write Requests|            |Secondary Write Requests|
+        +----------------------+            +------------------------+
+                  |                                       |
+                  |                                      (4)
+                  |                                       V
+                  |                              /-------------\
+                  |      Copy and Forward        |             |
+                  |---------(1)----------+       | Disk Buffer |
+                  |                      |       |             |
+                  |                     (3)      \-------------/
+                  |                 speculative      ^
+                  |                write through    (2)
+                  |                      |           |
+                  V                      V           |
+           +--------------+           +----------------+
+           | Primary Disk |           | Secondary Disk |
+           +--------------+           +----------------+
+
+    1) Primary write requests will be copied and forwarded to Secondary
+       QEMU.
+    2) Before Primary write requests are written to Secondary disk, the
+       original sector content will be read from Secondary disk and
+       buffered in the Disk buffer, but it will not overwrite the existing
+       sector content (it could be from either "Secondary Write Requests" or
+       previous COW of "Primary Write Requests") in the Disk buffer.
+    3) Primary write requests will be written to Secondary disk.
+    4) Secondary write requests will be buffered in the Disk buffer and it
+       will overwrite the existing sector content in the buffer.
+
+== Architecture ==
+We are going to implement block replication from many basic
+blocks that are already in QEMU.
+
+         virtio-blk       ||
+             ^            ||                            .----------
+             |            ||                            | Secondary
+        1 Quorum          ||                            '----------
+         /      \         ||
+        /        \        ||
+   Primary    2 filter
+     disk         ^                                                             virtio-blk
+                  |                                                                  ^
+                3 NBD  ------->  3 NBD                                               |
+                client    ||     server                                          2 filter
+                          ||        ^                                                ^
+--------.                 ||        |                                                |
+Primary |                 ||  Secondary disk <--------- hidden-disk 5 <--------- active-disk 4
+--------'                 ||        |          backing        ^       backing
+                          ||        |                         |
+                          ||        |                         |
+                          ||        '-------------------------'
+                          ||           drive-backup sync=none 6
+
+1) The disk on the primary is represented by a block device with two
+children, providing replication between a primary disk and the host that
+runs the secondary VM. The read pattern (fifo) for quorum can be extended
+to make the primary always read from the local disk instead of going through
+NBD.
+
+2) The new block filter (the name is replication) will control the block
+replication.
+
+3) The secondary disk receives writes from the primary VM through QEMU's
+embedded NBD server (speculative write-through).
+
+4) The disk on the secondary is represented by a custom block device
+(called active-disk). It should start as an empty disk, and the format
+should support bdrv_make_empty() and backing file.
+
+5) The hidden-disk is created automatically. It buffers the original content
+that is modified by the primary VM. It should also start as an empty disk,
+and the driver supports bdrv_make_empty() and backing file.
+
+6) The drive-backup job (sync=none) is run to allow hidden-disk to buffer
+any state that would otherwise be lost by the speculative write-through
+of the NBD server into the secondary disk. So before block replication,
+the primary disk and secondary disk should contain the same data.
+
+== Failure Handling ==
+There are 7 internal errors when block replication is running:
+1. I/O error on primary disk
+2. Forwarding primary write requests failed
+3. Backup failed
+4. I/O error on secondary disk
+5. I/O error on active disk
+6. Making active disk or hidden disk empty failed
+7. Doing failover failed
+In case 1 and 5, we just report the error to the disk layer. In case 2, 3,
+4 and 6, we just report block replication's error to FT/HA manager (which
+decides when to do a new checkpoint, when to do failover).
+In case 7, if active commit failed, we use replication failover failed state
+in Secondary's write operation (what decides which target to write).
+
+== New block driver interface ==
+We add four block driver interfaces to control block replication:
+a. replication_start_all()
+   Start block replication, called in migration/checkpoint thread.
+   We must call block_replication_start_all() in secondary QEMU before
+   calling block_replication_start_all() in primary QEMU. The caller
+   must hold the I/O mutex lock if it is in migration/checkpoint
+   thread.
+b. replication_do_checkpoint_all()
+   This interface is called after all VM state is transferred to
+   Secondary QEMU. The Disk buffer will be dropped in this interface.
+   The caller must hold the I/O mutex lock if it is in migration/checkpoint
+   thread.
+c. replication_get_error_all()
+   This interface is called to check if error happened in replication.
+   The caller must hold the I/O mutex lock if it is in migration/checkpoint
+   thread.
+d. replication_stop_all()
+   It is called on failover. We will flush the Disk buffer into
+   Secondary Disk and stop block replication. The vm should be stopped
+   before calling it if you use this API to shutdown the guest, or other
+   things except failover. The caller must hold the I/O mutex lock if it is
+   in migration/checkpoint thread.
+
+== Usage ==
+Primary:
+  -drive if=xxx,driver=quorum,read-pattern=fifo,id=colo1,vote-threshold=1,\
+         children.0.file.filename=1.raw,\
+         children.0.driver=raw
+
+  Run qmp command in primary qemu:
+    { 'execute': 'human-monitor-command',
+      'arguments': {
+          'command-line': 'drive_add -n buddy driver=replication,mode=primary,file.driver=nbd,file.host=xxxx,file.port=xxxx,file.export=colo1,node-name=nbd_client1'
+      }
+    }
+    { 'execute': 'x-blockdev-change',
+      'arguments': {
+          'parent': 'colo1',
+          'node': 'nbd_client1'
+      }
+    }
+  Note:
+  1. There should be only one NBD Client for each primary disk.
+  2. host is the secondary physical machine's hostname or IP
+  3. Each disk must have its own export name.
+  4. It is all a single argument to -drive and you should ignore the
+     leading whitespace.
+  5. The qmp command line must be run after running qmp command line in
+     secondary qemu.
+  6. After failover we need remove children.1 (replication driver).
+
+Secondary:
+  -drive if=none,driver=raw,file.filename=1.raw,id=colo1 \
+  -drive if=xxx,id=topxxx,driver=replication,mode=secondary,top-id=topxxx\
+         file.file.filename=active_disk.qcow2,\
+         file.driver=qcow2,\
+         file.backing.file.filename=hidden_disk.qcow2,\
+         file.backing.driver=qcow2,\
+         file.backing.backing=colo1
+
+  Then run qmp command in secondary qemu:
+    { 'execute': 'nbd-server-start',
+      'arguments': {
+          'addr': {
+              'type': 'inet',
+              'data': {
+                  'host': 'xxx',
+                  'port': 'xxx'
+              }
+          }
+      }
+    }
+    { 'execute': 'nbd-server-add',
+      'arguments': {
+          'device': 'colo1',
+          'writable': true
+      }
+    }
+
+  Note:
+  1. The export name in secondary QEMU command line is the secondary
+     disk's id.
+  2. The export name for the same disk must be the same
+  3. The qmp command nbd-server-start and nbd-server-add must be run
+     before running the qmp command migrate on primary QEMU
+  4. Active disk, hidden disk and nbd target's length should be the
+     same.
+  5. It is better to put active disk and hidden disk in ramdisk.
+  6. It is all a single argument to -drive, and you should ignore
+     the leading whitespace.
+
+After Failover:
+Primary:
+  The secondary host is down, so we should run the following qmp command
+  to remove the nbd child from the quorum:
+  { 'execute': 'x-blockdev-change',
+    'arguments': {
+        'parent': 'colo1',
+        'child': 'children.1'
+    }
+  }
+  { 'execute': 'human-monitor-command',
+    'arguments': {
+        'command-line': 'drive_del xxxx'
+    }
+  }
+  Note: there is no qmp command to remove the blockdev now
+
+Secondary:
+  The primary host is down, so we should do the following thing:
+  { 'execute': 'nbd-server-stop' }
+
+TODO:
+1. Continuous block replication
+2. Shared disk
diff --git a/docs/throttle.txt b/docs/throttle.txt
index 26d4d5107f..cd4e109d39 100644
--- a/docs/throttle.txt
+++ b/docs/throttle.txt
@@ -235,7 +235,10 @@ consider the following values:
   - Water leaks from the bucket at a rate of 100 IOPS.
   - Water can be added to the bucket at a rate of 2000 IOPS.
   - The size of the bucket is 2000 x 60 = 120000
-  - If 'iops-total-max' is unset then the bucket size is 100 x 60.
+  - If 'iops-total-max-length' is unset then it defaults to 1 and the
+    size of the bucket is 2000.
+  - If 'iops-total-max' is unset then 'iops-total-max-length' must be
+    unset as well. In this case the bucket size is 100.
 
 The bucket is initially empty, therefore water can be added until it's
 full at a rate of 2000 IOPS (the burst rate). Once the bucket is full
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 9b1eccff24..c295f3183f 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -4814,6 +4814,10 @@ int32_t floatx80_to_int32(floatx80 a, float_status *status)
     int32_t aExp, shiftCount;
     uint64_t aSig;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return 1 << 31;
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -4842,6 +4846,10 @@ int32_t floatx80_to_int32_round_to_zero(floatx80 a, float_status *status)
     uint64_t aSig, savedASig;
     int32_t z;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return 1 << 31;
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -4888,6 +4896,10 @@ int64_t floatx80_to_int64(floatx80 a, float_status *status)
     int32_t aExp, shiftCount;
     uint64_t aSig, aSigExtra;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return 1ULL << 63;
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -4929,6 +4941,10 @@ int64_t floatx80_to_int64_round_to_zero(floatx80 a, float_status *status)
     uint64_t aSig;
     int64_t z;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return 1ULL << 63;
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -4971,6 +4987,10 @@ float32 floatx80_to_float32(floatx80 a, float_status *status)
     int32_t aExp;
     uint64_t aSig;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return float32_default_nan(status);
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -4999,6 +5019,10 @@ float64 floatx80_to_float64(floatx80 a, float_status *status)
     int32_t aExp;
     uint64_t aSig, zSig;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return float64_default_nan(status);
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -5027,6 +5051,10 @@ float128 floatx80_to_float128(floatx80 a, float_status *status)
     int aExp;
     uint64_t aSig, zSig0, zSig1;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return float128_default_nan(status);
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -5052,6 +5080,10 @@ floatx80 floatx80_round_to_int(floatx80 a, float_status *status)
     uint64_t lastBitMask, roundBitsMask;
     floatx80 z;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aExp = extractFloatx80Exp( a );
     if ( 0x403E <= aExp ) {
         if ( ( aExp == 0x7FFF ) && (uint64_t) ( extractFloatx80Frac( a )<<1 ) ) {
@@ -5279,6 +5311,10 @@ floatx80 floatx80_add(floatx80 a, floatx80 b, float_status *status)
 {
     flag aSign, bSign;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSign = extractFloatx80Sign( a );
     bSign = extractFloatx80Sign( b );
     if ( aSign == bSign ) {
@@ -5300,6 +5336,10 @@ floatx80 floatx80_sub(floatx80 a, floatx80 b, float_status *status)
 {
     flag aSign, bSign;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSign = extractFloatx80Sign( a );
     bSign = extractFloatx80Sign( b );
     if ( aSign == bSign ) {
@@ -5323,6 +5363,10 @@ floatx80 floatx80_mul(floatx80 a, floatx80 b, float_status *status)
     int32_t aExp, bExp, zExp;
     uint64_t aSig, bSig, zSig0, zSig1;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -5380,6 +5424,10 @@ floatx80 floatx80_div(floatx80 a, floatx80 b, float_status *status)
     uint64_t aSig, bSig, zSig0, zSig1;
     uint64_t rem0, rem1, rem2, term0, term1, term2;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -5461,6 +5509,10 @@ floatx80 floatx80_rem(floatx80 a, floatx80 b, float_status *status)
     uint64_t aSig0, aSig1, bSig;
     uint64_t q, term0, term1, alternateASig0, alternateASig1;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSig0 = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -5556,6 +5608,10 @@ floatx80 floatx80_sqrt(floatx80 a, float_status *status)
     uint64_t aSig0, aSig1, zSig0, zSig1, doubleZSig0;
     uint64_t rem0, rem1, rem2, rem3, term0, term1, term2, term3;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSig0 = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
@@ -5620,10 +5676,11 @@ floatx80 floatx80_sqrt(floatx80 a, float_status *status)
 int floatx80_eq(floatx80 a, floatx80 b, float_status *status)
 {
 
-    if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
-         || (    ( extractFloatx80Exp( b ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( b )<<1 ) )
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)
+        || (extractFloatx80Exp(a) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(a) << 1))
+        || (extractFloatx80Exp(b) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(b) << 1))
        ) {
         float_raise(float_flag_invalid, status);
         return 0;
@@ -5649,10 +5706,11 @@ int floatx80_le(floatx80 a, floatx80 b, float_status *status)
 {
     flag aSign, bSign;
 
-    if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
-         || (    ( extractFloatx80Exp( b ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( b )<<1 ) )
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)
+        || (extractFloatx80Exp(a) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(a) << 1))
+        || (extractFloatx80Exp(b) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(b) << 1))
        ) {
         float_raise(float_flag_invalid, status);
         return 0;
@@ -5682,10 +5740,11 @@ int floatx80_lt(floatx80 a, floatx80 b, float_status *status)
 {
     flag aSign, bSign;
 
