summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--.mailmap5
-rw-r--r--MAINTAINERS43
-rw-r--r--Makefile13
-rw-r--r--Makefile.objs1
-rw-r--r--block/backup.c5
-rw-r--r--block/nbd.c331
-rw-r--r--block/qcow2-refcount.c2
-rw-r--r--block/qcow2.c3
-rw-r--r--blockdev.c7
-rw-r--r--default-configs/xtensa-softmmu.mak1
-rw-r--r--docs/devel/qapi-code-gen.txt10
-rw-r--r--hw/Kconfig1
-rw-r--r--hw/Makefile.objs1
-rw-r--r--hw/alpha/dp264.c2
-rw-r--r--hw/arm/aspeed.c23
-rw-r--r--hw/arm/bcm2835_peripherals.c30
-rw-r--r--hw/arm/bcm2836.c44
-rw-r--r--hw/arm/collie.c8
-rw-r--r--hw/arm/digic_boards.c9
-rw-r--r--hw/arm/exynos4210.c2
-rw-r--r--hw/arm/highbank.c3
-rw-r--r--hw/arm/mps2-tz.c3
-rw-r--r--hw/arm/mps2.c3
-rw-r--r--hw/arm/musca.c2
-rw-r--r--hw/arm/nseries.c10
-rw-r--r--hw/arm/omap1.c12
-rw-r--r--hw/arm/omap2.c13
-rw-r--r--hw/arm/omap_sx1.c8
-rw-r--r--hw/arm/palm.c8
-rw-r--r--hw/arm/raspi.c14
-rw-r--r--hw/arm/strongarm.c7
-rw-r--r--hw/arm/strongarm.h4
-rw-r--r--hw/arm/xilinx_zynq.c3
-rw-r--r--hw/block/virtio-blk.c1
-rw-r--r--hw/dma/xilinx_axidma.c9
-rw-r--r--hw/gpio/aspeed_gpio.c8
-rw-r--r--hw/hppa/machine.c7
-rw-r--r--hw/i386/acpi-build.c2
-rw-r--r--hw/i386/microvm.c2
-rw-r--r--hw/i386/pc.c2
-rw-r--r--hw/i386/pc_q35.c2
-rw-r--r--hw/intc/armv7m_nvic.c22
-rw-r--r--hw/intc/pnv_xive.c20
-rw-r--r--hw/intc/spapr_xive.c324
-rw-r--r--hw/intc/spapr_xive_kvm.c22
-rw-r--r--hw/intc/xics.c18
-rw-r--r--hw/intc/xics_kvm.c9
-rw-r--r--hw/intc/xics_spapr.c117
-rw-r--r--hw/intc/xive.c31
-rw-r--r--hw/m68k/mcf5206.c15
-rw-r--r--hw/m68k/mcf5208.c9
-rw-r--r--hw/mips/mips_fulong2e.c2
-rw-r--r--hw/mips/mips_jazz.c2
-rw-r--r--hw/mips/mips_malta.c2
-rw-r--r--hw/mips/mips_r4k.c2
-rw-r--r--hw/misc/Makefile.objs1
-rw-r--r--hw/misc/bcm2835_thermal.c135
-rw-r--r--hw/net/fsl_etsec/etsec.c9
-rw-r--r--hw/net/fsl_etsec/etsec.h1
-rw-r--r--hw/pci/pci_bridge.c2
-rw-r--r--hw/ppc/pnv.c20
-rw-r--r--hw/ppc/pnv_core.c31
-rw-r--r--hw/ppc/pnv_psi.c15
-rw-r--r--hw/ppc/ppc405_boards.c2
-rw-r--r--hw/ppc/prep.c4
-rw-r--r--hw/ppc/rs6000_mc.c15
-rw-r--r--hw/ppc/spapr.c26
-rw-r--r--hw/ppc/spapr_cpu_core.c47
-rw-r--r--hw/ppc/spapr_irq.c611
-rw-r--r--hw/ppc/spapr_pci.c7
-rw-r--r--hw/rtc/Kconfig23
-rw-r--r--hw/rtc/Makefile.objs13
-rw-r--r--hw/rtc/aspeed_rtc.c (renamed from hw/timer/aspeed_rtc.c)2
-rw-r--r--hw/rtc/ds1338.c (renamed from hw/timer/ds1338.c)0
-rw-r--r--hw/rtc/exynos4210_rtc.c (renamed from hw/timer/exynos4210_rtc.c)0
-rw-r--r--hw/rtc/m41t80.c (renamed from hw/timer/m41t80.c)0
-rw-r--r--hw/rtc/m48t59-internal.h (renamed from hw/timer/m48t59-internal.h)0
-rw-r--r--hw/rtc/m48t59-isa.c (renamed from hw/timer/m48t59-isa.c)4
-rw-r--r--hw/rtc/m48t59.c (renamed from hw/timer/m48t59.c)2
-rw-r--r--hw/rtc/mc146818rtc.c (renamed from hw/timer/mc146818rtc.c)5
-rw-r--r--hw/rtc/pl031.c (renamed from hw/timer/pl031.c)2
-rw-r--r--hw/rtc/sun4v-rtc.c (renamed from hw/timer/sun4v-rtc.c)2
-rw-r--r--hw/rtc/trace-events19
-rw-r--r--hw/rtc/twl92230.c (renamed from hw/timer/twl92230.c)0
-rw-r--r--hw/rtc/xlnx-zynqmp-rtc.c (renamed from hw/timer/xlnx-zynqmp-rtc.c)3
-rw-r--r--hw/sd/sdhci.c68
-rw-r--r--hw/sparc/sun4m.c2
-rw-r--r--hw/sparc64/niagara.c27
-rw-r--r--hw/sparc64/sun4u.c2
-rw-r--r--hw/timer/Kconfig24
-rw-r--r--hw/timer/Makefile.objs36
-rw-r--r--hw/timer/altera_timer.c13
-rw-r--r--hw/timer/arm_mptimer.c4
-rw-r--r--hw/timer/bcm2835_systmr.c163
-rw-r--r--hw/timer/etraxfs_timer.c23
-rw-r--r--hw/timer/exynos4210_mct.c2
-rw-r--r--hw/timer/grlib_gptimer.c28
-rw-r--r--hw/timer/hpet.c3
-rw-r--r--hw/timer/lm32_timer.c13
-rw-r--r--hw/timer/milkymist-sysctl.c25
-rw-r--r--hw/timer/puv3_ost.c9
-rw-r--r--hw/timer/sh_timer.c13
-rw-r--r--hw/timer/slavio_timer.c32
-rw-r--r--hw/timer/trace-events21
-rw-r--r--hw/timer/xilinx_timer.c13
-rw-r--r--hw/xtensa/Kconfig6
-rw-r--r--hw/xtensa/Makefile.objs1
-rw-r--r--hw/xtensa/sim.c41
-rw-r--r--hw/xtensa/virt.c135
-rw-r--r--hw/xtensa/xtensa_sim.h34
-rw-r--r--include/hw/arm/aspeed.h1
-rw-r--r--include/hw/arm/aspeed_soc.h2
-rw-r--r--include/hw/arm/bcm2835_peripherals.h5
-rw-r--r--include/hw/arm/bcm2836.h4
-rw-r--r--include/hw/arm/omap.h10
-rw-r--r--include/hw/arm/raspi_platform.h1
-rw-r--r--include/hw/arm/xlnx-zynqmp.h2
-rw-r--r--include/hw/misc/bcm2835_thermal.h27
-rw-r--r--include/hw/pci-host/spapr.h4
-rw-r--r--include/hw/ppc/pnv.h1
-rw-r--r--include/hw/ppc/pnv_core.h3
-rw-r--r--include/hw/ppc/spapr.h7
-rw-r--r--include/hw/ppc/spapr_irq.h64
-rw-r--r--include/hw/ppc/spapr_xive.h10
-rw-r--r--include/hw/ppc/xics.h1
-rw-r--r--include/hw/ppc/xics_spapr.h6
-rw-r--r--include/hw/ppc/xive.h1
-rw-r--r--include/hw/ppc/xive_regs.h26
-rw-r--r--include/hw/rtc/aspeed_rtc.h (renamed from include/hw/timer/aspeed_rtc.h)9
-rw-r--r--include/hw/rtc/m48t59.h57
-rw-r--r--include/hw/rtc/mc146818rtc.h (renamed from include/hw/timer/mc146818rtc.h)12
-rw-r--r--include/hw/rtc/mc146818rtc_regs.h (renamed from include/hw/timer/mc146818rtc_regs.h)5
-rw-r--r--include/hw/rtc/pl031.h (renamed from include/hw/timer/pl031.h)5
-rw-r--r--include/hw/rtc/sun4v-rtc.h19
-rw-r--r--include/hw/rtc/xlnx-zynqmp-rtc.h (renamed from include/hw/timer/xlnx-zynqmp-rtc.h)6
-rw-r--r--include/hw/sd/sdhci.h2
-rw-r--r--include/hw/timer/bcm2835_systmr.h33
-rw-r--r--include/hw/timer/m48t59.h32
-rw-r--r--include/hw/timer/sun4v-rtc.h1
-rw-r--r--include/qemu/coroutine.h38
-rw-r--r--linux-user/aarch64/cpu_loop.c1
-rw-r--r--linux-user/arm/cpu_loop.c1
-rw-r--r--linux-user/fd-trans.c51
-rw-r--r--linux-user/strace.c120
-rw-r--r--linux-user/strace.list7
-rw-r--r--linux-user/syscall.c7
-rw-r--r--linux-user/syscall_defs.h41
-rw-r--r--pc-bios/README2
-rw-r--r--pc-bios/slof.binbin930640 -> 928552 bytes
-rw-r--r--qapi/block-core.json18
-rw-r--r--qapi/introspect.json6
-rw-r--r--qapi/misc.json9
-rw-r--r--qemu-doc.texi4
-rw-r--r--qemu-options.hx26
m---------roms/SLOF0
-rwxr-xr-xscripts/qapi-gen.py10
-rw-r--r--scripts/qapi/commands.py4
-rw-r--r--scripts/qapi/common.py2377
-rw-r--r--[-rwxr-xr-x]scripts/qapi/doc.py14
-rw-r--r--scripts/qapi/error.py43
-rw-r--r--scripts/qapi/events.py3
-rw-r--r--scripts/qapi/expr.py383
-rw-r--r--scripts/qapi/gen.py291
-rw-r--r--scripts/qapi/introspect.py12
-rw-r--r--scripts/qapi/parser.py570
-rw-r--r--scripts/qapi/schema.py1057
-rw-r--r--scripts/qapi/source.py67
-rw-r--r--scripts/qapi/types.py61
-rw-r--r--scripts/qapi/visit.py2
-rw-r--r--target/arm/cpu.c1
-rw-r--r--target/arm/cpu.h84
-rw-r--r--target/arm/helper-a64.c3
-rw-r--r--target/arm/helper.c387
-rw-r--r--target/arm/helper.h4
-rw-r--r--target/arm/internals.h9
-rw-r--r--target/arm/m_helper.c6
-rw-r--r--target/arm/machine.c1
-rw-r--r--target/arm/op_helper.c4
-rw-r--r--target/arm/translate-a64.c13
-rw-r--r--target/arm/translate.c37
-rw-r--r--target/i386/cpu.c47
-rw-r--r--target/mips/helper.c123
-rw-r--r--target/mips/helper.h155
-rw-r--r--target/mips/msa_helper.c3055
-rw-r--r--target/mips/op_helper.c1010
-rw-r--r--target/mips/translate.c760
-rw-r--r--target/ppc/translate/vmx-impl.inc.c84
-rw-r--r--target/s390x/cpu_models.c1
-rw-r--r--target/s390x/kvm.c10
-rw-r--r--target/s390x/mmu_helper.c4
-rw-r--r--target/s390x/translate_vx.inc.c30
-rw-r--r--target/s390x/vec_int_helper.c18
-rw-r--r--target/xtensa/core-test_mmuhifi_c3.c3
-rw-r--r--target/xtensa/core-test_mmuhifi_c3/core-isa.h116
-rw-r--r--target/xtensa/core-test_mmuhifi_c3/gdb-config.inc.c114
-rw-r--r--target/xtensa/core-test_mmuhifi_c3/xtensa-modules.inc.c5922
-rw-r--r--tests/Makefile.include30
-rw-r--r--tests/acceptance/linux_ssh_mips_malta.py106
-rw-r--r--tests/migration/stress.c2
-rw-r--r--tests/qapi-schema/allow-preconfig-test.err4
-rw-r--r--tests/qapi-schema/allow-preconfig-test.exit1
-rw-r--r--tests/qapi-schema/alternate-any.err4
-rw-r--r--tests/qapi-schema/alternate-any.exit1
-rw-r--r--tests/qapi-schema/alternate-array.err4
-rw-r--r--tests/qapi-schema/alternate-array.exit1
-rw-r--r--tests/qapi-schema/alternate-base.err4
-rw-r--r--tests/qapi-schema/alternate-base.exit1
-rw-r--r--tests/qapi-schema/alternate-branch-if-invalid.err4
-rw-r--r--tests/qapi-schema/alternate-branch-if-invalid.exit1
-rw-r--r--tests/qapi-schema/alternate-clash.err4
-rw-r--r--tests/qapi-schema/alternate-clash.exit1
-rw-r--r--tests/qapi-schema/alternate-conflict-bool-string.err4
-rw-r--r--tests/qapi-schema/alternate-conflict-bool-string.exit1
-rw-r--r--tests/qapi-schema/alternate-conflict-dict.err4
-rw-r--r--tests/qapi-schema/alternate-conflict-dict.exit1
-rw-r--r--tests/qapi-schema/alternate-conflict-enum-bool.err4
-rw-r--r--tests/qapi-schema/alternate-conflict-enum-bool.exit1
-rw-r--r--tests/qapi-schema/alternate-conflict-enum-int.err4
-rw-r--r--tests/qapi-schema/alternate-conflict-enum-int.exit1
-rw-r--r--tests/qapi-schema/alternate-conflict-num-string.err4
-rw-r--r--tests/qapi-schema/alternate-conflict-num-string.exit1
-rw-r--r--tests/qapi-schema/alternate-conflict-string.err4
-rw-r--r--tests/qapi-schema/alternate-conflict-string.exit1
-rw-r--r--tests/qapi-schema/alternate-empty.err4
-rw-r--r--tests/qapi-schema/alternate-empty.exit1
-rw-r--r--tests/qapi-schema/alternate-invalid-dict.err4
-rw-r--r--tests/qapi-schema/alternate-invalid-dict.exit1
-rw-r--r--tests/qapi-schema/alternate-nested.err4
-rw-r--r--tests/qapi-schema/alternate-nested.exit1
-rw-r--r--tests/qapi-schema/alternate-unknown.err4
-rw-r--r--tests/qapi-schema/alternate-unknown.exit1
-rw-r--r--tests/qapi-schema/args-alternate.err4
-rw-r--r--tests/qapi-schema/args-alternate.exit1
-rw-r--r--tests/qapi-schema/args-any.err4
-rw-r--r--tests/qapi-schema/args-any.exit1
-rw-r--r--tests/qapi-schema/args-array-empty.err4
-rw-r--r--tests/qapi-schema/args-array-empty.exit1
-rw-r--r--tests/qapi-schema/args-array-unknown.err4
-rw-r--r--tests/qapi-schema/args-array-unknown.exit1
-rw-r--r--tests/qapi-schema/args-bad-boxed.err4
-rw-r--r--tests/qapi-schema/args-bad-boxed.exit1
-rw-r--r--tests/qapi-schema/args-boxed-anon.err4
-rw-r--r--tests/qapi-schema/args-boxed-anon.exit1
-rw-r--r--tests/qapi-schema/args-boxed-string.err4
-rw-r--r--tests/qapi-schema/args-boxed-string.exit1
-rw-r--r--tests/qapi-schema/args-int.err4
-rw-r--r--tests/qapi-schema/args-int.exit1
-rw-r--r--tests/qapi-schema/args-invalid.err4
-rw-r--r--tests/qapi-schema/args-invalid.exit1
-rw-r--r--tests/qapi-schema/args-member-array-bad.err4
-rw-r--r--tests/qapi-schema/args-member-array-bad.exit1
-rw-r--r--tests/qapi-schema/args-member-case.err4
-rw-r--r--tests/qapi-schema/args-member-case.exit1
-rw-r--r--tests/qapi-schema/args-member-unknown.err4
-rw-r--r--tests/qapi-schema/args-member-unknown.exit1
-rw-r--r--tests/qapi-schema/args-name-clash.err4
-rw-r--r--tests/qapi-schema/args-name-clash.exit1
-rw-r--r--tests/qapi-schema/args-union.err4
-rw-r--r--tests/qapi-schema/args-union.exit1
-rw-r--r--tests/qapi-schema/args-unknown.err4
-rw-r--r--tests/qapi-schema/args-unknown.exit1
-rw-r--r--tests/qapi-schema/bad-base.err4
-rw-r--r--tests/qapi-schema/bad-base.exit1
-rw-r--r--tests/qapi-schema/bad-data.err4
-rw-r--r--tests/qapi-schema/bad-data.exit1
-rw-r--r--tests/qapi-schema/bad-ident.err4
-rw-r--r--tests/qapi-schema/bad-ident.exit1
-rw-r--r--tests/qapi-schema/bad-if-empty-list.err4
-rw-r--r--tests/qapi-schema/bad-if-empty-list.exit1
-rw-r--r--tests/qapi-schema/bad-if-empty.err4
-rw-r--r--tests/qapi-schema/bad-if-empty.exit1
-rw-r--r--tests/qapi-schema/bad-if-list.err4
-rw-r--r--tests/qapi-schema/bad-if-list.exit1
-rw-r--r--tests/qapi-schema/bad-if.err4
-rw-r--r--tests/qapi-schema/bad-if.exit1
-rw-r--r--tests/qapi-schema/bad-type-bool.err2
-rw-r--r--tests/qapi-schema/bad-type-bool.exit1
-rw-r--r--tests/qapi-schema/bad-type-dict.err2
-rw-r--r--tests/qapi-schema/bad-type-dict.exit1
-rw-r--r--tests/qapi-schema/bad-type-int.err2
-rw-r--r--tests/qapi-schema/bad-type-int.exit1
-rw-r--r--tests/qapi-schema/base-cycle-direct.err4
-rw-r--r--tests/qapi-schema/base-cycle-direct.exit1
-rw-r--r--tests/qapi-schema/base-cycle-indirect.err4
-rw-r--r--tests/qapi-schema/base-cycle-indirect.exit1
-rw-r--r--tests/qapi-schema/command-int.err4
-rw-r--r--tests/qapi-schema/command-int.exit1
-rw-r--r--tests/qapi-schema/comments.exit1
-rw-r--r--tests/qapi-schema/doc-bad-alternate-member.err2
-rw-r--r--tests/qapi-schema/doc-bad-alternate-member.exit1
-rw-r--r--tests/qapi-schema/doc-bad-command-arg.err2
-rw-r--r--tests/qapi-schema/doc-bad-command-arg.exit1
-rw-r--r--tests/qapi-schema/doc-bad-section.exit1
-rw-r--r--tests/qapi-schema/doc-bad-symbol.err4
-rw-r--r--tests/qapi-schema/doc-bad-symbol.exit1
-rw-r--r--tests/qapi-schema/doc-bad-union-member.err2
-rw-r--r--tests/qapi-schema/doc-bad-union-member.exit1
-rw-r--r--tests/qapi-schema/doc-before-include.err2
-rw-r--r--tests/qapi-schema/doc-before-include.exit1
-rw-r--r--tests/qapi-schema/doc-before-pragma.err2
-rw-r--r--tests/qapi-schema/doc-before-pragma.exit1
-rw-r--r--tests/qapi-schema/doc-duplicated-arg.err2
-rw-r--r--tests/qapi-schema/doc-duplicated-arg.exit1
-rw-r--r--tests/qapi-schema/doc-duplicated-return.err2
-rw-r--r--tests/qapi-schema/doc-duplicated-return.exit1
-rw-r--r--tests/qapi-schema/doc-duplicated-since.err2
-rw-r--r--tests/qapi-schema/doc-duplicated-since.exit1
-rw-r--r--tests/qapi-schema/doc-empty-arg.err2
-rw-r--r--tests/qapi-schema/doc-empty-arg.exit1
-rw-r--r--tests/qapi-schema/doc-empty-section.err2
-rw-r--r--tests/qapi-schema/doc-empty-section.exit1
-rw-r--r--tests/qapi-schema/doc-empty-symbol.err2
-rw-r--r--tests/qapi-schema/doc-empty-symbol.exit1
-rw-r--r--tests/qapi-schema/doc-good.exit1
-rw-r--r--tests/qapi-schema/doc-good.json17
-rw-r--r--tests/qapi-schema/doc-good.out9
-rw-r--r--tests/qapi-schema/doc-good.texi22
-rw-r--r--tests/qapi-schema/doc-interleaved-section.err2
-rw-r--r--tests/qapi-schema/doc-interleaved-section.exit1
-rw-r--r--tests/qapi-schema/doc-invalid-end.err2
-rw-r--r--tests/qapi-schema/doc-invalid-end.exit1
-rw-r--r--tests/qapi-schema/doc-invalid-end2.err2
-rw-r--r--tests/qapi-schema/doc-invalid-end2.exit1
-rw-r--r--tests/qapi-schema/doc-invalid-return.err2
-rw-r--r--tests/qapi-schema/doc-invalid-return.exit1
-rw-r--r--tests/qapi-schema/doc-invalid-section.err2
-rw-r--r--tests/qapi-schema/doc-invalid-section.exit1
-rw-r--r--tests/qapi-schema/doc-invalid-start.err2
-rw-r--r--tests/qapi-schema/doc-invalid-start.exit1
-rw-r--r--tests/qapi-schema/doc-missing-colon.err2
-rw-r--r--tests/qapi-schema/doc-missing-colon.exit1
-rw-r--r--tests/qapi-schema/doc-missing-expr.err2
-rw-r--r--tests/qapi-schema/doc-missing-expr.exit1
-rw-r--r--tests/qapi-schema/doc-missing-space.err2
-rw-r--r--tests/qapi-schema/doc-missing-space.exit1
-rw-r--r--tests/qapi-schema/doc-missing.err4
-rw-r--r--tests/qapi-schema/doc-missing.exit1
-rw-r--r--tests/qapi-schema/doc-no-symbol.err2
-rw-r--r--tests/qapi-schema/doc-no-symbol.exit1
-rw-r--r--tests/qapi-schema/double-type.err4
-rw-r--r--tests/qapi-schema/double-type.exit1
-rw-r--r--tests/qapi-schema/duplicate-key.err2
-rw-r--r--tests/qapi-schema/duplicate-key.exit1
-rw-r--r--tests/qapi-schema/empty.exit1
-rw-r--r--tests/qapi-schema/enum-bad-member.err4
-rw-r--r--tests/qapi-schema/enum-bad-member.exit1
-rw-r--r--tests/qapi-schema/enum-bad-name.err4
-rw-r--r--tests/qapi-schema/enum-bad-name.exit1
-rw-r--r--tests/qapi-schema/enum-bad-prefix.err4
-rw-r--r--tests/qapi-schema/enum-bad-prefix.exit1
-rw-r--r--tests/qapi-schema/enum-clash-member.err4
-rw-r--r--tests/qapi-schema/enum-clash-member.exit1
-rw-r--r--tests/qapi-schema/enum-dict-member-unknown.err4
-rw-r--r--tests/qapi-schema/enum-dict-member-unknown.exit1
-rw-r--r--tests/qapi-schema/enum-if-invalid.err4
-rw-r--r--tests/qapi-schema/enum-if-invalid.exit1
-rw-r--r--tests/qapi-schema/enum-int-member.err2
-rw-r--r--tests/qapi-schema/enum-int-member.exit1
-rw-r--r--tests/qapi-schema/enum-member-case.err4
-rw-r--r--tests/qapi-schema/enum-member-case.exit1
-rw-r--r--tests/qapi-schema/enum-missing-data.err4
-rw-r--r--tests/qapi-schema/enum-missing-data.exit1
-rw-r--r--tests/qapi-schema/enum-wrong-data.err4
-rw-r--r--tests/qapi-schema/enum-wrong-data.exit1
-rw-r--r--tests/qapi-schema/escape-outside-string.err2
-rw-r--r--tests/qapi-schema/event-boxed-empty.err4
-rw-r--r--tests/qapi-schema/event-boxed-empty.exit1
-rw-r--r--tests/qapi-schema/event-case.exit1
-rw-r--r--tests/qapi-schema/event-case.out2
-rw-r--r--tests/qapi-schema/event-member-invalid-dict.err4
-rw-r--r--tests/qapi-schema/event-member-invalid-dict.exit1
-rw-r--r--tests/qapi-schema/event-nest-struct.err4
-rw-r--r--tests/qapi-schema/event-nest-struct.exit1
-rw-r--r--tests/qapi-schema/features-bad-type.err4
-rw-r--r--tests/qapi-schema/features-bad-type.exit1
-rw-r--r--tests/qapi-schema/features-duplicate-name.err4
-rw-r--r--tests/qapi-schema/features-duplicate-name.exit1
-rw-r--r--tests/qapi-schema/features-if-invalid.err4
-rw-r--r--tests/qapi-schema/features-if-invalid.exit1
-rw-r--r--tests/qapi-schema/features-missing-name.err4
-rw-r--r--tests/qapi-schema/features-missing-name.exit1
-rw-r--r--tests/qapi-schema/features-name-bad-type.err4
-rw-r--r--tests/qapi-schema/features-name-bad-type.exit1
-rw-r--r--tests/qapi-schema/features-no-list.err4
-rw-r--r--tests/qapi-schema/features-no-list.exit1
-rw-r--r--tests/qapi-schema/features-unknown-key.err4
-rw-r--r--tests/qapi-schema/features-unknown-key.exit1
-rw-r--r--tests/qapi-schema/flat-union-array-branch.err4
-rw-r--r--tests/qapi-schema/flat-union-array-branch.exit1
-rw-r--r--tests/qapi-schema/flat-union-bad-base.err4
-rw-r--r--tests/qapi-schema/flat-union-bad-base.exit1
-rw-r--r--tests/qapi-schema/flat-union-bad-discriminator.err4
-rw-r--r--tests/qapi-schema/flat-union-bad-discriminator.exit1
-rw-r--r--tests/qapi-schema/flat-union-base-any.err4
-rw-r--r--tests/qapi-schema/flat-union-base-any.exit1
-rw-r--r--tests/qapi-schema/flat-union-base-union.err4
-rw-r--r--tests/qapi-schema/flat-union-base-union.exit1
-rw-r--r--tests/qapi-schema/flat-union-clash-member.err4
-rw-r--r--tests/qapi-schema/flat-union-clash-member.exit1
-rw-r--r--tests/qapi-schema/flat-union-discriminator-bad-name.err4
-rw-r--r--tests/qapi-schema/flat-union-discriminator-bad-name.exit1
-rw-r--r--tests/qapi-schema/flat-union-empty.err4
-rw-r--r--tests/qapi-schema/flat-union-empty.exit1
-rw-r--r--tests/qapi-schema/flat-union-inline-invalid-dict.err4
-rw-r--r--tests/qapi-schema/flat-union-inline-invalid-dict.exit1
-rw-r--r--tests/qapi-schema/flat-union-inline.err4
-rw-r--r--tests/qapi-schema/flat-union-inline.exit1
-rw-r--r--tests/qapi-schema/flat-union-int-branch.err4
-rw-r--r--tests/qapi-schema/flat-union-int-branch.exit1
-rw-r--r--tests/qapi-schema/flat-union-invalid-branch-key.err4
-rw-r--r--tests/qapi-schema/flat-union-invalid-branch-key.exit1
-rw-r--r--tests/qapi-schema/flat-union-invalid-discriminator.err4
-rw-r--r--tests/qapi-schema/flat-union-invalid-discriminator.exit1
-rw-r--r--tests/qapi-schema/flat-union-invalid-if-discriminator.err4
-rw-r--r--tests/qapi-schema/flat-union-invalid-if-discriminator.exit1
-rw-r--r--tests/qapi-schema/flat-union-no-base.err4
-rw-r--r--tests/qapi-schema/flat-union-no-base.exit1
-rw-r--r--tests/qapi-schema/flat-union-optional-discriminator.err4
-rw-r--r--tests/qapi-schema/flat-union-optional-discriminator.exit1
-rw-r--r--tests/qapi-schema/flat-union-string-discriminator.err4
-rw-r--r--tests/qapi-schema/flat-union-string-discriminator.exit1
-rw-r--r--tests/qapi-schema/funny-char.err2
-rw-r--r--tests/qapi-schema/funny-char.exit1
-rw-r--r--tests/qapi-schema/funny-word.err2
-rw-r--r--tests/qapi-schema/funny-word.exit1
-rw-r--r--tests/qapi-schema/ident-with-escape.err2
-rw-r--r--tests/qapi-schema/ident-with-escape.exit1
-rw-r--r--tests/qapi-schema/include-before-err.err2
-rw-r--r--tests/qapi-schema/include-before-err.exit1
-rw-r--r--tests/qapi-schema/include-cycle.err6
-rw-r--r--tests/qapi-schema/include-cycle.exit1
-rw-r--r--tests/qapi-schema/include-extra-junk.err2
-rw-r--r--tests/qapi-schema/include-extra-junk.exit1
-rw-r--r--tests/qapi-schema/include-nested-err.err4
-rw-r--r--tests/qapi-schema/include-nested-err.exit1
-rw-r--r--tests/qapi-schema/include-no-file.err2
-rw-r--r--tests/qapi-schema/include-no-file.exit1
-rw-r--r--tests/qapi-schema/include-non-file.err2
-rw-r--r--tests/qapi-schema/include-non-file.exit1
-rw-r--r--tests/qapi-schema/include-repetition.exit1
-rw-r--r--tests/qapi-schema/include-self-cycle.err2
-rw-r--r--tests/qapi-schema/include-self-cycle.exit1
-rw-r--r--tests/qapi-schema/include-simple.exit1
-rw-r--r--tests/qapi-schema/indented-expr.exit1
-rw-r--r--tests/qapi-schema/indented-expr.out4
-rw-r--r--tests/qapi-schema/leading-comma-list.err2
-rw-r--r--tests/qapi-schema/leading-comma-list.exit1
-rw-r--r--tests/qapi-schema/leading-comma-object.err2
-rw-r--r--tests/qapi-schema/leading-comma-object.exit1
-rw-r--r--tests/qapi-schema/missing-colon.err2
-rw-r--r--tests/qapi-schema/missing-colon.exit1
-rw-r--r--tests/qapi-schema/missing-comma-list.err2
-rw-r--r--tests/qapi-schema/missing-comma-list.exit1
-rw-r--r--tests/qapi-schema/missing-comma-object.err2
-rw-r--r--tests/qapi-schema/missing-comma-object.exit1
-rw-r--r--tests/qapi-schema/missing-type.err2
-rw-r--r--tests/qapi-schema/missing-type.exit1
-rw-r--r--tests/qapi-schema/nested-struct-data-invalid-dict.err4
-rw-r--r--tests/qapi-schema/nested-struct-data-invalid-dict.exit1
-rw-r--r--tests/qapi-schema/nested-struct-data.err4
-rw-r--r--tests/qapi-schema/nested-struct-data.exit1
-rw-r--r--tests/qapi-schema/non-objects.err2
-rw-r--r--tests/qapi-schema/non-objects.exit1
-rw-r--r--tests/qapi-schema/oob-test.err4
-rw-r--r--tests/qapi-schema/oob-test.exit1
-rw-r--r--tests/qapi-schema/pragma-doc-required-crap.err2
-rw-r--r--tests/qapi-schema/pragma-doc-required-crap.exit1
-rw-r--r--tests/qapi-schema/pragma-extra-junk.err2
-rw-r--r--tests/qapi-schema/pragma-extra-junk.exit1
-rw-r--r--tests/qapi-schema/pragma-name-case-whitelist-crap.err2
-rw-r--r--tests/qapi-schema/pragma-name-case-whitelist-crap.exit1
-rw-r--r--tests/qapi-schema/pragma-non-dict.err2
-rw-r--r--tests/qapi-schema/pragma-non-dict.exit1
-rw-r--r--tests/qapi-schema/pragma-returns-whitelist-crap.err2
-rw-r--r--tests/qapi-schema/pragma-returns-whitelist-crap.exit1
-rw-r--r--tests/qapi-schema/pragma-unknown.err2
-rw-r--r--tests/qapi-schema/pragma-unknown.exit1
-rw-r--r--tests/qapi-schema/qapi-schema-test.exit1
-rw-r--r--tests/qapi-schema/qapi-schema-test.json18
-rw-r--r--tests/qapi-schema/qapi-schema-test.out75
-rw-r--r--tests/qapi-schema/quoted-structural-chars.err2
-rw-r--r--tests/qapi-schema/quoted-structural-chars.exit1
-rw-r--r--tests/qapi-schema/redefined-builtin.err4
-rw-r--r--tests/qapi-schema/redefined-builtin.exit1
-rw-r--r--tests/qapi-schema/redefined-command.err8
-rw-r--r--tests/qapi-schema/redefined-command.exit1
-rw-r--r--tests/qapi-schema/redefined-event.err8
-rw-r--r--tests/qapi-schema/redefined-event.exit1
-rw-r--r--tests/qapi-schema/redefined-type.err8
-rw-r--r--tests/qapi-schema/redefined-type.exit1
-rw-r--r--tests/qapi-schema/reserved-command-q.err4
-rw-r--r--tests/qapi-schema/reserved-command-q.exit1
-rw-r--r--tests/qapi-schema/reserved-enum-q.err4
-rw-r--r--tests/qapi-schema/reserved-enum-q.exit1
-rw-r--r--tests/qapi-schema/reserved-member-has.err4
-rw-r--r--tests/qapi-schema/reserved-member-has.exit1
-rw-r--r--tests/qapi-schema/reserved-member-q.err4
-rw-r--r--tests/qapi-schema/reserved-member-q.exit1
-rw-r--r--tests/qapi-schema/reserved-member-u.err4
-rw-r--r--tests/qapi-schema/reserved-member-u.exit1
-rw-r--r--tests/qapi-schema/reserved-member-underscore.err4
-rw-r--r--tests/qapi-schema/reserved-member-underscore.exit1
-rw-r--r--tests/qapi-schema/reserved-type-kind.err4
-rw-r--r--tests/qapi-schema/reserved-type-kind.exit1
-rw-r--r--tests/qapi-schema/reserved-type-list.err4
-rw-r--r--tests/qapi-schema/reserved-type-list.exit1
-rw-r--r--tests/qapi-schema/returns-alternate.err4
-rw-r--r--tests/qapi-schema/returns-alternate.exit1
-rw-r--r--tests/qapi-schema/returns-array-bad.err4
-rw-r--r--tests/qapi-schema/returns-array-bad.exit1
-rw-r--r--tests/qapi-schema/returns-dict.err4
-rw-r--r--tests/qapi-schema/returns-dict.exit1
-rw-r--r--tests/qapi-schema/returns-unknown.err4
-rw-r--r--tests/qapi-schema/returns-unknown.exit1
-rw-r--r--tests/qapi-schema/returns-whitelist.err4
-rw-r--r--tests/qapi-schema/returns-whitelist.exit1
-rw-r--r--tests/qapi-schema/string-code-point-127.err2
-rw-r--r--tests/qapi-schema/string-code-point-127.exit1
-rw-r--r--tests/qapi-schema/string-code-point-31.err2
-rw-r--r--tests/qapi-schema/string-code-point-31.exit1
-rw-r--r--tests/qapi-schema/struct-base-clash-deep.err4
-rw-r--r--tests/qapi-schema/struct-base-clash-deep.exit1
-rw-r--r--tests/qapi-schema/struct-base-clash.err4
-rw-r--r--tests/qapi-schema/struct-base-clash.exit1
-rw-r--r--tests/qapi-schema/struct-data-invalid.err4
-rw-r--r--tests/qapi-schema/struct-data-invalid.exit1
-rw-r--r--tests/qapi-schema/struct-member-if-invalid.err4
-rw-r--r--tests/qapi-schema/struct-member-if-invalid.exit1
-rw-r--r--tests/qapi-schema/struct-member-invalid-dict.err4
-rw-r--r--tests/qapi-schema/struct-member-invalid-dict.exit1
-rw-r--r--tests/qapi-schema/struct-member-invalid.err4
-rw-r--r--tests/qapi-schema/struct-member-invalid.exit1
-rwxr-xr-x[-rw-r--r--]tests/qapi-schema/test-qapi.py151
-rw-r--r--tests/qapi-schema/trailing-comma-list.err2
-rw-r--r--tests/qapi-schema/trailing-comma-list.exit1
-rw-r--r--tests/qapi-schema/trailing-comma-object.err2
-rw-r--r--tests/qapi-schema/trailing-comma-object.exit1
-rw-r--r--tests/qapi-schema/type-bypass-bad-gen.err4
-rw-r--r--tests/qapi-schema/type-bypass-bad-gen.exit1
-rw-r--r--tests/qapi-schema/unclosed-list.err2
-rw-r--r--tests/qapi-schema/unclosed-list.exit1
-rw-r--r--tests/qapi-schema/unclosed-object.err2
-rw-r--r--tests/qapi-schema/unclosed-object.exit1
-rw-r--r--tests/qapi-schema/unclosed-string.err2
-rw-r--r--tests/qapi-schema/unclosed-string.exit1
-rw-r--r--tests/qapi-schema/union-base-empty.err4
-rw-r--r--tests/qapi-schema/union-base-empty.exit1
-rw-r--r--tests/qapi-schema/union-base-no-discriminator.err4
-rw-r--r--tests/qapi-schema/union-base-no-discriminator.exit1
-rw-r--r--tests/qapi-schema/union-branch-case.err4
-rw-r--r--tests/qapi-schema/union-branch-case.exit1
-rw-r--r--tests/qapi-schema/union-branch-if-invalid.err4
-rw-r--r--tests/qapi-schema/union-branch-if-invalid.exit1
-rw-r--r--tests/qapi-schema/union-branch-invalid-dict.err4
-rw-r--r--tests/qapi-schema/union-branch-invalid-dict.exit1
-rw-r--r--tests/qapi-schema/union-clash-branches.err4
-rw-r--r--tests/qapi-schema/union-clash-branches.exit1
-rw-r--r--tests/qapi-schema/union-empty.err4
-rw-r--r--tests/qapi-schema/union-empty.exit1
-rw-r--r--tests/qapi-schema/union-invalid-base.err4
-rw-r--r--tests/qapi-schema/union-invalid-base.exit1
-rw-r--r--tests/qapi-schema/union-optional-branch.err4
-rw-r--r--tests/qapi-schema/union-optional-branch.exit1
-rw-r--r--tests/qapi-schema/union-unknown.err4
-rw-r--r--tests/qapi-schema/union-unknown.exit1
-rw-r--r--tests/qapi-schema/unknown-escape.err2
-rw-r--r--tests/qapi-schema/unknown-escape.exit1
-rw-r--r--tests/qapi-schema/unknown-expr-key.err4
-rw-r--r--tests/qapi-schema/unknown-expr-key.exit1
-rwxr-xr-xtests/qemu-iotests/1183
-rwxr-xr-xtests/qemu-iotests/26495
-rw-r--r--tests/qemu-iotests/264.out13
-rw-r--r--tests/qemu-iotests/group1
-rw-r--r--tests/qemu-iotests/iotests.py21
-rw-r--r--tests/rtc-test.c4
-rw-r--r--tests/test-qmp-cmds.c24
-rw-r--r--util/async.c1
-rw-r--r--util/event_notifier-posix.c2
-rw-r--r--util/qemu-coroutine-io.c7
-rw-r--r--util/qemu-coroutine-sleep.c51
-rw-r--r--util/qemu-timer.c6
581 files changed, 13266 insertions, 8771 deletions
diff --git a/.mailmap b/.mailmap
index 0756a0bf66..3816e4effe 100644
--- a/.mailmap
+++ b/.mailmap
@@ -39,10 +39,11 @@ Julia Suvorova <jusual@mail.ru> Julia Suvorova via Qemu-devel <qemu-devel@nongnu
 Justin Terry (VM) <juterry@microsoft.com> Justin Terry (VM) via Qemu-devel <qemu-devel@nongnu.org>
 
 # Next, replace old addresses by a more recent one.
-Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
-James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
 Aleksandar Markovic <amarkovic@wavecomp.com> <aleksandar.markovic@mips.com>
 Aleksandar Markovic <amarkovic@wavecomp.com> <aleksandar.markovic@imgtec.com>
+Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com> <arikalo@wavecomp.com>
+Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
+James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
 Paul Burton <pburton@wavecomp.com> <paul.burton@mips.com>
 Paul Burton <pburton@wavecomp.com> <paul.burton@imgtec.com>
 Paul Burton <pburton@wavecomp.com> <paul@archlinuxmips.org>
diff --git a/MAINTAINERS b/MAINTAINERS
index 72ab731987..42e702f346 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -208,7 +208,7 @@ F: disas/microblaze.c
 MIPS TCG CPUs
 M: Aurelien Jarno <aurelien@aurel32.net>
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: target/mips/
 F: default-configs/*mips*
@@ -363,7 +363,7 @@ F: target/arm/kvm.c
 
 MIPS KVM CPUs
 M: James Hogan <jhogan@kernel.org>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: target/mips/kvm.c
 
@@ -495,8 +495,8 @@ F: hw/intc/pl190.c
 F: hw/sd/pl181.c
 F: hw/ssi/pl022.c
 F: include/hw/ssi/pl022.h
-F: hw/timer/pl031.c
-F: include/hw/timer/pl031.h
+F: hw/rtc/pl031.c
+F: include/hw/rtc/pl031.h
 F: include/hw/arm/primecell.h
 F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
@@ -663,7 +663,7 @@ F: hw/display/blizzard.c
 F: hw/input/lm832x.c
 F: hw/input/tsc2005.c
 F: hw/misc/cbus.c
-F: hw/timer/twl92230.c
+F: hw/rtc/twl92230.c
 F: include/hw/display/blizzard.h
 F: include/hw/input/tsc2xxx.h
 F: include/hw/misc/cbus.h
@@ -934,7 +934,7 @@ MIPS Machines
 -------------
 Jazz
 M: Hervé Poussineau <hpoussin@reactos.org>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: hw/mips/mips_jazz.c
 F: hw/display/jazz_led.c
@@ -942,7 +942,7 @@ F: hw/dma/rc4030.c
 
 Malta
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: hw/mips/mips_malta.c
 F: hw/mips/gt64xxx_pci.c
@@ -950,20 +950,20 @@ F: tests/acceptance/linux_ssh_mips_malta.py
 
 Mipssim
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Odd Fixes
 F: hw/mips/mips_mipssim.c
 F: hw/net/mipsnet.c
 
 R4000
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: hw/mips/mips_r4k.c
 
 Fulong 2E
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Odd Fixes
 F: hw/mips/mips_fulong2e.c
 F: hw/isa/vt82c686.c
@@ -972,7 +972,7 @@ F: include/hw/isa/vt82c686.h
 
 Boston
 M: Paul Burton <pburton@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: hw/core/loader-fit.c
 F: hw/mips/boston.c
@@ -1064,9 +1064,9 @@ F: hw/pci-host/prep.[hc]
 F: hw/isa/i82378.c
 F: hw/isa/pc87312.c
 F: hw/dma/i82374.c
-F: hw/timer/m48t59-isa.c
+F: hw/rtc/m48t59-isa.c
 F: include/hw/isa/pc87312.h
-F: include/hw/timer/m48t59.h
+F: include/hw/rtc/m48t59.h
 F: pc-bios/ppc_rom.bin
 
 sPAPR
@@ -1111,7 +1111,7 @@ F: hw/ppc/sam460ex.c
 F: hw/ppc/ppc440_pcix.c
 F: hw/display/sm501*
 F: hw/ide/sii3112.c
-F: hw/timer/m41t80.c
+F: hw/rtc/m41t80.c
 F: pc-bios/canyonlands.dt[sb]
 F: pc-bios/u-boot-sam460ex-20100605.bin
 F: roms/u-boot-sam460ex
@@ -1163,8 +1163,8 @@ Sun4v
 M: Artyom Tarasenko <atar4qemu@gmail.com>
 S: Maintained
 F: hw/sparc64/niagara.c
-F: hw/timer/sun4v-rtc.c
-F: include/hw/timer/sun4v-rtc.h
+F: hw/rtc/sun4v-rtc.c
+F: include/hw/rtc/sun4v-rtc.h
 
 Leon3
 M: Fabien Chouteau <chouteau@adacore.com>
@@ -1261,7 +1261,7 @@ F: hw/misc/debugexit.c
 F: hw/misc/pc-testdev.c
 F: hw/timer/hpet*
 F: hw/timer/i8254*
-F: hw/timer/mc146818rtc*
+F: hw/rtc/mc146818rtc*
 F: hw/watchdog/wdt_ib700.c
 F: hw/watchdog/wdt_i6300esb.c
 F: include/hw/display/vga.h
@@ -1273,7 +1273,7 @@ F: include/hw/isa/i8259_internal.h
 F: include/hw/isa/superio.h
 F: include/hw/timer/hpet.h
 F: include/hw/timer/i8254*
-F: include/hw/timer/mc146818rtc*
+F: include/hw/rtc/mc146818rtc*
 
 microvm
 M: Sergio Lopez <slp@redhat.com>
@@ -1309,6 +1309,11 @@ M: Max Filippov <jcmvbkbc@gmail.com>
 S: Maintained
 F: hw/xtensa/sim.c
 
+virt
+M: Max Filippov <jcmvbkbc@gmail.com>
+S: Maintained
+F: hw/xtensa/virt.c
+
 XTFPGA (LX60, LX200, ML605, KC705)
 M: Max Filippov <jcmvbkbc@gmail.com>
 S: Maintained
@@ -2356,7 +2361,7 @@ F: disas/i386.c
 
 MIPS TCG target
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
 S: Maintained
 F: tcg/mips/
 
diff --git a/Makefile b/Makefile
index d20e7ffce3..0e994a275d 100644
--- a/Makefile
+++ b/Makefile
@@ -582,13 +582,20 @@ qemu-ga$(EXESUF): QEMU_CFLAGS += -I qga/qapi-generated
 qemu-keymap$(EXESUF): LIBS += $(XKBCOMMON_LIBS)
 qemu-keymap$(EXESUF): QEMU_CFLAGS += $(XKBCOMMON_CFLAGS)
 
-qapi-py = $(SRC_PATH)/scripts/qapi/commands.py \
+qapi-py = $(SRC_PATH)/scripts/qapi/__init__.py \
+$(SRC_PATH)/scripts/qapi/commands.py \
+$(SRC_PATH)/scripts/qapi/common.py \
+$(SRC_PATH)/scripts/qapi/doc.py \
+$(SRC_PATH)/scripts/qapi/error.py \
 $(SRC_PATH)/scripts/qapi/events.py \
+$(SRC_PATH)/scripts/qapi/expr.py \
+$(SRC_PATH)/scripts/qapi/gen.py \
 $(SRC_PATH)/scripts/qapi/introspect.py \
+$(SRC_PATH)/scripts/qapi/parser.py \
+$(SRC_PATH)/scripts/qapi/schema.py \
+$(SRC_PATH)/scripts/qapi/source.py \
 $(SRC_PATH)/scripts/qapi/types.py \
 $(SRC_PATH)/scripts/qapi/visit.py \
-$(SRC_PATH)/scripts/qapi/common.py \
-$(SRC_PATH)/scripts/qapi/doc.py \
 $(SRC_PATH)/scripts/qapi-gen.py
 
 qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h \
diff --git a/Makefile.objs b/Makefile.objs
index abcbd89654..11ba1a36bd 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -173,6 +173,7 @@ trace-events-subdirs += hw/pci-host
 trace-events-subdirs += hw/ppc
 trace-events-subdirs += hw/rdma
 trace-events-subdirs += hw/rdma/vmw
+trace-events-subdirs += hw/rtc
 trace-events-subdirs += hw/s390x
 trace-events-subdirs += hw/scsi
 trace-events-subdirs += hw/sd
diff --git a/block/backup.c b/block/backup.c
index dddcf77f53..cf62b1a38c 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -474,10 +474,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     if (sync_bitmap) {
         bdrv_reclaim_dirty_bitmap(sync_bitmap, NULL);
     }
-    if (job) {
-        backup_clean(&job->common.job);
-        job_early_fail(&job->common.job);
-    } else if (backup_top) {
+    if (backup_top) {
         bdrv_backup_top_drop(backup_top);
     }
 
diff --git a/block/nbd.c b/block/nbd.c
index fd78e5f330..123976171c 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -1,6 +1,7 @@
 /*
  * QEMU Block driver for  NBD
  *
+ * Copyright (c) 2019 Virtuozzo International GmbH.
  * Copyright (C) 2016 Red Hat, Inc.
  * Copyright (C) 2008 Bull S.A.S.
  *     Author: Laurent Vivier <Laurent.Vivier@bull.net>
@@ -55,6 +56,8 @@ typedef struct {
 } NBDClientRequest;
 
 typedef enum NBDClientState {
+    NBD_CLIENT_CONNECTING_WAIT,
+    NBD_CLIENT_CONNECTING_NOWAIT,
     NBD_CLIENT_CONNECTED,
     NBD_CLIENT_QUIT
 } NBDClientState;
@@ -67,8 +70,14 @@ typedef struct BDRVNBDState {
     CoMutex send_mutex;
     CoQueue free_sema;
     Coroutine *connection_co;
+    QemuCoSleepState *connection_co_sleep_ns_state;
+    bool drained;
+    bool wait_drained_end;
     int in_flight;
     NBDClientState state;
+    int connect_status;
+    Error *connect_err;
+    bool wait_in_flight;
 
     NBDClientRequest requests[MAX_NBD_REQUESTS];
     NBDReply reply;
@@ -83,10 +92,21 @@ typedef struct BDRVNBDState {
     char *x_dirty_bitmap;
 } BDRVNBDState;
 
-/* @ret will be used for reconnect in future */
+static int nbd_client_connect(BlockDriverState *bs, Error **errp);
+
 static void nbd_channel_error(BDRVNBDState *s, int ret)
 {
-    s->state = NBD_CLIENT_QUIT;
+    if (ret == -EIO) {
+        if (s->state == NBD_CLIENT_CONNECTED) {
+            s->state = s->reconnect_delay ? NBD_CLIENT_CONNECTING_WAIT :
+                                            NBD_CLIENT_CONNECTING_NOWAIT;
+        }
+    } else {
+        if (s->state == NBD_CLIENT_CONNECTED) {
+            qio_channel_shutdown(s->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
+        }
+        s->state = NBD_CLIENT_QUIT;
+    }
 }
 
 static void nbd_recv_coroutines_wake_all(BDRVNBDState *s)
@@ -129,7 +149,13 @@ static void nbd_client_attach_aio_context(BlockDriverState *bs,
 {
     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
 
-    qio_channel_attach_aio_context(QIO_CHANNEL(s->ioc), new_context);
+    /*
+     * s->connection_co is either yielded from nbd_receive_reply or from
+     * nbd_co_reconnect_loop()
+     */
+    if (s->state == NBD_CLIENT_CONNECTED) {
+        qio_channel_attach_aio_context(QIO_CHANNEL(s->ioc), new_context);
+    }
 
     bdrv_inc_in_flight(bs);
 
@@ -140,24 +166,150 @@ static void nbd_client_attach_aio_context(BlockDriverState *bs,
     aio_wait_bh_oneshot(new_context, nbd_client_attach_aio_context_bh, bs);
 }
 
+static void coroutine_fn nbd_client_co_drain_begin(BlockDriverState *bs)
+{
+    BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
 
-static void nbd_teardown_connection(BlockDriverState *bs)
+    s->drained = true;
+    if (s->connection_co_sleep_ns_state) {
+        qemu_co_sleep_wake(s->connection_co_sleep_ns_state);
+    }
+}
+
+static void coroutine_fn nbd_client_co_drain_end(BlockDriverState *bs)
 {
     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
 
-    assert(s->ioc);
+    s->drained = false;
+    if (s->wait_drained_end) {
+        s->wait_drained_end = false;
+        aio_co_wake(s->connection_co);
+    }
+}
+
 
-    /* finish any pending coroutines */
-    qio_channel_shutdown(s->ioc,
-                         QIO_CHANNEL_SHUTDOWN_BOTH,
-                         NULL);
+static void nbd_teardown_connection(BlockDriverState *bs)
+{
+    BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
+
+    if (s->state == NBD_CLIENT_CONNECTED) {
+        /* finish any pending coroutines */
+        assert(s->ioc);
+        qio_channel_shutdown(s->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
+    }
+    s->state = NBD_CLIENT_QUIT;
+    if (s->connection_co) {
+        if (s->connection_co_sleep_ns_state) {
+            qemu_co_sleep_wake(s->connection_co_sleep_ns_state);
+        }
+    }
     BDRV_POLL_WHILE(bs, s->connection_co);
+}
 
-    nbd_client_detach_aio_context(bs);
-    object_unref(OBJECT(s->sioc));
-    s->sioc = NULL;
-    object_unref(OBJECT(s->ioc));
-    s->ioc = NULL;
+static bool nbd_client_connecting(BDRVNBDState *s)
+{
+    return s->state == NBD_CLIENT_CONNECTING_WAIT ||
+        s->state == NBD_CLIENT_CONNECTING_NOWAIT;
+}
+
+static bool nbd_client_connecting_wait(BDRVNBDState *s)
+{
+    return s->state == NBD_CLIENT_CONNECTING_WAIT;
+}
+
+static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
+{
+    Error *local_err = NULL;
+
+    if (!nbd_client_connecting(s)) {
+        return;
+    }
+
+    /* Wait for completion of all in-flight requests */
+
+    qemu_co_mutex_lock(&s->send_mutex);
+
+    while (s->in_flight > 0) {
+        qemu_co_mutex_unlock(&s->send_mutex);
+        nbd_recv_coroutines_wake_all(s);
+        s->wait_in_flight = true;
+        qemu_coroutine_yield();
+        s->wait_in_flight = false;
+        qemu_co_mutex_lock(&s->send_mutex);
+    }
+
+    qemu_co_mutex_unlock(&s->send_mutex);
+
+    if (!nbd_client_connecting(s)) {
+        return;
+    }
+
+    /*
+     * Now we are sure that nobody is accessing the channel, and no one will
+     * try until we set the state to CONNECTED.
+     */
+
+    /* Finalize previous connection if any */
+    if (s->ioc) {
+        nbd_client_detach_aio_context(s->bs);
+        object_unref(OBJECT(s->sioc));
+        s->sioc = NULL;
+        object_unref(OBJECT(s->ioc));
+        s->ioc = NULL;
+    }
+
+    s->connect_status = nbd_client_connect(s->bs, &local_err);
+    error_free(s->connect_err);
+    s->connect_err = NULL;
+    error_propagate(&s->connect_err, local_err);
+
+    if (s->connect_status < 0) {
+        /* failed attempt */
+        return;
+    }
+
+    /* successfully connected */
+    s->state = NBD_CLIENT_CONNECTED;
+    qemu_co_queue_restart_all(&s->free_sema);
+}
+
+static coroutine_fn void nbd_co_reconnect_loop(BDRVNBDState *s)
+{
+    uint64_t start_time_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
+    uint64_t delay_ns = s->reconnect_delay * NANOSECONDS_PER_SECOND;
+    uint64_t timeout = 1 * NANOSECONDS_PER_SECOND;
+    uint64_t max_timeout = 16 * NANOSECONDS_PER_SECOND;
+
+    nbd_reconnect_attempt(s);
+
+    while (nbd_client_connecting(s)) {
+        if (s->state == NBD_CLIENT_CONNECTING_WAIT &&
+            qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time_ns > delay_ns)
+        {
+            s->state = NBD_CLIENT_CONNECTING_NOWAIT;
+            qemu_co_queue_restart_all(&s->free_sema);
+        }
+
+        qemu_co_sleep_ns_wakeable(QEMU_CLOCK_REALTIME, timeout,
+                                  &s->connection_co_sleep_ns_state);
+        if (s->drained) {
+            bdrv_dec_in_flight(s->bs);
+            s->wait_drained_end = true;
+            while (s->drained) {
+                /*
+                 * We may be entered once from nbd_client_attach_aio_context_bh
+                 * and then from nbd_client_co_drain_end. So here is a loop.
+                 */
+                qemu_coroutine_yield();
+            }
+            bdrv_inc_in_flight(s->bs);
+        }
+        if (timeout < max_timeout) {
+            timeout *= 2;
+        }
+
+        nbd_reconnect_attempt(s);
+    }
 }
 
 static coroutine_fn void nbd_connection_entry(void *opaque)
@@ -177,16 +329,26 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
          * Therefore we keep an additional in_flight reference all the time and
          * only drop it temporarily here.
          */
+
+        if (nbd_client_connecting(s)) {
+            nbd_co_reconnect_loop(s);
+        }
+
+        if (s->state != NBD_CLIENT_CONNECTED) {
+            continue;
+        }
+
         assert(s->reply.handle == 0);
         ret = nbd_receive_reply(s->bs, s->ioc, &s->reply, &local_err);
 
         if (local_err) {
             trace_nbd_read_reply_entry_fail(ret, error_get_pretty(local_err));
             error_free(local_err);
+            local_err = NULL;
         }
         if (ret <= 0) {
             nbd_channel_error(s, ret ? ret : -EIO);
-            break;
+            continue;
         }
 
         /*
@@ -201,7 +363,7 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
             (nbd_reply_is_structured(&s->reply) && !s->info.structured_reply))
         {
             nbd_channel_error(s, -EINVAL);
-            break;
+            continue;
         }
 
         /*
@@ -220,10 +382,19 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
         qemu_coroutine_yield();
     }
 
+    qemu_co_queue_restart_all(&s->free_sema);
     nbd_recv_coroutines_wake_all(s);
     bdrv_dec_in_flight(s->bs);
 
     s->connection_co = NULL;
+    if (s->ioc) {
+        nbd_client_detach_aio_context(s->bs);
+        object_unref(OBJECT(s->sioc));
+        s->sioc = NULL;
+        object_unref(OBJECT(s->ioc));
+        s->ioc = NULL;
+    }
+
     aio_wait_kick();
 }
 
@@ -235,7 +406,7 @@ static int nbd_co_send_request(BlockDriverState *bs,
     int rc, i = -1;
 
     qemu_co_mutex_lock(&s->send_mutex);
-    while (s->in_flight == MAX_NBD_REQUESTS) {
+    while (s->in_flight == MAX_NBD_REQUESTS || nbd_client_connecting_wait(s)) {
         qemu_co_queue_wait(&s->free_sema, &s->send_mutex);
     }
 
@@ -286,7 +457,11 @@ err:
             s->requests[i].coroutine = NULL;
             s->in_flight--;
         }
-        qemu_co_queue_next(&s->free_sema);
+        if (s->in_flight == 0 && s->wait_in_flight) {
+            aio_co_wake(s->connection_co);
+        } else {
+            qemu_co_queue_next(&s->free_sema);
+        }
     }
     qemu_co_mutex_unlock(&s->send_mutex);
     return rc;
@@ -666,10 +841,15 @@ static coroutine_fn int nbd_co_receive_one_chunk(
     } else {
         /* For assert at loop start in nbd_connection_entry */
         *reply = s->reply;
-        s->reply.handle = 0;
     }
+    s->reply.handle = 0;
 
-    if (s->connection_co) {
+    if (s->connection_co && !s->wait_in_flight) {
+        /*
+         * We must check s->wait_in_flight, because we may entered by
+         * nbd_recv_coroutines_wake_all(), in this case we should not
+         * wake connection_co here, it will woken by last request.
+         */
         aio_co_wake(s->connection_co);
     }
 
@@ -781,7 +961,11 @@ break_loop:
 
     qemu_co_mutex_lock(&s->send_mutex);
     s->in_flight--;
-    qemu_co_queue_next(&s->free_sema);
+    if (s->in_flight == 0 && s->wait_in_flight) {
+        aio_co_wake(s->connection_co);
+    } else {
+        qemu_co_queue_next(&s->free_sema);
+    }
     qemu_co_mutex_unlock(&s->send_mutex);
 
     return false;
@@ -927,20 +1111,26 @@ static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
     } else {
         assert(request->type != NBD_CMD_WRITE);
     }
-    ret = nbd_co_send_request(bs, request, write_qiov);
-    if (ret < 0) {
-        return ret;
-    }
 
-    ret = nbd_co_receive_return_code(s, request->handle,
-                                     &request_ret, &local_err);
-    if (local_err) {
-        trace_nbd_co_request_fail(request->from, request->len, request->handle,
-                                  request->flags, request->type,
-                                  nbd_cmd_lookup(request->type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
-    }
+    do {
+        ret = nbd_co_send_request(bs, request, write_qiov);
+        if (ret < 0) {
+            continue;
+        }
+
+        ret = nbd_co_receive_return_code(s, request->handle,
+                                         &request_ret, &local_err);
+        if (local_err) {
+            trace_nbd_co_request_fail(request->from, request->len,
+                                      request->handle, request->flags,
+                                      request->type,
+                                      nbd_cmd_lookup(request->type),
+                                      ret, error_get_pretty(local_err));
+            error_free(local_err);
+            local_err = NULL;
+        }
+    } while (ret < 0 && nbd_client_connecting_wait(s));
+
     return ret ? ret : request_ret;
 }
 
@@ -981,20 +1171,24 @@ static int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
         request.len -= slop;
     }
 
-    ret = nbd_co_send_request(bs, &request, NULL);
-    if (ret < 0) {
-        return ret;
-    }
+    do {
+        ret = nbd_co_send_request(bs, &request, NULL);
+        if (ret < 0) {
+            continue;
+        }
+
+        ret = nbd_co_receive_cmdread_reply(s, request.handle, offset, qiov,
+                                           &request_ret, &local_err);
+        if (local_err) {
+            trace_nbd_co_request_fail(request.from, request.len, request.handle,
+                                      request.flags, request.type,
+                                      nbd_cmd_lookup(request.type),
+                                      ret, error_get_pretty(local_err));
+            error_free(local_err);
+            local_err = NULL;
+        }
+    } while (ret < 0 && nbd_client_connecting_wait(s));
 
-    ret = nbd_co_receive_cmdread_reply(s, request.handle, offset, qiov,
-                                       &request_ret, &local_err);
-    if (local_err) {
-        trace_nbd_co_request_fail(request.from, request.len, request.handle,
-                                  request.flags, request.type,
-                                  nbd_cmd_lookup(request.type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
-    }
     return ret ? ret : request_ret;
 }
 
@@ -1131,20 +1325,25 @@ static int coroutine_fn nbd_client_co_block_status(
     if (s->info.min_block) {
         assert(QEMU_IS_ALIGNED(request.len, s->info.min_block));
     }
-    ret = nbd_co_send_request(bs, &request, NULL);
-    if (ret < 0) {
-        return ret;
-    }
+    do {
+        ret = nbd_co_send_request(bs, &request, NULL);
+        if (ret < 0) {
+            continue;
+        }
+
+        ret = nbd_co_receive_blockstatus_reply(s, request.handle, bytes,
+                                               &extent, &request_ret,
+                                               &local_err);
+        if (local_err) {
+            trace_nbd_co_request_fail(request.from, request.len, request.handle,
+                                      request.flags, request.type,
+                                      nbd_cmd_lookup(request.type),
+                                      ret, error_get_pretty(local_err));
+            error_free(local_err);
+            local_err = NULL;
+        }
+    } while (ret < 0 && nbd_client_connecting_wait(s));
 
-    ret = nbd_co_receive_blockstatus_reply(s, request.handle, bytes,
-                                           &extent, &request_ret, &local_err);
-    if (local_err) {
-        trace_nbd_co_request_fail(request.from, request.len, request.handle,
-                                  request.flags, request.type,
-                                  nbd_cmd_lookup(request.type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
-    }
     if (ret < 0 || request_ret < 0) {
         return ret ? ret : request_ret;
     }
@@ -1175,9 +1374,9 @@ static void nbd_client_close(BlockDriverState *bs)
     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
     NBDRequest request = { .type = NBD_CMD_DISC };
 
-    assert(s->ioc);
-
-    nbd_send_request(s->ioc, &request);
+    if (s->ioc) {
+        nbd_send_request(s->ioc, &request);
+    }
 
     nbd_teardown_connection(bs);
 }
@@ -1821,6 +2020,8 @@ static BlockDriver bdrv_nbd = {
     .bdrv_getlength             = nbd_getlength,
     .bdrv_detach_aio_context    = nbd_client_detach_aio_context,
     .bdrv_attach_aio_context    = nbd_client_attach_aio_context,
+    .bdrv_co_drain_begin        = nbd_client_co_drain_begin,
+    .bdrv_co_drain_end          = nbd_client_co_drain_end,
     .bdrv_refresh_filename      = nbd_refresh_filename,
     .bdrv_co_block_status       = nbd_client_co_block_status,
     .bdrv_dirname               = nbd_dirname,
@@ -1844,6 +2045,8 @@ static BlockDriver bdrv_nbd_tcp = {
     .bdrv_getlength             = nbd_getlength,
     .bdrv_detach_aio_context    = nbd_client_detach_aio_context,
     .bdrv_attach_aio_context    = nbd_client_attach_aio_context,
+    .bdrv_co_drain_begin        = nbd_client_co_drain_begin,
+    .bdrv_co_drain_end          = nbd_client_co_drain_end,
     .bdrv_refresh_filename      = nbd_refresh_filename,
     .bdrv_co_block_status       = nbd_client_co_block_status,
     .bdrv_dirname               = nbd_dirname,
@@ -1867,6 +2070,8 @@ static BlockDriver bdrv_nbd_unix = {
     .bdrv_getlength             = nbd_getlength,
     .bdrv_detach_aio_context    = nbd_client_detach_aio_context,
     .bdrv_attach_aio_context    = nbd_client_attach_aio_context,
+    .bdrv_co_drain_begin        = nbd_client_co_drain_begin,
+    .bdrv_co_drain_end          = nbd_client_co_drain_end,
     .bdrv_refresh_filename      = nbd_refresh_filename,
     .bdrv_co_block_status       = nbd_client_co_block_status,
     .bdrv_dirname               = nbd_dirname,
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index ef965d7895..0d64bf5a5e 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -3455,6 +3455,8 @@ int qcow2_detect_metadata_preallocation(BlockDriverState *bs)
     int64_t i, end_cluster, cluster_count = 0, threshold;
     int64_t file_length, real_allocation, real_clusters;
 
+    qemu_co_mutex_assert_locked(&s->lock);
+
     file_length = bdrv_getlength(bs->file->bs);
     if (file_length < 0) {
         return file_length;
diff --git a/block/qcow2.c b/block/qcow2.c
index 8b05933565..0bc69e6996 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1916,6 +1916,8 @@ static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
     unsigned int bytes;
     int status = 0;
 
+    qemu_co_mutex_lock(&s->lock);
+
     if (!s->metadata_preallocation_checked) {
         ret = qcow2_detect_metadata_preallocation(bs);
         s->metadata_preallocation = (ret == 1);
@@ -1923,7 +1925,6 @@ static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
     }
 
     bytes = MIN(INT_MAX, count);
-    qemu_co_mutex_lock(&s->lock);
     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
     qemu_co_mutex_unlock(&s->lock);
     if (ret < 0) {
diff --git a/blockdev.c b/blockdev.c
index 03c7cd7651..ba491e3ef5 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1088,11 +1088,11 @@ void hmp_commit(Monitor *mon, const QDict *qdict)
 
         blk = blk_by_name(device);
         if (!blk) {
-            monitor_printf(mon, "Device '%s' not found\n", device);
+            error_report("Device '%s' not found", device);
             return;
         }
         if (!blk_is_available(blk)) {
-            monitor_printf(mon, "Device '%s' has no medium\n", device);
+            error_report("Device '%s' has no medium", device);
             return;
         }
 
@@ -1105,8 +1105,7 @@ void hmp_commit(Monitor *mon, const QDict *qdict)
         aio_context_release(aio_context);
     }
     if (ret < 0) {
-        monitor_printf(mon, "'commit' error for '%s': %s\n", device,
-                       strerror(-ret));
+        error_report("'commit' error for '%s': %s", device, strerror(-ret));
     }
 }
 
diff --git a/default-configs/xtensa-softmmu.mak b/default-configs/xtensa-softmmu.mak
index 3aa20a47a7..4fe1bf00c9 100644
--- a/default-configs/xtensa-softmmu.mak
+++ b/default-configs/xtensa-softmmu.mak
@@ -5,4 +5,5 @@ CONFIG_SEMIHOSTING=y
 # Boards:
 #
 CONFIG_XTENSA_SIM=y
+CONFIG_XTENSA_VIRT=y
 CONFIG_XTENSA_XTFPGA=y
diff --git a/docs/devel/qapi-code-gen.txt b/docs/devel/qapi-code-gen.txt
index 64d9e4c6a9..45c93a43cc 100644
--- a/docs/devel/qapi-code-gen.txt
+++ b/docs/devel/qapi-code-gen.txt
@@ -457,7 +457,8 @@ Syntax:
                 '*gen': false,
                 '*allow-oob': true,
                 '*allow-preconfig': true,
-                '*if': COND }
+                '*if': COND,
+                '*features': FEATURES }
 
 Member 'command' names the command.
 
@@ -640,9 +641,10 @@ change in the QMP syntax (usually by allowing values or operations
 that previously resulted in an error).  QMP clients may still need to
 know whether the extension is available.
 
-For this purpose, a list of features can be specified for a struct type.
-This is exposed to the client as a list of string, where each string
-signals that this build of QEMU shows a certain behaviour.
+For this purpose, a list of features can be specified for a command or
+struct type.  This is exposed to the client as a list of strings,
+where each string signals that this build of QEMU shows a certain
+behaviour.
 
 Each member of the 'features' array defines a feature.  It can either
 be { 'name': STRING, '*if': COND }, or STRING, which is shorthand for
diff --git a/hw/Kconfig b/hw/Kconfig
index b45db3c813..4b53fee4d0 100644
--- a/hw/Kconfig
+++ b/hw/Kconfig
@@ -27,6 +27,7 @@ source pci-host/Kconfig
 source pcmcia/Kconfig
 source pci/Kconfig
 source rdma/Kconfig
+source rtc/Kconfig
 source scsi/Kconfig
 source sd/Kconfig
 source semihosting/Kconfig
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index ece6cc3755..fd9750e5f2 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -26,6 +26,7 @@ devices-dirs-y += nvram/
 devices-dirs-y += pci/
 devices-dirs-$(CONFIG_PCI) += pci-bridge/ pci-host/
 devices-dirs-y += pcmcia/
+devices-dirs-y += rtc/
 devices-dirs-$(CONFIG_SCSI) += scsi/
 devices-dirs-y += sd/
 devices-dirs-y += ssi/
diff --git a/hw/alpha/dp264.c b/hw/alpha/dp264.c
index 51feee8558..51b3cf7a61 100644
--- a/hw/alpha/dp264.c
+++ b/hw/alpha/dp264.c
@@ -14,7 +14,7 @@
 #include "alpha_sys.h"
 #include "qemu/error-report.h"
 #include "sysemu/sysemu.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/ide.h"
 #include "hw/timer/i8254.h"
 #include "hw/isa/superio.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 52993f84b4..028191ff36 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -88,6 +88,10 @@ struct AspeedBoardState {
 /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
 #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 
+/* AST2600 evb hardware value */
+#define AST2600_EVB_HW_STRAP1 0x000000C0
+#define AST2600_EVB_HW_STRAP2 0x00000003
+
 /*
  * The max ram region is for firmwares that scan the address space
  * with load/store to guess how much RAM the SoC has.
@@ -187,6 +191,8 @@ static void aspeed_board_init(MachineState *machine,
                              &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), cfg->hw_strap1, "hw-strap1",
                             &error_abort);
+    object_property_set_int(OBJECT(&bmc->soc), cfg->hw_strap2, "hw-strap2",
+                            &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), cfg->num_cs, "num-cs",
                             &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
@@ -308,6 +314,12 @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 }
 
+static void ast2600_evb_i2c_init(AspeedBoardState *bmc)
+{
+    /* Start with some devices on our I2C busses */
+    ast2500_evb_i2c_init(bmc);
+}
+
 static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -455,6 +467,17 @@ static const AspeedBoardConfig aspeed_boards[] = {
         .num_cs    = 2,
         .i2c_init  = witherspoon_bmc_i2c_init,
         .ram       = 512 * MiB,
+    }, {
+        .name      = MACHINE_TYPE_NAME("ast2600-evb"),
+        .desc      = "Aspeed AST2600 EVB (Cortex A7)",
+        .soc_name  = "ast2600-a0",
+        .hw_strap1 = AST2600_EVB_HW_STRAP1,
+        .hw_strap2 = AST2600_EVB_HW_STRAP2,
+        .fmc_model = "w25q512jv",
+        .spi_model = "mx66u51235f",
+        .num_cs    = 1,
+        .i2c_init  = ast2600_evb_i2c_init,
+        .ram       = 1 * GiB,
     },
 };
 
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index fdcf616c56..17207ae07e 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -58,6 +58,10 @@ static void bcm2835_peripherals_init(Object *obj)
     /* Interrupt Controller */
     sysbus_init_child_obj(obj, "ic", &s->ic, sizeof(s->ic), TYPE_BCM2835_IC);
 
+    /* SYS Timer */
+    sysbus_init_child_obj(obj, "systimer", &s->systmr, sizeof(s->systmr),
+                          TYPE_BCM2835_SYSTIMER);
+
     /* UART0 */
     sysbus_init_child_obj(obj, "uart0", &s->uart0, sizeof(s->uart0),
                           TYPE_PL011);
@@ -111,6 +115,10 @@ static void bcm2835_peripherals_init(Object *obj)
     object_property_add_const_link(OBJECT(&s->dma), "dma-mr",
                                    OBJECT(&s->gpu_bus_mr), &error_abort);
 
+    /* Thermal */
+    sysbus_init_child_obj(obj, "thermal", &s->thermal, sizeof(s->thermal),
+                          TYPE_BCM2835_THERMAL);
+
     /* GPIO */
     sysbus_init_child_obj(obj, "gpio", &s->gpio, sizeof(s->gpio),
                           TYPE_BCM2835_GPIO);
@@ -167,6 +175,18 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->ic), 0));
     sysbus_pass_irq(SYS_BUS_DEVICE(s), SYS_BUS_DEVICE(&s->ic));
 
+    /* Sys Timer */
+    object_property_set_bool(OBJECT(&s->systmr), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(&s->peri_mr, ST_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systmr), 0));
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->systmr), 0,
+        qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_ARM_IRQ,
+                               INTERRUPT_ARM_TIMER));
+
     /* UART0 */
     qdev_prop_set_chr(DEVICE(&s->uart0), "chardev", serial_hd(0));
     object_property_set_bool(OBJECT(&s->uart0), true, "realized", &err);
@@ -321,6 +341,15 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
                                                   INTERRUPT_DMA0 + n));
     }
 
+    /* THERMAL */
+    object_property_set_bool(OBJECT(&s->thermal), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(&s->peri_mr, THERMAL_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->thermal), 0));
+
     /* GPIO */
     object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
     if (err) {
@@ -339,7 +368,6 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     }
 
     create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
-    create_unimp(s, &s->systmr, "bcm2835-systimer", ST_OFFSET, 0x20);
     create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
     create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
     create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 723aef6bf5..221ff06895 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -16,15 +16,11 @@
 #include "hw/arm/raspi_platform.h"
 #include "hw/sysbus.h"
 
-/* Peripheral base address seen by the CPU */
-#define BCM2836_PERI_BASE       0x3F000000
-
-/* "QA7" (Pi2) interrupt controller and mailboxes etc. */
-#define BCM2836_CONTROL_BASE    0x40000000
-
 struct BCM283XInfo {
     const char *name;
     const char *cpu_type;
+    hwaddr peri_base; /* Peripheral base address seen by the CPU */
+    hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
     int clusterid;
 };
 
@@ -32,12 +28,16 @@ static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
         .cpu_type = ARM_CPU_TYPE_NAME("cortex-a7"),
+        .peri_base = 0x3f000000,
+        .ctrl_base = 0x40000000,
         .clusterid = 0xf,
     },
 #ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
         .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
+        .peri_base = 0x3f000000,
+        .ctrl_base = 0x40000000,
         .clusterid = 0x0,
     },
 #endif
@@ -51,8 +51,9 @@ static void bcm2836_init(Object *obj)
     int n;
 
     for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize_child(obj, "cpu[*]", &s->cpus[n], sizeof(s->cpus[n]),
-                                info->cpu_type, &error_abort, NULL);
+        object_initialize_child(obj, "cpu[*]", &s->cpu[n].core,
+                                sizeof(s->cpu[n].core), info->cpu_type,
+                                &error_abort, NULL);
     }
 
     sysbus_init_child_obj(obj, "control", &s->control, sizeof(s->control),
@@ -104,7 +105,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     }
 
     sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->peripherals), 0,
-                            BCM2836_PERI_BASE, 1);
+                            info->peri_base, 1);
 
     /* bcm2836 interrupt controller (and mailboxes, etc.) */
     object_property_set_bool(OBJECT(&s->control), true, "realized", &err);
@@ -113,7 +114,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, BCM2836_CONTROL_BASE);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info->ctrl_base);
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-irq", 0));
@@ -122,11 +123,11 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     for (n = 0; n < BCM283X_NCPUS; n++) {
         /* TODO: this should be converted to a property of ARM_CPU */
-        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
+        s->cpu[n].core.mp_affinity = (info->clusterid << 8) | n;
 
         /* set periphbase/CBAR value for CPU-local registers */
-        object_property_set_int(OBJECT(&s->cpus[n]),
-                                BCM2836_PERI_BASE + MSYNC_OFFSET,
+        object_property_set_int(OBJECT(&s->cpu[n].core),
+                                info->peri_base,
                                 "reset-cbar", &err);
         if (err) {
             error_propagate(errp, err);
@@ -134,14 +135,15 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
         }
 
         /* start powered off if not enabled */
-        object_property_set_bool(OBJECT(&s->cpus[n]), n >= s->enabled_cpus,
+        object_property_set_bool(OBJECT(&s->cpu[n].core), n >= s->enabled_cpus,
                                  "start-powered-off", &err);
         if (err) {
             error_propagate(errp, err);
             return;
         }
 
-        object_property_set_bool(OBJECT(&s->cpus[n]), true, "realized", &err);
+        object_property_set_bool(OBJECT(&s->cpu[n].core), true,
+                                 "realized", &err);
         if (err) {
             error_propagate(errp, err);
             return;
@@ -149,18 +151,18 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
         /* Connect irq/fiq outputs from the interrupt controller. */
         qdev_connect_gpio_out_named(DEVICE(&s->control), "irq", n,
-                qdev_get_gpio_in(DEVICE(&s->cpus[n]), ARM_CPU_IRQ));
+                qdev_get_gpio_in(DEVICE(&s->cpu[n].core), ARM_CPU_IRQ));
         qdev_connect_gpio_out_named(DEVICE(&s->control), "fiq", n,
-                qdev_get_gpio_in(DEVICE(&s->cpus[n]), ARM_CPU_FIQ));
+                qdev_get_gpio_in(DEVICE(&s->cpu[n].core), ARM_CPU_FIQ));
 
         /* Connect timers from the CPU to the interrupt controller */
-        qdev_connect_gpio_out(DEVICE(&s->cpus[n]), GTIMER_PHYS,
+        qdev_connect_gpio_out(DEVICE(&s->cpu[n].core), GTIMER_PHYS,
                 qdev_get_gpio_in_named(DEVICE(&s->control), "cntpnsirq", n));
-        qdev_connect_gpio_out(DEVICE(&s->cpus[n]), GTIMER_VIRT,
+        qdev_connect_gpio_out(DEVICE(&s->cpu[n].core), GTIMER_VIRT,
                 qdev_get_gpio_in_named(DEVICE(&s->control), "cntvirq", n));
-        qdev_connect_gpio_out(DEVICE(&s->cpus[n]), GTIMER_HYP,
+        qdev_connect_gpio_out(DEVICE(&s->cpu[n].core), GTIMER_HYP,
                 qdev_get_gpio_in_named(DEVICE(&s->control), "cnthpirq", n));
-        qdev_connect_gpio_out(DEVICE(&s->cpus[n]), GTIMER_SEC,
+        qdev_connect_gpio_out(DEVICE(&s->cpu[n].core), GTIMER_SEC,
                 qdev_get_gpio_in_named(DEVICE(&s->control), "cntpsirq", n));
     }
 }
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index b1288ccea8..970a4405cc 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -27,9 +27,13 @@ static void collie_init(MachineState *machine)
 {
     StrongARMState *s;
     DriveInfo *dinfo;
-    MemoryRegion *sysmem = get_system_memory();
+    MemoryRegion *sdram = g_new(MemoryRegion, 1);
 
-    s = sa1110_init(sysmem, collie_binfo.ram_size, machine->cpu_type);
+    s = sa1110_init(machine->cpu_type);
+
+    memory_region_allocate_system_memory(sdram, NULL, "strongarm.sdram",
+                                         collie_binfo.ram_size);
+    memory_region_add_subregion(get_system_memory(), SA_SDCS0, sdram);
 
     dinfo = drive_get(IF_PFLASH, 0, 0);
     pflash_cfi01_register(SA_CS0, "collie.fl1", 0x02000000,
diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
index 304e4d1a29..ef3fc2b6a5 100644
--- a/hw/arm/digic_boards.c
+++ b/hw/arm/digic_boards.c
@@ -53,12 +53,6 @@ typedef struct DigicBoard {
     const char *rom1_def_filename;
 } DigicBoard;
 
-static void digic4_board_setup_ram(DigicBoardState *s, hwaddr ram_size)
-{
-    memory_region_allocate_system_memory(&s->ram, NULL, "ram", ram_size);
-    memory_region_add_subregion(get_system_memory(), 0, &s->ram);
-}
-
 static void digic4_board_init(DigicBoard *board)
 {
     Error *err = NULL;
@@ -72,7 +66,8 @@ static void digic4_board_init(DigicBoard *board)
         exit(1);
     }
 
-    digic4_board_setup_ram(s, board->ram_size);
+    memory_region_allocate_system_memory(&s->ram, NULL, "ram", board->ram_size);
+    memory_region_add_subregion(get_system_memory(), 0, &s->ram);
 
     if (board->add_rom0) {
         board->add_rom0(s, DIGIC4_ROM0_BASE, board->rom0_def_filename);
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index a9f8a5c868..77fbe1baab 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -405,7 +405,7 @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
          * public datasheet which is very similar (implementing
          * MMC Specification Version 4.0 being the only difference noted)
          */
-        dev = qdev_create(NULL, TYPE_SYSBUS_SDHCI);
+        dev = qdev_create(NULL, TYPE_S3C_SDHCI);
         qdev_prop_set_uint64(dev, "capareg", EXYNOS4210_SDHCI_CAPABILITIES);
         qdev_init_nofail(dev);
 