-    if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
-         || (    ( extractFloatx80Exp( b ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( b )<<1 ) )
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)
+        || (extractFloatx80Exp(a) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(a) << 1))
+        || (extractFloatx80Exp(b) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(b) << 1))
        ) {
         float_raise(float_flag_invalid, status);
         return 0;
@@ -5712,10 +5771,11 @@ int floatx80_lt(floatx80 a, floatx80 b, float_status *status)
 *----------------------------------------------------------------------------*/
 int floatx80_unordered(floatx80 a, floatx80 b, float_status *status)
 {
-    if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
-         || (    ( extractFloatx80Exp( b ) == 0x7FFF )
-              && (uint64_t) ( extractFloatx80Frac( b )<<1 ) )
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)
+        || (extractFloatx80Exp(a) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(a) << 1))
+        || (extractFloatx80Exp(b) == 0x7FFF
+            && (uint64_t) (extractFloatx80Frac(b) << 1))
        ) {
         float_raise(float_flag_invalid, status);
         return 1;
@@ -5733,6 +5793,10 @@ int floatx80_unordered(floatx80 a, floatx80 b, float_status *status)
 int floatx80_eq_quiet(floatx80 a, floatx80 b, float_status *status)
 {
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return 0;
+    }
     if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
               && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
@@ -5764,6 +5828,10 @@ int floatx80_le_quiet(floatx80 a, floatx80 b, float_status *status)
 {
     flag aSign, bSign;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return 0;
+    }
     if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
               && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
@@ -5800,6 +5868,10 @@ int floatx80_lt_quiet(floatx80 a, floatx80 b, float_status *status)
 {
     flag aSign, bSign;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return 0;
+    }
     if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
               && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
@@ -5833,6 +5905,10 @@ int floatx80_lt_quiet(floatx80 a, floatx80 b, float_status *status)
 *----------------------------------------------------------------------------*/
 int floatx80_unordered_quiet(floatx80 a, floatx80 b, float_status *status)
 {
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return 1;
+    }
     if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
               && (uint64_t) ( extractFloatx80Frac( a )<<1 ) )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
@@ -7374,6 +7450,10 @@ static inline int floatx80_compare_internal(floatx80 a, floatx80 b,
 {
     flag aSign, bSign;
 
+    if (floatx80_invalid_encoding(a) || floatx80_invalid_encoding(b)) {
+        float_raise(float_flag_invalid, status);
+        return float_relation_unordered;
+    }
     if (( ( extractFloatx80Exp( a ) == 0x7fff ) &&
           ( extractFloatx80Frac( a )<<1 ) ) ||
         ( ( extractFloatx80Exp( b ) == 0x7fff ) &&
@@ -7645,6 +7725,10 @@ floatx80 floatx80_scalbn(floatx80 a, int n, float_status *status)
     int32_t aExp;
     uint64_t aSig;
 
+    if (floatx80_invalid_encoding(a)) {
+        float_raise(float_flag_invalid, status);
+        return floatx80_default_nan(status);
+    }
     aSig = extractFloatx80Frac( a );
     aExp = extractFloatx80Exp( a );
     aSign = extractFloatx80Sign( a );
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 331d7667ec..3a6112fbf4 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -992,7 +992,7 @@ static void virtio_blk_class_init(ObjectClass *klass, void *data)
     vdc->load = virtio_blk_load_device;
 }
 
-static const TypeInfo virtio_device_info = {
+static const TypeInfo virtio_blk_info = {
     .name = TYPE_VIRTIO_BLK,
     .parent = TYPE_VIRTIO_DEVICE,
     .instance_size = sizeof(VirtIOBlock),
@@ -1002,7 +1002,7 @@ static const TypeInfo virtio_device_info = {
 
 static void virtio_register_types(void)
 {
-    type_register_static(&virtio_device_info);
+    type_register_static(&virtio_blk_info);
 }
 
 type_init(virtio_register_types)
diff --git a/hw/bt/hci.c b/hw/bt/hci.c
index 351123fab7..476ebec0ab 100644
--- a/hw/bt/hci.c
+++ b/hw/bt/hci.c
@@ -421,7 +421,7 @@ static void bt_submit_raw_acl(struct bt_piconet_s *net, int length, uint8_t *dat
 
 /* HCI layer emulation */
 
-/* Note: we could ignore endiannes because unswapped handles will still
+/* Note: we could ignore endianness because unswapped handles will still
  * be valid as connection identifiers for the guest - they don't have to
  * be continuously allocated.  We do it though, to preserve similar
  * behaviour between hosts.  Some things, like the BD_ADDR cannot be
diff --git a/hw/dma/omap_dma.c b/hw/dma/omap_dma.c
index 700cd6b43e..f6f86f9639 100644
--- a/hw/dma/omap_dma.c
+++ b/hw/dma/omap_dma.c
@@ -1975,7 +1975,7 @@ static void omap_dma4_write(void *opaque, hwaddr addr,
         ch->endian[1] =(value >> 19) & 1;
         ch->endian_lock[1] =(value >> 18) & 1;
         if (ch->endian[0] != ch->endian[1])
-            fprintf(stderr, "%s: DMA endiannes conversion enable attempt\n",
+            fprintf(stderr, "%s: DMA endianness conversion enable attempt\n",
                             __FUNCTION__);
         ch->write_mode = (value >> 16) & 3;
         ch->burst[1] = (value & 0xc000) >> 14;
diff --git a/hw/i386/kvm/i8259.c b/hw/i386/kvm/i8259.c
index 2b207de01b..11d1b726b6 100644
--- a/hw/i386/kvm/i8259.c
+++ b/hw/i386/kvm/i8259.c
@@ -92,7 +92,7 @@ static void kvm_pic_put(PICCommonState *s)
 
     ret = kvm_vm_ioctl(kvm_state, KVM_SET_IRQCHIP, &chip);
     if (ret < 0) {
-        fprintf(stderr, "KVM_GET_IRQCHIP failed: %s\n", strerror(ret));
+        fprintf(stderr, "KVM_SET_IRQCHIP failed: %s\n", strerror(ret));
         abort();
     }
 }
diff --git a/hw/i386/trace-events b/hw/i386/trace-events
index 7735e46eaf..5b99eba7b9 100644
--- a/hw/i386/trace-events
+++ b/hw/i386/trace-events
@@ -8,7 +8,7 @@ xen_pv_mmio_read(uint64_t addr) "WARNING: read from Xen PV Device MMIO space (ad
 xen_pv_mmio_write(uint64_t addr) "WARNING: write to Xen PV Device MMIO space (address %"PRIx64")"
 
 # hw/i386/pc.c
-mhp_pc_dimm_assigned_slot(int slot) "0x%d"
+mhp_pc_dimm_assigned_slot(int slot) "%d"
 mhp_pc_dimm_assigned_address(uint64_t addr) "0x%"PRIx64
 
 # hw/i386/x86-iommu.c
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 40a2ebca20..f803dfd5b3 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -628,7 +628,6 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size)
     s->msg_buffered_bytes = 0;
 
     fd = qemu_chr_fe_get_msgfd(s->server_chr);
-    IVSHMEM_DPRINTF("posn is %" PRId64 ", fd is %d\n", msg, fd);
 
     process_msg(s, msg, fd, &err);
     if (err) {
diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index badb1feb7d..e0bd31c577 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -52,7 +52,7 @@
                                      second according to spec 10.2.4.2 */
 #define E1000E_MAX_TX_FRAGS (64)
 
-static void
+static inline void
 e1000e_set_interrupt_cause(E1000ECore *core, uint32_t val);
 
 static inline void
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 6a68e594d5..1776b1b3c4 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -180,7 +180,7 @@ static void fw_cfg_bootsplash(FWCfgState *s)
         temp = qemu_opt_get(opts, "splash-time");
         if (temp != NULL) {
             p = (char *)temp;
-            boot_splash_time = strtol(p, (char **)&p, 10);
+            boot_splash_time = strtol(p, &p, 10);
         }
     }
 
@@ -240,7 +240,7 @@ static void fw_cfg_reboot(FWCfgState *s)
         temp = qemu_opt_get(opts, "reboot-timeout");
         if (temp != NULL) {
             p = (char *)temp;
-            reboot_timeout = strtol(p, (char **)&p, 10);
+            reboot_timeout = strtol(p, &p, 10);
         }
     }
     /* validate the input */
diff --git a/hw/ppc/ppc405.h b/hw/ppc/ppc405.h
index c67febca2f..a9ffc87f19 100644
--- a/hw/ppc/ppc405.h
+++ b/hw/ppc/ppc405.h
@@ -71,11 +71,5 @@ CPUPPCState *ppc405ep_init(MemoryRegion *address_space_mem,
                         hwaddr ram_sizes[2],
                         uint32_t sysclk, qemu_irq **picp,
                         int do_init);
-/* IBM STBxxx microcontrollers */
-CPUPPCState *ppc_stb025_init (MemoryRegion ram_memories[2],
-                           hwaddr ram_bases[2],
-                           hwaddr ram_sizes[2],
-                           uint32_t sysclk, qemu_irq **picp,
-                           ram_addr_t *offsetp);
 
 #endif /* PPC405_H */
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 48e38b2bbe..e741da1141 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -426,7 +426,7 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code)
         goto out;
     }
 
-    sclp_c->execute(sclp, (SCCB *)&work_sccb, code);
+    sclp_c->execute(sclp, &work_sccb, code);
 
     cpu_physical_memory_write(sccb, &work_sccb,
                               be16_to_cpu(work_sccb.h.length));
diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
index 904e357581..b58ab21d4c 100644
--- a/hw/s390x/virtio-ccw.h
+++ b/hw/s390x/virtio-ccw.h
@@ -183,7 +183,6 @@ typedef struct VirtIORNGCcw {
     VirtIORNG vdev;
 } VirtIORNGCcw;
 
-void virtio_ccw_device_update_status(SubchDev *sch);
 VirtIODevice *virtio_ccw_get_vdev(SubchDev *sch);
 
 #ifdef CONFIG_VIRTFS
diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
index eaae1bb182..ad87e78fe2 100644
--- a/hw/scsi/mptsas.c
+++ b/hw/scsi/mptsas.c
@@ -1269,7 +1269,7 @@ static const struct SCSIBusInfo mptsas_scsi_info = {
     .load_request = mptsas_load_request,
 };
 
-static void mptsas_scsi_init(PCIDevice *dev, Error **errp)
+static void mptsas_scsi_realize(PCIDevice *dev, Error **errp)
 {
     DeviceState *d = DEVICE(dev);
     MPTSASState *s = MPT_SAS(dev);
@@ -1426,7 +1426,7 @@ static void mptsas1068_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
 
-    pc->realize = mptsas_scsi_init;
+    pc->realize = mptsas_scsi_realize;
     pc->exit = mptsas_scsi_uninit;
     pc->romfile = 0;
     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
diff --git a/hw/sh4/shix.c b/hw/sh4/shix.c
index ccc9e75894..14d4007c1c 100644
--- a/hw/sh4/shix.c
+++ b/hw/sh4/shix.c
@@ -23,7 +23,7 @@
  */
 /*
    Shix 2.0 board by Alexis Polti, described at
-   http://perso.enst.fr/~polti/realisations/shix20/
+   https://web.archive.org/web/20070917001736/perso.enst.fr/~polti/realisations/shix20
 
    More information in target-sh4/README.sh4
 */
diff --git a/hw/tricore/tricore_testboard.c b/hw/tricore/tricore_testboard.c
index 8d3520f5be..19dd587207 100644
--- a/hw/tricore/tricore_testboard.c
+++ b/hw/tricore/tricore_testboard.c
@@ -46,7 +46,7 @@ static void tricore_load_kernel(CPUTriCoreState *env)
     long kernel_size;
 
     kernel_size = load_elf(tricoretb_binfo.kernel_filename, NULL,
-                           NULL, (uint64_t *)&entry, NULL,
+                           NULL, &entry, NULL,
                            NULL, 0,
                            EM_TRICORE, 1, 0);
     if (kernel_size <= 0) {
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1be85ae75a..58d95fffb2 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -48,6 +48,9 @@ enum mtp_code {
     CMD_GET_OBJECT_INFO            = 0x1008,
     CMD_GET_OBJECT                 = 0x1009,
     CMD_GET_PARTIAL_OBJECT         = 0x101b,
+    CMD_GET_OBJECT_PROPS_SUPPORTED = 0x9801,
+    CMD_GET_OBJECT_PROP_DESC       = 0x9802,
+    CMD_GET_OBJECT_PROP_VALUE      = 0x9803,
 
     /* response codes */
     RES_OK                         = 0x2001,
@@ -59,10 +62,12 @@ enum mtp_code {
     RES_INCOMPLETE_TRANSFER        = 0x2007,
     RES_INVALID_STORAGE_ID         = 0x2008,
     RES_INVALID_OBJECT_HANDLE      = 0x2009,
+    RES_INVALID_OBJECT_FORMAT_CODE = 0x200b,
     RES_SPEC_BY_FORMAT_UNSUPPORTED = 0x2014,
     RES_INVALID_PARENT_OBJECT      = 0x201a,
     RES_INVALID_PARAMETER          = 0x201d,
     RES_SESSION_ALREADY_OPEN       = 0x201e,
+    RES_INVALID_OBJECT_PROP_CODE   = 0xA801,
 
     /* format codes */
     FMT_UNDEFINED_OBJECT           = 0x3000,
@@ -72,6 +77,22 @@ enum mtp_code {
     EVT_OBJ_ADDED                  = 0x4002,
     EVT_OBJ_REMOVED                = 0x4003,
     EVT_OBJ_INFO_CHANGED           = 0x4007,
+
+    /* object properties */
+    PROP_STORAGE_ID                = 0xDC01,
+    PROP_OBJECT_FORMAT             = 0xDC02,
+    PROP_OBJECT_COMPRESSED_SIZE    = 0xDC04,
+    PROP_PARENT_OBJECT             = 0xDC0B,
+    PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER = 0xDC41,
+    PROP_NAME                      = 0xDC44,
+};
+
+enum mtp_data_type {
+    DATA_TYPE_UINT16  = 0x0004,
+    DATA_TYPE_UINT32  = 0x0006,
+    DATA_TYPE_UINT64  = 0x0008,
+    DATA_TYPE_UINT128 = 0x000a,
+    DATA_TYPE_STRING  = 0xffff,
 };
 
 typedef struct {
@@ -115,8 +136,8 @@ struct MTPControl {
 struct MTPData {
     uint16_t     code;
     uint32_t     trans;
-    uint32_t     offset;
-    uint32_t     length;
+    uint64_t     offset;
+    uint64_t     length;
     uint32_t     alloc;
     uint8_t      *data;
     bool         first;
@@ -778,6 +799,9 @@ static MTPData *usb_mtp_get_device_info(MTPState *s, MTPControl *c)
         CMD_GET_OBJECT_INFO,
         CMD_GET_OBJECT,
         CMD_GET_PARTIAL_OBJECT,
+        CMD_GET_OBJECT_PROPS_SUPPORTED,
+        CMD_GET_OBJECT_PROP_DESC,
+        CMD_GET_OBJECT_PROP_VALUE,
     };
     static const uint16_t fmt[] = {
         FMT_UNDEFINED_OBJECT,
@@ -883,7 +907,12 @@ static MTPData *usb_mtp_get_object_info(MTPState *s, MTPControl *c,
     usb_mtp_add_u32(d, QEMU_STORAGE_ID);
     usb_mtp_add_u16(d, o->format);
     usb_mtp_add_u16(d, 0);
-    usb_mtp_add_u32(d, o->stat.st_size);
+
+    if (o->stat.st_size > 0xFFFFFFFF) {
+        usb_mtp_add_u32(d, 0xFFFFFFFF);
+    } else {
+        usb_mtp_add_u32(d, o->stat.st_size);
+    }
 
     usb_mtp_add_u16(d, 0);
     usb_mtp_add_u32(d, 0);
@@ -966,6 +995,122 @@ static MTPData *usb_mtp_get_partial_object(MTPState *s, MTPControl *c,
     return d;
 }
 
+static MTPData *usb_mtp_get_object_props_supported(MTPState *s, MTPControl *c)
+{
+    static const uint16_t props[] = {
+        PROP_STORAGE_ID,
+        PROP_OBJECT_FORMAT,
+        PROP_OBJECT_COMPRESSED_SIZE,
+        PROP_PARENT_OBJECT,
+        PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER,
+        PROP_NAME,
+    };
+    MTPData *d = usb_mtp_data_alloc(c);
+    usb_mtp_add_u16_array(d, ARRAY_SIZE(props), props);
+
+    return d;
+}
+
+static MTPData *usb_mtp_get_object_prop_desc(MTPState *s, MTPControl *c)
+{
+    MTPData *d = usb_mtp_data_alloc(c);
+    switch (c->argv[0]) {
+    case PROP_STORAGE_ID:
+        usb_mtp_add_u16(d, PROP_STORAGE_ID);
+        usb_mtp_add_u16(d, DATA_TYPE_UINT32);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u8(d, 0x00);
+        break;
+    case PROP_OBJECT_FORMAT:
+        usb_mtp_add_u16(d, PROP_OBJECT_FORMAT);
+        usb_mtp_add_u16(d, DATA_TYPE_UINT16);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u16(d, 0x0000);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u8(d, 0x00);
+        break;
+    case PROP_OBJECT_COMPRESSED_SIZE:
+        usb_mtp_add_u16(d, PROP_OBJECT_COMPRESSED_SIZE);
+        usb_mtp_add_u16(d, DATA_TYPE_UINT64);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u64(d, 0x0000000000000000);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u8(d, 0x00);
+        break;
+    case PROP_PARENT_OBJECT:
+        usb_mtp_add_u16(d, PROP_PARENT_OBJECT);
+        usb_mtp_add_u16(d, DATA_TYPE_UINT32);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u8(d, 0x00);
+        break;
+    case PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER:
+        usb_mtp_add_u16(d, PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER);
+        usb_mtp_add_u16(d, DATA_TYPE_UINT128);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u64(d, 0x0000000000000000);
+        usb_mtp_add_u64(d, 0x0000000000000000);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u8(d, 0x00);
+        break;
+    case PROP_NAME:
+        usb_mtp_add_u16(d, PROP_NAME);
+        usb_mtp_add_u16(d, DATA_TYPE_STRING);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u8(d, 0x00);
+        usb_mtp_add_u32(d, 0x00000000);
+        usb_mtp_add_u8(d, 0x00);
+        break;
+    default:
+        usb_mtp_data_free(d);
+        return NULL;
+    }
+
+    return d;
+}
+
+static MTPData *usb_mtp_get_object_prop_value(MTPState *s, MTPControl *c,
+                                              MTPObject *o)
+{
+    MTPData *d = usb_mtp_data_alloc(c);
+    switch (c->argv[1]) {
+    case PROP_STORAGE_ID:
+        usb_mtp_add_u32(d, QEMU_STORAGE_ID);
+        break;
+    case PROP_OBJECT_FORMAT:
+        usb_mtp_add_u16(d, o->format);
+        break;
+    case PROP_OBJECT_COMPRESSED_SIZE:
+        usb_mtp_add_u64(d, o->stat.st_size);
+        break;
+    case PROP_PARENT_OBJECT:
+        if (o->parent == NULL) {
+            usb_mtp_add_u32(d, 0x00000000);
+        } else {
+            usb_mtp_add_u32(d, o->parent->handle);
+        }
+        break;
+    case PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER:
+        /* Should be persistant between sessions,
+         * but using our objedt ID is "good enough"
+         * for now */
+        usb_mtp_add_u64(d, 0x0000000000000000);
+        usb_mtp_add_u64(d, o->handle);
+        break;
+    case PROP_NAME:
+        usb_mtp_add_str(d, o->name);
+        break;
+    default:
+        usb_mtp_data_free(d);
+        return NULL;
+    }
+
+    return d;
+}
+
 static void usb_mtp_command(MTPState *s, MTPControl *c)
 {
     MTPData *data_in = NULL;
@@ -1113,6 +1258,43 @@ static void usb_mtp_command(MTPState *s, MTPControl *c)
         nres = 1;
         res0 = data_in->length;
         break;
+    case CMD_GET_OBJECT_PROPS_SUPPORTED:
+        if (c->argv[0] != FMT_UNDEFINED_OBJECT &&
+            c->argv[0] != FMT_ASSOCIATION) {
+            usb_mtp_queue_result(s, RES_INVALID_OBJECT_FORMAT_CODE,
+                                 c->trans, 0, 0, 0);
+            return;
+        }
+        data_in = usb_mtp_get_object_props_supported(s, c);
+        break;
+    case CMD_GET_OBJECT_PROP_DESC:
+        if (c->argv[1] != FMT_UNDEFINED_OBJECT &&
+            c->argv[1] != FMT_ASSOCIATION) {
+            usb_mtp_queue_result(s, RES_INVALID_OBJECT_FORMAT_CODE,
+                                 c->trans, 0, 0, 0);
+            return;
+        }
+        data_in = usb_mtp_get_object_prop_desc(s, c);
+        if (data_in == NULL) {
+            usb_mtp_queue_result(s, RES_INVALID_OBJECT_PROP_CODE,
+                                 c->trans, 0, 0, 0);
+            return;
+        }
+        break;
+    case CMD_GET_OBJECT_PROP_VALUE:
+        o = usb_mtp_object_lookup(s, c->argv[0]);
+        if (o == NULL) {
+            usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE,
+                                 c->trans, 0, 0, 0);
+            return;
+        }
+        data_in = usb_mtp_get_object_prop_value(s, c, o);
+        if (data_in == NULL) {
+            usb_mtp_queue_result(s, RES_INVALID_OBJECT_PROP_CODE,
+                                 c->trans, 0, 0, 0);
+            return;
+        }
+        break;
     default:
         trace_usb_mtp_op_unknown(s->dev.addr, c->code);
         usb_mtp_queue_result(s, RES_OPERATION_NOT_SUPPORTED,
@@ -1193,10 +1375,15 @@ static void usb_mtp_handle_data(USBDevice *dev, USBPacket *p)
         }
         if (s->data_in !=  NULL) {
             MTPData *d = s->data_in;
-            int dlen = d->length - d->offset;
+            uint64_t dlen = d->length - d->offset;
             if (d->first) {
                 trace_usb_mtp_data_in(s->dev.addr, d->trans, d->length);
-                container.length = cpu_to_le32(d->length + sizeof(container));
+                if (d->length + sizeof(container) > 0xFFFFFFFF) {
+                    container.length = cpu_to_le32(0xFFFFFFFF);
+                } else {
+                    container.length =
+                        cpu_to_le32(d->length + sizeof(container));
+                }
                 container.type   = cpu_to_le16(TYPE_DATA);
                 container.code   = cpu_to_le16(d->code);
                 container.trans  = cpu_to_le32(d->trans);
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 188f95416a..726435c462 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1753,6 +1753,12 @@ static void xhci_xfer_report(XHCITransfer *xfer)
         unsigned int chunk = 0;
 
         switch (TRB_TYPE(*trb)) {
+        case TR_SETUP:
+            chunk = trb->status & 0x1ffff;
+            if (chunk > 8) {
+                chunk = 8;
+            }
+            break;
         case TR_DATA:
         case TR_NORMAL:
         case TR_ISOCH:
@@ -3709,8 +3715,7 @@ static void usb_xhci_exit(PCIDevice *dev)
     /* destroy msix memory region */
     if (dev->msix_table && dev->msix_pba
         && dev->msix_entry_used) {
-        memory_region_del_subregion(&xhci->mem, &dev->msix_table_mmio);
-        memory_region_del_subregion(&xhci->mem, &dev->msix_pba_mmio);
+        msix_uninit(dev, &xhci->mem, &xhci->mem);
     }
 
     usb_bus_release(&xhci->bus);
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index e94672c155..bd81d71a98 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -743,10 +743,13 @@ static void usb_host_speed_compat(USBHostDevice *s)
                         rc = libusb_get_ss_endpoint_companion_descriptor
                             (ctx, endp, &endp_ss_comp);
                         if (rc == LIBUSB_SUCCESS) {
+                            int streams = endp_ss_comp->bmAttributes & 0x1f;
+                            if (streams) {
+                                compat_full = false;
+                                compat_high = false;
+                            }
                             libusb_free_ss_endpoint_companion_descriptor
                                 (endp_ss_comp);
-                            compat_full = false;
-                            compat_high = false;
                         }
 #endif
                         break;
diff --git a/include/block/block.h b/include/block/block.h
index 7edce5c35f..ffecebfb3a 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -185,11 +185,6 @@ typedef enum BlockOpType {
     BLOCK_OP_TYPE_MAX,
 } BlockOpType;
 
-void bdrv_info_print(Monitor *mon, const QObject *data);
-void bdrv_info(Monitor *mon, QObject **ret_data);
-void bdrv_stats_print(Monitor *mon, const QObject *data);
-void bdrv_info_stats(Monitor *mon, QObject **ret_data);
-
 /* disk I/O throttling */
 void bdrv_init(void);
 void bdrv_init_with_whitelist(void);
@@ -393,7 +388,6 @@ bool bdrv_is_encrypted(BlockDriverState *bs);
 bool bdrv_key_required(BlockDriverState *bs);
 int bdrv_set_key(BlockDriverState *bs, const char *key);
 void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp);
-int bdrv_query_missing_keys(void);
 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
                          void *opaque);
 const char *bdrv_get_node_name(const BlockDriverState *bs);
diff --git a/include/block/block_backup.h b/include/block/block_backup.h
new file mode 100644
index 0000000000..8a759477a3
--- /dev/null
+++ b/include/block/block_backup.h
@@ -0,0 +1,39 @@
+/*
+ * QEMU backup
+ *
+ * Copyright (c) 2013 Proxmox Server Solutions
+ * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
+ * Copyright (c) 2016 Intel Corporation
+ * Copyright (c) 2016 FUJITSU LIMITED
+ *
+ * Authors:
+ *  Dietmar Maurer <dietmar@proxmox.com>
+ *  Changlong Xie <xiecl.fnst@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef BLOCK_BACKUP_H
+#define BLOCK_BACKUP_H
+
+#include "block/block_int.h"
+
+typedef struct CowRequest {
+    int64_t start;
+    int64_t end;
+    QLIST_ENTRY(CowRequest) list;
+    CoQueue wait_queue; /* coroutines blocked on this request */
+} CowRequest;
+
+void backup_wait_for_overlapping_requests(BlockJob *job, int64_t sector_num,
+                                          int nb_sectors);
+void backup_cow_request_begin(CowRequest *req, BlockJob *job,
+                              int64_t sector_num,
+                              int nb_sectors);
+void backup_cow_request_end(CowRequest *req);
+
+void backup_do_checkpoint(BlockJob *job, Error **errp);
+
+#endif
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 0ca6a78eb3..ef3c047cb3 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -562,15 +562,6 @@ extern BlockDriver bdrv_file;
 extern BlockDriver bdrv_raw;
 extern BlockDriver bdrv_qcow2;
 
-/**
- * bdrv_setup_io_funcs:
- *
- * Prepare a #BlockDriver for I/O request processing by populating
- * unimplemented coroutine and AIO interfaces with generic wrapper functions
- * that fall back to implemented interfaces.
- */
-void bdrv_setup_io_funcs(BlockDriver *bdrv);
-
 int coroutine_fn bdrv_co_preadv(BdrvChild *child,
     int64_t offset, unsigned int bytes, QEMUIOVector *qiov,
     BdrvRequestFlags flags);
@@ -702,13 +693,14 @@ void commit_start(const char *job_id, BlockDriverState *bs,
  * @cb: Completion function for the job.
  * @opaque: Opaque pointer value passed to @cb.
  * @errp: Error object.
+ * @auto_complete: Auto complete the job.
  *
  */
 void commit_active_start(const char *job_id, BlockDriverState *bs,
                          BlockDriverState *base, int64_t speed,
                          BlockdevOnError on_error,
                          BlockCompletionFunc *cb,
-                         void *opaque, Error **errp);
+                         void *opaque, Error **errp, bool auto_complete);
 /*
  * mirror_start:
  * @job_id: The id of the newly-created job, or %NULL to use the
diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
index 1bde349b74..14f8383686 100644
--- a/include/fpu/softfloat.h
+++ b/include/fpu/softfloat.h
@@ -658,6 +658,21 @@ static inline int floatx80_is_any_nan(floatx80 a)
     return ((a.high & 0x7fff) == 0x7fff) && (a.low<<1);
 }
 