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index f1724d6929..518d935fdf 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -78,7 +78,8 @@ static void hb_write_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
     for (n = 0; n < ARRAY_SIZE(smpboot); n++) {
         smpboot[n] = tswap32(smpboot[n]);
     }
-    rom_add_blob_fixed("smpboot", smpboot, sizeof(smpboot), SMP_BOOT_ADDR);
+    rom_add_blob_fixed_as("smpboot", smpboot, sizeof(smpboot), SMP_BOOT_ADDR,
+                          arm_boot_address_space(cpu, info));
 }
 
 static void hb_reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 6b24aaacde..f8b620bcc6 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -38,6 +38,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/arm/boot.h"
@@ -458,7 +459,7 @@ static void mps2tz_common_init(MachineState *machine)
      * call the 16MB our "system memory", as it's the largest lump.
      */
     memory_region_allocate_system_memory(&mms->psram,
-                                         NULL, "mps.ram", 0x01000000);
+                                         NULL, "mps.ram", 16 * MiB);
     memory_region_add_subregion(system_memory, 0x80000000, &mms->psram);
 
     /* The overflow IRQs for all UARTs are ORed together.
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index 10efff36b2..d002b126d3 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -23,6 +23,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/arm/boot.h"
@@ -146,7 +147,7 @@ static void mps2_common_init(MachineState *machine)
      * zbt_boot_ctrl is always zero).
      */
     memory_region_allocate_system_memory(&mms->psram,
-                                         NULL, "mps.ram", 0x1000000);
+                                         NULL, "mps.ram", 16 * MiB);
     memory_region_add_subregion(system_memory, 0x21000000, &mms->psram);
 
     switch (mmc->fpga_type) {
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index 68db4b5b38..ba99dd1941 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -32,7 +32,7 @@
 #include "hw/misc/tz-mpc.h"
 #include "hw/misc/tz-ppc.h"
 #include "hw/misc/unimp.h"
-#include "hw/timer/pl031.h"
+#include "hw/rtc/pl031.h"
 
 #define MUSCA_NUMIRQ_MAX 96
 #define MUSCA_PPC_MAX 3
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index a36971d39a..7e361936a9 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -47,6 +47,7 @@
 
 /* Nokia N8x0 support */
 struct n800_s {
+    MemoryRegion sdram;
     struct omap_mpu_state_s *mpu;
 
     struct rfbi_chip_s blizzard;
@@ -1311,11 +1312,14 @@ static int n810_atag_setup(const struct arm_boot_info *info, void *p)
 static void n8x0_init(MachineState *machine,
                       struct arm_boot_info *binfo, int model)
 {
-    MemoryRegion *sysmem = get_system_memory();
     struct n800_s *s = (struct n800_s *) g_malloc0(sizeof(*s));
-    int sdram_size = binfo->ram_size;
+    uint64_t sdram_size = binfo->ram_size;
 
-    s->mpu = omap2420_mpu_init(sysmem, sdram_size, machine->cpu_type);
+    memory_region_allocate_system_memory(&s->sdram, NULL, "omap2.dram",
+                                         sdram_size);
+    memory_region_add_subregion(get_system_memory(), OMAP2_Q2_BASE, &s->sdram);
+
+    s->mpu = omap2420_mpu_init(&s->sdram, machine->cpu_type);
 
     /* Setup peripherals
      *
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index 0400593805..6ce038a453 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -23,6 +23,7 @@
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "cpu.h"
+#include "exec/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
@@ -3858,8 +3859,7 @@ static int omap_validate_tipb_mpui_addr(struct omap_mpu_state_s *s,
     return range_covers_byte(0xe1010000, 0xe1020004 - 0xe1010000, addr);
 }
 
-struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
-                unsigned long sdram_size,
+struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *dram,
                 const char *cpu_type)
 {
     int i;
@@ -3867,11 +3867,12 @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
     qemu_irq dma_irqs[6];
     DriveInfo *dinfo;
     SysBusDevice *busdev;
+    MemoryRegion *system_memory = get_system_memory();
 
     /* Core */
     s->mpu_model = omap310;
     s->cpu = ARM_CPU(cpu_create(cpu_type));
-    s->sdram_size = sdram_size;
+    s->sdram_size = memory_region_size(dram);
     s->sram_size = OMAP15XX_SRAM_SIZE;
 
     s->wakeup = qemu_allocate_irq(omap_mpu_wakeup, s, 0);
@@ -3880,9 +3881,6 @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
     omap_clk_init(s);
 
     /* Memory-mapped stuff */
-    memory_region_allocate_system_memory(&s->emiff_ram, NULL, "omap1.dram",
-                                         s->sdram_size);
-    memory_region_add_subregion(system_memory, OMAP_EMIFF_BASE, &s->emiff_ram);
     memory_region_init_ram(&s->imif_ram, NULL, "omap1.sram", s->sram_size,
                            &error_fatal);
     memory_region_add_subregion(system_memory, OMAP_IMIF_BASE, &s->imif_ram);
@@ -3925,7 +3923,7 @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
     s->port[tipb_mpui].addr_valid = omap_validate_tipb_mpui_addr;
 
     /* Register SDRAM and SRAM DMA ports for fast transfers.  */
-    soc_dma_port_add_mem(s->dma, memory_region_get_ram_ptr(&s->emiff_ram),
+    soc_dma_port_add_mem(s->dma, memory_region_get_ram_ptr(dram),
                          OMAP_EMIFF_BASE, s->sdram_size);
     soc_dma_port_add_mem(s->dma, memory_region_get_ram_ptr(&s->imif_ram),
                          OMAP_IMIF_BASE, s->sram_size);
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index bd7ddff983..457f152bac 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -22,6 +22,7 @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#include "exec/address-spaces.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/qtest.h"
 #include "sysemu/reset.h"
@@ -2276,8 +2277,7 @@ static const struct dma_irq_map omap2_dma_irq_map[] = {
     { 0, OMAP_INT_24XX_SDMA_IRQ3 },
 };
 
-struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
-                unsigned long sdram_size,
+struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sdram,
                 const char *cpu_type)
 {
     struct omap_mpu_state_s *s = g_new0(struct omap_mpu_state_s, 1);
@@ -2286,11 +2286,11 @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
     int i;
     SysBusDevice *busdev;
     struct omap_target_agent_s *ta;
+    MemoryRegion *sysmem = get_system_memory();
 
     /* Core */
     s->mpu_model = omap2420;
     s->cpu = ARM_CPU(cpu_create(cpu_type));
-    s->sdram_size = sdram_size;
     s->sram_size = OMAP242X_SRAM_SIZE;
 
     s->wakeup = qemu_allocate_irq(omap_mpu_wakeup, s, 0);
@@ -2299,9 +2299,6 @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
     omap_clk_init(s);
 
     /* Memory-mapped stuff */
-    memory_region_allocate_system_memory(&s->sdram, NULL, "omap2.dram",
-                                         s->sdram_size);
-    memory_region_add_subregion(sysmem, OMAP2_Q2_BASE, &s->sdram);
     memory_region_init_ram(&s->sram, NULL, "omap2.sram", s->sram_size,
                            &error_fatal);
     memory_region_add_subregion(sysmem, OMAP2_SRAM_BASE, &s->sram);
@@ -2338,8 +2335,8 @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
     s->port->addr_valid = omap2_validate_addr;
 
     /* Register SDRAM and SRAM ports for fast DMA transfers.  */
-    soc_dma_port_add_mem(s->dma, memory_region_get_ram_ptr(&s->sdram),
-                         OMAP2_Q2_BASE, s->sdram_size);
+    soc_dma_port_add_mem(s->dma, memory_region_get_ram_ptr(sdram),
+                         OMAP2_Q2_BASE, memory_region_size(sdram));
     soc_dma_port_add_mem(s->dma, memory_region_get_ram_ptr(&s->sram),
                          OMAP2_SRAM_BASE, s->sram_size);
 
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index c071197be7..be245714db 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -103,6 +103,7 @@ static void sx1_init(MachineState *machine, const int version)
 {
     struct omap_mpu_state_s *mpu;
     MemoryRegion *address_space = get_system_memory();
+    MemoryRegion *dram = g_new(MemoryRegion, 1);
     MemoryRegion *flash = g_new(MemoryRegion, 1);
     MemoryRegion *cs = g_new(MemoryRegion, 4);
     static uint32_t cs0val = 0x00213090;
@@ -118,8 +119,11 @@ static void sx1_init(MachineState *machine, const int version)
         flash_size = flash2_size;
     }
 
-    mpu = omap310_mpu_init(address_space, sx1_binfo.ram_size,
-                           machine->cpu_type);
+    memory_region_allocate_system_memory(dram, NULL, "omap1.dram",
+                                         sx1_binfo.ram_size);
+    memory_region_add_subregion(address_space, OMAP_EMIFF_BASE, dram);
+
+    mpu = omap310_mpu_init(dram, machine->cpu_type);
 
     /* External Flash (EMIFS) */
     memory_region_init_ram(flash, NULL, "omap_sx1.flash0-0", flash_size,
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index 02a3a82b9b..72eca8cc55 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -190,16 +190,20 @@ static void palmte_init(MachineState *machine)
     MemoryRegion *address_space_mem = get_system_memory();
     struct omap_mpu_state_s *mpu;
     int flash_size = 0x00800000;
-    int sdram_size = palmte_binfo.ram_size;
     static uint32_t cs0val = 0xffffffff;
     static uint32_t cs1val = 0x0000e1a0;
     static uint32_t cs2val = 0x0000e1a0;
     static uint32_t cs3val = 0xe1a0e1a0;
     int rom_size, rom_loaded = 0;
+    MemoryRegion *dram = g_new(MemoryRegion, 1);
     MemoryRegion *flash = g_new(MemoryRegion, 1);
     MemoryRegion *cs = g_new(MemoryRegion, 4);
 
-    mpu = omap310_mpu_init(address_space_mem, sdram_size, machine->cpu_type);
+    memory_region_allocate_system_memory(dram, NULL, "omap1.dram",
+                                         palmte_binfo.ram_size);
+    memory_region_add_subregion(address_space_mem, OMAP_EMIFF_BASE, dram);
+
+    mpu = omap310_mpu_init(dram, machine->cpu_type);
 
     /* External Flash (EMIFS) */
     memory_region_init_ram(flash, NULL, "palmte.flash", flash_size,
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 615d755879..6a510aafc1 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -60,12 +60,14 @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
     QEMU_BUILD_BUG_ON((BOARDSETUP_ADDR & 0xf) != 0
                       || (BOARDSETUP_ADDR >> 4) >= 0x100);
 
-    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
-                       info->smp_loader_start);
+    rom_add_blob_fixed_as("raspi_smpboot", smpboot, sizeof(smpboot),
+                          info->smp_loader_start,
+                          arm_boot_address_space(cpu, info));
 }
 
 static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
 {
+    AddressSpace *as = arm_boot_address_space(cpu, info);
     /* Unlike the AArch32 version we don't need to call the board setup hook.
      * The mechanism for doing the spin-table is also entirely different.
      * We must have four 64-bit fields at absolute addresses
@@ -92,10 +94,10 @@ static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
         0, 0, 0, 0
     };
 
-    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
-                       info->smp_loader_start);
-    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
-                       SPINTABLE_ADDR);
+    rom_add_blob_fixed_as("raspi_smpboot", smpboot, sizeof(smpboot),
+                          info->smp_loader_start, as);
+    rom_add_blob_fixed_as("raspi_spintables", spintables, sizeof(spintables),
+                          SPINTABLE_ADDR, as);
 }
 
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index dc65d88a65..6bee034914 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -1586,8 +1586,7 @@ static const TypeInfo strongarm_ssp_info = {
 };
 
 /* Main CPU functions */
-StrongARMState *sa1110_init(MemoryRegion *sysmem,
-                            unsigned int sdram_size, const char *cpu_type)
+StrongARMState *sa1110_init(const char *cpu_type)
 {
     StrongARMState *s;
     int i;
@@ -1601,10 +1600,6 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
 
     s->cpu = ARM_CPU(cpu_create(cpu_type));
 
-    memory_region_allocate_system_memory(&s->sdram, NULL, "strongarm.sdram",
-                                         sdram_size);
-    memory_region_add_subregion(sysmem, SA_SDCS0, &s->sdram);
-
     s->pic = sysbus_create_varargs("strongarm_pic", 0x90050000,
                     qdev_get_gpio_in(DEVICE(s->cpu), ARM_CPU_IRQ),
                     qdev_get_gpio_in(DEVICE(s->cpu), ARM_CPU_FIQ),
diff --git a/hw/arm/strongarm.h b/hw/arm/strongarm.h
index e98840b461..192821f6aa 100644
--- a/hw/arm/strongarm.h
+++ b/hw/arm/strongarm.h
@@ -55,7 +55,6 @@ enum {
 
 typedef struct {
     ARMCPU *cpu;
-    MemoryRegion sdram;
     DeviceState *pic;
     DeviceState *gpio;
     DeviceState *ppc;
@@ -63,7 +62,6 @@ typedef struct {
     SSIBus *ssp_bus;
 } StrongARMState;
 
-StrongARMState *sa1110_init(MemoryRegion *sysmem,
-                            unsigned int sdram_size, const char *rev);
+StrongARMState *sa1110_init(const char *cpu_type);
 
 #endif
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index c14774e542..3a0fa5b23f 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -16,6 +16,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
@@ -194,7 +195,7 @@ static void zynq_init(MachineState *machine)
     memory_region_add_subregion(address_space_mem, 0, ext_ram);
 
     /* 256K of on-chip memory */
-    memory_region_init_ram(ocm_ram, NULL, "zynq.ocm_ram", 256 << 10,
+    memory_region_init_ram(ocm_ram, NULL, "zynq.ocm_ram", 256 * KiB,
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, 0xFFFC0000, ocm_ram);
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index ed2ddebd2b..14e9f85b8b 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -1207,6 +1207,7 @@ static void virtio_blk_device_unrealize(DeviceState *dev, Error **errp)
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOBlock *s = VIRTIO_BLK(dev);
 
+    blk_drain(s->blk);
     virtio_blk_data_plane_destroy(s->dataplane);
     s->dataplane = NULL;
     qemu_del_vm_change_state_handler(s->change);
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index e035d1f750..fb3a978e28 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -31,7 +31,6 @@
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 #include "hw/stream.h"
@@ -104,7 +103,6 @@ enum {
 };
 
 struct Stream {
-    QEMUBH *bh;
     ptimer_state *ptimer;
     qemu_irq irq;
 
@@ -242,6 +240,7 @@ static void stream_complete(struct Stream *s)
     unsigned int comp_delay;
 
     /* Start the delayed timer.  */
+    ptimer_transaction_begin(s->ptimer);
     comp_delay = s->regs[R_DMACR] >> 24;
     if (comp_delay) {
         ptimer_stop(s->ptimer);
@@ -255,6 +254,7 @@ static void stream_complete(struct Stream *s)
         s->regs[R_DMASR] |= DMASR_IOC_IRQ;
         stream_reload_complete_cnt(s);
     }
+    ptimer_transaction_commit(s->ptimer);
 }
 
 static void stream_process_mem2s(struct Stream *s, StreamSlave *tx_data_dev,
@@ -551,9 +551,10 @@ static void xilinx_axidma_realize(DeviceState *dev, Error **errp)
         struct Stream *st = &s->streams[i];
 
         st->nr = i;
-        st->bh = qemu_bh_new(timer_hit, st);
-        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
+        st->ptimer = ptimer_init(timer_hit, st, PTIMER_POLICY_DEFAULT);
+        ptimer_transaction_begin(st->ptimer);
         ptimer_set_freq(st->ptimer, s->freqhz);
+        ptimer_transaction_commit(st->ptimer);
     }
     return;
 
diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index 196e47c262..7acc5fa8e2 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -733,13 +733,13 @@ static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
 {
     int pin = 0xfff;
     bool level = true;
-    char group[3];
+    char group[4];
     AspeedGPIOState *s = ASPEED_GPIO(obj);
     int set_idx, group_idx = 0;
 
     if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
         /* 1.8V gpio */
-        if (sscanf(name, "gpio%3s%1d", group, &pin) != 2) {
+        if (sscanf(name, "gpio%3[18A-E]%1d", group, &pin) != 2) {
             error_setg(errp, "%s: error reading %s", __func__, name);
             return;
         }
@@ -760,7 +760,7 @@ static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
     Error *local_err = NULL;
     bool level;
     int pin = 0xfff;
-    char group[3];
+    char group[4];
     AspeedGPIOState *s = ASPEED_GPIO(obj);
     int set_idx, group_idx = 0;
 
@@ -771,7 +771,7 @@ static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
     }
     if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
         /* 1.8V gpio */
-        if (sscanf(name, "gpio%3s%1d", group, &pin) != 2) {
+        if (sscanf(name, "gpio%3[18A-E]%1d", group, &pin) != 2) {
             error_setg(errp, "%s: error reading %s", __func__, name);
             return;
         }
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 7e23675429..b30aba6d54 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -12,7 +12,7 @@
 #include "qemu/error-report.h"
 #include "sysemu/reset.h"
 #include "sysemu/sysemu.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/ide.h"
 #include "hw/timer/i8254.h"
 #include "hw/char/serial.h"
@@ -161,9 +161,8 @@ static void machine_hppa_init(MachineState *machine)
     g_free(firmware_filename);
 
     rom_region = g_new(MemoryRegion, 1);
-    memory_region_allocate_system_memory(rom_region, OBJECT(machine),
-                                         "firmware",
-                                         (FIRMWARE_END - FIRMWARE_START));
+    memory_region_init_ram(rom_region, NULL, "firmware",
+                           (FIRMWARE_END - FIRMWARE_START), &error_fatal);
     memory_region_add_subregion(addr_space, FIRMWARE_START, rom_region);
 
     /* Load kernel */
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index bc0256e1e0..9dd3dbb16c 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -45,7 +45,7 @@
 #include "hw/acpi/vmgenid.h"
 #include "hw/boards.h"
 #include "sysemu/tpm_backend.h"
-#include "hw/timer/mc146818rtc_regs.h"
+#include "hw/rtc/mc146818rtc_regs.h"
 #include "migration/vmstate.h"
 #include "hw/mem/memory-device.h"
 #include "sysemu/numa.h"
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index 20d2189ea8..8aacd6c8d1 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -35,7 +35,7 @@
 #include "hw/i386/pc.h"
 #include "target/i386/cpu.h"
 #include "hw/timer/i8254.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/char/serial.h"
 #include "hw/i386/topology.h"
 #include "hw/i386/e820_memory_layout.h"
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 5fce60c856..b8f02c6f3f 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -43,7 +43,7 @@
 #include "elf.h"
 #include "migration/vmstate.h"
 #include "multiboot.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/dma/i8257.h"
 #include "hw/timer/i8254.h"
 #include "hw/input/i8042.h"
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index def3bc2d7b..d8b4c48021 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -33,7 +33,7 @@
 #include "hw/loader.h"
 #include "sysemu/arch_init.h"
 #include "hw/i2c/smbus_eeprom.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/xen/xen.h"
 #include "sysemu/kvm.h"
 #include "hw/kvm/clock.h"
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 8e93e51e81..e8c74f9eba 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -2251,7 +2251,7 @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
             }
         }
         nvic_irq_update(s);
-        return MEMTX_OK;
+        goto exit_ok;
     case 0x200 ... 0x23f: /* NVIC Set pend */
         /* the special logic in armv7m_nvic_set_pending()
          * is not needed since IRQs are never escalated
@@ -2269,9 +2269,9 @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
             }
         }
         nvic_irq_update(s);
-        return MEMTX_OK;
+        goto exit_ok;
     case 0x300 ... 0x33f: /* NVIC Active */
-        return MEMTX_OK; /* R/O */
+        goto exit_ok; /* R/O */
     case 0x400 ... 0x5ef: /* NVIC Priority */
         startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
 
@@ -2281,10 +2281,10 @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
             }
         }
         nvic_irq_update(s);
-        return MEMTX_OK;
+        goto exit_ok;
     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
-            return MEMTX_OK;
+            goto exit_ok;
         }
         /* fall through */
     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
@@ -2299,10 +2299,10 @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
             set_prio(s, hdlidx, sbank, newprio);
         }
         nvic_irq_update(s);
-        return MEMTX_OK;
+        goto exit_ok;
     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
-            return MEMTX_OK;
+            goto exit_ok;
         }
         /* All bits are W1C, so construct 32 bit value with 0s in
          * the parts not written by the access size
@@ -2322,15 +2322,19 @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
              */
             s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
         }
-        return MEMTX_OK;
+        goto exit_ok;
     }
     if (size == 4) {
         nvic_writel(s, offset, value, attrs);
-        return MEMTX_OK;
+        goto exit_ok;
     }
     qemu_log_mask(LOG_GUEST_ERROR,
                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
     /* This is UNPREDICTABLE; treat as RAZ/WI */
+
+ exit_ok:
+    /* Ensure any changes made are reflected in the cached hflags.  */
+    arm_rebuild_hflags(&s->cpu->env);
     return MEMTX_OK;
 }
 
diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index ed6e9d71bb..348f2fdd26 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -385,7 +385,7 @@ static int pnv_xive_get_eas(XiveRouter *xrtr, uint8_t blk, uint32_t idx,
     PnvXive *xive = PNV_XIVE(xrtr);
 
     if (pnv_xive_get_ic(blk) != xive) {
-        xive_error(xive, "VST: EAS %x is remote !?", XIVE_SRCNO(blk, idx));
+        xive_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
         return -1;
     }
 
@@ -431,7 +431,7 @@ static void pnv_xive_notify(XiveNotifier *xn, uint32_t srcno)
     PnvXive *xive = PNV_XIVE(xn);
     uint8_t blk = xive->chip->chip_id;
 
-    xive_router_notify(xn, XIVE_SRCNO(blk, srcno));
+    xive_router_notify(xn, XIVE_EAS(blk, srcno));
 }
 
 /*
@@ -1225,12 +1225,24 @@ static const MemoryRegionOps pnv_xive_ic_reg_ops = {
 
 static void pnv_xive_ic_hw_trigger(PnvXive *xive, hwaddr addr, uint64_t val)
 {
+    uint8_t blk;
+    uint32_t idx;
+
+    if (val & XIVE_TRIGGER_END) {
+        xive_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
+                   addr, val);
+        return;
+    }
+
     /*
      * Forward the source event notification directly to the Router.
      * The source interrupt number should already be correctly encoded
      * with the chip block id by the sending device (PHB, PSI).
      */
-    xive_router_notify(XIVE_NOTIFIER(xive), val);
+    blk = XIVE_EAS_BLOCK(val);
+    idx = XIVE_EAS_INDEX(val);
+
+    xive_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx));
 }
 
 static void pnv_xive_ic_notify_write(void *opaque, hwaddr addr, uint64_t val,
@@ -1566,7 +1578,7 @@ void pnv_xive_pic_print_info(PnvXive *xive, Monitor *mon)
 {
     XiveRouter *xrtr = XIVE_ROUTER(xive);
     uint8_t blk = xive->chip->chip_id;
-    uint32_t srcno0 = XIVE_SRCNO(blk, 0);
+    uint32_t srcno0 = XIVE_EAS(blk, 0);
     uint32_t nr_ipis = pnv_xive_nr_ipis(xive);
     uint32_t nr_ends = pnv_xive_nr_ends(xive);
     XiveEAS eas;
diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index 04879abf2e..d8e1291905 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -205,23 +205,6 @@ void spapr_xive_mmio_set_enabled(SpaprXive *xive, bool enable)
     memory_region_set_enabled(&xive->end_source.esb_mmio, false);
 }
 
-/*
- * When a Virtual Processor is scheduled to run on a HW thread, the
- * hypervisor pushes its identifier in the OS CAM line. Emulate the
- * same behavior under QEMU.
- */
-void spapr_xive_set_tctx_os_cam(XiveTCTX *tctx)
-{
-    uint8_t  nvt_blk;
-    uint32_t nvt_idx;
-    uint32_t nvt_cam;
-
-    spapr_xive_cpu_to_nvt(POWERPC_CPU(tctx->cs), &nvt_blk, &nvt_idx);
-
-    nvt_cam = cpu_to_be32(TM_QW1W2_VO | xive_nvt_cam_line(nvt_blk, nvt_idx));
-    memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &nvt_cam, 4);
-}
-
 static void spapr_xive_end_reset(XiveEND *end)
 {
     memset(end, 0, sizeof(*end));
@@ -462,10 +445,10 @@ static int vmstate_spapr_xive_pre_save(void *opaque)
  * Called by the sPAPR IRQ backend 'post_load' method at the machine
  * level.
  */
-int spapr_xive_post_load(SpaprXive *xive, int version_id)
+static int spapr_xive_post_load(SpaprInterruptController *intc, int version_id)
 {
     if (kvm_irqchip_in_kernel()) {
-        return kvmppc_xive_post_load(xive, version_id);
+        return kvmppc_xive_post_load(SPAPR_XIVE(intc), version_id);
     }
 
     return 0;
@@ -487,6 +470,42 @@ static const VMStateDescription vmstate_spapr_xive = {
     },
 };
 
+static int spapr_xive_claim_irq(SpaprInterruptController *intc, int lisn,
+                                bool lsi, Error **errp)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+    XiveSource *xsrc = &xive->source;
+
+    assert(lisn < xive->nr_irqs);
+
+    if (xive_eas_is_valid(&xive->eat[lisn])) {
+        error_setg(errp, "IRQ %d is not free", lisn);
+        return -EBUSY;
+    }
+
+    /*
+     * Set default values when allocating an IRQ number
+     */
+    xive->eat[lisn].w |= cpu_to_be64(EAS_VALID | EAS_MASKED);
+    if (lsi) {
+        xive_source_irq_set_lsi(xsrc, lisn);
+    }
+
+    if (kvm_irqchip_in_kernel()) {
+        return kvmppc_xive_source_reset_one(xsrc, lisn, errp);
+    }
+
+    return 0;
+}
+
+static void spapr_xive_free_irq(SpaprInterruptController *intc, int lisn)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+    assert(lisn < xive->nr_irqs);
+
+    xive->eat[lisn].w &= cpu_to_be64(~EAS_VALID);
+}
+
 static Property spapr_xive_properties[] = {
     DEFINE_PROP_UINT32("nr-irqs", SpaprXive, nr_irqs, 0),
     DEFINE_PROP_UINT32("nr-ends", SpaprXive, nr_ends, 0),
@@ -495,10 +514,167 @@ static Property spapr_xive_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static int spapr_xive_cpu_intc_create(SpaprInterruptController *intc,
+                                      PowerPCCPU *cpu, Error **errp)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+    Object *obj;
+    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
+
+    obj = xive_tctx_create(OBJECT(cpu), XIVE_ROUTER(xive), errp);
+    if (!obj) {
+        return -1;
+    }
+
+    spapr_cpu->tctx = XIVE_TCTX(obj);
+    return 0;
+}
+
+static void xive_tctx_set_os_cam(XiveTCTX *tctx, uint32_t os_cam)
+{
+    uint32_t qw1w2 = cpu_to_be32(TM_QW1W2_VO | os_cam);
+    memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1w2, 4);
+}
+
+static void spapr_xive_cpu_intc_reset(SpaprInterruptController *intc,
+                                     PowerPCCPU *cpu)
+{
+    XiveTCTX *tctx = spapr_cpu_state(cpu)->tctx;
+    uint8_t  nvt_blk;
+    uint32_t nvt_idx;
+
+    xive_tctx_reset(tctx);
+
+    /*
+     * When a Virtual Processor is scheduled to run on a HW thread,
+     * the hypervisor pushes its identifier in the OS CAM line.
+     * Emulate the same behavior under QEMU.
+     */
+    spapr_xive_cpu_to_nvt(cpu, &nvt_blk, &nvt_idx);
+
+    xive_tctx_set_os_cam(tctx, xive_nvt_cam_line(nvt_blk, nvt_idx));
+}
+
+static void spapr_xive_set_irq(SpaprInterruptController *intc, int irq, int val)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+
+    if (kvm_irqchip_in_kernel()) {
+        kvmppc_xive_source_set_irq(&xive->source, irq, val);
+    } else {
+        xive_source_set_irq(&xive->source, irq, val);
+    }
+}
+
+static void spapr_xive_print_info(SpaprInterruptController *intc, Monitor *mon)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+    CPUState *cs;
+
+    CPU_FOREACH(cs) {
+        PowerPCCPU *cpu = POWERPC_CPU(cs);
+
+        xive_tctx_pic_print_info(spapr_cpu_state(cpu)->tctx, mon);
+    }
+
+    spapr_xive_pic_print_info(xive, mon);
+}
+
+static void spapr_xive_dt(SpaprInterruptController *intc, uint32_t nr_servers,
+                          void *fdt, uint32_t phandle)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+    int node;
+    uint64_t timas[2 * 2];
+    /* Interrupt number ranges for the IPIs */
+    uint32_t lisn_ranges[] = {
+        cpu_to_be32(0),
+        cpu_to_be32(nr_servers),
+    };
+    /*
+     * EQ size - the sizes of pages supported by the system 4K, 64K,
+     * 2M, 16M. We only advertise 64K for the moment.
+     */
+    uint32_t eq_sizes[] = {
+        cpu_to_be32(16), /* 64K */
+    };
+    /*
+     * The following array is in sync with the reserved priorities
+     * defined by the 'spapr_xive_priority_is_reserved' routine.
+     */
+    uint32_t plat_res_int_priorities[] = {
+        cpu_to_be32(7),    /* start */
+        cpu_to_be32(0xf8), /* count */
+    };
+
+    /* Thread Interrupt Management Area : User (ring 3) and OS (ring 2) */
+    timas[0] = cpu_to_be64(xive->tm_base +
+                           XIVE_TM_USER_PAGE * (1ull << TM_SHIFT));
+    timas[1] = cpu_to_be64(1ull << TM_SHIFT);
+    timas[2] = cpu_to_be64(xive->tm_base +
+                           XIVE_TM_OS_PAGE * (1ull << TM_SHIFT));
+    timas[3] = cpu_to_be64(1ull << TM_SHIFT);
+
+    _FDT(node = fdt_add_subnode(fdt, 0, xive->nodename));
+
+    _FDT(fdt_setprop_string(fdt, node, "device_type", "power-ivpe"));
+    _FDT(fdt_setprop(fdt, node, "reg", timas, sizeof(timas)));
+
+    _FDT(fdt_setprop_string(fdt, node, "compatible", "ibm,power-ivpe"));
+    _FDT(fdt_setprop(fdt, node, "ibm,xive-eq-sizes", eq_sizes,
+                     sizeof(eq_sizes)));
+    _FDT(fdt_setprop(fdt, node, "ibm,xive-lisn-ranges", lisn_ranges,
+                     sizeof(lisn_ranges)));
+
+    /* For Linux to link the LSIs to the interrupt controller. */
+    _FDT(fdt_setprop(fdt, node, "interrupt-controller", NULL, 0));
+    _FDT(fdt_setprop_cell(fdt, node, "#interrupt-cells", 2));
+
+    /* For SLOF */
+    _FDT(fdt_setprop_cell(fdt, node, "linux,phandle", phandle));
+    _FDT(fdt_setprop_cell(fdt, node, "phandle", phandle));
+
+    /*
+     * The "ibm,plat-res-int-priorities" property defines the priority
+     * ranges reserved by the hypervisor
+     */
+    _FDT(fdt_setprop(fdt, 0, "ibm,plat-res-int-priorities",
+                     plat_res_int_priorities, sizeof(plat_res_int_priorities)));
+}
+
+static int spapr_xive_activate(SpaprInterruptController *intc, Error **errp)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+
+    if (kvm_enabled()) {
+        int rc = spapr_irq_init_kvm(kvmppc_xive_connect, intc, errp);
+        if (rc < 0) {
+            return rc;
+        }
+    }
+
+    /* Activate the XIVE MMIOs */
+    spapr_xive_mmio_set_enabled(xive, true);
+
+    return 0;
+}
+
+static void spapr_xive_deactivate(SpaprInterruptController *intc)
+{
+    SpaprXive *xive = SPAPR_XIVE(intc);
+
+    spapr_xive_mmio_set_enabled(xive, false);
+
+    if (kvm_irqchip_in_kernel()) {
+        kvmppc_xive_disconnect(intc);
+    }
+}
+
 static void spapr_xive_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XiveRouterClass *xrc = XIVE_ROUTER_CLASS(klass);
+    SpaprInterruptControllerClass *sicc = SPAPR_INTC_CLASS(klass);
 
     dc->desc    = "sPAPR XIVE Interrupt Controller";
     dc->props   = spapr_xive_properties;
@@ -511,6 +687,17 @@ static void spapr_xive_class_init(ObjectClass *klass, void *data)
     xrc->get_nvt = spapr_xive_get_nvt;
     xrc->write_nvt = spapr_xive_write_nvt;
     xrc->get_tctx = spapr_xive_get_tctx;
+
+    sicc->activate = spapr_xive_activate;
+    sicc->deactivate = spapr_xive_deactivate;
+    sicc->cpu_intc_create = spapr_xive_cpu_intc_create;
+    sicc->cpu_intc_reset = spapr_xive_cpu_intc_reset;
+    sicc->claim_irq = spapr_xive_claim_irq;
+    sicc->free_irq = spapr_xive_free_irq;
+    sicc->set_irq = spapr_xive_set_irq;
+    sicc->print_info = spapr_xive_print_info;
+    sicc->dt = spapr_xive_dt;
+    sicc->post_load = spapr_xive_post_load;
 }
 
 static const TypeInfo spapr_xive_info = {
@@ -519,6 +706,10 @@ static const TypeInfo spapr_xive_info = {
     .instance_init = spapr_xive_instance_init,
     .instance_size = sizeof(SpaprXive),
     .class_init = spapr_xive_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        { TYPE_SPAPR_INTC },
+        { }
+    },
 };
 
 static void spapr_xive_register_types(void)
@@ -528,39 +719,6 @@ static void spapr_xive_register_types(void)
 
 type_init(spapr_xive_register_types)
 
-int spapr_xive_irq_claim(SpaprXive *xive, int lisn, bool lsi, Error **errp)
-{
-    XiveSource *xsrc = &xive->source;
-
-    assert(lisn < xive->nr_irqs);
-
-    if (xive_eas_is_valid(&xive->eat[lisn])) {
-        error_setg(errp, "IRQ %d is not free", lisn);
-        return -EBUSY;
-    }
-
-    /*
-     * Set default values when allocating an IRQ number
-     */
-    xive->eat[lisn].w |= cpu_to_be64(EAS_VALID | EAS_MASKED);
-    if (lsi) {
-        xive_source_irq_set_lsi(xsrc, lisn);
-    }
-
-    if (kvm_irqchip_in_kernel()) {
-        return kvmppc_xive_source_reset_one(xsrc, lisn, errp);
-    }
-
-    return 0;
-}
-
-void spapr_xive_irq_free(SpaprXive *xive, int lisn)
-{
-    assert(lisn < xive->nr_irqs);
-
-    xive->eat[lisn].w &= cpu_to_be64(~EAS_VALID);
-}
-
 /*
  * XIVE hcalls
  *
@@ -1540,65 +1698,3 @@ void spapr_xive_hcall_init(SpaprMachineState *spapr)
     spapr_register_hypercall(H_INT_SYNC, h_int_sync);
     spapr_register_hypercall(H_INT_RESET, h_int_reset);
 }
-
-void spapr_dt_xive(SpaprMachineState *spapr, uint32_t nr_servers, void *fdt,
-                   uint32_t phandle)
-{
-    SpaprXive *xive = spapr->xive;
-    int node;
-    uint64_t timas[2 * 2];
-    /* Interrupt number ranges for the IPIs */
-    uint32_t lisn_ranges[] = {
-        cpu_to_be32(0),
-        cpu_to_be32(nr_servers),
-    };
-    /*
-     * EQ size - the sizes of pages supported by the system 4K, 64K,
-     * 2M, 16M. We only advertise 64K for the moment.
-     */
-    uint32_t eq_sizes[] = {
-        cpu_to_be32(16), /* 64K */
-    };
-    /*
-     * The following array is in sync with the reserved priorities
-     * defined by the 'spapr_xive_priority_is_reserved' routine.
-     */
-    uint32_t plat_res_int_priorities[] = {
-        cpu_to_be32(7),    /* start */
-        cpu_to_be32(0xf8), /* count */
-    };
-
-    /* Thread Interrupt Management Area : User (ring 3) and OS (ring 2) */
-    timas[0] = cpu_to_be64(xive->tm_base +
-                           XIVE_TM_USER_PAGE * (1ull << TM_SHIFT));
-    timas[1] = cpu_to_be64(1ull << TM_SHIFT);
-    timas[2] = cpu_to_be64(xive->tm_base +
-                           XIVE_TM_OS_PAGE * (1ull << TM_SHIFT));
-    timas[3] = cpu_to_be64(1ull << TM_SHIFT);
-
-    _FDT(node = fdt_add_subnode(fdt, 0, xive->nodename));
-
-    _FDT(fdt_setprop_string(fdt, node, "device_type", "power-ivpe"));
-    _FDT(fdt_setprop(fdt, node, "reg", timas, sizeof(timas)));
-
-    _FDT(fdt_setprop_string(fdt, node, "compatible", "ibm,power-ivpe"));
-    _FDT(fdt_setprop(fdt, node, "ibm,xive-eq-sizes", eq_sizes,
-                     sizeof(eq_sizes)));
-    _FDT(fdt_setprop(fdt, node, "ibm,xive-lisn-ranges", lisn_ranges,
-                     sizeof(lisn_ranges)));
-
-    /* For Linux to link the LSIs to the interrupt controller. */
-    _FDT(fdt_setprop(fdt, node, "interrupt-controller", NULL, 0));
-    _FDT(fdt_setprop_cell(fdt, node, "#interrupt-cells", 2));
-
-    /* For SLOF */
-    _FDT(fdt_setprop_cell(fdt, node, "linux,phandle", phandle));
-    _FDT(fdt_setprop_cell(fdt, node, "phandle", phandle));
-
-    /*
-     * The "ibm,plat-res-int-priorities" property defines the priority
-     * ranges reserved by the hypervisor
-     */
-    _FDT(fdt_setprop(fdt, 0, "ibm,plat-res-int-priorities",
-                     plat_res_int_priorities, sizeof(plat_res_int_priorities)));
-}
diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c
index 51b334b676..08012ac7cd 100644
--- a/hw/intc/spapr_xive_kvm.c
+++ b/hw/intc/spapr_xive_kvm.c
@@ -740,8 +740,9 @@ static void *kvmppc_xive_mmap(SpaprXive *xive, int pgoff, size_t len,
  * All the XIVE memory regions are now backed by mappings from the KVM
  * XIVE device.
  */
-void kvmppc_xive_connect(SpaprXive *xive, Error **errp)
+int kvmppc_xive_connect(SpaprInterruptController *intc, Error **errp)
 {
+    SpaprXive *xive = SPAPR_XIVE(intc);
     XiveSource *xsrc = &xive->source;
     Error *local_err = NULL;
     size_t esb_len = (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
@@ -753,19 +754,19 @@ void kvmppc_xive_connect(SpaprXive *xive, Error **errp)
      * rebooting under the XIVE-only interrupt mode.
      */
     if (xive->fd != -1) {
-        return;
+        return 0;
     }
 
     if (!kvmppc_has_cap_xive()) {
         error_setg(errp, "IRQ_XIVE capability must be present for KVM");
-        return;
+        return -1;
     }
 
     /* First, create the KVM XIVE device */
     xive->fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_XIVE, false);
     if (xive->fd < 0) {
         error_setg_errno(errp, -xive->fd, "XIVE: error creating KVM device");
-        return;
+        return -1;
     }
 
     /*
@@ -821,15 +822,17 @@ void kvmppc_xive_connect(SpaprXive *xive, Error **errp)
     kvm_kernel_irqchip = true;
     kvm_msi_via_irqfd_allowed = true;
     kvm_gsi_direct_mapping = true;
-    return;
+    return 0;
 
 fail:
     error_propagate(errp, local_err);
-    kvmppc_xive_disconnect(xive, NULL);
+    kvmppc_xive_disconnect(intc);
+    return -1;
 }
 
-void kvmppc_xive_disconnect(SpaprXive *xive, Error **errp)
+void kvmppc_xive_disconnect(SpaprInterruptController *intc)
 {
+    SpaprXive *xive = SPAPR_XIVE(intc);
     XiveSource *xsrc;
     size_t esb_len;
 
@@ -838,11 +841,6 @@ void kvmppc_xive_disconnect(SpaprXive *xive, Error **errp)
         return;
     }
 
-    if (!kvmppc_has_cap_xive()) {
-        error_setg(errp, "IRQ_XIVE capability must be present for KVM");
-        return;
-    }
-
     /* Clear the KVM mapping */
     xsrc = &xive->source;
     esb_len = (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index dfe7dbd254..6da05763f9 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -274,10 +274,8 @@ static const VMStateDescription vmstate_icp_server = {
     },
 };
 
-static void icp_reset_handler(void *dev)
+void icp_reset(ICPState *icp)
 {
-    ICPState *icp = ICP(dev);
-
     icp->xirr = 0;
     icp->pending_priority = 0xff;
     icp->mfrr = 0xff;
@@ -288,7 +286,7 @@ static void icp_reset_handler(void *dev)
     if (kvm_irqchip_in_kernel()) {
         Error *local_err = NULL;
 
-        icp_set_kvm_state(ICP(dev), &local_err);
+        icp_set_kvm_state(icp, &local_err);
         if (local_err) {
             error_report_err(local_err);
         }
@@ -351,7 +349,6 @@ static void icp_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    qemu_register_reset(icp_reset_handler, dev);
     vmstate_register(NULL, icp->cs->cpu_index, &vmstate_icp_server, icp);
 }
 
@@ -360,7 +357,6 @@ static void icp_unrealize(DeviceState *dev, Error **errp)
     ICPState *icp = ICP(dev);
 
     vmstate_unregister(NULL, &vmstate_icp_server, icp);
-    qemu_unregister_reset(icp_reset_handler, dev);
 }
 
 static void icp_class_init(ObjectClass *klass, void *data)
@@ -369,6 +365,11 @@ static void icp_class_init(ObjectClass *klass, void *data)
 
     dc->realize = icp_realize;
     dc->unrealize = icp_unrealize;
+    /*
+     * Reason: part of XICS interrupt controller, needs to be wired up
+     * by icp_create().
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo icp_info = {
@@ -689,6 +690,11 @@ static void ics_class_init(ObjectClass *klass, void *data)
     dc->props = ics_properties;
     dc->reset = ics_reset;
     dc->vmsd = &vmstate_ics;
+    /*
+     * Reason: part of XICS interrupt controller, needs to be wired up,
+     * e.g. by spapr_irq_init().
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo ics_info = {
diff --git a/hw/intc/xics_kvm.c b/hw/intc/xics_kvm.c
index ba90d6dc96..954c424b36 100644
--- a/hw/intc/xics_kvm.c
+++ b/hw/intc/xics_kvm.c
@@ -342,8 +342,9 @@ void ics_kvm_set_irq(ICSState *ics, int srcno, int val)
     }
 }
 
-int xics_kvm_connect(SpaprMachineState *spapr, Error **errp)
+int xics_kvm_connect(SpaprInterruptController *intc, Error **errp)
 {
+    ICSState *ics = ICS_SPAPR(intc);
     int rc;
     CPUState *cs;
     Error *local_err = NULL;
@@ -413,7 +414,7 @@ int xics_kvm_connect(SpaprMachineState *spapr, Error **errp)
     }
 
     /* Update the KVM sources */
-    ics_set_kvm_state(spapr->ics, &local_err);
+    ics_set_kvm_state(ics, &local_err);
     if (local_err) {
         goto fail;
     }
@@ -431,11 +432,11 @@ int xics_kvm_connect(SpaprMachineState *spapr, Error **errp)
 
 fail:
     error_propagate(errp, local_err);
-    xics_kvm_disconnect(spapr, NULL);
+    xics_kvm_disconnect(intc);
     return -1;
 }
 
-void xics_kvm_disconnect(SpaprMachineState *spapr, Error **errp)
+void xics_kvm_disconnect(SpaprInterruptController *intc)
 {
     /*
      * Only on P9 using the XICS-on XIVE KVM device:
diff --git a/hw/intc/xics_spapr.c b/hw/intc/xics_spapr.c
index 6e5eb24b3c..7418fb9f37 100644
--- a/hw/intc/xics_spapr.c
+++ b/hw/intc/xics_spapr.c
@@ -308,8 +308,8 @@ static void ics_spapr_realize(DeviceState *dev, Error **errp)
     spapr_register_hypercall(H_IPOLL, h_ipoll);
 }
 
-void spapr_dt_xics(SpaprMachineState *spapr, uint32_t nr_servers, void *fdt,
-                   uint32_t phandle)
+static void xics_spapr_dt(SpaprInterruptController *intc, uint32_t nr_servers,
+                          void *fdt, uint32_t phandle)
 {
     uint32_t interrupt_server_ranges_prop[] = {
         0, cpu_to_be32(nr_servers),
@@ -330,19 +330,132 @@ void spapr_dt_xics(SpaprMachineState *spapr, uint32_t nr_servers, void *fdt,
     _FDT(fdt_setprop_cell(fdt, node, "phandle", phandle));
 }
 
+static int xics_spapr_cpu_intc_create(SpaprInterruptController *intc,
+                                       PowerPCCPU *cpu, Error **errp)
+{
+    ICSState *ics = ICS_SPAPR(intc);
+    Object *obj;
+    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
+
+    obj = icp_create(OBJECT(cpu), TYPE_ICP, ics->xics, errp);
+    if (!obj) {
+        return -1;
+    }
+
+    spapr_cpu->icp = ICP(obj);
+    return 0;
+}
+
+static void xics_spapr_cpu_intc_reset(SpaprInterruptController *intc,
+                                     PowerPCCPU *cpu)
+{
+    icp_reset(spapr_cpu_state(cpu)->icp);
+}
+
+static int xics_spapr_claim_irq(SpaprInterruptController *intc, int irq,
+                                bool lsi, Error **errp)
+{
+    ICSState *ics = ICS_SPAPR(intc);
+
+    assert(ics);
+    assert(ics_valid_irq(ics, irq));
+
+    if (!ics_irq_free(ics, irq - ics->offset)) {
+        error_setg(errp, "IRQ %d is not free", irq);
+        return -EBUSY;
+    }
+
+    ics_set_irq_type(ics, irq - ics->offset, lsi);
+    return 0;
+}
+
+static void xics_spapr_free_irq(SpaprInterruptController *intc, int irq)
+{
+    ICSState *ics = ICS_SPAPR(intc);
+    uint32_t srcno = irq - ics->offset;
+
+    assert(ics_valid_irq(ics, irq));
+
+    memset(&ics->irqs[srcno], 0, sizeof(ICSIRQState));
+}
+
+static void xics_spapr_set_irq(SpaprInterruptController *intc, int irq, int val)
+{
+    ICSState *ics = ICS_SPAPR(intc);
+    uint32_t srcno = irq - ics->offset;
+
+    ics_set_irq(ics, srcno, val);
+}
+
+static void xics_spapr_print_info(SpaprInterruptController *intc, Monitor *mon)
+{
+    ICSState *ics = ICS_SPAPR(intc);
+    CPUState *cs;
+
+    CPU_FOREACH(cs) {
+        PowerPCCPU *cpu = POWERPC_CPU(cs);
+
+        icp_pic_print_info(spapr_cpu_state(cpu)->icp, mon);
+    }
+
+    ics_pic_print_info(ics, mon);
+}
+
+static int xics_spapr_post_load(SpaprInterruptController *intc, int version_id)
+{
+    if (!kvm_irqchip_in_kernel()) {
+        CPUState *cs;
+        CPU_FOREACH(cs) {
+            PowerPCCPU *cpu = POWERPC_CPU(cs);
+            icp_resend(spapr_cpu_state(cpu)->icp);
+        }
+    }
+    return 0;
+}
+
+static int xics_spapr_activate(SpaprInterruptController *intc, Error **errp)
+{
+    if (kvm_enabled()) {
+        return spapr_irq_init_kvm(xics_kvm_connect, intc, errp);
+    }
+    return 0;
+}
+
+static void xics_spapr_deactivate(SpaprInterruptController *intc)
+{
+    if (kvm_irqchip_in_kernel()) {
+        xics_kvm_disconnect(intc);
+    }
+}
+
 static void ics_spapr_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ICSStateClass *isc = ICS_CLASS(klass);
+    SpaprInterruptControllerClass *sicc = SPAPR_INTC_CLASS(klass);
 
     device_class_set_parent_realize(dc, ics_spapr_realize,
                                     &isc->parent_realize);
+    sicc->activate = xics_spapr_activate;
+    sicc->deactivate = xics_spapr_deactivate;
+    sicc->cpu_intc_create = xics_spapr_cpu_intc_create;
+    sicc->cpu_intc_reset = xics_spapr_cpu_intc_reset;
+    sicc->claim_irq = xics_spapr_claim_irq;
+    sicc->free_irq = xics_spapr_free_irq;
+    sicc->set_irq = xics_spapr_set_irq;
+    sicc->print_info = xics_spapr_print_info;
+    sicc->dt = xics_spapr_dt;
+    sicc->post_load = xics_spapr_post_load;
 }
 
 static const TypeInfo ics_spapr_info = {
     .name = TYPE_ICS_SPAPR,
     .parent = TYPE_ICS,
     .class_init = ics_spapr_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        { TYPE_SPAPR_INTC },
+        { }
+    },
 };
 
 static void xics_spapr_register_types(void)
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 29df06df11..f066be5eb5 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -547,10 +547,8 @@ void xive_tctx_pic_print_info(XiveTCTX *tctx, Monitor *mon)
     }
 }
 
-static void xive_tctx_reset(void *dev)
+void xive_tctx_reset(XiveTCTX *tctx)
 {
-    XiveTCTX *tctx = XIVE_TCTX(dev);
-
     memset(tctx->regs, 0, sizeof(tctx->regs));
 
     /* Set some defaults */
@@ -607,13 +605,6 @@ static void xive_tctx_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
-
-    qemu_register_reset(xive_tctx_reset, dev);
-}
-
-static void xive_tctx_unrealize(DeviceState *dev, Error **errp)
-{
-    qemu_unregister_reset(xive_tctx_reset, dev);
 }
 
 static int vmstate_xive_tctx_pre_save(void *opaque)
@@ -668,8 +659,12 @@ static void xive_tctx_class_init(ObjectClass *klass, void *data)
 
     dc->desc = "XIVE Interrupt Thread Context";
     dc->realize = xive_tctx_realize;
-    dc->unrealize = xive_tctx_unrealize;
     dc->vmsd = &vmstate_xive_tctx;
+    /*
+     * Reason: part of XIVE interrupt controller, needs to be wired up
+     * by xive_tctx_create().
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo xive_tctx_info = {
@@ -1118,6 +1113,11 @@ static void xive_source_class_init(ObjectClass *klass, void *data)
     dc->props   = xive_source_properties;
     dc->realize = xive_source_realize;
     dc->vmsd    = &vmstate_xive_source;
+    /*
+     * Reason: part of XIVE interrupt controller, needs to be wired up,
+     * e.g. by spapr_xive_instance_init().
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo xive_source_info = {
@@ -1648,8 +1648,8 @@ do_escalation:
 void xive_router_notify(XiveNotifier *xn, uint32_t lisn)
 {
     XiveRouter *xrtr = XIVE_ROUTER(xn);
-    uint8_t eas_blk = XIVE_SRCNO_BLOCK(lisn);
-    uint32_t eas_idx = XIVE_SRCNO_INDEX(lisn);
+    uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
+    uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
     XiveEAS eas;
 
     /* EAS cache lookup */
@@ -1853,6 +1853,11 @@ static void xive_end_source_class_init(ObjectClass *klass, void *data)
     dc->desc    = "XIVE END Source";
     dc->props   = xive_end_source_properties;
     dc->realize = xive_end_source_realize;
+    /*
+     * Reason: part of XIVE interrupt controller, needs to be wired up,
+     * e.g. by spapr_xive_instance_init().
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo xive_end_source_info = {
diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
index a49096367c..b155dd8170 100644
--- a/hw/m68k/mcf5206.c
+++ b/hw/m68k/mcf5206.c
@@ -8,7 +8,6 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
-#include "qemu/main-loop.h"
 #include "cpu.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
@@ -57,10 +56,12 @@ static void m5206_timer_recalibrate(m5206_timer_state *s)
     int prescale;
     int mode;
 
+    ptimer_transaction_begin(s->timer);
     ptimer_stop(s->timer);
 
-    if ((s->tmr & TMR_RST) == 0)
-        return;
+    if ((s->tmr & TMR_RST) == 0) {
+        goto exit;
+    }
 
     prescale = (s->tmr >> 8) + 1;
     mode = (s->tmr >> 1) & 3;
@@ -78,6 +79,8 @@ static void m5206_timer_recalibrate(m5206_timer_state *s)
     ptimer_set_limit(s->timer, s->trr, 0);
 
     ptimer_run(s->timer, 0);
+exit:
+    ptimer_transaction_commit(s->timer);
 }
 
 static void m5206_timer_trigger(void *opaque)
@@ -123,7 +126,9 @@ static void m5206_timer_write(m5206_timer_state *s, uint32_t addr, uint32_t val)
         s->tcr = val;
         break;
     case 0xc:
+        ptimer_transaction_begin(s->timer);
         ptimer_set_count(s->timer, val);
+        ptimer_transaction_commit(s->timer);
         break;
     case 0x11:
         s->ter &= ~val;
@@ -137,11 +142,9 @@ static void m5206_timer_write(m5206_timer_state *s, uint32_t addr, uint32_t val)
 static m5206_timer_state *m5206_timer_init(qemu_irq irq)
 {
     m5206_timer_state *s;
-    QEMUBH *bh;
 
     s = g_new0(m5206_timer_state, 1);
-    bh = qemu_bh_new(m5206_timer_trigger, s);
-    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init(m5206_timer_trigger, s, PTIMER_POLICY_DEFAULT);
     s->irq = irq;
     m5206_timer_reset(s);
     return s;
diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index 34d34eba17..158c5e4be7 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -9,7 +9,6 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qemu/error-report.h"
-#include "qemu/main-loop.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -79,6 +78,7 @@ static void m5208_timer_write(void *opaque, hwaddr offset,
             return;
         }
 
+        ptimer_transaction_begin(s->timer);
         if (s->pcsr & PCSR_EN)
             ptimer_stop(s->timer);
 
@@ -94,8 +94,10 @@ static void m5208_timer_write(void *opaque, hwaddr offset,
 
         if (s->pcsr & PCSR_EN)
             ptimer_run(s->timer, 0);
+        ptimer_transaction_commit(s->timer);
         break;
     case 2:
+        ptimer_transaction_begin(s->timer);
         s->pmr = value;
         s->pcsr &= ~PCSR_PIF;
         if ((s->pcsr & PCSR_RLD) == 0) {
@@ -104,6 +106,7 @@ static void m5208_timer_write(void *opaque, hwaddr offset,
         } else {
             ptimer_set_limit(s->timer, value, s->pcsr & PCSR_OVW);
         }
+        ptimer_transaction_commit(s->timer);
         break;
     case 4:
         break;
@@ -182,7 +185,6 @@ static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
 {
     MemoryRegion *iomem = g_new(MemoryRegion, 1);
     m5208_timer_state *s;
-    QEMUBH *bh;
     int i;
 
     /* SDRAMC.  */
@@ -191,8 +193,7 @@ static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
     /* Timers.  */
     for (i = 0; i < 2; i++) {
         s = g_new0(m5208_timer_state, 1);
-        bh = qemu_bh_new(m5208_timer_trigger, s);
-        s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+        s->timer = ptimer_init(m5208_timer_trigger, s, PTIMER_POLICY_DEFAULT);
         memory_region_init_io(&s->iomem, NULL, &m5208_timer_ops, s,
                               "m5208-timer", 0x00004000);
         memory_region_add_subregion(address_space, 0xfc080000 + 0x4000 * i,
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index cf537dd7e6..03a27e1767 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -39,7 +39,7 @@
 #include "hw/ide.h"
 #include "elf.h"
 #include "hw/isa/vt82c686.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/timer/i8254.h"
 #include "exec/address-spaces.h"
 #include "sysemu/qtest.h"
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 8d010a0b6e..d978bb64a0 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -39,7 +39,7 @@
 #include "hw/scsi/esp.h"
 #include "hw/mips/bios.h"
 #include "hw/loader.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/timer/i8254.h"
 #include "hw/display/vga.h"
 #include "hw/audio/pcspk.h"
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 4d9c64b36a..c1c8810e71 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -45,7 +45,7 @@
 #include "hw/irq.h"
 #include "hw/loader.h"
 #include "elf.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/timer/i8254.h"
 #include "exec/address-spaces.h"
 #include "hw/sysbus.h"             /* SysBusDevice */
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index bc0be26544..70024235ae 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -28,7 +28,7 @@
 #include "hw/ide.h"
 #include "hw/loader.h"
 #include "elf.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/input/i8042.h"
 #include "hw/timer/i8254.h"
 #include "exec/address-spaces.h"
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index a150680966..c89f3816a5 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -53,6 +53,7 @@ common-obj-$(CONFIG_OMAP) += omap_tap.o
 common-obj-$(CONFIG_RASPI) += bcm2835_mbox.o
 common-obj-$(CONFIG_RASPI) += bcm2835_property.o
 common-obj-$(CONFIG_RASPI) += bcm2835_rng.o
+common-obj-$(CONFIG_RASPI) += bcm2835_thermal.o
 common-obj-$(CONFIG_SLAVIO) += slavio_misc.o
 common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
diff --git a/hw/misc/bcm2835_thermal.c b/hw/misc/bcm2835_thermal.c
new file mode 100644
index 0000000000..c6f3b1ad60
--- /dev/null
+++ b/hw/misc/bcm2835_thermal.c
@@ -0,0 +1,135 @@
+/*
+ * BCM2835 dummy thermal sensor
+ *
+ * Copyright (C) 2019 Philippe Mathieu-Daudé <f4bug@amsat.org>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "hw/misc/bcm2835_thermal.h"
+#include "hw/registerfields.h"
+#include "migration/vmstate.h"
+
+REG32(CTL, 0)
+FIELD(CTL, POWER_DOWN, 0, 1)
+FIELD(CTL, RESET, 1, 1)
+FIELD(CTL, BANDGAP_CTRL, 2, 3)
+FIELD(CTL, INTERRUPT_ENABLE, 5, 1)
+FIELD(CTL, DIRECT, 6, 1)
+FIELD(CTL, INTERRUPT_CLEAR, 7, 1)
+FIELD(CTL, HOLD, 8, 10)
+FIELD(CTL, RESET_DELAY, 18, 8)
+FIELD(CTL, REGULATOR_ENABLE, 26, 1)
+
+REG32(STAT, 4)
+FIELD(STAT, DATA, 0, 10)
+FIELD(STAT, VALID, 10, 1)
+FIELD(STAT, INTERRUPT, 11, 1)
+
+#define THERMAL_OFFSET_C 412
+#define THERMAL_COEFF  (-0.538f)
+
+static uint16_t bcm2835_thermal_temp2adc(int temp_C)
+{
+    return (temp_C - THERMAL_OFFSET_C) / THERMAL_COEFF;
+}
+
+static uint64_t bcm2835_thermal_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Bcm2835ThermalState *s = BCM2835_THERMAL(opaque);
+    uint32_t val = 0;
+
+    switch (addr) {
+    case A_CTL:
+        val = s->ctl;
+        break;
+    case A_STAT:
+        /* Temperature is constantly 25°C. */
+        val = FIELD_DP32(bcm2835_thermal_temp2adc(25), STAT, VALID, true);
+        break;
+    default:
+        /* MemoryRegionOps are aligned, so this can not happen. */
+        g_assert_not_reached();
+    }
+    return val;
+}
+
+static void bcm2835_thermal_write(void *opaque, hwaddr addr,
+                                  uint64_t value, unsigned size)
+{
+    Bcm2835ThermalState *s = BCM2835_THERMAL(opaque);
+
+    switch (addr) {
+    case A_CTL:
+        s->ctl = value;
+        break;
+    case A_STAT:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: write 0x%" PRIx64
+                                       " to 0x%" HWADDR_PRIx "\n",
+                       __func__, value, addr);
+        break;
+    default:
+        /* MemoryRegionOps are aligned, so this can not happen. */
+        g_assert_not_reached();
+    }
+}
+
+static const MemoryRegionOps bcm2835_thermal_ops = {
+    .read = bcm2835_thermal_read,
+    .write = bcm2835_thermal_write,
+    .impl.max_access_size = 4,
+    .valid.min_access_size = 4,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void bcm2835_thermal_reset(DeviceState *dev)
+{
+    Bcm2835ThermalState *s = BCM2835_THERMAL(dev);
+
+    s->ctl = 0;
+}
+
+static void bcm2835_thermal_realize(DeviceState *dev, Error **errp)
+{
+    Bcm2835ThermalState *s = BCM2835_THERMAL(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_thermal_ops,
+                          s, TYPE_BCM2835_THERMAL, 8);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+static const VMStateDescription bcm2835_thermal_vmstate = {
+    .name = "bcm2835_thermal",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(ctl, Bcm2835ThermalState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_thermal_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = bcm2835_thermal_realize;
+    dc->reset = bcm2835_thermal_reset;
+    dc->vmsd = &bcm2835_thermal_vmstate;
+}
+
+static const TypeInfo bcm2835_thermal_info = {
+    .name = TYPE_BCM2835_THERMAL,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Bcm2835ThermalState),
+    .class_init = bcm2835_thermal_class_init,
+};
+
+static void bcm2835_thermal_register_types(void)
+{
+    type_register_static(&bcm2835_thermal_info);
+}
+
+type_init(bcm2835_thermal_register_types)
diff --git a/hw/net/fsl_etsec/etsec.c b/hw/net/fsl_etsec/etsec.c
index d9b3e8c691..717de76569 100644
--- a/hw/net/fsl_etsec/etsec.c
+++ b/hw/net/fsl_etsec/etsec.c
@@ -34,7 +34,6 @@
 #include "etsec.h"
 #include "registers.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 /* #define HEX_DUMP */
@@ -195,9 +194,11 @@ static void write_dmactrl(eTSEC          *etsec,
 
     if (!(value & DMACTRL_WOP)) {
         /* Start polling */
+        ptimer_transaction_begin(etsec->ptimer);
         ptimer_stop(etsec->ptimer);
         ptimer_set_count(etsec->ptimer, 1);
         ptimer_run(etsec->ptimer, 1);
+        ptimer_transaction_commit(etsec->ptimer);
     }
 }
 
@@ -391,10 +392,10 @@ static void etsec_realize(DeviceState *dev, Error **errp)
                               object_get_typename(OBJECT(dev)), dev->id, etsec);
     qemu_format_nic_info_str(qemu_get_queue(etsec->nic), etsec->conf.macaddr.a);
 
-
-    etsec->bh     = qemu_bh_new(etsec_timer_hit, etsec);
-    etsec->ptimer = ptimer_init_with_bh(etsec->bh, PTIMER_POLICY_DEFAULT);
+    etsec->ptimer = ptimer_init(etsec_timer_hit, etsec, PTIMER_POLICY_DEFAULT);
+    ptimer_transaction_begin(etsec->ptimer);
     ptimer_set_freq(etsec->ptimer, 100);
+    ptimer_transaction_commit(etsec->ptimer);
 }
 
 static void etsec_instance_init(Object *obj)
diff --git a/hw/net/fsl_etsec/etsec.h b/hw/net/fsl_etsec/etsec.h
index 09d05c2133..7951c3ad65 100644
--- a/hw/net/fsl_etsec/etsec.h
+++ b/hw/net/fsl_etsec/etsec.h
@@ -141,7 +141,6 @@ typedef struct eTSEC {
     uint16_t phy_control;
 
     /* Polling */
-    QEMUBH *bh;
     struct ptimer_state *ptimer;
 
     /* Whether we should flush the rx queue when buffer becomes available. */
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 715b9a4fe6..97967d12eb 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -311,7 +311,7 @@ void pci_bridge_reset(DeviceState *qdev)
 
     /*
      * the default values for base/limit registers aren't specified
-     * in the PCI-to-PCI-bridge spec. So we don't thouch them here.
+     * in the PCI-to-PCI-bridge spec. So we don't touch them here.
      * Each implementation can override it.
      * typical implementation does
      * zero base/limit registers or
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 7cf64b6d25..60632720ef 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -48,7 +48,7 @@
 #include "hw/isa/isa.h"
 #include "hw/boards.h"
 #include "hw/char/serial.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 
 #include <libfdt.h>
 
@@ -778,6 +778,13 @@ static void pnv_chip_power8_intc_create(PnvChip *chip, PowerPCCPU *cpu,
     pnv_cpu->intc = obj;
 }
 
+static void pnv_chip_power8_intc_reset(PnvChip *chip, PowerPCCPU *cpu)
+{
+    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
+
+    icp_reset(ICP(pnv_cpu->intc));
+}
+
 /*
  *    0:48  Reserved - Read as zeroes
  *   49:52  Node ID
@@ -815,6 +822,13 @@ static void pnv_chip_power9_intc_create(PnvChip *chip, PowerPCCPU *cpu,
     pnv_cpu->intc = obj;
 }
 
+static void pnv_chip_power9_intc_reset(PnvChip *chip, PowerPCCPU *cpu)
+{
+    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
+
+    xive_tctx_reset(XIVE_TCTX(pnv_cpu->intc));
+}
+
 /*
  * Allowed core identifiers on a POWER8 Processor Chip :
  *
@@ -984,6 +998,7 @@ static void pnv_chip_power8e_class_init(ObjectClass *klass, void *data)
     k->cores_mask = POWER8E_CORE_MASK;
     k->core_pir = pnv_chip_core_pir_p8;
     k->intc_create = pnv_chip_power8_intc_create;
+    k->intc_reset = pnv_chip_power8_intc_reset;
     k->isa_create = pnv_chip_power8_isa_create;
     k->dt_populate = pnv_chip_power8_dt_populate;
     k->pic_print_info = pnv_chip_power8_pic_print_info;
@@ -1003,6 +1018,7 @@ static void pnv_chip_power8_class_init(ObjectClass *klass, void *data)
     k->cores_mask = POWER8_CORE_MASK;
     k->core_pir = pnv_chip_core_pir_p8;
     k->intc_create = pnv_chip_power8_intc_create;
+    k->intc_reset = pnv_chip_power8_intc_reset;
     k->isa_create = pnv_chip_power8_isa_create;
     k->dt_populate = pnv_chip_power8_dt_populate;
     k->pic_print_info = pnv_chip_power8_pic_print_info;
@@ -1022,6 +1038,7 @@ static void pnv_chip_power8nvl_class_init(ObjectClass *klass, void *data)
     k->cores_mask = POWER8_CORE_MASK;
     k->core_pir = pnv_chip_core_pir_p8;
     k->intc_create = pnv_chip_power8_intc_create;
+    k->intc_reset = pnv_chip_power8_intc_reset;
     k->isa_create = pnv_chip_power8nvl_isa_create;
     k->dt_populate = pnv_chip_power8_dt_populate;
     k->pic_print_info = pnv_chip_power8_pic_print_info;
@@ -1191,6 +1208,7 @@ static void pnv_chip_power9_class_init(ObjectClass *klass, void *data)
     k->cores_mask = POWER9_CORE_MASK;
     k->core_pir = pnv_chip_core_pir_p9;
     k->intc_create = pnv_chip_power9_intc_create;
+    k->intc_reset = pnv_chip_power9_intc_reset;
     k->isa_create = pnv_chip_power9_isa_create;
     k->dt_populate = pnv_chip_power9_dt_populate;
     k->pic_print_info = pnv_chip_power9_pic_print_info;
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index b1a7489e7a..e81cd3a3e0 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -40,11 +40,11 @@ static const char *pnv_core_cpu_typename(PnvCore *pc)
     return cpu_type;
 }
 
-static void pnv_cpu_reset(void *opaque)
+static void pnv_core_cpu_reset(PowerPCCPU *cpu, PnvChip *chip)
 {
-    PowerPCCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
+    PnvChipClass *pcc = PNV_CHIP_GET_CLASS(chip);
 
     cpu_reset(cs);
 
@@ -55,6 +55,8 @@ static void pnv_cpu_reset(void *opaque)
     env->gpr[3] = PNV_FDT_ADDR;
     env->nip = 0x10;
     env->msr |= MSR_HVB; /* Hypervisor mode */
+
+    pcc->intc_reset(chip, cpu);
 }
 
 /*
@@ -160,7 +162,7 @@ static const MemoryRegionOps pnv_core_power9_xscom_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
-static void pnv_realize_vcpu(PowerPCCPU *cpu, PnvChip *chip, Error **errp)
+static void pnv_core_cpu_realize(PowerPCCPU *cpu, PnvChip *chip, Error **errp)
 {
     CPUPPCState *env = &cpu->env;
     int core_pir;
@@ -192,8 +194,17 @@ static void pnv_realize_vcpu(PowerPCCPU *cpu, PnvChip *chip, Error **errp)
 
     /* Set time-base frequency to 512 MHz */
     cpu_ppc_tb_init(env, PNV_TIMEBASE_FREQ);
+}
+
+static void pnv_core_reset(void *dev)
+{
+    CPUCore *cc = CPU_CORE(dev);
+    PnvCore *pc = PNV_CORE(dev);
+    int i;
 
-    qemu_register_reset(pnv_cpu_reset, cpu);
+    for (i = 0; i < cc->nr_threads; i++) {
+        pnv_core_cpu_reset(pc->threads[i], pc->chip);
+    }
 }
 
 static void pnv_core_realize(DeviceState *dev, Error **errp)
@@ -214,6 +225,7 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
                                 "required link 'chip' not found: ");
         return;
     }
+    pc->chip = PNV_CHIP(chip);
 
     pc->threads = g_new(PowerPCCPU *, cc->nr_threads);
     for (i = 0; i < cc->nr_threads; i++) {
@@ -235,7 +247,7 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
     }
 
     for (j = 0; j < cc->nr_threads; j++) {
-        pnv_realize_vcpu(pc->threads[j], PNV_CHIP(chip), &local_err);
+        pnv_core_cpu_realize(pc->threads[j], pc->chip, &local_err);
         if (local_err) {
             goto err;
         }
@@ -244,6 +256,8 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
     snprintf(name, sizeof(name), "xscom-core.%d", cc->core_id);
     pnv_xscom_region_init(&pc->xscom_regs, OBJECT(dev), pcc->xscom_ops,
                           pc, name, PNV_XSCOM_EX_SIZE);
+
+    qemu_register_reset(pnv_core_reset, pc);
     return;
 
 err:
@@ -255,11 +269,10 @@ err:
     error_propagate(errp, local_err);
 }
 
-static void pnv_unrealize_vcpu(PowerPCCPU *cpu)
+static void pnv_core_cpu_unrealize(PowerPCCPU *cpu)
 {
     PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
 
-    qemu_unregister_reset(pnv_cpu_reset, cpu);
     object_unparent(OBJECT(pnv_cpu_state(cpu)->intc));
     cpu_remove_sync(CPU(cpu));
     cpu->machine_data = NULL;
@@ -273,8 +286,10 @@ static void pnv_core_unrealize(DeviceState *dev, Error **errp)
     CPUCore *cc = CPU_CORE(dev);
     int i;
 
+    qemu_unregister_reset(pnv_core_reset, pc);
+
     for (i = 0; i < cc->nr_threads; i++) {
-        pnv_unrealize_vcpu(pc->threads[i]);
+        pnv_core_cpu_unrealize(pc->threads[i]);
     }
     g_free(pc->threads);
 }
diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index a997f16bb4..68d0dfacfe 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -660,10 +660,19 @@ static void pnv_psi_notify(XiveNotifier *xf, uint32_t srcno)
 
     uint32_t offset =
         (psi->regs[PSIHB_REG(PSIHB9_IVT_OFFSET)] >> PSIHB9_IVT_OFF_SHIFT);
-    uint64_t lisn = cpu_to_be64(offset + srcno);
+    uint64_t data = XIVE_TRIGGER_PQ | offset | srcno;
+    MemTxResult result;
 
-    if (valid) {
-        cpu_physical_memory_write(notify_addr, &lisn, sizeof(lisn));
+    if (!valid) {
+        return;
+    }
+
+    address_space_stq_be(&address_space_memory, notify_addr, data,
+                         MEMTXATTRS_UNSPECIFIED, &result);
+    if (result != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: trigger failed @%"
+                      HWADDR_PRIx "\n", __func__, notif_port);
+        return;
     }
 }
 
diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
index 388cae0b43..1f721feed6 100644
--- a/hw/ppc/ppc405_boards.c
+++ b/hw/ppc/ppc405_boards.c
@@ -29,7 +29,7 @@
 #include "cpu.h"
 #include "hw/ppc/ppc.h"
 #include "ppc405.h"
-#include "hw/timer/m48t59.h"
+#include "hw/rtc/m48t59.h"
 #include "hw/block/flash.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/qtest.h"
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 4f3c6bf190..862345c2ac 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -25,7 +25,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "hw/timer/m48t59.h"
+#include "hw/rtc/m48t59.h"
 #include "hw/char/serial.h"
 #include "hw/block/fdc.h"
 #include "net/net.h"
@@ -40,7 +40,7 @@
 #include "hw/ide.h"
 #include "hw/irq.h"
 #include "hw/loader.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
 #include "hw/isa/pc87312.h"
 #include "hw/net/ne2000-isa.h"
 #include "sysemu/arch_init.h"
diff --git a/hw/ppc/rs6000_mc.c b/hw/ppc/rs6000_mc.c
index df7c0006fc..66b14db5fa 100644
--- a/hw/ppc/rs6000_mc.c
+++ b/hw/ppc/rs6000_mc.c
@@ -144,6 +144,7 @@ static void rs6000mc_realize(DeviceState *dev, Error **errp)
     RS6000MCState *s = RS6000MC_DEVICE(dev);
     int socket = 0;
     unsigned int ram_size = s->ram_size / MiB;
+    Error *local_err = NULL;
 
     while (socket < 6) {
         if (ram_size >= 64) {
@@ -165,19 +166,21 @@ static void rs6000mc_realize(DeviceState *dev, Error **errp)
         if (s->simm_size[socket]) {
             char name[] = "simm.?";
             name[5] = socket + '0';
-            memory_region_allocate_system_memory(&s->simm[socket], OBJECT(dev),
-                                                 name,
-                                                 s->simm_size[socket] * MiB);
+            memory_region_init_ram(&s->simm[socket], OBJECT(dev), name,
+                                   s->simm_size[socket] * MiB, &local_err);
+            if (local_err) {
+                goto out;
+            }
             memory_region_add_subregion_overlap(get_system_memory(), 0,
                                                 &s->simm[socket], socket);
         }
     }
     if (ram_size) {
         /* unable to push all requested RAM in SIMMs */
-        error_setg(errp, "RAM size incompatible with this board. "
+        error_setg(&local_err, "RAM size incompatible with this board. "
                    "Try again with something else, like %" PRId64 " MB",
                    s->ram_size / MiB - ram_size);
-        return;
+        goto out;
     }
 
     if (s->autoconfigure) {
@@ -193,6 +196,8 @@ static void rs6000mc_realize(DeviceState *dev, Error **errp)
 
     isa_register_portio_list(ISA_DEVICE(dev), &s->portio, 0x0,
                              rs6000mc_port_list, s, "rs6000mc");
+out:
+    error_propagate(errp, local_err);
 }
 
 static const VMStateDescription vmstate_rs6000mc = {
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 4eb97d3a9b..94f9d27096 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1247,8 +1247,7 @@ static void *spapr_build_fdt(SpaprMachineState *spapr)
     _FDT(fdt_setprop_cell(fdt, 0, "#size-cells", 2));
 
     /* /interrupt controller */
-    spapr->irq->dt_populate(spapr, spapr_max_server_number(spapr), fdt,
-                          PHANDLE_INTC);
+    spapr_irq_dt(spapr, spapr_max_server_number(spapr), fdt, PHANDLE_INTC);
 
     ret = spapr_populate_memory(spapr, fdt);
     if (ret < 0) {
@@ -1268,7 +1267,7 @@ static void *spapr_build_fdt(SpaprMachineState *spapr)
     }
 
     QLIST_FOREACH(phb, &spapr->phbs, list) {
-        ret = spapr_dt_phb(phb, PHANDLE_INTC, fdt, spapr->irq->nr_msis, NULL);
+        ret = spapr_dt_phb(spapr, phb, PHANDLE_INTC, fdt, NULL);
         if (ret < 0) {
             error_report("couldn't setup PCI devices in fdt");
             exit(1);
@@ -2496,6 +2495,7 @@ static CPUArchId *spapr_find_cpu_slot(MachineState *ms, uint32_t id, int *idx)
 static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
 {
     MachineState *ms = MACHINE(spapr);
+    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     Error *local_err = NULL;
     bool vsmt_user = !!spapr->vsmt;
     int kvm_smt = kvmppc_smt_threads();
@@ -2522,7 +2522,7 @@ static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
             goto out;
         }
         /* In this case, spapr->vsmt has been set by the command line */
-    } else {
+    } else if (!smc->smp_threads_vsmt) {
         /*
          * Default VSMT value is tricky, because we need it to be as
          * consistent as possible (for migration), but this requires
@@ -2531,6 +2531,8 @@ static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
          * overwhelmingly common case in production systems.
          */
         spapr->vsmt = MAX(8, smp_threads);
+    } else {
+        spapr->vsmt = smp_threads;
     }
 
     /* KVM: If necessary, set the SMT mode: */
@@ -3739,9 +3741,10 @@ void spapr_core_unplug_request(HotplugHandler *hotplug_dev, DeviceState *dev,
                           spapr_vcpu_id(spapr, cc->core_id));
     g_assert(drc);
 
-    spapr_drc_detach(drc);
-
-    spapr_hotplug_req_remove_by_index(drc);
+    if (!spapr_drc_unplug_requested(drc)) {
+        spapr_drc_detach(drc);
+        spapr_hotplug_req_remove_by_index(drc);
+    }
 }
 
 int spapr_core_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
@@ -3903,8 +3906,7 @@ int spapr_phb_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
         return -1;
     }
 
-    if (spapr_dt_phb(sphb, intc_phandle, fdt, spapr->irq->nr_msis,
-                     fdt_start_offset)) {
+    if (spapr_dt_phb(spapr, sphb, intc_phandle, fdt, fdt_start_offset)) {
         error_setg(errp, "unable to create FDT node for PHB %d", sphb->index);
         return -1;
     }
@@ -4263,7 +4265,7 @@ static void spapr_pic_print_info(InterruptStatsProvider *obj,
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
 
-    spapr->irq->print_info(spapr, mon);
+    spapr_irq_print_info(spapr, mon);
     monitor_printf(mon, "irqchip: %s\n",
                    kvm_irqchip_in_kernel() ? "in-kernel" : "emulated");
 }
@@ -4438,6 +4440,8 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     smc->irq = &spapr_irq_dual;
     smc->dr_phb_enabled = true;
     smc->linux_pci_probe = true;
+    smc->smp_threads_vsmt = true;
+    smc->nr_xirqs = SPAPR_NR_XIRQS;
 }
 
 static const TypeInfo spapr_machine_info = {
@@ -4505,6 +4509,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 
     spapr_machine_4_2_class_options(mc);
     smc->linux_pci_probe = false;
+    smc->smp_threads_vsmt = false;
     compat_props_add(mc->compat_props, hw_compat_4_1, hw_compat_4_1_len);
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
@@ -4573,6 +4578,7 @@ static void spapr_machine_3_0_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_3_0, hw_compat_3_0_len);
 
     smc->legacy_irq_allocation = true;
+    smc->nr_xirqs = 0x400;
     smc->irq = &spapr_irq_xics_legacy;
 }
 
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
index 1d93de8161..ef7b27a66d 100644
--- a/hw/ppc/spapr_cpu_core.c
+++ b/hw/ppc/spapr_cpu_core.c
@@ -25,14 +25,14 @@
 #include "sysemu/hw_accel.h"
 #include "qemu/error-report.h"
 
-static void spapr_cpu_reset(void *opaque)
+static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
-    PowerPCCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     target_ulong lpcr;
+    SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
 
     cpu_reset(cs);
 
@@ -77,9 +77,11 @@ static void spapr_cpu_reset(void *opaque)
     spapr_cpu->dtl_addr = 0;
     spapr_cpu->dtl_size = 0;
 
-    spapr_caps_cpu_apply(SPAPR_MACHINE(qdev_get_machine()), cpu);
+    spapr_caps_cpu_apply(spapr, cpu);
 
     kvm_check_mmu(cpu, &error_fatal);
+
+    spapr_irq_cpu_intc_reset(spapr, cpu);
 }
 
 void spapr_cpu_set_entry_state(PowerPCCPU *cpu, target_ulong nip, target_ulong r3)
@@ -193,7 +195,6 @@ static void spapr_unrealize_vcpu(PowerPCCPU *cpu, SpaprCpuCore *sc)
     if (!sc->pre_3_0_migration) {
         vmstate_unregister(NULL, &vmstate_spapr_cpu_state, cpu->machine_data);
     }
-    qemu_unregister_reset(spapr_cpu_reset, cpu);
     if (spapr_cpu_state(cpu)->icp) {
         object_unparent(OBJECT(spapr_cpu_state(cpu)->icp));
     }
@@ -204,12 +205,36 @@ static void spapr_unrealize_vcpu(PowerPCCPU *cpu, SpaprCpuCore *sc)
     object_unparent(OBJECT(cpu));
 }
 
+/*
+ * Called when CPUs are hot-plugged.
+ */
+static void spapr_cpu_core_reset(DeviceState *dev)
+{
+    CPUCore *cc = CPU_CORE(dev);
+    SpaprCpuCore *sc = SPAPR_CPU_CORE(dev);
+    int i;
+
+    for (i = 0; i < cc->nr_threads; i++) {
+        spapr_reset_vcpu(sc->threads[i]);
+    }
+}
+
+/*
+ * Called by the machine reset.
+ */
+static void spapr_cpu_core_reset_handler(void *opaque)
+{
+    spapr_cpu_core_reset(opaque);
+}
+
 static void spapr_cpu_core_unrealize(DeviceState *dev, Error **errp)
 {
     SpaprCpuCore *sc = SPAPR_CPU_CORE(OBJECT(dev));
     CPUCore *cc = CPU_CORE(dev);
     int i;
 