+/*----------------------------------------------------------------------------
+| Return whether the given value is an invalid floatx80 encoding.
+| Invalid floatx80 encodings arise when the integer bit is not set, but
+| the exponent is not zero. The only times the integer bit is permitted to
+| be zero is in subnormal numbers and the value zero.
+| This includes what the Intel software developer's manual calls pseudo-NaNs,
+| pseudo-infinities and un-normal numbers. It does not include
+| pseudo-denormals, which must still be correctly handled as inputs even
+| if they are never generated as outputs.
+*----------------------------------------------------------------------------*/
+static inline bool floatx80_invalid_encoding(floatx80 a)
+{
+    return (a.low & (1ULL << 63)) == 0 && (a.high & 0x7FFF) != 0;
+}
+
 #define floatx80_zero make_floatx80(0x0000, 0x0000000000000000LL)
 #define floatx80_one make_floatx80(0x3fff, 0x8000000000000000LL)
 #define floatx80_ln2 make_floatx80(0x3ffe, 0xb17217f7d1cf79acLL)
diff --git a/include/hw/arm/pxa.h b/include/hw/arm/pxa.h
index dd1a48b0c1..191e068184 100644
--- a/include/hw/arm/pxa.h
+++ b/include/hw/arm/pxa.h
@@ -83,7 +83,6 @@ typedef struct PXA2xxLCDState PXA2xxLCDState;
 PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
                 hwaddr base, qemu_irq irq);
 void pxa2xx_lcd_vsync_notifier(PXA2xxLCDState *s, qemu_irq handler);
-void pxa2xx_lcdc_oritentation(void *opaque, int angle);
 
 /* pxa2xx_mmci.c */
 typedef struct PXA2xxMMCIState PXA2xxMMCIState;
diff --git a/include/hw/bt.h b/include/hw/bt.h
index 185e79df2b..963f330138 100644
--- a/include/hw/bt.h
+++ b/include/hw/bt.h
@@ -174,8 +174,6 @@ enum bt_l2cap_psm_predef {
 void bt_l2cap_sdp_init(struct bt_l2cap_device_s *dev);
 
 /* bt-hid.c */
-struct bt_device_s *bt_mouse_init(struct bt_scatternet_s *net);
-struct bt_device_s *bt_tablet_init(struct bt_scatternet_s *net);
 struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net);
 
 /* Link Management Protocol layer defines */
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index ebba151097..ab8e319505 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -216,7 +216,6 @@ void vmmouse_set_data(const uint32_t *data);
 /* pckbd.c */
 #define I8042_A20_LINE "a20"
 
-void i8042_init(qemu_irq kbd_irq, qemu_irq mouse_irq, uint32_t io_base);
 void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
                    MemoryRegion *region, ram_addr_t size,
                    hwaddr mask);
@@ -284,7 +283,6 @@ int cmos_get_fd_drive_type(FloppyDriveType fd0);
 I2CBus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base,
                       qemu_irq sci_irq, qemu_irq smi_irq,
                       int smm_enabled, DeviceState **piix4_pm);
-void piix4_smbus_register_device(SMBusDevice *dev, uint8_t addr);
 
 /* hpet.c */
 extern int no_hpet;
diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
index 5adc603d47..1a2b11b322 100644
--- a/include/hw/pci-host/spapr.h
+++ b/include/hw/pci-host/spapr.h
@@ -106,8 +106,6 @@ int spapr_populate_pci_dt(sPAPRPHBState *phb,
                           uint32_t xics_phandle,
                           void *fdt);
 
-void spapr_pci_msi_init(sPAPRMachineState *spapr, hwaddr addr);
-
 void spapr_pci_rtas_init(void);
 
 sPAPRPHBState *spapr_pci_find_phb(sPAPRMachineState *spapr, uint64_t buid);
diff --git a/include/hw/pci/pci_bridge.h b/include/hw/pci/pci_bridge.h
index 847fd7db33..d5891cd30e 100644
--- a/include/hw/pci/pci_bridge.h
+++ b/include/hw/pci/pci_bridge.h
@@ -45,7 +45,6 @@ void pci_bridge_update_mappings(PCIBridge *br);
 void pci_bridge_write_config(PCIDevice *d,
                              uint32_t address, uint32_t val, int len);
 void pci_bridge_disable_base_limit(PCIDevice *dev);
-void pci_bridge_reset_reg(PCIDevice *dev);
 void pci_bridge_reset(DeviceState *qdev);
 
 void pci_bridge_initfn(PCIDevice *pci_dev, const char *typename);
diff --git a/include/hw/pci/pcie_port.h b/include/hw/pci/pcie_port.h
index e167bf7520..f7b64db00c 100644
--- a/include/hw/pci/pcie_port.h
+++ b/include/hw/pci/pcie_port.h
@@ -53,7 +53,6 @@ struct PCIESlot {
 };
 
 void pcie_chassis_create(uint8_t chassis_number);
-void pcie_main_chassis_create(void);
 PCIESlot *pcie_chassis_find_slot(uint8_t chassis, uint16_t slot);
 int pcie_chassis_add_slot(struct PCIESlot *slot);
 void pcie_chassis_del_slot(PCIESlot *s);
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index 3b01ae8314..66e57a5194 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -55,10 +55,4 @@ void ppc4xx_sdram_init (CPUPPCState *env, qemu_irq irq, int nbanks,
 
 #define TYPE_PPC4xx_PCI_HOST_BRIDGE "ppc4xx-pcihost"
 
-PCIBus *ppc4xx_pci_init(CPUPPCState *env, qemu_irq pci_irqs[4],
-                        hwaddr config_space,
-                        hwaddr int_ack,
-                        hwaddr special_cycle,
-                        hwaddr registers);
-
 #endif /* PPC4XX_H */
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index caf7be919f..6289d50dbf 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -368,9 +368,6 @@ void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn);
 target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
                              target_ulong *args);
 
-int spapr_allocate_irq(int hint, bool lsi);
-int spapr_allocate_irq_block(int num, bool lsi, bool msi);
-
 /* ibm,set-eeh-option */
 #define RTAS_EEH_DISABLE                 0
 #define RTAS_EEH_ENABLE                  1
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index d4a1e2c8af..40d0e5f6a3 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -85,8 +85,6 @@ extern VIOsPAPRDevice *spapr_vio_find_by_reg(VIOsPAPRBus *bus, uint32_t reg);
 extern int spapr_populate_vdevice(VIOsPAPRBus *bus, void *fdt);
 extern int spapr_populate_chosen_stdout(void *fdt, VIOsPAPRBus *bus);
 
-extern int spapr_vio_signal(VIOsPAPRDevice *dev, target_ulong mode);
-
 static inline qemu_irq spapr_vio_qirq(VIOsPAPRDevice *dev)
 {
     sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
@@ -137,8 +135,6 @@ void spapr_vscsi_create(VIOsPAPRBus *bus);
 
 VIOsPAPRDevice *spapr_vty_get_default(VIOsPAPRBus *bus);
 
-void spapr_vio_quiesce(void);
-
 extern const VMStateDescription vmstate_spapr_vio;
 
 #define VMSTATE_SPAPR_VIO(_f, _s) \
diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
index 94d7868105..9bad49e917 100644
--- a/include/hw/scsi/scsi.h
+++ b/include/hw/scsi/scsi.h
@@ -243,7 +243,6 @@ extern const struct SCSISense sense_code_SPACE_ALLOC_FAILED;
 uint32_t scsi_data_cdb_xfer(uint8_t *buf);
 uint32_t scsi_cdb_xfer(uint8_t *buf);
 int scsi_cdb_length(uint8_t *buf);
-int scsi_sense_valid(SCSISense sense);
 int scsi_build_sense(uint8_t *in_buf, int in_len,
                      uint8_t *buf, int len, bool fixed);
 
diff --git a/include/hw/virtio/virtio-bus.h b/include/hw/virtio/virtio-bus.h
index f3e5ef3f5b..c98aa526d1 100644
--- a/include/hw/virtio/virtio-bus.h
+++ b/include/hw/virtio/virtio-bus.h
@@ -111,9 +111,6 @@ void virtio_bus_device_unplugged(VirtIODevice *bus);
 uint16_t virtio_bus_get_vdev_id(VirtioBusState *bus);
 /* Get the config_len field of the plugged device. */
 size_t virtio_bus_get_vdev_config_len(VirtioBusState *bus);
-/* Get the features of the plugged device. */
-uint32_t virtio_bus_get_vdev_features(VirtioBusState *bus,
-                                    uint32_t requested_features);
 /* Get bad features of the plugged device. */
 uint32_t virtio_bus_get_vdev_bad_features(VirtioBusState *bus);
 /* Get config of the plugged device. */
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 3c96623d3d..d4acc72b85 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -229,8 +229,6 @@ void migrate_fd_error(MigrationState *s, const Error *error);
 
 void migrate_fd_connect(MigrationState *s);
 
-int migrate_fd_close(MigrationState *s);
-
 void add_migration_state_change_notifier(Notifier *notify);
 void remove_migration_state_change_notifier(Notifier *notify);
 MigrationState *migrate_init(const MigrationParams *params);
diff --git a/include/net/net.h b/include/net/net.h
index e8d9e9e4e9..99b28d5b38 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -138,8 +138,6 @@ NetClientState *qemu_get_queue(NICState *nic);
 NICState *qemu_get_nic(NetClientState *nc);
 void *qemu_get_nic_opaque(NetClientState *nc);
 void qemu_del_net_client(NetClientState *nc);
-NetClientState *qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
-                                              const char *client_str);
 typedef void (*qemu_nic_foreach)(NICState *nic, void *opaque);
 void qemu_foreach_nic(qemu_nic_foreach func, void *opaque);
 int qemu_can_send_packet(NetClientState *nc);
diff --git a/include/qemu/bitmap.h b/include/qemu/bitmap.h
index ec5146f84e..7247f14788 100644
--- a/include/qemu/bitmap.h
+++ b/include/qemu/bitmap.h
@@ -75,10 +75,6 @@ int slow_bitmap_equal(const unsigned long *bitmap1,
                       const unsigned long *bitmap2, long bits);
 void slow_bitmap_complement(unsigned long *dst, const unsigned long *src,
                             long bits);
-void slow_bitmap_shift_right(unsigned long *dst,
-                             const unsigned long *src, int shift, long bits);
-void slow_bitmap_shift_left(unsigned long *dst,
-                            const unsigned long *src, int shift, long bits);
 int slow_bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
                     const unsigned long *bitmap2, long bits);
 void slow_bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index 34650b2039..bdfae004e4 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -172,7 +172,7 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type);
  * qemu_clock_get_main_loop_timerlist:
  * @type: the clock type
  *
- * Return the default timer list assocatiated with a clock.
+ * Return the default timer list associated with a clock.
  *
  * Returns: the default timer list
  */
@@ -424,6 +424,7 @@ void timer_init_tl(QEMUTimer *ts,
 
 /**
  * timer_init:
+ * @ts: the timer to be initialised
  * @type: the clock to associate with the timer
  * @scale: the scale value for the timer
  * @cb: the callback to call when the timer expires
@@ -443,6 +444,7 @@ static inline void timer_init(QEMUTimer *ts, QEMUClockType type, int scale,
 
 /**
  * timer_init_ns:
+ * @ts: the timer to be initialised
  * @type: the clock to associate with the timer
  * @cb: the callback to call when the timer expires
  * @opaque: the opaque pointer to pass to the callback
@@ -461,6 +463,7 @@ static inline void timer_init_ns(QEMUTimer *ts, QEMUClockType type,
 
 /**
  * timer_init_us:
+ * @ts: the timer to be initialised
  * @type: the clock to associate with the timer
  * @cb: the callback to call when the timer expires
  * @opaque: the opaque pointer to pass to the callback
@@ -479,6 +482,7 @@ static inline void timer_init_us(QEMUTimer *ts, QEMUClockType type,
 
 /**
  * timer_init_ms:
+ * @ts: the timer to be initialised
  * @type: the clock to associate with the timer
  * @cb: the callback to call when the timer expires
  * @opaque: the opaque pointer to pass to the callback
@@ -502,7 +506,7 @@ static inline void timer_init_ms(QEMUTimer *ts, QEMUClockType type,
  * @cb: the callback to be called when the timer expires
  * @opaque: the opaque pointer to be passed to the callback
  *
- * Creeate a new timer and associate it with @timer_list.
+ * Create a new timer and associate it with @timer_list.
  * The memory is allocated by the function.
  *
  * This is not the preferred interface unless you know you
@@ -527,7 +531,7 @@ static inline QEMUTimer *timer_new_tl(QEMUTimerList *timer_list,
  * @cb: the callback to be called when the timer expires
  * @opaque: the opaque pointer to be passed to the callback
  *
- * Creeate a new timer and associate it with the default
+ * Create a new timer and associate it with the default
  * timer list for the clock type @type.
  *
  * Returns: a pointer to the timer
@@ -540,8 +544,8 @@ static inline QEMUTimer *timer_new(QEMUClockType type, int scale,
 
 /**
  * timer_new_ns:
- * @clock: the clock to associate with the timer
- * @callback: the callback to call when the timer expires
+ * @type: the clock type to associate with the timer
+ * @cb: the callback to call when the timer expires
  * @opaque: the opaque pointer to pass to the callback
  *
  * Create a new timer with nanosecond scale on the default timer list
@@ -557,8 +561,8 @@ static inline QEMUTimer *timer_new_ns(QEMUClockType type, QEMUTimerCB *cb,
 
 /**
  * timer_new_us:
- * @clock: the clock to associate with the timer
- * @callback: the callback to call when the timer expires
+ * @type: the clock type to associate with the timer
+ * @cb: the callback to call when the timer expires
  * @opaque: the opaque pointer to pass to the callback
  *
  * Create a new timer with microsecond scale on the default timer list
@@ -574,8 +578,8 @@ static inline QEMUTimer *timer_new_us(QEMUClockType type, QEMUTimerCB *cb,
 
 /**
  * timer_new_ms:
- * @clock: the clock to associate with the timer
- * @callback: the callback to call when the timer expires
+ * @type: the clock type to associate with the timer
+ * @cb: the callback to call when the timer expires
  * @opaque: the opaque pointer to pass to the callback
  *
  * Create a new timer with millisecond scale on the default timer list
@@ -684,6 +688,7 @@ bool timer_pending(QEMUTimer *ts);
 /**
  * timer_expired:
  * @ts: the timer
+ * @current_time: the current time
  *
  * Determines whether a timer has expired.
  *
@@ -790,7 +795,7 @@ static inline int64_t get_max_clock_jump(void)
  * Low level clock functions
  */
 
-/* real time host monotonic timer */
+/* get host real time in nanosecond */
 static inline int64_t get_clock_realtime(void)
 {
     struct timeval tv;
diff --git a/include/qemu/uri.h b/include/qemu/uri.h
index de99b3bd4b..d201c61260 100644
--- a/include/qemu/uri.h
+++ b/include/qemu/uri.h
@@ -102,8 +102,6 @@ typedef struct QueryParams {
 } QueryParams;
 
 struct QueryParams *query_params_new (int init_alloc);
-int query_param_append (QueryParams *ps, const char *name, const char *value);
-extern char *query_param_to_string (const QueryParams *ps);
 extern QueryParams *query_params_parse (const char *query);
 extern void query_params_free (QueryParams *ps);
 
diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
index 2eefea1cc2..68ac2de83a 100644
--- a/include/sysemu/iothread.h
+++ b/include/sysemu/iothread.h
@@ -35,5 +35,6 @@ typedef struct {
 
 char *iothread_get_id(IOThread *iothread);
 AioContext *iothread_get_aio_context(IOThread *iothread);
+void iothread_stop_all(void);
 
 #endif /* IOTHREAD_H */
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index f2a7b3b8fe..3e17ba76ce 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -326,8 +326,6 @@ MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run);
 
 int kvm_arch_handle_exit(CPUState *cpu, struct kvm_run *run);
 
-int kvm_arch_handle_ioapic_eoi(CPUState *cpu, struct kvm_run *run);
-
 int kvm_arch_process_async_events(CPUState *cpu);
 
 int kvm_arch_get_registers(CPUState *cpu);
diff --git a/include/ui/console.h b/include/ui/console.h
index 2703a3aa5a..d9c13d20b1 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -394,9 +394,7 @@ QemuUIInfo *qemu_console_get_ui_info(QemuConsole *con);
 int qemu_console_get_width(QemuConsole *con, int fallback);
 int qemu_console_get_height(QemuConsole *con, int fallback);
 
-void text_consoles_set_display(DisplayState *ds);
 void console_select(unsigned int index);
-void console_color_init(DisplayState *ds);
 void qemu_console_resize(QemuConsole *con, int width, int height);
 void qemu_console_copy(QemuConsole *con, int src_x, int src_y,
                        int dst_x, int dst_y, int w, int h);
diff --git a/include/ui/input.h b/include/ui/input.h
index 102d8a3341..d06a12dd4c 100644
--- a/include/ui/input.h
+++ b/include/ui/input.h
@@ -65,6 +65,4 @@ void qemu_input_check_mode_change(void);
 void qemu_add_mouse_mode_change_notifier(Notifier *notify);
 void qemu_remove_mouse_mode_change_notifier(Notifier *notify);
 
-int input_linux_init(void *opaque, QemuOpts *opts, Error **errp);
-
 #endif /* INPUT_H */
diff --git a/include/ui/spice-display.h b/include/ui/spice-display.h
index 568b64a0f6..42e0fdf775 100644
--- a/include/ui/spice-display.h
+++ b/include/ui/spice-display.h
@@ -144,8 +144,6 @@ void qemu_spice_destroy_update(SimpleSpiceDisplay *sdpy, SimpleSpiceUpdate *upda
 void qemu_spice_create_host_memslot(SimpleSpiceDisplay *ssd);
 void qemu_spice_create_host_primary(SimpleSpiceDisplay *ssd);
 void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd);
-void qemu_spice_vm_change_state_handler(void *opaque, int running,
-                                        RunState state);
 void qemu_spice_display_init_common(SimpleSpiceDisplay *ssd);
 
 void qemu_spice_display_update(SimpleSpiceDisplay *ssd,
diff --git a/iothread.c b/iothread.c
index f183d380e6..fb08a60b4b 100644
--- a/iothread.c
+++ b/iothread.c
@@ -54,16 +54,25 @@ static void *iothread_run(void *opaque)
     return NULL;
 }
 
-static void iothread_instance_finalize(Object *obj)
+static int iothread_stop(Object *object, void *opaque)
 {
-    IOThread *iothread = IOTHREAD(obj);
+    IOThread *iothread;
 
-    if (!iothread->ctx) {
-        return;
+    iothread = (IOThread *)object_dynamic_cast(object, TYPE_IOTHREAD);
+    if (!iothread || !iothread->ctx) {
+        return 0;
     }
     iothread->stopping = true;
     aio_notify(iothread->ctx);
     qemu_thread_join(&iothread->thread);
+    return 0;
+}
+
+static void iothread_instance_finalize(Object *obj)
+{
+    IOThread *iothread = IOTHREAD(obj);
+
+    iothread_stop(obj, NULL);
     qemu_cond_destroy(&iothread->init_done_cond);
     qemu_mutex_destroy(&iothread->init_done_lock);
     aio_context_unref(iothread->ctx);
@@ -174,3 +183,10 @@ IOThreadInfoList *qmp_query_iothreads(Error **errp)
     object_child_foreach(container, query_one_iothread, &prev);
     return head;
 }
+
+void iothread_stop_all(void)
+{
+    Object *container = object_get_objects_root();
+
+    object_child_foreach(container, iothread_stop, NULL);
+}
diff --git a/linux-user/main.c b/linux-user/main.c
index 6004ece152..3ad70f8a6e 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -2030,7 +2030,7 @@ void cpu_loop(CPUPPCState *env)
             /* just indicate that signals should be handled asap */
             break;
         default:
-            cpu_abort(cs, "Unknown exception 0x%d. Aborting\n", trapnr);
+            cpu_abort(cs, "Unknown exception 0x%x. Aborting\n", trapnr);
             break;
         }
         process_pending_signals(env);
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index bef465de4d..815447f5fc 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -548,7 +548,7 @@ static inline void *lock_user(int type, abi_ulong guest_addr, long len, int copy
 #ifdef DEBUG_REMAP
     {
         void *addr;
-        addr = malloc(len);
+        addr = g_malloc(len);
         if (copy)
             memcpy(addr, g2h(guest_addr), len);
         else
@@ -574,7 +574,7 @@ static inline void unlock_user(void *host_ptr, abi_ulong guest_addr,
         return;
     if (len > 0)
         memcpy(g2h(guest_addr), host_ptr, len);
-    free(host_ptr);
+    g_free(host_ptr);
 #endif
 }
 
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 9a4d894e3a..d3ac0e2565 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -4244,7 +4244,7 @@ static void setup_frame(int sig, struct target_sigaction *ka,
     env->regs[5] = 0; // FIXME: no clue... current->thread.prot_addr;
 
     /* Place signal number on stack to allow backtrace from handler.  */
-    __put_user(env->regs[2], (int *) &frame->signo);
+    __put_user(env->regs[2], &frame->signo);
     unlock_user_struct(frame, frame_addr, 1);
     return;
 
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 783565463f..c0c9b5887c 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -2329,8 +2329,8 @@ struct target_flock {
 struct target_flock64 {
     short  l_type;
     short  l_whence;
-#if defined(TARGET_PPC) || defined(TARGET_X86_64) || defined(TARGET_MIPS) \
-    || defined(TARGET_SPARC) || defined(TARGET_HPPA) \
+#if defined(TARGET_PPC) || defined(TARGET_X86_64) \
+    || defined(TARGET_MIPS) || defined(TARGET_SPARC) \
     || defined(TARGET_MICROBLAZE) || defined(TARGET_TILEGX)
     int __pad;
 #endif
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 173fb08ea3..24223fd08a 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -252,6 +252,7 @@
 #       2.3: 'host_floppy' deprecated
 #       2.5: 'host_floppy' dropped
 #       2.6: 'luks' added
+#       2.8: 'replication' added
 #
 # @backing_file: #optional the name of the backing file (for copy-on-write)
 #
@@ -1712,8 +1713,8 @@
   'data': [ 'archipelago', 'blkdebug', 'blkverify', 'bochs', 'cloop',
             'dmg', 'file', 'ftp', 'ftps', 'gluster', 'host_cdrom',
             'host_device', 'http', 'https', 'luks', 'null-aio', 'null-co',
-            'parallels', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'tftp',
-            'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
+            'parallels', 'qcow', 'qcow2', 'qed', 'quorum', 'raw',
+	    'replication', 'tftp', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
 
 ##
 # @BlockdevOptionsFile
@@ -2178,6 +2179,36 @@
             '*logfile': 'str' } }
 
 ##
+# @ReplicationMode
+#
+# An enumeration of replication modes.
+#
+# @primary: Primary mode, the vm's state will be sent to secondary QEMU.
+#
+# @secondary: Secondary mode, receive the vm's state from primary QEMU.
+#
+# Since: 2.8
+##
+{ 'enum' : 'ReplicationMode', 'data' : [ 'primary', 'secondary' ] }
+
+##
+# @BlockdevOptionsReplication
+#
+# Driver specific block device options for replication
+#
+# @mode: the replication mode
+#
+# @top-id: #optional In secondary mode, node name or device ID of the root
+#          node who owns the replication node chain. Ignored in primary mode.
+#
+# Since: 2.8
+##
+{ 'struct': 'BlockdevOptionsReplication',
+  'base': 'BlockdevOptionsGenericFormat',
+  'data': { 'mode': 'ReplicationMode',
+            '*top-id': 'str' } }
+
+##
 # @BlockdevOptions
 #
 # Options for creating a block device.  Many options are available for all
@@ -2242,6 +2273,7 @@
       'quorum':     'BlockdevOptionsQuorum',
       'raw':        'BlockdevOptionsGenericFormat',
 # TODO rbd: Wait for structured options
+      'replication':'BlockdevOptionsReplication',
 # TODO sheepdog: Wait for structured options
 # TODO ssh: Should take InetSocketAddress for 'host'?
       'tftp':       'BlockdevOptionsFile',
diff --git a/qemu-img.c b/qemu-img.c
index 1090286a9f..ea52486e81 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -921,7 +921,7 @@ static int img_commit(int argc, char **argv)
     };
 
     commit_active_start("commit", bs, base_bs, 0, BLOCKDEV_ON_ERROR_REPORT,
-                        common_block_job_cb, &cbi, &local_err);
+                        common_block_job_cb, &cbi, &local_err, false);
     if (local_err) {
         goto done;
     }
diff --git a/qemu-options.hx b/qemu-options.hx
index 4927939d5d..0b621bb99e 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -303,7 +303,7 @@ STEXI
 @findex -k
 Use keyboard layout @var{language} (for example @code{fr} for
 French). This option is only needed where it is not easy to get raw PC
-keycodes (e.g. on Macs, with some X11 servers or with a VNC
+keycodes (e.g. on Macs, with some X11 servers or with a VNC or curses
 display). You don't normally need to use it on PC/Linux or PC/Windows
 hosts.
 
diff --git a/qemu-tech.texi b/qemu-tech.texi
index bdb2285f4e..1b048cb337 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -89,8 +89,7 @@ QEMU generic features:
 
 @item
 Working on x86, x86_64 and PowerPC32/64 hosts. Being tested on ARM,
-HPPA, Sparc32 and Sparc64. Previous versions had some support for
-Alpha and S390 hosts, but TCG (see below) doesn't support those yet.
+S390x, Sparc32 and Sparc64.
 
 @item Self-modifying code support.
 