+    qemu_unregister_reset(spapr_cpu_core_reset_handler, sc);
+
     for (i = 0; i < cc->nr_threads; i++) {
         spapr_unrealize_vcpu(sc->threads[i], sc);
     }
@@ -234,12 +259,8 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
     kvmppc_set_papr(cpu);
 
-    qemu_register_reset(spapr_cpu_reset, cpu);
-    spapr_cpu_reset(cpu);
-
-    spapr->irq->cpu_intc_create(spapr, cpu, &local_err);
-    if (local_err) {
-        goto error_unregister;
+    if (spapr_irq_cpu_intc_create(spapr, cpu, &local_err) < 0) {
+        goto error_intc_create;
     }
 
     if (!sc->pre_3_0_migration) {
@@ -249,8 +270,7 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
 
     return;
 
-error_unregister:
-    qemu_unregister_reset(spapr_cpu_reset, cpu);
+error_intc_create:
     cpu_remove_sync(CPU(cpu));
 error:
     error_propagate(errp, local_err);
@@ -337,6 +357,8 @@ static void spapr_cpu_core_realize(DeviceState *dev, Error **errp)
             goto err_unrealize;
         }
     }
+
+    qemu_register_reset(spapr_cpu_core_reset_handler, sc);
     return;
 
 err_unrealize:
@@ -365,6 +387,7 @@ static void spapr_cpu_core_class_init(ObjectClass *oc, void *data)
 
     dc->realize = spapr_cpu_core_realize;
     dc->unrealize = spapr_cpu_core_unrealize;
+    dc->reset = spapr_cpu_core_reset;
     dc->props = spapr_cpu_core_properties;
     scc->cpu_type = data;
 }
diff --git a/hw/ppc/spapr_irq.c b/hw/ppc/spapr_irq.c
index 457eabe24c..b941608b69 100644
--- a/hw/ppc/spapr_irq.c
+++ b/hw/ppc/spapr_irq.c
@@ -23,9 +23,20 @@
 
 #include "trace.h"
 
-void spapr_irq_msi_init(SpaprMachineState *spapr, uint32_t nr_msis)
+static const TypeInfo spapr_intc_info = {
+    .name = TYPE_SPAPR_INTC,
+    .parent = TYPE_INTERFACE,
+    .class_size = sizeof(SpaprInterruptControllerClass),
+};
+
+static void spapr_irq_msi_init(SpaprMachineState *spapr)
 {
-    spapr->irq_map_nr = nr_msis;
+    if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
+        /* Legacy mode doesn't use this allocator */
+        return;
+    }
+
+    spapr->irq_map_nr = spapr_irq_nr_msis(spapr);
     spapr->irq_map = bitmap_new(spapr->irq_map_nr);
 }
 
@@ -59,262 +70,53 @@ void spapr_irq_msi_free(SpaprMachineState *spapr, int irq, uint32_t num)
     bitmap_clear(spapr->irq_map, irq - SPAPR_IRQ_MSI, num);
 }
 
-static void spapr_irq_init_kvm(SpaprMachineState *spapr,
-                                  SpaprIrq *irq, Error **errp)
+int spapr_irq_init_kvm(int (*fn)(SpaprInterruptController *, Error **),
+                       SpaprInterruptController *intc,
+                       Error **errp)
 {
-    MachineState *machine = MACHINE(spapr);
+    MachineState *machine = MACHINE(qdev_get_machine());
     Error *local_err = NULL;
 
     if (kvm_enabled() && machine_kernel_irqchip_allowed(machine)) {
-        irq->init_kvm(spapr, &local_err);
-        if (local_err && machine_kernel_irqchip_required(machine)) {
-            error_prepend(&local_err,
-                          "kernel_irqchip requested but unavailable: ");
-            error_propagate(errp, local_err);
-            return;
-        }
+        if (fn(intc, &local_err) < 0) {
+            if (machine_kernel_irqchip_required(machine)) {
+                error_prepend(&local_err,
+                              "kernel_irqchip requested but unavailable: ");
+                error_propagate(errp, local_err);
+                return -1;
+            }
 
-        if (!local_err) {
-            return;
+            /*
+             * We failed to initialize the KVM device, fallback to
+             * emulated mode
+             */
+            error_prepend(&local_err,
+                          "kernel_irqchip allowed but unavailable: ");
+            error_append_hint(&local_err,
+                              "Falling back to kernel-irqchip=off\n");
+            warn_report_err(local_err);
         }
-
-        /*
-         * We failed to initialize the KVM device, fallback to
-         * emulated mode
-         */
-        error_prepend(&local_err, "kernel_irqchip allowed but unavailable: ");
-        error_append_hint(&local_err, "Falling back to kernel-irqchip=off\n");
-        warn_report_err(local_err);
     }
+
+    return 0;
 }
 
 /*
  * XICS IRQ backend.
  */
 
-static int spapr_irq_claim_xics(SpaprMachineState *spapr, int irq, bool lsi,
-                                Error **errp)
-{
-    ICSState *ics = spapr->ics;
-
-    assert(ics);
-    assert(ics_valid_irq(ics, irq));
-
-    if (!ics_irq_free(ics, irq - ics->offset)) {
-        error_setg(errp, "IRQ %d is not free", irq);
-        return -1;
-    }
-
-    ics_set_irq_type(ics, irq - ics->offset, lsi);
-    return 0;
-}
-
-static void spapr_irq_free_xics(SpaprMachineState *spapr, int irq)
-{
-    ICSState *ics = spapr->ics;
-    uint32_t srcno = irq - ics->offset;
-
-    assert(ics_valid_irq(ics, irq));
-
-    memset(&ics->irqs[srcno], 0, sizeof(ICSIRQState));
-}
-
-static void spapr_irq_print_info_xics(SpaprMachineState *spapr, Monitor *mon)
-{
-    CPUState *cs;
-
-    CPU_FOREACH(cs) {
-        PowerPCCPU *cpu = POWERPC_CPU(cs);
-
-        icp_pic_print_info(spapr_cpu_state(cpu)->icp, mon);
-    }
-
-    ics_pic_print_info(spapr->ics, mon);
-}
-
-static void spapr_irq_cpu_intc_create_xics(SpaprMachineState *spapr,
-                                           PowerPCCPU *cpu, Error **errp)
-{
-    Error *local_err = NULL;
-    Object *obj;
-    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
-
-    obj = icp_create(OBJECT(cpu), TYPE_ICP, XICS_FABRIC(spapr),
-                     &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    spapr_cpu->icp = ICP(obj);
-}
-
-static int spapr_irq_post_load_xics(SpaprMachineState *spapr, int version_id)
-{
-    if (!kvm_irqchip_in_kernel()) {
-        CPUState *cs;
-        CPU_FOREACH(cs) {
-            PowerPCCPU *cpu = POWERPC_CPU(cs);
-            icp_resend(spapr_cpu_state(cpu)->icp);
-        }
-    }
-    return 0;
-}
-
-static void spapr_irq_set_irq_xics(void *opaque, int irq, int val)
-{
-    SpaprMachineState *spapr = opaque;
-    uint32_t srcno = irq - spapr->ics->offset;
-
-    ics_set_irq(spapr->ics, srcno, val);
-}
-
-static void spapr_irq_reset_xics(SpaprMachineState *spapr, Error **errp)
-{
-    Error *local_err = NULL;
-
-    spapr_irq_init_kvm(spapr, &spapr_irq_xics, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-}
-
-static void spapr_irq_init_kvm_xics(SpaprMachineState *spapr, Error **errp)
-{
-    if (kvm_enabled()) {
-        xics_kvm_connect(spapr, errp);
-    }
-}
-
 SpaprIrq spapr_irq_xics = {
-    .nr_xirqs    = SPAPR_NR_XIRQS,
-    .nr_msis     = SPAPR_NR_MSIS,
     .xics        = true,
     .xive        = false,
-
-    .claim       = spapr_irq_claim_xics,
-    .free        = spapr_irq_free_xics,
-    .print_info  = spapr_irq_print_info_xics,
-    .dt_populate = spapr_dt_xics,
-    .cpu_intc_create = spapr_irq_cpu_intc_create_xics,
-    .post_load   = spapr_irq_post_load_xics,
-    .reset       = spapr_irq_reset_xics,
-    .set_irq     = spapr_irq_set_irq_xics,
-    .init_kvm    = spapr_irq_init_kvm_xics,
 };
 
 /*
  * XIVE IRQ backend.
  */
 
-static int spapr_irq_claim_xive(SpaprMachineState *spapr, int irq, bool lsi,
-                                Error **errp)
-{
-    return spapr_xive_irq_claim(spapr->xive, irq, lsi, errp);
-}
-
-static void spapr_irq_free_xive(SpaprMachineState *spapr, int irq)
-{
-    spapr_xive_irq_free(spapr->xive, irq);
-}
-
-static void spapr_irq_print_info_xive(SpaprMachineState *spapr,
-                                      Monitor *mon)
-{
-    CPUState *cs;
-
-    CPU_FOREACH(cs) {
-        PowerPCCPU *cpu = POWERPC_CPU(cs);
-
-        xive_tctx_pic_print_info(spapr_cpu_state(cpu)->tctx, mon);
-    }
-
-    spapr_xive_pic_print_info(spapr->xive, mon);
-}
-
-static void spapr_irq_cpu_intc_create_xive(SpaprMachineState *spapr,
-                                           PowerPCCPU *cpu, Error **errp)
-{
-    Error *local_err = NULL;
-    Object *obj;
-    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
-
-    obj = xive_tctx_create(OBJECT(cpu), XIVE_ROUTER(spapr->xive), &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    spapr_cpu->tctx = XIVE_TCTX(obj);
-
-    /*
-     * (TCG) Early setting the OS CAM line for hotplugged CPUs as they
-     * don't beneficiate from the reset of the XIVE IRQ backend
-     */
-    spapr_xive_set_tctx_os_cam(spapr_cpu->tctx);
-}
-
-static int spapr_irq_post_load_xive(SpaprMachineState *spapr, int version_id)
-{
-    return spapr_xive_post_load(spapr->xive, version_id);
-}
-
-static void spapr_irq_reset_xive(SpaprMachineState *spapr, Error **errp)
-{
-    CPUState *cs;
-    Error *local_err = NULL;
-
-    CPU_FOREACH(cs) {
-        PowerPCCPU *cpu = POWERPC_CPU(cs);
-
-        /* (TCG) Set the OS CAM line of the thread interrupt context. */
-        spapr_xive_set_tctx_os_cam(spapr_cpu_state(cpu)->tctx);
-    }
-
-    spapr_irq_init_kvm(spapr, &spapr_irq_xive, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    /* Activate the XIVE MMIOs */
-    spapr_xive_mmio_set_enabled(spapr->xive, true);
-}
-
-static void spapr_irq_set_irq_xive(void *opaque, int irq, int val)
-{
-    SpaprMachineState *spapr = opaque;
-
-    if (kvm_irqchip_in_kernel()) {
-        kvmppc_xive_source_set_irq(&spapr->xive->source, irq, val);
-    } else {
-        xive_source_set_irq(&spapr->xive->source, irq, val);
-    }
-}
-
-static void spapr_irq_init_kvm_xive(SpaprMachineState *spapr, Error **errp)
-{
-    if (kvm_enabled()) {
-        kvmppc_xive_connect(spapr->xive, errp);
-    }
-}
-
 SpaprIrq spapr_irq_xive = {
-    .nr_xirqs    = SPAPR_NR_XIRQS,
-    .nr_msis     = SPAPR_NR_MSIS,
     .xics        = false,
     .xive        = true,
-
-    .claim       = spapr_irq_claim_xive,
-    .free        = spapr_irq_free_xive,
-    .print_info  = spapr_irq_print_info_xive,
-    .dt_populate = spapr_dt_xive,
-    .cpu_intc_create = spapr_irq_cpu_intc_create_xive,
-    .post_load   = spapr_irq_post_load_xive,
-    .reset       = spapr_irq_reset_xive,
-    .set_irq     = spapr_irq_set_irq_xive,
-    .init_kvm    = spapr_irq_init_kvm_xive,
 };
 
 /*
@@ -327,138 +129,11 @@ SpaprIrq spapr_irq_xive = {
  */
 
 /*
- * Returns the sPAPR IRQ backend negotiated by CAS. XICS is the
- * default.
- */
-static SpaprIrq *spapr_irq_current(SpaprMachineState *spapr)
-{
-    return spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT) ?
-        &spapr_irq_xive : &spapr_irq_xics;
-}
-
-static int spapr_irq_claim_dual(SpaprMachineState *spapr, int irq, bool lsi,
-                                Error **errp)
-{
-    Error *local_err = NULL;
-    int ret;
-
-    ret = spapr_irq_xics.claim(spapr, irq, lsi, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return ret;
-    }
-
-    ret = spapr_irq_xive.claim(spapr, irq, lsi, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return ret;
-    }
-
-    return ret;
-}
-
-static void spapr_irq_free_dual(SpaprMachineState *spapr, int irq)
-{
-    spapr_irq_xics.free(spapr, irq);
-    spapr_irq_xive.free(spapr, irq);
-}
-
-static void spapr_irq_print_info_dual(SpaprMachineState *spapr, Monitor *mon)
-{
-    spapr_irq_current(spapr)->print_info(spapr, mon);
-}
-
-static void spapr_irq_dt_populate_dual(SpaprMachineState *spapr,
-                                       uint32_t nr_servers, void *fdt,
-                                       uint32_t phandle)
-{
-    spapr_irq_current(spapr)->dt_populate(spapr, nr_servers, fdt, phandle);
-}
-
-static void spapr_irq_cpu_intc_create_dual(SpaprMachineState *spapr,
-                                           PowerPCCPU *cpu, Error **errp)
-{
-    Error *local_err = NULL;
-
-    spapr_irq_xive.cpu_intc_create(spapr, cpu, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    spapr_irq_xics.cpu_intc_create(spapr, cpu, errp);
-}
-
-static int spapr_irq_post_load_dual(SpaprMachineState *spapr, int version_id)
-{
-    /*
-     * Force a reset of the XIVE backend after migration. The machine
-     * defaults to XICS at startup.
-     */
-    if (spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
-        if (kvm_irqchip_in_kernel()) {
-            xics_kvm_disconnect(spapr, &error_fatal);
-        }
-        spapr_irq_xive.reset(spapr, &error_fatal);
-    }
-
-    return spapr_irq_current(spapr)->post_load(spapr, version_id);
-}
-
-static void spapr_irq_reset_dual(SpaprMachineState *spapr, Error **errp)
-{
-    Error *local_err = NULL;
-
-    /*
-     * Deactivate the XIVE MMIOs. The XIVE backend will reenable them
-     * if selected.
-     */
-    spapr_xive_mmio_set_enabled(spapr->xive, false);
-
-    /* Destroy all KVM devices */
-    if (kvm_irqchip_in_kernel()) {
-        xics_kvm_disconnect(spapr, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            error_prepend(errp, "KVM XICS disconnect failed: ");
-            return;
-        }
-        kvmppc_xive_disconnect(spapr->xive, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            error_prepend(errp, "KVM XIVE disconnect failed: ");
-            return;
-        }
-    }
-
-    spapr_irq_current(spapr)->reset(spapr, errp);
-}
-
-static void spapr_irq_set_irq_dual(void *opaque, int irq, int val)
-{
-    SpaprMachineState *spapr = opaque;
-
-    spapr_irq_current(spapr)->set_irq(spapr, irq, val);
-}
-
-/*
  * Define values in sync with the XIVE and XICS backend
  */
 SpaprIrq spapr_irq_dual = {
-    .nr_xirqs    = SPAPR_NR_XIRQS,
-    .nr_msis     = SPAPR_NR_MSIS,
     .xics        = true,
     .xive        = true,
-
-    .claim       = spapr_irq_claim_dual,
-    .free        = spapr_irq_free_dual,
-    .print_info  = spapr_irq_print_info_dual,
-    .dt_populate = spapr_irq_dt_populate_dual,
-    .cpu_intc_create = spapr_irq_cpu_intc_create_dual,
-    .post_load   = spapr_irq_post_load_dual,
-    .reset       = spapr_irq_reset_dual,
-    .set_irq     = spapr_irq_set_irq_dual,
-    .init_kvm    = NULL, /* should not be used */
 };
 
 
@@ -521,9 +196,85 @@ static int spapr_irq_check(SpaprMachineState *spapr, Error **errp)
 /*
  * sPAPR IRQ frontend routines for devices
  */
+#define ALL_INTCS(spapr_) \
+    { SPAPR_INTC((spapr_)->ics), SPAPR_INTC((spapr_)->xive), }
+
+int spapr_irq_cpu_intc_create(SpaprMachineState *spapr,
+                              PowerPCCPU *cpu, Error **errp)
+{
+    SpaprInterruptController *intcs[] = ALL_INTCS(spapr);
+    int i;
+    int rc;
+
+    for (i = 0; i < ARRAY_SIZE(intcs); i++) {
+        SpaprInterruptController *intc = intcs[i];
+        if (intc) {
+            SpaprInterruptControllerClass *sicc = SPAPR_INTC_GET_CLASS(intc);
+            rc = sicc->cpu_intc_create(intc, cpu, errp);
+            if (rc < 0) {
+                return rc;
+            }
+        }
+    }
+
+    return 0;
+}
+
+void spapr_irq_cpu_intc_reset(SpaprMachineState *spapr, PowerPCCPU *cpu)
+{
+    SpaprInterruptController *intcs[] = ALL_INTCS(spapr);
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(intcs); i++) {
+        SpaprInterruptController *intc = intcs[i];
+        if (intc) {
+            SpaprInterruptControllerClass *sicc = SPAPR_INTC_GET_CLASS(intc);
+            sicc->cpu_intc_reset(intc, cpu);
+        }
+    }
+}
+
+static void spapr_set_irq(void *opaque, int irq, int level)
+{
+    SpaprMachineState *spapr = SPAPR_MACHINE(opaque);
+    SpaprInterruptControllerClass *sicc
+        = SPAPR_INTC_GET_CLASS(spapr->active_intc);
+
+    sicc->set_irq(spapr->active_intc, irq, level);
+}
+
+void spapr_irq_print_info(SpaprMachineState *spapr, Monitor *mon)
+{
+    SpaprInterruptControllerClass *sicc
+        = SPAPR_INTC_GET_CLASS(spapr->active_intc);
+
+    sicc->print_info(spapr->active_intc, mon);
+}
+
+void spapr_irq_dt(SpaprMachineState *spapr, uint32_t nr_servers,
+                  void *fdt, uint32_t phandle)
+{
+    SpaprInterruptControllerClass *sicc
+        = SPAPR_INTC_GET_CLASS(spapr->active_intc);
+
+    sicc->dt(spapr->active_intc, nr_servers, fdt, phandle);
+}
+
+uint32_t spapr_irq_nr_msis(SpaprMachineState *spapr)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
+
+    if (smc->legacy_irq_allocation) {
+        return smc->nr_xirqs;
+    } else {
+        return SPAPR_XIRQ_BASE + smc->nr_xirqs - SPAPR_IRQ_MSI;
+    }
+}
+
 void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
 {
     MachineState *machine = MACHINE(spapr);
+    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
 
     if (machine_kernel_irqchip_split(machine)) {
         error_setg(errp, "kernel_irqchip split mode not supported on pseries");
@@ -541,9 +292,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
     }
 
     /* Initialize the MSI IRQ allocator. */
-    if (!SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
-        spapr_irq_msi_init(spapr, spapr->irq->nr_msis);
-    }
+    spapr_irq_msi_init(spapr);
 
     if (spapr->irq->xics) {
         Error *local_err = NULL;
@@ -563,8 +312,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
             return;
         }
 
-        object_property_set_int(obj, spapr->irq->nr_xirqs, "nr-irqs",
-                                &local_err);
+        object_property_set_int(obj, smc->nr_xirqs, "nr-irqs", &local_err);
         if (local_err) {
             error_propagate(errp, local_err);
             return;
@@ -585,8 +333,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
         int i;
 
         dev = qdev_create(NULL, TYPE_SPAPR_XIVE);
-        qdev_prop_set_uint32(dev, "nr-irqs",
-                             spapr->irq->nr_xirqs + SPAPR_XIRQ_BASE);
+        qdev_prop_set_uint32(dev, "nr-irqs", smc->nr_xirqs + SPAPR_XIRQ_BASE);
         /*
          * 8 XIVE END structures per CPU. One for each available
          * priority
@@ -598,8 +345,11 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
 
         /* Enable the CPU IPIs */
         for (i = 0; i < nr_servers; ++i) {
-            if (spapr_xive_irq_claim(spapr->xive, SPAPR_IRQ_IPI + i,
-                                     false, errp) < 0) {
+            SpaprInterruptControllerClass *sicc
+                = SPAPR_INTC_GET_CLASS(spapr->xive);
+
+            if (sicc->claim_irq(SPAPR_INTC(spapr->xive), SPAPR_IRQ_IPI + i,
+                                false, errp) < 0) {
                 return;
             }
         }
@@ -607,32 +357,60 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
         spapr_xive_hcall_init(spapr);
     }
 
-    spapr->qirqs = qemu_allocate_irqs(spapr->irq->set_irq, spapr,
-                                      spapr->irq->nr_xirqs + SPAPR_XIRQ_BASE);
+    spapr->qirqs = qemu_allocate_irqs(spapr_set_irq, spapr,
+                                      smc->nr_xirqs + SPAPR_XIRQ_BASE);
 }
 
 int spapr_irq_claim(SpaprMachineState *spapr, int irq, bool lsi, Error **errp)
 {
+    SpaprInterruptController *intcs[] = ALL_INTCS(spapr);
+    int i;
+    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
+    int rc;
+
     assert(irq >= SPAPR_XIRQ_BASE);
-    assert(irq < (spapr->irq->nr_xirqs + SPAPR_XIRQ_BASE));
+    assert(irq < (smc->nr_xirqs + SPAPR_XIRQ_BASE));
+
+    for (i = 0; i < ARRAY_SIZE(intcs); i++) {
+        SpaprInterruptController *intc = intcs[i];
+        if (intc) {
+            SpaprInterruptControllerClass *sicc = SPAPR_INTC_GET_CLASS(intc);
+            rc = sicc->claim_irq(intc, irq, lsi, errp);
+            if (rc < 0) {
+                return rc;
+            }
+        }
+    }
 
-    return spapr->irq->claim(spapr, irq, lsi, errp);
+    return 0;
 }
 
 void spapr_irq_free(SpaprMachineState *spapr, int irq, int num)
 {
-    int i;
+    SpaprInterruptController *intcs[] = ALL_INTCS(spapr);
+    int i, j;
+    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
 
     assert(irq >= SPAPR_XIRQ_BASE);
-    assert((irq + num) <= (spapr->irq->nr_xirqs + SPAPR_XIRQ_BASE));
+    assert((irq + num) <= (smc->nr_xirqs + SPAPR_XIRQ_BASE));
 
     for (i = irq; i < (irq + num); i++) {
-        spapr->irq->free(spapr, i);
+        for (j = 0; j < ARRAY_SIZE(intcs); j++) {
+            SpaprInterruptController *intc = intcs[j];
+
+            if (intc) {
+                SpaprInterruptControllerClass *sicc
+                    = SPAPR_INTC_GET_CLASS(intc);
+                sicc->free_irq(intc, i);
+            }
+        }
     }
 }
 
 qemu_irq spapr_qirq(SpaprMachineState *spapr, int irq)
 {
+    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
+
     /*
      * This interface is basically for VIO and PHB devices to find the
      * right qemu_irq to manipulate, so we only allow access to the
@@ -641,7 +419,7 @@ qemu_irq spapr_qirq(SpaprMachineState *spapr, int irq)
      * interfaces, we can change this if we need to in future.
      */
     assert(irq >= SPAPR_XIRQ_BASE);
-    assert(irq < (spapr->irq->nr_xirqs + SPAPR_XIRQ_BASE));
+    assert(irq < (smc->nr_xirqs + SPAPR_XIRQ_BASE));
 
     if (spapr->ics) {
         assert(ics_valid_irq(spapr->ics, irq));
@@ -656,16 +434,18 @@ qemu_irq spapr_qirq(SpaprMachineState *spapr, int irq)
 
 int spapr_irq_post_load(SpaprMachineState *spapr, int version_id)
 {
-    return spapr->irq->post_load(spapr, version_id);
+    SpaprInterruptControllerClass *sicc;
+
+    spapr_irq_update_active_intc(spapr);
+    sicc = SPAPR_INTC_GET_CLASS(spapr->active_intc);
+    return sicc->post_load(spapr->active_intc, version_id);
 }
 
 void spapr_irq_reset(SpaprMachineState *spapr, Error **errp)
 {
     assert(!spapr->irq_map || bitmap_empty(spapr->irq_map, spapr->irq_map_nr));
 
-    if (spapr->irq->reset) {
-        spapr->irq->reset(spapr, errp);
-    }
+    spapr_irq_update_active_intc(spapr);
 }
 
 int spapr_irq_get_phandle(SpaprMachineState *spapr, void *fdt, Error **errp)
@@ -689,6 +469,54 @@ int spapr_irq_get_phandle(SpaprMachineState *spapr, void *fdt, Error **errp)
     return phandle;
 }
 
+static void set_active_intc(SpaprMachineState *spapr,
+                            SpaprInterruptController *new_intc)
+{
+    SpaprInterruptControllerClass *sicc;
+
+    assert(new_intc);
+
+    if (new_intc == spapr->active_intc) {
+        /* Nothing to do */
+        return;
+    }
+
+    if (spapr->active_intc) {
+        sicc = SPAPR_INTC_GET_CLASS(spapr->active_intc);
+        if (sicc->deactivate) {
+            sicc->deactivate(spapr->active_intc);
+        }
+    }
+
+    sicc = SPAPR_INTC_GET_CLASS(new_intc);
+    if (sicc->activate) {
+        sicc->activate(new_intc, &error_fatal);
+    }
+
+    spapr->active_intc = new_intc;
+}
+
+void spapr_irq_update_active_intc(SpaprMachineState *spapr)
+{
+    SpaprInterruptController *new_intc;
+
+    if (!spapr->ics) {
+        /*
+         * XXX before we run CAS, ov5_cas is initialized empty, which
+         * indicates XICS, even if we have ic-mode=xive.  TODO: clean
+         * up the CAS path so that we have a clearer way of handling
+         * this.
+         */
+        new_intc = SPAPR_INTC(spapr->xive);
+    } else if (spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
+        new_intc = SPAPR_INTC(spapr->xive);
+    } else {
+        new_intc = SPAPR_INTC(spapr->ics);
+    }
+
+    set_active_intc(spapr, new_intc);
+}
+
 /*
  * XICS legacy routines - to deprecate one day
  */
@@ -744,21 +572,14 @@ int spapr_irq_find(SpaprMachineState *spapr, int num, bool align, Error **errp)
     return first + ics->offset;
 }
 
-#define SPAPR_IRQ_XICS_LEGACY_NR_XIRQS     0x400
-
 SpaprIrq spapr_irq_xics_legacy = {
-    .nr_xirqs    = SPAPR_IRQ_XICS_LEGACY_NR_XIRQS,
-    .nr_msis     = SPAPR_IRQ_XICS_LEGACY_NR_XIRQS,
     .xics        = true,
     .xive        = false,
-
-    .claim       = spapr_irq_claim_xics,
-    .free        = spapr_irq_free_xics,
-    .print_info  = spapr_irq_print_info_xics,
-    .dt_populate = spapr_dt_xics,
-    .cpu_intc_create = spapr_irq_cpu_intc_create_xics,
-    .post_load   = spapr_irq_post_load_xics,
-    .reset       = spapr_irq_reset_xics,
-    .set_irq     = spapr_irq_set_irq_xics,
-    .init_kvm    = spapr_irq_init_kvm_xics,
 };
+
+static void spapr_irq_register_types(void)
+{
+    type_register_static(&spapr_intc_info);
+}
+
+type_init(spapr_irq_register_types)
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 01ff41d4c4..cc0e7829b6 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2277,8 +2277,8 @@ static void spapr_phb_pci_enumerate(SpaprPhbState *phb)
 
 }
 
-int spapr_dt_phb(SpaprPhbState *phb, uint32_t intc_phandle, void *fdt,
-                 uint32_t nr_msis, int *node_offset)
+int spapr_dt_phb(SpaprMachineState *spapr, SpaprPhbState *phb,
+                 uint32_t intc_phandle, void *fdt, int *node_offset)
 {
     int bus_off, i, j, ret;
     uint32_t bus_range[] = { cpu_to_be32(0), cpu_to_be32(0xff) };
@@ -2343,7 +2343,8 @@ int spapr_dt_phb(SpaprPhbState *phb, uint32_t intc_phandle, void *fdt,
     _FDT(fdt_setprop(fdt, bus_off, "ranges", &ranges, sizeof_ranges));
     _FDT(fdt_setprop(fdt, bus_off, "reg", &bus_reg, sizeof(bus_reg)));
     _FDT(fdt_setprop_cell(fdt, bus_off, "ibm,pci-config-space-type", 0x1));
-    _FDT(fdt_setprop_cell(fdt, bus_off, "ibm,pe-total-#msi", nr_msis));
+    _FDT(fdt_setprop_cell(fdt, bus_off, "ibm,pe-total-#msi",
+                          spapr_irq_nr_msis(spapr)));
 
     /* Dynamic DMA window */
     if (phb->ddw_enabled) {
diff --git a/hw/rtc/Kconfig b/hw/rtc/Kconfig
new file mode 100644
index 0000000000..45daa8d655
--- /dev/null
+++ b/hw/rtc/Kconfig
@@ -0,0 +1,23 @@
+config DS1338
+    bool
+    depends on I2C
+
+config M41T80
+    bool
+    depends on I2C
+
+config M48T59
+    bool
+
+config PL031
+    bool
+
+config TWL92230
+    bool
+    depends on I2C
+
+config MC146818RTC
+    bool
+
+config SUN4V_RTC
+    bool
diff --git a/hw/rtc/Makefile.objs b/hw/rtc/Makefile.objs
new file mode 100644
index 0000000000..8dc9fcd3a9
--- /dev/null
+++ b/hw/rtc/Makefile.objs
@@ -0,0 +1,13 @@
+common-obj-$(CONFIG_DS1338) += ds1338.o
+common-obj-$(CONFIG_M41T80) += m41t80.o
+common-obj-$(CONFIG_M48T59) += m48t59.o
+ifeq ($(CONFIG_ISA_BUS),y)
+common-obj-$(CONFIG_M48T59) += m48t59-isa.o
+endif
+common-obj-$(CONFIG_PL031) += pl031.o
+common-obj-$(CONFIG_TWL92230) += twl92230.o
+common-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp-rtc.o
+common-obj-$(CONFIG_EXYNOS4) += exynos4210_rtc.o
+obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
+common-obj-$(CONFIG_SUN4V_RTC) += sun4v-rtc.o
+common-obj-$(CONFIG_ASPEED_SOC) += aspeed_rtc.o
diff --git a/hw/timer/aspeed_rtc.c b/hw/rtc/aspeed_rtc.c
index 5313017353..3ca1183558 100644
--- a/hw/timer/aspeed_rtc.c
+++ b/hw/rtc/aspeed_rtc.c
@@ -8,7 +8,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "hw/timer/aspeed_rtc.h"
+#include "hw/rtc/aspeed_rtc.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/timer.h"
diff --git a/hw/timer/ds1338.c b/hw/rtc/ds1338.c
index 588a9ba9be..588a9ba9be 100644
--- a/hw/timer/ds1338.c
+++ b/hw/rtc/ds1338.c
diff --git a/hw/timer/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
index f85483a07f..f85483a07f 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/rtc/exynos4210_rtc.c
diff --git a/hw/timer/m41t80.c b/hw/rtc/m41t80.c
index 914ecac8f4..914ecac8f4 100644
--- a/hw/timer/m41t80.c
+++ b/hw/rtc/m41t80.c
diff --git a/hw/timer/m48t59-internal.h b/hw/rtc/m48t59-internal.h
index 4d4f2a6fed..4d4f2a6fed 100644
--- a/hw/timer/m48t59-internal.h
+++ b/hw/rtc/m48t59-internal.h
diff --git a/hw/timer/m48t59-isa.c b/hw/rtc/m48t59-isa.c
index 5e5432abfd..7fde854c0f 100644
--- a/hw/timer/m48t59-isa.c
+++ b/hw/rtc/m48t59-isa.c
@@ -1,5 +1,5 @@
 /*
- * QEMU M48T59 and M48T08 NVRAM emulation (ISA bus interface
+ * QEMU M48T59 and M48T08 NVRAM emulation (ISA bus interface)
  *
  * Copyright (c) 2003-2005, 2007 Jocelyn Mayer
  * Copyright (c) 2013 Hervé Poussineau
@@ -26,7 +26,7 @@
 #include "qemu/osdep.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
-#include "hw/timer/m48t59.h"
+#include "hw/rtc/m48t59.h"
 #include "m48t59-internal.h"
 #include "qemu/module.h"
 
diff --git a/hw/timer/m48t59.c b/hw/rtc/m48t59.c
index a9fc2f981a..fc592b9fb1 100644
--- a/hw/timer/m48t59.c
+++ b/hw/rtc/m48t59.c
@@ -27,7 +27,7 @@
 #include "qemu-common.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
-#include "hw/timer/m48t59.h"
+#include "hw/rtc/m48t59.h"
 #include "qemu/timer.h"
 #include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/timer/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index 0d7784b104..ee6bf82b40 100644
--- a/hw/timer/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -34,13 +34,14 @@
 #include "sysemu/replay.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc_regs.h"
 #include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "qapi/qapi-events-misc-target.h"
 #include "qapi/visitor.h"
 #include "exec/address-spaces.h"
-#include "hw/timer/mc146818rtc_regs.h"
+#include "hw/rtc/mc146818rtc_regs.h"
 
 #ifdef TARGET_I386
 #include "qapi/qapi-commands-misc-target.h"
diff --git a/hw/timer/pl031.c b/hw/rtc/pl031.c
index 2b3e261006..3a982752a2 100644
--- a/hw/timer/pl031.c
+++ b/hw/rtc/pl031.c
@@ -13,7 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "hw/timer/pl031.h"
+#include "hw/rtc/pl031.h"
 #include "migration/vmstate.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/timer/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index 54272a822f..ada01b5774 100644
--- a/hw/timer/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -13,7 +13,7 @@
 #include "hw/sysbus.h"
 #include "qemu/module.h"
 #include "qemu/timer.h"
-#include "hw/timer/sun4v-rtc.h"
+#include "hw/rtc/sun4v-rtc.h"
 #include "trace.h"
 
 
diff --git a/hw/rtc/trace-events b/hw/rtc/trace-events
new file mode 100644
index 0000000000..d6749f4616
--- /dev/null
+++ b/hw/rtc/trace-events
@@ -0,0 +1,19 @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# sun4v-rtc.c
+sun4v_rtc_read(uint64_t addr, uint64_t value) "read: addr 0x%" PRIx64 " value 0x%" PRIx64
+sun4v_rtc_write(uint64_t addr, uint64_t value) "write: addr 0x%" PRIx64 " value 0x%" PRIx64
+
+# xlnx-zynqmp-rtc.c
+xlnx_zynqmp_rtc_gettime(int year, int month, int day, int hour, int min, int sec) "Get time from host: %d-%d-%d %2d:%02d:%02d"
+
+# pl031.c
+pl031_irq_state(int level) "irq state %d"
+pl031_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+pl031_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+pl031_alarm_raised(void) "alarm raised"
+pl031_set_alarm(uint32_t ticks) "alarm set for %u ticks"
+
+# aspeed-rtc.c
+aspeed_rtc_read(uint64_t addr, uint64_t value) "addr 0x%02" PRIx64 " value 0x%08" PRIx64
+aspeed_rtc_write(uint64_t addr, uint64_t value) "addr 0x%02" PRIx64 " value 0x%08" PRIx64
diff --git a/hw/timer/twl92230.c b/hw/rtc/twl92230.c
index 63bd13d2ca..63bd13d2ca 100644
--- a/hw/timer/twl92230.c
+++ b/hw/rtc/twl92230.c
diff --git a/hw/timer/xlnx-zynqmp-rtc.c b/hw/rtc/xlnx-zynqmp-rtc.c
index 5692db98c2..2bcd14d779 100644
--- a/hw/timer/xlnx-zynqmp-rtc.c
+++ b/hw/rtc/xlnx-zynqmp-rtc.c
@@ -32,11 +32,10 @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "hw/irq.h"
-#include "hw/ptimer.h"
 #include "qemu/cutils.h"
 #include "sysemu/sysemu.h"
 #include "trace.h"
-#include "hw/timer/xlnx-zynqmp-rtc.h"
+#include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "migration/vmstate.h"
 
 #ifndef XLNX_ZYNQMP_RTC_ERR_DEBUG
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index e08ec3e398..88404d0e9d 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1532,6 +1532,8 @@ static const TypeInfo sdhci_bus_info = {
     .class_init = sdhci_bus_class_init,
 };
 
+/* --- qdev i.MX eSDHC --- */
+
 static uint64_t usdhc_read(void *opaque, hwaddr offset, unsigned size)
 {
     SDHCIState *s = SYSBUS_SDHCI(opaque);
@@ -1734,7 +1736,6 @@ usdhc_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
     }
 }
 
-
 static const MemoryRegionOps usdhc_mmio_ops = {
     .read = usdhc_read,
     .write = usdhc_write,
@@ -1760,11 +1761,76 @@ static const TypeInfo imx_usdhc_info = {
     .instance_init = imx_usdhc_init,
 };
 
+/* --- qdev Samsung s3c --- */
+
+#define S3C_SDHCI_CONTROL2      0x80
+#define S3C_SDHCI_CONTROL3      0x84
+#define S3C_SDHCI_CONTROL4      0x8c
+
+static uint64_t sdhci_s3c_read(void *opaque, hwaddr offset, unsigned size)
+{
+    uint64_t ret;
+
+    switch (offset) {
+    case S3C_SDHCI_CONTROL2:
+    case S3C_SDHCI_CONTROL3:
+    case S3C_SDHCI_CONTROL4:
+        /* ignore */
+        ret = 0;
+        break;
+    default:
+        ret = sdhci_read(opaque, offset, size);
+        break;
+    }
+
+    return ret;
+}
+
+static void sdhci_s3c_write(void *opaque, hwaddr offset, uint64_t val,
+                            unsigned size)
+{
+    switch (offset) {
+    case S3C_SDHCI_CONTROL2:
+    case S3C_SDHCI_CONTROL3:
+    case S3C_SDHCI_CONTROL4:
+        /* ignore */
+        break;
+    default:
+        sdhci_write(opaque, offset, val, size);
+        break;
+    }
+}
+
+static const MemoryRegionOps sdhci_s3c_mmio_ops = {
+    .read = sdhci_s3c_read,
+    .write = sdhci_s3c_write,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+        .unaligned = false
+    },
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void sdhci_s3c_init(Object *obj)
+{
+    SDHCIState *s = SYSBUS_SDHCI(obj);
+
+    s->io_ops = &sdhci_s3c_mmio_ops;
+}
+
+static const TypeInfo sdhci_s3c_info = {
+    .name = TYPE_S3C_SDHCI  ,
+    .parent = TYPE_SYSBUS_SDHCI,
+    .instance_init = sdhci_s3c_init,
+};
+
 static void sdhci_register_types(void)
 {
     type_register_static(&sdhci_sysbus_info);
     type_register_static(&sdhci_bus_info);
     type_register_static(&imx_usdhc_info);
+    type_register_static(&sdhci_s3c_info);
 }
 
 type_init(sdhci_register_types)
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 6c5a17a020..2aaa5bf1ae 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -31,7 +31,7 @@
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
 #include "hw/sparc/sun4m_iommu.h"
-#include "hw/timer/m48t59.h"
+#include "hw/rtc/m48t59.h"
 #include "migration/vmstate.h"
 #include "hw/sparc/sparc32_dma.h"
 #include "hw/block/fdc.h"
diff --git a/hw/sparc64/niagara.c b/hw/sparc64/niagara.c
index 167143bffe..5eb2d097b9 100644
--- a/hw/sparc64/niagara.c
+++ b/hw/sparc64/niagara.c
@@ -30,12 +30,13 @@
 #include "hw/misc/unimp.h"
 #include "hw/loader.h"
 #include "hw/sparc/sparc64.h"
-#include "hw/timer/sun4v-rtc.h"
+#include "hw/rtc/sun4v-rtc.h"
 #include "exec/address-spaces.h"
 #include "sysemu/block-backend.h"
 #include "qemu/error-report.h"
 #include "sysemu/qtest.h"
 #include "sysemu/sysemu.h"
+#include "qapi/error.h"
 
 typedef struct NiagaraBoardState {
     MemoryRegion hv_ram;
@@ -106,8 +107,8 @@ static void niagara_init(MachineState *machine)
     /* init CPUs */
     sparc64_cpu_devinit(machine->cpu_type, NIAGARA_PROM_BASE);
     /* set up devices */
-    memory_region_allocate_system_memory(&s->hv_ram, NULL, "sun4v-hv.ram",
-                                         NIAGARA_HV_RAM_SIZE);
+    memory_region_init_ram(&s->hv_ram, NULL, "sun4v-hv.ram",
+                           NIAGARA_HV_RAM_SIZE, &error_fatal);
     memory_region_add_subregion(sysmem, NIAGARA_HV_RAM_BASE, &s->hv_ram);
 
     memory_region_allocate_system_memory(&s->partition_ram, NULL,
@@ -116,17 +117,17 @@ static void niagara_init(MachineState *machine)
     memory_region_add_subregion(sysmem, NIAGARA_PARTITION_RAM_BASE,
                                 &s->partition_ram);
 
-    memory_region_allocate_system_memory(&s->nvram, NULL,
-                                         "sun4v.nvram", NIAGARA_NVRAM_SIZE);
+    memory_region_init_ram(&s->nvram, NULL, "sun4v.nvram", NIAGARA_NVRAM_SIZE,
+                           &error_fatal);
     memory_region_add_subregion(sysmem, NIAGARA_NVRAM_BASE, &s->nvram);
-    memory_region_allocate_system_memory(&s->md_rom, NULL,
-                                         "sun4v-md.rom", NIAGARA_MD_ROM_SIZE);
+    memory_region_init_ram(&s->md_rom, NULL, "sun4v-md.rom",
+                           NIAGARA_MD_ROM_SIZE, &error_fatal);
     memory_region_add_subregion(sysmem, NIAGARA_MD_ROM_BASE, &s->md_rom);
-    memory_region_allocate_system_memory(&s->hv_rom, NULL,
-                                         "sun4v-hv.rom", NIAGARA_HV_ROM_SIZE);
+    memory_region_init_ram(&s->hv_rom, NULL, "sun4v-hv.rom",
+                           NIAGARA_HV_ROM_SIZE, &error_fatal);
     memory_region_add_subregion(sysmem, NIAGARA_HV_ROM_BASE, &s->hv_rom);
-    memory_region_allocate_system_memory(&s->prom, NULL,
-                                         "sun4v.prom", PROM_SIZE_MAX);
+    memory_region_init_ram(&s->prom, NULL, "sun4v.prom", PROM_SIZE_MAX,
+                           &error_fatal);
     memory_region_add_subregion(sysmem, NIAGARA_PROM_BASE, &s->prom);
 
     add_rom_or_fail("nvram1", NIAGARA_NVRAM_BASE);
@@ -143,8 +144,8 @@ static void niagara_init(MachineState *machine)
         BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
         int size = blk_getlength(blk);
         if (size > 0) {
-            memory_region_allocate_system_memory(&s->vdisk_ram, NULL,
-                                                 "sun4v_vdisk.ram", size);
+            memory_region_init_ram(&s->vdisk_ram, NULL, "sun4v_vdisk.ram", size,
+                                   &error_fatal);
             memory_region_add_subregion(get_system_memory(),
                                         NIAGARA_VDISK_BASE, &s->vdisk_ram);
             dinfo->is_default = 1;
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 1ded2a4c9a..955082773b 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -36,7 +36,7 @@
 #include "hw/pci-host/sabre.h"
 #include "hw/char/serial.h"
 #include "hw/char/parallel.h"
-#include "hw/timer/m48t59.h"
+#include "hw/rtc/m48t59.h"
 #include "migration/vmstate.h"
 #include "hw/input/i8042.h"
 #include "hw/block/fdc.h"
diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig
index eefc95f35e..a990f9fe35 100644
--- a/hw/timer/Kconfig
+++ b/hw/timer/Kconfig
@@ -9,10 +9,6 @@ config ARM_MPTIMER
 config A9_GTIMER
     bool
 
-config DS1338
-    bool
-    depends on I2C
-
 config HPET
     bool
     default y if PC
@@ -20,27 +16,10 @@ config HPET
 config I8254
     bool
 
-config M41T80
-    bool
-    depends on I2C
-
-config M48T59
-    bool
-
-config PL031
-    bool
-
-config TWL92230
-    bool
-    depends on I2C
-
 config ALTERA_TIMER
     bool
     select PTIMER
 
-config MC146818RTC
-    bool
-
 config ALLWINNER_A10_PIT
     bool
     select PTIMER
@@ -48,9 +27,6 @@ config ALLWINNER_A10_PIT
 config STM32F2XX_TIMER
     bool
 
-config SUN4V_RTC
-    bool
-
 config CMSDK_APB_TIMER
     bool
     select PTIMER
diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
index 123d92c969..dece235fd7 100644
--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -3,17 +3,9 @@ common-obj-$(CONFIG_ARM_MPTIMER) += arm_mptimer.o
 common-obj-$(CONFIG_ARM_V7M) += armv7m_systick.o
 common-obj-$(CONFIG_A9_GTIMER) += a9gtimer.o
 common-obj-$(CONFIG_CADENCE) += cadence_ttc.o
-common-obj-$(CONFIG_DS1338) += ds1338.o
 common-obj-$(CONFIG_HPET) += hpet.o
 common-obj-$(CONFIG_I8254) += i8254_common.o i8254.o
-common-obj-$(CONFIG_M41T80) += m41t80.o
-common-obj-$(CONFIG_M48T59) += m48t59.o
-ifeq ($(CONFIG_ISA_BUS),y)
-common-obj-$(CONFIG_M48T59) += m48t59-isa.o
-endif
-common-obj-$(CONFIG_PL031) += pl031.o
 common-obj-$(CONFIG_PUV3) += puv3_ost.o
-common-obj-$(CONFIG_TWL92230) += twl92230.o
 common-obj-$(CONFIG_XILINX) += xilinx_timer.o
 common-obj-$(CONFIG_SLAVIO) += slavio_timer.o
 common-obj-$(CONFIG_ETRAXFS) += etraxfs_timer.o
@@ -22,28 +14,24 @@ common-obj-$(CONFIG_IMX) += imx_epit.o
 common-obj-$(CONFIG_IMX) += imx_gpt.o
 common-obj-$(CONFIG_LM32) += lm32_timer.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-sysctl.o
-common-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp-rtc.o
 common-obj-$(CONFIG_NRF51_SOC) += nrf51_timer.o
 
-obj-$(CONFIG_ALTERA_TIMER) += altera_timer.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_mct.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_pwm.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_rtc.o
-obj-$(CONFIG_OMAP) += omap_gptimer.o
-obj-$(CONFIG_OMAP) += omap_synctimer.o
-obj-$(CONFIG_PXA2XX) += pxa2xx_timer.o
-obj-$(CONFIG_SH4) += sh_timer.o
-obj-$(CONFIG_DIGIC) += digic-timer.o
-obj-$(CONFIG_MIPS_CPS) += mips_gictimer.o
+common-obj-$(CONFIG_ALTERA_TIMER) += altera_timer.o
+common-obj-$(CONFIG_EXYNOS4) += exynos4210_mct.o
+common-obj-$(CONFIG_EXYNOS4) += exynos4210_pwm.o
+common-obj-$(CONFIG_OMAP) += omap_gptimer.o
+common-obj-$(CONFIG_OMAP) += omap_synctimer.o
+common-obj-$(CONFIG_PXA2XX) += pxa2xx_timer.o
+common-obj-$(CONFIG_SH4) += sh_timer.o
+common-obj-$(CONFIG_DIGIC) += digic-timer.o
+common-obj-$(CONFIG_MIPS_CPS) += mips_gictimer.o
 
-obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
-
-obj-$(CONFIG_ALLWINNER_A10_PIT) += allwinner-a10-pit.o
+common-obj-$(CONFIG_ALLWINNER_A10_PIT) += allwinner-a10-pit.o
 
 common-obj-$(CONFIG_STM32F2XX_TIMER) += stm32f2xx_timer.o
-common-obj-$(CONFIG_ASPEED_SOC) += aspeed_timer.o aspeed_rtc.o
+common-obj-$(CONFIG_ASPEED_SOC) += aspeed_timer.o
 
-common-obj-$(CONFIG_SUN4V_RTC) += sun4v-rtc.o
 common-obj-$(CONFIG_CMSDK_APB_TIMER) += cmsdk-apb-timer.o
 common-obj-$(CONFIG_CMSDK_APB_DUALTIMER) += cmsdk-apb-dualtimer.o
 common-obj-$(CONFIG_MSF2) += mss-timer.o
+common-obj-$(CONFIG_RASPI) += bcm2835_systmr.o
diff --git a/hw/timer/altera_timer.c b/hw/timer/altera_timer.c
index ee32e0ec1f..79fc381252 100644
--- a/hw/timer/altera_timer.c
+++ b/hw/timer/altera_timer.c
@@ -19,7 +19,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
 
@@ -53,7 +52,6 @@ typedef struct AlteraTimer {
     MemoryRegion  mmio;
     qemu_irq      irq;
     uint32_t      freq_hz;
-    QEMUBH       *bh;
     ptimer_state *ptimer;
     uint32_t      regs[R_MAX];
 } AlteraTimer;
@@ -105,6 +103,7 @@ static void timer_write(void *opaque, hwaddr addr,
         break;
 
     case R_CONTROL:
+        ptimer_transaction_begin(t->ptimer);
         t->regs[R_CONTROL] = value & (CONTROL_ITO | CONTROL_CONT);
         if ((value & CONTROL_START) &&
             !(t->regs[R_STATUS] & STATUS_RUN)) {
@@ -115,10 +114,12 @@ static void timer_write(void *opaque, hwaddr addr,
             ptimer_stop(t->ptimer);
             t->regs[R_STATUS] &= ~STATUS_RUN;
         }
+        ptimer_transaction_commit(t->ptimer);
         break;
 
     case R_PERIODL:
     case R_PERIODH:
+        ptimer_transaction_begin(t->ptimer);
         t->regs[addr] = value & 0xFFFF;
         if (t->regs[R_STATUS] & STATUS_RUN) {
             ptimer_stop(t->ptimer);
@@ -126,6 +127,7 @@ static void timer_write(void *opaque, hwaddr addr,
         }
         tvalue = (t->regs[R_PERIODH] << 16) | t->regs[R_PERIODL];
         ptimer_set_limit(t->ptimer, tvalue + 1, 1);
+        ptimer_transaction_commit(t->ptimer);
         break;
 
     case R_SNAPL:
@@ -183,9 +185,10 @@ static void altera_timer_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    t->bh = qemu_bh_new(timer_hit, t);
-    t->ptimer = ptimer_init_with_bh(t->bh, PTIMER_POLICY_DEFAULT);
+    t->ptimer = ptimer_init(timer_hit, t, PTIMER_POLICY_DEFAULT);
+    ptimer_transaction_begin(t->ptimer);
     ptimer_set_freq(t->ptimer, t->freq_hz);
+    ptimer_transaction_commit(t->ptimer);
 
     memory_region_init_io(&t->mmio, OBJECT(t), &timer_ops, t,
                           TYPE_ALTERA_TIMER, R_MAX * sizeof(uint32_t));
@@ -204,8 +207,10 @@ static void altera_timer_reset(DeviceState *dev)
 {
     AlteraTimer *t = ALTERA_TIMER(dev);
 
+    ptimer_transaction_begin(t->ptimer);
     ptimer_stop(t->ptimer);
     ptimer_set_limit(t->ptimer, 0xffffffff, 1);
+    ptimer_transaction_commit(t->ptimer);
     memset(t->regs, 0, sizeof(t->regs));
 }
 
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index fdf97d1800..2bf11f788c 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -237,7 +237,7 @@ static void arm_mptimer_reset(DeviceState *dev)
     }
 }
 
-static void arm_mptimer_init_with_bh(Object *obj)
+static void arm_mptimer_init(Object *obj)
 {
     ARMMPTimerState *s = ARM_MPTIMER(obj);
 
@@ -319,7 +319,7 @@ static const TypeInfo arm_mptimer_info = {
     .name          = TYPE_ARM_MPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARMMPTimerState),
-    .instance_init = arm_mptimer_init_with_bh,
+    .instance_init = arm_mptimer_init,
     .class_init    = arm_mptimer_class_init,
 };
 
diff --git a/hw/timer/bcm2835_systmr.c b/hw/timer/bcm2835_systmr.c
new file mode 100644
index 0000000000..3387a6214a
--- /dev/null
+++ b/hw/timer/bcm2835_systmr.c
@@ -0,0 +1,163 @@
+/*
+ * BCM2835 SYS timer emulation
+ *
+ * Copyright (C) 2019 Philippe Mathieu-Daudé <f4bug@amsat.org>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Datasheet: BCM2835 ARM Peripherals (C6357-M-1398)
+ * https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
+ *
+ * Only the free running 64-bit counter is implemented.
+ * The 4 COMPARE registers and the interruption are not implemented.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/timer.h"
+#include "hw/timer/bcm2835_systmr.h"
+#include "hw/registerfields.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+REG32(CTRL_STATUS,  0x00)
+REG32(COUNTER_LOW,  0x04)
+REG32(COUNTER_HIGH, 0x08)
+REG32(COMPARE0,     0x0c)
+REG32(COMPARE1,     0x10)
+REG32(COMPARE2,     0x14)
+REG32(COMPARE3,     0x18)
+
+static void bcm2835_systmr_update_irq(BCM2835SystemTimerState *s)
+{
+    bool enable = !!s->reg.status;
+
+    trace_bcm2835_systmr_irq(enable);
+    qemu_set_irq(s->irq, enable);
+}
+
+static void bcm2835_systmr_update_compare(BCM2835SystemTimerState *s,
+                                          unsigned timer_index)
+{
+    /* TODO fow now, since neither Linux nor U-boot use these timers. */
+    qemu_log_mask(LOG_UNIMP, "COMPARE register %u not implemented\n",
+                  timer_index);
+}
+
+static uint64_t bcm2835_systmr_read(void *opaque, hwaddr offset,
+                                    unsigned size)
+{
+    BCM2835SystemTimerState *s = BCM2835_SYSTIMER(opaque);
+    uint64_t r = 0;
+
+    switch (offset) {
+    case A_CTRL_STATUS:
+        r = s->reg.status;
+        break;
+    case A_COMPARE0 ... A_COMPARE3:
+        r = s->reg.compare[(offset - A_COMPARE0) >> 2];
+        break;
+    case A_COUNTER_LOW:
+    case A_COUNTER_HIGH:
+        /* Free running counter at 1MHz */
+        r = qemu_clock_get_us(QEMU_CLOCK_VIRTUAL);
+        r >>= 8 * (offset - A_COUNTER_LOW);
+        r &= UINT32_MAX;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    }
+    trace_bcm2835_systmr_read(offset, r);
+
+    return r;
+}
+
+static void bcm2835_systmr_write(void *opaque, hwaddr offset,
+                                 uint64_t value, unsigned size)
+{
+    BCM2835SystemTimerState *s = BCM2835_SYSTIMER(opaque);
+
+    trace_bcm2835_systmr_write(offset, value);
+    switch (offset) {
+    case A_CTRL_STATUS:
+        s->reg.status &= ~value; /* Ack */
+        bcm2835_systmr_update_irq(s);
+        break;
+    case A_COMPARE0 ... A_COMPARE3:
+        s->reg.compare[(offset - A_COMPARE0) >> 2] = value;
+        bcm2835_systmr_update_compare(s, (offset - A_COMPARE0) >> 2);
+        break;
+    case A_COUNTER_LOW:
+    case A_COUNTER_HIGH:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: read-only ofs 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps bcm2835_systmr_ops = {
+    .read = bcm2835_systmr_read,
+    .write = bcm2835_systmr_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void bcm2835_systmr_reset(DeviceState *dev)
+{
+    BCM2835SystemTimerState *s = BCM2835_SYSTIMER(dev);
+
+    memset(&s->reg, 0, sizeof(s->reg));
+}
+
+static void bcm2835_systmr_realize(DeviceState *dev, Error **errp)
+{
+    BCM2835SystemTimerState *s = BCM2835_SYSTIMER(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(dev), &bcm2835_systmr_ops,
+                          s, "bcm2835-sys-timer", 0x20);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
+}
+
+static const VMStateDescription bcm2835_systmr_vmstate = {
+    .name = "bcm2835_sys_timer",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(reg.status, BCM2835SystemTimerState),
+        VMSTATE_UINT32_ARRAY(reg.compare, BCM2835SystemTimerState, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_systmr_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = bcm2835_systmr_realize;
+    dc->reset = bcm2835_systmr_reset;
+    dc->vmsd = &bcm2835_systmr_vmstate;
+}
+
+static const TypeInfo bcm2835_systmr_info = {
+    .name = TYPE_BCM2835_SYSTIMER,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835SystemTimerState),
+    .class_init = bcm2835_systmr_class_init,
+};
+
+static void bcm2835_systmr_register_types(void)
+{
+    type_register_static(&bcm2835_systmr_info);
+}
+
+type_init(bcm2835_systmr_register_types);
diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index ab27fe1895..afe3d30a8e 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -26,7 +26,6 @@
 #include "hw/sysbus.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/timer.h"
 #include "hw/irq.h"
@@ -59,9 +58,6 @@ typedef struct ETRAXTimerState {
     qemu_irq irq;
     qemu_irq nmi;
 
-    QEMUBH *bh_t0;
-    QEMUBH *bh_t1;
-    QEMUBH *bh_wd;
     ptimer_state *ptimer_t0;
     ptimer_state *ptimer_t1;
     ptimer_state *ptimer_wd;
@@ -155,6 +151,7 @@ static void update_ctrl(ETRAXTimerState *t, int tnum)
     }
 
     D(printf ("freq_hz=%d div=%d\n", freq_hz, div));
+    ptimer_transaction_begin(timer);
     ptimer_set_freq(timer, freq_hz);
     ptimer_set_limit(timer, div, 0);
 
@@ -176,6 +173,7 @@ static void update_ctrl(ETRAXTimerState *t, int tnum)
             abort();
             break;
     }
+    ptimer_transaction_commit(timer);
 }
 
 static void timer_update_irq(ETRAXTimerState *t)
@@ -240,6 +238,7 @@ static inline void timer_watchdog_update(ETRAXTimerState *t, uint32_t value)
 
     t->wd_hits = 0;
 
+    ptimer_transaction_begin(t->ptimer_wd);
     ptimer_set_freq(t->ptimer_wd, 760);
     if (wd_cnt == 0)
         wd_cnt = 256;
@@ -250,6 +249,7 @@ static inline void timer_watchdog_update(ETRAXTimerState *t, uint32_t value)
         ptimer_stop(t->ptimer_wd);
 
     t->rw_wd_ctrl = value;
+    ptimer_transaction_commit(t->ptimer_wd);
 }
 
 static void
@@ -311,9 +311,15 @@ static void etraxfs_timer_reset(void *opaque)
 {
     ETRAXTimerState *t = opaque;
 
+    ptimer_transaction_begin(t->ptimer_t0);
     ptimer_stop(t->ptimer_t0);
+    ptimer_transaction_commit(t->ptimer_t0);
+    ptimer_transaction_begin(t->ptimer_t1);
     ptimer_stop(t->ptimer_t1);
+    ptimer_transaction_commit(t->ptimer_t1);
+    ptimer_transaction_begin(t->ptimer_wd);
     ptimer_stop(t->ptimer_wd);
+    ptimer_transaction_commit(t->ptimer_wd);
     t->rw_wd_ctrl = 0;
     t->r_intr = 0;
     t->rw_intr_mask = 0;
@@ -325,12 +331,9 @@ static void etraxfs_timer_realize(DeviceState *dev, Error **errp)
     ETRAXTimerState *t = ETRAX_TIMER(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    t->bh_t0 = qemu_bh_new(timer0_hit, t);
-    t->bh_t1 = qemu_bh_new(timer1_hit, t);
-    t->bh_wd = qemu_bh_new(watchdog_hit, t);
-    t->ptimer_t0 = ptimer_init_with_bh(t->bh_t0, PTIMER_POLICY_DEFAULT);
-    t->ptimer_t1 = ptimer_init_with_bh(t->bh_t1, PTIMER_POLICY_DEFAULT);
-    t->ptimer_wd = ptimer_init_with_bh(t->bh_wd, PTIMER_POLICY_DEFAULT);
+    t->ptimer_t0 = ptimer_init(timer0_hit, t, PTIMER_POLICY_DEFAULT);
+    t->ptimer_t1 = ptimer_init(timer1_hit, t, PTIMER_POLICY_DEFAULT);
+    t->ptimer_wd = ptimer_init(watchdog_hit, t, PTIMER_POLICY_DEFAULT);
 
     sysbus_init_irq(sbd, &t->irq);
     sysbus_init_irq(sbd, &t->nmi);
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 7225758414..944120aea5 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -1254,7 +1254,7 @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         /* Start FRC if transition from disabled to enabled */
         if ((value & G_TCON_TIMER_ENABLE) > (old_val &
                 G_TCON_TIMER_ENABLE)) {
-            exynos4210_gfrc_start(&s->g_timer);
+            exynos4210_gfrc_restart(s);
         }
         if ((value & G_TCON_TIMER_ENABLE) < (old_val &
                 G_TCON_TIMER_ENABLE)) {
diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index bb09268ea1..7a9371c0e3 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -29,7 +29,6 @@
 #include "hw/irq.h"
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 #include "trace.h"
@@ -63,7 +62,6 @@ typedef struct GPTimer     GPTimer;
 typedef struct GPTimerUnit GPTimerUnit;
 
 struct GPTimer {
-    QEMUBH *bh;
     struct ptimer_state *ptimer;
 
     qemu_irq     irq;
@@ -93,6 +91,17 @@ struct GPTimerUnit {
     uint32_t config;
 };
 
+static void grlib_gptimer_tx_begin(GPTimer *timer)
+{
+    ptimer_transaction_begin(timer->ptimer);
+}
+
+static void grlib_gptimer_tx_commit(GPTimer *timer)
+{
+    ptimer_transaction_commit(timer->ptimer);
+}
+
+/* Must be called within grlib_gptimer_tx_begin/commit block */
 static void grlib_gptimer_enable(GPTimer *timer)
 {
     assert(timer != NULL);
@@ -115,6 +124,7 @@ static void grlib_gptimer_enable(GPTimer *timer)
     ptimer_run(timer->ptimer, 1);
 }
 
+/* Must be called within grlib_gptimer_tx_begin/commit block */
 static void grlib_gptimer_restart(GPTimer *timer)
 {
     assert(timer != NULL);
@@ -141,7 +151,9 @@ static void grlib_gptimer_set_scaler(GPTimerUnit *unit, uint32_t scaler)
     trace_grlib_gptimer_set_scaler(scaler, value);
 
     for (i = 0; i < unit->nr_timers; i++) {
+        ptimer_transaction_begin(unit->timers[i].ptimer);
         ptimer_set_freq(unit->timers[i].ptimer, value);
+        ptimer_transaction_commit(unit->timers[i].ptimer);
     }
 }
 
@@ -266,8 +278,10 @@ static void grlib_gptimer_write(void *opaque, hwaddr addr,
         switch (timer_addr) {
         case COUNTER_OFFSET:
             trace_grlib_gptimer_writel(id, addr, value);
+            grlib_gptimer_tx_begin(&unit->timers[id]);
             unit->timers[id].counter = value;
             grlib_gptimer_enable(&unit->timers[id]);
+            grlib_gptimer_tx_commit(&unit->timers[id]);
             return;
 
         case COUNTER_RELOAD_OFFSET:
@@ -291,6 +305,7 @@ static void grlib_gptimer_write(void *opaque, hwaddr addr,
             /* gptimer_restart calls gptimer_enable, so if "enable" and "load"
                bits are present, we just have to call restart. */
 
+            grlib_gptimer_tx_begin(&unit->timers[id]);
             if (value & GPTIMER_LOAD) {
                 grlib_gptimer_restart(&unit->timers[id]);
             } else if (value & GPTIMER_ENABLE) {
@@ -301,6 +316,7 @@ static void grlib_gptimer_write(void *opaque, hwaddr addr,
             value &= ~(GPTIMER_LOAD & GPTIMER_DEBUG_HALT);
 
             unit->timers[id].config = value;
+            grlib_gptimer_tx_commit(&unit->timers[id]);
             return;
 
         default:
@@ -344,9 +360,11 @@ static void grlib_gptimer_reset(DeviceState *d)
         timer->counter = 0;
         timer->reload = 0;
         timer->config = 0;
+        ptimer_transaction_begin(timer->ptimer);
         ptimer_stop(timer->ptimer);
         ptimer_set_count(timer->ptimer, 0);
         ptimer_set_freq(timer->ptimer, unit->freq_hz);
+        ptimer_transaction_commit(timer->ptimer);
     }
 }
 
@@ -365,14 +383,16 @@ static void grlib_gptimer_realize(DeviceState *dev, Error **errp)
         GPTimer *timer = &unit->timers[i];
 
         timer->unit   = unit;
-        timer->bh     = qemu_bh_new(grlib_gptimer_hit, timer);
-        timer->ptimer = ptimer_init_with_bh(timer->bh, PTIMER_POLICY_DEFAULT);
+        timer->ptimer = ptimer_init(grlib_gptimer_hit, timer,
+                                    PTIMER_POLICY_DEFAULT);
         timer->id     = i;
 
         /* One IRQ line for each timer */
         sysbus_init_irq(sbd, &timer->irq);
 
+        ptimer_transaction_begin(timer->ptimer);
         ptimer_set_freq(timer->ptimer, unit->freq_hz);
+        ptimer_transaction_commit(timer->ptimer);
     }
 
     memory_region_init_io(&unit->iomem, OBJECT(unit), &grlib_gptimer_ops,
diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 1ddae4e7d7..9f17aaa278 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -33,7 +33,8 @@
 #include "qemu/timer.h"
 #include "hw/timer/hpet.h"
 #include "hw/sysbus.h"
-#include "hw/timer/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc_regs.h"
 #include "migration/vmstate.h"
 #include "hw/timer/i8254.h"
 
diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index fabde760b2..3fdecd09fe 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -30,7 +30,6 @@
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 #define DEFAULT_FREQUENCY (50*1000000)
@@ -63,7 +62,6 @@ struct LM32TimerState {
 
     MemoryRegion iomem;
 
-    QEMUBH *bh;
     ptimer_state *ptimer;
 
     qemu_irq irq;
@@ -119,6 +117,7 @@ static void timer_write(void *opaque, hwaddr addr,
         s->regs[R_SR] &= ~SR_TO;
         break;
     case R_CR:
+        ptimer_transaction_begin(s->ptimer);
         s->regs[R_CR] = value;
         if (s->regs[R_CR] & CR_START) {
             ptimer_run(s->ptimer, 1);
@@ -126,10 +125,13 @@ static void timer_write(void *opaque, hwaddr addr,
         if (s->regs[R_CR] & CR_STOP) {
             ptimer_stop(s->ptimer);
         }
+        ptimer_transaction_commit(s->ptimer);
         break;
     case R_PERIOD:
         s->regs[R_PERIOD] = value;
+        ptimer_transaction_begin(s->ptimer);
         ptimer_set_count(s->ptimer, value);
+        ptimer_transaction_commit(s->ptimer);
         break;
     case R_SNAPSHOT:
         error_report("lm32_timer: write access to read only register 0x"
@@ -176,7 +178,9 @@ static void timer_reset(DeviceState *d)
     for (i = 0; i < R_MAX; i++) {
         s->regs[i] = 0;
     }
+    ptimer_transaction_begin(s->ptimer);
     ptimer_stop(s->ptimer);
+    ptimer_transaction_commit(s->ptimer);
 }
 
 static void lm32_timer_init(Object *obj)
@@ -195,10 +199,11 @@ static void lm32_timer_realize(DeviceState *dev, Error **errp)
 {
     LM32TimerState *s = LM32_TIMER(dev);
 
-    s->bh = qemu_bh_new(timer_hit, s);
-    s->ptimer = ptimer_init_with_bh(s->bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init(timer_hit, s, PTIMER_POLICY_DEFAULT);
 
+    ptimer_transaction_begin(s->ptimer);
     ptimer_set_freq(s->ptimer, s->freq_hz);
+    ptimer_transaction_commit(s->ptimer);
 }
 
 static const VMStateDescription vmstate_lm32_timer = {
diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index 5193c03850..7a62e212c3 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -31,7 +31,6 @@
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 enum {
@@ -71,8 +70,6 @@ struct MilkymistSysctlState {
 
     MemoryRegion regs_region;
 
-    QEMUBH *bh0;
-    QEMUBH *bh1;
     ptimer_state *ptimer0;
     ptimer_state *ptimer1;
 
@@ -161,14 +158,19 @@ static void sysctl_write(void *opaque, hwaddr addr, uint64_t value,
         s->regs[addr] = value;
         break;
     case R_TIMER0_COMPARE:
+        ptimer_transaction_begin(s->ptimer0);
         ptimer_set_limit(s->ptimer0, value, 0);
         s->regs[addr] = value;
+        ptimer_transaction_commit(s->ptimer0);
         break;
     case R_TIMER1_COMPARE:
+        ptimer_transaction_begin(s->ptimer1);
         ptimer_set_limit(s->ptimer1, value, 0);
         s->regs[addr] = value;
+        ptimer_transaction_commit(s->ptimer1);
         break;
     case R_TIMER0_CONTROL:
+        ptimer_transaction_begin(s->ptimer0);
         s->regs[addr] = value;
         if (s->regs[R_TIMER0_CONTROL] & CTRL_ENABLE) {
             trace_milkymist_sysctl_start_timer0();
@@ -179,8 +181,10 @@ static void sysctl_write(void *opaque, hwaddr addr, uint64_t value,
             trace_milkymist_sysctl_stop_timer0();
             ptimer_stop(s->ptimer0);
         }
+        ptimer_transaction_commit(s->ptimer0);
         break;
     case R_TIMER1_CONTROL:
+        ptimer_transaction_begin(s->ptimer1);
         s->regs[addr] = value;
         if (s->regs[R_TIMER1_CONTROL] & CTRL_ENABLE) {
             trace_milkymist_sysctl_start_timer1();
@@ -191,6 +195,7 @@ static void sysctl_write(void *opaque, hwaddr addr, uint64_t value,
             trace_milkymist_sysctl_stop_timer1();
             ptimer_stop(s->ptimer1);
         }
+        ptimer_transaction_commit(s->ptimer1);
         break;
     case R_ICAP:
         sysctl_icap_write(s, value);
@@ -263,8 +268,12 @@ static void milkymist_sysctl_reset(DeviceState *d)
         s->regs[i] = 0;
     }
 
+    ptimer_transaction_begin(s->ptimer0);
     ptimer_stop(s->ptimer0);
+    ptimer_transaction_commit(s->ptimer0);
+    ptimer_transaction_begin(s->ptimer1);
     ptimer_stop(s->ptimer1);
+    ptimer_transaction_commit(s->ptimer1);
 
     /* defaults */
     s->regs[R_ICAP] = ICAP_READY;
@@ -292,13 +301,15 @@ static void milkymist_sysctl_realize(DeviceState *dev, Error **errp)
 {
     MilkymistSysctlState *s = MILKYMIST_SYSCTL(dev);
 
-    s->bh0 = qemu_bh_new(timer0_hit, s);
-    s->bh1 = qemu_bh_new(timer1_hit, s);
-    s->ptimer0 = ptimer_init_with_bh(s->bh0, PTIMER_POLICY_DEFAULT);
-    s->ptimer1 = ptimer_init_with_bh(s->bh1, PTIMER_POLICY_DEFAULT);
+    s->ptimer0 = ptimer_init(timer0_hit, s, PTIMER_POLICY_DEFAULT);
+    s->ptimer1 = ptimer_init(timer1_hit, s, PTIMER_POLICY_DEFAULT);
 
+    ptimer_transaction_begin(s->ptimer0);
     ptimer_set_freq(s->ptimer0, s->freq_hz);
+    ptimer_transaction_commit(s->ptimer0);
+    ptimer_transaction_begin(s->ptimer1);
     ptimer_set_freq(s->ptimer1, s->freq_hz);
+    ptimer_transaction_commit(s->ptimer1);
 }
 
 static const VMStateDescription vmstate_milkymist_sysctl = {
diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index 0898da5ce9..697519593b 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -13,7 +13,6 @@
 #include "hw/sysbus.h"
 #include "hw/irq.h"
 #include "hw/ptimer.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 #undef DEBUG_PUV3
@@ -27,7 +26,6 @@ typedef struct PUV3OSTState {
     SysBusDevice parent_obj;
 
     MemoryRegion iomem;
-    QEMUBH *bh;
     qemu_irq irq;
     ptimer_state *ptimer;
 
@@ -68,6 +66,7 @@ static void puv3_ost_write(void *opaque, hwaddr offset,
     DPRINTF("offset 0x%x, value 0x%x\n", offset, value);
     switch (offset) {
     case 0x00: /* Match Register 0 */
+        ptimer_transaction_begin(s->ptimer);
         s->reg_OSMR0 = value;
         if (s->reg_OSMR0 > s->reg_OSCR) {
             ptimer_set_count(s->ptimer, s->reg_OSMR0 - s->reg_OSCR);
@@ -76,6 +75,7 @@ static void puv3_ost_write(void *opaque, hwaddr offset,
                     (0xffffffff - s->reg_OSCR));
         }
         ptimer_run(s->ptimer, 2);
+        ptimer_transaction_commit(s->ptimer);
         break;
     case 0x14: /* Status Register */
         assert(value == 0);
@@ -128,9 +128,10 @@ static void puv3_ost_realize(DeviceState *dev, Error **errp)
 
     sysbus_init_irq(sbd, &s->irq);
 
-    s->bh = qemu_bh_new(puv3_ost_tick, s);
-    s->ptimer = ptimer_init_with_bh(s->bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init(puv3_ost_tick, s, PTIMER_POLICY_DEFAULT);
+    ptimer_transaction_begin(s->ptimer);
     ptimer_set_freq(s->ptimer, 50 * 1000 * 1000);
+    ptimer_transaction_commit(s->ptimer);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &puv3_ost_ops, s, "puv3_ost",
             PUV3_REGS_OFFSET);
diff --git a/hw/timer/sh_timer.c b/hw/timer/sh_timer.c
index 48a81b4dc7..13c4051808 100644
--- a/hw/timer/sh_timer.c
+++ b/hw/timer/sh_timer.c
@@ -13,7 +13,6 @@
 #include "hw/irq.h"
 #include "hw/sh4/sh.h"
 #include "qemu/timer.h"
-#include "qemu/main-loop.h"
 #include "hw/ptimer.h"
 
 //#define DEBUG_TIMER
@@ -91,13 +90,18 @@ static void sh_timer_write(void *opaque, hwaddr offset,
     switch (offset >> 2) {
     case OFFSET_TCOR:
         s->tcor = value;
+        ptimer_transaction_begin(s->timer);
         ptimer_set_limit(s->timer, s->tcor, 0);
+        ptimer_transaction_commit(s->timer);
         break;
     case OFFSET_TCNT:
         s->tcnt = value;
+        ptimer_transaction_begin(s->timer);
         ptimer_set_count(s->timer, s->tcnt);
+        ptimer_transaction_commit(s->timer);
         break;
     case OFFSET_TCR:
+        ptimer_transaction_begin(s->timer);
         if (s->enabled) {
             /* Pause the timer if it is running.  This may cause some
                inaccuracy dure to rounding, but avoids a whole lot of other
@@ -148,6 +152,7 @@ static void sh_timer_write(void *opaque, hwaddr offset,
             /* Restart the timer if still enabled.  */
             ptimer_run(s->timer, 0);
         }
+        ptimer_transaction_commit(s->timer);
         break;
     case OFFSET_TCPR:
         if (s->feat & TIMER_FEAT_CAPT) {
@@ -168,12 +173,14 @@ static void sh_timer_start_stop(void *opaque, int enable)
     printf("sh_timer_start_stop %d (%d)\n", enable, s->enabled);
 #endif
 
+    ptimer_transaction_begin(s->timer);
     if (s->enabled && !enable) {
         ptimer_stop(s->timer);
     }
     if (!s->enabled && enable) {
         ptimer_run(s->timer, 0);
     }
+    ptimer_transaction_commit(s->timer);
     s->enabled = !!enable;
 
 #ifdef DEBUG_TIMER
@@ -191,7 +198,6 @@ static void sh_timer_tick(void *opaque)
 static void *sh_timer_init(uint32_t freq, int feat, qemu_irq irq)
 {
     sh_timer_state *s;
-    QEMUBH *bh;
 
     s = (sh_timer_state *)g_malloc0(sizeof(sh_timer_state));
     s->freq = freq;
@@ -203,8 +209,7 @@ static void *sh_timer_init(uint32_t freq, int feat, qemu_irq irq)
     s->enabled = 0;
     s->irq = irq;
 
-    bh = qemu_bh_new(sh_timer_tick, s);
-    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init(sh_timer_tick, s, PTIMER_POLICY_DEFAULT);
 
     sh_timer_write(s, OFFSET_TCOR >> 2, s->tcor);
     sh_timer_write(s, OFFSET_TCNT >> 2, s->tcnt);
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index 692d213897..c55e8d0bf4 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -30,7 +30,6 @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "trace.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 /*
@@ -213,6 +212,7 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
     saddr = addr >> 2;
     switch (saddr) {
     case TIMER_LIMIT:
+        ptimer_transaction_begin(t->timer);
         if (slavio_timer_is_user(tc)) {
             uint64_t count;
 
@@ -227,15 +227,14 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
             // set limit, reset counter
             qemu_irq_lower(t->irq);
             t->limit = val & TIMER_MAX_COUNT32;
-            if (t->timer) {
-                if (t->limit == 0) { /* free-run */
-                    ptimer_set_limit(t->timer,
-                                     LIMIT_TO_PERIODS(TIMER_MAX_COUNT32), 1);
-                } else {
-                    ptimer_set_limit(t->timer, LIMIT_TO_PERIODS(t->limit), 1);
-                }
+            if (t->limit == 0) { /* free-run */
+                ptimer_set_limit(t->timer,
+                                 LIMIT_TO_PERIODS(TIMER_MAX_COUNT32), 1);
+            } else {
+                ptimer_set_limit(t->timer, LIMIT_TO_PERIODS(t->limit), 1);
             }
         }
+        ptimer_transaction_commit(t->timer);
         break;
     case TIMER_COUNTER:
         if (slavio_timer_is_user(tc)) {
@@ -247,7 +246,9 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
             t->reached = 0;
             count = ((uint64_t)t->counthigh) << 32 | t->count;
             trace_slavio_timer_mem_writel_limit(timer_index, count);
+            ptimer_transaction_begin(t->timer);
             ptimer_set_count(t->timer, LIMIT_TO_PERIODS(t->limit - count));
+            ptimer_transaction_commit(t->timer);
         } else {
             trace_slavio_timer_mem_writel_counter_invalid();
         }
@@ -255,13 +256,16 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
     case TIMER_COUNTER_NORST:
         // set limit without resetting counter
         t->limit = val & TIMER_MAX_COUNT32;
+        ptimer_transaction_begin(t->timer);
         if (t->limit == 0) { /* free-run */
             ptimer_set_limit(t->timer, LIMIT_TO_PERIODS(TIMER_MAX_COUNT32), 0);
         } else {
             ptimer_set_limit(t->timer, LIMIT_TO_PERIODS(t->limit), 0);
         }
+        ptimer_transaction_commit(t->timer);
         break;
     case TIMER_STATUS:
+        ptimer_transaction_begin(t->timer);
         if (slavio_timer_is_user(tc)) {
             // start/stop user counter
             if (val & 1) {
@@ -273,6 +277,7 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
             }
         }
         t->run = val & 1;
+        ptimer_transaction_commit(t->timer);
         break;
     case TIMER_MODE:
         if (timer_index == 0) {
@@ -282,6 +287,7 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
                 unsigned int processor = 1 << i;
                 CPUTimerState *curr_timer = &s->cputimer[i + 1];
 
+                ptimer_transaction_begin(curr_timer->timer);
                 // check for a change in timer mode for this processor
                 if ((val & processor) != (s->cputimer_mode & processor)) {
                     if (val & processor) { // counter -> user timer
@@ -308,6 +314,7 @@ static void slavio_timer_mem_writel(void *opaque, hwaddr addr,
                         trace_slavio_timer_mem_writel_mode_counter(timer_index);
                     }
                 }
+                ptimer_transaction_commit(curr_timer->timer);
             }
         } else {
             trace_slavio_timer_mem_writel_mode_invalid();
@@ -367,10 +374,12 @@ static void slavio_timer_reset(DeviceState *d)
         curr_timer->count = 0;
         curr_timer->reached = 0;
         if (i <= s->num_cpus) {
+            ptimer_transaction_begin(curr_timer->timer);
             ptimer_set_limit(curr_timer->timer,
                              LIMIT_TO_PERIODS(TIMER_MAX_COUNT32), 1);
             ptimer_run(curr_timer->timer, 0);
             curr_timer->run = 1;
+            ptimer_transaction_commit(curr_timer->timer);
         }
     }
     s->cputimer_mode = 0;
@@ -380,7 +389,6 @@ static void slavio_timer_init(Object *obj)
 {
     SLAVIO_TIMERState *s = SLAVIO_TIMER(obj);
     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-    QEMUBH *bh;
     unsigned int i;
     TimerContext *tc;
 
@@ -392,9 +400,11 @@ static void slavio_timer_init(Object *obj)
         tc->s = s;
         tc->timer_index = i;
 
-        bh = qemu_bh_new(slavio_timer_irq, tc);
-        s->cputimer[i].timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+        s->cputimer[i].timer = ptimer_init(slavio_timer_irq, tc,
+                                           PTIMER_POLICY_DEFAULT);
+        ptimer_transaction_begin(s->cputimer[i].timer);
         ptimer_set_period(s->cputimer[i].timer, TIMER_PERIOD);
+        ptimer_transaction_commit(s->cputimer[i].timer);
 
         size = i == 0 ? SYS_TIMER_SIZE : CPU_TIMER_SIZE;
         snprintf(timer_name, sizeof(timer_name), "timer-%i", i);
diff --git a/hw/timer/trace-events b/hw/timer/trace-events
index db02a9142c..29fda7870e 100644
--- a/hw/timer/trace-events
+++ b/hw/timer/trace-events
@@ -66,24 +66,11 @@ cmsdk_apb_dualtimer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK A
 cmsdk_apb_dualtimer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB dualtimer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 cmsdk_apb_dualtimer_reset(void) "CMSDK APB dualtimer: reset"
 
-# hw/timer/aspeed-rtc.c
-aspeed_rtc_read(uint64_t addr, uint64_t value) "addr 0x%02" PRIx64 " value 0x%08" PRIx64
-aspeed_rtc_write(uint64_t addr, uint64_t value) "addr 0x%02" PRIx64 " value 0x%08" PRIx64
-
-# sun4v-rtc.c
-sun4v_rtc_read(uint64_t addr, uint64_t value) "read: addr 0x%" PRIx64 " value 0x%" PRIx64
-sun4v_rtc_write(uint64_t addr, uint64_t value) "write: addr 0x%" PRIx64 " value 0x%" PRIx64
-
-# xlnx-zynqmp-rtc.c
-xlnx_zynqmp_rtc_gettime(int year, int month, int day, int hour, int min, int sec) "Get time from host: %d-%d-%d %2d:%02d:%02d"
-
 # nrf51_timer.c
 nrf51_timer_read(uint64_t addr, uint32_t value, unsigned size) "read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
 nrf51_timer_write(uint64_t addr, uint32_t value, unsigned size) "write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
 
-# pl031.c
-pl031_irq_state(int level) "irq state %d"
-pl031_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
-pl031_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
-pl031_alarm_raised(void) "alarm raised"
-pl031_set_alarm(uint32_t ticks) "alarm set for %u ticks"
+# bcm2835_systmr.c
+bcm2835_systmr_irq(bool enable) "timer irq state %u"
+bcm2835_systmr_read(uint64_t offset, uint64_t data) "timer read: offset 0x%" PRIx64 " data 0x%" PRIx64
+bcm2835_systmr_write(uint64_t offset, uint64_t data) "timer write: offset 0x%" PRIx64 " data 0x%" PRIx64
diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index 92dbff304d..7191ea54f5 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -28,7 +28,6 @@
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 #define D(x)
@@ -52,7 +51,6 @@
 
 struct xlx_timer
 {
-    QEMUBH *bh;
     ptimer_state *ptimer;
     void *parent;
     int nr; /* for debug.  */
@@ -134,6 +132,7 @@ timer_read(void *opaque, hwaddr addr, unsigned int size)
     return r;
 }
 
+/* Must be called inside ptimer transaction block */
 static void timer_enable(struct xlx_timer *xt)
 {
     uint64_t count;
@@ -174,8 +173,11 @@ timer_write(void *opaque, hwaddr addr,
                 value &= ~TCSR_TINT;
 
             xt->regs[addr] = value & 0x7ff;
-            if (value & TCSR_ENT)
+            if (value & TCSR_ENT) {
+                ptimer_transaction_begin(xt->ptimer);
                 timer_enable(xt);
+                ptimer_transaction_commit(xt->ptimer);
+            }
             break;
  
         default:
@@ -220,9 +222,10 @@ static void xilinx_timer_realize(DeviceState *dev, Error **errp)
 
         xt->parent = t;
         xt->nr = i;
-        xt->bh = qemu_bh_new(timer_hit, xt);
-        xt->ptimer = ptimer_init_with_bh(xt->bh, PTIMER_POLICY_DEFAULT);
+        xt->ptimer = ptimer_init(timer_hit, xt, PTIMER_POLICY_DEFAULT);
+        ptimer_transaction_begin(xt->ptimer);
         ptimer_set_freq(xt->ptimer, t->freq_hz);
+        ptimer_transaction_commit(xt->ptimer);
     }
 
     memory_region_init_io(&t->mmio, OBJECT(t), &timer_ops, t, "xlnx.xps-timer",
diff --git a/hw/xtensa/Kconfig b/hw/xtensa/Kconfig
index d72817d012..0740657ea5 100644
--- a/hw/xtensa/Kconfig
+++ b/hw/xtensa/Kconfig
@@ -1,6 +1,12 @@
 config XTENSA_SIM
     bool
 
+config XTENSA_VIRT
+    bool
+    select XTENSA_SIM
+    select PCI_EXPRESS_GENERIC_BRIDGE
+    select PCI_DEVICES
+
 config XTENSA_XTFPGA
     bool
     select OPENCORES_ETH
diff --git a/hw/xtensa/Makefile.objs b/hw/xtensa/Makefile.objs
index 0bbfccd6de..2b40e1b60a 100644
--- a/hw/xtensa/Makefile.objs
+++ b/hw/xtensa/Makefile.objs
@@ -2,4 +2,5 @@ obj-y += mx_pic.o
 obj-y += pic_cpu.o
 obj-y += xtensa_memory.o
 obj-$(CONFIG_XTENSA_SIM) += sim.o
+obj-$(CONFIG_XTENSA_VIRT) += virt.o
 obj-$(CONFIG_XTENSA_XTFPGA) += xtfpga.o
diff --git a/hw/xtensa/sim.c b/hw/xtensa/sim.c
index 981dbb7bbe..a22743a3d6 100644
--- a/hw/xtensa/sim.c
+++ b/hw/xtensa/sim.c
@@ -37,6 +37,7 @@
 #include "exec/address-spaces.h"
 #include "qemu/error-report.h"
 #include "xtensa_memory.h"
+#include "xtensa_sim.h"
 
 static uint64_t translate_phys_addr(void *opaque, uint64_t addr)
 {
@@ -52,12 +53,11 @@ static void sim_reset(void *opaque)
     cpu_reset(CPU(cpu));
 }
 
-static void xtensa_sim_init(MachineState *machine)
+XtensaCPU *xtensa_sim_common_init(MachineState *machine)
 {
     XtensaCPU *cpu = NULL;
     CPUXtensaState *env = NULL;
     ram_addr_t ram_size = machine->ram_size;
-    const char *kernel_filename = machine->kernel_filename;
     int n;
 
     for (n = 0; n < machine->smp.cpus; n++) {
@@ -89,30 +89,41 @@ static void xtensa_sim_init(MachineState *machine)
         xtensa_create_memory_regions(&sysram, "xtensa.sysram",
                                      get_system_memory());
     }
-
     if (serial_hd(0)) {
         xtensa_sim_open_console(serial_hd(0));
     }
-    if (kernel_filename) {
-        uint64_t elf_entry;
-        uint64_t elf_lowaddr;
+    return cpu;
+}
+
+void xtensa_sim_load_kernel(XtensaCPU *cpu, MachineState *machine)
+{
+    const char *kernel_filename = machine->kernel_filename;
 #ifdef TARGET_WORDS_BIGENDIAN
-        int success = load_elf(kernel_filename, NULL,
-                               translate_phys_addr, cpu,
-                               &elf_entry, &elf_lowaddr,
-                               NULL, 1, EM_XTENSA, 0, 0);
+    int big_endian = true;
 #else
-        int success = load_elf(kernel_filename, NULL,
-                               translate_phys_addr, cpu,
-                               &elf_entry, &elf_lowaddr,
-                               NULL, 0, EM_XTENSA, 0, 0);
+    int big_endian = false;
 #endif
+
+    if (kernel_filename) {
+        uint64_t elf_entry;
+        uint64_t elf_lowaddr;
+        int success = load_elf(kernel_filename, NULL, translate_phys_addr, cpu,
+                               &elf_entry, &elf_lowaddr, NULL, big_endian,
+                               EM_XTENSA, 0, 0);
+
         if (success > 0) {
-            env->pc = elf_entry;
+            cpu->env.pc = elf_entry;
         }
     }
 }
 
+static void xtensa_sim_init(MachineState *machine)
+{
+    XtensaCPU *cpu = xtensa_sim_common_init(machine);
+
+    xtensa_sim_load_kernel(cpu, machine);
+}
+
 static void xtensa_sim_machine_init(MachineClass *mc)
 {
     mc->desc = "sim machine (" XTENSA_DEFAULT_CPU_MODEL ")";
diff --git a/hw/xtensa/virt.c b/hw/xtensa/virt.c
new file mode 100644
index 0000000000..b22dcf938a
--- /dev/null
+++ b/hw/xtensa/virt.c
@@ -0,0 +1,135 @@
+/*
+ * Copyright (c) 2019, Max Filippov, Open Source and Linux Lab.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the Open Source and Linux Lab nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "cpu.h"
+#include "sysemu/reset.h"
+#include "sysemu/sysemu.h"
+#include "hw/boards.h"
+#include "hw/loader.h"
+#include "hw/pci-host/gpex.h"
+#include "net/net.h"
+#include "elf.h"
+#include "exec/memory.h"
+#include "exec/address-spaces.h"
+#include "qemu/error-report.h"
+#include "xtensa_memory.h"
+#include "xtensa_sim.h"
+
+static void create_pcie(CPUXtensaState *env, int irq_base, hwaddr addr_base)
+{
+    hwaddr base_ecam = addr_base + 0x00100000;
+    hwaddr size_ecam =             0x03f00000;
+    hwaddr base_pio  = addr_base + 0x00000000;
+    hwaddr size_pio  =             0x00010000;
+    hwaddr base_mmio = addr_base + 0x04000000;
+    hwaddr size_mmio =             0x08000000;
+
+    MemoryRegion *ecam_alias;
+    MemoryRegion *ecam_reg;
+    MemoryRegion *pio_alias;
+    MemoryRegion *pio_reg;
+    MemoryRegion *mmio_alias;
+    MemoryRegion *mmio_reg;
+
+    DeviceState *dev;
+    PCIHostState *pci;
+    qemu_irq *extints;
+    int i;
+
+    dev = qdev_create(NULL, TYPE_GPEX_HOST);
+    qdev_init_nofail(dev);
+
+    /* Map only the first size_ecam bytes of ECAM space. */
+    ecam_alias = g_new0(MemoryRegion, 1);
+    ecam_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+    memory_region_init_alias(ecam_alias, OBJECT(dev), "pcie-ecam",
+                             ecam_reg, 0, size_ecam);
+    memory_region_add_subregion(get_system_memory(), base_ecam, ecam_alias);
+
+    /*
+     * Map the MMIO window into system address space so as to expose
+     * the section of PCI MMIO space which starts at the same base address
+     * (ie 1:1 mapping for that part of PCI MMIO space visible through
+     * the window).
+     */
+    mmio_alias = g_new0(MemoryRegion, 1);
+    mmio_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 1);
+    memory_region_init_alias(mmio_alias, OBJECT(dev), "pcie-mmio",
+                             mmio_reg, base_mmio, size_mmio);
+    memory_region_add_subregion(get_system_memory(), base_mmio, mmio_alias);
+
+    /* Map IO port space. */
+    pio_alias = g_new0(MemoryRegion, 1);
+    pio_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 2);
+    memory_region_init_alias(pio_alias, OBJECT(dev), "pcie-pio",
+                             pio_reg, 0, size_pio);
+    memory_region_add_subregion(get_system_memory(), base_pio, pio_alias);
+
+    /* Connect IRQ lines. */
+    extints = xtensa_get_extints(env);
+
+    for (i = 0; i < GPEX_NUM_IRQS; i++) {
+        void *q = extints[irq_base + i];
+
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, q);
+        gpex_set_irq_num(GPEX_HOST(dev), i, irq_base + i);
+    }
+
+    pci = PCI_HOST_BRIDGE(dev);
+    if (pci->bus) {
+        for (i = 0; i < nb_nics; i++) {
+            NICInfo *nd = &nd_table[i];
+
+            if (!nd->model) {
+                nd->model = g_strdup("virtio");
+            }
+
+            pci_nic_init_nofail(nd, pci->bus, nd->model, NULL);
+        }
+    }
+}
+
+static void xtensa_virt_init(MachineState *machine)
+{
+    XtensaCPU *cpu = xtensa_sim_common_init(machine);
+    CPUXtensaState *env = &cpu->env;
+
+    create_pcie(env, 0, 0xf0000000);
+    xtensa_sim_load_kernel(cpu, machine);
+}
+
+static void xtensa_virt_machine_init(MachineClass *mc)
+{
+    mc->desc = "virt machine (" XTENSA_DEFAULT_CPU_MODEL ")";
+    mc->init = xtensa_virt_init;
+    mc->max_cpus = 32;
+    mc->default_cpu_type = XTENSA_DEFAULT_CPU_TYPE;
+}
+
+DEFINE_MACHINE("virt", xtensa_virt_machine_init)
diff --git a/hw/xtensa/xtensa_sim.h b/hw/xtensa/xtensa_sim.h
new file mode 100644
index 0000000000..bdc92f3d2c
--- /dev/null
+++ b/hw/xtensa/xtensa_sim.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2019, Max Filippov, Open Source and Linux Lab.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the Open Source and Linux Lab nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef XTENSA_SIM_H
+#define XTENSA_SIM_H
+
+XtensaCPU *xtensa_sim_common_init(MachineState *machine);
+void xtensa_sim_load_kernel(XtensaCPU *cpu, MachineState *machine);
+
+#endif
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 02073a6b4d..f49bc7081e 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -18,6 +18,7 @@ typedef struct AspeedBoardConfig {
     const char *desc;
     const char *soc_name;
     uint32_t hw_strap1;
+    uint32_t hw_strap2;
     const char *fmc_model;
     const char *spi_model;
     uint32_t num_cs;
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index cccb684a19..495c08be1b 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -18,7 +18,7 @@
 #include "hw/misc/aspeed_sdmc.h"
 #include "hw/misc/aspeed_xdma.h"
 #include "hw/timer/aspeed_timer.h"
-#include "hw/timer/aspeed_rtc.h"
+#include "hw/rtc/aspeed_rtc.h"
 #include "hw/i2c/aspeed_i2c.h"
 #include "hw/ssi/aspeed_smc.h"
 #include "hw/watchdog/wdt_aspeed.h"
diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index 62a4c7b559..7859281e11 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -20,9 +20,11 @@
 #include "hw/misc/bcm2835_property.h"
 #include "hw/misc/bcm2835_rng.h"
 #include "hw/misc/bcm2835_mbox.h"
+#include "hw/misc/bcm2835_thermal.h"
 #include "hw/sd/sdhci.h"
 #include "hw/sd/bcm2835_sdhost.h"
 #include "hw/gpio/bcm2835_gpio.h"
+#include "hw/timer/bcm2835_systmr.h"
 #include "hw/misc/unimp.h"
 
 #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
@@ -38,7 +40,7 @@ typedef struct BCM2835PeripheralState {
     MemoryRegion ram_alias[4];
     qemu_irq irq, fiq;
 
-    UnimplementedDeviceState systmr;
+    BCM2835SystemTimerState systmr;
     UnimplementedDeviceState armtmr;
     UnimplementedDeviceState cprman;
     UnimplementedDeviceState a2w;
@@ -53,6 +55,7 @@ typedef struct BCM2835PeripheralState {
     SDHCIState sdhci;
     BCM2835SDHostState sdhost;
     BCM2835GpioState gpio;
+    Bcm2835ThermalState thermal;
     UnimplementedDeviceState i2s;
     UnimplementedDeviceState spi[1];
     UnimplementedDeviceState i2c[3];
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index 97187f72be..92a6544816 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -35,7 +35,9 @@ typedef struct BCM283XState {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM283X_NCPUS];
+    struct {
+        ARMCPU core;
+    } cpu[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
 } BCM283XState;
diff --git a/include/hw/arm/omap.h b/include/hw/arm/omap.h
index 2fda996648..f3aa670036 100644
--- a/include/hw/arm/omap.h
+++ b/include/hw/arm/omap.h
@@ -823,8 +823,6 @@ struct omap_mpu_state_s {
     MemoryRegion mpui_io_iomem;
     MemoryRegion tap_iomem;
     MemoryRegion imif_ram;
-    MemoryRegion emiff_ram;
-    MemoryRegion sdram;
     MemoryRegion sram;
 
     struct omap_dma_port_if_s {
@@ -836,7 +834,7 @@ struct omap_mpu_state_s {
                         hwaddr addr);
     } port[__omap_dma_port_last];
 
-    unsigned long sdram_size;
+    uint64_t sdram_size;
     unsigned long sram_size;
 
     /* MPUI-TIPB peripherals */
@@ -933,13 +931,11 @@ struct omap_mpu_state_s {
 };
 
 /* omap1.c */
-struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
-                unsigned long sdram_size,
+struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *sdram,
                 const char *core);
 
 /* omap2.c */
-struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
-                unsigned long sdram_size,
+struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sdram,
                 const char *core);
 
 uint32_t omap_badwidth_read8(void *opaque, hwaddr addr);
diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index cdcbca943f..61b04a1bd4 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -48,6 +48,7 @@
 #define SPI0_OFFSET             0x204000
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
 #define OTP_OFFSET              0x20f000
+#define THERMAL_OFFSET          0x212000
 #define BSC_SL_OFFSET           0x214000 /* SPI slave */
 #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 #define EMMC1_OFFSET            0x300000
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index d7483c3b42..53076fa29a 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -29,7 +29,7 @@
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/display/xlnx_dp.h"
 #include "hw/intc/xlnx-zynqmp-ipi.h"
-#include "hw/timer/xlnx-zynqmp-rtc.h"
+#include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "hw/cpu/cluster.h"
 #include "target/arm/cpu.h"
 
diff --git a/include/hw/misc/bcm2835_thermal.h b/include/hw/misc/bcm2835_thermal.h
new file mode 100644
index 0000000000..c3651b27ec
--- /dev/null
+++ b/include/hw/misc/bcm2835_thermal.h
@@ -0,0 +1,27 @@
+/*
+ * BCM2835 dummy thermal sensor
+ *
+ * Copyright (C) 2019 Philippe Mathieu-Daudé <f4bug@amsat.org>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_MISC_BCM2835_THERMAL_H
+#define HW_MISC_BCM2835_THERMAL_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_BCM2835_THERMAL "bcm2835-thermal"
+
+#define BCM2835_THERMAL(obj) \
+    OBJECT_CHECK(Bcm2835ThermalState, (obj), TYPE_BCM2835_THERMAL)
+
+typedef struct {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+    MemoryRegion iomem;
+    uint32_t ctl;
+} Bcm2835ThermalState;
+
+#endif
diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
index 23506f05d9..8877ff51fb 100644
--- a/include/hw/pci-host/spapr.h
+++ b/include/hw/pci-host/spapr.h
@@ -128,8 +128,8 @@ struct SpaprPhbState {
 #define SPAPR_PCI_NV2ATSD_WIN_SIZE   (NVGPU_MAX_NUM * NVGPU_MAX_LINKS * \
                                       64 * KiB)
 
-int spapr_dt_phb(SpaprPhbState *phb, uint32_t intc_phandle, void *fdt,
-                 uint32_t nr_msis, int *node_offset);
+int spapr_dt_phb(SpaprMachineState *spapr, SpaprPhbState *phb,
+                 uint32_t intc_phandle, void *fdt, int *node_offset);
 
 void spapr_pci_rtas_init(void);
 
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index 1cdbe55bf8..2a780e633f 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -111,6 +111,7 @@ typedef struct PnvChipClass {
 
     uint32_t (*core_pir)(PnvChip *chip, uint32_t core_id);
     void (*intc_create)(PnvChip *chip, PowerPCCPU *cpu, Error **errp);
+    void (*intc_reset)(PnvChip *chip, PowerPCCPU *cpu);
     ISABus *(*isa_create)(PnvChip *chip, Error **errp);
     void (*dt_populate)(PnvChip *chip, void *fdt);
     void (*pic_print_info)(PnvChip *chip, Monitor *mon);
diff --git a/include/hw/ppc/pnv_core.h b/include/hw/ppc/pnv_core.h
index bfbd2ec42a..55eee95104 100644
--- a/include/hw/ppc/pnv_core.h
+++ b/include/hw/ppc/pnv_core.h
@@ -31,6 +31,8 @@
 #define PNV_CORE_GET_CLASS(obj) \
      OBJECT_GET_CLASS(PnvCoreClass, (obj), TYPE_PNV_CORE)
 
+typedef struct PnvChip PnvChip;
+
 typedef struct PnvCore {
     /*< private >*/
     CPUCore parent_obj;
@@ -38,6 +40,7 @@ typedef struct PnvCore {
     /*< public >*/
     PowerPCCPU **threads;
     uint32_t pir;
+    PnvChip *chip;
 
     MemoryRegion xscom_regs;
 } PnvCore;
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index cbd1a4c9f3..d5ab5ea7b2 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -119,9 +119,11 @@ struct SpaprMachineClass {
     bool use_ohci_by_default;  /* use USB-OHCI instead of XHCI */
     bool pre_2_10_has_unused_icps;
     bool legacy_irq_allocation;
+    uint32_t nr_xirqs;
     bool broken_host_serial_model; /* present real host info to the guest */
     bool pre_4_1_migration; /* don't migrate hpt-max-page-size */
     bool linux_pci_probe;
+    bool smp_threads_vsmt; /* set VSMT to smp_threads by default */
 
     void (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio, 
@@ -143,7 +145,6 @@ struct SpaprMachineState {
     struct SpaprVioBus *vio_bus;
     QLIST_HEAD(, SpaprPhbState) phbs;
     struct SpaprNvram *nvram;
-    ICSState *ics;
     SpaprRtcState rtc;
 
     SpaprResizeHpt resize_hpt;
@@ -195,9 +196,11 @@ struct SpaprMachineState {
 
     int32_t irq_map_nr;
     unsigned long *irq_map;
-    SpaprXive  *xive;
     SpaprIrq *irq;
     qemu_irq *qirqs;
+    SpaprInterruptController *active_intc;
+    ICSState *ics;
+    SpaprXive *xive;
 
     bool cmd_line_caps[SPAPR_CAP_NUM];
     SpaprCapabilities def, eff, mig;
diff --git a/include/hw/ppc/spapr_irq.h b/include/hw/ppc/spapr_irq.h
index 69a37f608e..09232999b0 100644
--- a/include/hw/ppc/spapr_irq.h
+++ b/include/hw/ppc/spapr_irq.h
@@ -27,32 +27,61 @@
 #define SPAPR_IRQ_MSI        (SPAPR_XIRQ_BASE + 0x0300)
 
 #define SPAPR_NR_XIRQS       0x1000
-#define SPAPR_NR_MSIS        (SPAPR_XIRQ_BASE + SPAPR_NR_XIRQS - SPAPR_IRQ_MSI)
 
 typedef struct SpaprMachineState SpaprMachineState;
 
-void spapr_irq_msi_init(SpaprMachineState *spapr, uint32_t nr_msis);
+typedef struct SpaprInterruptController SpaprInterruptController;
+
+#define TYPE_SPAPR_INTC "spapr-interrupt-controller"
+#define SPAPR_INTC(obj)                                     \
+    INTERFACE_CHECK(SpaprInterruptController, (obj), TYPE_SPAPR_INTC)
+#define SPAPR_INTC_CLASS(klass)                                     \
+    OBJECT_CLASS_CHECK(SpaprInterruptControllerClass, (klass), TYPE_SPAPR_INTC)
+#define SPAPR_INTC_GET_CLASS(obj)                                   \
+    OBJECT_GET_CLASS(SpaprInterruptControllerClass, (obj), TYPE_SPAPR_INTC)
+
+typedef struct SpaprInterruptControllerClass {
+    InterfaceClass parent;
+
+    int (*activate)(SpaprInterruptController *intc, Error **errp);
+    void (*deactivate)(SpaprInterruptController *intc);
+
+    /*
+     * These methods will typically be called on all intcs, active and
+     * inactive
+     */
+    int (*cpu_intc_create)(SpaprInterruptController *intc,
+                            PowerPCCPU *cpu, Error **errp);
+    void (*cpu_intc_reset)(SpaprInterruptController *intc, PowerPCCPU *cpu);
+    int (*claim_irq)(SpaprInterruptController *intc, int irq, bool lsi,
+                     Error **errp);
+    void (*free_irq)(SpaprInterruptController *intc, int irq);
+
+    /* These methods should only be called on the active intc */
+    void (*set_irq)(SpaprInterruptController *intc, int irq, int val);
+    void (*print_info)(SpaprInterruptController *intc, Monitor *mon);
+    void (*dt)(SpaprInterruptController *intc, uint32_t nr_servers,
+               void *fdt, uint32_t phandle);
+    int (*post_load)(SpaprInterruptController *intc, int version_id);
+} SpaprInterruptControllerClass;
+
+void spapr_irq_update_active_intc(SpaprMachineState *spapr);
+
+int spapr_irq_cpu_intc_create(SpaprMachineState *spapr,
+                              PowerPCCPU *cpu, Error **errp);
+void spapr_irq_cpu_intc_reset(SpaprMachineState *spapr, PowerPCCPU *cpu);
+void spapr_irq_print_info(SpaprMachineState *spapr, Monitor *mon);
+void spapr_irq_dt(SpaprMachineState *spapr, uint32_t nr_servers,
+                  void *fdt, uint32_t phandle);
+
+uint32_t spapr_irq_nr_msis(SpaprMachineState *spapr);
 int spapr_irq_msi_alloc(SpaprMachineState *spapr, uint32_t num, bool align,
                         Error **errp);
 void spapr_irq_msi_free(SpaprMachineState *spapr, int irq, uint32_t num);
 
 typedef struct SpaprIrq {
-    uint32_t    nr_xirqs;
-    uint32_t    nr_msis;
     bool        xics;
     bool        xive;
-
-    int (*claim)(SpaprMachineState *spapr, int irq, bool lsi, Error **errp);
-    void (*free)(SpaprMachineState *spapr, int irq);
-    void (*print_info)(SpaprMachineState *spapr, Monitor *mon);
-    void (*dt_populate)(SpaprMachineState *spapr, uint32_t nr_servers,
-                        void *fdt, uint32_t phandle);
-    void (*cpu_intc_create)(SpaprMachineState *spapr, PowerPCCPU *cpu,
-                            Error **errp);
-    int (*post_load)(SpaprMachineState *spapr, int version_id);
-    void (*reset)(SpaprMachineState *spapr, Error **errp);
-    void (*set_irq)(void *opaque, int srcno, int val);
-    void (*init_kvm)(SpaprMachineState *spapr, Error **errp);
 } SpaprIrq;
 
 extern SpaprIrq spapr_irq_xics;
@@ -67,6 +96,9 @@ qemu_irq spapr_qirq(SpaprMachineState *spapr, int irq);
 int spapr_irq_post_load(SpaprMachineState *spapr, int version_id);
 void spapr_irq_reset(SpaprMachineState *spapr, Error **errp);
 int spapr_irq_get_phandle(SpaprMachineState *spapr, void *fdt, Error **errp);
+int spapr_irq_init_kvm(int (*fn)(SpaprInterruptController *, Error **),
+                       SpaprInterruptController *intc,
+                       Error **errp);
 
 /*
  * XICS legacy routines
diff --git a/include/hw/ppc/spapr_xive.h b/include/hw/ppc/spapr_xive.h
index 0df20a6590..742b7e834f 100644
--- a/include/hw/ppc/spapr_xive.h
+++ b/include/hw/ppc/spapr_xive.h
@@ -54,15 +54,9 @@ typedef struct SpaprXive {
  */
 #define SPAPR_XIVE_BLOCK_ID 0x0
 
-int spapr_xive_irq_claim(SpaprXive *xive, int lisn, bool lsi, Error **errp);
-void spapr_xive_irq_free(SpaprXive *xive, int lisn);
 void spapr_xive_pic_print_info(SpaprXive *xive, Monitor *mon);
-int spapr_xive_post_load(SpaprXive *xive, int version_id);
 
 void spapr_xive_hcall_init(SpaprMachineState *spapr);
-void spapr_dt_xive(SpaprMachineState *spapr, uint32_t nr_servers, void *fdt,
-                   uint32_t phandle);
-void spapr_xive_set_tctx_os_cam(XiveTCTX *tctx);
 void spapr_xive_mmio_set_enabled(SpaprXive *xive, bool enable);
 void spapr_xive_map_mmio(SpaprXive *xive);
 
@@ -72,8 +66,8 @@ int spapr_xive_end_to_target(uint8_t end_blk, uint32_t end_idx,
 /*
  * KVM XIVE device helpers
  */
-void kvmppc_xive_connect(SpaprXive *xive, Error **errp);
-void kvmppc_xive_disconnect(SpaprXive *xive, Error **errp);
+int kvmppc_xive_connect(SpaprInterruptController *intc, Error **errp);
+void kvmppc_xive_disconnect(SpaprInterruptController *intc);
 void kvmppc_xive_reset(SpaprXive *xive, Error **errp);
 void kvmppc_xive_set_source_config(SpaprXive *xive, uint32_t lisn, XiveEAS *eas,
                                    Error **errp);
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index 1e6a9300eb..602173c122 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -161,6 +161,7 @@ void icp_set_mfrr(ICPState *icp, uint8_t mfrr);
 uint32_t icp_accept(ICPState *ss);
 uint32_t icp_ipoll(ICPState *ss, uint32_t *mfrr);
 void icp_eoi(ICPState *icp, uint32_t xirr);
+void icp_reset(ICPState *icp);
 
 void ics_write_xive(ICSState *ics, int nr, int server,
                     uint8_t priority, uint8_t saved_priority);
diff --git a/include/hw/ppc/xics_spapr.h b/include/hw/ppc/xics_spapr.h
index 0b35e85c26..28b87038c8 100644
--- a/include/hw/ppc/xics_spapr.h
+++ b/include/hw/ppc/xics_spapr.h
@@ -32,10 +32,8 @@
 #define TYPE_ICS_SPAPR "ics-spapr"
 #define ICS_SPAPR(obj) OBJECT_CHECK(ICSState, (obj), TYPE_ICS_SPAPR)
 
-void spapr_dt_xics(SpaprMachineState *spapr, uint32_t nr_servers, void *fdt,
-                   uint32_t phandle);
-int xics_kvm_connect(SpaprMachineState *spapr, Error **errp);
-void xics_kvm_disconnect(SpaprMachineState *spapr, Error **errp);
+int xics_kvm_connect(SpaprInterruptController *intc, Error **errp);
+void xics_kvm_disconnect(SpaprInterruptController *intc);
 bool xics_kvm_has_broken_disconnect(SpaprMachineState *spapr);
 
 #endif /* XICS_SPAPR_H */
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index fd3319bd32..99381639f5 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -415,6 +415,7 @@ uint64_t xive_tctx_tm_read(XiveTCTX *tctx, hwaddr offset, unsigned size);
 
 void xive_tctx_pic_print_info(XiveTCTX *tctx, Monitor *mon);
 Object *xive_tctx_create(Object *cpu, XiveRouter *xrtr, Error **errp);
+void xive_tctx_reset(XiveTCTX *tctx);
 
 static inline uint32_t xive_nvt_cam_line(uint8_t nvt_blk, uint32_t nvt_idx)
 {
diff --git a/include/hw/ppc/xive_regs.h b/include/hw/ppc/xive_regs.h
index 08c8bf7172..55307cd153 100644
--- a/include/hw/ppc/xive_regs.h
+++ b/include/hw/ppc/xive_regs.h
@@ -22,9 +22,29 @@
 /*
  * Interrupt source number encoding on PowerBUS
  */
-#define XIVE_SRCNO_BLOCK(srcno) (((srcno) >> 28) & 0xf)
-#define XIVE_SRCNO_INDEX(srcno) ((srcno) & 0x0fffffff)
-#define XIVE_SRCNO(blk, idx)    ((uint32_t)(blk) << 28 | (idx))
+/*
+ * Trigger data definition
+ *
+ * The trigger definition is used for triggers both for HW source
+ * interrupts (PHB, PSI), as well as for rerouting interrupts between
+ * Interrupt Controller.
+ *
+ * HW source controllers set bit0 of word0 to ‘0’ as they provide EAS
+ * information (EAS block + EAS index) in the 8 byte data and not END
+ * information, which is use for rerouting interrupts.
+ *
+ * bit1 of word0 to ‘1’ signals that the state bit check has been
+ * performed.
+ */
+#define XIVE_TRIGGER_END        PPC_BIT(0)
+#define XIVE_TRIGGER_PQ         PPC_BIT(1)
+
+/*
+ * QEMU macros to manipulate the trigger payload in native endian
+ */
+#define XIVE_EAS_BLOCK(n)       (((n) >> 28) & 0xf)
+#define XIVE_EAS_INDEX(n)       ((n) & 0x0fffffff)
+#define XIVE_EAS(blk, idx)      ((uint32_t)(blk) << 28 | (idx))
 
 #define TM_SHIFT                16
 
diff --git a/include/hw/timer/aspeed_rtc.h b/include/hw/rtc/aspeed_rtc.h
index 15ba42912b..b94a710268 100644
--- a/include/hw/timer/aspeed_rtc.h
+++ b/include/hw/rtc/aspeed_rtc.h
@@ -5,12 +5,9 @@
  * Copyright 2019 IBM Corp
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
-#ifndef ASPEED_RTC_H
-#define ASPEED_RTC_H
+#ifndef HW_RTC_ASPEED_RTC_H
+#define HW_RTC_ASPEED_RTC_H
 
-#include <stdint.h>
-
-#include "hw/irq.h"
 #include "hw/sysbus.h"
 
 typedef struct AspeedRtcState {
@@ -27,4 +24,4 @@ typedef struct AspeedRtcState {
 #define TYPE_ASPEED_RTC "aspeed.rtc"
 #define ASPEED_RTC(obj) OBJECT_CHECK(AspeedRtcState, (obj), TYPE_ASPEED_RTC)
 
-#endif /* ASPEED_RTC_H */
+#endif /* HW_RTC_ASPEED_RTC_H */
diff --git a/include/hw/rtc/m48t59.h b/include/hw/rtc/m48t59.h
new file mode 100644
index 0000000000..e7ea4e8761
--- /dev/null
+++ b/include/hw/rtc/m48t59.h
@@ -0,0 +1,57 @@
+/*
+ * QEMU M48T59 and M48T08 NVRAM emulation
+ *
+ * Copyright (c) 2003-2005, 2007 Jocelyn Mayer
+ * Copyright (c) 2013 Hervé Poussineau
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_RTC_M48T59_H
+#define HW_RTC_M48T59_H
+
+#include "exec/hwaddr.h"
+#include "qom/object.h"
+
+#define TYPE_NVRAM "nvram"
+
+#define NVRAM_CLASS(klass) \
+    OBJECT_CLASS_CHECK(NvramClass, (klass), TYPE_NVRAM)
+#define NVRAM_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(NvramClass, (obj), TYPE_NVRAM)
+#define NVRAM(obj) \
+    INTERFACE_CHECK(Nvram, (obj), TYPE_NVRAM)
+
+typedef struct Nvram Nvram;
+
+typedef struct NvramClass {
+    InterfaceClass parent;
+
+    uint32_t (*read)(Nvram *obj, uint32_t addr);
+    void (*write)(Nvram *obj, uint32_t addr, uint32_t val);
+    void (*toggle_lock)(Nvram *obj, int lock);
+} NvramClass;
+
+Nvram *m48t59_init_isa(ISABus *bus, uint32_t io_base, uint16_t size,
+                       int base_year, int type);
+Nvram *m48t59_init(qemu_irq IRQ, hwaddr mem_base,
+                   uint32_t io_base, uint16_t size, int base_year,
+                   int type);
+
+#endif /* HW_M48T59_H */
diff --git a/include/hw/timer/mc146818rtc.h b/include/hw/rtc/mc146818rtc.h
index a857dcdc69..10c93a096a 100644
--- a/include/hw/timer/mc146818rtc.h
+++ b/include/hw/rtc/mc146818rtc.h
@@ -1,5 +1,13 @@
-#ifndef MC146818RTC_H
-#define MC146818RTC_H
+/*
+ * QEMU MC146818 RTC emulation
+ *
+ * Copyright (c) 2003-2004 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef HW_RTC_MC146818RTC_H
+#define HW_RTC_MC146818RTC_H
 
 #include "qapi/qapi-types-misc.h"
 #include "qemu/queue.h"
diff --git a/include/hw/timer/mc146818rtc_regs.h b/include/hw/rtc/mc146818rtc_regs.h
index 631f71cfd9..12197e0553 100644
--- a/include/hw/timer/mc146818rtc_regs.h
+++ b/include/hw/rtc/mc146818rtc_regs.h
@@ -22,10 +22,11 @@
  * THE SOFTWARE.
  */
 
-#ifndef MC146818RTC_REGS_H
-#define MC146818RTC_REGS_H
+#ifndef HW_RTC_MC146818RTC_REGS_H
+#define HW_RTC_MC146818RTC_REGS_H
 
 #include "qemu/timer.h"
+#include "qemu/host-utils.h"
 
 #define RTC_SECONDS             0
 #define RTC_SECONDS_ALARM       1
diff --git a/include/hw/timer/pl031.h b/include/hw/rtc/pl031.h
index 8c3f555ee2..e3cb1d646f 100644
--- a/include/hw/timer/pl031.h
+++ b/include/hw/rtc/pl031.h
@@ -11,10 +11,11 @@
  * GNU GPL, version 2 or (at your option) any later version.
  */
 
-#ifndef HW_TIMER_PL031_H
-#define HW_TIMER_PL031_H
+#ifndef HW_RTC_PL031_H
+#define HW_RTC_PL031_H
 
 #include "hw/sysbus.h"
+#include "qemu/timer.h"
 
 #define TYPE_PL031 "pl031"
 #define PL031(obj) OBJECT_CHECK(PL031State, (obj), TYPE_PL031)
diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
new file mode 100644
index 0000000000..fd868f6ed2
--- /dev/null
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -0,0 +1,19 @@
+/*
+ * QEMU sun4v Real Time Clock device
+ *
+ * The sun4v_rtc device (sun4v tod clock)
+ *
+ * Copyright (c) 2016 Artyom Tarasenko
+ *
+ * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * version.
+ */
+
+#ifndef HW_RTC_SUN4V
+#define HW_RTC_SUN4V
+
+#include "exec/hwaddr.h"
+
+void sun4v_rtc_init(hwaddr addr);
+
+#endif
diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/rtc/xlnx-zynqmp-rtc.h
index 97e32322ed..6fa1cb2f43 100644
--- a/include/hw/timer/xlnx-zynqmp-rtc.h
+++ b/include/hw/rtc/xlnx-zynqmp-rtc.h
@@ -3,7 +3,7 @@
  *
  * Copyright (c) 2017 Xilinx Inc.
  *
- * Written-by: Alistair Francis <alistair.francis@xilinx.com>
+ * Written-by: Alistair Francis
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,8 +24,8 @@
  * THE SOFTWARE.
  */
 
-#ifndef HW_TIMER_XLNX_ZYNQMP_RTC_H
-#define HW_TIMER_XLNX_ZYNQMP_RTC_H
+#ifndef HW_RTC_XLNX_ZYNQMP_H
+#define HW_RTC_XLNX_ZYNQMP_H
 
 #include "hw/register.h"
 #include "hw/sysbus.h"
diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index cbf415e43a..c6868c9699 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -116,4 +116,6 @@ typedef struct SDHCIState {
 
 #define TYPE_IMX_USDHC "imx-usdhc"
 
+#define TYPE_S3C_SDHCI "s3c-sdhci"
+
 #endif /* SDHCI_H */
diff --git a/include/hw/timer/bcm2835_systmr.h b/include/hw/timer/bcm2835_systmr.h
new file mode 100644
index 0000000000..c0bc5c8127
--- /dev/null
+++ b/include/hw/timer/bcm2835_systmr.h
@@ -0,0 +1,33 @@
+/*
+ * BCM2835 SYS timer emulation
+ *
+ * Copyright (c) 2019 Philippe Mathieu-Daudé <f4bug@amsat.org>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef BCM2835_SYSTIMER_H
+#define BCM2835_SYSTIMER_H
+
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+
+#define TYPE_BCM2835_SYSTIMER "bcm2835-sys-timer"
+#define BCM2835_SYSTIMER(obj) \
+    OBJECT_CHECK(BCM2835SystemTimerState, (obj), TYPE_BCM2835_SYSTIMER)
+
+typedef struct {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    qemu_irq irq;
+
+    struct {
+        uint32_t status;
+        uint32_t compare[4];
+    } reg;
+} BCM2835SystemTimerState;
+
+#endif
diff --git a/include/hw/timer/m48t59.h b/include/hw/timer/m48t59.h
deleted file mode 100644
index f74854c026..0000000000
--- a/include/hw/timer/m48t59.h
+++ /dev/null
@@ -1,32 +0,0 @@
-#ifndef HW_M48T59_H
-#define HW_M48T59_H
-
-#include "exec/hwaddr.h"
-#include "qom/object.h"
-
-#define TYPE_NVRAM "nvram"
-
-#define NVRAM_CLASS(klass) \
-    OBJECT_CLASS_CHECK(NvramClass, (klass), TYPE_NVRAM)
-#define NVRAM_GET_CLASS(obj) \
-    OBJECT_GET_CLASS(NvramClass, (obj), TYPE_NVRAM)
-#define NVRAM(obj) \
-    INTERFACE_CHECK(Nvram, (obj), TYPE_NVRAM)
-
-typedef struct Nvram Nvram;
-
-typedef struct NvramClass {
-    InterfaceClass parent;
-
-    uint32_t (*read)(Nvram *obj, uint32_t addr);
-    void (*write)(Nvram *obj, uint32_t addr, uint32_t val);
-    void (*toggle_lock)(Nvram *obj, int lock);
-} NvramClass;
-
-Nvram *m48t59_init_isa(ISABus *bus, uint32_t io_base, uint16_t size,
-                       int base_year, int type);
-Nvram *m48t59_init(qemu_irq IRQ, hwaddr mem_base,
-                   uint32_t io_base, uint16_t size, int base_year,
-                   int type);
-
-#endif /* HW_M48T59_H */
diff --git a/include/hw/timer/sun4v-rtc.h b/include/hw/timer/sun4v-rtc.h
deleted file mode 100644
index 407278f918..0000000000
--- a/include/hw/timer/sun4v-rtc.h
+++ /dev/null
@@ -1 +0,0 @@
-void sun4v_rtc_init(hwaddr addr);
diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index 9801e7f5a4..dfd261c5b1 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -167,6 +167,21 @@ void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex);
  */
 void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex);
 
+/**
+ * Assert that the current coroutine holds @mutex.
+ */
+static inline coroutine_fn void qemu_co_mutex_assert_locked(CoMutex *mutex)
+{
+    /*
+     * mutex->holder doesn't need any synchronisation if the assertion holds
+     * true because the mutex protects it. If it doesn't hold true, we still
+     * don't mind if another thread takes or releases mutex behind our back,
+     * because the condition will be false no matter whether we read NULL or
+     * the pointer for any other coroutine.
+     */
+    assert(atomic_read(&mutex->locked) &&
+           mutex->holder == qemu_coroutine_self());
+}
 
 /**
  * CoQueues are a mechanism to queue coroutines in order to continue executing
@@ -273,10 +288,29 @@ void qemu_co_rwlock_wrlock(CoRwlock *lock);
  */
 void qemu_co_rwlock_unlock(CoRwlock *lock);
 
+typedef struct QemuCoSleepState QemuCoSleepState;
+
+/**
+ * Yield the coroutine for a given duration. During this yield, @sleep_state
+ * (if not NULL) is set to an opaque pointer, which may be used for
+ * qemu_co_sleep_wake(). Be careful, the pointer is set back to zero when the
+ * timer fires. Don't save the obtained value to other variables and don't call
+ * qemu_co_sleep_wake from another aio context.
+ */
+void coroutine_fn qemu_co_sleep_ns_wakeable(QEMUClockType type, int64_t ns,
+                                            QemuCoSleepState **sleep_state);
+static inline void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns)
+{
+    qemu_co_sleep_ns_wakeable(type, ns, NULL);
+}
+
 /**
- * Yield the coroutine for a given duration
+ * Wake a coroutine if it is sleeping in qemu_co_sleep_ns. The timer will be
+ * deleted. @sleep_state must be the variable whose address was given to
+ * qemu_co_sleep_ns() and should be checked to be non-NULL before calling
+ * qemu_co_sleep_wake().
  */
-void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns);
+void qemu_co_sleep_wake(QemuCoSleepState *sleep_state);
 
 /**
  * Yield until a file descriptor becomes readable
diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 1295fa8531..31c845a70d 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -173,6 +173,7 @@ void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
     for (i = 1; i < 4; ++i) {
         env->cp15.sctlr_el[i] |= SCTLR_EE;
     }
+    arm_rebuild_hflags(env);
 #endif
 
     if (cpu_isar_feature(aa64_pauth, cpu)) {
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index e28c45cd4a..7be4071751 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -440,6 +440,7 @@ void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
     } else {
         env->cp15.sctlr_el[1] |= SCTLR_B;
     }
+    arm_rebuild_hflags(env);
 #endif
 
     ts->stack_base = info->start_stack;
diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
index 60077ce531..9b92386abf 100644
--- a/linux-user/fd-trans.c
+++ b/linux-user/fd-trans.c
@@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
                                                        (struct nlmsghdr *))
 {
     uint32_t nlmsg_len;
+    uint32_t aligned_nlmsg_len;
     abi_long ret;
 
     while (len > sizeof(struct nlmsghdr)) {
@@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
             break;
         }
         tswap_nlmsghdr(nlh);
-        len -= NLMSG_ALIGN(nlmsg_len);
-        nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
+
+        aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
+        if (aligned_nlmsg_len >= len) {
+            break;
+        }
+        len -= aligned_nlmsg_len;
+        nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
     }
     return 0;
 }
@@ -323,6 +329,7 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
                                               abi_long (*target_to_host_nlmsg)
                                                        (struct nlmsghdr *))
 {
+    uint32_t aligned_nlmsg_len;
     int ret;
 
     while (len > sizeof(struct nlmsghdr)) {
@@ -349,8 +356,13 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
                 return ret;
             }
         }
-        len -= NLMSG_ALIGN(nlh->nlmsg_len);
-        nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len));
+
+        aligned_nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len);
+        if (aligned_nlmsg_len >= len) {
+            break;
+        }
+        len -= aligned_nlmsg_len;
+        nlh = (struct nlmsghdr *)(((char *)nlh) + aligned_nlmsg_len);
     }
     return 0;
 }
@@ -363,6 +375,7 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
                                                          void *context))
 {
     unsigned short nla_len;
+    unsigned short aligned_nla_len;
     abi_long ret;
 
     while (len > sizeof(struct nlattr)) {
@@ -377,8 +390,13 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
         if (ret < 0) {
             return ret;
         }
-        len -= NLA_ALIGN(nla_len);
-        nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len));
+
+        aligned_nla_len = NLA_ALIGN(nla_len);
+        if (aligned_nla_len >= len) {
+            break;
+        }
+        len -= aligned_nla_len;
+        nlattr = (struct nlattr *)(((char *)nlattr) + aligned_nla_len);
     }
     return 0;
 }
@@ -389,6 +407,7 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
                                                         (struct rtattr *))
 {
     unsigned short rta_len;
+    unsigned short aligned_rta_len;
     abi_long ret;
 
     while (len > sizeof(struct rtattr)) {
@@ -403,8 +422,13 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
         if (ret < 0) {
             return ret;
         }
-        len -= RTA_ALIGN(rta_len);
-        rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len));
+
+        aligned_rta_len = RTA_ALIGN(rta_len);
+        if (aligned_rta_len >= len) {
+            break;
+        }
+        len -= aligned_rta_len;
+        rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
     }
     return 0;
 }
@@ -1058,6 +1082,7 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
                                                abi_long (*target_to_host_rtattr)
                                                         (struct rtattr *))
 {
+    unsigned short aligned_rta_len;
     abi_long ret;
 
     while (len >= sizeof(struct rtattr)) {
@@ -1071,9 +1096,13 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
         if (ret < 0) {
             return ret;
         }
-        len -= RTA_ALIGN(rtattr->rta_len);
-        rtattr = (struct rtattr *)(((char *)rtattr) +
-                 RTA_ALIGN(rtattr->rta_len));
+
+        aligned_rta_len = RTA_ALIGN(rtattr->rta_len);
+        if (aligned_rta_len >= len) {
+            break;
+        }
+        len -= aligned_rta_len;
+        rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
     }
     return 0;
 }
diff --git a/linux-user/strace.c b/linux-user/strace.c
index c80e93b5db..3d4d684450 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -8,6 +8,7 @@
 #include <arpa/inet.h>
 #include <netinet/tcp.h>
 #include <linux/if_packet.h>
+#include <linux/netlink.h>
 #include <sched.h>
 #include "qemu.h"
 
@@ -63,9 +64,10 @@ UNUSED static void print_string(abi_long, int);
 UNUSED static void print_buf(abi_long addr, abi_long len, int last);
 UNUSED static void print_raw_param(const char *, abi_long, int);
 UNUSED static void print_timeval(abi_ulong, int);
+UNUSED static void print_timezone(abi_ulong, int);
 UNUSED static void print_number(abi_long, int);
 UNUSED static void print_signal(abi_ulong, int);
-UNUSED static void print_sockaddr(abi_ulong addr, abi_long addrlen);
+UNUSED static void print_sockaddr(abi_ulong, abi_long, int);
 UNUSED static void print_socket_domain(int domain);
 UNUSED static void print_socket_type(int type);
 UNUSED static void print_socket_protocol(int domain, int type, int protocol);
@@ -334,7 +336,7 @@ static void print_siginfo(const target_siginfo_t *tinfo)
 }
 
 static void
-print_sockaddr(abi_ulong addr, abi_long addrlen)
+print_sockaddr(abi_ulong addr, abi_long addrlen, int last)
 {
     struct target_sockaddr *sa;
     int i;
@@ -397,6 +399,12 @@ print_sockaddr(abi_ulong addr, abi_long addrlen)
             gemu_log("}");
             break;
         }
+        case AF_NETLINK: {
+            struct target_sockaddr_nl *nl = (struct target_sockaddr_nl *)sa;
+            gemu_log("{nl_family=AF_NETLINK,nl_pid=%u,nl_groups=%u}",
+                     tswap32(nl->nl_pid), tswap32(nl->nl_groups));
+            break;
+        }
         default:
             gemu_log("{sa_family=%d, sa_data={", sa->sa_family);
             for (i = 0; i < 13; i++) {
@@ -410,7 +418,7 @@ print_sockaddr(abi_ulong addr, abi_long addrlen)
     } else {
         print_raw_param("0x"TARGET_ABI_FMT_lx, addr, 0);
     }
-    gemu_log(", "TARGET_ABI_FMT_ld, addrlen);
+    gemu_log(", "TARGET_ABI_FMT_ld"%s", addrlen, get_comma(last));
 }
 
 static void
@@ -423,6 +431,9 @@ print_socket_domain(int domain)
     case PF_INET:
         gemu_log("PF_INET");
         break;
+    case PF_NETLINK:
+        gemu_log("PF_NETLINK");
+        break;
     case PF_PACKET:
         gemu_log("PF_PACKET");
         break;
@@ -472,6 +483,33 @@ print_socket_protocol(int domain, int type, int protocol)
         return;
     }
 
+    if (domain == PF_NETLINK) {
+        switch (protocol) {
+        case NETLINK_ROUTE:
+            gemu_log("NETLINK_ROUTE");
+            break;
+        case NETLINK_AUDIT:
+            gemu_log("NETLINK_AUDIT");
+            break;
+        case NETLINK_NETFILTER:
+            gemu_log("NETLINK_NETFILTER");
+            break;
+        case NETLINK_KOBJECT_UEVENT:
+            gemu_log("NETLINK_KOBJECT_UEVENT");
+            break;
+        case NETLINK_RDMA:
+            gemu_log("NETLINK_RDMA");
+            break;
+        case NETLINK_CRYPTO:
+            gemu_log("NETLINK_CRYPTO");
+            break;
+        default:
+            gemu_log("%d", protocol);
+            break;
+        }
+        return;
+    }
+
     switch (protocol) {
     case IPPROTO_IP:
         gemu_log("IPPROTO_IP");
@@ -1243,8 +1281,10 @@ print_timeval(abi_ulong tv_addr, int last)
         struct target_timeval *tv;
 
         tv = lock_user(VERIFY_READ, tv_addr, sizeof(*tv), 1);
-        if (!tv)
+        if (!tv) {
+            print_pointer(tv_addr, last);
             return;
+        }
         gemu_log("{" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "}%s",
             tswapal(tv->tv_sec), tswapal(tv->tv_usec), get_comma(last));
         unlock_user(tv, tv_addr, 0);
@@ -1252,6 +1292,25 @@ print_timeval(abi_ulong tv_addr, int last)
         gemu_log("NULL%s", get_comma(last));
 }
 
+static void
+print_timezone(abi_ulong tz_addr, int last)
+{
+    if (tz_addr) {
+        struct target_timezone *tz;
+
+        tz = lock_user(VERIFY_READ, tz_addr, sizeof(*tz), 1);
+        if (!tz) {
+            print_pointer(tz_addr, last);
+            return;
+        }
+        gemu_log("{%d,%d}%s", tswap32(tz->tz_minuteswest),
+                 tswap32(tz->tz_dsttime), get_comma(last));
+        unlock_user(tz, tz_addr, 0);
+    } else {
+        gemu_log("NULL%s", get_comma(last));
+    }
+}
+
 #undef UNUSED
 
 #ifdef TARGET_NR_accept
@@ -1561,6 +1620,19 @@ print_futimesat(const struct syscallname *name,
 }
 #endif
 
+#ifdef TARGET_NR_settimeofday
+static void
+print_settimeofday(const struct syscallname *name,
+                abi_long arg0, abi_long arg1, abi_long arg2,
+                abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    print_syscall_prologue(name);
+    print_timeval(arg0, 0);
+    print_timezone(arg1, 1);
+    print_syscall_epilogue(name);
+}
+#endif
+
 #ifdef TARGET_NR_link
 static void
 print_link(const struct syscallname *name,
@@ -1635,6 +1707,15 @@ print_socket(const struct syscallname *name,
 
 #endif
 
+#if defined(TARGET_NR_socketcall) || defined(TARGET_NR_bind)
+
+static void print_sockfd(abi_long sockfd, int last)
+{
+    print_raw_param(TARGET_ABI_FMT_ld, sockfd, last);
+}
+
+#endif
+
 #if defined(TARGET_NR_socketcall)
 
 #define get_user_ualx(x, gaddr, idx) \
@@ -1669,8 +1750,8 @@ static void do_print_sockaddr(const char *name, abi_long arg1)
     get_user_ualx(addrlen, arg1, 2);
 
     gemu_log("%s(", name);
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
-    print_sockaddr(addr, addrlen);
+    print_sockfd(sockfd, 0);
+    print_sockaddr(addr, addrlen, 0);
     gemu_log(")");
 }
 
@@ -1682,7 +1763,7 @@ static void do_print_listen(const char *name, abi_long arg1)
     get_user_ualx(backlog, arg1, 1);
 
     gemu_log("%s(", name);
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
+    print_sockfd(sockfd, 0);
     print_raw_param(TARGET_ABI_FMT_ld, backlog, 1);
     gemu_log(")");
 }
@@ -1717,7 +1798,7 @@ static void do_print_sendrecv(const char *name, abi_long arg1)
     get_user_ualx(flags, arg1, 3);
 
     gemu_log("%s(", name);
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
+    print_sockfd(sockfd, 0);
     print_buf(msg, len, 0);
     print_raw_param(TARGET_ABI_FMT_ld, len, 0);
     print_flags(msg_flags, flags, 1);
@@ -1736,11 +1817,11 @@ static void do_print_msgaddr(const char *name, abi_long arg1)
     get_user_ualx(addrlen, arg1, 5);
 
     gemu_log("%s(", name);
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
+    print_sockfd(sockfd, 0);
     print_buf(msg, len, 0);
     print_raw_param(TARGET_ABI_FMT_ld, len, 0);
     print_flags(msg_flags, flags, 0);
-    print_sockaddr(addr, addrlen);
+    print_sockaddr(addr, addrlen, 0);
     gemu_log(")");
 }
 
@@ -1752,7 +1833,7 @@ static void do_print_shutdown(const char *name, abi_long arg1)
     get_user_ualx(how, arg1, 1);
 
     gemu_log("shutdown(");
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
+    print_sockfd(sockfd, 0);
     switch (how) {
     case SHUT_RD:
         gemu_log("SHUT_RD");
@@ -1779,7 +1860,7 @@ static void do_print_msg(const char *name, abi_long arg1)
     get_user_ualx(flags, arg1, 2);
 
     gemu_log("%s(", name);
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
+    print_sockfd(sockfd, 0);
     print_pointer(msg, 0);
     print_flags(msg_flags, flags, 1);
     gemu_log(")");
@@ -1796,7 +1877,7 @@ static void do_print_sockopt(const char *name, abi_long arg1)
     get_user_ualx(optlen, arg1, 4);
 
     gemu_log("%s(", name);
-    print_raw_param(TARGET_ABI_FMT_ld, sockfd, 0);
+    print_sockfd(sockfd, 0);
     switch (level) {
     case SOL_TCP:
         gemu_log("SOL_TCP,");
@@ -1973,6 +2054,19 @@ print_socketcall(const struct syscallname *name,
 }
 #endif
 
+#if defined(TARGET_NR_bind)
+static void
+print_bind(const struct syscallname *name,
+           abi_long arg0, abi_long arg1, abi_long arg2,
+           abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    print_syscall_prologue(name);
+    print_sockfd(arg0, 0);
+    print_sockaddr(arg1, arg2, 1);
+    print_syscall_epilogue(name);
+}
+#endif
+
 #if defined(TARGET_NR_stat) || defined(TARGET_NR_stat64) || \
     defined(TARGET_NR_lstat) || defined(TARGET_NR_lstat64)
 static void
diff --git a/linux-user/strace.list b/linux-user/strace.list
index 63a946642d..1de4319dcf 100644
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -41,7 +41,7 @@
 { TARGET_NR_bdflush, "bdflush" , NULL, NULL, NULL },
 #endif
 #ifdef TARGET_NR_bind
-{ TARGET_NR_bind, "bind" , NULL, NULL, NULL },
+{ TARGET_NR_bind, "bind" , NULL, print_bind, NULL },
 #endif
 #ifdef TARGET_NR_bpf
 { TARGET_NR_bpf, "bpf" , NULL, NULL, NULL },
@@ -121,6 +121,9 @@
 #ifdef TARGET_NR_dup2
 { TARGET_NR_dup2, "dup2" , NULL, NULL, NULL },
 #endif
+#ifdef TARGET_NR_dup3
+{ TARGET_NR_dup3, "dup3" , NULL, NULL, NULL },
+#endif
 #ifdef TARGET_NR_epoll_create
 { TARGET_NR_epoll_create, "epoll_create" , NULL, NULL, NULL },
 #endif
@@ -1345,7 +1348,7 @@
 { TARGET_NR_set_tid_address, "set_tid_address" , NULL, NULL, NULL },
 #endif
 #ifdef TARGET_NR_settimeofday
-{ TARGET_NR_settimeofday, "settimeofday" , NULL, NULL, NULL },
+{ TARGET_NR_settimeofday, "settimeofday" , NULL, print_settimeofday, NULL },
 #endif
 #ifdef TARGET_NR_setuid
 { TARGET_NR_setuid, "setuid" , NULL, NULL, NULL },
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e2af3c1494..530c843303 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -1496,8 +1496,10 @@ static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
         sizeof(target_saddr->sa_family)) {
         target_saddr->sa_family = tswap16(addr->sa_family);
     }
-    if (addr->sa_family == AF_NETLINK && len >= sizeof(struct sockaddr_nl)) {
-        struct sockaddr_nl *target_nl = (struct sockaddr_nl *)target_saddr;
+    if (addr->sa_family == AF_NETLINK &&
+        len >= sizeof(struct target_sockaddr_nl)) {
+        struct target_sockaddr_nl *target_nl =
+               (struct target_sockaddr_nl *)target_saddr;
         target_nl->nl_pid = tswap32(target_nl->nl_pid);
         target_nl->nl_groups = tswap32(target_nl->nl_groups);
     } else if (addr->sa_family == AF_PACKET) {
@@ -9982,6 +9984,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
                     aarch64_sve_narrow_vq(env, vq);
                 }
                 env->vfp.zcr_el[1] = vq - 1;
+                arm_rebuild_hflags(env);
                 ret = vq * 16;
             }
             return ret;
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index fa69c6ab8d..98c2119de9 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -134,44 +134,51 @@
 #define TARGET_IOWRU(type,nr)	TARGET_IOC(TARGET_IOC_READ|TARGET_IOC_WRITE,(type),(nr),TARGET_IOC_SIZEMASK)
 
 struct target_sockaddr {
-    uint16_t sa_family;
+    abi_ushort sa_family;
     uint8_t sa_data[14];
 };
 
 struct target_sockaddr_ll {
-    uint16_t sll_family;   /* Always AF_PACKET */
-    uint16_t sll_protocol; /* Physical layer protocol */
-    int      sll_ifindex;  /* Interface number */
-    uint16_t sll_hatype;   /* ARP hardware type */
-    uint8_t  sll_pkttype;  /* Packet type */
-    uint8_t  sll_halen;    /* Length of address */
-    uint8_t  sll_addr[8];  /* Physical layer address */
+    abi_ushort sll_family;   /* Always AF_PACKET */
+    abi_ushort sll_protocol; /* Physical layer protocol */
+    abi_int    sll_ifindex;  /* Interface number */
+    abi_ushort sll_hatype;   /* ARP hardware type */
+    uint8_t    sll_pkttype;  /* Packet type */
+    uint8_t    sll_halen;    /* Length of address */
+    uint8_t    sll_addr[8];  /* Physical layer address */
 };
 
 struct target_sockaddr_un {
-    uint16_t su_family;
+    abi_ushort su_family;
     uint8_t sun_path[108];
 };
 
+struct target_sockaddr_nl {
+    abi_ushort nl_family;   /* AF_NETLINK */
+    abi_ushort __pad;
+    abi_uint nl_pid;
+    abi_uint nl_groups;
+};
+
 struct target_in_addr {
-    uint32_t s_addr; /* big endian */
+    abi_uint s_addr; /* big endian */
 };
 
 struct target_sockaddr_in {
-  uint16_t sin_family;
-  int16_t sin_port; /* big endian */
+  abi_ushort sin_family;
+  abi_short sin_port; /* big endian */
   struct target_in_addr sin_addr;
   uint8_t __pad[sizeof(struct target_sockaddr) -
-                sizeof(uint16_t) - sizeof(int16_t) -
+                sizeof(abi_ushort) - sizeof(abi_short) -
                 sizeof(struct target_in_addr)];
 };
 
 struct target_sockaddr_in6 {
-    uint16_t sin6_family;
-    uint16_t sin6_port; /* big endian */
-    uint32_t sin6_flowinfo; /* big endian */
+    abi_ushort sin6_family;
+    abi_ushort sin6_port; /* big endian */
+    abi_uint sin6_flowinfo; /* big endian */
     struct in6_addr sin6_addr; /* IPv6 address, big endian */
-    uint32_t sin6_scope_id;
+    abi_uint sin6_scope_id;
 };
 
 struct target_sock_filter {
diff --git a/pc-bios/README b/pc-bios/README
index 0b0b5d42ad..830645c51f 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -17,7 +17,7 @@
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
   https://github.com/aik/SLOF, and the image currently in qemu is
-  built from git tag qemu-slof-20190911.
+  built from git tag qemu-slof-20191022.
 
 - sgabios (the Serial Graphics Adapter option ROM) provides a means for
   legacy x86 software to communicate with an attached serial console as
diff --git a/pc-bios/slof.bin b/pc-bios/slof.bin
index 2af0c5d5fc..0b93fe8c01 100644
--- a/pc-bios/slof.bin
+++ b/pc-bios/slof.bin
Binary files differdiff --git a/qapi/block-core.json b/qapi/block-core.json
index b274aef713..aa97ee2641 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2883,12 +2883,13 @@
 # @nvme: Since 2.12
 # @copy-on-read: Since 3.0
 # @blklogwrites: Since 3.0
+# @blkreplay: Since 4.2
 #
 # Since: 2.9
 ##
 { 'enum': 'BlockdevDriver',
-  'data': [ 'blkdebug', 'blklogwrites', 'blkverify', 'bochs', 'cloop',
-            'copy-on-read', 'dmg', 'file', 'ftp', 'ftps', 'gluster',
+  'data': [ 'blkdebug', 'blklogwrites', 'blkreplay', 'blkverify', 'bochs',
+            'cloop', 'copy-on-read', 'dmg', 'file', 'ftp', 'ftps', 'gluster',
             'host_cdrom', 'host_device', 'http', 'https', 'iscsi', 'luks',
             'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels', 'qcow',
             'qcow2', 'qed', 'quorum', 'raw', 'rbd',
@@ -3502,6 +3503,18 @@
             'raw': 'BlockdevRef' } }
 
 ##
+# @BlockdevOptionsBlkreplay:
+#
+# Driver specific block device options for blkreplay.
+#
+# @image:     disk image which should be controlled with blkreplay
+#
+# Since: 4.2
+##
+{ 'struct': 'BlockdevOptionsBlkreplay',
+  'data': { 'image': 'BlockdevRef' } }
+
+##
 # @QuorumReadPattern:
 #
 # An enumeration of quorum read patterns.
@@ -4028,6 +4041,7 @@
       'blkdebug':   'BlockdevOptionsBlkdebug',
       'blklogwrites':'BlockdevOptionsBlklogwrites',
       'blkverify':  'BlockdevOptionsBlkverify',
+      'blkreplay':  'BlockdevOptionsBlkreplay',
       'bochs':      'BlockdevOptionsGenericFormat',
       'cloop':      'BlockdevOptionsGenericFormat',
       'copy-on-read':'BlockdevOptionsGenericFormat',
diff --git a/qapi/introspect.json b/qapi/introspect.json
index 1843c1cb17..031a954fa9 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -266,13 +266,17 @@
 # @allow-oob: whether the command allows out-of-band execution,
 #             defaults to false (Since: 2.12)
 #
+# @features: names of features associated with the command, in no particular
+#            order. (since 4.2)
+#
 # TODO: @success-response (currently irrelevant, because it's QGA, not QMP)
 #
 # Since: 2.5
 ##
 { 'struct': 'SchemaInfoCommand',
   'data': { 'arg-type': 'str', 'ret-type': 'str',
-            '*allow-oob': 'bool' } }
+            '*allow-oob': 'bool',
+            '*features': [ 'str' ] } }
 
 ##
 # @SchemaInfoEvent:
diff --git a/qapi/misc.json b/qapi/misc.json
index 6bd11f50e6..33b94e3589 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -1020,6 +1020,12 @@
 #
 # @cpu-index: The CPU to use for commands that require an implicit CPU
 #
+# Features:
+# @savevm-monitor-nodes: If present, HMP command savevm only snapshots
+#                        monitor-owned nodes if they have no parents.
+#                        This allows the use of 'savevm' with
+#                        -blockdev. (since 4.2)
+#
 # Returns: the output of the command as a string
 #
 # Since: 0.14.0
@@ -1047,7 +1053,8 @@
 ##
 { 'command': 'human-monitor-command',
   'data': {'command-line': 'str', '*cpu-index': 'int'},
-  'returns': 'str' }
+  'returns': 'str',
+  'features': [ 'savevm-monitor-nodes' ] }
 
 ##
 # @change:
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 2ba6c90c08..3c5022050f 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -906,10 +906,6 @@ Use @option{-kernel} to provide the Linux kernel image and
 @option{-append} to give the kernel command line arguments. The
 @option{-initrd} option can be used to provide an INITRD image.
 
-When using the direct Linux boot, a disk image for the first hard disk
-@file{hda} is required because its boot sector is used to launch the
-Linux kernel.
-
 If you do not need graphical output, you can disable it and redirect
 the virtual serial port and the QEMU monitor to the console with the
 @option{-nographic} option. The typical command line is:
diff --git a/qemu-options.hx b/qemu-options.hx
index 996b6fba74..b95bf9fbed 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -327,8 +327,8 @@ format(true color). The resolution should be supported by the SVGA mode, so
 the recommended is 320x240, 640x480, 800x640.
 
 A timeout could be passed to bios, guest will pause for @var{rb_timeout} ms
-when boot failed, then reboot. If @var{rb_timeout} is '-1', guest will not
-reboot, qemu passes '-1' to bios by default. Currently Seabios for X86
+when boot failed, then reboot. If @option{reboot-timeout} is not set,
+guest will not reboot by default. Currently Seabios for X86
 system support it.
 
 Do strict boot via @option{strict=on} as far as firmware/BIOS
@@ -864,7 +864,8 @@ ETEXI
 DEF("blockdev", HAS_ARG, QEMU_OPTION_blockdev,
     "-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]\n"
     "          [,cache.direct=on|off][,cache.no-flush=on|off]\n"
-    "          [,read-only=on|off][,detect-zeroes=on|off|unmap]\n"
+    "          [,read-only=on|off][,auto-read-only=on|off]\n"
+    "          [,force-share=on|off][,detect-zeroes=on|off|unmap]\n"
     "          [,driver specific parameters...]\n"
     "                configure a block backend\n", QEMU_ARCH_ALL)
 STEXI
@@ -900,6 +901,25 @@ name is not intended to be predictable and changes between QEMU invocations.
 For the top level, an explicit node name must be specified.
 @item read-only
 Open the node read-only. Guest write attempts will fail.
+
+Note that some block drivers support only read-only access, either generally or
+in certain configurations. In this case, the default value
+@option{read-only=off} does not work and the option must be specified
+explicitly.
+@item auto-read-only
+If @option{auto-read-only=on} is set, QEMU may fall back to read-only usage
+even when @option{read-only=off} is requested, or even switch between modes as
+needed, e.g. depending on whether the image file is writable or whether a
+writing user is attached to the node.
+@item force-share
+Override the image locking system of QEMU by forcing the node to utilize
+weaker shared access for permissions where it would normally request exclusive
+access.  When there is the potential for multiple instances to have the same
+file open (whether this invocation of QEMU is the first or the second
+instance), both instances must permit shared access for the second instance to
+succeed at opening the file.
+
+Enabling @option{force-share=on} requires @option{read-only=on}.
 @item cache.direct
 The host page cache can be avoided with @option{cache.direct=on}. This will
 attempt to do disk IO directly to the guest's memory. QEMU may still perform an
diff --git a/roms/SLOF b/roms/SLOF
-Subproject bcc3c4e5c21a015f4680894c4ec978a90d4a2d6
+Subproject 899d98836513bb3d6a4f4e48ef7cee887ee5f57
diff --git a/scripts/qapi-gen.py b/scripts/qapi-gen.py
index 3d98ca2e0c..f93f3c7c23 100755
--- a/scripts/qapi-gen.py
+++ b/scripts/qapi-gen.py
@@ -5,16 +5,18 @@
 # See the COPYING file in the top-level directory.
 
 from __future__ import print_function
+
 import argparse
 import re
 import sys
-from qapi.common import QAPIError, QAPISchema
-from qapi.types import gen_types
-from qapi.visit import gen_visit
+
 from qapi.commands import gen_commands
+from qapi.doc import gen_doc
 from qapi.events import gen_events
 from qapi.introspect import gen_introspect
-from qapi.doc import gen_doc
+from qapi.schema import QAPIError, QAPISchema
+from qapi.types import gen_types
+from qapi.visit import gen_visit
 
 
 def main(argv):
diff --git a/scripts/qapi/commands.py b/scripts/qapi/commands.py
index 7e3dd1068a..ab98e504f3 100644
--- a/scripts/qapi/commands.py
+++ b/scripts/qapi/commands.py
@@ -14,6 +14,7 @@ See the COPYING file in the top-level directory.
 """
 
 from qapi.common import *
+from qapi.gen import QAPIGenCCode, QAPISchemaModularCVisitor, ifcontext
 
 
 def gen_command_decl(name, arg_type, boxed, ret_type):
@@ -276,7 +277,8 @@ void %(c_prefix)sqmp_init_marshal(QmpCommandList *cmds);
         genc.add(gen_registry(self._regy.get_content(), self._prefix))
 
     def visit_command(self, name, info, ifcond, arg_type, ret_type, gen,
-                      success_response, boxed, allow_oob, allow_preconfig):
+                      success_response, boxed, allow_oob, allow_preconfig,
+                      features):
         if not gen:
             return
         # FIXME: If T is a user-defined type, the user is responsible
diff --git a/scripts/qapi/common.py b/scripts/qapi/common.py
index d6e00c80ea..e00dcafce7 100644
--- a/scripts/qapi/common.py
+++ b/scripts/qapi/common.py
@@ -11,2053 +11,8 @@
 # This work is licensed under the terms of the GNU GPL, version 2.
 # See the COPYING file in the top-level directory.
 