diff --git a/replication.c b/replication.c
new file mode 100644
index 0000000000..be3a42f9c9
--- /dev/null
+++ b/replication.c
@@ -0,0 +1,107 @@
+/*
+ * Replication filter
+ *
+ * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
+ * Copyright (c) 2016 Intel Corporation
+ * Copyright (c) 2016 FUJITSU LIMITED
+ *
+ * Author:
+ *   Changlong Xie <xiecl.fnst@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "replication.h"
+
+static QLIST_HEAD(, ReplicationState) replication_states;
+
+ReplicationState *replication_new(void *opaque, ReplicationOps *ops)
+{
+    ReplicationState *rs;
+
+    assert(ops != NULL);
+    rs = g_new0(ReplicationState, 1);
+    rs->opaque = opaque;
+    rs->ops = ops;
+    QLIST_INSERT_HEAD(&replication_states, rs, node);
+
+    return rs;
+}
+
+void replication_remove(ReplicationState *rs)
+{
+    if (rs) {
+        QLIST_REMOVE(rs, node);
+        g_free(rs);
+    }
+}
+
+/*
+ * The caller of the function MUST make sure vm stopped
+ */
+void replication_start_all(ReplicationMode mode, Error **errp)
+{
+    ReplicationState *rs, *next;
+    Error *local_err = NULL;
+
+    QLIST_FOREACH_SAFE(rs, &replication_states, node, next) {
+        if (rs->ops && rs->ops->start) {
+            rs->ops->start(rs, mode, &local_err);
+        }
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
+
+void replication_do_checkpoint_all(Error **errp)
+{
+    ReplicationState *rs, *next;
+    Error *local_err = NULL;
+
+    QLIST_FOREACH_SAFE(rs, &replication_states, node, next) {
+        if (rs->ops && rs->ops->checkpoint) {
+            rs->ops->checkpoint(rs, &local_err);
+        }
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
+
+void replication_get_error_all(Error **errp)
+{
+    ReplicationState *rs, *next;
+    Error *local_err = NULL;
+
+    QLIST_FOREACH_SAFE(rs, &replication_states, node, next) {
+        if (rs->ops && rs->ops->get_error) {
+            rs->ops->get_error(rs, &local_err);
+        }
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
+
+void replication_stop_all(bool failover, Error **errp)
+{
+    ReplicationState *rs, *next;
+    Error *local_err = NULL;
+
+    QLIST_FOREACH_SAFE(rs, &replication_states, node, next) {
+        if (rs->ops && rs->ops->stop) {
+            rs->ops->stop(rs, failover, &local_err);
+        }
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
diff --git a/replication.h b/replication.h
new file mode 100644
index 0000000000..ece6ca6133
--- /dev/null
+++ b/replication.h
@@ -0,0 +1,174 @@
+/*
+ * Replication filter
+ *
+ * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
+ * Copyright (c) 2016 Intel Corporation
+ * Copyright (c) 2016 FUJITSU LIMITED
+ *
+ * Author:
+ *   Changlong Xie <xiecl.fnst@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef REPLICATION_H
+#define REPLICATION_H
+
+#include "qemu/queue.h"
+
+typedef struct ReplicationOps ReplicationOps;
+typedef struct ReplicationState ReplicationState;
+
+/**
+ * SECTION:replication.h
+ * @title:Base Replication System
+ * @short_description: interfaces for handling replication
+ *
+ * The Replication Model provides a framework for handling Replication
+ *
+ * <example>
+ *   <title>How to use replication interfaces</title>
+ *   <programlisting>
+ * #include "replication.h"
+ *
+ * typedef struct BDRVReplicationState {
+ *     ReplicationState *rs;
+ * } BDRVReplicationState;
+ *
+ * static void replication_start(ReplicationState *rs, ReplicationMode mode,
+ *                               Error **errp);
+ * static void replication_do_checkpoint(ReplicationState *rs, Error **errp);
+ * static void replication_get_error(ReplicationState *rs, Error **errp);
+ * static void replication_stop(ReplicationState *rs, bool failover,
+ *                              Error **errp);
+ *
+ * static ReplicationOps replication_ops = {
+ *     .start = replication_start,
+ *     .checkpoint = replication_do_checkpoint,
+ *     .get_error = replication_get_error,
+ *     .stop = replication_stop,
+ * }
+ *
+ * static int replication_open(BlockDriverState *bs, QDict *options,
+ *                             int flags, Error **errp)
+ * {
+ *     BDRVReplicationState *s = bs->opaque;
+ *     s->rs = replication_new(bs, &replication_ops);
+ *     return 0;
+ * }
+ *
+ * static void replication_close(BlockDriverState *bs)
+ * {
+ *     BDRVReplicationState *s = bs->opaque;
+ *     replication_remove(s->rs);
+ * }
+ *
+ * BlockDriver bdrv_replication = {
+ *     .format_name                = "replication",
+ *     .protocol_name              = "replication",
+ *     .instance_size              = sizeof(BDRVReplicationState),
+ *
+ *     .bdrv_open                  = replication_open,
+ *     .bdrv_close                 = replication_close,
+ * };
+ *
+ * static void bdrv_replication_init(void)
+ * {
+ *     bdrv_register(&bdrv_replication);
+ * }
+ *
+ * block_init(bdrv_replication_init);
+ *   </programlisting>
+ * </example>
+ *
+ * We create an example about how to use replication interfaces in above.
+ * Then in migration, we can use replication_(start/stop/do_checkpoint/
+ * get_error)_all to handle all replication operations.
+ */
+
+/**
+ * ReplicationState:
+ * @opaque: opaque pointer value passed to this ReplicationState
+ * @ops: replication operation of this ReplicationState
+ * @node: node that we will insert into @replication_states QLIST
+ */
+struct ReplicationState {
+    void *opaque;
+    ReplicationOps *ops;
+    QLIST_ENTRY(ReplicationState) node;
+};
+
+/**
+ * ReplicationOps:
+ * @start: callback to start replication
+ * @stop: callback to stop replication
+ * @checkpoint: callback to do checkpoint
+ * @get_error: callback to check if error occurred during replication
+ */
+struct ReplicationOps {
+    void (*start)(ReplicationState *rs, ReplicationMode mode, Error **errp);
+    void (*stop)(ReplicationState *rs, bool failover, Error **errp);
+    void (*checkpoint)(ReplicationState *rs, Error **errp);
+    void (*get_error)(ReplicationState *rs, Error **errp);
+};
+
+/**
+ * replication_new:
+ * @opaque: opaque pointer value passed to ReplicationState
+ * @ops: replication operation of the new relevant ReplicationState
+ *
+ * Called to create a new ReplicationState instance, and then insert it
+ * into @replication_states QLIST
+ *
+ * Returns: the new ReplicationState instance
+ */
+ReplicationState *replication_new(void *opaque, ReplicationOps *ops);
+
+/**
+ * replication_remove:
+ * @rs: the ReplicationState instance to remove
+ *
+ * Called to remove a ReplicationState instance, and then delete it from
+ * @replication_states QLIST
+ */
+void replication_remove(ReplicationState *rs);
+
+/**
+ * replication_start_all:
+ * @mode: replication mode that could be "primary" or "secondary"
+ * @errp: returns an error if this function fails
+ *
+ * Start replication, called in migration/checkpoint thread
+ *
+ * Note: the caller of the function MUST make sure vm stopped
+ */
+void replication_start_all(ReplicationMode mode, Error **errp);
+
+/**
+ * replication_do_checkpoint_all:
+ * @errp: returns an error if this function fails
+ *
+ * This interface is called after all VM state is transferred to Secondary QEMU
+ */
+void replication_do_checkpoint_all(Error **errp);
+
+/**
+ * replication_get_error_all:
+ * @errp: returns an error if this function fails
+ *
+ * This interface is called to check if error occurred during replication
+ */
+void replication_get_error_all(Error **errp);
+
+/**
+ * replication_stop_all:
+ * @failover: boolean value that indicates if we need do failover or not
+ * @errp: returns an error if this function fails
+ *
+ * It is called on failover. The vm should be stopped before calling it, if you
+ * use this API to shutdown the guest, or other things except failover
+ */
+void replication_stop_all(bool failover, Error **errp);
+
+#endif /* REPLICATION_H */
diff --git a/scripts/coccinelle/typecast.cocci b/scripts/coccinelle/typecast.cocci
new file mode 100644
index 0000000000..be2183ee4f
--- /dev/null
+++ b/scripts/coccinelle/typecast.cocci
@@ -0,0 +1,7 @@
+// Remove useless casts
+@@
+type T;
+T v;
+@@
+-	(T *)&v
++	&v
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index ac5e801fb4..dcdd0416bd 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -474,7 +474,6 @@ int cpu_alpha_signal_handler(int host_signum, void *pinfo,
                              void *puc);
 int alpha_cpu_handle_mmu_fault(CPUState *cpu, vaddr address, int rw,
                                int mmu_idx);
-void do_restore_state(CPUAlphaState *, uintptr_t retaddr);
 void QEMU_NORETURN dynamic_excp(CPUAlphaState *, uintptr_t, int, int);
 void QEMU_NORETURN arith_excp(CPUAlphaState *, uintptr_t, int, uint64_t);
 
diff --git a/target-arm/helper.c b/target-arm/helper.c
index bdb842cc45..5484c15d1a 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -7498,7 +7498,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          * is unpredictable. Flag this as a guest error.  */
         if (sign != sext) {
             qemu_log_mask(LOG_GUEST_ERROR,
-                          "AArch32: VTCR.S / VTCR.T0SZ[3] missmatch\n");
+                          "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
         }
     }
     t1sz = extract32(tcr->raw_tcr, 16, 6);
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index b2faa6b605..c2d40cb1cc 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -196,7 +196,6 @@ enum {
 #define MACSR_EV    0x001
 
 void m68k_set_irq_level(M68kCPU *cpu, int level, uint8_t vector);
-void m68k_set_macsr(CPUM68KState *env, uint32_t val);
 void m68k_switch_sp(CPUM68KState *env);
 
 #define M68K_FPCR_PREC (1 << 6)
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index f52d0e3036..89bbe6dfa6 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -812,7 +812,7 @@ uint32_t HELPER(get_mac_extf)(CPUM68KState *env, uint32_t acc)
 {
     uint32_t val;
     val = env->macc[acc] & 0x00ff;
-    val = (env->macc[acc] >> 32) & 0xff00;
+    val |= (env->macc[acc] >> 32) & 0xff00;
     val |= (env->macc[acc + 1] << 16) & 0x00ff0000;
     val |= (env->macc[acc + 1] >> 16) & 0xff000000;
     return val;
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 1e808c8884..9617481196 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -1184,8 +1184,6 @@ void ppc_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                         int flags);
 void ppc_cpu_dump_statistics(CPUState *cpu, FILE *f,
                              fprintf_function cpu_fprintf, int flags);
-int ppc_cpu_get_monitor_def(CPUState *cs, const char *name,
-                            uint64_t *pval);
 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 int ppc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int ppc_cpu_gdb_read_register_apple(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/target-ppc/mmu-hash64.h b/target-ppc/mmu-hash64.h
index db265e30b2..ab5d347a53 100644
--- a/target-ppc/mmu-hash64.h
+++ b/target-ppc/mmu-hash64.h
@@ -4,7 +4,6 @@
 #ifndef CONFIG_USER_ONLY
 
 #ifdef TARGET_PPC64
-void ppc_hash64_check_page_sizes(PowerPCCPU *cpu, Error **errp);
 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu);
 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
                   target_ulong esid, target_ulong vsid);
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index ac75360eab..5645e063af 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -624,8 +624,6 @@ static inline unsigned int s390_cpu_set_state(uint8_t cpu_state, S390CPU *cpu)
     return 0;
 }
 #endif
-void cpu_lock(void);
-void cpu_unlock(void);
 
 extern void subsystem_reset(void);
 
diff --git a/target-sh4/README.sh4 b/target-sh4/README.sh4
index e578830f79..ece046442a 100644
--- a/target-sh4/README.sh4
+++ b/target-sh4/README.sh4
@@ -25,7 +25,7 @@ Goals
 
 The primary model being worked on is the soft MMU target to be able to
 emulate the Shix 2.0 board by Alexis Polti, described at
-http://perso.enst.fr/~polti/realisations/shix20/
+https://web.archive.org/web/20070917001736/http://perso.enst.fr/~polti/realisations/shix20/
 
 Ultimately, qemu will be coupled with a system C or a verilog
 simulator to simulate the whole board functionalities.
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index e4089f2074..800a25aa57 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -117,8 +117,7 @@ static int cpu_sparc_register(SPARCCPU *cpu, const char *cpu_model)
         return -1;
     }
 
-    env->def = g_new0(sparc_def_t, 1);
-    memcpy(env->def, def, sizeof(*def));
+    env->def = g_memdup(def, sizeof(*def));
 
     featurestr = strtok(NULL, ",");
     sparc_cpu_parse_features(CPU(cpu), featurestr, &err);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 42417bdc92..c450c6273b 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -40,8 +40,6 @@
 #define NO_CPU_IO_DEFS
 #include "cpu.h"
 
-#include "qemu/host-utils.h"
-#include "qemu/timer.h"
 #include "exec/cpu-common.h"
 #include "exec/exec-all.h"
 
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 1bcabcad9d..9bf31bbc84 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -723,7 +723,6 @@ static inline bool tcg_op_buf_full(void)
 
 void *tcg_malloc_internal(TCGContext *s, int size);
 void tcg_pool_reset(TCGContext *s);
-void tcg_pool_delete(TCGContext *s);
 
 void tb_lock(void);
 void tb_unlock(void);
@@ -907,7 +906,6 @@ void tcg_optimize(TCGContext *s);
 /* only used for debugging purposes */
 void tcg_dump_ops(TCGContext *s);
 
-void dump_ops(const uint16_t *opc_buf, const TCGArg *opparam_buf);
 TCGv_i32 tcg_const_i32(int32_t val);
 TCGv_i64 tcg_const_i64(int64_t val);
 TCGv_i32 tcg_const_local_i32(int32_t val);
diff --git a/tcg/tci/README b/tcg/tci/README
index 3786b0915b..386c3c7507 100644
--- a/tcg/tci/README
+++ b/tcg/tci/README
@@ -9,7 +9,7 @@ code fragments ("basic blocks") from target code (any of the
 targets supported by QEMU) to a code representation which
 can be run on a host.
 
-QEMU can create native code for some hosts (arm, hppa, i386, ia64, ppc, ppc64,
+QEMU can create native code for some hosts (arm, i386, ia64, ppc, ppc64,
 s390, sparc, x86_64). For others, unofficial host support was written.
 