-from __future__ import print_function
-from contextlib import contextmanager
-import copy
-import errno
-import os
 import re
 import string
-import sys
-from collections import OrderedDict
-
-# Are documentation comments required?
-doc_required = False
-
-# Whitelist of commands allowed to return a non-dictionary
-returns_whitelist = []
-
-# Whitelist of entities allowed to violate case conventions
-name_case_whitelist = []
-
-
-#
-# Parsing the schema into expressions
-#
-
-class QAPISourceInfo(object):
-    def __init__(self, fname, line, parent):
-        self.fname = fname
-        self.line = line
-        self.parent = parent
-        self.defn_meta = None
-        self.defn_name = None
-
-    def set_defn(self, meta, name):
-        self.defn_meta = meta
-        self.defn_name = name
-
-    def next_line(self):
-        info = copy.copy(self)
-        info.line += 1
-        return info
-
-    def loc(self):
-        if self.fname is None:
-            return sys.argv[0]
-        ret = self.fname
-        if self.line is not None:
-            ret += ':%d' % self.line
-        return ret
-
-    def in_defn(self):
-        if self.defn_name:
-            return "%s: In %s '%s':\n" % (self.fname,
-                                          self.defn_meta, self.defn_name)
-        return ''
-
-    def include_path(self):
-        ret = ''
-        parent = self.parent
-        while parent:
-            ret = 'In file included from %s:\n' % parent.loc() + ret
-            parent = parent.parent
-        return ret
-
-    def __str__(self):
-        return self.include_path() + self.in_defn() + self.loc()
-
-
-class QAPIError(Exception):
-    def __init__(self, info, col, msg):
-        Exception.__init__(self)
-        self.info = info
-        self.col = col
-        self.msg = msg
-
-    def __str__(self):
-        loc = str(self.info)
-        if self.col is not None:
-            assert self.info.line is not None
-            loc += ':%s' % self.col
-        return loc + ': ' + self.msg
-
-
-class QAPIParseError(QAPIError):
-    def __init__(self, parser, msg):
-        col = 1
-        for ch in parser.src[parser.line_pos:parser.pos]:
-            if ch == '\t':
-                col = (col + 7) % 8 + 1
-            else:
-                col += 1
-        QAPIError.__init__(self, parser.info, col, msg)
-
-
-class QAPISemError(QAPIError):
-    def __init__(self, info, msg):
-        QAPIError.__init__(self, info, None, msg)
-
-
-class QAPIDoc(object):
-    """
-    A documentation comment block, either definition or free-form
-
-    Definition documentation blocks consist of
-
-    * a body section: one line naming the definition, followed by an
-      overview (any number of lines)
-
-    * argument sections: a description of each argument (for commands
-      and events) or member (for structs, unions and alternates)
-
-    * features sections: a description of each feature flag
-
-    * additional (non-argument) sections, possibly tagged
-
-    Free-form documentation blocks consist only of a body section.
-    """
-
-    class Section(object):
-        def __init__(self, name=None):
-            # optional section name (argument/member or section name)
-            self.name = name
-            # the list of lines for this section
-            self.text = ''
-
-        def append(self, line):
-            self.text += line.rstrip() + '\n'
-
-    class ArgSection(Section):
-        def __init__(self, name):
-            QAPIDoc.Section.__init__(self, name)
-            self.member = None
-
-        def connect(self, member):
-            self.member = member
-
-    def __init__(self, parser, info):
-        # self._parser is used to report errors with QAPIParseError.  The
-        # resulting error position depends on the state of the parser.
-        # It happens to be the beginning of the comment.  More or less
-        # servicable, but action at a distance.
-        self._parser = parser
-        self.info = info
-        self.symbol = None
-        self.body = QAPIDoc.Section()
-        # dict mapping parameter name to ArgSection
-        self.args = OrderedDict()
-        self.features = OrderedDict()
-        # a list of Section
-        self.sections = []
-        # the current section
-        self._section = self.body
-        self._append_line = self._append_body_line
-
-    def has_section(self, name):
-        """Return True if we have a section with this name."""
-        for i in self.sections:
-            if i.name == name:
-                return True
-        return False
-
-    def append(self, line):
-        """
-        Parse a comment line and add it to the documentation.
-
-        The way that the line is dealt with depends on which part of
-        the documentation we're parsing right now:
-        * The body section: ._append_line is ._append_body_line
-        * An argument section: ._append_line is ._append_args_line
-        * A features section: ._append_line is ._append_features_line
-        * An additional section: ._append_line is ._append_various_line
-        """
-        line = line[1:]
-        if not line:
-            self._append_freeform(line)
-            return
-
-        if line[0] != ' ':
-            raise QAPIParseError(self._parser, "missing space after #")
-        line = line[1:]
-        self._append_line(line)
-
-    def end_comment(self):
-        self._end_section()
-
-    @staticmethod
-    def _is_section_tag(name):
-        return name in ('Returns:', 'Since:',
-                        # those are often singular or plural
-                        'Note:', 'Notes:',
-                        'Example:', 'Examples:',
-                        'TODO:')
-
-    def _append_body_line(self, line):
-        """
-        Process a line of documentation text in the body section.
-
-        If this a symbol line and it is the section's first line, this
-        is a definition documentation block for that symbol.
-
-        If it's a definition documentation block, another symbol line
-        begins the argument section for the argument named by it, and
-        a section tag begins an additional section.  Start that
-        section and append the line to it.
-
-        Else, append the line to the current section.
-        """
-        name = line.split(' ', 1)[0]
-        # FIXME not nice: things like '#  @foo:' and '# @foo: ' aren't
-        # recognized, and get silently treated as ordinary text
-        if not self.symbol and not self.body.text and line.startswith('@'):
-            if not line.endswith(':'):
-                raise QAPIParseError(self._parser, "line should end with ':'")
-            self.symbol = line[1:-1]
-            # FIXME invalid names other than the empty string aren't flagged
-            if not self.symbol:
-                raise QAPIParseError(self._parser, "invalid name")
-        elif self.symbol:
-            # This is a definition documentation block
-            if name.startswith('@') and name.endswith(':'):
-                self._append_line = self._append_args_line
-                self._append_args_line(line)
-            elif line == 'Features:':
-                self._append_line = self._append_features_line
-            elif self._is_section_tag(name):
-                self._append_line = self._append_various_line
-                self._append_various_line(line)
-            else:
-                self._append_freeform(line.strip())
-        else:
-            # This is a free-form documentation block
-            self._append_freeform(line.strip())
-
-    def _append_args_line(self, line):
-        """
-        Process a line of documentation text in an argument section.
-
-        A symbol line begins the next argument section, a section tag
-        section or a non-indented line after a blank line begins an
-        additional section.  Start that section and append the line to
-        it.
-
-        Else, append the line to the current section.
-
-        """
-        name = line.split(' ', 1)[0]
-
-        if name.startswith('@') and name.endswith(':'):
-            line = line[len(name)+1:]
-            self._start_args_section(name[1:-1])
-        elif self._is_section_tag(name):
-            self._append_line = self._append_various_line
-            self._append_various_line(line)
-            return
-        elif (self._section.text.endswith('\n\n')
-              and line and not line[0].isspace()):
-            if line == 'Features:':
-                self._append_line = self._append_features_line
-            else:
-                self._start_section()
-                self._append_line = self._append_various_line
-                self._append_various_line(line)
-            return
-
-        self._append_freeform(line.strip())
-
-    def _append_features_line(self, line):
-        name = line.split(' ', 1)[0]
-
-        if name.startswith('@') and name.endswith(':'):
-            line = line[len(name)+1:]
-            self._start_features_section(name[1:-1])
-        elif self._is_section_tag(name):
-            self._append_line = self._append_various_line
-            self._append_various_line(line)
-            return
-        elif (self._section.text.endswith('\n\n')
-              and line and not line[0].isspace()):
-            self._start_section()
-            self._append_line = self._append_various_line
-            self._append_various_line(line)
-            return
-
-        self._append_freeform(line.strip())
-
-    def _append_various_line(self, line):
-        """
-        Process a line of documentation text in an additional section.
-
-        A symbol line is an error.
-
-        A section tag begins an additional section.  Start that
-        section and append the line to it.
-
-        Else, append the line to the current section.
-        """
-        name = line.split(' ', 1)[0]
-
-        if name.startswith('@') and name.endswith(':'):
-            raise QAPIParseError(self._parser,
-                                 "'%s' can't follow '%s' section"
-                                 % (name, self.sections[0].name))
-        elif self._is_section_tag(name):
-            line = line[len(name)+1:]
-            self._start_section(name[:-1])
-
-        if (not self._section.name or
-                not self._section.name.startswith('Example')):
-            line = line.strip()
-
-        self._append_freeform(line)
-
-    def _start_symbol_section(self, symbols_dict, name):
-        # FIXME invalid names other than the empty string aren't flagged
-        if not name:
-            raise QAPIParseError(self._parser, "invalid parameter name")
-        if name in symbols_dict:
-            raise QAPIParseError(self._parser,
-                                 "'%s' parameter name duplicated" % name)
-        assert not self.sections
-        self._end_section()
-        self._section = QAPIDoc.ArgSection(name)
-        symbols_dict[name] = self._section
-
-    def _start_args_section(self, name):
-        self._start_symbol_section(self.args, name)
-
-    def _start_features_section(self, name):
-        self._start_symbol_section(self.features, name)
-
-    def _start_section(self, name=None):
-        if name in ('Returns', 'Since') and self.has_section(name):
-            raise QAPIParseError(self._parser,
-                                 "duplicated '%s' section" % name)
-        self._end_section()
-        self._section = QAPIDoc.Section(name)
-        self.sections.append(self._section)
-
-    def _end_section(self):
-        if self._section:
-            text = self._section.text = self._section.text.strip()
-            if self._section.name and (not text or text.isspace()):
-                raise QAPIParseError(
-                    self._parser,
-                    "empty doc section '%s'" % self._section.name)
-            self._section = None
-
-    def _append_freeform(self, line):
-        match = re.match(r'(@\S+:)', line)
-        if match:
-            raise QAPIParseError(self._parser,
-                                 "'%s' not allowed in free-form documentation"
-                                 % match.group(1))
-        self._section.append(line)
-
-    def connect_member(self, member):
-        if member.name not in self.args:
-            # Undocumented TODO outlaw
-            self.args[member.name] = QAPIDoc.ArgSection(member.name)
-        self.args[member.name].connect(member)
-
-    def check_expr(self, expr):
-        if self.has_section('Returns') and 'command' not in expr:
-            raise QAPISemError(self.info,
-                               "'Returns:' is only valid for commands")
-
-    def check(self):
-        bogus = [name for name, section in self.args.items()
-                 if not section.member]
-        if bogus:
-            raise QAPISemError(
-                self.info,
-                "the following documented members are not in "
-                "the declaration: %s" % ", ".join(bogus))
-
-
-class QAPISchemaParser(object):
-
-    def __init__(self, fname, previously_included=[], incl_info=None):
-        previously_included.append(os.path.abspath(fname))
-
-        try:
-            if sys.version_info[0] >= 3:
-                fp = open(fname, 'r', encoding='utf-8')
-            else:
-                fp = open(fname, 'r')
-            self.src = fp.read()
-        except IOError as e:
-            raise QAPISemError(incl_info or QAPISourceInfo(None, None, None),
-                               "can't read %s file '%s': %s"
-                               % ("include" if incl_info else "schema",
-                                  fname,
-                                  e.strerror))
-
-        if self.src == '' or self.src[-1] != '\n':
-            self.src += '\n'
-        self.cursor = 0
-        self.info = QAPISourceInfo(fname, 1, incl_info)
-        self.line_pos = 0
-        self.exprs = []
-        self.docs = []
-        self.accept()
-        cur_doc = None
-
-        while self.tok is not None:
-            info = self.info
-            if self.tok == '#':
-                self.reject_expr_doc(cur_doc)
-                cur_doc = self.get_doc(info)
-                self.docs.append(cur_doc)
-                continue
-
-            expr = self.get_expr(False)
-            if 'include' in expr:
-                self.reject_expr_doc(cur_doc)
-                if len(expr) != 1:
-                    raise QAPISemError(info, "invalid 'include' directive")
-                include = expr['include']
-                if not isinstance(include, str):
-                    raise QAPISemError(info,
-                                       "value of 'include' must be a string")
-                incl_fname = os.path.join(os.path.dirname(fname),
-                                          include)
-                self.exprs.append({'expr': {'include': incl_fname},
-                                   'info': info})
-                exprs_include = self._include(include, info, incl_fname,
-                                              previously_included)
-                if exprs_include:
-                    self.exprs.extend(exprs_include.exprs)
-                    self.docs.extend(exprs_include.docs)
-            elif "pragma" in expr:
-                self.reject_expr_doc(cur_doc)
-                if len(expr) != 1:
-                    raise QAPISemError(info, "invalid 'pragma' directive")
-                pragma = expr['pragma']
-                if not isinstance(pragma, dict):
-                    raise QAPISemError(
-                        info, "value of 'pragma' must be an object")
-                for name, value in pragma.items():
-                    self._pragma(name, value, info)
-            else:
-                expr_elem = {'expr': expr,
-                             'info': info}
-                if cur_doc:
-                    if not cur_doc.symbol:
-                        raise QAPISemError(
-                            cur_doc.info, "definition documentation required")
-                    expr_elem['doc'] = cur_doc
-                self.exprs.append(expr_elem)
-            cur_doc = None
-        self.reject_expr_doc(cur_doc)
-
-    @staticmethod
-    def reject_expr_doc(doc):
-        if doc and doc.symbol:
-            raise QAPISemError(
-                doc.info,
-                "documentation for '%s' is not followed by the definition"
-                % doc.symbol)
-
-    def _include(self, include, info, incl_fname, previously_included):
-        incl_abs_fname = os.path.abspath(incl_fname)
-        # catch inclusion cycle
-        inf = info
-        while inf:
-            if incl_abs_fname == os.path.abspath(inf.fname):
-                raise QAPISemError(info, "inclusion loop for %s" % include)
-            inf = inf.parent
-
-        # skip multiple include of the same file
-        if incl_abs_fname in previously_included:
-            return None
-
-        return QAPISchemaParser(incl_fname, previously_included, info)
-
-    def _pragma(self, name, value, info):
-        global doc_required, returns_whitelist, name_case_whitelist
-        if name == 'doc-required':
-            if not isinstance(value, bool):
-                raise QAPISemError(info,
-                                   "pragma 'doc-required' must be boolean")
-            doc_required = value
-        elif name == 'returns-whitelist':
-            if (not isinstance(value, list)
-                    or any([not isinstance(elt, str) for elt in value])):
-                raise QAPISemError(
-                    info,
-                    "pragma returns-whitelist must be a list of strings")
-            returns_whitelist = value
-        elif name == 'name-case-whitelist':
-            if (not isinstance(value, list)
-                    or any([not isinstance(elt, str) for elt in value])):
-                raise QAPISemError(
-                    info,
-                    "pragma name-case-whitelist must be a list of strings")
-            name_case_whitelist = value
-        else:
-            raise QAPISemError(info, "unknown pragma '%s'" % name)
-
-    def accept(self, skip_comment=True):
-        while True:
-            self.tok = self.src[self.cursor]
-            self.pos = self.cursor
-            self.cursor += 1
-            self.val = None
-
-            if self.tok == '#':
-                if self.src[self.cursor] == '#':
-                    # Start of doc comment
-                    skip_comment = False
-                self.cursor = self.src.find('\n', self.cursor)
-                if not skip_comment:
-                    self.val = self.src[self.pos:self.cursor]
-                    return
-            elif self.tok in '{}:,[]':
-                return
-            elif self.tok == "'":
-                # Note: we accept only printable ASCII
-                string = ''
-                esc = False
-                while True:
-                    ch = self.src[self.cursor]
-                    self.cursor += 1
-                    if ch == '\n':
-                        raise QAPIParseError(self, "missing terminating \"'\"")
-                    if esc:
-                        # Note: we recognize only \\ because we have
-                        # no use for funny characters in strings
-                        if ch != '\\':
-                            raise QAPIParseError(self,
-                                                 "unknown escape \\%s" % ch)
-                        esc = False
-                    elif ch == '\\':
-                        esc = True
-                        continue
-                    elif ch == "'":
-                        self.val = string
-                        return
-                    if ord(ch) < 32 or ord(ch) >= 127:
-                        raise QAPIParseError(
-                            self, "funny character in string")
-                    string += ch
-            elif self.src.startswith('true', self.pos):
-                self.val = True
-                self.cursor += 3
-                return
-            elif self.src.startswith('false', self.pos):
-                self.val = False
-                self.cursor += 4
-                return
-            elif self.tok == '\n':
-                if self.cursor == len(self.src):
-                    self.tok = None
-                    return
-                self.info = self.info.next_line()
-                self.line_pos = self.cursor
-            elif not self.tok.isspace():
-                # Show up to next structural, whitespace or quote
-                # character
-                match = re.match('[^[\\]{}:,\\s\'"]+',
-                                 self.src[self.cursor-1:])
-                raise QAPIParseError(self, "stray '%s'" % match.group(0))
-
-    def get_members(self):
-        expr = OrderedDict()
-        if self.tok == '}':
-            self.accept()
-            return expr
-        if self.tok != "'":
-            raise QAPIParseError(self, "expected string or '}'")
-        while True:
-            key = self.val
-            self.accept()
-            if self.tok != ':':
-                raise QAPIParseError(self, "expected ':'")
-            self.accept()
-            if key in expr:
-                raise QAPIParseError(self, "duplicate key '%s'" % key)
-            expr[key] = self.get_expr(True)
-            if self.tok == '}':
-                self.accept()
-                return expr
-            if self.tok != ',':
-                raise QAPIParseError(self, "expected ',' or '}'")
-            self.accept()
-            if self.tok != "'":
-                raise QAPIParseError(self, "expected string")
-
-    def get_values(self):
-        expr = []
-        if self.tok == ']':
-            self.accept()
-            return expr
-        if self.tok not in "{['tfn":
-            raise QAPIParseError(
-                self, "expected '{', '[', ']', string, boolean or 'null'")
-        while True:
-            expr.append(self.get_expr(True))
-            if self.tok == ']':
-                self.accept()
-                return expr
-            if self.tok != ',':
-                raise QAPIParseError(self, "expected ',' or ']'")
-            self.accept()
-
-    def get_expr(self, nested):
-        if self.tok != '{' and not nested:
-            raise QAPIParseError(self, "expected '{'")
-        if self.tok == '{':
-            self.accept()
-            expr = self.get_members()
-        elif self.tok == '[':
-            self.accept()
-            expr = self.get_values()
-        elif self.tok in "'tfn":
-            expr = self.val
-            self.accept()
-        else:
-            raise QAPIParseError(
-                self, "expected '{', '[', string, boolean or 'null'")
-        return expr
-
-    def get_doc(self, info):
-        if self.val != '##':
-            raise QAPIParseError(
-                self, "junk after '##' at start of documentation comment")
-
-        doc = QAPIDoc(self, info)
-        self.accept(False)
-        while self.tok == '#':
-            if self.val.startswith('##'):
-                # End of doc comment
-                if self.val != '##':
-                    raise QAPIParseError(
-                        self,
-                        "junk after '##' at end of documentation comment")
-                doc.end_comment()
-                self.accept()
-                return doc
-            else:
-                doc.append(self.val)
-            self.accept(False)
-
-        raise QAPIParseError(self, "documentation comment must end with '##'")
-
-
-#
-# Check (context-free) schema expression structure
-#
-
-# Names must be letters, numbers, -, and _.  They must start with letter,
-# except for downstream extensions which must start with __RFQDN_.
-# Dots are only valid in the downstream extension prefix.
-valid_name = re.compile(r'^(__[a-zA-Z0-9.-]+_)?'
-                        '[a-zA-Z][a-zA-Z0-9_-]*$')
-
-
-def check_name_is_str(name, info, source):
-    if not isinstance(name, str):
-        raise QAPISemError(info, "%s requires a string name" % source)
-
-
-def check_name_str(name, info, source,
-                   allow_optional=False, enum_member=False,
-                   permit_upper=False):
-    global valid_name
-    membername = name
-
-    if allow_optional and name.startswith('*'):
-        membername = name[1:]
-    # Enum members can start with a digit, because the generated C
-    # code always prefixes it with the enum name
-    if enum_member and membername[0].isdigit():
-        membername = 'D' + membername
-    # Reserve the entire 'q_' namespace for c_name(), and for 'q_empty'
-    # and 'q_obj_*' implicit type names.
-    if not valid_name.match(membername) or \
-       c_name(membername, False).startswith('q_'):
-        raise QAPISemError(info, "%s has an invalid name" % source)
-    if not permit_upper and name.lower() != name:
-        raise QAPISemError(
-            info, "%s uses uppercase in name" % source)
-    assert not membername.startswith('*')
-
-
-def check_defn_name_str(name, info, meta):
-    check_name_str(name, info, meta, permit_upper=True)
-    if name.endswith('Kind') or name.endswith('List'):
-        raise QAPISemError(
-            info, "%s name should not end in '%s'" % (meta, name[-4:]))
-
-
-def check_if(expr, info, source):
-
-    def check_if_str(ifcond, info):
-        if not isinstance(ifcond, str):
-            raise QAPISemError(
-                info,
-                "'if' condition of %s must be a string or a list of strings"
-                % source)
-        if ifcond.strip() == '':
-            raise QAPISemError(
-                info,
-                "'if' condition '%s' of %s makes no sense"
-                % (ifcond, source))
-
-    ifcond = expr.get('if')
-    if ifcond is None:
-        return
-    if isinstance(ifcond, list):
-        if ifcond == []:
-            raise QAPISemError(
-                info, "'if' condition [] of %s is useless" % source)
-        for elt in ifcond:
-            check_if_str(elt, info)
-    else:
-        check_if_str(ifcond, info)
-
-
-def check_type(value, info, source,
-               allow_array=False, allow_dict=False):
-    if value is None:
-        return
-
-    # Array type
-    if isinstance(value, list):
-        if not allow_array:
-            raise QAPISemError(info, "%s cannot be an array" % source)
-        if len(value) != 1 or not isinstance(value[0], str):
-            raise QAPISemError(info,
-                               "%s: array type must contain single type name" %
-                               source)
-        return
-
-    # Type name
-    if isinstance(value, str):
-        return
-
-    # Anonymous type
-
-    if not allow_dict:
-        raise QAPISemError(info, "%s should be a type name" % source)
-
-    if not isinstance(value, OrderedDict):
-        raise QAPISemError(info,
-                           "%s should be an object or type name" % source)
-
-    permit_upper = allow_dict in name_case_whitelist
-
-    # value is a dictionary, check that each member is okay
-    for (key, arg) in value.items():
-        key_source = "%s member '%s'" % (source, key)
-        check_name_str(key, info, key_source,
-                       allow_optional=True, permit_upper=permit_upper)
-        if c_name(key, False) == 'u' or c_name(key, False).startswith('has_'):
-            raise QAPISemError(info, "%s uses reserved name" % key_source)
-        check_keys(arg, info, key_source, ['type'], ['if'])
-        check_if(arg, info, key_source)
-        normalize_if(arg)
-        check_type(arg['type'], info, key_source, allow_array=True)
-
-
-def check_command(expr, info):
-    args = expr.get('data')
-    rets = expr.get('returns')
-    boxed = expr.get('boxed', False)
-
-    if boxed and args is None:
-        raise QAPISemError(info, "'boxed': true requires 'data'")
-    check_type(args, info, "'data'", allow_dict=not boxed)
-    check_type(rets, info, "'returns'", allow_array=True)
-
-
-def check_event(expr, info):
-    args = expr.get('data')
-    boxed = expr.get('boxed', False)
-
-    if boxed and args is None:
-        raise QAPISemError(info, "'boxed': true requires 'data'")
-    check_type(args, info, "'data'", allow_dict=not boxed)
-
-
-def check_union(expr, info):
-    name = expr['union']
-    base = expr.get('base')
-    discriminator = expr.get('discriminator')
-    members = expr['data']
-
-    if discriminator is None:   # simple union
-        if base is not None:
-            raise QAPISemError(info, "'base' requires 'discriminator'")
-    else:                       # flat union
-        check_type(base, info, "'base'", allow_dict=name)
-        if not base:
-            raise QAPISemError(info, "'discriminator' requires 'base'")
-        check_name_is_str(discriminator, info, "'discriminator'")
-
-    for (key, value) in members.items():
-        source = "'data' member '%s'" % key
-        check_name_str(key, info, source)
-        check_keys(value, info, source, ['type'], ['if'])
-        check_if(value, info, source)
-        normalize_if(value)
-        check_type(value['type'], info, source, allow_array=not base)
-
-
-def check_alternate(expr, info):
-    members = expr['data']
-
-    if len(members) == 0:
-        raise QAPISemError(info, "'data' must not be empty")
-    for (key, value) in members.items():
-        source = "'data' member '%s'" % key
-        check_name_str(key, info, source)
-        check_keys(value, info, source, ['type'], ['if'])
-        check_if(value, info, source)
-        normalize_if(value)
-        check_type(value['type'], info, source)
-
-
-def check_enum(expr, info):
-    name = expr['enum']
-    members = expr['data']
-    prefix = expr.get('prefix')
-
-    if not isinstance(members, list):
-        raise QAPISemError(info, "'data' must be an array")
-    if prefix is not None and not isinstance(prefix, str):
-        raise QAPISemError(info, "'prefix' must be a string")
-
-    permit_upper = name in name_case_whitelist
-
-    for member in members:
-        source = "'data' member"
-        check_keys(member, info, source, ['name'], ['if'])
-        check_name_is_str(member['name'], info, source)
-        source = "%s '%s'" % (source, member['name'])
-        check_name_str(member['name'], info, source,
-                       enum_member=True, permit_upper=permit_upper)
-        check_if(member, info, source)
-        normalize_if(member)
-
-
-def check_struct(expr, info):
-    name = expr['struct']
-    members = expr['data']
-    features = expr.get('features')
-
-    check_type(members, info, "'data'", allow_dict=name)
-    check_type(expr.get('base'), info, "'base'")
-
-    if features:
-        if not isinstance(features, list):
-            raise QAPISemError(info, "'features' must be an array")
-        for f in features:
-            source = "'features' member"
-            assert isinstance(f, dict)
-            check_keys(f, info, source, ['name'], ['if'])
-            check_name_is_str(f['name'], info, source)
-            source = "%s '%s'" % (source, f['name'])
-            check_name_str(f['name'], info, source)
-            check_if(f, info, source)
-            normalize_if(f)
-
-
-def check_keys(value, info, source, required, optional):
-
-    def pprint(elems):
-        return ', '.join("'" + e + "'" for e in sorted(elems))
-
-    missing = set(required) - set(value)
-    if missing:
-        raise QAPISemError(
-            info,
-            "%s misses key%s %s"
-            % (source, 's' if len(missing) > 1 else '',
-               pprint(missing)))
-    allowed = set(required + optional)
-    unknown = set(value) - allowed
-    if unknown:
-        raise QAPISemError(
-            info,
-            "%s has unknown key%s %s\nValid keys are %s."
-            % (source, 's' if len(unknown) > 1 else '',
-               pprint(unknown), pprint(allowed)))
-
-
-def check_flags(expr, info):
-    for key in ['gen', 'success-response']:
-        if key in expr and expr[key] is not False:
-            raise QAPISemError(
-                info, "flag '%s' may only use false value" % key)
-    for key in ['boxed', 'allow-oob', 'allow-preconfig']:
-        if key in expr and expr[key] is not True:
-            raise QAPISemError(
-                info, "flag '%s' may only use true value" % key)
-
-
-def normalize_enum(expr):
-    if isinstance(expr['data'], list):
-        expr['data'] = [m if isinstance(m, dict) else {'name': m}
-                        for m in expr['data']]
-
-
-def normalize_members(members):
-    if isinstance(members, OrderedDict):
-        for key, arg in members.items():
-            if isinstance(arg, dict):
-                continue
-            members[key] = {'type': arg}
-
-
-def normalize_features(features):
-    if isinstance(features, list):
-        features[:] = [f if isinstance(f, dict) else {'name': f}
-                       for f in features]
-
-
-def normalize_if(expr):
-    ifcond = expr.get('if')
-    if isinstance(ifcond, str):
-        expr['if'] = [ifcond]
-
-
-def check_exprs(exprs):
-    for expr_elem in exprs:
-        expr = expr_elem['expr']
-        info = expr_elem['info']
-        doc = expr_elem.get('doc')
-
-        if 'include' in expr:
-            continue
-
-        if 'enum' in expr:
-            meta = 'enum'
-        elif 'union' in expr:
-            meta = 'union'
-        elif 'alternate' in expr:
-            meta = 'alternate'
-        elif 'struct' in expr:
-            meta = 'struct'
-        elif 'command' in expr:
-            meta = 'command'
-        elif 'event' in expr:
-            meta = 'event'
-        else:
-            raise QAPISemError(info, "expression is missing metatype")
-
-        name = expr[meta]
-        check_name_is_str(name, info, "'%s'" % meta)
-        info.set_defn(meta, name)
-        check_defn_name_str(name, info, meta)
-
-        if doc:
-            if doc.symbol != name:
-                raise QAPISemError(
-                    info, "documentation comment is for '%s'" % doc.symbol)
-            doc.check_expr(expr)
-        elif doc_required:
-            raise QAPISemError(info,
-                               "documentation comment required")
-
-        if meta == 'enum':
-            check_keys(expr, info, meta,
-                       ['enum', 'data'], ['if', 'prefix'])
-            normalize_enum(expr)
-            check_enum(expr, info)
-        elif meta == 'union':
-            check_keys(expr, info, meta,
-                       ['union', 'data'],
-                       ['base', 'discriminator', 'if'])
-            normalize_members(expr.get('base'))
-            normalize_members(expr['data'])
-            check_union(expr, info)
-        elif meta == 'alternate':
-            check_keys(expr, info, meta,
-                       ['alternate', 'data'], ['if'])
-            normalize_members(expr['data'])
-            check_alternate(expr, info)
-        elif meta == 'struct':
-            check_keys(expr, info, meta,
-                       ['struct', 'data'], ['base', 'if', 'features'])
-            normalize_members(expr['data'])
-            normalize_features(expr.get('features'))
-            check_struct(expr, info)
-        elif meta == 'command':
-            check_keys(expr, info, meta,
-                       ['command'],
-                       ['data', 'returns', 'boxed', 'if',
-                        'gen', 'success-response', 'allow-oob',
-                        'allow-preconfig'])
-            normalize_members(expr.get('data'))
-            check_command(expr, info)
-        elif meta == 'event':
-            check_keys(expr, info, meta,
-                       ['event'], ['data', 'boxed', 'if'])
-            normalize_members(expr.get('data'))
-            check_event(expr, info)
-        else:
-            assert False, 'unexpected meta type'
-
-        normalize_if(expr)
-        check_if(expr, info, meta)
-        check_flags(expr, info)
-
-    return exprs
-
-
-#
-# Schema compiler frontend
-# TODO catching name collisions in generated code would be nice
-#
-
-class QAPISchemaEntity(object):
-    meta = None
-
-    def __init__(self, name, info, doc, ifcond=None):
-        assert name is None or isinstance(name, str)
-        self.name = name
-        self._module = None
-        # For explicitly defined entities, info points to the (explicit)
-        # definition.  For builtins (and their arrays), info is None.
-        # For implicitly defined entities, info points to a place that
-        # triggered the implicit definition (there may be more than one
-        # such place).
-        self.info = info
-        self.doc = doc
-        self._ifcond = ifcond or []
-        self._checked = False
-
-    def c_name(self):
-        return c_name(self.name)
-
-    def check(self, schema):
-        assert not self._checked
-        if self.info:
-            self._module = os.path.relpath(self.info.fname,
-                                           os.path.dirname(schema.fname))
-        self._checked = True
-
-    @property
-    def ifcond(self):
-        assert self._checked
-        return self._ifcond
-
-    @property
-    def module(self):
-        assert self._checked
-        return self._module
-
-    def is_implicit(self):
-        return not self.info
-
-    def visit(self, visitor):
-        assert self._checked
-
-    def describe(self):
-        assert self.meta
-        return "%s '%s'" % (self.meta, self.name)
-
-
-class QAPISchemaVisitor(object):
-    def visit_begin(self, schema):
-        pass
-
-    def visit_end(self):
-        pass
-
-    def visit_module(self, fname):
-        pass
-
-    def visit_needed(self, entity):
-        # Default to visiting everything
-        return True
-
-    def visit_include(self, fname, info):
-        pass
-
-    def visit_builtin_type(self, name, info, json_type):
-        pass
-
-    def visit_enum_type(self, name, info, ifcond, members, prefix):
-        pass
-
-    def visit_array_type(self, name, info, ifcond, element_type):
-        pass
-
-    def visit_object_type(self, name, info, ifcond, base, members, variants,
-                          features):
-        pass
-
-    def visit_object_type_flat(self, name, info, ifcond, members, variants,
-                               features):
-        pass
-
-    def visit_alternate_type(self, name, info, ifcond, variants):
-        pass
-
-    def visit_command(self, name, info, ifcond, arg_type, ret_type, gen,
-                      success_response, boxed, allow_oob, allow_preconfig):
-        pass
-
-    def visit_event(self, name, info, ifcond, arg_type, boxed):
-        pass
-
-
-class QAPISchemaInclude(QAPISchemaEntity):
-
-    def __init__(self, fname, info):
-        QAPISchemaEntity.__init__(self, None, info, None)
-        self.fname = fname
-
-    def visit(self, visitor):
-        QAPISchemaEntity.visit(self, visitor)
-        visitor.visit_include(self.fname, self.info)
-
-
-class QAPISchemaType(QAPISchemaEntity):
-    # Return the C type for common use.
-    # For the types we commonly box, this is a pointer type.
-    def c_type(self):
-        pass
-
-    # Return the C type to be used in a parameter list.
-    def c_param_type(self):
-        return self.c_type()
-
-    # Return the C type to be used where we suppress boxing.
-    def c_unboxed_type(self):
-        return self.c_type()
-
-    def json_type(self):
-        pass
-
-    def alternate_qtype(self):
-        json2qtype = {
-            'null':    'QTYPE_QNULL',
-            'string':  'QTYPE_QSTRING',
-            'number':  'QTYPE_QNUM',
-            'int':     'QTYPE_QNUM',
-            'boolean': 'QTYPE_QBOOL',
-            'object':  'QTYPE_QDICT'
-        }
-        return json2qtype.get(self.json_type())
-
-    def doc_type(self):
-        if self.is_implicit():
-            return None
-        return self.name
-
-    def describe(self):
-        assert self.meta
-        return "%s type '%s'" % (self.meta, self.name)
-
-
-class QAPISchemaBuiltinType(QAPISchemaType):
-    meta = 'built-in'
-
-    def __init__(self, name, json_type, c_type):
-        QAPISchemaType.__init__(self, name, None, None)
-        assert not c_type or isinstance(c_type, str)
-        assert json_type in ('string', 'number', 'int', 'boolean', 'null',
-                             'value')
-        self._json_type_name = json_type
-        self._c_type_name = c_type
-
-    def c_name(self):
-        return self.name
-
-    def c_type(self):
-        return self._c_type_name
-
-    def c_param_type(self):
-        if self.name == 'str':
-            return 'const ' + self._c_type_name
-        return self._c_type_name
-
-    def json_type(self):
-        return self._json_type_name
-
-    def doc_type(self):
-        return self.json_type()
-
-    def visit(self, visitor):
-        QAPISchemaType.visit(self, visitor)
-        visitor.visit_builtin_type(self.name, self.info, self.json_type())
-
-
-class QAPISchemaEnumType(QAPISchemaType):
-    meta = 'enum'
-
-    def __init__(self, name, info, doc, ifcond, members, prefix):
-        QAPISchemaType.__init__(self, name, info, doc, ifcond)
-        for m in members:
-            assert isinstance(m, QAPISchemaEnumMember)
-            m.set_defined_in(name)
-        assert prefix is None or isinstance(prefix, str)
-        self.members = members
-        self.prefix = prefix
-
-    def check(self, schema):
-        QAPISchemaType.check(self, schema)
-        seen = {}
-        for m in self.members:
-            m.check_clash(self.info, seen)
-            if self.doc:
-                self.doc.connect_member(m)
-
-    def is_implicit(self):
-        # See QAPISchema._make_implicit_enum_type() and ._def_predefineds()
-        return self.name.endswith('Kind') or self.name == 'QType'
-
-    def c_type(self):
-        return c_name(self.name)
-
-    def member_names(self):
-        return [m.name for m in self.members]
-
-    def json_type(self):
-        return 'string'
-
-    def visit(self, visitor):
-        QAPISchemaType.visit(self, visitor)
-        visitor.visit_enum_type(self.name, self.info, self.ifcond,
-                                self.members, self.prefix)
-
-
-class QAPISchemaArrayType(QAPISchemaType):
-    meta = 'array'
-
-    def __init__(self, name, info, element_type):
-        QAPISchemaType.__init__(self, name, info, None, None)
-        assert isinstance(element_type, str)
-        self._element_type_name = element_type
-        self.element_type = None
-
-    def check(self, schema):
-        QAPISchemaType.check(self, schema)
-        self.element_type = schema.resolve_type(
-            self._element_type_name, self.info,
-            self.info and self.info.defn_meta)
-        assert not isinstance(self.element_type, QAPISchemaArrayType)
-
-    @property
-    def ifcond(self):
-        assert self._checked
-        return self.element_type.ifcond
-
-    @property
-    def module(self):
-        assert self._checked
-        return self.element_type.module
-
-    def is_implicit(self):
-        return True
-
-    def c_type(self):
-        return c_name(self.name) + pointer_suffix
-
-    def json_type(self):
-        return 'array'
-
-    def doc_type(self):
-        elt_doc_type = self.element_type.doc_type()
-        if not elt_doc_type:
-            return None
-        return 'array of ' + elt_doc_type
-
-    def visit(self, visitor):
-        QAPISchemaType.visit(self, visitor)
-        visitor.visit_array_type(self.name, self.info, self.ifcond,
-                                 self.element_type)
-
-    def describe(self):
-        assert self.meta
-        return "%s type ['%s']" % (self.meta, self._element_type_name)
-
-
-class QAPISchemaObjectType(QAPISchemaType):
-    def __init__(self, name, info, doc, ifcond,
-                 base, local_members, variants, features):
-        # struct has local_members, optional base, and no variants
-        # flat union has base, variants, and no local_members
-        # simple union has local_members, variants, and no base
-        QAPISchemaType.__init__(self, name, info, doc, ifcond)
-        self.meta = 'union' if variants else 'struct'
-        assert base is None or isinstance(base, str)
-        for m in local_members:
-            assert isinstance(m, QAPISchemaObjectTypeMember)
-            m.set_defined_in(name)
-        if variants is not None:
-            assert isinstance(variants, QAPISchemaObjectTypeVariants)
-            variants.set_defined_in(name)
-        for f in features:
-            assert isinstance(f, QAPISchemaFeature)
-            f.set_defined_in(name)
-        self._base_name = base
-        self.base = None
-        self.local_members = local_members
-        self.variants = variants
-        self.members = None
-        self.features = features
-
-    def check(self, schema):
-        # This calls another type T's .check() exactly when the C
-        # struct emitted by gen_object() contains that T's C struct
-        # (pointers don't count).
-        if self.members is not None:
-            # A previous .check() completed: nothing to do
-            return
-        if self._checked:
-            # Recursed: C struct contains itself
-            raise QAPISemError(self.info,
-                               "object %s contains itself" % self.name)
-
-        QAPISchemaType.check(self, schema)
-        assert self._checked and self.members is None
-
-        seen = OrderedDict()
-        if self._base_name:
-            self.base = schema.resolve_type(self._base_name, self.info,
-                                            "'base'")
-            if (not isinstance(self.base, QAPISchemaObjectType)
-                    or self.base.variants):
-                raise QAPISemError(
-                    self.info,
-                    "'base' requires a struct type, %s isn't"
-                    % self.base.describe())
-            self.base.check(schema)
-            self.base.check_clash(self.info, seen)
-        for m in self.local_members:
-            m.check(schema)
-            m.check_clash(self.info, seen)
-            if self.doc:
-                self.doc.connect_member(m)
-        members = seen.values()
-
-        if self.variants:
-            self.variants.check(schema, seen)
-            self.variants.check_clash(self.info, seen)
-
-        # Features are in a name space separate from members
-        seen = {}
-        for f in self.features:
-            f.check_clash(self.info, seen)
-
-        if self.doc:
-            self.doc.check()
-
-        self.members = members  # mark completed
-
-    # Check that the members of this type do not cause duplicate JSON members,
-    # and update seen to track the members seen so far. Report any errors
-    # on behalf of info, which is not necessarily self.info
-    def check_clash(self, info, seen):
-        assert self._checked
-        assert not self.variants       # not implemented
-        for m in self.members:
-            m.check_clash(info, seen)
-
-    @property
-    def ifcond(self):
-        assert self._checked
-        if isinstance(self._ifcond, QAPISchemaType):
-            # Simple union wrapper type inherits from wrapped type;
-            # see _make_implicit_object_type()
-            return self._ifcond.ifcond
-        return self._ifcond
-
-    def is_implicit(self):
-        # See QAPISchema._make_implicit_object_type(), as well as
-        # _def_predefineds()
-        return self.name.startswith('q_')
-
-    def is_empty(self):
-        assert self.members is not None
-        return not self.members and not self.variants
-
-    def c_name(self):
-        assert self.name != 'q_empty'
-        return QAPISchemaType.c_name(self)
-
-    def c_type(self):
-        assert not self.is_implicit()
-        return c_name(self.name) + pointer_suffix
-
-    def c_unboxed_type(self):
-        return c_name(self.name)
-
-    def json_type(self):
-        return 'object'
-
-    def visit(self, visitor):
-        QAPISchemaType.visit(self, visitor)
-        visitor.visit_object_type(self.name, self.info, self.ifcond,
-                                  self.base, self.local_members, self.variants,
-                                  self.features)
-        visitor.visit_object_type_flat(self.name, self.info, self.ifcond,
-                                       self.members, self.variants,
-                                       self.features)
-
-
-class QAPISchemaMember(object):
-    """ Represents object members, enum members and features """
-    role = 'member'
-
-    def __init__(self, name, info, ifcond=None):
-        assert isinstance(name, str)
-        self.name = name
-        self.info = info
-        self.ifcond = ifcond or []
-        self.defined_in = None
-
-    def set_defined_in(self, name):
-        assert not self.defined_in
-        self.defined_in = name
-
-    def check_clash(self, info, seen):
-        cname = c_name(self.name)
-        if cname in seen:
-            raise QAPISemError(
-                info,
-                "%s collides with %s"
-                % (self.describe(info), seen[cname].describe(info)))
-        seen[cname] = self
-
-    def describe(self, info):
-        role = self.role
-        defined_in = self.defined_in
-        assert defined_in
-
-        if defined_in.startswith('q_obj_'):
-            # See QAPISchema._make_implicit_object_type() - reverse the
-            # mapping there to create a nice human-readable description
-            defined_in = defined_in[6:]
-            if defined_in.endswith('-arg'):
-                # Implicit type created for a command's dict 'data'
-                assert role == 'member'
-                role = 'parameter'
-            elif defined_in.endswith('-base'):
-                # Implicit type created for a flat union's dict 'base'
-                role = 'base ' + role
-            else:
-                # Implicit type created for a simple union's branch
-                assert defined_in.endswith('-wrapper')
-                # Unreachable and not implemented
-                assert False
-        elif defined_in.endswith('Kind'):
-            # See QAPISchema._make_implicit_enum_type()
-            # Implicit enum created for simple union's branches
-            assert role == 'value'
-            role = 'branch'
-        elif defined_in != info.defn_name:
-            return "%s '%s' of type '%s'" % (role, self.name, defined_in)
-        return "%s '%s'" % (role, self.name)
-
-
-class QAPISchemaEnumMember(QAPISchemaMember):
-    role = 'value'
-
-
-class QAPISchemaFeature(QAPISchemaMember):
-    role = 'feature'
-
-
-class QAPISchemaObjectTypeMember(QAPISchemaMember):
-    def __init__(self, name, info, typ, optional, ifcond=None):
-        QAPISchemaMember.__init__(self, name, info, ifcond)
-        assert isinstance(typ, str)
-        assert isinstance(optional, bool)
-        self._type_name = typ
-        self.type = None
-        self.optional = optional
-
-    def check(self, schema):
-        assert self.defined_in
-        self.type = schema.resolve_type(self._type_name, self.info,
-                                        self.describe)
-
-
-class QAPISchemaObjectTypeVariants(object):
-    def __init__(self, tag_name, info, tag_member, variants):
-        # Flat unions pass tag_name but not tag_member.
-        # Simple unions and alternates pass tag_member but not tag_name.
-        # After check(), tag_member is always set, and tag_name remains
-        # a reliable witness of being used by a flat union.
-        assert bool(tag_member) != bool(tag_name)
-        assert (isinstance(tag_name, str) or
-                isinstance(tag_member, QAPISchemaObjectTypeMember))
-        for v in variants:
-            assert isinstance(v, QAPISchemaObjectTypeVariant)
-        self._tag_name = tag_name
-        self.info = info
-        self.tag_member = tag_member
-        self.variants = variants
-
-    def set_defined_in(self, name):
-        for v in self.variants:
-            v.set_defined_in(name)
-
-    def check(self, schema, seen):
-        if not self.tag_member: # flat union
-            self.tag_member = seen.get(c_name(self._tag_name))
-            base = "'base'"
-            # Pointing to the base type when not implicit would be
-            # nice, but we don't know it here
-            if not self.tag_member or self._tag_name != self.tag_member.name:
-                raise QAPISemError(
-                    self.info,
-                    "discriminator '%s' is not a member of %s"
-                    % (self._tag_name, base))
-            # Here we do:
-            base_type = schema.lookup_type(self.tag_member.defined_in)
-            assert base_type
-            if not base_type.is_implicit():
-                base = "base type '%s'" % self.tag_member.defined_in
-            if not isinstance(self.tag_member.type, QAPISchemaEnumType):
-                raise QAPISemError(
-                    self.info,
-                    "discriminator member '%s' of %s must be of enum type"
-                    % (self._tag_name, base))
-            if self.tag_member.optional:
-                raise QAPISemError(
-                    self.info,
-                    "discriminator member '%s' of %s must not be optional"
-                    % (self._tag_name, base))
-            if self.tag_member.ifcond:
-                raise QAPISemError(
-                    self.info,
-                    "discriminator member '%s' of %s must not be conditional"
-                    % (self._tag_name, base))
-        else:                   # simple union
-            assert isinstance(self.tag_member.type, QAPISchemaEnumType)
-            assert not self.tag_member.optional
-            assert self.tag_member.ifcond == []
-        if self._tag_name:    # flat union
-            # branches that are not explicitly covered get an empty type
-            cases = set([v.name for v in self.variants])
-            for m in self.tag_member.type.members:
-                if m.name not in cases:
-                    v = QAPISchemaObjectTypeVariant(m.name, self.info,
-                                                    'q_empty', m.ifcond)
-                    v.set_defined_in(self.tag_member.defined_in)
-                    self.variants.append(v)
-        if not self.variants:
-            raise QAPISemError(self.info, "union has no branches")
-        for v in self.variants:
-            v.check(schema)
-            # Union names must match enum values; alternate names are
-            # checked separately. Use 'seen' to tell the two apart.
-            if seen:
-                if v.name not in self.tag_member.type.member_names():
-                    raise QAPISemError(
-                        self.info,
-                        "branch '%s' is not a value of %s"
-                        % (v.name, self.tag_member.type.describe()))
-                if (not isinstance(v.type, QAPISchemaObjectType)
-                        or v.type.variants):
-                    raise QAPISemError(
-                        self.info,
-                        "%s cannot use %s"
-                        % (v.describe(self.info), v.type.describe()))
-                v.type.check(schema)
-
-    def check_clash(self, info, seen):
-        for v in self.variants:
-            # Reset seen map for each variant, since qapi names from one
-            # branch do not affect another branch
-            v.type.check_clash(info, dict(seen))
-
-
-class QAPISchemaObjectTypeVariant(QAPISchemaObjectTypeMember):
-    role = 'branch'
-
-    def __init__(self, name, info, typ, ifcond=None):
-        QAPISchemaObjectTypeMember.__init__(self, name, info, typ,
-                                            False, ifcond)
-
-
-class QAPISchemaAlternateType(QAPISchemaType):
-    meta = 'alternate'
-
-    def __init__(self, name, info, doc, ifcond, variants):
-        QAPISchemaType.__init__(self, name, info, doc, ifcond)
-        assert isinstance(variants, QAPISchemaObjectTypeVariants)
-        assert variants.tag_member
-        variants.set_defined_in(name)
-        variants.tag_member.set_defined_in(self.name)
-        self.variants = variants
-
-    def check(self, schema):
-        QAPISchemaType.check(self, schema)
-        self.variants.tag_member.check(schema)
-        # Not calling self.variants.check_clash(), because there's nothing
-        # to clash with
-        self.variants.check(schema, {})
-        # Alternate branch names have no relation to the tag enum values;
-        # so we have to check for potential name collisions ourselves.
-        seen = {}
-        types_seen = {}
-        for v in self.variants.variants:
-            v.check_clash(self.info, seen)
-            qtype = v.type.alternate_qtype()
-            if not qtype:
-                raise QAPISemError(
-                    self.info,
-                    "%s cannot use %s"
-                    % (v.describe(self.info), v.type.describe()))
-            conflicting = set([qtype])
-            if qtype == 'QTYPE_QSTRING':
-                if isinstance(v.type, QAPISchemaEnumType):
-                    for m in v.type.members:
-                        if m.name in ['on', 'off']:
-                            conflicting.add('QTYPE_QBOOL')
-                        if re.match(r'[-+0-9.]', m.name):
-                            # lazy, could be tightened
-                            conflicting.add('QTYPE_QNUM')
-                else:
-                    conflicting.add('QTYPE_QNUM')
-                    conflicting.add('QTYPE_QBOOL')
-            for qt in conflicting:
-                if qt in types_seen:
-                    raise QAPISemError(
-                        self.info,
-                        "%s can't be distinguished from '%s'"
-                        % (v.describe(self.info), types_seen[qt]))
-                types_seen[qt] = v.name
-            if self.doc:
-                self.doc.connect_member(v)
-        if self.doc:
-            self.doc.check()
-
-    def c_type(self):
-        return c_name(self.name) + pointer_suffix
-
-    def json_type(self):
-        return 'value'
-
-    def visit(self, visitor):
-        QAPISchemaType.visit(self, visitor)
-        visitor.visit_alternate_type(self.name, self.info, self.ifcond,
-                                     self.variants)
-
-
-class QAPISchemaCommand(QAPISchemaEntity):
-    meta = 'command'
-
-    def __init__(self, name, info, doc, ifcond, arg_type, ret_type,
-                 gen, success_response, boxed, allow_oob, allow_preconfig):
-        QAPISchemaEntity.__init__(self, name, info, doc, ifcond)
-        assert not arg_type or isinstance(arg_type, str)
-        assert not ret_type or isinstance(ret_type, str)
-        self._arg_type_name = arg_type
-        self.arg_type = None
-        self._ret_type_name = ret_type
-        self.ret_type = None
-        self.gen = gen
-        self.success_response = success_response
-        self.boxed = boxed
-        self.allow_oob = allow_oob
-        self.allow_preconfig = allow_preconfig
-
-    def check(self, schema):
-        QAPISchemaEntity.check(self, schema)
-        if self._arg_type_name:
-            self.arg_type = schema.resolve_type(
-                self._arg_type_name, self.info, "command's 'data'")
-            if not isinstance(self.arg_type, QAPISchemaObjectType):
-                raise QAPISemError(
-                    self.info,
-                    "command's 'data' cannot take %s"
-                    % self.arg_type.describe())
-            if self.arg_type.variants and not self.boxed:
-                raise QAPISemError(
-                    self.info,
-                    "command's 'data' can take %s only with 'boxed': true"
-                    % self.arg_type.describe())
-        if self._ret_type_name:
-            self.ret_type = schema.resolve_type(
-                self._ret_type_name, self.info, "command's 'returns'")
-            if self.name not in returns_whitelist:
-                if not (isinstance(self.ret_type, QAPISchemaObjectType)
-                        or (isinstance(self.ret_type, QAPISchemaArrayType)
-                            and isinstance(self.ret_type.element_type,
-                                           QAPISchemaObjectType))):
-                    raise QAPISemError(
-                        self.info,
-                        "command's 'returns' cannot take %s"
-                        % self.ret_type.describe())
-
-    def visit(self, visitor):
-        QAPISchemaEntity.visit(self, visitor)
-        visitor.visit_command(self.name, self.info, self.ifcond,
-                              self.arg_type, self.ret_type,
-                              self.gen, self.success_response,
-                              self.boxed, self.allow_oob,
-                              self.allow_preconfig)
-
-
-class QAPISchemaEvent(QAPISchemaEntity):
-    meta = 'event'
-
-    def __init__(self, name, info, doc, ifcond, arg_type, boxed):
-        QAPISchemaEntity.__init__(self, name, info, doc, ifcond)
-        assert not arg_type or isinstance(arg_type, str)
-        self._arg_type_name = arg_type
-        self.arg_type = None
-        self.boxed = boxed
-
-    def check(self, schema):
-        QAPISchemaEntity.check(self, schema)
-        if self._arg_type_name:
-            self.arg_type = schema.resolve_type(
-                self._arg_type_name, self.info, "event's 'data'")
-            if not isinstance(self.arg_type, QAPISchemaObjectType):
-                raise QAPISemError(
-                    self.info,
-                    "event's 'data' cannot take %s"
-                    % self.arg_type.describe())
-            if self.arg_type.variants and not self.boxed:
-                raise QAPISemError(
-                    self.info,
-                    "event's 'data' can take %s only with 'boxed': true"
-                    % self.arg_type.describe())
-
-    def visit(self, visitor):
-        QAPISchemaEntity.visit(self, visitor)
-        visitor.visit_event(self.name, self.info, self.ifcond,
-                            self.arg_type, self.boxed)
-
-
-class QAPISchema(object):
-    def __init__(self, fname):
-        self.fname = fname
-        parser = QAPISchemaParser(fname)
-        exprs = check_exprs(parser.exprs)
-        self.docs = parser.docs
-        self._entity_list = []
-        self._entity_dict = {}
-        self._predefining = True
-        self._def_predefineds()
-        self._predefining = False
-        self._def_exprs(exprs)
-        self.check()
-
-    def _def_entity(self, ent):
-        # Only the predefined types are allowed to not have info
-        assert ent.info or self._predefining
-        self._entity_list.append(ent)
-        if ent.name is None:
-            return
-        # TODO reject names that differ only in '_' vs. '.'  vs. '-',
-        # because they're liable to clash in generated C.
-        other_ent = self._entity_dict.get(ent.name)
-        if other_ent:
-            if other_ent.info:
-                where = QAPIError(other_ent.info, None, "previous definition")
-                raise QAPISemError(
-                    ent.info,
-                    "'%s' is already defined\n%s" % (ent.name, where))
-            raise QAPISemError(
-                ent.info, "%s is already defined" % other_ent.describe())
-        self._entity_dict[ent.name] = ent
-
-    def lookup_entity(self, name, typ=None):
-        ent = self._entity_dict.get(name)
-        if typ and not isinstance(ent, typ):
-            return None
-        return ent
-
-    def lookup_type(self, name):
-        return self.lookup_entity(name, QAPISchemaType)
-
-    def resolve_type(self, name, info, what):
-        typ = self.lookup_type(name)
-        if not typ:
-            if callable(what):
-                what = what(info)
-            raise QAPISemError(
-                info, "%s uses unknown type '%s'" % (what, name))
-        return typ
-
-    def _def_include(self, expr, info, doc):
-        include = expr['include']
-        assert doc is None
-        main_info = info
-        while main_info.parent:
-            main_info = main_info.parent
-        fname = os.path.relpath(include, os.path.dirname(main_info.fname))
-        self._def_entity(QAPISchemaInclude(fname, info))
-
-    def _def_builtin_type(self, name, json_type, c_type):
-        self._def_entity(QAPISchemaBuiltinType(name, json_type, c_type))
-        # Instantiating only the arrays that are actually used would
-        # be nice, but we can't as long as their generated code
-        # (qapi-builtin-types.[ch]) may be shared by some other
-        # schema.
-        self._make_array_type(name, None)
-
-    def _def_predefineds(self):
-        for t in [('str',    'string',  'char' + pointer_suffix),
-                  ('number', 'number',  'double'),
-                  ('int',    'int',     'int64_t'),
-                  ('int8',   'int',     'int8_t'),
-                  ('int16',  'int',     'int16_t'),
-                  ('int32',  'int',     'int32_t'),
-                  ('int64',  'int',     'int64_t'),
-                  ('uint8',  'int',     'uint8_t'),
-                  ('uint16', 'int',     'uint16_t'),
-                  ('uint32', 'int',     'uint32_t'),
-                  ('uint64', 'int',     'uint64_t'),
-                  ('size',   'int',     'uint64_t'),
-                  ('bool',   'boolean', 'bool'),
-                  ('any',    'value',   'QObject' + pointer_suffix),
-                  ('null',   'null',    'QNull' + pointer_suffix)]:
-            self._def_builtin_type(*t)
-        self.the_empty_object_type = QAPISchemaObjectType(
-            'q_empty', None, None, None, None, [], None, [])
-        self._def_entity(self.the_empty_object_type)
-
-        qtypes = ['none', 'qnull', 'qnum', 'qstring', 'qdict', 'qlist',
-                  'qbool']
-        qtype_values = self._make_enum_members(
-            [{'name': n} for n in qtypes], None)
-
-        self._def_entity(QAPISchemaEnumType('QType', None, None, None,
-                                            qtype_values, 'QTYPE'))
-
-    def _make_features(self, features, info):
-        return [QAPISchemaFeature(f['name'], info, f.get('if'))
-                for f in features]
-
-    def _make_enum_members(self, values, info):
-        return [QAPISchemaEnumMember(v['name'], info, v.get('if'))
-                for v in values]
-
-    def _make_implicit_enum_type(self, name, info, ifcond, values):
-        # See also QAPISchemaObjectTypeMember.describe()
-        name = name + 'Kind'    # reserved by check_defn_name_str()
-        self._def_entity(QAPISchemaEnumType(
-            name, info, None, ifcond, self._make_enum_members(values, info),
-            None))
-        return name
-
-    def _make_array_type(self, element_type, info):
-        name = element_type + 'List'    # reserved by check_defn_name_str()
-        if not self.lookup_type(name):
-            self._def_entity(QAPISchemaArrayType(name, info, element_type))
-        return name
-
-    def _make_implicit_object_type(self, name, info, doc, ifcond,
-                                   role, members):
-        if not members:
-            return None
-        # See also QAPISchemaObjectTypeMember.describe()
-        name = 'q_obj_%s-%s' % (name, role)
-        typ = self.lookup_entity(name, QAPISchemaObjectType)
-        if typ:
-            # The implicit object type has multiple users.  This can
-            # happen only for simple unions' implicit wrapper types.
-            # Its ifcond should be the disjunction of its user's
-            # ifconds.  Not implemented.  Instead, we always pass the
-            # wrapped type's ifcond, which is trivially the same for all
-            # users.  It's also necessary for the wrapper to compile.
-            # But it's not tight: the disjunction need not imply it.  We
-            # may end up compiling useless wrapper types.
-            # TODO kill simple unions or implement the disjunction
-            assert (ifcond or []) == typ._ifcond # pylint: disable=protected-access
-        else:
-            self._def_entity(QAPISchemaObjectType(name, info, doc, ifcond,
-                                                  None, members, None, []))
-        return name
-
-    def _def_enum_type(self, expr, info, doc):
-        name = expr['enum']
-        data = expr['data']
-        prefix = expr.get('prefix')
-        ifcond = expr.get('if')
-        self._def_entity(QAPISchemaEnumType(
-            name, info, doc, ifcond,
-            self._make_enum_members(data, info), prefix))
-
-    def _make_member(self, name, typ, ifcond, info):
-        optional = False
-        if name.startswith('*'):
-            name = name[1:]
-            optional = True
-        if isinstance(typ, list):
-            assert len(typ) == 1
-            typ = self._make_array_type(typ[0], info)
-        return QAPISchemaObjectTypeMember(name, info, typ, optional, ifcond)
-
-    def _make_members(self, data, info):
-        return [self._make_member(key, value['type'], value.get('if'), info)
-                for (key, value) in data.items()]
-
-    def _def_struct_type(self, expr, info, doc):
-        name = expr['struct']
-        base = expr.get('base')
-        data = expr['data']
-        ifcond = expr.get('if')
-        features = expr.get('features', [])
-        self._def_entity(QAPISchemaObjectType(
-            name, info, doc, ifcond, base,
-            self._make_members(data, info),
-            None,
-            self._make_features(features, info)))
-
-    def _make_variant(self, case, typ, ifcond, info):
-        return QAPISchemaObjectTypeVariant(case, info, typ, ifcond)
-
-    def _make_simple_variant(self, case, typ, ifcond, info):
-        if isinstance(typ, list):
-            assert len(typ) == 1
-            typ = self._make_array_type(typ[0], info)
-        typ = self._make_implicit_object_type(
-            typ, info, None, self.lookup_type(typ),
-            'wrapper', [self._make_member('data', typ, None, info)])
-        return QAPISchemaObjectTypeVariant(case, info, typ, ifcond)
-
-    def _def_union_type(self, expr, info, doc):
-        name = expr['union']
-        data = expr['data']
-        base = expr.get('base')
-        ifcond = expr.get('if')
-        tag_name = expr.get('discriminator')
-        tag_member = None
-        if isinstance(base, dict):
-            base = self._make_implicit_object_type(
-                name, info, doc, ifcond,
-                'base', self._make_members(base, info))
-        if tag_name:
-            variants = [self._make_variant(key, value['type'],
-                                           value.get('if'), info)
-                        for (key, value) in data.items()]
-            members = []
-        else:
-            variants = [self._make_simple_variant(key, value['type'],
-                                                  value.get('if'), info)
-                        for (key, value) in data.items()]
-            enum = [{'name': v.name, 'if': v.ifcond} for v in variants]
-            typ = self._make_implicit_enum_type(name, info, ifcond, enum)
-            tag_member = QAPISchemaObjectTypeMember('type', info, typ, False)
-            members = [tag_member]
-        self._def_entity(
-            QAPISchemaObjectType(name, info, doc, ifcond, base, members,
-                                 QAPISchemaObjectTypeVariants(
-                                     tag_name, info, tag_member, variants),
-                                 []))
-
-    def _def_alternate_type(self, expr, info, doc):
-        name = expr['alternate']
-        data = expr['data']
-        ifcond = expr.get('if')
-        variants = [self._make_variant(key, value['type'], value.get('if'),
-                                       info)
-                    for (key, value) in data.items()]
-        tag_member = QAPISchemaObjectTypeMember('type', info, 'QType', False)
-        self._def_entity(
-            QAPISchemaAlternateType(name, info, doc, ifcond,
-                                    QAPISchemaObjectTypeVariants(
-                                        None, info, tag_member, variants)))
-
-    def _def_command(self, expr, info, doc):
-        name = expr['command']
-        data = expr.get('data')
-        rets = expr.get('returns')
-        gen = expr.get('gen', True)
-        success_response = expr.get('success-response', True)
-        boxed = expr.get('boxed', False)
-        allow_oob = expr.get('allow-oob', False)
-        allow_preconfig = expr.get('allow-preconfig', False)
-        ifcond = expr.get('if')
-        if isinstance(data, OrderedDict):
-            data = self._make_implicit_object_type(
-                name, info, doc, ifcond, 'arg', self._make_members(data, info))
-        if isinstance(rets, list):
-            assert len(rets) == 1
-            rets = self._make_array_type(rets[0], info)
-        self._def_entity(QAPISchemaCommand(name, info, doc, ifcond, data, rets,
-                                           gen, success_response,
-                                           boxed, allow_oob, allow_preconfig))
-
-    def _def_event(self, expr, info, doc):
-        name = expr['event']
-        data = expr.get('data')
-        boxed = expr.get('boxed', False)
-        ifcond = expr.get('if')
-        if isinstance(data, OrderedDict):
-            data = self._make_implicit_object_type(
-                name, info, doc, ifcond, 'arg', self._make_members(data, info))
-        self._def_entity(QAPISchemaEvent(name, info, doc, ifcond, data, boxed))
-
-    def _def_exprs(self, exprs):
-        for expr_elem in exprs:
-            expr = expr_elem['expr']
-            info = expr_elem['info']
-            doc = expr_elem.get('doc')
-            if 'enum' in expr:
-                self._def_enum_type(expr, info, doc)
-            elif 'struct' in expr:
-                self._def_struct_type(expr, info, doc)
-            elif 'union' in expr:
-                self._def_union_type(expr, info, doc)
-            elif 'alternate' in expr:
-                self._def_alternate_type(expr, info, doc)
-            elif 'command' in expr:
-                self._def_command(expr, info, doc)
-            elif 'event' in expr:
-                self._def_event(expr, info, doc)
-            elif 'include' in expr:
-                self._def_include(expr, info, doc)
-            else:
-                assert False
-
-    def check(self):
-        for ent in self._entity_list:
-            ent.check(self)
-
-    def visit(self, visitor):
-        visitor.visit_begin(self)
-        module = None
-        visitor.visit_module(module)
-        for entity in self._entity_list:
-            if visitor.visit_needed(entity):
-                if entity.module != module:
-                    module = entity.module
-                    visitor.visit_module(module)
-                entity.visit(visitor)
-        visitor.visit_end()
-
-
-#
-# Code generation helpers
-#
-
-def camel_case(name):
-    new_name = ''
-    first = True
-    for ch in name:
-        if ch in ['_', '-']:
-            first = True
-        elif first:
-            new_name += ch.upper()
-            first = False
-        else:
-            new_name += ch.lower()
-    return new_name
 
 
 # ENUMName -> ENUM_NAME, EnumName1 -> ENUM_NAME1
@@ -2220,81 +175,6 @@ def gen_endif(ifcond):
     return ret
 
 
-def _wrap_ifcond(ifcond, before, after):
-    if before == after:
-        return after   # suppress empty #if ... #endif
-
-    assert after.startswith(before)
-    out = before
-    added = after[len(before):]
-    if added[0] == '\n':
-        out += '\n'
-        added = added[1:]
-    out += gen_if(ifcond)
-    out += added
-    out += gen_endif(ifcond)
-    return out
-
-
-def gen_enum_lookup(name, members, prefix=None):
-    ret = mcgen('''
-
-const QEnumLookup %(c_name)s_lookup = {
-    .array = (const char *const[]) {
-''',
-                c_name=c_name(name))
-    for m in members:
-        ret += gen_if(m.ifcond)
-        index = c_enum_const(name, m.name, prefix)
-        ret += mcgen('''
-        [%(index)s] = "%(name)s",
-''',
-                     index=index, name=m.name)
-        ret += gen_endif(m.ifcond)
-
-    ret += mcgen('''
-    },
-    .size = %(max_index)s
-};
-''',
-                 max_index=c_enum_const(name, '_MAX', prefix))
-    return ret
-
-
-def gen_enum(name, members, prefix=None):
-    # append automatically generated _MAX value
-    enum_members = members + [QAPISchemaEnumMember('_MAX', None)]
-
-    ret = mcgen('''
-
-typedef enum %(c_name)s {
-''',
-                c_name=c_name(name))
-
-    for m in enum_members:
-        ret += gen_if(m.ifcond)
-        ret += mcgen('''
-    %(c_enum)s,
-''',
-                     c_enum=c_enum_const(name, m.name, prefix))
-        ret += gen_endif(m.ifcond)
-
-    ret += mcgen('''
-} %(c_name)s;
-''',
-                 c_name=c_name(name))
-
-    ret += mcgen('''
-
-#define %(c_name)s_str(val) \\
-    qapi_enum_lookup(&%(c_name)s_lookup, (val))
-
-extern const QEnumLookup %(c_name)s_lookup;
-''',
-                 c_name=c_name(name))
-    return ret
-
-
 def build_params(arg_type, boxed, extra=None):
     ret = ''
     sep = ''
@@ -2314,260 +194,3 @@ def build_params(arg_type, boxed, extra=None):
     if extra:
         ret += sep + extra
     return ret if ret else 'void'
-
-
-#
-# Accumulate and write output
-#
-
-class QAPIGen(object):
-
-    def __init__(self, fname):
-        self.fname = fname
-        self._preamble = ''
-        self._body = ''
-
-    def preamble_add(self, text):
-        self._preamble += text
-
-    def add(self, text):
-        self._body += text
-
-    def get_content(self):
-        return self._top() + self._preamble + self._body + self._bottom()
-
-    def _top(self):
-        return ''
-
-    def _bottom(self):
-        return ''
-
-    def write(self, output_dir):
-        pathname = os.path.join(output_dir, self.fname)
-        dir = os.path.dirname(pathname)
-        if dir:
-            try:
-                os.makedirs(dir)
-            except os.error as e:
-                if e.errno != errno.EEXIST:
-                    raise
-        fd = os.open(pathname, os.O_RDWR | os.O_CREAT, 0o666)
-        if sys.version_info[0] >= 3:
-            f = open(fd, 'r+', encoding='utf-8')
-        else:
-            f = os.fdopen(fd, 'r+')
-        text = self.get_content()
-        oldtext = f.read(len(text) + 1)
-        if text != oldtext:
-            f.seek(0)
-            f.truncate(0)
-            f.write(text)
-        f.close()
-
-
-@contextmanager
-def ifcontext(ifcond, *args):
-    """A 'with' statement context manager to wrap with start_if()/end_if()
-
-    *args: any number of QAPIGenCCode
-
-    Example::
-
-        with ifcontext(ifcond, self._genh, self._genc):
-            modify self._genh and self._genc ...
-
-    Is equivalent to calling::
-
-        self._genh.start_if(ifcond)
-        self._genc.start_if(ifcond)
-        modify self._genh and self._genc ...
-        self._genh.end_if()
-        self._genc.end_if()
-    """
-    for arg in args:
-        arg.start_if(ifcond)
-    yield
-    for arg in args:
-        arg.end_if()
-
-
-class QAPIGenCCode(QAPIGen):
-
-    def __init__(self, fname):
-        QAPIGen.__init__(self, fname)
-        self._start_if = None
-
-    def start_if(self, ifcond):
-        assert self._start_if is None
-        self._start_if = (ifcond, self._body, self._preamble)
-
-    def end_if(self):
-        assert self._start_if
-        self._wrap_ifcond()
-        self._start_if = None
-
-    def _wrap_ifcond(self):
-        self._body = _wrap_ifcond(self._start_if[0],
-                                  self._start_if[1], self._body)
-        self._preamble = _wrap_ifcond(self._start_if[0],
-                                      self._start_if[2], self._preamble)
-
-    def get_content(self):
-        assert self._start_if is None
-        return QAPIGen.get_content(self)
-
-
-class QAPIGenC(QAPIGenCCode):
-
-    def __init__(self, fname, blurb, pydoc):
-        QAPIGenCCode.__init__(self, fname)
-        self._blurb = blurb
-        self._copyright = '\n * '.join(re.findall(r'^Copyright .*', pydoc,
-                                                  re.MULTILINE))
-
-    def _top(self):
-        return mcgen('''
-/* AUTOMATICALLY GENERATED, DO NOT MODIFY */
-
-/*
-%(blurb)s
- *
- * %(copyright)s
- *
- * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- * See the COPYING.LIB file in the top-level directory.
- */
-
-''',
-                     blurb=self._blurb, copyright=self._copyright)
-
-    def _bottom(self):
-        return mcgen('''
-
-/* Dummy declaration to prevent empty .o file */
-char qapi_dummy_%(name)s;
-''',
-                     name=c_fname(self.fname))
-
-
-class QAPIGenH(QAPIGenC):
-
-    def _top(self):
-        return QAPIGenC._top(self) + guardstart(self.fname)
-
-    def _bottom(self):
-        return guardend(self.fname)
-
-
-class QAPIGenDoc(QAPIGen):
-
-    def _top(self):
-        return (QAPIGen._top(self)
-                + '@c AUTOMATICALLY GENERATED, DO NOT MODIFY\n\n')
-
-
-class QAPISchemaMonolithicCVisitor(QAPISchemaVisitor):
-
-    def __init__(self, prefix, what, blurb, pydoc):
-        self._prefix = prefix
-        self._what = what
-        self._genc = QAPIGenC(self._prefix + self._what + '.c',
-                              blurb, pydoc)
-        self._genh = QAPIGenH(self._prefix + self._what + '.h',
-                              blurb, pydoc)
-
-    def write(self, output_dir):
-        self._genc.write(output_dir)
-        self._genh.write(output_dir)
-
-
-class QAPISchemaModularCVisitor(QAPISchemaVisitor):
-
-    def __init__(self, prefix, what, blurb, pydoc):
-        self._prefix = prefix
-        self._what = what
-        self._blurb = blurb
-        self._pydoc = pydoc
-        self._genc = None
-        self._genh = None
-        self._module = {}
-        self._main_module = None
-
-    @staticmethod
-    def _is_user_module(name):
-        return name and not name.startswith('./')
-
-    @staticmethod
-    def _is_builtin_module(name):
-        return not name
-
-    def _module_dirname(self, what, name):
-        if self._is_user_module(name):
-            return os.path.dirname(name)
-        return ''
-
-    def _module_basename(self, what, name):
-        ret = '' if self._is_builtin_module(name) else self._prefix
-        if self._is_user_module(name):
-            basename = os.path.basename(name)
-            ret += what
-            if name != self._main_module:
-                ret += '-' + os.path.splitext(basename)[0]
-        else:
-            name = name[2:] if name else 'builtin'
-            ret += re.sub(r'-', '-' + name + '-', what)
-        return ret
-
-    def _module_filename(self, what, name):
-        return os.path.join(self._module_dirname(what, name),
-                            self._module_basename(what, name))
-
-    def _add_module(self, name, blurb):
-        basename = self._module_filename(self._what, name)
-        genc = QAPIGenC(basename + '.c', blurb, self._pydoc)
-        genh = QAPIGenH(basename + '.h', blurb, self._pydoc)
-        self._module[name] = (genc, genh)
-        self._set_module(name)
-
-    def _add_user_module(self, name, blurb):
-        assert self._is_user_module(name)
-        if self._main_module is None:
-            self._main_module = name
-        self._add_module(name, blurb)
-
-    def _add_system_module(self, name, blurb):
-        self._add_module(name and './' + name, blurb)
-
-    def _set_module(self, name):
-        self._genc, self._genh = self._module[name]
-
-    def write(self, output_dir, opt_builtins=False):
-        for name in self._module:
-            if self._is_builtin_module(name) and not opt_builtins:
-                continue
-            (genc, genh) = self._module[name]
-            genc.write(output_dir)
-            genh.write(output_dir)
-
-    def _begin_user_module(self, name):
-        pass
-
-    def visit_module(self, name):
-        if name in self._module:
-            self._set_module(name)
-        elif self._is_builtin_module(name):
-            # The built-in module has not been created.  No code may
-            # be generated.
-            self._genc = None
-            self._genh = None
-        else:
-            self._add_user_module(name, self._blurb)
-            self._begin_user_module(name)
-
-    def visit_include(self, name, info):
-        relname = os.path.relpath(self._module_filename(self._what, name),
-                                  os.path.dirname(self._genh.fname))
-        self._genh.preamble_add(mcgen('''
-#include "%(relname)s.h"
-''',
-                                      relname=relname))
diff --git a/scripts/qapi/doc.py b/scripts/qapi/doc.py
index 5fc0fc7e06..6d5726cf6e 100755..100644
--- a/scripts/qapi/doc.py
+++ b/scripts/qapi/doc.py
@@ -1,4 +1,3 @@
-#!/usr/bin/env python
 # QAPI texi generator
 #
 # This work is licensed under the terms of the GNU LGPL, version 2+.
@@ -7,7 +6,8 @@
 
 from __future__ import print_function
 import re
-import qapi.common
+from qapi.gen import QAPIGenDoc, QAPISchemaVisitor
+
 
 MSG_FMT = """
 @deftypefn {type} {{}} {name}
@@ -216,10 +216,10 @@ def texi_entity(doc, what, ifcond, base=None, variants=None,
             + texi_sections(doc, ifcond))
 
 
-class QAPISchemaGenDocVisitor(qapi.common.QAPISchemaVisitor):
+class QAPISchemaGenDocVisitor(QAPISchemaVisitor):
     def __init__(self, prefix):
         self._prefix = prefix
-        self._gen = qapi.common.QAPIGenDoc(self._prefix + 'qapi-doc.texi')
+        self._gen = QAPIGenDoc(self._prefix + 'qapi-doc.texi')
         self.cur_doc = None
 
     def write(self, output_dir):
@@ -249,12 +249,14 @@ class QAPISchemaGenDocVisitor(qapi.common.QAPISchemaVisitor):
                                body=texi_entity(doc, 'Members', ifcond)))
 
     def visit_command(self, name, info, ifcond, arg_type, ret_type, gen,
-                      success_response, boxed, allow_oob, allow_preconfig):
+                      success_response, boxed, allow_oob, allow_preconfig,
+                      features):
         doc = self.cur_doc
         if boxed:
             body = texi_body(doc)
             body += ('\n@b{Arguments:} the members of @code{%s}\n'
                      % arg_type.name)
+            body += texi_features(doc)
             body += texi_sections(doc, ifcond)
         else:
             body = texi_entity(doc, 'Arguments', ifcond)
@@ -283,8 +285,6 @@ class QAPISchemaGenDocVisitor(qapi.common.QAPISchemaVisitor):
 
 
 def gen_doc(schema, output_dir, prefix):
-    if not qapi.common.doc_required:
-        return
     vis = QAPISchemaGenDocVisitor(prefix)
     vis.visit_begin(schema)
     for doc in schema.docs:
diff --git a/scripts/qapi/error.py b/scripts/qapi/error.py
new file mode 100644
index 0000000000..b9f3751bea
--- /dev/null
+++ b/scripts/qapi/error.py
@@ -0,0 +1,43 @@
+# -*- coding: utf-8 -*-
+#
+# QAPI error classes
+#
+# Copyright (c) 2017-2019 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru@redhat.com>
+#  Marc-André Lureau <marcandre.lureau@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2.
+# See the COPYING file in the top-level directory.
+
+
+class QAPIError(Exception):
+    def __init__(self, info, col, msg):
+        Exception.__init__(self)
+        self.info = info
+        self.col = col
+        self.msg = msg
+
+    def __str__(self):
+        loc = str(self.info)
+        if self.col is not None:
+            assert self.info.line is not None
+            loc += ':%s' % self.col
+        return loc + ': ' + self.msg
+
+
+class QAPIParseError(QAPIError):
+    def __init__(self, parser, msg):
+        col = 1
+        for ch in parser.src[parser.line_pos:parser.pos]:
+            if ch == '\t':
+                col = (col + 7) % 8 + 1
+            else:
+                col += 1
+        QAPIError.__init__(self, parser.info, col, msg)
+
+
+class QAPISemError(QAPIError):
+    def __init__(self, info, msg):
+        QAPIError.__init__(self, info, None, msg)
diff --git a/scripts/qapi/events.py b/scripts/qapi/events.py
index 7308e8e589..10fc509fa9 100644
--- a/scripts/qapi/events.py
+++ b/scripts/qapi/events.py
@@ -13,6 +13,9 @@ See the COPYING file in the top-level directory.
 """
 
 from qapi.common import *
+from qapi.gen import QAPISchemaModularCVisitor, ifcontext
+from qapi.schema import QAPISchemaEnumMember
+from qapi.types import gen_enum, gen_enum_lookup
 
 
 def build_event_send_proto(name, arg_type, boxed):
diff --git a/scripts/qapi/expr.py b/scripts/qapi/expr.py
new file mode 100644
index 0000000000..7c7394f835
--- /dev/null
+++ b/scripts/qapi/expr.py
@@ -0,0 +1,383 @@
+# -*- coding: utf-8 -*-
+#
+# Check (context-free) QAPI schema expression structure
+#
+# Copyright IBM, Corp. 2011
+# Copyright (c) 2013-2019 Red Hat Inc.
+#
+# Authors:
+#  Anthony Liguori <aliguori@us.ibm.com>
+#  Markus Armbruster <armbru@redhat.com>
+#  Eric Blake <eblake@redhat.com>
+#  Marc-André Lureau <marcandre.lureau@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2.
+# See the COPYING file in the top-level directory.
+
+import re
+from collections import OrderedDict
+from qapi.common import c_name
+from qapi.error import QAPISemError
+
+
+# Names must be letters, numbers, -, and _.  They must start with letter,
+# except for downstream extensions which must start with __RFQDN_.
+# Dots are only valid in the downstream extension prefix.
+valid_name = re.compile(r'^(__[a-zA-Z0-9.-]+_)?'
+                        '[a-zA-Z][a-zA-Z0-9_-]*$')
+
+
+def check_name_is_str(name, info, source):
+    if not isinstance(name, str):
+        raise QAPISemError(info, "%s requires a string name" % source)
+
+
+def check_name_str(name, info, source,
+                   allow_optional=False, enum_member=False,
+                   permit_upper=False):
+    global valid_name
+    membername = name
+
+    if allow_optional and name.startswith('*'):
+        membername = name[1:]
+    # Enum members can start with a digit, because the generated C
+    # code always prefixes it with the enum name
+    if enum_member and membername[0].isdigit():
+        membername = 'D' + membername
+    # Reserve the entire 'q_' namespace for c_name(), and for 'q_empty'
+    # and 'q_obj_*' implicit type names.
+    if not valid_name.match(membername) or \
+       c_name(membername, False).startswith('q_'):
+        raise QAPISemError(info, "%s has an invalid name" % source)
+    if not permit_upper and name.lower() != name:
+        raise QAPISemError(
+            info, "%s uses uppercase in name" % source)
+    assert not membername.startswith('*')
+
+
+def check_defn_name_str(name, info, meta):
+    check_name_str(name, info, meta, permit_upper=True)
+    if name.endswith('Kind') or name.endswith('List'):
+        raise QAPISemError(
+            info, "%s name should not end in '%s'" % (meta, name[-4:]))
+
+
+def check_keys(value, info, source, required, optional):
+
+    def pprint(elems):
+        return ', '.join("'" + e + "'" for e in sorted(elems))
+
+    missing = set(required) - set(value)
+    if missing:
+        raise QAPISemError(
+            info,
+            "%s misses key%s %s"
+            % (source, 's' if len(missing) > 1 else '',
+               pprint(missing)))
+    allowed = set(required + optional)
+    unknown = set(value) - allowed
+    if unknown:
+        raise QAPISemError(
+            info,
+            "%s has unknown key%s %s\nValid keys are %s."
+            % (source, 's' if len(unknown) > 1 else '',
+               pprint(unknown), pprint(allowed)))
+
+
+def check_flags(expr, info):
+    for key in ['gen', 'success-response']:
+        if key in expr and expr[key] is not False:
+            raise QAPISemError(
+                info, "flag '%s' may only use false value" % key)
+    for key in ['boxed', 'allow-oob', 'allow-preconfig']:
+        if key in expr and expr[key] is not True:
+            raise QAPISemError(
+                info, "flag '%s' may only use true value" % key)
+
+
+def normalize_if(expr):
+    ifcond = expr.get('if')
+    if isinstance(ifcond, str):
+        expr['if'] = [ifcond]
+
+
+def check_if(expr, info, source):
+
+    def check_if_str(ifcond, info):
+        if not isinstance(ifcond, str):
+            raise QAPISemError(
+                info,
+                "'if' condition of %s must be a string or a list of strings"
+                % source)
+        if ifcond.strip() == '':
+            raise QAPISemError(
+                info,
+                "'if' condition '%s' of %s makes no sense"
+                % (ifcond, source))
+
+    ifcond = expr.get('if')
+    if ifcond is None:
+        return
+    if isinstance(ifcond, list):
+        if ifcond == []:
+            raise QAPISemError(
+                info, "'if' condition [] of %s is useless" % source)
+        for elt in ifcond:
+            check_if_str(elt, info)
+    else:
+        check_if_str(ifcond, info)
+
+
+def normalize_members(members):
+    if isinstance(members, OrderedDict):
+        for key, arg in members.items():
+            if isinstance(arg, dict):
+                continue
+            members[key] = {'type': arg}
+
+
+def check_type(value, info, source,
+               allow_array=False, allow_dict=False):
+    if value is None:
+        return
+
+    # Array type
+    if isinstance(value, list):
+        if not allow_array:
+            raise QAPISemError(info, "%s cannot be an array" % source)
+        if len(value) != 1 or not isinstance(value[0], str):
+            raise QAPISemError(info,
+                               "%s: array type must contain single type name" %
+                               source)
+        return
+
+    # Type name
+    if isinstance(value, str):
+        return
+
+    # Anonymous type
+
+    if not allow_dict:
+        raise QAPISemError(info, "%s should be a type name" % source)
+
+    if not isinstance(value, OrderedDict):
+        raise QAPISemError(info,
+                           "%s should be an object or type name" % source)
+
+    permit_upper = allow_dict in info.pragma.name_case_whitelist
+
+    # value is a dictionary, check that each member is okay
+    for (key, arg) in value.items():
+        key_source = "%s member '%s'" % (source, key)
+        check_name_str(key, info, key_source,
+                       allow_optional=True, permit_upper=permit_upper)
+        if c_name(key, False) == 'u' or c_name(key, False).startswith('has_'):
+            raise QAPISemError(info, "%s uses reserved name" % key_source)
+        check_keys(arg, info, key_source, ['type'], ['if'])
+        check_if(arg, info, key_source)
+        normalize_if(arg)
+        check_type(arg['type'], info, key_source, allow_array=True)
+
+
+def normalize_features(features):
+    if isinstance(features, list):
+        features[:] = [f if isinstance(f, dict) else {'name': f}
+                       for f in features]
+
+
+def check_features(features, info):
+    if features is None:
+        return
+    if not isinstance(features, list):
+        raise QAPISemError(info, "'features' must be an array")
+    for f in features:
+        source = "'features' member"
+        assert isinstance(f, dict)
+        check_keys(f, info, source, ['name'], ['if'])
+        check_name_is_str(f['name'], info, source)
+        source = "%s '%s'" % (source, f['name'])
+        check_name_str(f['name'], info, source)
+        check_if(f, info, source)
+        normalize_if(f)
+
+
+def normalize_enum(expr):
+    if isinstance(expr['data'], list):
+        expr['data'] = [m if isinstance(m, dict) else {'name': m}
+                        for m in expr['data']]
+
+
+def check_enum(expr, info):
+    name = expr['enum']
+    members = expr['data']
+    prefix = expr.get('prefix')
+
+    if not isinstance(members, list):
+        raise QAPISemError(info, "'data' must be an array")
+    if prefix is not None and not isinstance(prefix, str):
+        raise QAPISemError(info, "'prefix' must be a string")
+
+    permit_upper = name in info.pragma.name_case_whitelist
+
+    for member in members:
+        source = "'data' member"
+        check_keys(member, info, source, ['name'], ['if'])
+        check_name_is_str(member['name'], info, source)
+        source = "%s '%s'" % (source, member['name'])
+        check_name_str(member['name'], info, source,
+                       enum_member=True, permit_upper=permit_upper)
+        check_if(member, info, source)
+        normalize_if(member)
+
+
+def check_struct(expr, info):
+    name = expr['struct']
+    members = expr['data']
+
+    check_type(members, info, "'data'", allow_dict=name)
+    check_type(expr.get('base'), info, "'base'")
+    check_features(expr.get('features'), info)
+
+
+def check_union(expr, info):
+    name = expr['union']
+    base = expr.get('base')
+    discriminator = expr.get('discriminator')
+    members = expr['data']
+
+    if discriminator is None:   # simple union
+        if base is not None:
+            raise QAPISemError(info, "'base' requires 'discriminator'")
+    else:                       # flat union
+        check_type(base, info, "'base'", allow_dict=name)
+        if not base:
+            raise QAPISemError(info, "'discriminator' requires 'base'")
+        check_name_is_str(discriminator, info, "'discriminator'")
+
+    for (key, value) in members.items():
+        source = "'data' member '%s'" % key
+        check_name_str(key, info, source)
+        check_keys(value, info, source, ['type'], ['if'])
+        check_if(value, info, source)
+        normalize_if(value)
+        check_type(value['type'], info, source, allow_array=not base)
+
+
+def check_alternate(expr, info):
+    members = expr['data']
+
+    if len(members) == 0:
+        raise QAPISemError(info, "'data' must not be empty")
+    for (key, value) in members.items():
+        source = "'data' member '%s'" % key
+        check_name_str(key, info, source)
+        check_keys(value, info, source, ['type'], ['if'])
+        check_if(value, info, source)
+        normalize_if(value)
+        check_type(value['type'], info, source)
+
+
+def check_command(expr, info):
+    args = expr.get('data')
+    rets = expr.get('returns')
+    boxed = expr.get('boxed', False)
+
+    if boxed and args is None:
+        raise QAPISemError(info, "'boxed': true requires 'data'")
+    check_type(args, info, "'data'", allow_dict=not boxed)
+    check_type(rets, info, "'returns'", allow_array=True)
+    check_features(expr.get('features'), info)
+
+
+def check_event(expr, info):
+    args = expr.get('data')
+    boxed = expr.get('boxed', False)
+
+    if boxed and args is None:
+        raise QAPISemError(info, "'boxed': true requires 'data'")
+    check_type(args, info, "'data'", allow_dict=not boxed)
+
+
+def check_exprs(exprs):
+    for expr_elem in exprs:
+        expr = expr_elem['expr']
+        info = expr_elem['info']
+        doc = expr_elem.get('doc')
+
+        if 'include' in expr:
+            continue
+
+        if 'enum' in expr:
+            meta = 'enum'
+        elif 'union' in expr:
+            meta = 'union'
+        elif 'alternate' in expr:
+            meta = 'alternate'
+        elif 'struct' in expr:
+            meta = 'struct'
+        elif 'command' in expr:
+            meta = 'command'
+        elif 'event' in expr:
+            meta = 'event'
+        else:
+            raise QAPISemError(info, "expression is missing metatype")
+
+        name = expr[meta]
+        check_name_is_str(name, info, "'%s'" % meta)
+        info.set_defn(meta, name)
+        check_defn_name_str(name, info, meta)
+
+        if doc:
+            if doc.symbol != name:
+                raise QAPISemError(
+                    info, "documentation comment is for '%s'" % doc.symbol)
+            doc.check_expr(expr)
+        elif info.pragma.doc_required:
+            raise QAPISemError(info,
+                               "documentation comment required")
+
+        if meta == 'enum':
+            check_keys(expr, info, meta,
+                       ['enum', 'data'], ['if', 'prefix'])
+            normalize_enum(expr)
+            check_enum(expr, info)
+        elif meta == 'union':
+            check_keys(expr, info, meta,
+                       ['union', 'data'],
+                       ['base', 'discriminator', 'if'])
+            normalize_members(expr.get('base'))
+            normalize_members(expr['data'])
+            check_union(expr, info)
+        elif meta == 'alternate':
+            check_keys(expr, info, meta,
+                       ['alternate', 'data'], ['if'])
+            normalize_members(expr['data'])
+            check_alternate(expr, info)
+        elif meta == 'struct':
+            check_keys(expr, info, meta,
+                       ['struct', 'data'], ['base', 'if', 'features'])
+            normalize_members(expr['data'])
+            normalize_features(expr.get('features'))
+            check_struct(expr, info)
+        elif meta == 'command':
+            check_keys(expr, info, meta,
+                       ['command'],
+                       ['data', 'returns', 'boxed', 'if', 'features',
+                        'gen', 'success-response', 'allow-oob',
+                        'allow-preconfig'])
+            normalize_members(expr.get('data'))
+            normalize_features(expr.get('features'))
+            check_command(expr, info)
+        elif meta == 'event':
+            check_keys(expr, info, meta,
+                       ['event'], ['data', 'boxed', 'if'])
+            normalize_members(expr.get('data'))
+            check_event(expr, info)
+        else:
+            assert False, 'unexpected meta type'
+
+        normalize_if(expr)
+        check_if(expr, info, meta)
+        check_flags(expr, info)
+
+    return exprs
diff --git a/scripts/qapi/gen.py b/scripts/qapi/gen.py
new file mode 100644
index 0000000000..112b6d94c5
--- /dev/null
+++ b/scripts/qapi/gen.py
@@ -0,0 +1,291 @@
+# -*- coding: utf-8 -*-
+#
+# QAPI code generation
+#
+# Copyright (c) 2018-2019 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru@redhat.com>
+#  Marc-André Lureau <marcandre.lureau@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2.
+# See the COPYING file in the top-level directory.
+
+
+import errno
+import os
+import re
+import sys
+from contextlib import contextmanager
+
+from qapi.common import *
+from qapi.schema import QAPISchemaVisitor
+
+
+class QAPIGen(object):
+
+    def __init__(self, fname):
+        self.fname = fname
+        self._preamble = ''
+        self._body = ''
+
+    def preamble_add(self, text):
+        self._preamble += text
+
+    def add(self, text):
+        self._body += text
+
+    def get_content(self):
+        return self._top() + self._preamble + self._body + self._bottom()
+
+    def _top(self):
+        return ''
+
+    def _bottom(self):
+        return ''
+
+    def write(self, output_dir):
+        pathname = os.path.join(output_dir, self.fname)
+        dir = os.path.dirname(pathname)
+        if dir:
+            try:
+                os.makedirs(dir)
+            except os.error as e:
+                if e.errno != errno.EEXIST:
+                    raise
+        fd = os.open(pathname, os.O_RDWR | os.O_CREAT, 0o666)
+        if sys.version_info[0] >= 3:
+            f = open(fd, 'r+', encoding='utf-8')
+        else:
+            f = os.fdopen(fd, 'r+')
+        text = self.get_content()
+        oldtext = f.read(len(text) + 1)
+        if text != oldtext:
+            f.seek(0)
+            f.truncate(0)
+            f.write(text)
+        f.close()
+
+
+def _wrap_ifcond(ifcond, before, after):
+    if before == after:
+        return after   # suppress empty #if ... #endif
+
+    assert after.startswith(before)
+    out = before
+    added = after[len(before):]
+    if added[0] == '\n':
+        out += '\n'
+        added = added[1:]
+    out += gen_if(ifcond)
+    out += added
+    out += gen_endif(ifcond)
+    return out
+
+
+class QAPIGenCCode(QAPIGen):
+
+    def __init__(self, fname):
+        QAPIGen.__init__(self, fname)
+        self._start_if = None
+
+    def start_if(self, ifcond):
+        assert self._start_if is None
+        self._start_if = (ifcond, self._body, self._preamble)
+
+    def end_if(self):
+        assert self._start_if
+        self._wrap_ifcond()
+        self._start_if = None
+
+    def _wrap_ifcond(self):
+        self._body = _wrap_ifcond(self._start_if[0],
+                                  self._start_if[1], self._body)
+        self._preamble = _wrap_ifcond(self._start_if[0],
+                                      self._start_if[2], self._preamble)
+
+    def get_content(self):
+        assert self._start_if is None
+        return QAPIGen.get_content(self)
+
+
+class QAPIGenC(QAPIGenCCode):
+
+    def __init__(self, fname, blurb, pydoc):
+        QAPIGenCCode.__init__(self, fname)
+        self._blurb = blurb
+        self._copyright = '\n * '.join(re.findall(r'^Copyright .*', pydoc,
+                                                  re.MULTILINE))
+
+    def _top(self):
+        return mcgen('''
+/* AUTOMATICALLY GENERATED, DO NOT MODIFY */
+
+/*
+%(blurb)s
+ *
+ * %(copyright)s
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+''',
+                     blurb=self._blurb, copyright=self._copyright)
+
+    def _bottom(self):
+        return mcgen('''
+
+/* Dummy declaration to prevent empty .o file */
+char qapi_dummy_%(name)s;
+''',
+                     name=c_fname(self.fname))
+
+
+class QAPIGenH(QAPIGenC):
+
+    def _top(self):
+        return QAPIGenC._top(self) + guardstart(self.fname)
+
+    def _bottom(self):
+        return guardend(self.fname)
+
+
+@contextmanager
+def ifcontext(ifcond, *args):
+    """A 'with' statement context manager to wrap with start_if()/end_if()
+
+    *args: any number of QAPIGenCCode
+
+    Example::
+
+        with ifcontext(ifcond, self._genh, self._genc):
+            modify self._genh and self._genc ...
+
+    Is equivalent to calling::
+
+        self._genh.start_if(ifcond)
+        self._genc.start_if(ifcond)
+        modify self._genh and self._genc ...
+        self._genh.end_if()
+        self._genc.end_if()
+    """
+    for arg in args:
+        arg.start_if(ifcond)
+    yield
+    for arg in args:
+        arg.end_if()
+
+
+class QAPIGenDoc(QAPIGen):
+
+    def _top(self):
+        return (QAPIGen._top(self)
+                + '@c AUTOMATICALLY GENERATED, DO NOT MODIFY\n\n')
+
+
+class QAPISchemaMonolithicCVisitor(QAPISchemaVisitor):
+
+    def __init__(self, prefix, what, blurb, pydoc):
+        self._prefix = prefix
+        self._what = what
+        self._genc = QAPIGenC(self._prefix + self._what + '.c',
+                              blurb, pydoc)
+        self._genh = QAPIGenH(self._prefix + self._what + '.h',
+                              blurb, pydoc)
+
+    def write(self, output_dir):
+        self._genc.write(output_dir)
+        self._genh.write(output_dir)
+
+
+class QAPISchemaModularCVisitor(QAPISchemaVisitor):
+
+    def __init__(self, prefix, what, blurb, pydoc):
+        self._prefix = prefix
+        self._what = what
+        self._blurb = blurb
+        self._pydoc = pydoc
+        self._genc = None
+        self._genh = None
+        self._module = {}
+        self._main_module = None
+
+    @staticmethod
+    def _is_user_module(name):
+        return name and not name.startswith('./')
+
+    @staticmethod
+    def _is_builtin_module(name):
+        return not name
+
+    def _module_dirname(self, what, name):
+        if self._is_user_module(name):
+            return os.path.dirname(name)
+        return ''
+
+    def _module_basename(self, what, name):
+        ret = '' if self._is_builtin_module(name) else self._prefix
+        if self._is_user_module(name):
+            basename = os.path.basename(name)
+            ret += what
+            if name != self._main_module:
+                ret += '-' + os.path.splitext(basename)[0]
+        else:
+            name = name[2:] if name else 'builtin'
+            ret += re.sub(r'-', '-' + name + '-', what)
+        return ret
+
+    def _module_filename(self, what, name):
+        return os.path.join(self._module_dirname(what, name),
+                            self._module_basename(what, name))
+
+    def _add_module(self, name, blurb):
+        basename = self._module_filename(self._what, name)
+        genc = QAPIGenC(basename + '.c', blurb, self._pydoc)
+        genh = QAPIGenH(basename + '.h', blurb, self._pydoc)
+        self._module[name] = (genc, genh)
+        self._set_module(name)
+
+    def _add_user_module(self, name, blurb):
+        assert self._is_user_module(name)
+        if self._main_module is None:
+            self._main_module = name
+        self._add_module(name, blurb)
+
+    def _add_system_module(self, name, blurb):
+        self._add_module(name and './' + name, blurb)
+
+    def _set_module(self, name):
+        self._genc, self._genh = self._module[name]
+
+    def write(self, output_dir, opt_builtins=False):
+        for name in self._module:
+            if self._is_builtin_module(name) and not opt_builtins:
+                continue
+            (genc, genh) = self._module[name]
+            genc.write(output_dir)
+            genh.write(output_dir)
+
+    def _begin_user_module(self, name):
+        pass
+
+    def visit_module(self, name):
+        if name in self._module:
+            self._set_module(name)
+        elif self._is_builtin_module(name):
+            # The built-in module has not been created.  No code may
+            # be generated.
+            self._genc = None
+            self._genh = None
+        else:
+            self._add_user_module(name, self._blurb)
+            self._begin_user_module(name)
+
+    def visit_include(self, name, info):
+        relname = os.path.relpath(self._module_filename(self._what, name),
+                                  os.path.dirname(self._genh.fname))
+        self._genh.preamble_add(mcgen('''
+#include "%(relname)s.h"
+''',
+                                      relname=relname))
diff --git a/scripts/qapi/introspect.py b/scripts/qapi/introspect.py
index f62cf0a2e1..b3a463dd8b 100644
--- a/scripts/qapi/introspect.py
+++ b/scripts/qapi/introspect.py
@@ -10,7 +10,12 @@ This work is licensed under the terms of the GNU GPL, version 2.
 See the COPYING file in the top-level directory.
 """
 
+import string
+
 from qapi.common import *
+from qapi.gen import QAPISchemaMonolithicCVisitor
+from qapi.schema import (QAPISchemaArrayType, QAPISchemaBuiltinType,
+                         QAPISchemaType)
 
 
 def to_qlit(obj, level=0, suppress_first_indent=False):
@@ -206,13 +211,18 @@ const QLitObject %(c_name)s = %(c_string)s;
                            for m in variants.variants]}, ifcond)
 
     def visit_command(self, name, info, ifcond, arg_type, ret_type, gen,
-                      success_response, boxed, allow_oob, allow_preconfig):
+                      success_response, boxed, allow_oob, allow_preconfig,
+                      features):
         arg_type = arg_type or self._schema.the_empty_object_type
         ret_type = ret_type or self._schema.the_empty_object_type
         obj = {'arg-type': self._use_type(arg_type),
                'ret-type': self._use_type(ret_type)}
         if allow_oob:
             obj['allow-oob'] = allow_oob
+
+        if features:
+            obj['features'] = [(f.name, {'if': f.ifcond}) for f in features]
+
         self._gen_qlit(name, 'command', obj, ifcond)
 
     def visit_event(self, name, info, ifcond, arg_type, boxed):
diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
new file mode 100644
index 0000000000..e800876ad1
--- /dev/null
+++ b/scripts/qapi/parser.py
@@ -0,0 +1,570 @@
+# -*- coding: utf-8 -*-
+#
+# QAPI schema parser
+#
+# Copyright IBM, Corp. 2011
+# Copyright (c) 2013-2019 Red Hat Inc.
+#
+# Authors:
+#  Anthony Liguori <aliguori@us.ibm.com>
+#  Markus Armbruster <armbru@redhat.com>
+#  Marc-André Lureau <marcandre.lureau@redhat.com>
+#  Kevin Wolf <kwolf@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2.
+# See the COPYING file in the top-level directory.
+
+import os
+import re
+import sys
+from collections import OrderedDict
+
+from qapi.error import QAPIParseError, QAPISemError
+from qapi.source import QAPISourceInfo
+
+
+class QAPISchemaParser(object):
+
+    def __init__(self, fname, previously_included=None, incl_info=None):
+        previously_included = previously_included or set()
+        previously_included.add(os.path.abspath(fname))
+
+        try:
+            if sys.version_info[0] >= 3:
+                fp = open(fname, 'r', encoding='utf-8')
+            else:
+                fp = open(fname, 'r')
+            self.src = fp.read()
+        except IOError as e:
+            raise QAPISemError(incl_info or QAPISourceInfo(None, None, None),
+                               "can't read %s file '%s': %s"
+                               % ("include" if incl_info else "schema",
+                                  fname,
+                                  e.strerror))
+
+        if self.src == '' or self.src[-1] != '\n':
+            self.src += '\n'
+        self.cursor = 0
+        self.info = QAPISourceInfo(fname, 1, incl_info)
+        self.line_pos = 0
+        self.exprs = []
+        self.docs = []
+        self.accept()
+        cur_doc = None
+
+        while self.tok is not None:
+            info = self.info
+            if self.tok == '#':
+                self.reject_expr_doc(cur_doc)
+                cur_doc = self.get_doc(info)
+                self.docs.append(cur_doc)
+                continue
+
+            expr = self.get_expr(False)
+            if 'include' in expr:
+                self.reject_expr_doc(cur_doc)
+                if len(expr) != 1:
+                    raise QAPISemError(info, "invalid 'include' directive")
+                include = expr['include']
+                if not isinstance(include, str):
+                    raise QAPISemError(info,
+                                       "value of 'include' must be a string")
+                incl_fname = os.path.join(os.path.dirname(fname),
+                                          include)
+                self.exprs.append({'expr': {'include': incl_fname},
+                                   'info': info})
+                exprs_include = self._include(include, info, incl_fname,
+                                              previously_included)
+                if exprs_include:
+                    self.exprs.extend(exprs_include.exprs)
+                    self.docs.extend(exprs_include.docs)
+            elif "pragma" in expr:
+                self.reject_expr_doc(cur_doc)
+                if len(expr) != 1:
+                    raise QAPISemError(info, "invalid 'pragma' directive")
+                pragma = expr['pragma']
+                if not isinstance(pragma, dict):
+                    raise QAPISemError(
+                        info, "value of 'pragma' must be an object")
+                for name, value in pragma.items():
+                    self._pragma(name, value, info)
+            else:
+                expr_elem = {'expr': expr,
+                             'info': info}
+                if cur_doc:
+                    if not cur_doc.symbol:
+                        raise QAPISemError(
+                            cur_doc.info, "definition documentation required")
+                    expr_elem['doc'] = cur_doc
+                self.exprs.append(expr_elem)
+            cur_doc = None
+        self.reject_expr_doc(cur_doc)
+
+    @staticmethod
+    def reject_expr_doc(doc):
+        if doc and doc.symbol:
+            raise QAPISemError(
+                doc.info,
+                "documentation for '%s' is not followed by the definition"
+                % doc.symbol)
+
+    def _include(self, include, info, incl_fname, previously_included):
+        incl_abs_fname = os.path.abspath(incl_fname)
+        # catch inclusion cycle
+        inf = info
+        while inf:
+            if incl_abs_fname == os.path.abspath(inf.fname):
+                raise QAPISemError(info, "inclusion loop for %s" % include)
+            inf = inf.parent
+
+        # skip multiple include of the same file
+        if incl_abs_fname in previously_included:
+            return None
+
+        return QAPISchemaParser(incl_fname, previously_included, info)
+
+    def _pragma(self, name, value, info):
+        if name == 'doc-required':
+            if not isinstance(value, bool):
+                raise QAPISemError(info,
+                                   "pragma 'doc-required' must be boolean")
+            info.pragma.doc_required = value
+        elif name == 'returns-whitelist':
+            if (not isinstance(value, list)
+                    or any([not isinstance(elt, str) for elt in value])):
+                raise QAPISemError(
+                    info,
+                    "pragma returns-whitelist must be a list of strings")
+            info.pragma.returns_whitelist = value
+        elif name == 'name-case-whitelist':
+            if (not isinstance(value, list)
+                    or any([not isinstance(elt, str) for elt in value])):
+                raise QAPISemError(
+                    info,
+                    "pragma name-case-whitelist must be a list of strings")
+            info.pragma.name_case_whitelist = value
+        else:
+            raise QAPISemError(info, "unknown pragma '%s'" % name)
+
+    def accept(self, skip_comment=True):
+        while True:
+            self.tok = self.src[self.cursor]
+            self.pos = self.cursor
+            self.cursor += 1
+            self.val = None
+
+            if self.tok == '#':
+                if self.src[self.cursor] == '#':
+                    # Start of doc comment
+                    skip_comment = False
+                self.cursor = self.src.find('\n', self.cursor)
+                if not skip_comment:
+                    self.val = self.src[self.pos:self.cursor]
+                    return
+            elif self.tok in '{}:,[]':
+                return
+            elif self.tok == "'":
+                # Note: we accept only printable ASCII
+                string = ''
+                esc = False
+                while True:
+                    ch = self.src[self.cursor]
+                    self.cursor += 1
+                    if ch == '\n':
+                        raise QAPIParseError(self, "missing terminating \"'\"")
+                    if esc:
+                        # Note: we recognize only \\ because we have
+                        # no use for funny characters in strings
+                        if ch != '\\':
+                            raise QAPIParseError(self,
+                                                 "unknown escape \\%s" % ch)
+                        esc = False
+                    elif ch == '\\':
+                        esc = True
+                        continue
+                    elif ch == "'":
+                        self.val = string
+                        return
+                    if ord(ch) < 32 or ord(ch) >= 127:
+                        raise QAPIParseError(
+                            self, "funny character in string")
+                    string += ch
+            elif self.src.startswith('true', self.pos):
+                self.val = True
+                self.cursor += 3
+                return
+            elif self.src.startswith('false', self.pos):
+                self.val = False
+                self.cursor += 4
+                return
+            elif self.tok == '\n':
+                if self.cursor == len(self.src):
+                    self.tok = None
+                    return
+                self.info = self.info.next_line()
+                self.line_pos = self.cursor
+            elif not self.tok.isspace():
+                # Show up to next structural, whitespace or quote
+                # character
+                match = re.match('[^[\\]{}:,\\s\'"]+',
+                                 self.src[self.cursor-1:])
+                raise QAPIParseError(self, "stray '%s'" % match.group(0))
+
+    def get_members(self):
+        expr = OrderedDict()
+        if self.tok == '}':
+            self.accept()
+            return expr
+        if self.tok != "'":
+            raise QAPIParseError(self, "expected string or '}'")
+        while True:
+            key = self.val
+            self.accept()
+            if self.tok != ':':
+                raise QAPIParseError(self, "expected ':'")
+            self.accept()
+            if key in expr:
+                raise QAPIParseError(self, "duplicate key '%s'" % key)
+            expr[key] = self.get_expr(True)
+            if self.tok == '}':
+                self.accept()
+                return expr
+            if self.tok != ',':
+                raise QAPIParseError(self, "expected ',' or '}'")
+            self.accept()
+            if self.tok != "'":
+                raise QAPIParseError(self, "expected string")
+
+    def get_values(self):
+        expr = []
+        if self.tok == ']':
+            self.accept()
+            return expr
+        if self.tok not in "{['tfn":
+            raise QAPIParseError(
+                self, "expected '{', '[', ']', string, boolean or 'null'")
+        while True:
+            expr.append(self.get_expr(True))
+            if self.tok == ']':
+                self.accept()
+                return expr
+            if self.tok != ',':
+                raise QAPIParseError(self, "expected ',' or ']'")
+            self.accept()
+
+    def get_expr(self, nested):
+        if self.tok != '{' and not nested:
+            raise QAPIParseError(self, "expected '{'")
+        if self.tok == '{':
+            self.accept()
+            expr = self.get_members()
+        elif self.tok == '[':
+            self.accept()
+            expr = self.get_values()
+        elif self.tok in "'tfn":
+            expr = self.val
+            self.accept()
+        else:
+            raise QAPIParseError(
+                self, "expected '{', '[', string, boolean or 'null'")
+        return expr
+
+    def get_doc(self, info):
+        if self.val != '##':
+            raise QAPIParseError(
+                self, "junk after '##' at start of documentation comment")
+
+        doc = QAPIDoc(self, info)
+        self.accept(False)
+        while self.tok == '#':
+            if self.val.startswith('##'):
+                # End of doc comment
+                if self.val != '##':
+                    raise QAPIParseError(
+                        self,
+                        "junk after '##' at end of documentation comment")
+                doc.end_comment()
+                self.accept()
+                return doc
+            else:
+                doc.append(self.val)
+            self.accept(False)
+
+        raise QAPIParseError(self, "documentation comment must end with '##'")
+
+
+class QAPIDoc(object):
+    """
+    A documentation comment block, either definition or free-form
+
+    Definition documentation blocks consist of
+
+    * a body section: one line naming the definition, followed by an
+      overview (any number of lines)
+
+    * argument sections: a description of each argument (for commands
+      and events) or member (for structs, unions and alternates)
+
+    * features sections: a description of each feature flag
+
+    * additional (non-argument) sections, possibly tagged
+
+    Free-form documentation blocks consist only of a body section.
+    """
+
+    class Section(object):
+        def __init__(self, name=None):
+            # optional section name (argument/member or section name)
+            self.name = name
+            # the list of lines for this section
+            self.text = ''
+
+        def append(self, line):
+            self.text += line.rstrip() + '\n'
+
+    class ArgSection(Section):
+        def __init__(self, name):
+            QAPIDoc.Section.__init__(self, name)
+            self.member = None
+
+        def connect(self, member):
+            self.member = member
+
+    def __init__(self, parser, info):
+        # self._parser is used to report errors with QAPIParseError.  The
+        # resulting error position depends on the state of the parser.
+        # It happens to be the beginning of the comment.  More or less
+        # servicable, but action at a distance.
+        self._parser = parser
+        self.info = info
+        self.symbol = None
+        self.body = QAPIDoc.Section()
+        # dict mapping parameter name to ArgSection
+        self.args = OrderedDict()
+        self.features = OrderedDict()
+        # a list of Section
+        self.sections = []
+        # the current section
+        self._section = self.body
+        self._append_line = self._append_body_line
+
+    def has_section(self, name):
+        """Return True if we have a section with this name."""
+        for i in self.sections:
+            if i.name == name:
+                return True
+        return False
+
+    def append(self, line):
+        """
+        Parse a comment line and add it to the documentation.
+
+        The way that the line is dealt with depends on which part of
+        the documentation we're parsing right now:
+        * The body section: ._append_line is ._append_body_line
+        * An argument section: ._append_line is ._append_args_line
+        * A features section: ._append_line is ._append_features_line
+        * An additional section: ._append_line is ._append_various_line
+        """
+        line = line[1:]
+        if not line:
+            self._append_freeform(line)
+            return
+
+        if line[0] != ' ':
+            raise QAPIParseError(self._parser, "missing space after #")
+        line = line[1:]
+        self._append_line(line)
+
+    def end_comment(self):
+        self._end_section()
+
+    @staticmethod
+    def _is_section_tag(name):
+        return name in ('Returns:', 'Since:',
+                        # those are often singular or plural
+                        'Note:', 'Notes:',
+                        'Example:', 'Examples:',
+                        'TODO:')
+
+    def _append_body_line(self, line):
+        """
+        Process a line of documentation text in the body section.
+
+        If this a symbol line and it is the section's first line, this
+        is a definition documentation block for that symbol.
+
+        If it's a definition documentation block, another symbol line
+        begins the argument section for the argument named by it, and
+        a section tag begins an additional section.  Start that
+        section and append the line to it.
+
+        Else, append the line to the current section.
+        """
+        name = line.split(' ', 1)[0]
+        # FIXME not nice: things like '#  @foo:' and '# @foo: ' aren't
+        # recognized, and get silently treated as ordinary text
+        if not self.symbol and not self.body.text and line.startswith('@'):
+            if not line.endswith(':'):
+                raise QAPIParseError(self._parser, "line should end with ':'")
+            self.symbol = line[1:-1]
+            # FIXME invalid names other than the empty string aren't flagged
+            if not self.symbol:
+                raise QAPIParseError(self._parser, "invalid name")
+        elif self.symbol:
+            # This is a definition documentation block
+            if name.startswith('@') and name.endswith(':'):
+                self._append_line = self._append_args_line
+                self._append_args_line(line)
+            elif line == 'Features:':
+                self._append_line = self._append_features_line
+            elif self._is_section_tag(name):
+                self._append_line = self._append_various_line
+                self._append_various_line(line)
+            else:
+                self._append_freeform(line.strip())
+        else:
+            # This is a free-form documentation block
+            self._append_freeform(line.strip())
+
+    def _append_args_line(self, line):
+        """
+        Process a line of documentation text in an argument section.
+
+        A symbol line begins the next argument section, a section tag
+        section or a non-indented line after a blank line begins an
+        additional section.  Start that section and append the line to
+        it.
+
+        Else, append the line to the current section.
+
+        """
+        name = line.split(' ', 1)[0]
+
+        if name.startswith('@') and name.endswith(':'):
+            line = line[len(name)+1:]
+            self._start_args_section(name[1:-1])
+        elif self._is_section_tag(name):
+            self._append_line = self._append_various_line
+            self._append_various_line(line)
+            return
+        elif (self._section.text.endswith('\n\n')
+              and line and not line[0].isspace()):
+            if line == 'Features:':
+                self._append_line = self._append_features_line
+            else:
+                self._start_section()
+                self._append_line = self._append_various_line
+                self._append_various_line(line)
+            return
+
+        self._append_freeform(line.strip())
+
+    def _append_features_line(self, line):
+        name = line.split(' ', 1)[0]
+
+        if name.startswith('@') and name.endswith(':'):
+            line = line[len(name)+1:]
+            self._start_features_section(name[1:-1])
+        elif self._is_section_tag(name):
+            self._append_line = self._append_various_line
+            self._append_various_line(line)
+            return
+        elif (self._section.text.endswith('\n\n')
+              and line and not line[0].isspace()):
+            self._start_section()
+            self._append_line = self._append_various_line
+            self._append_various_line(line)
+            return
+
+        self._append_freeform(line.strip())
+
+    def _append_various_line(self, line):
+        """
+        Process a line of documentation text in an additional section.
+
+        A symbol line is an error.
+
+        A section tag begins an additional section.  Start that
+        section and append the line to it.
+
+        Else, append the line to the current section.
+        """
+        name = line.split(' ', 1)[0]
+
+        if name.startswith('@') and name.endswith(':'):
+            raise QAPIParseError(self._parser,
+                                 "'%s' can't follow '%s' section"
+                                 % (name, self.sections[0].name))
+        elif self._is_section_tag(name):
+            line = line[len(name)+1:]
+            self._start_section(name[:-1])
+
+        if (not self._section.name or
+                not self._section.name.startswith('Example')):
+            line = line.strip()
+
+        self._append_freeform(line)
+
+    def _start_symbol_section(self, symbols_dict, name):
+        # FIXME invalid names other than the empty string aren't flagged
+        if not name:
+            raise QAPIParseError(self._parser, "invalid parameter name")
+        if name in symbols_dict:
+            raise QAPIParseError(self._parser,
+                                 "'%s' parameter name duplicated" % name)
+        assert not self.sections
+        self._end_section()
+        self._section = QAPIDoc.ArgSection(name)
+        symbols_dict[name] = self._section
+
+    def _start_args_section(self, name):
+        self._start_symbol_section(self.args, name)
+
+    def _start_features_section(self, name):
+        self._start_symbol_section(self.features, name)
+
+    def _start_section(self, name=None):
+        if name in ('Returns', 'Since') and self.has_section(name):
+            raise QAPIParseError(self._parser,
+                                 "duplicated '%s' section" % name)
+        self._end_section()
+        self._section = QAPIDoc.Section(name)
+        self.sections.append(self._section)
+
+    def _end_section(self):
+        if self._section:
+            text = self._section.text = self._section.text.strip()
+            if self._section.name and (not text or text.isspace()):
+                raise QAPIParseError(
+                    self._parser,
+                    "empty doc section '%s'" % self._section.name)
+            self._section = None
+
+    def _append_freeform(self, line):
+        match = re.match(r'(@\S+:)', line)
+        if match:
+            raise QAPIParseError(self._parser,
+                                 "'%s' not allowed in free-form documentation"
+                                 % match.group(1))
+        self._section.append(line)
+
+    def connect_member(self, member):
+        if member.name not in self.args:
+            # Undocumented TODO outlaw
+            self.args[member.name] = QAPIDoc.ArgSection(member.name)
+        self.args[member.name].connect(member)
+
+    def check_expr(self, expr):
+        if self.has_section('Returns') and 'command' not in expr:
+            raise QAPISemError(self.info,
+                               "'Returns:' is only valid for commands")
+
+    def check(self):
+        bogus = [name for name, section in self.args.items()
+                 if not section.member]
+        if bogus:
+            raise QAPISemError(
+                self.info,
+                "the following documented members are not in "
+                "the declaration: %s" % ", ".join(bogus))
diff --git a/scripts/qapi/schema.py b/scripts/qapi/schema.py
new file mode 100644
index 0000000000..f7d68a35f4
--- /dev/null
+++ b/scripts/qapi/schema.py
@@ -0,0 +1,1057 @@
+# -*- coding: utf-8 -*-
+#
+# QAPI schema internal representation
+#
+# Copyright (c) 2015-2019 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru@redhat.com>
+#  Eric Blake <eblake@redhat.com>
+#  Marc-André Lureau <marcandre.lureau@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2.
+# See the COPYING file in the top-level directory.
+
+# TODO catching name collisions in generated code would be nice
+
+import os
+import re
+from collections import OrderedDict
+
+from qapi.common import c_name, pointer_suffix
+from qapi.error import QAPIError, QAPIParseError, QAPISemError
+from qapi.expr import check_exprs
+from qapi.parser import QAPISchemaParser
+
+
+class QAPISchemaEntity(object):
+    meta = None
+
+    def __init__(self, name, info, doc, ifcond=None):
+        assert name is None or isinstance(name, str)
+        self.name = name
+        self._module = None
+        # For explicitly defined entities, info points to the (explicit)
+        # definition.  For builtins (and their arrays), info is None.
+        # For implicitly defined entities, info points to a place that
+        # triggered the implicit definition (there may be more than one
+        # such place).
+        self.info = info
+        self.doc = doc
+        self._ifcond = ifcond or []
+        self._checked = False
+
+    def c_name(self):
+        return c_name(self.name)
+
+    def check(self, schema):
+        assert not self._checked
+        if self.info:
+            self._module = os.path.relpath(self.info.fname,
+                                           os.path.dirname(schema.fname))
+        self._checked = True
+
+    @property
+    def ifcond(self):
+        assert self._checked
+        return self._ifcond
+
+    @property
+    def module(self):
+        assert self._checked
+        return self._module
+
+    def is_implicit(self):
+        return not self.info
+
+    def visit(self, visitor):
+        assert self._checked
+
+    def describe(self):
+        assert self.meta
+        return "%s '%s'" % (self.meta, self.name)
+
+
+class QAPISchemaVisitor(object):
+    def visit_begin(self, schema):
+        pass
+
+    def visit_end(self):
+        pass
+
+    def visit_module(self, fname):
+        pass
+
+    def visit_needed(self, entity):
+        # Default to visiting everything
+        return True
+
+    def visit_include(self, fname, info):
+        pass
+
+    def visit_builtin_type(self, name, info, json_type):
+        pass
+
+    def visit_enum_type(self, name, info, ifcond, members, prefix):
+        pass
+
+    def visit_array_type(self, name, info, ifcond, element_type):
+        pass
+
+    def visit_object_type(self, name, info, ifcond, base, members, variants,
+                          features):
+        pass
+
+    def visit_object_type_flat(self, name, info, ifcond, members, variants,
+                               features):
+        pass
+
+    def visit_alternate_type(self, name, info, ifcond, variants):
+        pass
+
+    def visit_command(self, name, info, ifcond, arg_type, ret_type, gen,
+                      success_response, boxed, allow_oob, allow_preconfig,
+                      features):
+        pass
+
+    def visit_event(self, name, info, ifcond, arg_type, boxed):
+        pass
+
+
+class QAPISchemaInclude(QAPISchemaEntity):
+
+    def __init__(self, fname, info):
+        QAPISchemaEntity.__init__(self, None, info, None)
+        self.fname = fname
+
+    def visit(self, visitor):
+        QAPISchemaEntity.visit(self, visitor)
+        visitor.visit_include(self.fname, self.info)
+
+
+class QAPISchemaType(QAPISchemaEntity):
+    # Return the C type for common use.
+    # For the types we commonly box, this is a pointer type.
+    def c_type(self):
+        pass
+
+    # Return the C type to be used in a parameter list.
+    def c_param_type(self):
+        return self.c_type()
+
+    # Return the C type to be used where we suppress boxing.
+    def c_unboxed_type(self):
+        return self.c_type()
+
+    def json_type(self):
+        pass
+
+    def alternate_qtype(self):
+        json2qtype = {
+            'null':    'QTYPE_QNULL',
+            'string':  'QTYPE_QSTRING',
+            'number':  'QTYPE_QNUM',
+            'int':     'QTYPE_QNUM',
+            'boolean': 'QTYPE_QBOOL',
+            'object':  'QTYPE_QDICT'
+        }
+        return json2qtype.get(self.json_type())
+
+    def doc_type(self):
+        if self.is_implicit():
+            return None
+        return self.name
+
+    def describe(self):
+        assert self.meta
+        return "%s type '%s'" % (self.meta, self.name)
+
+
+class QAPISchemaBuiltinType(QAPISchemaType):
+    meta = 'built-in'
+
+    def __init__(self, name, json_type, c_type):
+        QAPISchemaType.__init__(self, name, None, None)
+        assert not c_type or isinstance(c_type, str)
+        assert json_type in ('string', 'number', 'int', 'boolean', 'null',
+                             'value')
+        self._json_type_name = json_type
+        self._c_type_name = c_type
+
+    def c_name(self):
+        return self.name
+
+    def c_type(self):
+        return self._c_type_name
+
+    def c_param_type(self):
+        if self.name == 'str':
+            return 'const ' + self._c_type_name
+        return self._c_type_name
+
+    def json_type(self):
+        return self._json_type_name
+
+    def doc_type(self):
+        return self.json_type()
+
+    def visit(self, visitor):
+        QAPISchemaType.visit(self, visitor)
+        visitor.visit_builtin_type(self.name, self.info, self.json_type())
+
+
+class QAPISchemaEnumType(QAPISchemaType):
+    meta = 'enum'
+
+    def __init__(self, name, info, doc, ifcond, members, prefix):
+        QAPISchemaType.__init__(self, name, info, doc, ifcond)
+        for m in members:
+            assert isinstance(m, QAPISchemaEnumMember)
+            m.set_defined_in(name)
+        assert prefix is None or isinstance(prefix, str)
+        self.members = members
+        self.prefix = prefix
+
+    def check(self, schema):
+        QAPISchemaType.check(self, schema)
+        seen = {}
+        for m in self.members:
+            m.check_clash(self.info, seen)
+            if self.doc:
+                self.doc.connect_member(m)
+
+    def is_implicit(self):
+        # See QAPISchema._make_implicit_enum_type() and ._def_predefineds()
+        return self.name.endswith('Kind') or self.name == 'QType'
+
+    def c_type(self):
+        return c_name(self.name)
+
+    def member_names(self):
+        return [m.name for m in self.members]
+
+    def json_type(self):
+        return 'string'
+
+    def visit(self, visitor):
+        QAPISchemaType.visit(self, visitor)
+        visitor.visit_enum_type(self.name, self.info, self.ifcond,
+                                self.members, self.prefix)
+
+
+class QAPISchemaArrayType(QAPISchemaType):
+    meta = 'array'
+
+    def __init__(self, name, info, element_type):
+        QAPISchemaType.__init__(self, name, info, None, None)
+        assert isinstance(element_type, str)
+        self._element_type_name = element_type
+        self.element_type = None
+
+    def check(self, schema):
+        QAPISchemaType.check(self, schema)
+        self.element_type = schema.resolve_type(
+            self._element_type_name, self.info,
+            self.info and self.info.defn_meta)
+        assert not isinstance(self.element_type, QAPISchemaArrayType)
+
+    @property
+    def ifcond(self):
+        assert self._checked
+        return self.element_type.ifcond
+
+    @property
+    def module(self):
+        assert self._checked
+        return self.element_type.module
+
+    def is_implicit(self):
+        return True
+
+    def c_type(self):
+        return c_name(self.name) + pointer_suffix
+
+    def json_type(self):
+        return 'array'
+
+    def doc_type(self):
+        elt_doc_type = self.element_type.doc_type()
+        if not elt_doc_type:
+            return None
+        return 'array of ' + elt_doc_type
+
+    def visit(self, visitor):
+        QAPISchemaType.visit(self, visitor)
+        visitor.visit_array_type(self.name, self.info, self.ifcond,
+                                 self.element_type)
+
+    def describe(self):
+        assert self.meta
+        return "%s type ['%s']" % (self.meta, self._element_type_name)
+
+
+class QAPISchemaObjectType(QAPISchemaType):
+    def __init__(self, name, info, doc, ifcond,
+                 base, local_members, variants, features):
+        # struct has local_members, optional base, and no variants
+        # flat union has base, variants, and no local_members
+        # simple union has local_members, variants, and no base
+        QAPISchemaType.__init__(self, name, info, doc, ifcond)
+        self.meta = 'union' if variants else 'struct'
+        assert base is None or isinstance(base, str)
+        for m in local_members:
+            assert isinstance(m, QAPISchemaObjectTypeMember)
+            m.set_defined_in(name)
+        if variants is not None:
+            assert isinstance(variants, QAPISchemaObjectTypeVariants)
+            variants.set_defined_in(name)
+        for f in features:
+            assert isinstance(f, QAPISchemaFeature)
+            f.set_defined_in(name)
+        self._base_name = base
+        self.base = None
+        self.local_members = local_members
+        self.variants = variants
+        self.members = None
+        self.features = features
+
+    def check(self, schema):
+        # This calls another type T's .check() exactly when the C
+        # struct emitted by gen_object() contains that T's C struct
+        # (pointers don't count).
+        if self.members is not None:
+            # A previous .check() completed: nothing to do
+            return
+        if self._checked:
+            # Recursed: C struct contains itself
+            raise QAPISemError(self.info,
+                               "object %s contains itself" % self.name)
+
+        QAPISchemaType.check(self, schema)
+        assert self._checked and self.members is None
+
+        seen = OrderedDict()
+        if self._base_name:
+            self.base = schema.resolve_type(self._base_name, self.info,
+                                            "'base'")
+            if (not isinstance(self.base, QAPISchemaObjectType)
+                    or self.base.variants):
+                raise QAPISemError(
+                    self.info,
+                    "'base' requires a struct type, %s isn't"
+                    % self.base.describe())
+            self.base.check(schema)
+            self.base.check_clash(self.info, seen)
+        for m in self.local_members:
+            m.check(schema)
+            m.check_clash(self.info, seen)
+            if self.doc:
+                self.doc.connect_member(m)
+        members = seen.values()
+
+        if self.variants:
+            self.variants.check(schema, seen)
+            self.variants.check_clash(self.info, seen)
+
+        # Features are in a name space separate from members
+        seen = {}
+        for f in self.features:
+            f.check_clash(self.info, seen)
+
+        if self.doc:
+            self.doc.check()
+
+        self.members = members  # mark completed
+
+    # Check that the members of this type do not cause duplicate JSON members,
+    # and update seen to track the members seen so far. Report any errors
+    # on behalf of info, which is not necessarily self.info
+    def check_clash(self, info, seen):
+        assert self._checked
+        assert not self.variants       # not implemented
+        for m in self.members:
+            m.check_clash(info, seen)
+
+    @property
+    def ifcond(self):
+        assert self._checked
+        if isinstance(self._ifcond, QAPISchemaType):
+            # Simple union wrapper type inherits from wrapped type;
+            # see _make_implicit_object_type()
+            return self._ifcond.ifcond
+        return self._ifcond
+
+    def is_implicit(self):
+        # See QAPISchema._make_implicit_object_type(), as well as
+        # _def_predefineds()
+        return self.name.startswith('q_')
+
+    def is_empty(self):
+        assert self.members is not None
+        return not self.members and not self.variants
+
+    def c_name(self):
+        assert self.name != 'q_empty'
+        return QAPISchemaType.c_name(self)
+
+    def c_type(self):
+        assert not self.is_implicit()
+        return c_name(self.name) + pointer_suffix
+
+    def c_unboxed_type(self):
+        return c_name(self.name)
+
+    def json_type(self):
+        return 'object'
+
+    def visit(self, visitor):
+        QAPISchemaType.visit(self, visitor)
+        visitor.visit_object_type(self.name, self.info, self.ifcond,
+                                  self.base, self.local_members, self.variants,
+                                  self.features)
+        visitor.visit_object_type_flat(self.name, self.info, self.ifcond,
+                                       self.members, self.variants,
+                                       self.features)
+
+
+class QAPISchemaMember(object):
+    """ Represents object members, enum members and features """
+    role = 'member'
+
+    def __init__(self, name, info, ifcond=None):
+        assert isinstance(name, str)
+        self.name = name
+        self.info = info
+        self.ifcond = ifcond or []
+        self.defined_in = None
+
+    def set_defined_in(self, name):
+        assert not self.defined_in
+        self.defined_in = name
+
+    def check_clash(self, info, seen):
+        cname = c_name(self.name)
+        if cname in seen:
+            raise QAPISemError(
+                info,
+                "%s collides with %s"
+                % (self.describe(info), seen[cname].describe(info)))
+        seen[cname] = self
+
+    def describe(self, info):
+        role = self.role
+        defined_in = self.defined_in
+        assert defined_in
+
+        if defined_in.startswith('q_obj_'):
+            # See QAPISchema._make_implicit_object_type() - reverse the
+            # mapping there to create a nice human-readable description
+            defined_in = defined_in[6:]
+            if defined_in.endswith('-arg'):
+                # Implicit type created for a command's dict 'data'
+                assert role == 'member'
+                role = 'parameter'
+            elif defined_in.endswith('-base'):
+                # Implicit type created for a flat union's dict 'base'
+                role = 'base ' + role
+            else:
+                # Implicit type created for a simple union's branch
+                assert defined_in.endswith('-wrapper')
+                # Unreachable and not implemented
+                assert False
+        elif defined_in.endswith('Kind'):
+            # See QAPISchema._make_implicit_enum_type()
+            # Implicit enum created for simple union's branches
+            assert role == 'value'
+            role = 'branch'
+        elif defined_in != info.defn_name:
+            return "%s '%s' of type '%s'" % (role, self.name, defined_in)
+        return "%s '%s'" % (role, self.name)
+
+
+class QAPISchemaEnumMember(QAPISchemaMember):
+    role = 'value'
+
+
+class QAPISchemaFeature(QAPISchemaMember):
+    role = 'feature'
+
+
+class QAPISchemaObjectTypeMember(QAPISchemaMember):
+    def __init__(self, name, info, typ, optional, ifcond=None):
+        QAPISchemaMember.__init__(self, name, info, ifcond)
+        assert isinstance(typ, str)
+        assert isinstance(optional, bool)
+        self._type_name = typ
+        self.type = None
+        self.optional = optional
+
+    def check(self, schema):
+        assert self.defined_in
+        self.type = schema.resolve_type(self._type_name, self.info,
+                                        self.describe)
+
+
+class QAPISchemaObjectTypeVariants(object):
+    def __init__(self, tag_name, info, tag_member, variants):
+        # Flat unions pass tag_name but not tag_member.
+        # Simple unions and alternates pass tag_member but not tag_name.
+        # After check(), tag_member is always set, and tag_name remains
+        # a reliable witness of being used by a flat union.
+        assert bool(tag_member) != bool(tag_name)
+        assert (isinstance(tag_name, str) or
+                isinstance(tag_member, QAPISchemaObjectTypeMember))
+        for v in variants:
+            assert isinstance(v, QAPISchemaObjectTypeVariant)
+        self._tag_name = tag_name
+        self.info = info
+        self.tag_member = tag_member
+        self.variants = variants
+
+    def set_defined_in(self, name):
+        for v in self.variants:
+            v.set_defined_in(name)
+
+    def check(self, schema, seen):
+        if not self.tag_member: # flat union
+            self.tag_member = seen.get(c_name(self._tag_name))
+            base = "'base'"
+            # Pointing to the base type when not implicit would be
+            # nice, but we don't know it here
+            if not self.tag_member or self._tag_name != self.tag_member.name:
+                raise QAPISemError(
+                    self.info,
+                    "discriminator '%s' is not a member of %s"
+                    % (self._tag_name, base))
+            # Here we do:
+            base_type = schema.lookup_type(self.tag_member.defined_in)
+            assert base_type
+            if not base_type.is_implicit():
+                base = "base type '%s'" % self.tag_member.defined_in
+            if not isinstance(self.tag_member.type, QAPISchemaEnumType):
+                raise QAPISemError(
+                    self.info,
+                    "discriminator member '%s' of %s must be of enum type"
+                    % (self._tag_name, base))
+            if self.tag_member.optional:
+                raise QAPISemError(
+                    self.info,
+                    "discriminator member '%s' of %s must not be optional"
+                    % (self._tag_name, base))
+            if self.tag_member.ifcond:
+                raise QAPISemError(
+                    self.info,
+                    "discriminator member '%s' of %s must not be conditional"
+                    % (self._tag_name, base))
+        else:                   # simple union
+            assert isinstance(self.tag_member.type, QAPISchemaEnumType)
+            assert not self.tag_member.optional
+            assert self.tag_member.ifcond == []
+        if self._tag_name:    # flat union
+            # branches that are not explicitly covered get an empty type
+            cases = set([v.name for v in self.variants])
+            for m in self.tag_member.type.members:
+                if m.name not in cases:
+                    v = QAPISchemaObjectTypeVariant(m.name, self.info,
+                                                    'q_empty', m.ifcond)
+                    v.set_defined_in(self.tag_member.defined_in)
+                    self.variants.append(v)
+        if not self.variants:
+            raise QAPISemError(self.info, "union has no branches")
+        for v in self.variants:
+            v.check(schema)
+            # Union names must match enum values; alternate names are
+            # checked separately. Use 'seen' to tell the two apart.
+            if seen:
+                if v.name not in self.tag_member.type.member_names():
+                    raise QAPISemError(
+                        self.info,
+                        "branch '%s' is not a value of %s"
+                        % (v.name, self.tag_member.type.describe()))
+                if (not isinstance(v.type, QAPISchemaObjectType)
+                        or v.type.variants):
+                    raise QAPISemError(
+                        self.info,
+                        "%s cannot use %s"
+                        % (v.describe(self.info), v.type.describe()))
+                v.type.check(schema)
+
+    def check_clash(self, info, seen):
+        for v in self.variants:
+            # Reset seen map for each variant, since qapi names from one
+            # branch do not affect another branch
+            v.type.check_clash(info, dict(seen))
+
+
+class QAPISchemaObjectTypeVariant(QAPISchemaObjectTypeMember):
+    role = 'branch'
+
+    def __init__(self, name, info, typ, ifcond=None):
+        QAPISchemaObjectTypeMember.__init__(self, name, info, typ,
+                                            False, ifcond)
+
+
+class QAPISchemaAlternateType(QAPISchemaType):
+    meta = 'alternate'
+
+    def __init__(self, name, info, doc, ifcond, variants):
+        QAPISchemaType.__init__(self, name, info, doc, ifcond)
+        assert isinstance(variants, QAPISchemaObjectTypeVariants)
+        assert variants.tag_member
+        variants.set_defined_in(name)
+        variants.tag_member.set_defined_in(self.name)
+        self.variants = variants
+
+    def check(self, schema):
+        QAPISchemaType.check(self, schema)
+        self.variants.tag_member.check(schema)
+        # Not calling self.variants.check_clash(), because there's nothing
+        # to clash with
+        self.variants.check(schema, {})
+        # Alternate branch names have no relation to the tag enum values;
+        # so we have to check for potential name collisions ourselves.
+        seen = {}
+        types_seen = {}
+        for v in self.variants.variants:
+            v.check_clash(self.info, seen)
+            qtype = v.type.alternate_qtype()
+            if not qtype:
+                raise QAPISemError(
+                    self.info,
+                    "%s cannot use %s"
+                    % (v.describe(self.info), v.type.describe()))
+            conflicting = set([qtype])
+            if qtype == 'QTYPE_QSTRING':
+                if isinstance(v.type, QAPISchemaEnumType):
+                    for m in v.type.members:
+                        if m.name in ['on', 'off']:
+                            conflicting.add('QTYPE_QBOOL')
+                        if re.match(r'[-+0-9.]', m.name):
+                            # lazy, could be tightened
+                            conflicting.add('QTYPE_QNUM')
+                else:
+                    conflicting.add('QTYPE_QNUM')
+                    conflicting.add('QTYPE_QBOOL')
+            for qt in conflicting:
+                if qt in types_seen:
+                    raise QAPISemError(
+                        self.info,
+                        "%s can't be distinguished from '%s'"
+                        % (v.describe(self.info), types_seen[qt]))
+                types_seen[qt] = v.name
+            if self.doc:
+                self.doc.connect_member(v)
+        if self.doc:
+            self.doc.check()
+
+    def c_type(self):
+        return c_name(self.name) + pointer_suffix
+
+    def json_type(self):
+        return 'value'
+
+    def visit(self, visitor):
+        QAPISchemaType.visit(self, visitor)
+        visitor.visit_alternate_type(self.name, self.info, self.ifcond,
+                                     self.variants)
+
+
+class QAPISchemaCommand(QAPISchemaEntity):
+    meta = 'command'
+
+    def __init__(self, name, info, doc, ifcond, arg_type, ret_type,
+                 gen, success_response, boxed, allow_oob, allow_preconfig,
+                 features):
+        QAPISchemaEntity.__init__(self, name, info, doc, ifcond)
+        assert not arg_type or isinstance(arg_type, str)
+        assert not ret_type or isinstance(ret_type, str)
+        for f in features:
+            assert isinstance(f, QAPISchemaFeature)
+            f.set_defined_in(name)
+        self._arg_type_name = arg_type
+        self.arg_type = None
+        self._ret_type_name = ret_type
+        self.ret_type = None
+        self.gen = gen
+        self.success_response = success_response
+        self.boxed = boxed
+        self.allow_oob = allow_oob
+        self.allow_preconfig = allow_preconfig
+        self.features = features
+
+    def check(self, schema):
+        QAPISchemaEntity.check(self, schema)
+        if self._arg_type_name:
+            self.arg_type = schema.resolve_type(
+                self._arg_type_name, self.info, "command's 'data'")
+            if not isinstance(self.arg_type, QAPISchemaObjectType):
+                raise QAPISemError(
+                    self.info,
+                    "command's 'data' cannot take %s"
+                    % self.arg_type.describe())
+            if self.arg_type.variants and not self.boxed:
+                raise QAPISemError(
+                    self.info,
+                    "command's 'data' can take %s only with 'boxed': true"
+                    % self.arg_type.describe())
+        if self._ret_type_name:
+            self.ret_type = schema.resolve_type(
+                self._ret_type_name, self.info, "command's 'returns'")
+            if self.name not in self.info.pragma.returns_whitelist:
+                if not (isinstance(self.ret_type, QAPISchemaObjectType)
+                        or (isinstance(self.ret_type, QAPISchemaArrayType)
+                            and isinstance(self.ret_type.element_type,
+                                           QAPISchemaObjectType))):
+                    raise QAPISemError(
+                        self.info,
+                        "command's 'returns' cannot take %s"
+                        % self.ret_type.describe())
+
+        # Features are in a name space separate from members
+        seen = {}
+        for f in self.features:
+            f.check_clash(self.info, seen)
+
+    def visit(self, visitor):
+        QAPISchemaEntity.visit(self, visitor)
+        visitor.visit_command(self.name, self.info, self.ifcond,
+                              self.arg_type, self.ret_type,
+                              self.gen, self.success_response,
+                              self.boxed, self.allow_oob,
+                              self.allow_preconfig,
+                              self.features)
+
+
+class QAPISchemaEvent(QAPISchemaEntity):
+    meta = 'event'
+
+    def __init__(self, name, info, doc, ifcond, arg_type, boxed):
+        QAPISchemaEntity.__init__(self, name, info, doc, ifcond)
+        assert not arg_type or isinstance(arg_type, str)
+        self._arg_type_name = arg_type
+        self.arg_type = None
+        self.boxed = boxed
+
+    def check(self, schema):
+        QAPISchemaEntity.check(self, schema)
+        if self._arg_type_name:
+            self.arg_type = schema.resolve_type(
+                self._arg_type_name, self.info, "event's 'data'")
+            if not isinstance(self.arg_type, QAPISchemaObjectType):
+                raise QAPISemError(
+                    self.info,
+                    "event's 'data' cannot take %s"
+                    % self.arg_type.describe())
+            if self.arg_type.variants and not self.boxed:
+                raise QAPISemError(
+                    self.info,
+                    "event's 'data' can take %s only with 'boxed': true"
+                    % self.arg_type.describe())
+
+    def visit(self, visitor):
+        QAPISchemaEntity.visit(self, visitor)
+        visitor.visit_event(self.name, self.info, self.ifcond,
+                            self.arg_type, self.boxed)
+
+
+class QAPISchema(object):
+    def __init__(self, fname):
+        self.fname = fname
+        parser = QAPISchemaParser(fname)
+        exprs = check_exprs(parser.exprs)
+        self.docs = parser.docs
+        self._entity_list = []
+        self._entity_dict = {}
+        self._predefining = True
+        self._def_predefineds()
+        self._predefining = False
+        self._def_exprs(exprs)
+        self.check()
+
+    def _def_entity(self, ent):
+        # Only the predefined types are allowed to not have info
+        assert ent.info or self._predefining
+        self._entity_list.append(ent)
+        if ent.name is None:
+            return
+        # TODO reject names that differ only in '_' vs. '.'  vs. '-',
+        # because they're liable to clash in generated C.
+        other_ent = self._entity_dict.get(ent.name)
+        if other_ent:
+            if other_ent.info:
+                where = QAPIError(other_ent.info, None, "previous definition")
+                raise QAPISemError(
+                    ent.info,
+                    "'%s' is already defined\n%s" % (ent.name, where))
+            raise QAPISemError(
+                ent.info, "%s is already defined" % other_ent.describe())
+        self._entity_dict[ent.name] = ent
+
+    def lookup_entity(self, name, typ=None):
+        ent = self._entity_dict.get(name)
+        if typ and not isinstance(ent, typ):
+            return None
+        return ent
+
+    def lookup_type(self, name):
+        return self.lookup_entity(name, QAPISchemaType)
+
+    def resolve_type(self, name, info, what):
+        typ = self.lookup_type(name)
+        if not typ:
+            if callable(what):
+                what = what(info)
+            raise QAPISemError(
+                info, "%s uses unknown type '%s'" % (what, name))
+        return typ
+
+    def _def_include(self, expr, info, doc):
+        include = expr['include']
+        assert doc is None
+        main_info = info
+        while main_info.parent:
+            main_info = main_info.parent
+        fname = os.path.relpath(include, os.path.dirname(main_info.fname))
+        self._def_entity(QAPISchemaInclude(fname, info))
+
+    def _def_builtin_type(self, name, json_type, c_type):
+        self._def_entity(QAPISchemaBuiltinType(name, json_type, c_type))
+        # Instantiating only the arrays that are actually used would
+        # be nice, but we can't as long as their generated code
+        # (qapi-builtin-types.[ch]) may be shared by some other
+        # schema.
+        self._make_array_type(name, None)
+
+    def _def_predefineds(self):
+        for t in [('str',    'string',  'char' + pointer_suffix),
+                  ('number', 'number',  'double'),
+                  ('int',    'int',     'int64_t'),
+                  ('int8',   'int',     'int8_t'),
+                  ('int16',  'int',     'int16_t'),
+                  ('int32',  'int',     'int32_t'),
+                  ('int64',  'int',     'int64_t'),
+                  ('uint8',  'int',     'uint8_t'),
+                  ('uint16', 'int',     'uint16_t'),
+                  ('uint32', 'int',     'uint32_t'),
+                  ('uint64', 'int',     'uint64_t'),
+                  ('size',   'int',     'uint64_t'),
+                  ('bool',   'boolean', 'bool'),
+                  ('any',    'value',   'QObject' + pointer_suffix),
+                  ('null',   'null',    'QNull' + pointer_suffix)]:
+            self._def_builtin_type(*t)
+        self.the_empty_object_type = QAPISchemaObjectType(
+            'q_empty', None, None, None, None, [], None, [])
+        self._def_entity(self.the_empty_object_type)
+
+        qtypes = ['none', 'qnull', 'qnum', 'qstring', 'qdict', 'qlist',
+                  'qbool']
+        qtype_values = self._make_enum_members(
+            [{'name': n} for n in qtypes], None)
+
+        self._def_entity(QAPISchemaEnumType('QType', None, None, None,
+                                            qtype_values, 'QTYPE'))
+
+    def _make_features(self, features, info):
+        return [QAPISchemaFeature(f['name'], info, f.get('if'))
+                for f in features]
+
+    def _make_enum_members(self, values, info):
+        return [QAPISchemaEnumMember(v['name'], info, v.get('if'))
+                for v in values]
+
+    def _make_implicit_enum_type(self, name, info, ifcond, values):
+        # See also QAPISchemaObjectTypeMember.describe()
+        name = name + 'Kind'    # reserved by check_defn_name_str()
+        self._def_entity(QAPISchemaEnumType(
+            name, info, None, ifcond, self._make_enum_members(values, info),
+            None))
+        return name
+
+    def _make_array_type(self, element_type, info):
+        name = element_type + 'List'    # reserved by check_defn_name_str()
+        if not self.lookup_type(name):
+            self._def_entity(QAPISchemaArrayType(name, info, element_type))
+        return name
+
+    def _make_implicit_object_type(self, name, info, doc, ifcond,
+                                   role, members):
+        if not members:
+            return None
+        # See also QAPISchemaObjectTypeMember.describe()
+        name = 'q_obj_%s-%s' % (name, role)
+        typ = self.lookup_entity(name, QAPISchemaObjectType)
+        if typ:
+            # The implicit object type has multiple users.  This can
+            # happen only for simple unions' implicit wrapper types.
+            # Its ifcond should be the disjunction of its user's
+            # ifconds.  Not implemented.  Instead, we always pass the
+            # wrapped type's ifcond, which is trivially the same for all
+            # users.  It's also necessary for the wrapper to compile.
+            # But it's not tight: the disjunction need not imply it.  We
+            # may end up compiling useless wrapper types.
+            # TODO kill simple unions or implement the disjunction
+            assert (ifcond or []) == typ._ifcond # pylint: disable=protected-access
+        else:
+            self._def_entity(QAPISchemaObjectType(name, info, doc, ifcond,
+                                                  None, members, None, []))
+        return name
+
+    def _def_enum_type(self, expr, info, doc):
+        name = expr['enum']
+        data = expr['data']
+        prefix = expr.get('prefix')
+        ifcond = expr.get('if')
+        self._def_entity(QAPISchemaEnumType(
+            name, info, doc, ifcond,
+            self._make_enum_members(data, info), prefix))
+
+    def _make_member(self, name, typ, ifcond, info):
+        optional = False
+        if name.startswith('*'):
+            name = name[1:]
+            optional = True
+        if isinstance(typ, list):
+            assert len(typ) == 1
+            typ = self._make_array_type(typ[0], info)
+        return QAPISchemaObjectTypeMember(name, info, typ, optional, ifcond)
+
+    def _make_members(self, data, info):
+        return [self._make_member(key, value['type'], value.get('if'), info)
+                for (key, value) in data.items()]
+
+    def _def_struct_type(self, expr, info, doc):
+        name = expr['struct']
+        base = expr.get('base')
+        data = expr['data']
+        ifcond = expr.get('if')
+        features = expr.get('features', [])
+        self._def_entity(QAPISchemaObjectType(
+            name, info, doc, ifcond, base,
+            self._make_members(data, info),
+            None,
+            self._make_features(features, info)))
+
+    def _make_variant(self, case, typ, ifcond, info):
+        return QAPISchemaObjectTypeVariant(case, info, typ, ifcond)
+
+    def _make_simple_variant(self, case, typ, ifcond, info):
+        if isinstance(typ, list):
+            assert len(typ) == 1
+            typ = self._make_array_type(typ[0], info)
+        typ = self._make_implicit_object_type(
+            typ, info, None, self.lookup_type(typ),
+            'wrapper', [self._make_member('data', typ, None, info)])
+        return QAPISchemaObjectTypeVariant(case, info, typ, ifcond)
+
+    def _def_union_type(self, expr, info, doc):
+        name = expr['union']
+        data = expr['data']
+        base = expr.get('base')
+        ifcond = expr.get('if')
+        tag_name = expr.get('discriminator')
+        tag_member = None
+        if isinstance(base, dict):
+            base = self._make_implicit_object_type(
+                name, info, doc, ifcond,
+                'base', self._make_members(base, info))
+        if tag_name:
+            variants = [self._make_variant(key, value['type'],
+                                           value.get('if'), info)
+                        for (key, value) in data.items()]
+            members = []
+        else:
+            variants = [self._make_simple_variant(key, value['type'],
+                                                  value.get('if'), info)
+                        for (key, value) in data.items()]
+            enum = [{'name': v.name, 'if': v.ifcond} for v in variants]
+            typ = self._make_implicit_enum_type(name, info, ifcond, enum)
+            tag_member = QAPISchemaObjectTypeMember('type', info, typ, False)
+            members = [tag_member]
+        self._def_entity(
+            QAPISchemaObjectType(name, info, doc, ifcond, base, members,
+                                 QAPISchemaObjectTypeVariants(
+                                     tag_name, info, tag_member, variants),
+                                 []))
+
+    def _def_alternate_type(self, expr, info, doc):
+        name = expr['alternate']
+        data = expr['data']
+        ifcond = expr.get('if')
+        variants = [self._make_variant(key, value['type'], value.get('if'),
+                                       info)
+                    for (key, value) in data.items()]
+        tag_member = QAPISchemaObjectTypeMember('type', info, 'QType', False)
+        self._def_entity(
+            QAPISchemaAlternateType(name, info, doc, ifcond,
+                                    QAPISchemaObjectTypeVariants(
+                                        None, info, tag_member, variants)))
+
+    def _def_command(self, expr, info, doc):
+        name = expr['command']
+        data = expr.get('data')
+        rets = expr.get('returns')
+        gen = expr.get('gen', True)
+        success_response = expr.get('success-response', True)
+        boxed = expr.get('boxed', False)
+        allow_oob = expr.get('allow-oob', False)
+        allow_preconfig = expr.get('allow-preconfig', False)
+        ifcond = expr.get('if')
+        features = expr.get('features', [])
+        if isinstance(data, OrderedDict):
+            data = self._make_implicit_object_type(
+                name, info, doc, ifcond, 'arg', self._make_members(data, info))
+        if isinstance(rets, list):
+            assert len(rets) == 1
+            rets = self._make_array_type(rets[0], info)
+        self._def_entity(QAPISchemaCommand(name, info, doc, ifcond, data, rets,
+                                           gen, success_response,
+                                           boxed, allow_oob, allow_preconfig,
+                                           self._make_features(features, info)))
+
+    def _def_event(self, expr, info, doc):
+        name = expr['event']
+        data = expr.get('data')
+        boxed = expr.get('boxed', False)
+        ifcond = expr.get('if')
+        if isinstance(data, OrderedDict):
+            data = self._make_implicit_object_type(
+                name, info, doc, ifcond, 'arg', self._make_members(data, info))
+        self._def_entity(QAPISchemaEvent(name, info, doc, ifcond, data, boxed))
+
+    def _def_exprs(self, exprs):
+        for expr_elem in exprs:
+            expr = expr_elem['expr']
+            info = expr_elem['info']
+            doc = expr_elem.get('doc')
+            if 'enum' in expr:
+                self._def_enum_type(expr, info, doc)
+            elif 'struct' in expr:
+                self._def_struct_type(expr, info, doc)
+            elif 'union' in expr:
+                self._def_union_type(expr, info, doc)
+            elif 'alternate' in expr:
+                self._def_alternate_type(expr, info, doc)
+            elif 'command' in expr:
+                self._def_command(expr, info, doc)
+            elif 'event' in expr:
+                self._def_event(expr, info, doc)
+            elif 'include' in expr:
+                self._def_include(expr, info, doc)
+            else:
+                assert False
+
+    def check(self):
+        for ent in self._entity_list:
+            ent.check(self)
+
+    def visit(self, visitor):
+        visitor.visit_begin(self)
+        module = None
+        visitor.visit_module(module)
+        for entity in self._entity_list:
+            if visitor.visit_needed(entity):
+                if entity.module != module:
+                    module = entity.module
+                    visitor.visit_module(module)
+                entity.visit(visitor)
+        visitor.visit_end()
diff --git a/scripts/qapi/source.py b/scripts/qapi/source.py
new file mode 100644
index 0000000000..8956885033
--- /dev/null
+++ b/scripts/qapi/source.py
@@ -0,0 +1,67 @@
+#
+# QAPI frontend source file info
+#
+# Copyright (c) 2019 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2.
+# See the COPYING file in the top-level directory.
+
+import copy
+import sys
+
+
+class QAPISchemaPragma(object):
+    def __init__(self):
+        # Are documentation comments required?
+        self.doc_required = False
+        # Whitelist of commands allowed to return a non-dictionary
+        self.returns_whitelist = []
+        # Whitelist of entities allowed to violate case conventions
+        self.name_case_whitelist = []
+
+
+class QAPISourceInfo(object):
+    def __init__(self, fname, line, parent):
+        self.fname = fname
+        self.line = line
+        self.parent = parent
+        self.pragma = parent.pragma if parent else QAPISchemaPragma()
+        self.defn_meta = None
+        self.defn_name = None
+
+    def set_defn(self, meta, name):
+        self.defn_meta = meta
+        self.defn_name = name
+
+    def next_line(self):
+        info = copy.copy(self)
+        info.line += 1
+        return info
+
+    def loc(self):
+        if self.fname is None:
+            return sys.argv[0]
+        ret = self.fname
+        if self.line is not None:
+            ret += ':%d' % self.line
+        return ret
+
+    def in_defn(self):
+        if self.defn_name:
+            return "%s: In %s '%s':\n" % (self.fname,
+                                          self.defn_meta, self.defn_name)
+        return ''
+
+    def include_path(self):
+        ret = ''
+        parent = self.parent
+        while parent:
+            ret = 'In file included from %s:\n' % parent.loc() + ret
+            parent = parent.parent
+        return ret
+
+    def __str__(self):
+        return self.include_path() + self.in_defn() + self.loc()
diff --git a/scripts/qapi/types.py b/scripts/qapi/types.py
index 3edd9374aa..d8751daa04 100644
--- a/scripts/qapi/types.py
+++ b/scripts/qapi/types.py
@@ -14,6 +14,8 @@ This work is licensed under the terms of the GNU GPL, version 2.
 """
 
 from qapi.common import *
+from qapi.gen import QAPISchemaModularCVisitor, ifcontext
+from qapi.schema import QAPISchemaEnumMember, QAPISchemaObjectType
 
 
 # variants must be emitted before their container; track what has already
@@ -21,6 +23,65 @@ from qapi.common import *
 objects_seen = set()
 
 
+def gen_enum_lookup(name, members, prefix=None):
+    ret = mcgen('''
+
+const QEnumLookup %(c_name)s_lookup = {
+    .array = (const char *const[]) {
+''',
+                c_name=c_name(name))
+    for m in members:
+        ret += gen_if(m.ifcond)
+        index = c_enum_const(name, m.name, prefix)
+        ret += mcgen('''
+        [%(index)s] = "%(name)s",
+''',
+                     index=index, name=m.name)
+        ret += gen_endif(m.ifcond)
+
+    ret += mcgen('''
+    },
+    .size = %(max_index)s
+};
+''',
+                 max_index=c_enum_const(name, '_MAX', prefix))
+    return ret
+
+
+def gen_enum(name, members, prefix=None):
+    # append automatically generated _MAX value
+    enum_members = members + [QAPISchemaEnumMember('_MAX', None)]
+
+    ret = mcgen('''
+
+typedef enum %(c_name)s {
+''',
+                c_name=c_name(name))
+
+    for m in enum_members:
+        ret += gen_if(m.ifcond)
+        ret += mcgen('''
+    %(c_enum)s,
+''',
+                     c_enum=c_enum_const(name, m.name, prefix))
+        ret += gen_endif(m.ifcond)
+
+    ret += mcgen('''
+} %(c_name)s;
+''',
+                 c_name=c_name(name))
+
+    ret += mcgen('''
+
+#define %(c_name)s_str(val) \\
+    qapi_enum_lookup(&%(c_name)s_lookup, (val))
+
+extern const QEnumLookup %(c_name)s_lookup;
+''',
+                 c_name=c_name(name))
+    return ret
+
+
 def gen_fwd_object_or_array(name):
     return mcgen('''
 
diff --git a/scripts/qapi/visit.py b/scripts/qapi/visit.py
index 484ebb66ad..c72f2bc5c0 100644
--- a/scripts/qapi/visit.py
+++ b/scripts/qapi/visit.py
@@ -14,6 +14,8 @@ See the COPYING file in the top-level directory.
 """
 
 from qapi.common import *
+from qapi.gen import QAPISchemaModularCVisitor, ifcontext
+from qapi.schema import QAPISchemaObjectType
 
 
 def gen_visit_decl(name, scalar=False):
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 13813fb213..ab3e1a0361 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -406,6 +406,7 @@ static void arm_cpu_reset(CPUState *s)
 
     hw_breakpoint_update_all(cpu);
     hw_watchpoint_update_all(cpu);
+    arm_rebuild_hflags(env);
 }
 
 bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 297ad5e47a..d844ea21d8 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -231,6 +231,9 @@ typedef struct CPUARMState {
     uint32_t pstate;
     uint32_t aarch64; /* 1 if CPU is in aarch64 state; inverse of PSTATE.nRW */
 
+    /* Cached TBFLAGS state.  See below for which bits are included.  */
+    uint32_t hflags;
+
     /* Frequently accessed CPSR bits are stored separately for efficiency.
        This contains all the other bits.  Use cpsr_{read,write} to access
        the whole CPSR.  */
@@ -3105,33 +3108,44 @@ static inline uint64_t arm_sctlr(CPUARMState *env, int el)
     }
 }
 
+static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
+                                                  bool sctlr_b)
+{
+#ifdef CONFIG_USER_ONLY
+    /*
+     * In system mode, BE32 is modelled in line with the
+     * architecture (as word-invariant big-endianness), where loads
+     * and stores are done little endian but from addresses which
+     * are adjusted by XORing with the appropriate constant. So the
+     * endianness to use for the raw data access is not affected by
+     * SCTLR.B.
+     * In user mode, however, we model BE32 as byte-invariant
+     * big-endianness (because user-only code cannot tell the
+     * difference), and so we need to use a data access endianness
+     * that depends on SCTLR.B.
+     */
+    if (sctlr_b) {
+        return true;
+    }
+#endif
+    /* In 32bit endianness is determined by looking at CPSR's E bit */
+    return env->uncached_cpsr & CPSR_E;
+}
+
+static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
+{
+    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
+}
 
 /* Return true if the processor is in big-endian mode. */
 static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
 {
-    /* In 32bit endianness is determined by looking at CPSR's E bit */
     if (!is_a64(env)) {
-        return
-#ifdef CONFIG_USER_ONLY
-            /* In system mode, BE32 is modelled in line with the
-             * architecture (as word-invariant big-endianness), where loads
-             * and stores are done little endian but from addresses which
-             * are adjusted by XORing with the appropriate constant. So the
-             * endianness to use for the raw data access is not affected by
-             * SCTLR.B.
-             * In user mode, however, we model BE32 as byte-invariant
-             * big-endianness (because user-only code cannot tell the
-             * difference), and so we need to use a data access endianness
-             * that depends on SCTLR.B.
-             */
-            arm_sctlr_b(env) ||
-#endif
-                ((env->uncached_cpsr & CPSR_E) ? 1 : 0);
+        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
     } else {
         int cur_el = arm_current_el(env);
         uint64_t sctlr = arm_sctlr(env, cur_el);
-
-        return (sctlr & (cur_el ? SCTLR_EE : SCTLR_E0E)) != 0;
+        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
     }
 }
 
@@ -3140,15 +3154,18 @@ typedef ARMCPU ArchCPU;
 
 #include "exec/cpu-all.h"
 
-/* Bit usage in the TB flags field: bit 31 indicates whether we are
+/*
+ * Bit usage in the TB flags field: bit 31 indicates whether we are
  * in 32 or 64 bit mode. The meaning of the other bits depends on that.
  * We put flags which are shared between 32 and 64 bit mode at the top
  * of the word, and flags which apply to only one mode at the bottom.
+ *
+ * Unless otherwise noted, these bits are cached in env->hflags.
  */
 FIELD(TBFLAG_ANY, AARCH64_STATE, 31, 1)
 FIELD(TBFLAG_ANY, MMUIDX, 28, 3)
 FIELD(TBFLAG_ANY, SS_ACTIVE, 27, 1)
-FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1)
+FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1)     /* Not cached. */
 /* Target EL if we take a floating-point-disabled exception */
 FIELD(TBFLAG_ANY, FPEXC_EL, 24, 2)
 FIELD(TBFLAG_ANY, BE_DATA, 23, 1)
@@ -3159,13 +3176,14 @@ FIELD(TBFLAG_ANY, BE_DATA, 23, 1)
 FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 21, 2)
 
 /* Bit usage when in AArch32 state: */
-FIELD(TBFLAG_A32, THUMB, 0, 1)
-FIELD(TBFLAG_A32, VECLEN, 1, 3)
-FIELD(TBFLAG_A32, VECSTRIDE, 4, 2)
+FIELD(TBFLAG_A32, THUMB, 0, 1)          /* Not cached. */
+FIELD(TBFLAG_A32, VECLEN, 1, 3)         /* Not cached. */
+FIELD(TBFLAG_A32, VECSTRIDE, 4, 2)      /* Not cached. */
 /*
  * We store the bottom two bits of the CPAR as TB flags and handle
  * checks on the other bits at runtime. This shares the same bits as
  * VECSTRIDE, which is OK as no XScale CPU has VFP.
+ * Not cached, because VECLEN+VECSTRIDE are not cached.
  */
 FIELD(TBFLAG_A32, XSCALE_CPAR, 4, 2)
 /*
@@ -3174,15 +3192,15 @@ FIELD(TBFLAG_A32, XSCALE_CPAR, 4, 2)
  * the same thing as the current security state of the processor!
  */
 FIELD(TBFLAG_A32, NS, 6, 1)
-FIELD(TBFLAG_A32, VFPEN, 7, 1)
-FIELD(TBFLAG_A32, CONDEXEC, 8, 8)
+FIELD(TBFLAG_A32, VFPEN, 7, 1)          /* Partially cached, minus FPEXC. */
+FIELD(TBFLAG_A32, CONDEXEC, 8, 8)       /* Not cached. */
 FIELD(TBFLAG_A32, SCTLR_B, 16, 1)
 /* For M profile only, set if FPCCR.LSPACT is set */
-FIELD(TBFLAG_A32, LSPACT, 18, 1)
+FIELD(TBFLAG_A32, LSPACT, 18, 1)        /* Not cached. */
 /* For M profile only, set if we must create a new FP context */
-FIELD(TBFLAG_A32, NEW_FP_CTXT_NEEDED, 19, 1)
+FIELD(TBFLAG_A32, NEW_FP_CTXT_NEEDED, 19, 1) /* Not cached. */
 /* For M profile only, set if FPCCR.S does not match current security state */
-FIELD(TBFLAG_A32, FPCCR_S_WRONG, 20, 1)
+FIELD(TBFLAG_A32, FPCCR_S_WRONG, 20, 1) /* Not cached. */
 /* For M profile only, Handler (ie not Thread) mode */
 FIELD(TBFLAG_A32, HANDLER, 21, 1)
 /* For M profile only, whether we should generate stack-limit checks */
@@ -3194,7 +3212,7 @@ FIELD(TBFLAG_A64, SVEEXC_EL, 2, 2)
 FIELD(TBFLAG_A64, ZCR_LEN, 4, 4)
 FIELD(TBFLAG_A64, PAUTH_ACTIVE, 8, 1)
 FIELD(TBFLAG_A64, BT, 9, 1)
-FIELD(TBFLAG_A64, BTYPE, 10, 2)
+FIELD(TBFLAG_A64, BTYPE, 10, 2)         /* Not cached. */
 FIELD(TBFLAG_A64, TBID, 12, 2)
 
 static inline bool bswap_code(bool sctlr_b)
@@ -3280,6 +3298,12 @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook, void
         *opaque);
 
 /**
+ * arm_rebuild_hflags:
+ * Rebuild the cached TBFLAGS for arbitrary changed processor state.
+ */
+void arm_rebuild_hflags(CPUARMState *env);
+
+/**
  * aa32_vfp_dreg:
  * Return a pointer to the Dn register within env in 32-bit mode.
  */
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index bca80bdc38..b4cd680fc4 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1025,6 +1025,7 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         } else {
             env->regs[15] = new_pc & ~0x3;
         }
+        helper_rebuild_hflags_a32(env, new_el);
         qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
                       "AArch32 EL%d PC 0x%" PRIx32 "\n",
                       cur_el, new_el, env->regs[15]);
@@ -1036,10 +1037,12 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         }
         aarch64_restore_sp(env, new_el);
         env->pc = new_pc;
+        helper_rebuild_hflags_a64(env, new_el);
         qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
                       "AArch64 EL%d PC 0x%" PRIx64 "\n",
                       cur_el, new_el, env->pc);
     }
+
     /*
      * Note that cur_el can never be 0.  If new_el is 0, then
      * el0_a64 is return_to_aa64, else el0_a64 is ignored.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0d9a2d2ab7..63815fc4cf 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4174,6 +4174,16 @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     /* ??? Lots of these bits are not implemented.  */
     /* This may enable/disable the MMU, so do a TLB flush.  */
     tlb_flush(CPU(cpu));
+
+    if (ri->type & ARM_CP_SUPPRESS_TB_END) {
+        /*
+         * Normally we would always end the TB on an SCTLR write; see the
+         * comment in ARMCPRegInfo sctlr initialization below for why Xscale
+         * is special.  Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild
+         * of hflags from the translator, so do it here.
+         */
+        arm_rebuild_hflags(env);
+    }
 }
 
 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -7998,6 +8008,7 @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
         env->regs[14] = env->regs[15] + offset;
     }
     env->regs[15] = newpc;
+    arm_rebuild_hflags(env);
 }
 
 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
@@ -8345,6 +8356,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     pstate_write(env, PSTATE_DAIF | new_mode);
     env->aarch64 = 1;
     aarch64_restore_sp(env, new_el);
+    helper_rebuild_hflags_a64(env, new_el);
 
     env->pc = addr;
 
@@ -11026,15 +11038,12 @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 }
 #endif
 
-ARMMMUIdx arm_mmu_idx(CPUARMState *env)
+ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
 {
-    int el;
-
     if (arm_feature(env, ARM_FEATURE_M)) {
         return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
     }
 
-    el = arm_current_el(env);
     if (el < 2 && arm_is_secure_below_el3(env)) {
         return ARMMMUIdx_S1SE0 + el;
     } else {
@@ -11042,6 +11051,11 @@ ARMMMUIdx arm_mmu_idx(CPUARMState *env)
     }
 }
 
+ARMMMUIdx arm_mmu_idx(CPUARMState *env)
+{
+    return arm_mmu_idx_el(env, arm_current_el(env));
+}
+
 int cpu_mmu_index(CPUARMState *env, bool ifetch)
 {
     return arm_to_core_mmu_idx(arm_mmu_idx(env));
@@ -11054,171 +11068,276 @@ ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
 }
 #endif
 
-void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *pflags)
+static uint32_t rebuild_hflags_common(CPUARMState *env, int fp_el,
+                                      ARMMMUIdx mmu_idx, uint32_t flags)
+{
+    flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el);
+    flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX,
+                       arm_to_core_mmu_idx(mmu_idx));
+
+    if (arm_singlestep_active(env)) {
+        flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1);
+    }
+    return flags;
+}
+
+static uint32_t rebuild_hflags_common_32(CPUARMState *env, int fp_el,
+                                         ARMMMUIdx mmu_idx, uint32_t flags)
+{
+    bool sctlr_b = arm_sctlr_b(env);
+
+    if (sctlr_b) {
+        flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, 1);
+    }
+    if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
+        flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
+    }
+    flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env));
+
+    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
+}
+
+static uint32_t rebuild_hflags_m32(CPUARMState *env, int fp_el,
+                                   ARMMMUIdx mmu_idx)
 {
-    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
-    int current_el = arm_current_el(env);
-    int fp_el = fp_exception_el(env, current_el);
     uint32_t flags = 0;
 
-    if (is_a64(env)) {
-        ARMCPU *cpu = env_archcpu(env);
-        uint64_t sctlr;
+    /* v8M always enables the fpu.  */
+    flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
 
-        *pc = env->pc;
-        flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
+    if (arm_v7m_is_handler_mode(env)) {
+        flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1);
+    }
 
-        /* Get control bits for tagged addresses.  */
-        {
-            ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
-            ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1);
-            int tbii, tbid;
-
-            /* FIXME: ARMv8.1-VHE S2 translation regime.  */
-            if (regime_el(env, stage1) < 2) {
-                ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1);
-                tbid = (p1.tbi << 1) | p0.tbi;
-                tbii = tbid & ~((p1.tbid << 1) | p0.tbid);
-            } else {
-                tbid = p0.tbi;
-                tbii = tbid & !p0.tbid;
-            }
+    /*
+     * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
+     * is suppressing them because the requested execution priority
+     * is less than 0.
+     */
+    if (arm_feature(env, ARM_FEATURE_V8) &&
+        !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
+          (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
+        flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1);
+    }
 
-            flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
-            flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
-        }
+    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
+}
 
-        if (cpu_isar_feature(aa64_sve, cpu)) {
-            int sve_el = sve_exception_el(env, current_el);
-            uint32_t zcr_len;
+static uint32_t rebuild_hflags_aprofile(CPUARMState *env)
+{
+    int flags = 0;
 
-            /* If SVE is disabled, but FP is enabled,
-             * then the effective len is 0.
-             */
-            if (sve_el != 0 && fp_el == 0) {
-                zcr_len = 0;
-            } else {
-                zcr_len = sve_zcr_len_for_el(env, current_el);
-            }
-            flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el);
-            flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len);
-        }
+    flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL,
+                       arm_debug_target_el(env));
+    return flags;
+}
 
-        sctlr = arm_sctlr(env, current_el);
+static uint32_t rebuild_hflags_a32(CPUARMState *env, int fp_el,
+                                   ARMMMUIdx mmu_idx)
+{
+    uint32_t flags = rebuild_hflags_aprofile(env);
 
-        if (cpu_isar_feature(aa64_pauth, cpu)) {
-            /*
-             * In order to save space in flags, we record only whether
-             * pauth is "inactive", meaning all insns are implemented as
-             * a nop, or "active" when some action must be performed.
-             * The decision of which action to take is left to a helper.
-             */
-            if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
-                flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1);
-            }
-        }
+    if (arm_el_is_aa64(env, 1)) {
+        flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
+    }
+    return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
+}
 
-        if (cpu_isar_feature(aa64_bti, cpu)) {
-            /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
-            if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
-                flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1);
-            }
-            flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);
-        }
+static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+                                   ARMMMUIdx mmu_idx)
+{
+    uint32_t flags = rebuild_hflags_aprofile(env);
+    ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
+    ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1);
+    uint64_t sctlr;
+    int tbii, tbid;
+
+    flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
+
+    /* FIXME: ARMv8.1-VHE S2 translation regime.  */
+    if (regime_el(env, stage1) < 2) {
+        ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1);
+        tbid = (p1.tbi << 1) | p0.tbi;
+        tbii = tbid & ~((p1.tbid << 1) | p0.tbid);
     } else {
-        *pc = env->regs[15];
-        flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb);
-        flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len);
-        flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride);
-        flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits);
-        flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env));
-        flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env));
-        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
-            || arm_el_is_aa64(env, 1) || arm_feature(env, ARM_FEATURE_M)) {
-            flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
-        }
-        /* Note that XSCALE_CPAR shares bits with VECSTRIDE */
-        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-            flags = FIELD_DP32(flags, TBFLAG_A32,
-                               XSCALE_CPAR, env->cp15.c15_cpar);
-        }
+        tbid = p0.tbi;
+        tbii = tbid & !p0.tbid;
     }
 