 By adding a code generator for a virtual machine and using an
diff --git a/tests/.gitignore b/tests/.gitignore
index dbb52639f6..b4a9cfc8c4 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -63,6 +63,7 @@ test-qmp-introspect.[ch]
 test-qmp-marshal.c
 test-qmp-output-visitor
 test-rcu-list
+test-replication
 test-rfifolock
 test-string-input-visitor
 test-string-output-visitor
diff --git a/tests/Makefile.include b/tests/Makefile.include
index bde274d31e..2f11064699 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -112,6 +112,7 @@ check-unit-y += tests/test-crypto-xts$(EXESUF)
 check-unit-y += tests/test-crypto-block$(EXESUF)
 gcov-files-test-logging-y = tests/test-logging.c
 check-unit-y += tests/test-logging$(EXESUF)
+check-unit-$(CONFIG_REPLICATION) += tests/test-replication$(EXESUF)
 check-unit-y += tests/test-bufferiszero$(EXESUF)
 gcov-files-check-bufferiszero-y = util/bufferiszero.c
 
@@ -505,6 +506,9 @@ tests/test-base64$(EXESUF): tests/test-base64.o \
 
 tests/test-logging$(EXESUF): tests/test-logging.o $(test-util-obj-y)
 
+tests/test-replication$(EXESUF): tests/test-replication.o $(test-util-obj-y) \
+	$(test-block-obj-y)
+
 tests/test-qapi-types.c tests/test-qapi-types.h :\
 $(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
diff --git a/tests/libqos/virtio.c b/tests/libqos/virtio.c
index d8c2970de7..37ff860c16 100644
--- a/tests/libqos/virtio.c
+++ b/tests/libqos/virtio.c
@@ -257,16 +257,16 @@ void qvirtqueue_kick(const QVirtioBus *bus, QVirtioDevice *d, QVirtQueue *vq,
                                                             uint32_t free_head)
 {
     /* vq->avail->idx */
-    uint16_t idx = readl(vq->avail + 2);
+    uint16_t idx = readw(vq->avail + 2);
     /* vq->used->flags */
     uint16_t flags;
     /* vq->used->avail_event */
     uint16_t avail_event;
 
     /* vq->avail->ring[idx % vq->size] */
-    writel(vq->avail + 4 + (2 * (idx % vq->size)), free_head);
+    writew(vq->avail + 4 + (2 * (idx % vq->size)), free_head);
     /* vq->avail->idx */
-    writel(vq->avail + 2, idx + 1);
+    writew(vq->avail + 2, idx + 1);
 
     /* Must read after idx is updated */
     flags = readw(vq->avail);
diff --git a/tests/test-replication.c b/tests/test-replication.c
new file mode 100644
index 0000000000..0997bd8b74
--- /dev/null
+++ b/tests/test-replication.c
@@ -0,0 +1,575 @@
+/*
+ * Block replication tests
+ *
+ * Copyright (c) 2016 FUJITSU LIMITED
+ * Author: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qapi/error.h"
+#include "replication.h"
+#include "block/block_int.h"
+#include "sysemu/block-backend.h"
+
+#define IMG_SIZE (64 * 1024 * 1024)
+
+/* primary */
+#define P_ID "primary-id"
+static char p_local_disk[] = "/tmp/p_local_disk.XXXXXX";
+
+/* secondary */
+#define S_ID "secondary-id"
+#define S_LOCAL_DISK_ID "secondary-local-disk-id"
+static char s_local_disk[] = "/tmp/s_local_disk.XXXXXX";
+static char s_active_disk[] = "/tmp/s_active_disk.XXXXXX";
+static char s_hidden_disk[] = "/tmp/s_hidden_disk.XXXXXX";
+
+/* FIXME: steal from blockdev.c */
+QemuOptsList qemu_drive_opts = {
+    .name = "drive",
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_drive_opts.head),
+    .desc = {
+        { /* end of list */ }
+    },
+};
+
+#define NOT_DONE 0x7fffffff
+
+static void blk_rw_done(void *opaque, int ret)
+{
+    *(int *)opaque = ret;
+}
+
+static void test_blk_read(BlockBackend *blk, long pattern,
+                          int64_t pattern_offset, int64_t pattern_count,
+                          int64_t offset, int64_t count,
+                          bool expect_failed)
+{
+    void *pattern_buf = NULL;
+    QEMUIOVector qiov;
+    void *cmp_buf = NULL;
+    int async_ret = NOT_DONE;
+
+    if (pattern) {
+        cmp_buf = g_malloc(pattern_count);
+        memset(cmp_buf, pattern, pattern_count);
+    }
+
+    pattern_buf = g_malloc(count);
+    if (pattern) {
+        memset(pattern_buf, pattern, count);
+    } else {
+        memset(pattern_buf, 0x00, count);
+    }
+
+    qemu_iovec_init(&qiov, 1);
+    qemu_iovec_add(&qiov, pattern_buf, count);
+
+    blk_aio_preadv(blk, offset, &qiov, 0, blk_rw_done, &async_ret);
+    while (async_ret == NOT_DONE) {
+        main_loop_wait(false);
+    }
+
+    if (expect_failed) {
+        g_assert(async_ret != 0);
+    } else {
+        g_assert(async_ret == 0);
+        if (pattern) {
+            g_assert(memcmp(pattern_buf + pattern_offset,
+                            cmp_buf, pattern_count) <= 0);
+        }
+    }
+
+    g_free(pattern_buf);
+}
+
+static void test_blk_write(BlockBackend *blk, long pattern, int64_t offset,
+                           int64_t count, bool expect_failed)
+{
+    void *pattern_buf = NULL;
+    QEMUIOVector qiov;
+    int async_ret = NOT_DONE;
+
+    pattern_buf = g_malloc(count);
+    if (pattern) {
+        memset(pattern_buf, pattern, count);
+    } else {
+        memset(pattern_buf, 0x00, count);
+    }
+
+    qemu_iovec_init(&qiov, 1);
+    qemu_iovec_add(&qiov, pattern_buf, count);
+
+    blk_aio_pwritev(blk, offset, &qiov, 0, blk_rw_done, &async_ret);
+    while (async_ret == NOT_DONE) {
+        main_loop_wait(false);
+    }
+
+    if (expect_failed) {
+        g_assert(async_ret != 0);
+    } else {
+        g_assert(async_ret == 0);
+    }
+
+    g_free(pattern_buf);
+}
+
+/*
+ * Create a uniquely-named empty temporary file.
+ */
+static void make_temp(char *template)
+{
+    int fd;
+
+    fd = mkstemp(template);
+    g_assert(fd >= 0);
+    close(fd);
+}
+
+static void prepare_imgs(void)
+{
+    Error *local_err = NULL;
+
+    make_temp(p_local_disk);
+    make_temp(s_local_disk);
+    make_temp(s_active_disk);
+    make_temp(s_hidden_disk);
+
+    /* Primary */
+    bdrv_img_create(p_local_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
+                    BDRV_O_RDWR, &local_err, true);
+    g_assert(!local_err);
+
+    /* Secondary */
+    bdrv_img_create(s_local_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
+                    BDRV_O_RDWR, &local_err, true);
+    g_assert(!local_err);
+    bdrv_img_create(s_active_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
+                    BDRV_O_RDWR, &local_err, true);
+    g_assert(!local_err);
+    bdrv_img_create(s_hidden_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
+                    BDRV_O_RDWR, &local_err, true);
+    g_assert(!local_err);
+}
+
+static void cleanup_imgs(void)
+{
+    /* Primary */
+    unlink(p_local_disk);
+
+    /* Secondary */
+    unlink(s_local_disk);
+    unlink(s_active_disk);
+    unlink(s_hidden_disk);
+}
+
+static BlockBackend *start_primary(void)
+{
+    BlockBackend *blk;
+    QemuOpts *opts;
+    QDict *qdict;
+    Error *local_err = NULL;
+    char *cmdline;
+
+    cmdline = g_strdup_printf("driver=replication,mode=primary,node-name=xxx,"
+                              "file.driver=qcow2,file.file.filename=%s"
+                              , p_local_disk);
+    opts = qemu_opts_parse_noisily(&qemu_drive_opts, cmdline, false);
+    g_free(cmdline);
+
+    qdict = qemu_opts_to_qdict(opts, NULL);
+    qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
+    qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
+
+    blk = blk_new_open(NULL, NULL, qdict, BDRV_O_RDWR, &local_err);
+    g_assert(blk);
+    g_assert(!local_err);
+
+    monitor_add_blk(blk, P_ID, &local_err);
+    g_assert(!local_err);
+
+    qemu_opts_del(opts);
+
+    return blk;
+}
+
+static void teardown_primary(void)
+{
+    BlockBackend *blk;
+
+    /* remove P_ID */
+    blk = blk_by_name(P_ID);
+    assert(blk);
+
+    monitor_remove_blk(blk);
+    blk_unref(blk);
+}
+
+static void test_primary_read(void)
+{
+    BlockBackend *blk;
+
+    blk = start_primary();
+
+    /* read from 0 to IMG_SIZE */
+    test_blk_read(blk, 0, 0, IMG_SIZE, 0, IMG_SIZE, true);
+
+    teardown_primary();
+}
+
+static void test_primary_write(void)
+{
+    BlockBackend *blk;
+
+    blk = start_primary();
+
+    /* write from 0 to IMG_SIZE */
+    test_blk_write(blk, 0, 0, IMG_SIZE, true);
+
+    teardown_primary();
+}
+
+static void test_primary_start(void)
+{
+    BlockBackend *blk = NULL;
+    Error *local_err = NULL;
+
+    blk = start_primary();
+
+    replication_start_all(REPLICATION_MODE_PRIMARY, &local_err);
+    g_assert(!local_err);
+
+    /* read from 0 to IMG_SIZE */
+    test_blk_read(blk, 0, 0, IMG_SIZE, 0, IMG_SIZE, true);
+
+    /* write 0x22 from 0 to IMG_SIZE */
+    test_blk_write(blk, 0x22, 0, IMG_SIZE, false);
+
+    teardown_primary();
+}
+
+static void test_primary_stop(void)
+{
+    Error *local_err = NULL;
+    bool failover = true;
+
+    start_primary();
+
+    replication_start_all(REPLICATION_MODE_PRIMARY, &local_err);
+    g_assert(!local_err);
+
+    replication_stop_all(failover, &local_err);
+    g_assert(!local_err);
+
+    teardown_primary();
+}
+
+static void test_primary_do_checkpoint(void)
+{
+    Error *local_err = NULL;
+
+    start_primary();
+
+    replication_start_all(REPLICATION_MODE_PRIMARY, &local_err);
+    g_assert(!local_err);
+
+    replication_do_checkpoint_all(&local_err);
+    g_assert(!local_err);
+
+    teardown_primary();
+}
+
+static void test_primary_get_error_all(void)
+{
+    Error *local_err = NULL;
+
+    start_primary();
+
+    replication_start_all(REPLICATION_MODE_PRIMARY, &local_err);
+    g_assert(!local_err);
+
+    replication_get_error_all(&local_err);
+    g_assert(!local_err);
+
+    teardown_primary();
+}
+
+static BlockBackend *start_secondary(void)
+{
+    QemuOpts *opts;
+    QDict *qdict;
+    BlockBackend *blk;
+    char *cmdline;
+    Error *local_err = NULL;
+
+    /* add s_local_disk and forge S_LOCAL_DISK_ID */
+    cmdline = g_strdup_printf("file.filename=%s,driver=qcow2", s_local_disk);
+    opts = qemu_opts_parse_noisily(&qemu_drive_opts, cmdline, false);
+    g_free(cmdline);
+
+    qdict = qemu_opts_to_qdict(opts, NULL);
+    qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
+    qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
+
+    blk = blk_new_open(NULL, NULL, qdict, BDRV_O_RDWR, &local_err);
+    assert(blk);
+    monitor_add_blk(blk, S_LOCAL_DISK_ID, &local_err);
+    g_assert(!local_err);
+
+    /* format s_local_disk with pattern "0x11" */
+    test_blk_write(blk, 0x11, 0, IMG_SIZE, false);
+
+    qemu_opts_del(opts);
+
+    /* add S_(ACTIVE/HIDDEN)_DISK and forge S_ID */
+    cmdline = g_strdup_printf("driver=replication,mode=secondary,top-id=%s,"
+                              "file.driver=qcow2,file.file.filename=%s,"
+                              "file.backing.driver=qcow2,"
+                              "file.backing.file.filename=%s,"
+                              "file.backing.backing=%s"
+                              , S_ID, s_active_disk, s_hidden_disk
+                              , S_LOCAL_DISK_ID);
+    opts = qemu_opts_parse_noisily(&qemu_drive_opts, cmdline, false);
+    g_free(cmdline);
+
+    qdict = qemu_opts_to_qdict(opts, NULL);
+    qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
+    qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
+
+    blk = blk_new_open(NULL, NULL, qdict, BDRV_O_RDWR, &local_err);
+    assert(blk);
+    monitor_add_blk(blk, S_ID, &local_err);
+    g_assert(!local_err);
+
+    qemu_opts_del(opts);
+
+    return blk;
+}
+
+static void teardown_secondary(void)
+{
+    /* only need to destroy two BBs */
+    BlockBackend *blk;
+
+    /* remove S_LOCAL_DISK_ID */
+    blk = blk_by_name(S_LOCAL_DISK_ID);
+    assert(blk);
+
+    monitor_remove_blk(blk);
+    blk_unref(blk);
+
+    /* remove S_ID */
+    blk = blk_by_name(S_ID);
+    assert(blk);
+
+    monitor_remove_blk(blk);
+    blk_unref(blk);
+}
+
+static void test_secondary_read(void)
+{
+    BlockBackend *blk;
+
+    blk = start_secondary();
+
+    /* read from 0 to IMG_SIZE */
+    test_blk_read(blk, 0, 0, IMG_SIZE, 0, IMG_SIZE, true);
+
+    teardown_secondary();
+}
+
+static void test_secondary_write(void)
+{
+    BlockBackend *blk;
+
+    blk = start_secondary();
+
+    /* write from 0 to IMG_SIZE */
+    test_blk_write(blk, 0, 0, IMG_SIZE, true);
+
+    teardown_secondary();
+}
+
+static void test_secondary_start(void)
+{
+    BlockBackend *top_blk, *local_blk;
+    Error *local_err = NULL;
+    bool failover = true;
+
+    top_blk = start_secondary();
+    replication_start_all(REPLICATION_MODE_SECONDARY, &local_err);
+    g_assert(!local_err);
+
+    /* read from s_local_disk (0, IMG_SIZE) */
+    test_blk_read(top_blk, 0x11, 0, IMG_SIZE, 0, IMG_SIZE, false);
+
+    /* write 0x22 to s_local_disk (IMG_SIZE / 2, IMG_SIZE) */
+    local_blk = blk_by_name(S_LOCAL_DISK_ID);
+    test_blk_write(local_blk, 0x22, IMG_SIZE / 2, IMG_SIZE / 2, false);
+
+    /* replication will backup s_local_disk to s_hidden_disk */
+    test_blk_read(top_blk, 0x11, IMG_SIZE / 2,
+                  IMG_SIZE / 2, 0, IMG_SIZE, false);
+
+    /* write 0x33 to s_active_disk (0, IMG_SIZE / 2) */
+    test_blk_write(top_blk, 0x33, 0, IMG_SIZE / 2, false);
+
+    /* read from s_active_disk (0, IMG_SIZE/2) */
+    test_blk_read(top_blk, 0x33, 0, IMG_SIZE / 2,
+                  0, IMG_SIZE / 2, false);
+
+    /* unblock top_bs */
+    replication_stop_all(failover, &local_err);
+    g_assert(!local_err);
+
+    teardown_secondary();
+}
+
+
+static void test_secondary_stop(void)
+{
+    BlockBackend *top_blk, *local_blk;
+    Error *local_err = NULL;
+    bool failover = true;
+
+    top_blk = start_secondary();
+    replication_start_all(REPLICATION_MODE_SECONDARY, &local_err);
+    g_assert(!local_err);
+
+    /* write 0x22 to s_local_disk (IMG_SIZE / 2, IMG_SIZE) */
+    local_blk = blk_by_name(S_LOCAL_DISK_ID);
+    test_blk_write(local_blk, 0x22, IMG_SIZE / 2, IMG_SIZE / 2, false);
+
+    /* replication will backup s_local_disk to s_hidden_disk */
+    test_blk_read(top_blk, 0x11, IMG_SIZE / 2,
+                  IMG_SIZE / 2, 0, IMG_SIZE, false);
+
+    /* write 0x33 to s_active_disk (0, IMG_SIZE / 2) */
+    test_blk_write(top_blk, 0x33, 0, IMG_SIZE / 2, false);
+
+    /* do active commit */
+    replication_stop_all(failover, &local_err);
+    g_assert(!local_err);
+
+    /* read from s_local_disk (0, IMG_SIZE / 2) */
+    test_blk_read(top_blk, 0x33, 0, IMG_SIZE / 2,
+                  0, IMG_SIZE / 2, false);
+
+
+    /* read from s_local_disk (IMG_SIZE / 2, IMG_SIZE) */
+    test_blk_read(top_blk, 0x22, IMG_SIZE / 2,
+                  IMG_SIZE / 2, 0, IMG_SIZE, false);
+
+    teardown_secondary();
+}
+
+static void test_secondary_do_checkpoint(void)
+{
+    BlockBackend *top_blk, *local_blk;
+    Error *local_err = NULL;
+    bool failover = true;
+
+    top_blk = start_secondary();
+    replication_start_all(REPLICATION_MODE_SECONDARY, &local_err);
+    g_assert(!local_err);
+
+    /* write 0x22 to s_local_disk (IMG_SIZE / 2, IMG_SIZE) */
+    local_blk = blk_by_name(S_LOCAL_DISK_ID);
+    test_blk_write(local_blk, 0x22, IMG_SIZE / 2,
+                   IMG_SIZE / 2, false);
+
+    /* replication will backup s_local_disk to s_hidden_disk */
+    test_blk_read(top_blk, 0x11, IMG_SIZE / 2,
+                  IMG_SIZE / 2, 0, IMG_SIZE, false);
+
+    replication_do_checkpoint_all(&local_err);
+    g_assert(!local_err);
+
+    /* after checkpoint, read pattern 0x22 from s_local_disk */
+    test_blk_read(top_blk, 0x22, IMG_SIZE / 2,
+                  IMG_SIZE / 2, 0, IMG_SIZE, false);
+
+    /* unblock top_bs */
+    replication_stop_all(failover, &local_err);
+    g_assert(!local_err);
+
+    teardown_secondary();
+}
+
+static void test_secondary_get_error_all(void)
+{
+    Error *local_err = NULL;
+    bool failover = true;
+
+    start_secondary();
+    replication_start_all(REPLICATION_MODE_SECONDARY, &local_err);
+    g_assert(!local_err);
+
+    replication_get_error_all(&local_err);
+    g_assert(!local_err);
+
+    /* unblock top_bs */
+    replication_stop_all(failover, &local_err);
+    g_assert(!local_err);
+
+    teardown_secondary();
+}
+
+static void sigabrt_handler(int signo)
+{
+    cleanup_imgs();
+}
+
+static void setup_sigabrt_handler(void)
+{
+    struct sigaction sigact;
+
+    sigact = (struct sigaction) {
+        .sa_handler = sigabrt_handler,
+        .sa_flags = SA_RESETHAND,
+    };
+    sigemptyset(&sigact.sa_mask);
+    sigaction(SIGABRT, &sigact, NULL);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+    qemu_init_main_loop(&error_fatal);
+    bdrv_init();
+
+    g_test_init(&argc, &argv, NULL);
+    setup_sigabrt_handler();
+
+    prepare_imgs();
+
+    /* Primary */
+    g_test_add_func("/replication/primary/read",    test_primary_read);
+    g_test_add_func("/replication/primary/write",   test_primary_write);
+    g_test_add_func("/replication/primary/start",   test_primary_start);
+    g_test_add_func("/replication/primary/stop",    test_primary_stop);
+    g_test_add_func("/replication/primary/do_checkpoint",
+                    test_primary_do_checkpoint);
+    g_test_add_func("/replication/primary/get_error_all",
+                    test_primary_get_error_all);
+
+    /* Secondary */
+    g_test_add_func("/replication/secondary/read",  test_secondary_read);
+    g_test_add_func("/replication/secondary/write", test_secondary_write);
+    g_test_add_func("/replication/secondary/start", test_secondary_start);
+    g_test_add_func("/replication/secondary/stop",  test_secondary_stop);
+    g_test_add_func("/replication/secondary/do_checkpoint",
+                    test_secondary_do_checkpoint);
+    g_test_add_func("/replication/secondary/get_error_all",
+                    test_secondary_get_error_all);
+
+    ret = g_test_run();
+
+    cleanup_imgs();
+
+    return ret;
+}
diff --git a/ui/cocoa.m b/ui/cocoa.m
index 36c6bf0cb0..52d9c54b6d 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -33,6 +33,7 @@
 #include "sysemu/sysemu.h"
 #include "qmp-commands.h"
 #include "sysemu/blockdev.h"
+#include "qemu-version.h"
 #include <Carbon/Carbon.h>
 