-    flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
+    flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
+    flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
 
-    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
-     * states defined in the ARM ARM for software singlestep:
-     *  SS_ACTIVE   PSTATE.SS   State
-     *     0            x       Inactive (the TB flag for SS is always 0)
-     *     1            0       Active-pending
-     *     1            1       Active-not-pending
-     */
-    if (arm_singlestep_active(env)) {
-        flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1);
-        if (is_a64(env)) {
-            if (env->pstate & PSTATE_SS) {
-                flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
-            }
+    if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
+        int sve_el = sve_exception_el(env, el);
+        uint32_t zcr_len;
+
+        /*
+         * If SVE is disabled, but FP is enabled,
+         * then the effective len is 0.
+         */
+        if (sve_el != 0 && fp_el == 0) {
+            zcr_len = 0;
         } else {
-            if (env->uncached_cpsr & PSTATE_SS) {
-                flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
-            }
+            zcr_len = sve_zcr_len_for_el(env, el);
         }
+        flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el);
+        flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len);
     }
-    if (arm_cpu_data_is_big_endian(env)) {
+
+    sctlr = arm_sctlr(env, el);
+
+    if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
         flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
     }
-    flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el);
 
-    if (arm_v7m_is_handler_mode(env)) {
-        flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1);
+    if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) {
+        /*
+         * In order to save space in flags, we record only whether
+         * pauth is "inactive", meaning all insns are implemented as
+         * a nop, or "active" when some action must be performed.
+         * The decision of which action to take is left to a helper.
+         */
+        if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
+            flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1);
+        }
     }
 
-    /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is
-     * suppressing them because the requested execution priority is less than 0.
-     */
-    if (arm_feature(env, ARM_FEATURE_V8) &&
-        arm_feature(env, ARM_FEATURE_M) &&
-        !((mmu_idx  & ARM_MMU_IDX_M_NEGPRI) &&
-          (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
-        flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1);
+    if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
+        /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
+        if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
+            flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1);
+        }
     }
 
-    if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
-        FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) != env->v7m.secure) {
-        flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1);
-    }
+    return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
+}
 
-    if (arm_feature(env, ARM_FEATURE_M) &&
-        (env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
-        (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
-         (env->v7m.secure &&
-          !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
-        /*
-         * ASPEN is set, but FPCA/SFPA indicate that there is no active
-         * FP context; we must create a new FP context before executing
-         * any FP insn.
-         */
-        flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1);
+static uint32_t rebuild_hflags_internal(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    if (is_a64(env)) {
+        return rebuild_hflags_a64(env, el, fp_el, mmu_idx);
+    } else if (arm_feature(env, ARM_FEATURE_M)) {
+        return rebuild_hflags_m32(env, fp_el, mmu_idx);
+    } else {
+        return rebuild_hflags_a32(env, fp_el, mmu_idx);
     }
+}
 
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
+void arm_rebuild_hflags(CPUARMState *env)
+{
+    env->hflags = rebuild_hflags_internal(env);
+}
+
+void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
+{
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
+}
+
+void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
+{
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
+}
+
+void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
+{
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+
+    env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
+}
+
+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+                          target_ulong *cs_base, uint32_t *pflags)
+{
+    uint32_t flags = env->hflags;
+    uint32_t pstate_for_ss;
 
-        if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
-            flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1);
+    *cs_base = 0;
+#ifdef CONFIG_DEBUG_TCG
+    assert(flags == rebuild_hflags_internal(env));
+#endif
+
+    if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) {
+        *pc = env->pc;
+        if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
+            flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);
         }
-    }
+        pstate_for_ss = env->pstate;
+    } else {
+        *pc = env->regs[15];
 
-    if (!arm_feature(env, ARM_FEATURE_M)) {
-        int target_el = arm_debug_target_el(env);
+        if (arm_feature(env, ARM_FEATURE_M)) {
+            if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+                FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S)
+                != env->v7m.secure) {
+                flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1);
+            }
+
+            if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
+                (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
+                 (env->v7m.secure &&
+                  !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
+                /*
+                 * ASPEN is set, but FPCA/SFPA indicate that there is no
+                 * active FP context; we must create a new FP context before
+                 * executing any FP insn.
+                 */
+                flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1);
+            }
+
+            bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
+            if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
+                flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1);
+            }
+        } else {
+            /*
+             * Note that XSCALE_CPAR shares bits with VECSTRIDE.
+             * Note that VECLEN+VECSTRIDE are RES0 for M-profile.
+             */
+            if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+                flags = FIELD_DP32(flags, TBFLAG_A32,
+                                   XSCALE_CPAR, env->cp15.c15_cpar);
+            } else {
+                flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN,
+                                   env->vfp.vec_len);
+                flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE,
+                                   env->vfp.vec_stride);
+            }
+            if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) {
+                flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
+            }
+        }
+
+        flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb);
+        flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits);
+        pstate_for_ss = env->uncached_cpsr;
+    }
 
-        flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, target_el);
+    /*
+     * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
+     * states defined in the ARM ARM for software singlestep:
+     *  SS_ACTIVE   PSTATE.SS   State
+     *     0            x       Inactive (the TB flag for SS is always 0)
+     *     1            0       Active-pending
+     *     1            1       Active-not-pending
+     * SS_ACTIVE is set in hflags; PSTATE_SS is computed every TB.
+     */
+    if (FIELD_EX32(flags, TBFLAG_ANY, SS_ACTIVE) &&
+        (pstate_for_ss & PSTATE_SS)) {
+        flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
     }
 
     *pflags = flags;
-    *cs_base = 0;
 }
 
 #ifdef TARGET_AARCH64
diff --git a/target/arm/helper.h b/target/arm/helper.h
index 1fb2cb5a77..3d4ec267a2 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -90,6 +90,10 @@ DEF_HELPER_4(msr_banked, void, env, i32, i32, i32)
 DEF_HELPER_2(get_user_reg, i32, env, i32)
 DEF_HELPER_3(set_user_reg, void, env, i32, i32)
 
+DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
+DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
+DEF_HELPER_FLAGS_2(rebuild_hflags_a64, TCG_CALL_NO_RWG, void, env, int)
+
 DEF_HELPER_1(vfp_get_fpscr, i32, env)
 DEF_HELPER_2(vfp_set_fpscr, void, env, i32)
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 232d963875..f5313dd3d4 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -950,6 +950,15 @@ void arm_cpu_update_virq(ARMCPU *cpu);
 void arm_cpu_update_vfiq(ARMCPU *cpu);
 
 /**
+ * arm_mmu_idx_el:
+ * @env: The cpu environment
+ * @el: The EL to use.
+ *
+ * Return the full ARMMMUIdx for the translation regime for EL.
+ */
+ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el);
+
+/**
  * arm_mmu_idx:
  * @env: The cpu environment
  *
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index 27cd2f3f96..f2512e448e 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -494,6 +494,7 @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
     switch_v7m_security_state(env, dest & 1);
     env->thumb = 1;
     env->regs[15] = dest & ~1;
+    arm_rebuild_hflags(env);
 }
 
 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
@@ -555,6 +556,7 @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
     switch_v7m_security_state(env, 0);
     env->thumb = 1;
     env->regs[15] = dest;
+    arm_rebuild_hflags(env);
 }
 
 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
@@ -895,6 +897,7 @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
     env->regs[14] = lr;
     env->regs[15] = addr & 0xfffffffe;
     env->thumb = addr & 1;
+    arm_rebuild_hflags(env);
 }
 
 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
@@ -1765,6 +1768,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     /* Otherwise, we have a successful exception exit. */
     arm_clear_exclusive(env);
+    arm_rebuild_hflags(env);
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
@@ -1837,6 +1841,7 @@ static bool do_v7m_function_return(ARMCPU *cpu)
     xpsr_write(env, 0, XPSR_IT);
     env->thumb = newpc & 1;
     env->regs[15] = newpc & ~1;
+    arm_rebuild_hflags(env);
 
     qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
     return true;
@@ -1959,6 +1964,7 @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
     switch_v7m_security_state(env, true);
     xpsr_write(env, 0, XPSR_IT);
     env->regs[15] += 4;
+    arm_rebuild_hflags(env);
     return true;
 
 gen_invep:
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 5c36707a7c..eb28b2381b 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -756,6 +756,7 @@ static int cpu_post_load(void *opaque, int version_id)
     if (!kvm_enabled()) {
         pmu_op_finish(&cpu->env);
     }
+    arm_rebuild_hflags(&cpu->env);
 
     return 0;
 }
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index 0fd4bd0238..b529d6c1bf 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -224,6 +224,7 @@ uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 void HELPER(setend)(CPUARMState *env)
 {
     env->uncached_cpsr ^= CPSR_E;
+    arm_rebuild_hflags(env);
 }
 
 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
@@ -387,6 +388,8 @@ uint32_t HELPER(cpsr_read)(CPUARMState *env)
 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 {
     cpsr_write(env, val, mask, CPSRWriteByInstr);
+    /* TODO: Not all cpsr bits are relevant to hflags.  */
+    arm_rebuild_hflags(env);
 }
 
 /* Write the CPSR for a 32-bit exception return */
@@ -404,6 +407,7 @@ void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
      * state. Do the masking now.
      */
     env->regs[15] &= (env->thumb ? ~1 : ~3);
+    arm_rebuild_hflags(env);
 
     qemu_mutex_lock_iothread();
     arm_call_el_change_hook(env_archcpu(env));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 2d6cd09634..d4bebbe629 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1789,8 +1789,17 @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
         /* I/O operations must end the TB here (whether read or write) */
         s->base.is_jmp = DISAS_UPDATE;
-    } else if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
-        /* We default to ending the TB on a coprocessor register write,
+    }
+    if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
+        /*
+         * A write to any coprocessor regiser that ends a TB
+         * must rebuild the hflags for the next TB.
+         */
+        TCGv_i32 tcg_el = tcg_const_i32(s->current_el);
+        gen_helper_rebuild_hflags_a64(cpu_env, tcg_el);
+        tcg_temp_free_i32(tcg_el);
+        /*
+         * We default to ending the TB on a coprocessor register write,
          * but allow this to be suppressed by the register definition
          * (usually only necessary to work around guest bugs).
          */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 698c594e8c..2ea9da7637 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -6890,6 +6890,8 @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
     ri = get_arm_cp_reginfo(s->cp_regs,
             ENCODE_CP_REG(cpnum, is64, s->ns, crn, crm, opc1, opc2));
     if (ri) {
+        bool need_exit_tb;
+
         /* Check access permissions */
         if (!cp_access_ok(s->current_el, ri, isread)) {
             return 1;
@@ -7068,14 +7070,30 @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
             }
         }
 
-        if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
-            /* I/O operations must end the TB here (whether read or write) */
-            gen_lookup_tb(s);
-        } else if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
-            /* We default to ending the TB on a coprocessor register write,
+        /* I/O operations must end the TB here (whether read or write) */
+        need_exit_tb = ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) &&
+                        (ri->type & ARM_CP_IO));
+
+        if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
+            /*
+             * A write to any coprocessor regiser that ends a TB
+             * must rebuild the hflags for the next TB.
+             */
+            TCGv_i32 tcg_el = tcg_const_i32(s->current_el);
+            if (arm_dc_feature(s, ARM_FEATURE_M)) {
+                gen_helper_rebuild_hflags_m32(cpu_env, tcg_el);
+            } else {
+                gen_helper_rebuild_hflags_a32(cpu_env, tcg_el);
+            }
+            tcg_temp_free_i32(tcg_el);
+            /*
+             * We default to ending the TB on a coprocessor register write,
              * but allow this to be suppressed by the register definition
              * (usually only necessary to work around guest bugs).
              */
+            need_exit_tb = true;
+        }
+        if (need_exit_tb) {
             gen_lookup_tb(s);
         }
 
@@ -8045,7 +8063,9 @@ static bool op_smlaxxx(DisasContext *s, arg_rrrr *a,
     case 2:
         tl = load_reg(s, a->ra);
         th = load_reg(s, a->rd);
-        t1 = tcg_const_i32(0);
+        /* Sign-extend the 32-bit product to 64 bits.  */
+        t1 = tcg_temp_new_i32();
+        tcg_gen_sari_i32(t1, t0, 31);
         tcg_gen_add2_i32(tl, th, tl, th, t0, t1);
         tcg_temp_free_i32(t0);
         tcg_temp_free_i32(t1);
@@ -8307,7 +8327,7 @@ static bool trans_MRS_v7m(DisasContext *s, arg_MRS_v7m *a)
 
 static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)
 {
-    TCGv_i32 addr, reg;
+    TCGv_i32 addr, reg, el;
 
     if (!arm_dc_feature(s, ARM_FEATURE_M)) {
         return false;
@@ -8317,6 +8337,9 @@ static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)
     gen_helper_v7m_msr(cpu_env, addr, reg);
     tcg_temp_free_i32(addr);
     tcg_temp_free_i32(reg);
+    el = tcg_const_i32(s->current_el);
+    gen_helper_rebuild_hflags_m32(cpu_env, el);
+    tcg_temp_free_i32(el);
     gen_lookup_tb(s);
     return true;
 }
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b635302859..a624163ac2 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2725,6 +2725,53 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .model_id = "Intel Xeon Processor (Icelake)",
     },
     {
+        .name = "Denverton",
+        .level = 21,
+        .vendor = CPUID_VENDOR_INTEL,
+        .family = 6,
+        .model = 95,
+        .stepping = 1,
+        .features[FEAT_1_EDX] =
+            CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+            CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+            CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+            CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+            CPUID_SSE | CPUID_SSE2,
+        .features[FEAT_1_ECX] =
+            CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_MONITOR |
+            CPUID_EXT_SSSE3 | CPUID_EXT_CX16 | CPUID_EXT_SSE41 |
+            CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+            CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER |
+            CPUID_EXT_AES | CPUID_EXT_XSAVE | CPUID_EXT_RDRAND,
+        .features[FEAT_8000_0001_EDX] =
+            CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+            CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+        .features[FEAT_8000_0001_ECX] =
+            CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
+        .features[FEAT_7_0_EBX] =
+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_ERMS |
+            CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_SMAP |
+            CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_SHA_NI,
+        .features[FEAT_7_0_EDX] =
+            CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_ARCH_CAPABILITIES |
+            CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+        /*
+         * Missing: XSAVES (not supported by some Linux versions,
+         * including v4.1 to v4.12).
+         * KVM doesn't yet expose any XSAVES state save component,
+         * and the only one defined in Skylake (processor tracing)
+         * probably will block migration anyway.
+         */
+        .features[FEAT_XSAVE] =
+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC | CPUID_XSAVE_XGETBV1,
+        .features[FEAT_6_EAX] =
+            CPUID_6_EAX_ARAT,
+        .features[FEAT_ARCH_CAPABILITIES] =
+            MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY,
+        .xlevel = 0x80000008,
+        .model_id = "Intel Atom Processor (Denverton)",
+    },
+    {
         .name = "Snowridge",
         .level = 27,
         .vendor = CPUID_VENDOR_INTEL,
diff --git a/target/mips/helper.c b/target/mips/helper.c
index a2b6459b05..781930a7dd 100644
--- a/target/mips/helper.c
+++ b/target/mips/helper.c
@@ -39,8 +39,8 @@ enum {
 #if !defined(CONFIG_USER_ONLY)
 
 /* no MMU emulation */
-int no_mmu_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
-                        target_ulong address, int rw, int access_type)
+int no_mmu_map_address(CPUMIPSState *env, hwaddr *physical, int *prot,
+                       target_ulong address, int rw, int access_type)
 {
     *physical = address;
     *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
@@ -48,26 +48,28 @@ int no_mmu_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
 }
 
 /* fixed mapping MMU emulation */
-int fixed_mmu_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
-                           target_ulong address, int rw, int access_type)
+int fixed_mmu_map_address(CPUMIPSState *env, hwaddr *physical, int *prot,
+                          target_ulong address, int rw, int access_type)
 {
     if (address <= (int32_t)0x7FFFFFFFUL) {
-        if (!(env->CP0_Status & (1 << CP0St_ERL)))
+        if (!(env->CP0_Status & (1 << CP0St_ERL))) {
             *physical = address + 0x40000000UL;
-        else
+        } else {
             *physical = address;
-    } else if (address <= (int32_t)0xBFFFFFFFUL)
+        }
+    } else if (address <= (int32_t)0xBFFFFFFFUL) {
         *physical = address & 0x1FFFFFFF;
-    else
+    } else {
         *physical = address;
+    }
 
     *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     return TLBRET_MATCH;
 }
 
 /* MIPS32/MIPS64 R4000-style MMU emulation */
-int r4k_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
-                     target_ulong address, int rw, int access_type)
+int r4k_map_address(CPUMIPSState *env, hwaddr *physical, int *prot,
+                    target_ulong address, int rw, int access_type)
 {
     uint16_t ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     int i;
@@ -99,8 +101,9 @@ int r4k_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
             if (rw != MMU_DATA_STORE || (n ? tlb->D1 : tlb->D0)) {
                 *physical = tlb->PFN[n] | (address & (mask >> 1));
                 *prot = PAGE_READ;
-                if (n ? tlb->D1 : tlb->D0)
+                if (n ? tlb->D1 : tlb->D0) {
                     *prot |= PAGE_WRITE;
+                }
                 if (!(n ? tlb->XI1 : tlb->XI0)) {
                     *prot |= PAGE_EXEC;
                 }
@@ -130,7 +133,7 @@ static int is_seg_am_mapped(unsigned int am, bool eu, int mmu_idx)
     int32_t adetlb_mask;
 
     switch (mmu_idx) {
-    case 3 /* ERL */:
+    case 3: /* ERL */
         /* If EU is set, always unmapped */
         if (eu) {
             return 0;
@@ -204,7 +207,7 @@ static int get_segctl_physical_address(CPUMIPSState *env, hwaddr *physical,
                                     pa & ~(hwaddr)segmask);
 }
 
-static int get_physical_address (CPUMIPSState *env, hwaddr *physical,
+static int get_physical_address(CPUMIPSState *env, hwaddr *physical,
                                 int *prot, target_ulong real_address,
                                 int rw, int access_type, int mmu_idx)
 {
@@ -252,14 +255,15 @@ static int get_physical_address (CPUMIPSState *env, hwaddr *physical,
         } else {
             segctl = env->CP0_SegCtl2 >> 16;
         }
-        ret = get_segctl_physical_address(env, physical, prot, real_address, rw,
-                                          access_type, mmu_idx, segctl,
-                                          0x3FFFFFFF);
+        ret = get_segctl_physical_address(env, physical, prot,
+                                          real_address, rw, access_type,
+                                          mmu_idx, segctl, 0x3FFFFFFF);
 #if defined(TARGET_MIPS64)
     } else if (address < 0x4000000000000000ULL) {
         /* xuseg */
         if (UX && address <= (0x3FFFFFFFFFFFFFFFULL & env->SEGMask)) {
-            ret = env->tlb->map_address(env, physical, prot, real_address, rw, access_type);
+            ret = env->tlb->map_address(env, physical, prot,
+                                        real_address, rw, access_type);
         } else {
             ret = TLBRET_BADADDR;
         }
@@ -267,7 +271,8 @@ static int get_physical_address (CPUMIPSState *env, hwaddr *physical,
         /* xsseg */
         if ((supervisor_mode || kernel_mode) &&
             SX && address <= (0x7FFFFFFFFFFFFFFFULL & env->SEGMask)) {
-            ret = env->tlb->map_address(env, physical, prot, real_address, rw, access_type);
+            ret = env->tlb->map_address(env, physical, prot,
+                                        real_address, rw, access_type);
         } else {
             ret = TLBRET_BADADDR;
         }
@@ -307,7 +312,8 @@ static int get_physical_address (CPUMIPSState *env, hwaddr *physical,
         /* xkseg */
         if (kernel_mode && KX &&
             address <= (0xFFFFFFFF7FFFFFFFULL & env->SEGMask)) {
-            ret = env->tlb->map_address(env, physical, prot, real_address, rw, access_type);
+            ret = env->tlb->map_address(env, physical, prot,
+                                        real_address, rw, access_type);
         } else {
             ret = TLBRET_BADADDR;
         }
@@ -328,8 +334,10 @@ static int get_physical_address (CPUMIPSState *env, hwaddr *physical,
                                           access_type, mmu_idx,
                                           env->CP0_SegCtl0 >> 16, 0x1FFFFFFF);
     } else {
-        /* kseg3 */
-        /* XXX: debug segment is not emulated */
+        /*
+         * kseg3
+         * XXX: debug segment is not emulated
+         */
         ret = get_segctl_physical_address(env, physical, prot, real_address, rw,
                                           access_type, mmu_idx,
                                           env->CP0_SegCtl0, 0x1FFFFFFF);
@@ -515,9 +523,9 @@ static void raise_mmu_exception(CPUMIPSState *env, target_ulong address,
 #if defined(TARGET_MIPS64)
     env->CP0_EntryHi &= env->SEGMask;
     env->CP0_XContext =
-        /* PTEBase */   (env->CP0_XContext & ((~0ULL) << (env->SEGBITS - 7))) |
-        /* R */         (extract64(address, 62, 2) << (env->SEGBITS - 9)) |
-        /* BadVPN2 */   (extract64(address, 13, env->SEGBITS - 13) << 4);
+        (env->CP0_XContext & ((~0ULL) << (env->SEGBITS - 7))) | /* PTEBase */
+        (extract64(address, 62, 2) << (env->SEGBITS - 9)) |     /* R       */
+        (extract64(address, 13, env->SEGBITS - 13) << 4);       /* BadVPN2 */
 #endif
     cs->exception_index = exception;
     env->error_code = error_code;
@@ -945,7 +953,8 @@ bool mips_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 }
 
 #ifndef CONFIG_USER_ONLY
-hwaddr cpu_mips_translate_address(CPUMIPSState *env, target_ulong address, int rw)
+hwaddr cpu_mips_translate_address(CPUMIPSState *env, target_ulong address,
+                                  int rw)
 {
     hwaddr physical;
     int prot;
@@ -1005,7 +1014,7 @@ static const char * const excp_names[EXCP_LAST + 1] = {
 };
 #endif
 
-target_ulong exception_resume_pc (CPUMIPSState *env)
+target_ulong exception_resume_pc(CPUMIPSState *env)
 {
     target_ulong bad_pc;
     target_ulong isa_mode;
@@ -1013,8 +1022,10 @@ target_ulong exception_resume_pc (CPUMIPSState *env)
     isa_mode = !!(env->hflags & MIPS_HFLAG_M16);
     bad_pc = env->active_tc.PC | isa_mode;
     if (env->hflags & MIPS_HFLAG_BMASK) {
-        /* If the exception was raised from a delay slot, come back to
-           the jump.  */
+        /*
+         * If the exception was raised from a delay slot, come back to
+         * the jump.
+         */
         bad_pc -= (env->hflags & MIPS_HFLAG_B16 ? 2 : 4);
     }
 
@@ -1022,14 +1033,14 @@ target_ulong exception_resume_pc (CPUMIPSState *env)
 }
 
 #if !defined(CONFIG_USER_ONLY)
-static void set_hflags_for_handler (CPUMIPSState *env)
+static void set_hflags_for_handler(CPUMIPSState *env)
 {
     /* Exception handlers are entered in 32-bit mode.  */
     env->hflags &= ~(MIPS_HFLAG_M16);
     /* ...except that microMIPS lets you choose.  */
     if (env->insn_flags & ASE_MICROMIPS) {
-        env->hflags |= (!!(env->CP0_Config3
-                           & (1 << CP0C3_ISA_ON_EXC))
+        env->hflags |= (!!(env->CP0_Config3 &
+                           (1 << CP0C3_ISA_ON_EXC))
                         << MIPS_HFLAG_M16_SHIFT);
     }
 }
@@ -1096,10 +1107,12 @@ void mips_cpu_do_interrupt(CPUState *cs)
     switch (cs->exception_index) {
     case EXCP_DSS:
         env->CP0_Debug |= 1 << CP0DB_DSS;
-        /* Debug single step cannot be raised inside a delay slot and
-           resume will always occur on the next instruction
-           (but we assume the pc has always been updated during
-           code translation). */
+        /*
+         * Debug single step cannot be raised inside a delay slot and
+         * resume will always occur on the next instruction
+         * (but we assume the pc has always been updated during
+         * code translation).
+         */
         env->CP0_DEPC = env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16);
         goto enter_debug_mode;
     case EXCP_DINT:
@@ -1111,7 +1124,8 @@ void mips_cpu_do_interrupt(CPUState *cs)
     case EXCP_DBp:
         env->CP0_Debug |= 1 << CP0DB_DBp;
         /* Setup DExcCode - SDBBP instruction */
-        env->CP0_Debug = (env->CP0_Debug & ~(0x1fULL << CP0DB_DEC)) | 9 << CP0DB_DEC;
+        env->CP0_Debug = (env->CP0_Debug & ~(0x1fULL << CP0DB_DEC)) |
+                         (9 << CP0DB_DEC);
         goto set_DEPC;
     case EXCP_DDBS:
         env->CP0_Debug |= 1 << CP0DB_DDBS;
@@ -1132,8 +1146,9 @@ void mips_cpu_do_interrupt(CPUState *cs)
         env->hflags |= MIPS_HFLAG_DM | MIPS_HFLAG_CP0;
         env->hflags &= ~(MIPS_HFLAG_KSU);
         /* EJTAG probe trap enable is not implemented... */
-        if (!(env->CP0_Status & (1 << CP0St_EXL)))
+        if (!(env->CP0_Status & (1 << CP0St_EXL))) {
             env->CP0_Cause &= ~(1U << CP0Ca_BD);
+        }
         env->active_tc.PC = env->exception_base + 0x480;
         set_hflags_for_handler(env);
         break;
@@ -1159,8 +1174,9 @@ void mips_cpu_do_interrupt(CPUState *cs)
         }
         env->hflags |= MIPS_HFLAG_CP0;
         env->hflags &= ~(MIPS_HFLAG_KSU);
-        if (!(env->CP0_Status & (1 << CP0St_EXL)))
+        if (!(env->CP0_Status & (1 << CP0St_EXL))) {
             env->CP0_Cause &= ~(1U << CP0Ca_BD);
+        }
         env->active_tc.PC = env->exception_base;
         set_hflags_for_handler(env);
         break;
@@ -1176,12 +1192,16 @@ void mips_cpu_do_interrupt(CPUState *cs)
                 uint32_t pending = (env->CP0_Cause & CP0Ca_IP_mask) >> CP0Ca_IP;
 
                 if (env->CP0_Config3 & (1 << CP0C3_VEIC)) {
-                    /* For VEIC mode, the external interrupt controller feeds
-                     * the vector through the CP0Cause IP lines.  */
+                    /*
+                     * For VEIC mode, the external interrupt controller feeds
+                     * the vector through the CP0Cause IP lines.
+                     */
                     vector = pending;
                 } else {
-                    /* Vectored Interrupts
-                     * Mask with Status.IM7-IM0 to get enabled interrupts. */
+                    /*
+                     * Vectored Interrupts
+                     * Mask with Status.IM7-IM0 to get enabled interrupts.
+                     */
                     pending &= (env->CP0_Status >> CP0St_IM) & 0xff;
                     /* Find the highest-priority interrupt. */
                     while (pending >>= 1) {
@@ -1354,7 +1374,8 @@ void mips_cpu_do_interrupt(CPUState *cs)
 
         env->active_tc.PC += offset;
         set_hflags_for_handler(env);
-        env->CP0_Cause = (env->CP0_Cause & ~(0x1f << CP0Ca_EC)) | (cause << CP0Ca_EC);
+        env->CP0_Cause = (env->CP0_Cause & ~(0x1f << CP0Ca_EC)) |
+                         (cause << CP0Ca_EC);
         break;
     default:
         abort();
@@ -1390,7 +1411,7 @@ bool mips_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 }
 
 #if !defined(CONFIG_USER_ONLY)
-void r4k_invalidate_tlb (CPUMIPSState *env, int idx, int use_extra)
+void r4k_invalidate_tlb(CPUMIPSState *env, int idx, int use_extra)
 {
     CPUState *cs = env_cpu(env);
     r4k_tlb_t *tlb;
@@ -1400,16 +1421,20 @@ void r4k_invalidate_tlb (CPUMIPSState *env, int idx, int use_extra)
     target_ulong mask;
 
     tlb = &env->tlb->mmu.r4k.tlb[idx];
-    /* The qemu TLB is flushed when the ASID changes, so no need to
-       flush these entries again.  */
+    /*
+     * The qemu TLB is flushed when the ASID changes, so no need to
+     * flush these entries again.
+     */
     if (tlb->G == 0 && tlb->ASID != ASID) {
         return;
     }
 
     if (use_extra && env->tlb->tlb_in_use < MIPS_TLB_MAX) {
-        /* For tlbwr, we can shadow the discarded entry into
-           a new (fake) TLB entry, as long as the guest can not
-           tell that it's there.  */
+        /*
+         * For tlbwr, we can shadow the discarded entry into
+         * a new (fake) TLB entry, as long as the guest can not
+         * tell that it's there.
+         */
         env->tlb->mmu.r4k.tlb[env->tlb->tlb_in_use] = *tlb;
         env->tlb->tlb_in_use++;
         return;
diff --git a/target/mips/helper.h b/target/mips/helper.h
index d615c83c54..7b8ad74d67 100644
--- a/target/mips/helper.h
+++ b/target/mips/helper.h
@@ -822,6 +822,39 @@ DEF_HELPER_4(msa_bset_h, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_bset_w, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_bset_d, void, env, i32, i32, i32)
 
+DEF_HELPER_4(msa_add_a_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_add_a_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_add_a_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_add_a_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_adds_a_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_a_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_a_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_a_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_adds_s_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_s_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_s_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_s_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_adds_u_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_u_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_u_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_adds_u_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_addv_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_addv_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_addv_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_addv_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_hadd_s_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hadd_s_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hadd_s_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_hadd_u_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hadd_u_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hadd_u_d, void, env, i32, i32, i32)
+
 DEF_HELPER_4(msa_ave_s_b, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_ave_s_h, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_ave_s_w, void, env, i32, i32, i32)
@@ -877,6 +910,31 @@ DEF_HELPER_4(msa_div_u_h, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_div_u_w, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_div_u_d, void, env, i32, i32, i32)
 
+DEF_HELPER_4(msa_max_a_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_a_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_a_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_a_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_s_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_s_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_s_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_s_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_u_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_u_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_u_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_max_u_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_a_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_a_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_a_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_a_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_s_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_s_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_s_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_s_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_u_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_u_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_u_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_min_u_d, void, env, i32, i32, i32)
+
 DEF_HELPER_4(msa_mod_u_b, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_mod_u_h, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_mod_u_w, void, env, i32, i32, i32)
@@ -887,11 +945,80 @@ DEF_HELPER_4(msa_mod_s_h, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_mod_s_w, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_mod_s_d, void, env, i32, i32, i32)
 
+DEF_HELPER_4(msa_asub_s_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_asub_s_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_asub_s_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_asub_s_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_asub_u_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_asub_u_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_asub_u_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_asub_u_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_hsub_s_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hsub_s_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hsub_s_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_hsub_u_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hsub_u_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_hsub_u_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_ilvev_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvev_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvev_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvev_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvod_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvod_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvod_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvod_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvl_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvl_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvl_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvl_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvr_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvr_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvr_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_ilvr_d, void, env, i32, i32, i32)
+
 DEF_HELPER_4(msa_and_v, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_nor_v, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_or_v, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_xor_v, void, env, i32, i32, i32)
 
+DEF_HELPER_4(msa_pckev_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckev_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckev_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckev_d, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckod_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckod_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckod_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_pckod_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_sll_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_sll_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_sll_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_sll_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_sra_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_sra_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_sra_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_sra_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_srar_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srar_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srar_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srar_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_srl_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srl_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srl_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srl_d, void, env, i32, i32, i32)
+
+DEF_HELPER_4(msa_srlr_b, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srlr_h, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srlr_w, void, env, i32, i32, i32)
+DEF_HELPER_4(msa_srlr_d, void, env, i32, i32, i32)
+
 DEF_HELPER_3(msa_move_v, void, env, i32, i32)
 
 DEF_HELPER_4(msa_andi_b, void, env, i32, i32, i32)
@@ -929,29 +1056,13 @@ DEF_HELPER_5(msa_sat_u_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_srari_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_srlri_df, void, env, i32, i32, i32, i32)
 
-DEF_HELPER_5(msa_sll_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_sra_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_srl_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_binsl_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_binsr_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_addv_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_subv_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_max_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_max_u_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_min_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_min_u_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_max_a_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_min_a_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_add_a_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_adds_a_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_adds_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_adds_u_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_subs_s_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_subs_u_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_subsus_u_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_subsuu_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_asub_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_asub_u_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_mulv_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_maddv_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_msubv_df, void, env, i32, i32, i32, i32)
@@ -963,19 +1074,7 @@ DEF_HELPER_5(msa_dpsub_s_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_dpsub_u_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_sld_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_splat_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_pckev_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_pckod_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_ilvl_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_ilvr_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_ilvev_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_ilvod_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_vshf_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_srar_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_srlr_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_hadd_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_hadd_u_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_hsub_s_df, void, env, i32, i32, i32, i32)
-DEF_HELPER_5(msa_hsub_u_df, void, env, i32, i32, i32, i32)
 
 DEF_HELPER_5(msa_sldi_df, void, env, i32, i32, i32, i32)
 DEF_HELPER_5(msa_splati_df, void, env, i32, i32, i32, i32)
diff --git a/target/mips/msa_helper.c b/target/mips/msa_helper.c
index a2052baa57..4065cfe4f7 100644
--- a/target/mips/msa_helper.c
+++ b/target/mips/msa_helper.c
@@ -805,7 +805,490 @@ void helper_msa_bset_d(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
  * +---------------+----------------------------------------------------------+
  */
 
-/* TODO: insert Int Add group helpers here */
+
+static inline int64_t msa_add_a_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
+    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
+    return abs_arg1 + abs_arg2;
+}
+
+void helper_msa_add_a_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_add_a_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_add_a_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_add_a_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_add_a_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_add_a_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_add_a_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_add_a_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_add_a_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_add_a_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_add_a_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_add_a_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_add_a_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_add_a_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_add_a_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_add_a_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_add_a_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_add_a_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_add_a_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_add_a_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_add_a_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_add_a_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_add_a_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_add_a_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_add_a_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_add_a_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_add_a_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_add_a_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_add_a_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_add_a_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_add_a_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_add_a_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_add_a_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_add_a_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_adds_a_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t max_int = (uint64_t)DF_MAX_INT(df);
+    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
+    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
+    if (abs_arg1 > max_int || abs_arg2 > max_int) {
+        return (int64_t)max_int;
+    } else {
+        return (abs_arg1 < max_int - abs_arg2) ? abs_arg1 + abs_arg2 : max_int;
+    }
+}
+
+void helper_msa_adds_a_b(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_adds_a_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_adds_a_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_adds_a_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_adds_a_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_adds_a_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_adds_a_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_adds_a_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_adds_a_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_adds_a_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_adds_a_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_adds_a_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_adds_a_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_adds_a_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_adds_a_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_adds_a_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_adds_a_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_adds_a_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_adds_a_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_adds_a_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_adds_a_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_adds_a_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_adds_a_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_adds_a_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_adds_a_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_adds_a_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_adds_a_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_adds_a_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_adds_a_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_adds_a_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_adds_a_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_adds_a_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_adds_a_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_adds_a_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_adds_s_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    int64_t max_int = DF_MAX_INT(df);
+    int64_t min_int = DF_MIN_INT(df);
+    if (arg1 < 0) {
+        return (min_int - arg1 < arg2) ? arg1 + arg2 : min_int;
+    } else {
+        return (arg2 < max_int - arg1) ? arg1 + arg2 : max_int;
+    }
+}
+
+void helper_msa_adds_s_b(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_adds_s_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_adds_s_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_adds_s_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_adds_s_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_adds_s_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_adds_s_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_adds_s_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_adds_s_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_adds_s_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_adds_s_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_adds_s_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_adds_s_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_adds_s_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_adds_s_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_adds_s_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_adds_s_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_adds_s_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_adds_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_adds_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_adds_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_adds_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_adds_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_adds_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_adds_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_adds_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_adds_s_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_adds_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_adds_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_adds_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_adds_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_adds_s_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_adds_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_adds_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline uint64_t msa_adds_u_df(uint32_t df, uint64_t arg1, uint64_t arg2)
+{
+    uint64_t max_uint = DF_MAX_UINT(df);
+    uint64_t u_arg1 = UNSIGNED(arg1, df);
+    uint64_t u_arg2 = UNSIGNED(arg2, df);
+    return (u_arg1 < max_uint - u_arg2) ? u_arg1 + u_arg2 : max_uint;
+}
+
+void helper_msa_adds_u_b(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_adds_u_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_adds_u_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_adds_u_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_adds_u_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_adds_u_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_adds_u_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_adds_u_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_adds_u_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_adds_u_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_adds_u_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_adds_u_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_adds_u_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_adds_u_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_adds_u_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_adds_u_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_adds_u_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_adds_u_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_adds_u_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_adds_u_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_adds_u_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_adds_u_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_adds_u_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_adds_u_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_adds_u_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_adds_u_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_adds_u_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_adds_u_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_adds_u_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_adds_u_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_adds_u_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_adds_u_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_adds_u_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_adds_u_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_addv_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return arg1 + arg2;
+}
+
+void helper_msa_addv_b(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_addv_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_addv_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_addv_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_addv_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_addv_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_addv_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_addv_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_addv_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_addv_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_addv_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_addv_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_addv_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_addv_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_addv_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_addv_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_addv_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_addv_h(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_addv_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_addv_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_addv_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_addv_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_addv_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_addv_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_addv_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_addv_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_addv_w(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_addv_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_addv_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_addv_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_addv_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_addv_d(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_addv_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_addv_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+#define SIGNED_EVEN(a, df) \
+        ((((int64_t)(a)) << (64 - DF_BITS(df) / 2)) >> (64 - DF_BITS(df) / 2))
+
+#define UNSIGNED_EVEN(a, df) \
+        ((((uint64_t)(a)) << (64 - DF_BITS(df) / 2)) >> (64 - DF_BITS(df) / 2))
+
+#define SIGNED_ODD(a, df) \
+        ((((int64_t)(a)) << (64 - DF_BITS(df))) >> (64 - DF_BITS(df) / 2))
+
+#define UNSIGNED_ODD(a, df) \
+        ((((uint64_t)(a)) << (64 - DF_BITS(df))) >> (64 - DF_BITS(df) / 2))
+
+
+static inline int64_t msa_hadd_s_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return SIGNED_ODD(arg1, df) + SIGNED_EVEN(arg2, df);
+}
+
+void helper_msa_hadd_s_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_hadd_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_hadd_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_hadd_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_hadd_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_hadd_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_hadd_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_hadd_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_hadd_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_hadd_s_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_hadd_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_hadd_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_hadd_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_hadd_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_hadd_s_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_hadd_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_hadd_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_hadd_u_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return UNSIGNED_ODD(arg1, df) + UNSIGNED_EVEN(arg2, df);
+}
+
+void helper_msa_hadd_u_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_hadd_u_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_hadd_u_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_hadd_u_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_hadd_u_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_hadd_u_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_hadd_u_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_hadd_u_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_hadd_u_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_hadd_u_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_hadd_u_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_hadd_u_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_hadd_u_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_hadd_u_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_hadd_u_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_hadd_u_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_hadd_u_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
 
 
 /*
@@ -1158,28 +1641,38 @@ static inline int64_t msa_ceq_df(uint32_t df, int64_t arg1, int64_t arg2)
     return arg1 == arg2 ? -1 : 0;
 }
 
+static inline int8_t msa_ceq_b(int8_t arg1, int8_t arg2)
+{
+    return arg1 == arg2 ? -1 : 0;
+}
+
 void helper_msa_ceq_b(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
 {
     wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->b[0]  = msa_ceq_df(DF_BYTE, pws->b[0],  pwt->b[0]);
-    pwd->b[1]  = msa_ceq_df(DF_BYTE, pws->b[1],  pwt->b[1]);
-    pwd->b[2]  = msa_ceq_df(DF_BYTE, pws->b[2],  pwt->b[2]);
-    pwd->b[3]  = msa_ceq_df(DF_BYTE, pws->b[3],  pwt->b[3]);
-    pwd->b[4]  = msa_ceq_df(DF_BYTE, pws->b[4],  pwt->b[4]);
-    pwd->b[5]  = msa_ceq_df(DF_BYTE, pws->b[5],  pwt->b[5]);
-    pwd->b[6]  = msa_ceq_df(DF_BYTE, pws->b[6],  pwt->b[6]);
-    pwd->b[7]  = msa_ceq_df(DF_BYTE, pws->b[7],  pwt->b[7]);
-    pwd->b[8]  = msa_ceq_df(DF_BYTE, pws->b[8],  pwt->b[8]);
-    pwd->b[9]  = msa_ceq_df(DF_BYTE, pws->b[9],  pwt->b[9]);
-    pwd->b[10] = msa_ceq_df(DF_BYTE, pws->b[10], pwt->b[10]);
-    pwd->b[11] = msa_ceq_df(DF_BYTE, pws->b[11], pwt->b[11]);
-    pwd->b[12] = msa_ceq_df(DF_BYTE, pws->b[12], pwt->b[12]);
-    pwd->b[13] = msa_ceq_df(DF_BYTE, pws->b[13], pwt->b[13]);
-    pwd->b[14] = msa_ceq_df(DF_BYTE, pws->b[14], pwt->b[14]);
-    pwd->b[15] = msa_ceq_df(DF_BYTE, pws->b[15], pwt->b[15]);
+    pwd->b[0]  = msa_ceq_b(pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_ceq_b(pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_ceq_b(pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_ceq_b(pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_ceq_b(pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_ceq_b(pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_ceq_b(pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_ceq_b(pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_ceq_b(pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_ceq_b(pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_ceq_b(pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_ceq_b(pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_ceq_b(pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_ceq_b(pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_ceq_b(pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_ceq_b(pws->b[15], pwt->b[15]);
+}
+
+static inline int16_t msa_ceq_h(int16_t arg1, int16_t arg2)
+{
+    return arg1 == arg2 ? -1 : 0;
 }
 
 void helper_msa_ceq_h(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
@@ -1188,14 +1681,19 @@ void helper_msa_ceq_h(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->h[0]  = msa_ceq_df(DF_HALF, pws->h[0],  pwt->h[0]);
-    pwd->h[1]  = msa_ceq_df(DF_HALF, pws->h[1],  pwt->h[1]);
-    pwd->h[2]  = msa_ceq_df(DF_HALF, pws->h[2],  pwt->h[2]);
-    pwd->h[3]  = msa_ceq_df(DF_HALF, pws->h[3],  pwt->h[3]);
-    pwd->h[4]  = msa_ceq_df(DF_HALF, pws->h[4],  pwt->h[4]);
-    pwd->h[5]  = msa_ceq_df(DF_HALF, pws->h[5],  pwt->h[5]);
-    pwd->h[6]  = msa_ceq_df(DF_HALF, pws->h[6],  pwt->h[6]);
-    pwd->h[7]  = msa_ceq_df(DF_HALF, pws->h[7],  pwt->h[7]);
+    pwd->h[0]  = msa_ceq_h(pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_ceq_h(pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_ceq_h(pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_ceq_h(pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_ceq_h(pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_ceq_h(pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_ceq_h(pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_ceq_h(pws->h[7],  pwt->h[7]);
+}
+
+static inline int32_t msa_ceq_w(int32_t arg1, int32_t arg2)
+{
+    return arg1 == arg2 ? -1 : 0;
 }
 
 void helper_msa_ceq_w(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
@@ -1204,10 +1702,15 @@ void helper_msa_ceq_w(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->w[0]  = msa_ceq_df(DF_WORD, pws->w[0],  pwt->w[0]);
-    pwd->w[1]  = msa_ceq_df(DF_WORD, pws->w[1],  pwt->w[1]);
-    pwd->w[2]  = msa_ceq_df(DF_WORD, pws->w[2],  pwt->w[2]);
-    pwd->w[3]  = msa_ceq_df(DF_WORD, pws->w[3],  pwt->w[3]);
+    pwd->w[0]  = msa_ceq_w(pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_ceq_w(pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_ceq_w(pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_ceq_w(pws->w[3],  pwt->w[3]);
+}
+
+static inline int64_t msa_ceq_d(int64_t arg1, int64_t arg2)
+{
+    return arg1 == arg2 ? -1 : 0;
 }
 
 void helper_msa_ceq_d(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
@@ -1216,8 +1719,8 @@ void helper_msa_ceq_d(CPUMIPSState *env, uint32_t wd, uint32_t ws, uint32_t wt)
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->d[0]  = msa_ceq_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
-    pwd->d[1]  = msa_ceq_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+    pwd->d[0]  = msa_ceq_d(pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_ceq_d(pws->d[1],  pwt->d[1]);
 }
 
 static inline int64_t msa_cle_s_df(uint32_t df, int64_t arg1, int64_t arg2)
@@ -1369,6 +1872,11 @@ static inline int64_t msa_clt_s_df(uint32_t df, int64_t arg1, int64_t arg2)
     return arg1 < arg2 ? -1 : 0;
 }
 
+static inline int8_t msa_clt_s_b(int8_t arg1, int8_t arg2)
+{
+    return arg1 < arg2 ? -1 : 0;
+}
+
 void helper_msa_clt_s_b(CPUMIPSState *env,
                         uint32_t wd, uint32_t ws, uint32_t wt)
 {
@@ -1376,22 +1884,27 @@ void helper_msa_clt_s_b(CPUMIPSState *env,
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->b[0]  = msa_clt_s_df(DF_BYTE, pws->b[0],  pwt->b[0]);
-    pwd->b[1]  = msa_clt_s_df(DF_BYTE, pws->b[1],  pwt->b[1]);
-    pwd->b[2]  = msa_clt_s_df(DF_BYTE, pws->b[2],  pwt->b[2]);
-    pwd->b[3]  = msa_clt_s_df(DF_BYTE, pws->b[3],  pwt->b[3]);
-    pwd->b[4]  = msa_clt_s_df(DF_BYTE, pws->b[4],  pwt->b[4]);
-    pwd->b[5]  = msa_clt_s_df(DF_BYTE, pws->b[5],  pwt->b[5]);
-    pwd->b[6]  = msa_clt_s_df(DF_BYTE, pws->b[6],  pwt->b[6]);
-    pwd->b[7]  = msa_clt_s_df(DF_BYTE, pws->b[7],  pwt->b[7]);
-    pwd->b[8]  = msa_clt_s_df(DF_BYTE, pws->b[8],  pwt->b[8]);
-    pwd->b[9]  = msa_clt_s_df(DF_BYTE, pws->b[9],  pwt->b[9]);
-    pwd->b[10] = msa_clt_s_df(DF_BYTE, pws->b[10], pwt->b[10]);
-    pwd->b[11] = msa_clt_s_df(DF_BYTE, pws->b[11], pwt->b[11]);
-    pwd->b[12] = msa_clt_s_df(DF_BYTE, pws->b[12], pwt->b[12]);
-    pwd->b[13] = msa_clt_s_df(DF_BYTE, pws->b[13], pwt->b[13]);
-    pwd->b[14] = msa_clt_s_df(DF_BYTE, pws->b[14], pwt->b[14]);
-    pwd->b[15] = msa_clt_s_df(DF_BYTE, pws->b[15], pwt->b[15]);
+    pwd->b[0]  = msa_clt_s_b(pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_clt_s_b(pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_clt_s_b(pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_clt_s_b(pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_clt_s_b(pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_clt_s_b(pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_clt_s_b(pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_clt_s_b(pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_clt_s_b(pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_clt_s_b(pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_clt_s_b(pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_clt_s_b(pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_clt_s_b(pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_clt_s_b(pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_clt_s_b(pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_clt_s_b(pws->b[15], pwt->b[15]);
+}
+
+static inline int16_t msa_clt_s_h(int16_t arg1, int16_t arg2)
+{
+    return arg1 < arg2 ? -1 : 0;
 }
 
 void helper_msa_clt_s_h(CPUMIPSState *env,
@@ -1401,14 +1914,19 @@ void helper_msa_clt_s_h(CPUMIPSState *env,
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->h[0]  = msa_clt_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
-    pwd->h[1]  = msa_clt_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
-    pwd->h[2]  = msa_clt_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
-    pwd->h[3]  = msa_clt_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
-    pwd->h[4]  = msa_clt_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
-    pwd->h[5]  = msa_clt_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
-    pwd->h[6]  = msa_clt_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
-    pwd->h[7]  = msa_clt_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+    pwd->h[0]  = msa_clt_s_h(pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_clt_s_h(pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_clt_s_h(pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_clt_s_h(pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_clt_s_h(pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_clt_s_h(pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_clt_s_h(pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_clt_s_h(pws->h[7],  pwt->h[7]);
+}
+
+static inline int32_t msa_clt_s_w(int32_t arg1, int32_t arg2)
+{
+    return arg1 < arg2 ? -1 : 0;
 }
 
 void helper_msa_clt_s_w(CPUMIPSState *env,
@@ -1418,10 +1936,15 @@ void helper_msa_clt_s_w(CPUMIPSState *env,
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->w[0]  = msa_clt_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
-    pwd->w[1]  = msa_clt_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
-    pwd->w[2]  = msa_clt_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
-    pwd->w[3]  = msa_clt_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+    pwd->w[0]  = msa_clt_s_w(pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_clt_s_w(pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_clt_s_w(pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_clt_s_w(pws->w[3],  pwt->w[3]);
+}
+
+static inline int64_t msa_clt_s_d(int64_t arg1, int64_t arg2)
+{
+    return arg1 < arg2 ? -1 : 0;
 }
 
 void helper_msa_clt_s_d(CPUMIPSState *env,
@@ -1431,8 +1954,8 @@ void helper_msa_clt_s_d(CPUMIPSState *env,
     wr_t *pws = &(env->active_fpu.fpr[ws].wr);
     wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
 
-    pwd->d[0]  = msa_clt_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
-    pwd->d[1]  = msa_clt_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+    pwd->d[0]  = msa_clt_s_d(pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_clt_s_d(pws->d[1],  pwt->d[1]);
 }
 
 static inline int64_t msa_clt_u_df(uint32_t df, int64_t arg1, int64_t arg2)
@@ -1736,7 +2259,444 @@ void helper_msa_div_u_d(CPUMIPSState *env,
  * +---------------+----------------------------------------------------------+
  */
 
-/* TODO: insert Int Max Min group helpers here */
+static inline int64_t msa_max_a_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
+    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
+    return abs_arg1 > abs_arg2 ? arg1 : arg2;
+}
+
+void helper_msa_max_a_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_max_a_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_max_a_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_max_a_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_max_a_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_max_a_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_max_a_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_max_a_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_max_a_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_max_a_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_max_a_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_max_a_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_max_a_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_max_a_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_max_a_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_max_a_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_max_a_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_max_a_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_max_a_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_max_a_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_max_a_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_max_a_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_max_a_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_max_a_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_max_a_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_max_a_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_max_a_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_max_a_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_max_a_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_max_a_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_max_a_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_max_a_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_max_a_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_max_a_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_max_s_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return arg1 > arg2 ? arg1 : arg2;
+}
+
+void helper_msa_max_s_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_max_s_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_max_s_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_max_s_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_max_s_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_max_s_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_max_s_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_max_s_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_max_s_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_max_s_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_max_s_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_max_s_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_max_s_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_max_s_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_max_s_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_max_s_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_max_s_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_max_s_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_max_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_max_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_max_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_max_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_max_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_max_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_max_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_max_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_max_s_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_max_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_max_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_max_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_max_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_max_s_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_max_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_max_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_max_u_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t u_arg1 = UNSIGNED(arg1, df);
+    uint64_t u_arg2 = UNSIGNED(arg2, df);
+    return u_arg1 > u_arg2 ? arg1 : arg2;
+}
+
+void helper_msa_max_u_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_max_u_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_max_u_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_max_u_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_max_u_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_max_u_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_max_u_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_max_u_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_max_u_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_max_u_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_max_u_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_max_u_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_max_u_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_max_u_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_max_u_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_max_u_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_max_u_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_max_u_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_max_u_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_max_u_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_max_u_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_max_u_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_max_u_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_max_u_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_max_u_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_max_u_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_max_u_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_max_u_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_max_u_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_max_u_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_max_u_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_max_u_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_max_u_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_max_u_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_min_a_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
+    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
+    return abs_arg1 < abs_arg2 ? arg1 : arg2;
+}
+
+void helper_msa_min_a_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_min_a_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_min_a_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_min_a_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_min_a_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_min_a_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_min_a_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_min_a_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_min_a_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_min_a_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_min_a_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_min_a_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_min_a_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_min_a_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_min_a_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_min_a_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_min_a_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_min_a_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_min_a_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_min_a_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_min_a_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_min_a_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_min_a_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_min_a_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_min_a_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_min_a_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_min_a_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_min_a_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_min_a_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_min_a_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_min_a_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_min_a_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_min_a_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_min_a_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_min_s_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return arg1 < arg2 ? arg1 : arg2;
+}
+
+void helper_msa_min_s_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_min_s_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_min_s_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_min_s_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_min_s_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_min_s_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_min_s_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_min_s_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_min_s_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_min_s_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_min_s_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_min_s_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_min_s_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_min_s_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_min_s_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_min_s_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_min_s_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_min_s_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_min_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_min_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_min_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_min_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_min_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_min_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_min_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_min_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_min_s_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_min_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_min_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_min_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_min_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_min_s_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_min_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_min_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_min_u_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t u_arg1 = UNSIGNED(arg1, df);
+    uint64_t u_arg2 = UNSIGNED(arg2, df);
+    return u_arg1 < u_arg2 ? arg1 : arg2;
+}
+
+void helper_msa_min_u_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_min_u_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_min_u_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_min_u_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_min_u_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_min_u_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_min_u_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_min_u_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_min_u_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_min_u_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_min_u_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_min_u_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_min_u_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_min_u_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_min_u_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_min_u_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_min_u_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_min_u_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_min_u_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_min_u_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_min_u_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_min_u_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_min_u_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_min_u_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_min_u_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_min_u_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_min_u_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_min_u_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_min_u_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_min_u_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_min_u_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_min_u_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_min_u_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_min_u_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
 
 
 /*
@@ -1968,7 +2928,252 @@ void helper_msa_mod_u_d(CPUMIPSState *env,
  * +---------------+----------------------------------------------------------+
  */
 
-/* TODO: insert Int Subtract group helpers here */
+
+static inline int64_t msa_asub_s_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    /* signed compare */
+    return (arg1 < arg2) ?
+        (uint64_t)(arg2 - arg1) : (uint64_t)(arg1 - arg2);
+}
+
+void helper_msa_asub_s_b(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_asub_s_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_asub_s_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_asub_s_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_asub_s_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_asub_s_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_asub_s_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_asub_s_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_asub_s_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_asub_s_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_asub_s_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_asub_s_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_asub_s_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_asub_s_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_asub_s_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_asub_s_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_asub_s_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_asub_s_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_asub_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_asub_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_asub_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_asub_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_asub_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_asub_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_asub_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_asub_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_asub_s_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_asub_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_asub_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_asub_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_asub_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_asub_s_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_asub_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_asub_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline uint64_t msa_asub_u_df(uint32_t df, uint64_t arg1, uint64_t arg2)
+{
+    uint64_t u_arg1 = UNSIGNED(arg1, df);
+    uint64_t u_arg2 = UNSIGNED(arg2, df);
+    /* unsigned compare */
+    return (u_arg1 < u_arg2) ?
+        (uint64_t)(u_arg2 - u_arg1) : (uint64_t)(u_arg1 - u_arg2);
+}
+
+void helper_msa_asub_u_b(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_asub_u_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_asub_u_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_asub_u_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_asub_u_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_asub_u_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_asub_u_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_asub_u_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_asub_u_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_asub_u_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_asub_u_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_asub_u_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_asub_u_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_asub_u_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_asub_u_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_asub_u_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_asub_u_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_asub_u_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_asub_u_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_asub_u_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_asub_u_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_asub_u_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_asub_u_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_asub_u_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_asub_u_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_asub_u_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_asub_u_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_asub_u_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_asub_u_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_asub_u_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_asub_u_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_asub_u_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_asub_u_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_asub_u_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+/* TODO: insert the rest of Int Subtract group helpers here */
+
+
+static inline int64_t msa_hsub_s_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return SIGNED_ODD(arg1, df) - SIGNED_EVEN(arg2, df);
+}
+
+void helper_msa_hsub_s_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_hsub_s_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_hsub_s_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_hsub_s_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_hsub_s_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_hsub_s_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_hsub_s_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_hsub_s_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_hsub_s_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_hsub_s_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_hsub_s_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_hsub_s_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_hsub_s_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_hsub_s_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_hsub_s_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_hsub_s_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_hsub_s_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_hsub_u_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    return UNSIGNED_ODD(arg1, df) - UNSIGNED_EVEN(arg2, df);
+}
+
+void helper_msa_hsub_u_h(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_hsub_u_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_hsub_u_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_hsub_u_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_hsub_u_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_hsub_u_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_hsub_u_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_hsub_u_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_hsub_u_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_hsub_u_w(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_hsub_u_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_hsub_u_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_hsub_u_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_hsub_u_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_hsub_u_d(CPUMIPSState *env,
+                         uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_hsub_u_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_hsub_u_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
 
 
 /*
@@ -1995,7 +3200,421 @@ void helper_msa_mod_u_d(CPUMIPSState *env,
  * +---------------+----------------------------------------------------------+
  */
 
-/* TODO: insert Interleave group helpers here */
+
+void helper_msa_ilvev_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->b[8]  = pws->b[9];
+    pwd->b[9]  = pwt->b[9];
+    pwd->b[10] = pws->b[11];
+    pwd->b[11] = pwt->b[11];
+    pwd->b[12] = pws->b[13];
+    pwd->b[13] = pwt->b[13];
+    pwd->b[14] = pws->b[15];
+    pwd->b[15] = pwt->b[15];
+    pwd->b[0]  = pws->b[1];
+    pwd->b[1]  = pwt->b[1];
+    pwd->b[2]  = pws->b[3];
+    pwd->b[3]  = pwt->b[3];
+    pwd->b[4]  = pws->b[5];
+    pwd->b[5]  = pwt->b[5];
+    pwd->b[6]  = pws->b[7];
+    pwd->b[7]  = pwt->b[7];
+#else
+    pwd->b[15] = pws->b[14];
+    pwd->b[14] = pwt->b[14];
+    pwd->b[13] = pws->b[12];
+    pwd->b[12] = pwt->b[12];
+    pwd->b[11] = pws->b[10];
+    pwd->b[10] = pwt->b[10];
+    pwd->b[9]  = pws->b[8];
+    pwd->b[8]  = pwt->b[8];
+    pwd->b[7]  = pws->b[6];
+    pwd->b[6]  = pwt->b[6];
+    pwd->b[5]  = pws->b[4];
+    pwd->b[4]  = pwt->b[4];
+    pwd->b[3]  = pws->b[2];
+    pwd->b[2]  = pwt->b[2];
+    pwd->b[1]  = pws->b[0];
+    pwd->b[0]  = pwt->b[0];
+#endif
+}
+
+void helper_msa_ilvev_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->h[4] = pws->h[5];
+    pwd->h[5] = pwt->h[5];
+    pwd->h[6] = pws->h[7];
+    pwd->h[7] = pwt->h[7];
+    pwd->h[0] = pws->h[1];
+    pwd->h[1] = pwt->h[1];
+    pwd->h[2] = pws->h[3];
+    pwd->h[3] = pwt->h[3];
+#else
+    pwd->h[7] = pws->h[6];
+    pwd->h[6] = pwt->h[6];
+    pwd->h[5] = pws->h[4];
+    pwd->h[4] = pwt->h[4];
+    pwd->h[3] = pws->h[2];
+    pwd->h[2] = pwt->h[2];
+    pwd->h[1] = pws->h[0];
+    pwd->h[0] = pwt->h[0];
+#endif
+}
+
+void helper_msa_ilvev_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->w[2] = pws->w[3];
+    pwd->w[3] = pwt->w[3];
+    pwd->w[0] = pws->w[1];
+    pwd->w[1] = pwt->w[1];
+#else
+    pwd->w[3] = pws->w[2];
+    pwd->w[2] = pwt->w[2];
+    pwd->w[1] = pws->w[0];
+    pwd->w[0] = pwt->w[0];
+#endif
+}
+
+void helper_msa_ilvev_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[1] = pws->d[0];
+    pwd->d[0] = pwt->d[0];
+}
+
+
+void helper_msa_ilvod_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->b[7]  = pwt->b[6];
+    pwd->b[6]  = pws->b[6];
+    pwd->b[5]  = pwt->b[4];
+    pwd->b[4]  = pws->b[4];
+    pwd->b[3]  = pwt->b[2];
+    pwd->b[2]  = pws->b[2];
+    pwd->b[1]  = pwt->b[0];
+    pwd->b[0]  = pws->b[0];
+    pwd->b[15] = pwt->b[14];
+    pwd->b[14] = pws->b[14];
+    pwd->b[13] = pwt->b[12];
+    pwd->b[12] = pws->b[12];
+    pwd->b[11] = pwt->b[10];
+    pwd->b[10] = pws->b[10];
+    pwd->b[9]  = pwt->b[8];
+    pwd->b[8]  = pws->b[8];
+#else
+    pwd->b[0]  = pwt->b[1];
+    pwd->b[1]  = pws->b[1];
+    pwd->b[2]  = pwt->b[3];
+    pwd->b[3]  = pws->b[3];
+    pwd->b[4]  = pwt->b[5];
+    pwd->b[5]  = pws->b[5];
+    pwd->b[6]  = pwt->b[7];
+    pwd->b[7]  = pws->b[7];
+    pwd->b[8]  = pwt->b[9];
+    pwd->b[9]  = pws->b[9];
+    pwd->b[10] = pwt->b[11];
+    pwd->b[11] = pws->b[11];
+    pwd->b[12] = pwt->b[13];
+    pwd->b[13] = pws->b[13];
+    pwd->b[14] = pwt->b[15];
+    pwd->b[15] = pws->b[15];
+#endif
+}
+
+void helper_msa_ilvod_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->h[3] = pwt->h[2];
+    pwd->h[2] = pws->h[2];
+    pwd->h[1] = pwt->h[0];
+    pwd->h[0] = pws->h[0];
+    pwd->h[7] = pwt->h[6];
+    pwd->h[6] = pws->h[6];
+    pwd->h[5] = pwt->h[4];
+    pwd->h[4] = pws->h[4];
+#else
+    pwd->h[0] = pwt->h[1];
+    pwd->h[1] = pws->h[1];
+    pwd->h[2] = pwt->h[3];
+    pwd->h[3] = pws->h[3];
+    pwd->h[4] = pwt->h[5];
+    pwd->h[5] = pws->h[5];
+    pwd->h[6] = pwt->h[7];
+    pwd->h[7] = pws->h[7];
+#endif
+}
+
+void helper_msa_ilvod_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->w[1] = pwt->w[0];
+    pwd->w[0] = pws->w[0];
+    pwd->w[3] = pwt->w[2];
+    pwd->w[2] = pws->w[2];
+#else
+    pwd->w[0] = pwt->w[1];
+    pwd->w[1] = pws->w[1];
+    pwd->w[2] = pwt->w[3];
+    pwd->w[3] = pws->w[3];
+#endif
+}
+
+void helper_msa_ilvod_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0] = pwt->d[1];
+    pwd->d[1] = pws->d[1];
+}
+
+
+void helper_msa_ilvl_b(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->b[7]  = pwt->b[15];
+    pwd->b[6]  = pws->b[15];
+    pwd->b[5]  = pwt->b[14];
+    pwd->b[4]  = pws->b[14];
+    pwd->b[3]  = pwt->b[13];
+    pwd->b[2]  = pws->b[13];
+    pwd->b[1]  = pwt->b[12];
+    pwd->b[0]  = pws->b[12];
+    pwd->b[15] = pwt->b[11];
+    pwd->b[14] = pws->b[11];
+    pwd->b[13] = pwt->b[10];
+    pwd->b[12] = pws->b[10];
+    pwd->b[11] = pwt->b[9];
+    pwd->b[10] = pws->b[9];
+    pwd->b[9]  = pwt->b[8];
+    pwd->b[8]  = pws->b[8];
+#else
+    pwd->b[0]  = pwt->b[8];
+    pwd->b[1]  = pws->b[8];
+    pwd->b[2]  = pwt->b[9];
+    pwd->b[3]  = pws->b[9];
+    pwd->b[4]  = pwt->b[10];
+    pwd->b[5]  = pws->b[10];
+    pwd->b[6]  = pwt->b[11];
+    pwd->b[7]  = pws->b[11];
+    pwd->b[8]  = pwt->b[12];
+    pwd->b[9]  = pws->b[12];
+    pwd->b[10] = pwt->b[13];
+    pwd->b[11] = pws->b[13];
+    pwd->b[12] = pwt->b[14];
+    pwd->b[13] = pws->b[14];
+    pwd->b[14] = pwt->b[15];
+    pwd->b[15] = pws->b[15];
+#endif
+}
+
+void helper_msa_ilvl_h(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->h[3] = pwt->h[7];
+    pwd->h[2] = pws->h[7];
+    pwd->h[1] = pwt->h[6];
+    pwd->h[0] = pws->h[6];
+    pwd->h[7] = pwt->h[5];
+    pwd->h[6] = pws->h[5];
+    pwd->h[5] = pwt->h[4];
+    pwd->h[4] = pws->h[4];
+#else
+    pwd->h[0] = pwt->h[4];
+    pwd->h[1] = pws->h[4];
+    pwd->h[2] = pwt->h[5];
+    pwd->h[3] = pws->h[5];
+    pwd->h[4] = pwt->h[6];
+    pwd->h[5] = pws->h[6];
+    pwd->h[6] = pwt->h[7];
+    pwd->h[7] = pws->h[7];
+#endif
+}
+
+void helper_msa_ilvl_w(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->w[1] = pwt->w[3];
+    pwd->w[0] = pws->w[3];
+    pwd->w[3] = pwt->w[2];
+    pwd->w[2] = pws->w[2];
+#else
+    pwd->w[0] = pwt->w[2];
+    pwd->w[1] = pws->w[2];
+    pwd->w[2] = pwt->w[3];
+    pwd->w[3] = pws->w[3];
+#endif
+}
+
+void helper_msa_ilvl_d(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0] = pwt->d[1];
+    pwd->d[1] = pws->d[1];
+}
+
+
+void helper_msa_ilvr_b(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->b[8]  = pws->b[0];
+    pwd->b[9]  = pwt->b[0];
+    pwd->b[10] = pws->b[1];
+    pwd->b[11] = pwt->b[1];
+    pwd->b[12] = pws->b[2];
+    pwd->b[13] = pwt->b[2];
+    pwd->b[14] = pws->b[3];
+    pwd->b[15] = pwt->b[3];
+    pwd->b[0]  = pws->b[4];
+    pwd->b[1]  = pwt->b[4];
+    pwd->b[2]  = pws->b[5];
+    pwd->b[3]  = pwt->b[5];
+    pwd->b[4]  = pws->b[6];
+    pwd->b[5]  = pwt->b[6];
+    pwd->b[6]  = pws->b[7];
+    pwd->b[7]  = pwt->b[7];
+#else
+    pwd->b[15] = pws->b[7];
+    pwd->b[14] = pwt->b[7];
+    pwd->b[13] = pws->b[6];
+    pwd->b[12] = pwt->b[6];
+    pwd->b[11] = pws->b[5];
+    pwd->b[10] = pwt->b[5];
+    pwd->b[9]  = pws->b[4];
+    pwd->b[8]  = pwt->b[4];
+    pwd->b[7]  = pws->b[3];
+    pwd->b[6]  = pwt->b[3];
+    pwd->b[5]  = pws->b[2];
+    pwd->b[4]  = pwt->b[2];
+    pwd->b[3]  = pws->b[1];
+    pwd->b[2]  = pwt->b[1];
+    pwd->b[1]  = pws->b[0];
+    pwd->b[0]  = pwt->b[0];
+#endif
+}
+
+void helper_msa_ilvr_h(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->h[4] = pws->h[0];
+    pwd->h[5] = pwt->h[0];
+    pwd->h[6] = pws->h[1];
+    pwd->h[7] = pwt->h[1];
+    pwd->h[0] = pws->h[2];
+    pwd->h[1] = pwt->h[2];
+    pwd->h[2] = pws->h[3];
+    pwd->h[3] = pwt->h[3];
+#else
+    pwd->h[7] = pws->h[3];
+    pwd->h[6] = pwt->h[3];
+    pwd->h[5] = pws->h[2];
+    pwd->h[4] = pwt->h[2];
+    pwd->h[3] = pws->h[1];
+    pwd->h[2] = pwt->h[1];
+    pwd->h[1] = pws->h[0];
+    pwd->h[0] = pwt->h[0];
+#endif
+}
+
+void helper_msa_ilvr_w(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->w[2] = pws->w[0];
+    pwd->w[3] = pwt->w[0];
+    pwd->w[0] = pws->w[1];
+    pwd->w[1] = pwt->w[1];
+#else
+    pwd->w[3] = pws->w[1];
+    pwd->w[2] = pwt->w[1];
+    pwd->w[1] = pws->w[0];
+    pwd->w[0] = pwt->w[0];
+#endif
+}
+
+void helper_msa_ilvr_d(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[1] = pws->d[0];
+    pwd->d[0] = pwt->d[0];
+}
 
 
 /*
@@ -2096,7 +3715,214 @@ void helper_msa_move_v(CPUMIPSState *env, uint32_t wd, uint32_t ws)
  * +---------------+----------------------------------------------------------+
  */
 
-/* TODO: insert Pack group helpers here */
+
+void helper_msa_pckev_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->b[8]  = pws->b[9];
+    pwd->b[10] = pws->b[13];
+    pwd->b[12] = pws->b[1];
+    pwd->b[14] = pws->b[5];
+    pwd->b[0]  = pwt->b[9];
+    pwd->b[2]  = pwt->b[13];
+    pwd->b[4]  = pwt->b[1];
+    pwd->b[6]  = pwt->b[5];
+    pwd->b[9]  = pws->b[11];
+    pwd->b[13] = pws->b[3];
+    pwd->b[1]  = pwt->b[11];
+    pwd->b[5]  = pwt->b[3];
+    pwd->b[11] = pws->b[15];
+    pwd->b[3]  = pwt->b[15];
+    pwd->b[15] = pws->b[7];
+    pwd->b[7]  = pwt->b[7];
+#else
+    pwd->b[15] = pws->b[14];
+    pwd->b[13] = pws->b[10];
+    pwd->b[11] = pws->b[6];
+    pwd->b[9]  = pws->b[2];
+    pwd->b[7]  = pwt->b[14];
+    pwd->b[5]  = pwt->b[10];
+    pwd->b[3]  = pwt->b[6];
+    pwd->b[1]  = pwt->b[2];
+    pwd->b[14] = pws->b[12];
+    pwd->b[10] = pws->b[4];
+    pwd->b[6]  = pwt->b[12];
+    pwd->b[2]  = pwt->b[4];
+    pwd->b[12] = pws->b[8];
+    pwd->b[4]  = pwt->b[8];
+    pwd->b[8]  = pws->b[0];
+    pwd->b[0]  = pwt->b[0];
+#endif
+}
+
+void helper_msa_pckev_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->h[4] = pws->h[5];
+    pwd->h[6] = pws->h[1];
+    pwd->h[0] = pwt->h[5];
+    pwd->h[2] = pwt->h[1];
+    pwd->h[5] = pws->h[7];
+    pwd->h[1] = pwt->h[7];
+    pwd->h[7] = pws->h[3];
+    pwd->h[3] = pwt->h[3];
+#else
+    pwd->h[7] = pws->h[6];
+    pwd->h[5] = pws->h[2];
+    pwd->h[3] = pwt->h[6];
+    pwd->h[1] = pwt->h[2];
+    pwd->h[6] = pws->h[4];
+    pwd->h[2] = pwt->h[4];
+    pwd->h[4] = pws->h[0];
+    pwd->h[0] = pwt->h[0];
+#endif
+}
+
+void helper_msa_pckev_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->w[2] = pws->w[3];
+    pwd->w[0] = pwt->w[3];
+    pwd->w[3] = pws->w[1];
+    pwd->w[1] = pwt->w[1];
+#else
+    pwd->w[3] = pws->w[2];
+    pwd->w[1] = pwt->w[2];
+    pwd->w[2] = pws->w[0];
+    pwd->w[0] = pwt->w[0];
+#endif
+}
+
+void helper_msa_pckev_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[1] = pws->d[0];
+    pwd->d[0] = pwt->d[0];
+}
+
+
+void helper_msa_pckod_b(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->b[7]  = pwt->b[6];
+    pwd->b[5]  = pwt->b[2];
+    pwd->b[3]  = pwt->b[14];
+    pwd->b[1]  = pwt->b[10];
+    pwd->b[15] = pws->b[6];
+    pwd->b[13] = pws->b[2];
+    pwd->b[11] = pws->b[14];
+    pwd->b[9]  = pws->b[10];
+    pwd->b[6]  = pwt->b[4];
+    pwd->b[2]  = pwt->b[12];
+    pwd->b[14] = pws->b[4];
+    pwd->b[10] = pws->b[12];
+    pwd->b[4]  = pwt->b[0];
+    pwd->b[12] = pws->b[0];
+    pwd->b[0]  = pwt->b[8];
+    pwd->b[8]  = pws->b[8];
+#else
+    pwd->b[0]  = pwt->b[1];
+    pwd->b[2]  = pwt->b[5];
+    pwd->b[4]  = pwt->b[9];
+    pwd->b[6]  = pwt->b[13];
+    pwd->b[8]  = pws->b[1];
+    pwd->b[10] = pws->b[5];
+    pwd->b[12] = pws->b[9];
+    pwd->b[14] = pws->b[13];
+    pwd->b[1]  = pwt->b[3];
+    pwd->b[5]  = pwt->b[11];
+    pwd->b[9]  = pws->b[3];
+    pwd->b[13] = pws->b[11];
+    pwd->b[3]  = pwt->b[7];
+    pwd->b[11] = pws->b[7];
+    pwd->b[7]  = pwt->b[15];
+    pwd->b[15] = pws->b[15];
+#endif
+
+}
+
+void helper_msa_pckod_h(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->h[3] = pwt->h[2];
+    pwd->h[1] = pwt->h[6];
+    pwd->h[7] = pws->h[2];
+    pwd->h[5] = pws->h[6];
+    pwd->h[2] = pwt->h[0];
+    pwd->h[6] = pws->h[0];
+    pwd->h[0] = pwt->h[4];
+    pwd->h[4] = pws->h[4];
+#else
+    pwd->h[0] = pwt->h[1];
+    pwd->h[2] = pwt->h[5];
+    pwd->h[4] = pws->h[1];
+    pwd->h[6] = pws->h[5];
+    pwd->h[1] = pwt->h[3];
+    pwd->h[5] = pws->h[3];
+    pwd->h[3] = pwt->h[7];
+    pwd->h[7] = pws->h[7];
+#endif
+}
+
+void helper_msa_pckod_w(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+#if defined(HOST_WORDS_BIGENDIAN)
+    pwd->w[1] = pwt->w[0];
+    pwd->w[3] = pws->w[0];
+    pwd->w[0] = pwt->w[2];
+    pwd->w[2] = pws->w[2];
+#else
+    pwd->w[0] = pwt->w[1];
+    pwd->w[2] = pws->w[1];
+    pwd->w[1] = pwt->w[3];
+    pwd->w[3] = pws->w[3];
+#endif
+}
+
+void helper_msa_pckod_d(CPUMIPSState *env,
+                        uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0] = pwt->d[1];
+    pwd->d[1] = pws->d[1];
+}
 
 
 /*
@@ -2127,7 +3953,382 @@ void helper_msa_move_v(CPUMIPSState *env, uint32_t wd, uint32_t ws)
  * +---------------+----------------------------------------------------------+
  */
 
-/* TODO: insert Shift group helpers here */
+
+static inline int64_t msa_sll_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    int32_t b_arg2 = BIT_POSITION(arg2, df);
+    return arg1 << b_arg2;
+}
+
+void helper_msa_sll_b(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_sll_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_sll_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_sll_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_sll_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_sll_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_sll_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_sll_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_sll_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_sll_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_sll_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_sll_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_sll_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_sll_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_sll_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_sll_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_sll_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_sll_h(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_sll_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_sll_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_sll_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_sll_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_sll_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_sll_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_sll_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_sll_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_sll_w(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_sll_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_sll_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_sll_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_sll_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_sll_d(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_sll_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_sll_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_sra_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    int32_t b_arg2 = BIT_POSITION(arg2, df);
+    return arg1 >> b_arg2;
+}
+
+void helper_msa_sra_b(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_sra_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_sra_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_sra_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_sra_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_sra_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_sra_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_sra_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_sra_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_sra_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_sra_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_sra_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_sra_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_sra_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_sra_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_sra_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_sra_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_sra_h(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_sra_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_sra_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_sra_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_sra_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_sra_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_sra_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_sra_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_sra_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_sra_w(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_sra_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_sra_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_sra_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_sra_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_sra_d(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_sra_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_sra_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_srar_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    int32_t b_arg2 = BIT_POSITION(arg2, df);
+    if (b_arg2 == 0) {
+        return arg1;
+    } else {
+        int64_t r_bit = (arg1 >> (b_arg2 - 1)) & 1;
+        return (arg1 >> b_arg2) + r_bit;
+    }
+}
+
+void helper_msa_srar_b(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_srar_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_srar_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_srar_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_srar_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_srar_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_srar_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_srar_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_srar_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_srar_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_srar_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_srar_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_srar_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_srar_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_srar_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_srar_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_srar_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_srar_h(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_srar_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_srar_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_srar_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_srar_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_srar_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_srar_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_srar_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_srar_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_srar_w(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_srar_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_srar_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_srar_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_srar_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_srar_d(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_srar_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_srar_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_srl_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t u_arg1 = UNSIGNED(arg1, df);
+    int32_t b_arg2 = BIT_POSITION(arg2, df);
+    return u_arg1 >> b_arg2;
+}
+
+void helper_msa_srl_b(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_srl_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_srl_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_srl_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_srl_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_srl_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_srl_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_srl_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_srl_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_srl_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_srl_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_srl_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_srl_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_srl_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_srl_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_srl_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_srl_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_srl_h(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_srl_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_srl_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_srl_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_srl_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_srl_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_srl_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_srl_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_srl_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_srl_w(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_srl_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_srl_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_srl_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_srl_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_srl_d(CPUMIPSState *env,
+                      uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_srl_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_srl_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
+
+
+static inline int64_t msa_srlr_df(uint32_t df, int64_t arg1, int64_t arg2)
+{
+    uint64_t u_arg1 = UNSIGNED(arg1, df);
+    int32_t b_arg2 = BIT_POSITION(arg2, df);
+    if (b_arg2 == 0) {
+        return u_arg1;
+    } else {
+        uint64_t r_bit = (u_arg1 >> (b_arg2 - 1)) & 1;
+        return (u_arg1 >> b_arg2) + r_bit;
+    }
+}
+
+void helper_msa_srlr_b(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->b[0]  = msa_srlr_df(DF_BYTE, pws->b[0],  pwt->b[0]);
+    pwd->b[1]  = msa_srlr_df(DF_BYTE, pws->b[1],  pwt->b[1]);
+    pwd->b[2]  = msa_srlr_df(DF_BYTE, pws->b[2],  pwt->b[2]);
+    pwd->b[3]  = msa_srlr_df(DF_BYTE, pws->b[3],  pwt->b[3]);
+    pwd->b[4]  = msa_srlr_df(DF_BYTE, pws->b[4],  pwt->b[4]);
+    pwd->b[5]  = msa_srlr_df(DF_BYTE, pws->b[5],  pwt->b[5]);
+    pwd->b[6]  = msa_srlr_df(DF_BYTE, pws->b[6],  pwt->b[6]);
+    pwd->b[7]  = msa_srlr_df(DF_BYTE, pws->b[7],  pwt->b[7]);
+    pwd->b[8]  = msa_srlr_df(DF_BYTE, pws->b[8],  pwt->b[8]);
+    pwd->b[9]  = msa_srlr_df(DF_BYTE, pws->b[9],  pwt->b[9]);
+    pwd->b[10] = msa_srlr_df(DF_BYTE, pws->b[10], pwt->b[10]);
+    pwd->b[11] = msa_srlr_df(DF_BYTE, pws->b[11], pwt->b[11]);
+    pwd->b[12] = msa_srlr_df(DF_BYTE, pws->b[12], pwt->b[12]);
+    pwd->b[13] = msa_srlr_df(DF_BYTE, pws->b[13], pwt->b[13]);
+    pwd->b[14] = msa_srlr_df(DF_BYTE, pws->b[14], pwt->b[14]);
+    pwd->b[15] = msa_srlr_df(DF_BYTE, pws->b[15], pwt->b[15]);
+}
+
+void helper_msa_srlr_h(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->h[0]  = msa_srlr_df(DF_HALF, pws->h[0],  pwt->h[0]);
+    pwd->h[1]  = msa_srlr_df(DF_HALF, pws->h[1],  pwt->h[1]);
+    pwd->h[2]  = msa_srlr_df(DF_HALF, pws->h[2],  pwt->h[2]);
+    pwd->h[3]  = msa_srlr_df(DF_HALF, pws->h[3],  pwt->h[3]);
+    pwd->h[4]  = msa_srlr_df(DF_HALF, pws->h[4],  pwt->h[4]);
+    pwd->h[5]  = msa_srlr_df(DF_HALF, pws->h[5],  pwt->h[5]);
+    pwd->h[6]  = msa_srlr_df(DF_HALF, pws->h[6],  pwt->h[6]);
+    pwd->h[7]  = msa_srlr_df(DF_HALF, pws->h[7],  pwt->h[7]);
+}
+
+void helper_msa_srlr_w(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->w[0]  = msa_srlr_df(DF_WORD, pws->w[0],  pwt->w[0]);
+    pwd->w[1]  = msa_srlr_df(DF_WORD, pws->w[1],  pwt->w[1]);
+    pwd->w[2]  = msa_srlr_df(DF_WORD, pws->w[2],  pwt->w[2]);
+    pwd->w[3]  = msa_srlr_df(DF_WORD, pws->w[3],  pwt->w[3]);
+}
+
+void helper_msa_srlr_d(CPUMIPSState *env,
+                       uint32_t wd, uint32_t ws, uint32_t wt)
+{
+    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
+    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
+    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
+
+    pwd->d[0]  = msa_srlr_df(DF_DOUBLE, pws->d[0],  pwt->d[0]);
+    pwd->d[1]  = msa_srlr_df(DF_DOUBLE, pws->d[1],  pwt->d[1]);
+}
 