 #ifndef MAC_OS_X_VERSION_10_5
@@ -63,7 +64,7 @@ typedef struct {
     int bitsPerPixel;
 } QEMUScreen;
 
-NSWindow *normalWindow;
+NSWindow *normalWindow, *about_window;
 static DisplayChangeListener *dcl;
 static int last_buttons;
 
@@ -670,7 +671,9 @@ QemuCocoaView *cocoaView;
         case NSLeftMouseUp:
             mouse_event = true;
             if (!isMouseGrabbed && [self screenContainsPoint:p]) {
-                [self grabMouse];
+                if([[self window] isKeyWindow]) {
+                    [self grabMouse];
+                }
             }
             break;
         case NSRightMouseUp:
@@ -824,6 +827,8 @@ QemuCocoaView *cocoaView;
 - (void)changeDeviceMedia:(id)sender;
 - (BOOL)verifyQuit;
 - (void)openDocumentation:(NSString *)filename;
+- (IBAction) do_about_menu_item: (id) sender;
+- (void)make_about_window;
 @end
 
 @implementation QemuCocoaAppController
@@ -876,6 +881,7 @@ QemuCocoaView *cocoaView;
         supportedImageFileTypes = [NSArray arrayWithObjects: @"img", @"iso", @"dmg",
                                  @"qcow", @"qcow2", @"cloop", @"vmdk", @"cdr",
                                   nil];
+        [self make_about_window];
     }
     return self;
 }
@@ -1138,6 +1144,101 @@ QemuCocoaView *cocoaView;
     }
 }
 
+/* The action method for the About menu item */
+- (IBAction) do_about_menu_item: (id) sender
+{
+    [about_window makeKeyAndOrderFront: nil];
+}
+
+/* Create and display the about dialog */
+- (void)make_about_window
+{
+    /* Make the window */
+    int x = 0, y = 0, about_width = 400, about_height = 200;
+    NSRect window_rect = NSMakeRect(x, y, about_width, about_height);
+    about_window = [[NSWindow alloc] initWithContentRect:window_rect
+                    styleMask:NSTitledWindowMask | NSClosableWindowMask |
+                    NSMiniaturizableWindowMask
+                    backing:NSBackingStoreBuffered
+                    defer:NO];
+    [about_window setTitle: @"About"];
+    [about_window setReleasedWhenClosed: NO];
+    [about_window center];
+    NSView *superView = [about_window contentView];
+
+    /* Create the dimensions of the picture */
+    int picture_width = 80, picture_height = 80;
+    x = (about_width - picture_width)/2;
+    y = about_height - picture_height - 10;
+    NSRect picture_rect = NSMakeRect(x, y, picture_width, picture_height);
+
+    /* Get the path to the QEMU binary */
+    NSString *binary_name = [NSString stringWithCString: gArgv[0]
+                                      encoding: NSASCIIStringEncoding];
+    binary_name = [binary_name lastPathComponent];
+    NSString *program_path = [[NSString alloc] initWithFormat: @"%@/%@",
+    [[NSBundle mainBundle] bundlePath], binary_name];
+
+    /* Make the picture of QEMU */
+    NSImageView *picture_view = [[NSImageView alloc] initWithFrame:
+                                                     picture_rect];
+    NSImage *qemu_image = [[NSWorkspace sharedWorkspace] iconForFile:
+                                                         program_path];
+    [picture_view setImage: qemu_image];
+    [picture_view setImageScaling: NSImageScaleProportionallyUpOrDown];
+    [superView addSubview: picture_view];
+
+    /* Make the name label */
+    x = 0;
+    y = y - 25;
+    int name_width = about_width, name_height = 20;
+    NSRect name_rect = NSMakeRect(x, y, name_width, name_height);
+    NSTextField *name_label = [[NSTextField alloc] initWithFrame: name_rect];
+    [name_label setEditable: NO];
+    [name_label setBezeled: NO];
+    [name_label setDrawsBackground: NO];
+    [name_label setAlignment: NSCenterTextAlignment];
+    NSString *qemu_name = [[NSString alloc] initWithCString: gArgv[0]
+                                            encoding: NSASCIIStringEncoding];
+    qemu_name = [qemu_name lastPathComponent];
+    [name_label setStringValue: qemu_name];
+    [superView addSubview: name_label];
+
+    /* Set the version label's attributes */
+    x = 0;
+    y = 50;
+    int version_width = about_width, version_height = 20;
+    NSRect version_rect = NSMakeRect(x, y, version_width, version_height);
+    NSTextField *version_label = [[NSTextField alloc] initWithFrame:
+                                                      version_rect];
+    [version_label setEditable: NO];
+    [version_label setBezeled: NO];
+    [version_label setAlignment: NSCenterTextAlignment];
+    [version_label setDrawsBackground: NO];
+
+    /* Create the version string*/
+    NSString *version_string;
+    version_string = [[NSString alloc] initWithFormat:
+    @"QEMU emulator version %s%s", QEMU_VERSION, QEMU_PKGVERSION];
+    [version_label setStringValue: version_string];
+    [superView addSubview: version_label];
+
+    /* Make copyright label */
+    x = 0;
+    y = 35;
+    int copyright_width = about_width, copyright_height = 20;
+    NSRect copyright_rect = NSMakeRect(x, y, copyright_width, copyright_height);
+    NSTextField *copyright_label = [[NSTextField alloc] initWithFrame:
+                                                        copyright_rect];
+    [copyright_label setEditable: NO];
+    [copyright_label setBezeled: NO];
+    [copyright_label setDrawsBackground: NO];
+    [copyright_label setAlignment: NSCenterTextAlignment];
+    [copyright_label setStringValue: [NSString stringWithFormat: @"%s",
+                                     QEMU_COPYRIGHT]];
+    [superView addSubview: copyright_label];
+}
+
 @end
 
 
@@ -1185,7 +1286,7 @@ int main (int argc, const char * argv[]) {
 
     // Application menu
     menu = [[NSMenu alloc] initWithTitle:@""];
-    [menu addItemWithTitle:@"About QEMU" action:@selector(orderFrontStandardAboutPanel:) keyEquivalent:@""]; // About QEMU
+    [menu addItemWithTitle:@"About QEMU" action:@selector(do_about_menu_item:) keyEquivalent:@""]; // About QEMU
     [menu addItem:[NSMenuItem separatorItem]]; //Separator
     [menu addItemWithTitle:@"Hide QEMU" action:@selector(hide:) keyEquivalent:@"h"]; //Hide QEMU
     menuItem = (NSMenuItem *)[menu addItemWithTitle:@"Hide Others" action:@selector(hideOtherApplications:) keyEquivalent:@"h"]; // Hide Others
diff --git a/ui/console.c b/ui/console.c
index c24bfe422d..3940762851 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1142,6 +1142,7 @@ static const int qcode_to_keysym[Q_KEY_CODE__MAX] = {
     [Q_KEY_CODE_PGUP]   = QEMU_KEY_PAGEUP,
     [Q_KEY_CODE_PGDN]   = QEMU_KEY_PAGEDOWN,
     [Q_KEY_CODE_DELETE] = QEMU_KEY_DELETE,
+    [Q_KEY_CODE_BACKSPACE] = QEMU_KEY_BACKSPACE,
 };
 
 bool kbd_put_qcode_console(QemuConsole *s, int qcode)
diff --git a/vl.c b/vl.c
index ee557a1d3f..ad2664bbc4 100644
--- a/vl.c
+++ b/vl.c
@@ -121,6 +121,7 @@ int main(int argc, char **argv)
 #include "crypto/init.h"
 #include "sysemu/replay.h"
 #include "qapi/qmp/qerror.h"
+#include "sysemu/iothread.h"
 
 #define MAX_VIRTIO_CONSOLES 1
 #define MAX_SCLP_CONSOLES 1
@@ -4616,13 +4617,11 @@ int main(int argc, char **argv, char **envp)
     trace_init_vcpu_events();
     main_loop();
     replay_disable_events();
+    iothread_stop_all();
 
     bdrv_close_all();
     pause_all_vcpus();
     res_free();
-#ifdef CONFIG_TPM
-    tpm_cleanup();
-#endif
 
     /* vhost-user must be cleaned up before chardevs.  */
     net_cleanup();