 
 #define MSA_FN_IMM8(FUNC, DEST, OPERATION)                              \
@@ -2199,40 +4400,11 @@ void helper_msa_shf_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
     msa_move_v(pwd, pwx);
 }
 
-static inline int64_t msa_addv_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return arg1 + arg2;
-}
-
 static inline int64_t msa_subv_df(uint32_t df, int64_t arg1, int64_t arg2)
 {
     return arg1 - arg2;
 }
 
-static inline int64_t msa_max_s_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return arg1 > arg2 ? arg1 : arg2;
-}
-
-static inline int64_t msa_max_u_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t u_arg1 = UNSIGNED(arg1, df);
-    uint64_t u_arg2 = UNSIGNED(arg2, df);
-    return u_arg1 > u_arg2 ? arg1 : arg2;
-}
-
-static inline int64_t msa_min_s_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return arg1 < arg2 ? arg1 : arg2;
-}
-
-static inline int64_t msa_min_u_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t u_arg1 = UNSIGNED(arg1, df);
-    uint64_t u_arg2 = UNSIGNED(arg2, df);
-    return u_arg1 < u_arg2 ? arg1 : arg2;
-}
-
 #define MSA_BINOP_IMM_DF(helper, func)                                  \
 void helper_msa_ ## helper ## _df(CPUMIPSState *env, uint32_t df,       \
                         uint32_t wd, uint32_t ws, int32_t u5)           \
@@ -2312,25 +4484,6 @@ void helper_msa_ldi_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
     }
 }
 
-static inline int64_t msa_sll_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    int32_t b_arg2 = BIT_POSITION(arg2, df);
-    return arg1 << b_arg2;
-}
-
-static inline int64_t msa_sra_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    int32_t b_arg2 = BIT_POSITION(arg2, df);
-    return arg1 >> b_arg2;
-}
-
-static inline int64_t msa_srl_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t u_arg1 = UNSIGNED(arg1, df);
-    int32_t b_arg2 = BIT_POSITION(arg2, df);
-    return u_arg1 >> b_arg2;
-}
-
 static inline int64_t msa_sat_s_df(uint32_t df, int64_t arg, uint32_t m)
 {
     return arg < M_MIN_INT(m + 1) ? M_MIN_INT(m + 1) :
@@ -2345,29 +4498,6 @@ static inline int64_t msa_sat_u_df(uint32_t df, int64_t arg, uint32_t m)
                                         M_MAX_UINT(m + 1);
 }
 
-static inline int64_t msa_srar_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    int32_t b_arg2 = BIT_POSITION(arg2, df);
-    if (b_arg2 == 0) {
-        return arg1;
-    } else {
-        int64_t r_bit = (arg1 >> (b_arg2 - 1)) & 1;
-        return (arg1 >> b_arg2) + r_bit;
-    }
-}
-
-static inline int64_t msa_srlr_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t u_arg1 = UNSIGNED(arg1, df);
-    int32_t b_arg2 = BIT_POSITION(arg2, df);
-    if (b_arg2 == 0) {
-        return u_arg1;
-    } else {
-        uint64_t r_bit = (u_arg1 >> (b_arg2 - 1)) & 1;
-        return (u_arg1 >> b_arg2) + r_bit;
-    }
-}
-
 #define MSA_BINOP_IMMU_DF(helper, func)                                  \
 void helper_msa_ ## helper ## _df(CPUMIPSState *env, uint32_t df, uint32_t wd, \
                        uint32_t ws, uint32_t u5)                        \
@@ -2456,58 +4586,6 @@ MSA_TEROP_IMMU_DF(binsli, binsl)
 MSA_TEROP_IMMU_DF(binsri, binsr)
 #undef MSA_TEROP_IMMU_DF
 
-static inline int64_t msa_max_a_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
-    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
-    return abs_arg1 > abs_arg2 ? arg1 : arg2;
-}
-
-static inline int64_t msa_min_a_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
-    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
-    return abs_arg1 < abs_arg2 ? arg1 : arg2;
-}
-
-static inline int64_t msa_add_a_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
-    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
-    return abs_arg1 + abs_arg2;
-}
-
-static inline int64_t msa_adds_a_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    uint64_t max_int = (uint64_t)DF_MAX_INT(df);
-    uint64_t abs_arg1 = arg1 >= 0 ? arg1 : -arg1;
-    uint64_t abs_arg2 = arg2 >= 0 ? arg2 : -arg2;
-    if (abs_arg1 > max_int || abs_arg2 > max_int) {
-        return (int64_t)max_int;
-    } else {
-        return (abs_arg1 < max_int - abs_arg2) ? abs_arg1 + abs_arg2 : max_int;
-    }
-}
-
-static inline int64_t msa_adds_s_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    int64_t max_int = DF_MAX_INT(df);
-    int64_t min_int = DF_MIN_INT(df);
-    if (arg1 < 0) {
-        return (min_int - arg1 < arg2) ? arg1 + arg2 : min_int;
-    } else {
-        return (arg2 < max_int - arg1) ? arg1 + arg2 : max_int;
-    }
-}
-
-static inline uint64_t msa_adds_u_df(uint32_t df, uint64_t arg1, uint64_t arg2)
-{
-    uint64_t max_uint = DF_MAX_UINT(df);
-    uint64_t u_arg1 = UNSIGNED(arg1, df);
-    uint64_t u_arg2 = UNSIGNED(arg2, df);
-    return (u_arg1 < max_uint - u_arg2) ? u_arg1 + u_arg2 : max_uint;
-}
-
 static inline int64_t msa_subs_s_df(uint32_t df, int64_t arg1, int64_t arg2)
 {
     int64_t max_int = DF_MAX_INT(df);
@@ -2560,39 +4638,11 @@ static inline int64_t msa_subsuu_s_df(uint32_t df, int64_t arg1, int64_t arg2)
     }
 }
 
-static inline int64_t msa_asub_s_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    /* signed compare */
-    return (arg1 < arg2) ?
-        (uint64_t)(arg2 - arg1) : (uint64_t)(arg1 - arg2);
-}
-
-static inline uint64_t msa_asub_u_df(uint32_t df, uint64_t arg1, uint64_t arg2)
-{
-    uint64_t u_arg1 = UNSIGNED(arg1, df);
-    uint64_t u_arg2 = UNSIGNED(arg2, df);
-    /* unsigned compare */
-    return (u_arg1 < u_arg2) ?
-        (uint64_t)(u_arg2 - u_arg1) : (uint64_t)(u_arg1 - u_arg2);
-}
-
 static inline int64_t msa_mulv_df(uint32_t df, int64_t arg1, int64_t arg2)
 {
     return arg1 * arg2;
 }
 
-#define SIGNED_EVEN(a, df) \
-        ((((int64_t)(a)) << (64 - DF_BITS(df) / 2)) >> (64 - DF_BITS(df) / 2))
-
-#define UNSIGNED_EVEN(a, df) \
-        ((((uint64_t)(a)) << (64 - DF_BITS(df) / 2)) >> (64 - DF_BITS(df) / 2))
-
-#define SIGNED_ODD(a, df) \
-        ((((int64_t)(a)) << (64 - DF_BITS(df))) >> (64 - DF_BITS(df) / 2))
-
-#define UNSIGNED_ODD(a, df) \
-        ((((uint64_t)(a)) << (64 - DF_BITS(df))) >> (64 - DF_BITS(df) / 2))
-
 #define SIGNED_EXTRACT(e, o, a, df)     \
     do {                                \
         e = SIGNED_EVEN(a, df);         \
@@ -2669,26 +4719,6 @@ static inline void msa_sld_df(uint32_t df, wr_t *pwd,
     }
 }
 
-static inline int64_t msa_hadd_s_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return SIGNED_ODD(arg1, df) + SIGNED_EVEN(arg2, df);
-}
-
-static inline int64_t msa_hadd_u_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return UNSIGNED_ODD(arg1, df) + UNSIGNED_EVEN(arg2, df);
-}
-
-static inline int64_t msa_hsub_s_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return SIGNED_ODD(arg1, df) - SIGNED_EVEN(arg2, df);
-}
-
-static inline int64_t msa_hsub_u_df(uint32_t df, int64_t arg1, int64_t arg2)
-{
-    return UNSIGNED_ODD(arg1, df) - UNSIGNED_EVEN(arg2, df);
-}
-
 static inline int64_t msa_mul_q_df(uint32_t df, int64_t arg1, int64_t arg2)
 {
     int64_t q_min = DF_MIN_INT(df);
@@ -2764,36 +4794,14 @@ void helper_msa_ ## func ## _df(CPUMIPSState *env, uint32_t df,         \
     }                                                                   \
 }
 
-MSA_BINOP_DF(sll)
-MSA_BINOP_DF(sra)
-MSA_BINOP_DF(srl)
-MSA_BINOP_DF(addv)
 MSA_BINOP_DF(subv)
-MSA_BINOP_DF(max_s)
-MSA_BINOP_DF(max_u)
-MSA_BINOP_DF(min_s)
-MSA_BINOP_DF(min_u)
-MSA_BINOP_DF(max_a)
-MSA_BINOP_DF(min_a)
-MSA_BINOP_DF(add_a)
-MSA_BINOP_DF(adds_a)
-MSA_BINOP_DF(adds_s)
-MSA_BINOP_DF(adds_u)
 MSA_BINOP_DF(subs_s)
 MSA_BINOP_DF(subs_u)
 MSA_BINOP_DF(subsus_u)
 MSA_BINOP_DF(subsuu_s)
-MSA_BINOP_DF(asub_s)
-MSA_BINOP_DF(asub_u)
 MSA_BINOP_DF(mulv)
 MSA_BINOP_DF(dotp_s)
 MSA_BINOP_DF(dotp_u)
-MSA_BINOP_DF(srar)
-MSA_BINOP_DF(srlr)
-MSA_BINOP_DF(hadd_s)
-MSA_BINOP_DF(hadd_u)
-MSA_BINOP_DF(hsub_s)
-MSA_BINOP_DF(hsub_u)
 
 MSA_BINOP_DF(mul_q)
 MSA_BINOP_DF(mulr_q)
@@ -3129,535 +5137,6 @@ MSA_FN_DF(vshf_df)
 #undef MSA_FN_DF
 
 
-void helper_msa_ilvev_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
-                         uint32_t ws, uint32_t wt)
-{
-    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
-    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
-    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
-
-    switch (df) {
-    case DF_BYTE:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->b[8]  = pws->b[9];
-        pwd->b[9]  = pwt->b[9];
-        pwd->b[10] = pws->b[11];
-        pwd->b[11] = pwt->b[11];
-        pwd->b[12] = pws->b[13];
-        pwd->b[13] = pwt->b[13];
-        pwd->b[14] = pws->b[15];
-        pwd->b[15] = pwt->b[15];
-        pwd->b[0]  = pws->b[1];
-        pwd->b[1]  = pwt->b[1];
-        pwd->b[2]  = pws->b[3];
-        pwd->b[3]  = pwt->b[3];
-        pwd->b[4]  = pws->b[5];
-        pwd->b[5]  = pwt->b[5];
-        pwd->b[6]  = pws->b[7];
-        pwd->b[7]  = pwt->b[7];
-#else
-        pwd->b[15] = pws->b[14];
-        pwd->b[14] = pwt->b[14];
-        pwd->b[13] = pws->b[12];
-        pwd->b[12] = pwt->b[12];
-        pwd->b[11] = pws->b[10];
-        pwd->b[10] = pwt->b[10];
-        pwd->b[9]  = pws->b[8];
-        pwd->b[8]  = pwt->b[8];
-        pwd->b[7]  = pws->b[6];
-        pwd->b[6]  = pwt->b[6];
-        pwd->b[5]  = pws->b[4];
-        pwd->b[4]  = pwt->b[4];
-        pwd->b[3]  = pws->b[2];
-        pwd->b[2]  = pwt->b[2];
-        pwd->b[1]  = pws->b[0];
-        pwd->b[0]  = pwt->b[0];
-#endif
-        break;
-    case DF_HALF:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->h[4] = pws->h[5];
-        pwd->h[5] = pwt->h[5];
-        pwd->h[6] = pws->h[7];
-        pwd->h[7] = pwt->h[7];
-        pwd->h[0] = pws->h[1];
-        pwd->h[1] = pwt->h[1];
-        pwd->h[2] = pws->h[3];
-        pwd->h[3] = pwt->h[3];
-#else
-        pwd->h[7] = pws->h[6];
-        pwd->h[6] = pwt->h[6];
-        pwd->h[5] = pws->h[4];
-        pwd->h[4] = pwt->h[4];
-        pwd->h[3] = pws->h[2];
-        pwd->h[2] = pwt->h[2];
-        pwd->h[1] = pws->h[0];
-        pwd->h[0] = pwt->h[0];
-#endif
-        break;
-    case DF_WORD:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->w[2] = pws->w[3];
-        pwd->w[3] = pwt->w[3];
-        pwd->w[0] = pws->w[1];
-        pwd->w[1] = pwt->w[1];
-#else
-        pwd->w[3] = pws->w[2];
-        pwd->w[2] = pwt->w[2];
-        pwd->w[1] = pws->w[0];
-        pwd->w[0] = pwt->w[0];
-#endif
-        break;
-    case DF_DOUBLE:
-        pwd->d[1] = pws->d[0];
-        pwd->d[0] = pwt->d[0];
-        break;
-    default:
-        assert(0);
-    }
-}
-
-void helper_msa_ilvod_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
-                         uint32_t ws, uint32_t wt)
-{
-    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
-    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
-    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
-
-    switch (df) {
-    case DF_BYTE:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->b[7]  = pwt->b[6];
-        pwd->b[6]  = pws->b[6];
-        pwd->b[5]  = pwt->b[4];
-        pwd->b[4]  = pws->b[4];
-        pwd->b[3]  = pwt->b[2];
-        pwd->b[2]  = pws->b[2];
-        pwd->b[1]  = pwt->b[0];
-        pwd->b[0]  = pws->b[0];
-        pwd->b[15] = pwt->b[14];
-        pwd->b[14] = pws->b[14];
-        pwd->b[13] = pwt->b[12];
-        pwd->b[12] = pws->b[12];
-        pwd->b[11] = pwt->b[10];
-        pwd->b[10] = pws->b[10];
-        pwd->b[9]  = pwt->b[8];
-        pwd->b[8]  = pws->b[8];
-#else
-        pwd->b[0]  = pwt->b[1];
-        pwd->b[1]  = pws->b[1];
-        pwd->b[2]  = pwt->b[3];
-        pwd->b[3]  = pws->b[3];
-        pwd->b[4]  = pwt->b[5];
-        pwd->b[5]  = pws->b[5];
-        pwd->b[6]  = pwt->b[7];
-        pwd->b[7]  = pws->b[7];
-        pwd->b[8]  = pwt->b[9];
-        pwd->b[9]  = pws->b[9];
-        pwd->b[10] = pwt->b[11];
-        pwd->b[11] = pws->b[11];
-        pwd->b[12] = pwt->b[13];
-        pwd->b[13] = pws->b[13];
-        pwd->b[14] = pwt->b[15];
-        pwd->b[15] = pws->b[15];
-#endif
-        break;
-    case DF_HALF:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->h[3] = pwt->h[2];
-        pwd->h[2] = pws->h[2];
-        pwd->h[1] = pwt->h[0];
-        pwd->h[0] = pws->h[0];
-        pwd->h[7] = pwt->h[6];
-        pwd->h[6] = pws->h[6];
-        pwd->h[5] = pwt->h[4];
-        pwd->h[4] = pws->h[4];
-#else
-        pwd->h[0] = pwt->h[1];
-        pwd->h[1] = pws->h[1];
-        pwd->h[2] = pwt->h[3];
-        pwd->h[3] = pws->h[3];
-        pwd->h[4] = pwt->h[5];
-        pwd->h[5] = pws->h[5];
-        pwd->h[6] = pwt->h[7];
-        pwd->h[7] = pws->h[7];
-#endif
-        break;
-    case DF_WORD:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->w[1] = pwt->w[0];
-        pwd->w[0] = pws->w[0];
-        pwd->w[3] = pwt->w[2];
-        pwd->w[2] = pws->w[2];
-#else
-        pwd->w[0] = pwt->w[1];
-        pwd->w[1] = pws->w[1];
-        pwd->w[2] = pwt->w[3];
-        pwd->w[3] = pws->w[3];
-#endif
-        break;
-    case DF_DOUBLE:
-        pwd->d[0] = pwt->d[1];
-        pwd->d[1] = pws->d[1];
-        break;
-    default:
-        assert(0);
-    }
-}
-
-void helper_msa_ilvl_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
-                        uint32_t ws, uint32_t wt)
-{
-    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
-    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
-    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
-
-    switch (df) {
-    case DF_BYTE:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->b[7]  = pwt->b[15];
-        pwd->b[6]  = pws->b[15];
-        pwd->b[5]  = pwt->b[14];
-        pwd->b[4]  = pws->b[14];
-        pwd->b[3]  = pwt->b[13];
-        pwd->b[2]  = pws->b[13];
-        pwd->b[1]  = pwt->b[12];
-        pwd->b[0]  = pws->b[12];
-        pwd->b[15] = pwt->b[11];
-        pwd->b[14] = pws->b[11];
-        pwd->b[13] = pwt->b[10];
-        pwd->b[12] = pws->b[10];
-        pwd->b[11] = pwt->b[9];
-        pwd->b[10] = pws->b[9];
-        pwd->b[9]  = pwt->b[8];
-        pwd->b[8]  = pws->b[8];
-#else
-        pwd->b[0]  = pwt->b[8];
-        pwd->b[1]  = pws->b[8];
-        pwd->b[2]  = pwt->b[9];
-        pwd->b[3]  = pws->b[9];
-        pwd->b[4]  = pwt->b[10];
-        pwd->b[5]  = pws->b[10];
-        pwd->b[6]  = pwt->b[11];
-        pwd->b[7]  = pws->b[11];
-        pwd->b[8]  = pwt->b[12];
-        pwd->b[9]  = pws->b[12];
-        pwd->b[10] = pwt->b[13];
-        pwd->b[11] = pws->b[13];
-        pwd->b[12] = pwt->b[14];
-        pwd->b[13] = pws->b[14];
-        pwd->b[14] = pwt->b[15];
-        pwd->b[15] = pws->b[15];
-#endif
-        break;
-    case DF_HALF:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->h[3] = pwt->h[7];
-        pwd->h[2] = pws->h[7];
-        pwd->h[1] = pwt->h[6];
-        pwd->h[0] = pws->h[6];
-        pwd->h[7] = pwt->h[5];
-        pwd->h[6] = pws->h[5];
-        pwd->h[5] = pwt->h[4];
-        pwd->h[4] = pws->h[4];
-#else
-        pwd->h[0] = pwt->h[4];
-        pwd->h[1] = pws->h[4];
-        pwd->h[2] = pwt->h[5];
-        pwd->h[3] = pws->h[5];
-        pwd->h[4] = pwt->h[6];
-        pwd->h[5] = pws->h[6];
-        pwd->h[6] = pwt->h[7];
-        pwd->h[7] = pws->h[7];
-#endif
-        break;
-    case DF_WORD:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->w[1] = pwt->w[3];
-        pwd->w[0] = pws->w[3];
-        pwd->w[3] = pwt->w[2];
-        pwd->w[2] = pws->w[2];
-#else
-        pwd->w[0] = pwt->w[2];
-        pwd->w[1] = pws->w[2];
-        pwd->w[2] = pwt->w[3];
-        pwd->w[3] = pws->w[3];
-#endif
-        break;
-    case DF_DOUBLE:
-        pwd->d[0] = pwt->d[1];
-        pwd->d[1] = pws->d[1];
-        break;
-    default:
-        assert(0);
-    }
-}
-
-void helper_msa_ilvr_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
-                        uint32_t ws, uint32_t wt)
-{
-    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
-    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
-    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
-
-    switch (df) {
-    case DF_BYTE:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->b[8]  = pws->b[0];
-        pwd->b[9]  = pwt->b[0];
-        pwd->b[10] = pws->b[1];
-        pwd->b[11] = pwt->b[1];
-        pwd->b[12] = pws->b[2];
-        pwd->b[13] = pwt->b[2];
-        pwd->b[14] = pws->b[3];
-        pwd->b[15] = pwt->b[3];
-        pwd->b[0]  = pws->b[4];
-        pwd->b[1]  = pwt->b[4];
-        pwd->b[2]  = pws->b[5];
-        pwd->b[3]  = pwt->b[5];
-        pwd->b[4]  = pws->b[6];
-        pwd->b[5]  = pwt->b[6];
-        pwd->b[6]  = pws->b[7];
-        pwd->b[7]  = pwt->b[7];
-#else
-        pwd->b[15] = pws->b[7];
-        pwd->b[14] = pwt->b[7];
-        pwd->b[13] = pws->b[6];
-        pwd->b[12] = pwt->b[6];
-        pwd->b[11] = pws->b[5];
-        pwd->b[10] = pwt->b[5];
-        pwd->b[9]  = pws->b[4];
-        pwd->b[8]  = pwt->b[4];
-        pwd->b[7]  = pws->b[3];
-        pwd->b[6]  = pwt->b[3];
-        pwd->b[5]  = pws->b[2];
-        pwd->b[4]  = pwt->b[2];
-        pwd->b[3]  = pws->b[1];
-        pwd->b[2]  = pwt->b[1];
-        pwd->b[1]  = pws->b[0];
-        pwd->b[0]  = pwt->b[0];
-#endif
-        break;
-    case DF_HALF:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->h[4] = pws->h[0];
-        pwd->h[5] = pwt->h[0];
-        pwd->h[6] = pws->h[1];
-        pwd->h[7] = pwt->h[1];
-        pwd->h[0] = pws->h[2];
-        pwd->h[1] = pwt->h[2];
-        pwd->h[2] = pws->h[3];
-        pwd->h[3] = pwt->h[3];
-#else
-        pwd->h[7] = pws->h[3];
-        pwd->h[6] = pwt->h[3];
-        pwd->h[5] = pws->h[2];
-        pwd->h[4] = pwt->h[2];
-        pwd->h[3] = pws->h[1];
-        pwd->h[2] = pwt->h[1];
-        pwd->h[1] = pws->h[0];
-        pwd->h[0] = pwt->h[0];
-#endif
-        break;
-    case DF_WORD:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->w[2] = pws->w[0];
-        pwd->w[3] = pwt->w[0];
-        pwd->w[0] = pws->w[1];
-        pwd->w[1] = pwt->w[1];
-#else
-        pwd->w[3] = pws->w[1];
-        pwd->w[2] = pwt->w[1];
-        pwd->w[1] = pws->w[0];
-        pwd->w[0] = pwt->w[0];
-#endif
-        break;
-    case DF_DOUBLE:
-        pwd->d[1] = pws->d[0];
-        pwd->d[0] = pwt->d[0];
-        break;
-    default:
-        assert(0);
-    }
-}
-
-void helper_msa_pckev_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
-                         uint32_t ws, uint32_t wt)
-{
-    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
-    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
-    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
-
-    switch (df) {
-    case DF_BYTE:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->b[8]  = pws->b[9];
-        pwd->b[10] = pws->b[13];
-        pwd->b[12] = pws->b[1];
-        pwd->b[14] = pws->b[5];
-        pwd->b[0]  = pwt->b[9];
-        pwd->b[2]  = pwt->b[13];
-        pwd->b[4]  = pwt->b[1];
-        pwd->b[6]  = pwt->b[5];
-        pwd->b[9]  = pws->b[11];
-        pwd->b[13] = pws->b[3];
-        pwd->b[1]  = pwt->b[11];
-        pwd->b[5]  = pwt->b[3];
-        pwd->b[11] = pws->b[15];
-        pwd->b[3]  = pwt->b[15];
-        pwd->b[15] = pws->b[7];
-        pwd->b[7]  = pwt->b[7];
-#else
-        pwd->b[15] = pws->b[14];
-        pwd->b[13] = pws->b[10];
-        pwd->b[11] = pws->b[6];
-        pwd->b[9]  = pws->b[2];
-        pwd->b[7]  = pwt->b[14];
-        pwd->b[5]  = pwt->b[10];
-        pwd->b[3]  = pwt->b[6];
-        pwd->b[1]  = pwt->b[2];
-        pwd->b[14] = pws->b[12];
-        pwd->b[10] = pws->b[4];
-        pwd->b[6]  = pwt->b[12];
-        pwd->b[2]  = pwt->b[4];
-        pwd->b[12] = pws->b[8];
-        pwd->b[4]  = pwt->b[8];
-        pwd->b[8]  = pws->b[0];
-        pwd->b[0]  = pwt->b[0];
-#endif
-        break;
-    case DF_HALF:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->h[4] = pws->h[5];
-        pwd->h[6] = pws->h[1];
-        pwd->h[0] = pwt->h[5];
-        pwd->h[2] = pwt->h[1];
-        pwd->h[5] = pws->h[7];
-        pwd->h[1] = pwt->h[7];
-        pwd->h[7] = pws->h[3];
-        pwd->h[3] = pwt->h[3];
-#else
-        pwd->h[7] = pws->h[6];
-        pwd->h[5] = pws->h[2];
-        pwd->h[3] = pwt->h[6];
-        pwd->h[1] = pwt->h[2];
-        pwd->h[6] = pws->h[4];
-        pwd->h[2] = pwt->h[4];
-        pwd->h[4] = pws->h[0];
-        pwd->h[0] = pwt->h[0];
-#endif
-        break;
-    case DF_WORD:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->w[2] = pws->w[3];
-        pwd->w[0] = pwt->w[3];
-        pwd->w[3] = pws->w[1];
-        pwd->w[1] = pwt->w[1];
-#else
-        pwd->w[3] = pws->w[2];
-        pwd->w[1] = pwt->w[2];
-        pwd->w[2] = pws->w[0];
-        pwd->w[0] = pwt->w[0];
-#endif
-        break;
-    case DF_DOUBLE:
-        pwd->d[1] = pws->d[0];
-        pwd->d[0] = pwt->d[0];
-        break;
-    default:
-        assert(0);
-    }
-}
-
-void helper_msa_pckod_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
-                         uint32_t ws, uint32_t wt)
-{
-    wr_t *pwd = &(env->active_fpu.fpr[wd].wr);
-    wr_t *pws = &(env->active_fpu.fpr[ws].wr);
-    wr_t *pwt = &(env->active_fpu.fpr[wt].wr);
-
-    switch (df) {
-    case DF_BYTE:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->b[7]  = pwt->b[6];
-        pwd->b[5]  = pwt->b[2];
-        pwd->b[3]  = pwt->b[14];
-        pwd->b[1]  = pwt->b[10];
-        pwd->b[15] = pws->b[6];
-        pwd->b[13] = pws->b[2];
-        pwd->b[11] = pws->b[14];
-        pwd->b[9]  = pws->b[10];
-        pwd->b[6]  = pwt->b[4];
-        pwd->b[2]  = pwt->b[12];
-        pwd->b[14] = pws->b[4];
-        pwd->b[10] = pws->b[12];
-        pwd->b[4]  = pwt->b[0];
-        pwd->b[12] = pws->b[0];
-        pwd->b[0]  = pwt->b[8];
-        pwd->b[8]  = pws->b[8];
-#else
-        pwd->b[0]  = pwt->b[1];
-        pwd->b[2]  = pwt->b[5];
-        pwd->b[4]  = pwt->b[9];
-        pwd->b[6]  = pwt->b[13];
-        pwd->b[8]  = pws->b[1];
-        pwd->b[10] = pws->b[5];
-        pwd->b[12] = pws->b[9];
-        pwd->b[14] = pws->b[13];
-        pwd->b[1]  = pwt->b[3];
-        pwd->b[5]  = pwt->b[11];
-        pwd->b[9]  = pws->b[3];
-        pwd->b[13] = pws->b[11];
-        pwd->b[3]  = pwt->b[7];
-        pwd->b[11] = pws->b[7];
-        pwd->b[7]  = pwt->b[15];
-        pwd->b[15] = pws->b[15];
-#endif
-        break;
-    case DF_HALF:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->h[3] = pwt->h[2];
-        pwd->h[1] = pwt->h[6];
-        pwd->h[7] = pws->h[2];
-        pwd->h[5] = pws->h[6];
-        pwd->h[2] = pwt->h[0];
-        pwd->h[6] = pws->h[0];
-        pwd->h[0] = pwt->h[4];
-        pwd->h[4] = pws->h[4];
-#else
-        pwd->h[0] = pwt->h[1];
-        pwd->h[2] = pwt->h[5];
-        pwd->h[4] = pws->h[1];
-        pwd->h[6] = pws->h[5];
-        pwd->h[1] = pwt->h[3];
-        pwd->h[5] = pws->h[3];
-        pwd->h[3] = pwt->h[7];
-        pwd->h[7] = pws->h[7];
-#endif
-        break;
-    case DF_WORD:
-#if defined(HOST_WORDS_BIGENDIAN)
-        pwd->w[1] = pwt->w[0];
-        pwd->w[3] = pws->w[0];
-        pwd->w[0] = pwt->w[2];
-        pwd->w[2] = pws->w[2];
-#else
-        pwd->w[0] = pwt->w[1];
-        pwd->w[2] = pws->w[1];
-        pwd->w[1] = pwt->w[3];
-        pwd->w[3] = pws->w[3];
-#endif
-        break;
-    case DF_DOUBLE:
-        pwd->d[0] = pwt->d[1];
-        pwd->d[1] = pws->d[1];
-        break;
-    default:
-        assert(0);
-    }
-}
-
-
 void helper_msa_sldi_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
                         uint32_t ws, uint32_t n)
 {
diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index 4de64657ef..18fcee4a78 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -64,8 +64,7 @@ static inline type do_##name(CPUMIPSState *env, target_ulong addr,      \
 static inline type do_##name(CPUMIPSState *env, target_ulong addr,      \
                              int mem_idx, uintptr_t retaddr)            \
 {                                                                       \
-    switch (mem_idx)                                                    \
-    {                                                                   \
+    switch (mem_idx) {                                                  \
     case 0: return (type) cpu_##insn##_kernel_ra(env, addr, retaddr);   \
     case 1: return (type) cpu_##insn##_super_ra(env, addr, retaddr);    \
     default:                                                            \
@@ -92,12 +91,17 @@ static inline void do_##name(CPUMIPSState *env, target_ulong addr,      \
 static inline void do_##name(CPUMIPSState *env, target_ulong addr,      \
                              type val, int mem_idx, uintptr_t retaddr)  \
 {                                                                       \
-    switch (mem_idx)                                                    \
-    {                                                                   \
-    case 0: cpu_##insn##_kernel_ra(env, addr, val, retaddr); break;     \
-    case 1: cpu_##insn##_super_ra(env, addr, val, retaddr); break;      \
+    switch (mem_idx) {                                                  \
+    case 0:                                                             \
+        cpu_##insn##_kernel_ra(env, addr, val, retaddr);                \
+        break;                                                          \
+    case 1:                                                             \
+        cpu_##insn##_super_ra(env, addr, val, retaddr);                 \
+        break;                                                          \
     default:                                                            \
-    case 2: cpu_##insn##_user_ra(env, addr, val, retaddr); break;       \
+    case 2:                                                             \
+        cpu_##insn##_user_ra(env, addr, val, retaddr);                  \
+        break;                                                          \
     case 3:                                                             \
         cpu_##insn##_error_ra(env, addr, val, retaddr);                 \
         break;                                                          \
@@ -114,7 +118,8 @@ HELPER_ST(sd, stq, uint64_t)
 /* 64 bits arithmetic for 32 bits hosts */
 static inline uint64_t get_HILO(CPUMIPSState *env)
 {
-    return ((uint64_t)(env->active_tc.HI[0]) << 32) | (uint32_t)env->active_tc.LO[0];
+    return ((uint64_t)(env->active_tc.HI[0]) << 32) |
+           (uint32_t)env->active_tc.LO[0];
 }
 
 static inline target_ulong set_HIT0_LO(CPUMIPSState *env, uint64_t HILO)
@@ -435,9 +440,10 @@ void helper_swr(CPUMIPSState *env, target_ulong arg1, target_ulong arg2,
 }
 
 #if defined(TARGET_MIPS64)
-/* "half" load and stores.  We must do the memory access inline,
-   or fault handling won't work.  */
-
+/*
+ * "half" load and stores.  We must do the memory access inline,
+ * or fault handling won't work.
+ */
 #ifdef TARGET_WORDS_BIGENDIAN
 #define GET_LMASK64(v) ((v) & 7)
 #else
@@ -535,7 +541,7 @@ void helper_lwm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
-    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE (multiple_regs)) {
+    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         target_ulong i;
 
         for (i = 0; i < base_reglist; i++) {
@@ -557,7 +563,7 @@ void helper_swm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
-    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE (multiple_regs)) {
+    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         target_ulong i;
 
         for (i = 0; i < base_reglist; i++) {
@@ -579,7 +585,7 @@ void helper_ldm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
-    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE (multiple_regs)) {
+    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         target_ulong i;
 
         for (i = 0; i < base_reglist; i++) {
@@ -600,7 +606,7 @@ void helper_sdm(CPUMIPSState *env, target_ulong addr, target_ulong reglist,
     target_ulong base_reglist = reglist & 0xf;
     target_ulong do_r31 = reglist & 0x10;
 
-    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE (multiple_regs)) {
+    if (base_reglist > 0 && base_reglist <= ARRAY_SIZE(multiple_regs)) {
         target_ulong i;
 
         for (i = 0; i < base_reglist; i++) {
@@ -623,8 +629,10 @@ static bool mips_vpe_is_wfi(MIPSCPU *c)
     CPUState *cpu = CPU(c);
     CPUMIPSState *env = &c->env;
 
-    /* If the VPE is halted but otherwise active, it means it's waiting for
-       an interrupt.  */
+    /*
+     * If the VPE is halted but otherwise active, it means it's waiting for
+     * an interrupt.\
+     */
     return cpu->halted && mips_vpe_active(env);
 }
 
@@ -638,9 +646,11 @@ static bool mips_vp_is_wfi(MIPSCPU *c)
 
 static inline void mips_vpe_wake(MIPSCPU *c)
 {
-    /* Don't set ->halted = 0 directly, let it be done via cpu_has_work
-       because there might be other conditions that state that c should
-       be sleeping.  */
+    /*
+     * Don't set ->halted = 0 directly, let it be done via cpu_has_work
+     * because there might be other conditions that state that c should
+     * be sleeping.
+     */
     qemu_mutex_lock_iothread();
     cpu_interrupt(CPU(c), CPU_INTERRUPT_WAKE);
     qemu_mutex_unlock_iothread();
@@ -650,8 +660,10 @@ static inline void mips_vpe_sleep(MIPSCPU *cpu)
 {
     CPUState *cs = CPU(cpu);
 
-    /* The VPE was shut off, really go to bed.
-       Reset any old _WAKE requests.  */
+    /*
+     * The VPE was shut off, really go to bed.
+     * Reset any old _WAKE requests.
+     */
     cs->halted = 1;
     cpu_reset_interrupt(cs, CPU_INTERRUPT_WAKE);
 }
@@ -684,9 +696,12 @@ static inline void mips_tc_sleep(MIPSCPU *cpu, int tc)
  * This function will transform @tc into a local index within the
  * returned #CPUMIPSState.
  */
-/* FIXME: This code assumes that all VPEs have the same number of TCs,
-          which depends on runtime setup. Can probably be fixed by
-          walking the list of CPUMIPSStates.  */
+
+/*
+ * FIXME: This code assumes that all VPEs have the same number of TCs,
+ *        which depends on runtime setup. Can probably be fixed by
+ *        walking the list of CPUMIPSStates.
+ */
 static CPUMIPSState *mips_cpu_map_tc(CPUMIPSState *env, int *tc)
 {
     MIPSCPU *cpu;
@@ -712,17 +727,21 @@ static CPUMIPSState *mips_cpu_map_tc(CPUMIPSState *env, int *tc)
     return &cpu->env;
 }
 
-/* The per VPE CP0_Status register shares some fields with the per TC
-   CP0_TCStatus registers. These fields are wired to the same registers,
-   so changes to either of them should be reflected on both registers.
-
-   Also, EntryHi shares the bottom 8 bit ASID with TCStauts.
-
-   These helper call synchronizes the regs for a given cpu.  */
+/*
+ * The per VPE CP0_Status register shares some fields with the per TC
+ * CP0_TCStatus registers. These fields are wired to the same registers,
+ * so changes to either of them should be reflected on both registers.
+ *
+ * Also, EntryHi shares the bottom 8 bit ASID with TCStauts.
+ *
+ * These helper call synchronizes the regs for a given cpu.
+ */
 
-/* Called for updates to CP0_Status.  Defined in "cpu.h" for gdbstub.c.  */
-/* static inline void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu,
-                                     int tc);  */
+/*
+ * Called for updates to CP0_Status.  Defined in "cpu.h" for gdbstub.c.
+ * static inline void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu,
+ *                                   int tc);
+ */
 
 /* Called for updates to CP0_TCStatus.  */
 static void sync_c0_tcstatus(CPUMIPSState *cpu, int tc,
@@ -805,10 +824,11 @@ target_ulong helper_mftc0_tcstatus(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.CP0_TCStatus;
-    else
+    } else {
         return other->tcs[other_tc].CP0_TCStatus;
+    }
 }
 
 target_ulong helper_mfc0_tcbind(CPUMIPSState *env)
@@ -821,10 +841,11 @@ target_ulong helper_mftc0_tcbind(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.CP0_TCBind;
-    else
+    } else {
         return other->tcs[other_tc].CP0_TCBind;
+    }
 }
 
 target_ulong helper_mfc0_tcrestart(CPUMIPSState *env)
@@ -837,10 +858,11 @@ target_ulong helper_mftc0_tcrestart(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.PC;
-    else
+    } else {
         return other->tcs[other_tc].PC;
+    }
 }
 
 target_ulong helper_mfc0_tchalt(CPUMIPSState *env)
@@ -853,10 +875,11 @@ target_ulong helper_mftc0_tchalt(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.CP0_TCHalt;
-    else
+    } else {
         return other->tcs[other_tc].CP0_TCHalt;
+    }
 }
 
 target_ulong helper_mfc0_tccontext(CPUMIPSState *env)
@@ -869,10 +892,11 @@ target_ulong helper_mftc0_tccontext(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.CP0_TCContext;
-    else
+    } else {
         return other->tcs[other_tc].CP0_TCContext;
+    }
 }
 
 target_ulong helper_mfc0_tcschedule(CPUMIPSState *env)
@@ -885,10 +909,11 @@ target_ulong helper_mftc0_tcschedule(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.CP0_TCSchedule;
-    else
+    } else {
         return other->tcs[other_tc].CP0_TCSchedule;
+    }
 }
 
 target_ulong helper_mfc0_tcschefback(CPUMIPSState *env)
@@ -901,10 +926,11 @@ target_ulong helper_mftc0_tcschefback(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.CP0_TCScheFBack;
-    else
+    } else {
         return other->tcs[other_tc].CP0_TCScheFBack;
+    }
 }
 
 target_ulong helper_mfc0_count(CPUMIPSState *env)
@@ -987,8 +1013,9 @@ target_ulong helper_mfc0_watchhi(CPUMIPSState *env, uint32_t sel)
 target_ulong helper_mfc0_debug(CPUMIPSState *env)
 {
     target_ulong t0 = env->CP0_Debug;
-    if (env->hflags & MIPS_HFLAG_DM)
+    if (env->hflags & MIPS_HFLAG_DM) {
         t0 |= 1 << CP0DB_DM;
+    }
 
     return t0;
 }
@@ -999,10 +1026,11 @@ target_ulong helper_mftc0_debug(CPUMIPSState *env)
     int32_t tcstatus;
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         tcstatus = other->active_tc.CP0_Debug_tcstatus;
-    else
+    } else {
         tcstatus = other->tcs[other_tc].CP0_Debug_tcstatus;
+    }
 
     /* XXX: Might be wrong, check with EJTAG spec. */
     return (other->CP0_Debug & ~((1 << CP0DB_SSt) | (1 << CP0DB_Halt))) |
@@ -1076,14 +1104,16 @@ void helper_mtc0_mvpcontrol(CPUMIPSState *env, target_ulong arg1)
     uint32_t mask = 0;
     uint32_t newval;
 
-    if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP))
+    if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
         mask |= (1 << CP0MVPCo_CPA) | (1 << CP0MVPCo_VPC) |
                 (1 << CP0MVPCo_EVP);
-    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+    }
+    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
         mask |= (1 << CP0MVPCo_STLB);
+    }
     newval = (env->mvp->CP0_MVPControl & ~mask) | (arg1 & mask);
 
-    // TODO: Enable/disable shared TLB, enable/disable VPEs.
+    /* TODO: Enable/disable shared TLB, enable/disable VPEs. */
 
     env->mvp->CP0_MVPControl = newval;
 }
@@ -1097,10 +1127,12 @@ void helper_mtc0_vpecontrol(CPUMIPSState *env, target_ulong arg1)
            (1 << CP0VPECo_TE) | (0xff << CP0VPECo_TargTC);
     newval = (env->CP0_VPEControl & ~mask) | (arg1 & mask);
 
-    /* Yield scheduler intercept not implemented. */
-    /* Gating storage scheduler intercept not implemented. */
+    /*
+     * Yield scheduler intercept not implemented.
+     * Gating storage scheduler intercept not implemented.
+     */
 
-    // TODO: Enable/disable TCs.
+    /* TODO: Enable/disable TCs. */
 
     env->CP0_VPEControl = newval;
 }
@@ -1143,13 +1175,14 @@ void helper_mtc0_vpeconf0(CPUMIPSState *env, target_ulong arg1)
     uint32_t newval;
 
     if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
-        if (env->CP0_VPEConf0 & (1 << CP0VPEC0_VPA))
+        if (env->CP0_VPEConf0 & (1 << CP0VPEC0_VPA)) {
             mask |= (0xff << CP0VPEC0_XTC);
+        }
         mask |= (1 << CP0VPEC0_MVP) | (1 << CP0VPEC0_VPA);
     }
     newval = (env->CP0_VPEConf0 & ~mask) | (arg1 & mask);
 
-    // TODO: TC exclusive handling due to ERL/EXL.
+    /* TODO: TC exclusive handling due to ERL/EXL. */
 
     env->CP0_VPEConf0 = newval;
 }
@@ -1181,7 +1214,7 @@ void helper_mtc0_vpeconf1(CPUMIPSState *env, target_ulong arg1)
     /* UDI not implemented. */
     /* CP2 not implemented. */
 
-    // TODO: Handle FPU (CP1) binding.
+    /* TODO: Handle FPU (CP1) binding. */
 
     env->CP0_VPEConf1 = newval;
 }
@@ -1233,10 +1266,11 @@ void helper_mttc0_tcstatus(CPUMIPSState *env, target_ulong arg1)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.CP0_TCStatus = arg1;
-    else
+    } else {
         other->tcs[other_tc].CP0_TCStatus = arg1;
+    }
     sync_c0_tcstatus(other, other_tc, arg1);
 }
 
@@ -1245,8 +1279,9 @@ void helper_mtc0_tcbind(CPUMIPSState *env, target_ulong arg1)
     uint32_t mask = (1 << CP0TCBd_TBE);
     uint32_t newval;
 
-    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+    if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
         mask |= (1 << CP0TCBd_CurVPE);
+    }
     newval = (env->active_tc.CP0_TCBind & ~mask) | (arg1 & mask);
     env->active_tc.CP0_TCBind = newval;
 }
@@ -1258,8 +1293,9 @@ void helper_mttc0_tcbind(CPUMIPSState *env, target_ulong arg1)
     uint32_t newval;
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+    if (other->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
         mask |= (1 << CP0TCBd_CurVPE);
+    }
     if (other_tc == other->current_tc) {
         newval = (other->active_tc.CP0_TCBind & ~mask) | (arg1 & mask);
         other->active_tc.CP0_TCBind = newval;
@@ -1304,7 +1340,7 @@ void helper_mtc0_tchalt(CPUMIPSState *env, target_ulong arg1)
 
     env->active_tc.CP0_TCHalt = arg1 & 0x1;
 
-    // TODO: Halt TC / Restart (if allocated+active) TC.
+    /* TODO: Halt TC / Restart (if allocated+active) TC. */
     if (env->active_tc.CP0_TCHalt & 1) {
         mips_tc_sleep(cpu, env->current_tc);
     } else {
@@ -1318,12 +1354,13 @@ void helper_mttc0_tchalt(CPUMIPSState *env, target_ulong arg1)
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
     MIPSCPU *other_cpu = env_archcpu(other);
 
-    // TODO: Halt TC / Restart (if allocated+active) TC.
+    /* TODO: Halt TC / Restart (if allocated+active) TC. */
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.CP0_TCHalt = arg1;
-    else
+    } else {
         other->tcs[other_tc].CP0_TCHalt = arg1;
+    }
 
     if (arg1 & 1) {
         mips_tc_sleep(other_cpu, other_tc);
@@ -1342,10 +1379,11 @@ void helper_mttc0_tccontext(CPUMIPSState *env, target_ulong arg1)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.CP0_TCContext = arg1;
-    else
+    } else {
         other->tcs[other_tc].CP0_TCContext = arg1;
+    }
 }
 
 void helper_mtc0_tcschedule(CPUMIPSState *env, target_ulong arg1)
@@ -1358,10 +1396,11 @@ void helper_mttc0_tcschedule(CPUMIPSState *env, target_ulong arg1)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.CP0_TCSchedule = arg1;
-    else
+    } else {
         other->tcs[other_tc].CP0_TCSchedule = arg1;
+    }
 }
 
 void helper_mtc0_tcschefback(CPUMIPSState *env, target_ulong arg1)
@@ -1374,10 +1413,11 @@ void helper_mttc0_tcschefback(CPUMIPSState *env, target_ulong arg1)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.CP0_TCScheFBack = arg1;
-    else
+    } else {
         other->tcs[other_tc].CP0_TCScheFBack = arg1;
+    }
 }
 
 void helper_mtc0_entrylo1(CPUMIPSState *env, target_ulong arg1)
@@ -1703,9 +1743,15 @@ void helper_mtc0_status(CPUMIPSState *env, target_ulong arg1)
         case 3:
             qemu_log(", ERL\n");
             break;
-        case MIPS_HFLAG_UM: qemu_log(", UM\n"); break;
-        case MIPS_HFLAG_SM: qemu_log(", SM\n"); break;
-        case MIPS_HFLAG_KM: qemu_log("\n"); break;
+        case MIPS_HFLAG_UM:
+            qemu_log(", UM\n");
+            break;
+        case MIPS_HFLAG_SM:
+            qemu_log(", SM\n");
+            break;
+        case MIPS_HFLAG_KM:
+            qemu_log("\n");
+            break;
         default:
             cpu_abort(env_cpu(env), "Invalid MMU mode!\n");
             break;
@@ -1860,21 +1906,26 @@ void helper_mtc0_maari(CPUMIPSState *env, target_ulong arg1)
 {
     int index = arg1 & 0x3f;
     if (index == 0x3f) {
-        /* Software may write all ones to INDEX to determine the
-           maximum value supported. */
+        /*
+         * Software may write all ones to INDEX to determine the
+         *  maximum value supported.
+         */
         env->CP0_MAARI = MIPS_MAAR_MAX - 1;
     } else if (index < MIPS_MAAR_MAX) {
         env->CP0_MAARI = index;
     }
-    /* Other than the all ones, if the
-       value written is not supported, then INDEX is unchanged
-       from its previous value. */
+    /*
+     * Other than the all ones, if the value written is not supported,
+     * then INDEX is unchanged from its previous value.
+     */
 }
 
 void helper_mtc0_watchlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
 {
-    /* Watch exceptions for instructions, data loads, data stores
-       not implemented. */
+    /*
+     * Watch exceptions for instructions, data loads, data stores
+     * not implemented.
+     */
     env->CP0_WatchLo[sel] = (arg1 & ~0x7);
 }
 
@@ -1899,10 +1950,11 @@ void helper_mtc0_framemask(CPUMIPSState *env, target_ulong arg1)
 void helper_mtc0_debug(CPUMIPSState *env, target_ulong arg1)
 {
     env->CP0_Debug = (env->CP0_Debug & 0x8C03FC1F) | (arg1 & 0x13300120);
-    if (arg1 & (1 << CP0DB_DM))
+    if (arg1 & (1 << CP0DB_DM)) {
         env->hflags |= MIPS_HFLAG_DM;
-    else
+    } else {
         env->hflags &= ~MIPS_HFLAG_DM;
+    }
 }
 
 void helper_mttc0_debug(CPUMIPSState *env, target_ulong arg1)
@@ -1912,10 +1964,11 @@ void helper_mttc0_debug(CPUMIPSState *env, target_ulong arg1)
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
     /* XXX: Might be wrong, check with EJTAG spec. */
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.CP0_Debug_tcstatus = val;
-    else
+    } else {
         other->tcs[other_tc].CP0_Debug_tcstatus = val;
+    }
     other->CP0_Debug = (other->CP0_Debug &
                      ((1 << CP0DB_SSt) | (1 << CP0DB_Halt))) |
                      (arg1 & ~((1 << CP0DB_SSt) | (1 << CP0DB_Halt)));
@@ -1944,9 +1997,11 @@ void helper_mtc0_errctl(CPUMIPSState *env, target_ulong arg1)
 void helper_mtc0_taglo(CPUMIPSState *env, target_ulong arg1)
 {
     if (env->hflags & MIPS_HFLAG_ITC_CACHE) {
-        /* If CACHE instruction is configured for ITC tags then make all
-           CP0.TagLo bits writable. The actual write to ITC Configuration
-           Tag will take care of the read-only bits. */
+        /*
+         * If CACHE instruction is configured for ITC tags then make all
+         * CP0.TagLo bits writable. The actual write to ITC Configuration
+         * Tag will take care of the read-only bits.
+         */
         env->CP0_TagLo = arg1;
     } else {
         env->CP0_TagLo = arg1 & 0xFFFFFCF6;
@@ -1974,10 +2029,11 @@ target_ulong helper_mftgpr(CPUMIPSState *env, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.gpr[sel];
-    else
+    } else {
         return other->tcs[other_tc].gpr[sel];
+    }
 }
 
 target_ulong helper_mftlo(CPUMIPSState *env, uint32_t sel)
@@ -1985,10 +2041,11 @@ target_ulong helper_mftlo(CPUMIPSState *env, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.LO[sel];
-    else
+    } else {
         return other->tcs[other_tc].LO[sel];
+    }
 }
 
 target_ulong helper_mfthi(CPUMIPSState *env, uint32_t sel)
@@ -1996,10 +2053,11 @@ target_ulong helper_mfthi(CPUMIPSState *env, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.HI[sel];
-    else
+    } else {
         return other->tcs[other_tc].HI[sel];
+    }
 }
 
 target_ulong helper_mftacx(CPUMIPSState *env, uint32_t sel)
@@ -2007,10 +2065,11 @@ target_ulong helper_mftacx(CPUMIPSState *env, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.ACX[sel];
-    else
+    } else {
         return other->tcs[other_tc].ACX[sel];
+    }
 }
 
 target_ulong helper_mftdsp(CPUMIPSState *env)
@@ -2018,10 +2077,11 @@ target_ulong helper_mftdsp(CPUMIPSState *env)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         return other->active_tc.DSPControl;
-    else
+    } else {
         return other->tcs[other_tc].DSPControl;
+    }
 }
 
 void helper_mttgpr(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
@@ -2029,10 +2089,11 @@ void helper_mttgpr(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.gpr[sel] = arg1;
-    else
+    } else {
         other->tcs[other_tc].gpr[sel] = arg1;
+    }
 }
 
 void helper_mttlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
@@ -2040,10 +2101,11 @@ void helper_mttlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.LO[sel] = arg1;
-    else
+    } else {
         other->tcs[other_tc].LO[sel] = arg1;
+    }
 }
 
 void helper_mtthi(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
@@ -2051,10 +2113,11 @@ void helper_mtthi(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.HI[sel] = arg1;
-    else
+    } else {
         other->tcs[other_tc].HI[sel] = arg1;
+    }
 }
 
 void helper_mttacx(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
@@ -2062,10 +2125,11 @@ void helper_mttacx(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.ACX[sel] = arg1;
-    else
+    } else {
         other->tcs[other_tc].ACX[sel] = arg1;
+    }
 }
 
 void helper_mttdsp(CPUMIPSState *env, target_ulong arg1)
@@ -2073,22 +2137,23 @@ void helper_mttdsp(CPUMIPSState *env, target_ulong arg1)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
     CPUMIPSState *other = mips_cpu_map_tc(env, &other_tc);
 
-    if (other_tc == other->current_tc)
+    if (other_tc == other->current_tc) {
         other->active_tc.DSPControl = arg1;
-    else
+    } else {
         other->tcs[other_tc].DSPControl = arg1;
+    }
 }
 
 /* MIPS MT functions */
 target_ulong helper_dmt(void)
 {
-    // TODO
-     return 0;
+    /* TODO */
+    return 0;
 }
 
 target_ulong helper_emt(void)
 {
-    // TODO
+    /* TODO */
     return 0;
 }
 
@@ -2130,8 +2195,10 @@ target_ulong helper_evpe(CPUMIPSState *env)
 
 void helper_fork(target_ulong arg1, target_ulong arg2)
 {
-    // arg1 = rt, arg2 = rs
-    // TODO: store to TC register
+    /*
+     * arg1 = rt, arg2 = rs
+     * TODO: store to TC register
+     */
 }
 
 target_ulong helper_yield(CPUMIPSState *env, target_ulong arg)
@@ -2149,11 +2216,12 @@ target_ulong helper_yield(CPUMIPSState *env, target_ulong arg)
             }
         }
     } else if (arg1 == 0) {
-        if (0 /* TODO: TC underflow */) {
+        if (0) {
+            /* TODO: TC underflow */
             env->CP0_VPEControl &= ~(0x7 << CP0VPECo_EXCPT);
             do_raise_exception(env, EXCP_THREAD, GETPC());
         } else {
-            // TODO: Deallocate TC
+            /* TODO: Deallocate TC */
         }
     } else if (arg1 > 0) {
         /* Yield qualifier inputs not implemented. */
@@ -2193,8 +2261,10 @@ target_ulong helper_evp(CPUMIPSState *env)
         CPU_FOREACH(other_cs) {
             MIPSCPU *other_cpu = MIPS_CPU(other_cs);
             if ((&other_cpu->env != env) && !mips_vp_is_wfi(other_cpu)) {
-                /* If the VP is WFI, don't disturb its sleep.
-                 * Otherwise, wake it up. */
+                /*
+                 * If the VP is WFI, don't disturb its sleep.
+                 * Otherwise, wake it up.
+                 */
                 mips_vpe_wake(other_cpu);
             }
         }
@@ -2206,7 +2276,7 @@ target_ulong helper_evp(CPUMIPSState *env)
 
 #ifndef CONFIG_USER_ONLY
 /* TLB management */
-static void r4k_mips_tlb_flush_extra (CPUMIPSState *env, int first)
+static void r4k_mips_tlb_flush_extra(CPUMIPSState *env, int first)
 {
     /* Discard entries from env->tlb[first] onwards.  */
     while (env->tlb->tlb_in_use > first) {
@@ -2308,8 +2378,10 @@ void r4k_helper_tlbwi(CPUMIPSState *env)
     XI1 = (env->CP0_EntryLo1 >> CP0EnLo_XI) &1;
     RI1 = (env->CP0_EntryLo1 >> CP0EnLo_RI) &1;
 
-    /* Discard cached TLB entries, unless tlbwi is just upgrading access
-       permissions on the current entry. */
+    /*
+     * Discard cached TLB entries, unless tlbwi is just upgrading access
+     * permissions on the current entry.
+     */
     if (tlb->VPN != VPN || tlb->ASID != ASID || tlb->G != G ||
         (!tlb->EHINV && EHINV) ||
         (tlb->V0 && !V0) || (tlb->D0 && !D0) ||
@@ -2370,7 +2442,7 @@ void r4k_helper_tlbp(CPUMIPSState *env)
 #endif
             /* Check ASID, virtual page number & size */
             if ((tlb->G == 1 || tlb->ASID == ASID) && VPN == tag) {
-                r4k_mips_tlb_flush_extra (env, i);
+                r4k_mips_tlb_flush_extra(env, i);
                 break;
             }
         }
@@ -2400,8 +2472,9 @@ void r4k_helper_tlbr(CPUMIPSState *env)
     tlb = &env->tlb->mmu.r4k.tlb[idx];
 
     /* If this will change the current ASID, flush qemu's TLB.  */
-    if (ASID != tlb->ASID)
+    if (ASID != tlb->ASID) {
         cpu_mips_tlb_flush(env);
+    }
 
     r4k_mips_tlb_flush_extra(env, env->tlb->nb_tlb);
 
@@ -2476,10 +2549,12 @@ static void debug_pre_eret(CPUMIPSState *env)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         qemu_log("ERET: PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx,
                 env->active_tc.PC, env->CP0_EPC);
-        if (env->CP0_Status & (1 << CP0St_ERL))
+        if (env->CP0_Status & (1 << CP0St_ERL)) {
             qemu_log(" ErrorEPC " TARGET_FMT_lx, env->CP0_ErrorEPC);
-        if (env->hflags & MIPS_HFLAG_DM)
+        }
+        if (env->hflags & MIPS_HFLAG_DM) {
             qemu_log(" DEPC " TARGET_FMT_lx, env->CP0_DEPC);
+        }
         qemu_log("\n");
     }
 }
@@ -2489,17 +2564,25 @@ static void debug_post_eret(CPUMIPSState *env)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         qemu_log("  =>  PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx,
                 env->active_tc.PC, env->CP0_EPC);
-        if (env->CP0_Status & (1 << CP0St_ERL))
+        if (env->CP0_Status & (1 << CP0St_ERL)) {
             qemu_log(" ErrorEPC " TARGET_FMT_lx, env->CP0_ErrorEPC);
-        if (env->hflags & MIPS_HFLAG_DM)
+        }
+        if (env->hflags & MIPS_HFLAG_DM) {
             qemu_log(" DEPC " TARGET_FMT_lx, env->CP0_DEPC);
+        }
         switch (cpu_mmu_index(env, false)) {
         case 3:
             qemu_log(", ERL\n");
             break;
-        case MIPS_HFLAG_UM: qemu_log(", UM\n"); break;
-        case MIPS_HFLAG_SM: qemu_log(", SM\n"); break;
-        case MIPS_HFLAG_KM: qemu_log("\n"); break;
+        case MIPS_HFLAG_UM:
+            qemu_log(", UM\n");
+            break;
+        case MIPS_HFLAG_SM:
+            qemu_log(", SM\n");
+            break;
+        case MIPS_HFLAG_KM:
+            qemu_log("\n");
+            break;
         default:
             cpu_abort(env_cpu(env), "Invalid MMU mode!\n");
             break;
@@ -2609,8 +2692,9 @@ void helper_pmon(CPUMIPSState *env, int function)
     function /= 2;
     switch (function) {
     case 2: /* TODO: char inbyte(int waitflag); */
-        if (env->active_tc.gpr[4] == 0)
+        if (env->active_tc.gpr[4] == 0) {
             env->active_tc.gpr[2] = -1;
+        }
         /* Fall through */
     case 11: /* TODO: char inbyte (void); */
         env->active_tc.gpr[2] = -1;
@@ -2636,8 +2720,10 @@ void helper_wait(CPUMIPSState *env)
 
     cs->halted = 1;
     cpu_reset_interrupt(cs, CPU_INTERRUPT_WAKE);
-    /* Last instruction in the block, PC was updated before
-       - no need to recover PC and icount */
+    /*
+     * Last instruction in the block, PC was updated before
+     * - no need to recover PC and icount.
+     */
     raise_exception(env, EXCP_HLT);
 }
 
@@ -2731,13 +2817,15 @@ target_ulong helper_cfc1(CPUMIPSState *env, uint32_t reg)
         }
         break;
     case 25:
-        arg1 = ((env->active_fpu.fcr31 >> 24) & 0xfe) | ((env->active_fpu.fcr31 >> 23) & 0x1);
+        arg1 = ((env->active_fpu.fcr31 >> 24) & 0xfe) |
+               ((env->active_fpu.fcr31 >> 23) & 0x1);
         break;
     case 26:
         arg1 = env->active_fpu.fcr31 & 0x0003f07c;
         break;
     case 28:
-        arg1 = (env->active_fpu.fcr31 & 0x00000f83) | ((env->active_fpu.fcr31 >> 22) & 0x4);
+        arg1 = (env->active_fpu.fcr31 & 0x00000f83) |
+               ((env->active_fpu.fcr31 >> 22) & 0x4);
         break;
     default:
         arg1 = (int32_t)env->active_fpu.fcr31;
@@ -2802,19 +2890,24 @@ void helper_ctc1(CPUMIPSState *env, target_ulong arg1, uint32_t fs, uint32_t rt)
         if ((env->insn_flags & ISA_MIPS32R6) || (arg1 & 0xffffff00)) {
             return;
         }
-        env->active_fpu.fcr31 = (env->active_fpu.fcr31 & 0x017fffff) | ((arg1 & 0xfe) << 24) |
-                     ((arg1 & 0x1) << 23);
+        env->active_fpu.fcr31 = (env->active_fpu.fcr31 & 0x017fffff) |
+                                ((arg1 & 0xfe) << 24) |
+                                ((arg1 & 0x1) << 23);
         break;
     case 26:
-        if (arg1 & 0x007c0000)
+        if (arg1 & 0x007c0000) {
             return;
-        env->active_fpu.fcr31 = (env->active_fpu.fcr31 & 0xfffc0f83) | (arg1 & 0x0003f07c);
+        }
+        env->active_fpu.fcr31 = (env->active_fpu.fcr31 & 0xfffc0f83) |
+                                (arg1 & 0x0003f07c);
         break;
     case 28:
-        if (arg1 & 0x007c0000)
+        if (arg1 & 0x007c0000) {
             return;
-        env->active_fpu.fcr31 = (env->active_fpu.fcr31 & 0xfefff07c) | (arg1 & 0x00000f83) |
-                     ((arg1 & 0x4) << 22);
+        }
+        env->active_fpu.fcr31 = (env->active_fpu.fcr31 & 0xfefff07c) |
+                                (arg1 & 0x00000f83) |
+                                ((arg1 & 0x4) << 22);
         break;
     case 31:
         env->active_fpu.fcr31 = (arg1 & env->active_fpu.fcr31_rw_bitmask) |
@@ -2828,8 +2921,10 @@ void helper_ctc1(CPUMIPSState *env, target_ulong arg1, uint32_t fs, uint32_t rt)
     }
     restore_fp_status(env);
     set_float_exception_flags(0, &env->active_fpu.fp_status);
-    if ((GET_FP_ENABLE(env->active_fpu.fcr31) | 0x20) & GET_FP_CAUSE(env->active_fpu.fcr31))
+    if ((GET_FP_ENABLE(env->active_fpu.fcr31) | 0x20) &
+        GET_FP_CAUSE(env->active_fpu.fcr31)) {
         do_raise_exception(env, EXCP_FPE, GETPC());
+    }
 }
 
 int ieee_ex_to_mips(int xcpt)
@@ -2857,7 +2952,8 @@ int ieee_ex_to_mips(int xcpt)
 
 static inline void update_fcr31(CPUMIPSState *env, uintptr_t pc)
 {
-    int tmp = ieee_ex_to_mips(get_float_exception_flags(&env->active_fpu.fp_status));
+    int tmp = ieee_ex_to_mips(get_float_exception_flags(
+                                  &env->active_fpu.fp_status));
 
     SET_FP_CAUSE(env->active_fpu.fcr31, tmp);
 
@@ -2872,10 +2968,12 @@ static inline void update_fcr31(CPUMIPSState *env, uintptr_t pc)
     }
 }
 
-/* Float support.
-   Single precition routines have a "s" suffix, double precision a
-   "d" suffix, 32bit integer "w", 64bit integer "l", paired single "ps",
-   paired single lower "pl", paired single upper "pu".  */
+/*
+ * Float support.
+ * Single precition routines have a "s" suffix, double precision a
+ * "d" suffix, 32bit integer "w", 64bit integer "l", paired single "ps",
+ * paired single lower "pl", paired single upper "pu".
+ */
 
 /* unary operations, modifying fp status  */
 uint64_t helper_float_sqrt_d(CPUMIPSState *env, uint64_t fdt0)
@@ -3056,7 +3154,8 @@ uint64_t helper_float_round_l_d(CPUMIPSState *env, uint64_t fdt0)
 {
     uint64_t dt2;
 
-    set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+    set_float_rounding_mode(float_round_nearest_even,
+                            &env->active_fpu.fp_status);
     dt2 = float64_to_int64(fdt0, &env->active_fpu.fp_status);
     restore_rounding_mode(env);
     if (get_float_exception_flags(&env->active_fpu.fp_status)
@@ -3071,7 +3170,8 @@ uint64_t helper_float_round_l_s(CPUMIPSState *env, uint32_t fst0)
 {
     uint64_t dt2;
 
-    set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+    set_float_rounding_mode(float_round_nearest_even,
+                            &env->active_fpu.fp_status);
     dt2 = float32_to_int64(fst0, &env->active_fpu.fp_status);
     restore_rounding_mode(env);
     if (get_float_exception_flags(&env->active_fpu.fp_status)
@@ -3086,7 +3186,8 @@ uint32_t helper_float_round_w_d(CPUMIPSState *env, uint64_t fdt0)
 {
     uint32_t wt2;
 
-    set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+    set_float_rounding_mode(float_round_nearest_even,
+                            &env->active_fpu.fp_status);
     wt2 = float64_to_int32(fdt0, &env->active_fpu.fp_status);
     restore_rounding_mode(env);
     if (get_float_exception_flags(&env->active_fpu.fp_status)
@@ -3101,7 +3202,8 @@ uint32_t helper_float_round_w_s(CPUMIPSState *env, uint32_t fst0)
 {
     uint32_t wt2;
 
-    set_float_rounding_mode(float_round_nearest_even, &env->active_fpu.fp_status);
+    set_float_rounding_mode(float_round_nearest_even,
+                            &env->active_fpu.fp_status);
     wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);
     restore_rounding_mode(env);
     if (get_float_exception_flags(&env->active_fpu.fp_status)
@@ -3116,7 +3218,8 @@ uint64_t helper_float_trunc_l_d(CPUMIPSState *env, uint64_t fdt0)
 {
     uint64_t dt2;
 
-    dt2 = float64_to_int64_round_to_zero(fdt0, &env->active_fpu.fp_status);
+    dt2 = float64_to_int64_round_to_zero(fdt0,
+                                         &env->active_fpu.fp_status);
     if (get_float_exception_flags(&env->active_fpu.fp_status)
         & (float_flag_invalid | float_flag_overflow)) {
         dt2 = FP_TO_INT64_OVERFLOW;
@@ -3697,7 +3800,8 @@ uint64_t helper_float_recip1_ps(CPUMIPSState *env, uint64_t fdt0)
     uint32_t fst2;
     uint32_t fsth2;
 
-    fst2 = float32_div(float32_one, fdt0 & 0XFFFFFFFF, &env->active_fpu.fp_status);
+    fst2 = float32_div(float32_one, fdt0 & 0XFFFFFFFF,
+                       &env->active_fpu.fp_status);
     fsth2 = float32_div(float32_one, fdt0 >> 32, &env->active_fpu.fp_status);
     update_fcr31(env, GETPC());
     return ((uint64_t)fsth2 << 32) | fst2;
@@ -3737,8 +3841,8 @@ uint64_t helper_float_rsqrt1_ps(CPUMIPSState *env, uint64_t fdt0)
 }
 
 #define FLOAT_RINT(name, bits)                                              \
-uint ## bits ## _t helper_float_ ## name (CPUMIPSState *env,                \
-                                          uint ## bits ## _t fs)            \
+uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env,                 \
+                                         uint ## bits ## _t fs)             \
 {                                                                           \
     uint ## bits ## _t fdret;                                               \
                                                                             \
@@ -3763,8 +3867,8 @@ FLOAT_RINT(rint_d, 64)
 #define FLOAT_CLASS_POSITIVE_ZERO      0x200
 
 #define FLOAT_CLASS(name, bits)                                      \
-uint ## bits ## _t float_ ## name (uint ## bits ## _t arg,           \
-                                   float_status *status)             \
+uint ## bits ## _t float_ ## name(uint ## bits ## _t arg,            \
+                                  float_status *status)              \
 {                                                                    \
     if (float ## bits ## _is_signaling_nan(arg, status)) {           \
         return FLOAT_CLASS_SIGNALING_NAN;                            \
@@ -3793,8 +3897,8 @@ uint ## bits ## _t float_ ## name (uint ## bits ## _t arg,           \
     }                                                                \
 }                                                                    \
                                                                      \
-uint ## bits ## _t helper_float_ ## name (CPUMIPSState *env,         \
-                                          uint ## bits ## _t arg)    \
+uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env,          \
+                                         uint ## bits ## _t arg)     \
 {                                                                    \
     return float_ ## name(arg, &env->active_fpu.fp_status);          \
 }
@@ -3810,7 +3914,7 @@ uint64_t helper_float_ ## name ## _d(CPUMIPSState *env,            \
 {                                                                  \
     uint64_t dt2;                                                  \
                                                                    \
-    dt2 = float64_ ## name (fdt0, fdt1, &env->active_fpu.fp_status);     \
+    dt2 = float64_ ## name(fdt0, fdt1, &env->active_fpu.fp_status);\
     update_fcr31(env, GETPC());                                    \
     return dt2;                                                    \
 }                                                                  \
@@ -3820,7 +3924,7 @@ uint32_t helper_float_ ## name ## _s(CPUMIPSState *env,            \
 {                                                                  \
     uint32_t wt2;                                                  \
                                                                    \
-    wt2 = float32_ ## name (fst0, fst1, &env->active_fpu.fp_status);     \
+    wt2 = float32_ ## name(fst0, fst1, &env->active_fpu.fp_status);\
     update_fcr31(env, GETPC());                                    \
     return wt2;                                                    \
 }                                                                  \
@@ -3836,8 +3940,8 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,           \
     uint32_t wt2;                                                  \
     uint32_t wth2;                                                 \
                                                                    \
-    wt2 = float32_ ## name (fst0, fst1, &env->active_fpu.fp_status);     \
-    wth2 = float32_ ## name (fsth0, fsth1, &env->active_fpu.fp_status);  \
+    wt2 = float32_ ## name(fst0, fst1, &env->active_fpu.fp_status);     \
+    wth2 = float32_ ## name(fsth0, fsth1, &env->active_fpu.fp_status);  \
     update_fcr31(env, GETPC());                                    \
     return ((uint64_t)wth2 << 32) | wt2;                           \
 }
@@ -3852,7 +3956,8 @@ FLOAT_BINOP(div)
 uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
 {
     fdt2 = float64_mul(fdt0, fdt2, &env->active_fpu.fp_status);
-    fdt2 = float64_chs(float64_sub(fdt2, float64_one, &env->active_fpu.fp_status));
+    fdt2 = float64_chs(float64_sub(fdt2, float64_one,
+                                   &env->active_fpu.fp_status));
     update_fcr31(env, GETPC());
     return fdt2;
 }
@@ -3860,7 +3965,8 @@ uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
 uint32_t helper_float_recip2_s(CPUMIPSState *env, uint32_t fst0, uint32_t fst2)
 {
     fst2 = float32_mul(fst0, fst2, &env->active_fpu.fp_status);
-    fst2 = float32_chs(float32_sub(fst2, float32_one, &env->active_fpu.fp_status));
+    fst2 = float32_chs(float32_sub(fst2, float32_one,
+                                       &env->active_fpu.fp_status));
     update_fcr31(env, GETPC());
     return fst2;
 }
@@ -3874,8 +3980,10 @@ uint64_t helper_float_recip2_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
 
     fst2 = float32_mul(fst0, fst2, &env->active_fpu.fp_status);
     fsth2 = float32_mul(fsth0, fsth2, &env->active_fpu.fp_status);
-    fst2 = float32_chs(float32_sub(fst2, float32_one, &env->active_fpu.fp_status));
-    fsth2 = float32_chs(float32_sub(fsth2, float32_one, &env->active_fpu.fp_status));
+    fst2 = float32_chs(float32_sub(fst2, float32_one,
+                                       &env->active_fpu.fp_status));
+    fsth2 = float32_chs(float32_sub(fsth2, float32_one,
+                                       &env->active_fpu.fp_status));
     update_fcr31(env, GETPC());
     return ((uint64_t)fsth2 << 32) | fst2;
 }
@@ -3884,7 +3992,8 @@ uint64_t helper_float_rsqrt2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
 {
     fdt2 = float64_mul(fdt0, fdt2, &env->active_fpu.fp_status);
     fdt2 = float64_sub(fdt2, float64_one, &env->active_fpu.fp_status);
-    fdt2 = float64_chs(float64_div(fdt2, FLOAT_TWO64, &env->active_fpu.fp_status));
+    fdt2 = float64_chs(float64_div(fdt2, FLOAT_TWO64,
+                                       &env->active_fpu.fp_status));
     update_fcr31(env, GETPC());
     return fdt2;
 }
@@ -3893,7 +4002,8 @@ uint32_t helper_float_rsqrt2_s(CPUMIPSState *env, uint32_t fst0, uint32_t fst2)
 {
     fst2 = float32_mul(fst0, fst2, &env->active_fpu.fp_status);
     fst2 = float32_sub(fst2, float32_one, &env->active_fpu.fp_status);
-    fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32, &env->active_fpu.fp_status));
+    fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32,
+                                       &env->active_fpu.fp_status));
     update_fcr31(env, GETPC());
     return fst2;
 }
@@ -3909,8 +4019,10 @@ uint64_t helper_float_rsqrt2_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
     fsth2 = float32_mul(fsth0, fsth2, &env->active_fpu.fp_status);
     fst2 = float32_sub(fst2, float32_one, &env->active_fpu.fp_status);
     fsth2 = float32_sub(fsth2, float32_one, &env->active_fpu.fp_status);
-    fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32, &env->active_fpu.fp_status));
-    fsth2 = float32_chs(float32_div(fsth2, FLOAT_TWO32, &env->active_fpu.fp_status));
+    fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32,
+                                       &env->active_fpu.fp_status));
+    fsth2 = float32_chs(float32_div(fsth2, FLOAT_TWO32,
+                                       &env->active_fpu.fp_status));
     update_fcr31(env, GETPC());
     return ((uint64_t)fsth2 << 32) | fst2;
 }
@@ -3924,8 +4036,8 @@ uint64_t helper_float_addr_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt1)
     uint32_t fst2;
     uint32_t fsth2;
 
-    fst2 = float32_add (fst0, fsth0, &env->active_fpu.fp_status);
-    fsth2 = float32_add (fst1, fsth1, &env->active_fpu.fp_status);
+    fst2 = float32_add(fst0, fsth0, &env->active_fpu.fp_status);
+    fsth2 = float32_add(fst1, fsth1, &env->active_fpu.fp_status);
     update_fcr31(env, GETPC());
     return ((uint64_t)fsth2 << 32) | fst2;
 }
@@ -3939,16 +4051,16 @@ uint64_t helper_float_mulr_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt1)
     uint32_t fst2;
     uint32_t fsth2;
 
-    fst2 = float32_mul (fst0, fsth0, &env->active_fpu.fp_status);
-    fsth2 = float32_mul (fst1, fsth1, &env->active_fpu.fp_status);
+    fst2 = float32_mul(fst0, fsth0, &env->active_fpu.fp_status);
+    fsth2 = float32_mul(fst1, fsth1, &env->active_fpu.fp_status);
     update_fcr31(env, GETPC());
     return ((uint64_t)fsth2 << 32) | fst2;
 }
 
 #define FLOAT_MINMAX(name, bits, minmaxfunc)                            \
-uint ## bits ## _t helper_float_ ## name (CPUMIPSState *env,            \
-                                          uint ## bits ## _t fs,        \
-                                          uint ## bits ## _t ft)        \
+uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env,             \
+                                         uint ## bits ## _t fs,         \
+                                         uint ## bits ## _t ft)         \
 {                                                                       \
     uint ## bits ## _t fdret;                                           \
                                                                         \
@@ -4026,10 +4138,10 @@ FLOAT_FMA(nmsub, float_muladd_negate_result | float_muladd_negate_c)
 #undef FLOAT_FMA
 
 #define FLOAT_FMADDSUB(name, bits, muladd_arg)                          \
-uint ## bits ## _t helper_float_ ## name (CPUMIPSState *env,            \
-                                          uint ## bits ## _t fs,        \
-                                          uint ## bits ## _t ft,        \
-                                          uint ## bits ## _t fd)        \
+uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env,             \
+                                         uint ## bits ## _t fs,         \
+                                         uint ## bits ## _t ft,         \
+                                         uint ## bits ## _t fd)         \
 {                                                                       \
     uint ## bits ## _t fdret;                                           \
                                                                         \
@@ -4072,26 +4184,58 @@ void helper_cmpabs_d_ ## op(CPUMIPSState *env, uint64_t fdt0,  \
         CLEAR_FP_COND(cc, env->active_fpu);                    \
 }
 
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float64_unordered_quiet() is still called. */
-FOP_COND_D(f,   (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status), 0))
-FOP_COND_D(un,  float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status))
-FOP_COND_D(eq,  float64_eq_quiet(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(ueq, float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)  || float64_eq_quiet(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(olt, float64_lt_quiet(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(ult, float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)  || float64_lt_quiet(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(ole, float64_le_quiet(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(ule, float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)  || float64_le_quiet(fdt0, fdt1, &env->active_fpu.fp_status))
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float64_unordered() is still called. */
-FOP_COND_D(sf,  (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status), 0))
-FOP_COND_D(ngle,float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status))
-FOP_COND_D(seq, float64_eq(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(ngl, float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)  || float64_eq(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(lt,  float64_lt(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(nge, float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)  || float64_lt(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(le,  float64_le(fdt0, fdt1, &env->active_fpu.fp_status))
-FOP_COND_D(ngt, float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)  || float64_le(fdt0, fdt1, &env->active_fpu.fp_status))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float64_unordered_quiet() is still called.
+ */
+FOP_COND_D(f,    (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_COND_D(un,   float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(eq,   float64_eq_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(ueq,  float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_eq_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(olt,  float64_lt_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(ult,  float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_lt_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(ole,  float64_le_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(ule,  float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_le_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float64_unordered() is still called.
+ */
+FOP_COND_D(sf,   (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_COND_D(ngle, float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(seq,  float64_eq(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(ngl,  float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_eq(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(lt,   float64_lt(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(nge,  float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_lt(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(le,   float64_le(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_D(ngt,  float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_le(fdt0, fdt1,
+                                       &env->active_fpu.fp_status))
 
 #define FOP_COND_S(op, cond)                                   \
 void helper_cmp_s_ ## op(CPUMIPSState *env, uint32_t fst0,     \
@@ -4119,26 +4263,58 @@ void helper_cmpabs_s_ ## op(CPUMIPSState *env, uint32_t fst0,  \
         CLEAR_FP_COND(cc, env->active_fpu);                    \
 }
 
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float32_unordered_quiet() is still called. */
-FOP_COND_S(f,   (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status), 0))
-FOP_COND_S(un,  float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status))
-FOP_COND_S(eq,  float32_eq_quiet(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(ueq, float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)  || float32_eq_quiet(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(olt, float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(ult, float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)  || float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(ole, float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(ule, float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)  || float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status))
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float32_unordered() is still called. */
-FOP_COND_S(sf,  (float32_unordered(fst1, fst0, &env->active_fpu.fp_status), 0))
-FOP_COND_S(ngle,float32_unordered(fst1, fst0, &env->active_fpu.fp_status))
-FOP_COND_S(seq, float32_eq(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(ngl, float32_unordered(fst1, fst0, &env->active_fpu.fp_status)  || float32_eq(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(lt,  float32_lt(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(nge, float32_unordered(fst1, fst0, &env->active_fpu.fp_status)  || float32_lt(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(le,  float32_le(fst0, fst1, &env->active_fpu.fp_status))
-FOP_COND_S(ngt, float32_unordered(fst1, fst0, &env->active_fpu.fp_status)  || float32_le(fst0, fst1, &env->active_fpu.fp_status))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float32_unordered_quiet() is still called.
+ */
+FOP_COND_S(f,    (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_COND_S(un,   float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(eq,   float32_eq_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(ueq,  float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                 || float32_eq_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(olt,  float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(ult,  float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                 || float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(ole,  float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(ule,  float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                 || float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float32_unordered() is still called.
+ */
+FOP_COND_S(sf,   (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_COND_S(ngle, float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(seq,  float32_eq(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(ngl,  float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                 || float32_eq(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(lt,   float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(nge,  float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                 || float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(le,   float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_S(ngt,  float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                 || float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status))
 
 #define FOP_COND_PS(op, condl, condh)                           \
 void helper_cmp_ps_ ## op(CPUMIPSState *env, uint64_t fdt0,     \
@@ -4184,47 +4360,107 @@ void helper_cmpabs_ps_ ## op(CPUMIPSState *env, uint64_t fdt0,  \
         CLEAR_FP_COND(cc + 1, env->active_fpu);                 \
 }
 
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float32_unordered_quiet() is still called. */
-FOP_COND_PS(f,   (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status), 0),
-                 (float32_unordered_quiet(fsth1, fsth0, &env->active_fpu.fp_status), 0))
-FOP_COND_PS(un,  float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status),
-                 float32_unordered_quiet(fsth1, fsth0, &env->active_fpu.fp_status))
-FOP_COND_PS(eq,  float32_eq_quiet(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_eq_quiet(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(ueq, float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)    || float32_eq_quiet(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_unordered_quiet(fsth1, fsth0, &env->active_fpu.fp_status)  || float32_eq_quiet(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(olt, float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_lt_quiet(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(ult, float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)    || float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_unordered_quiet(fsth1, fsth0, &env->active_fpu.fp_status)  || float32_lt_quiet(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(ole, float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_le_quiet(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(ule, float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)    || float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_unordered_quiet(fsth1, fsth0, &env->active_fpu.fp_status)  || float32_le_quiet(fsth0, fsth1, &env->active_fpu.fp_status))
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float32_unordered() is still called. */
-FOP_COND_PS(sf,  (float32_unordered(fst1, fst0, &env->active_fpu.fp_status), 0),
-                 (float32_unordered(fsth1, fsth0, &env->active_fpu.fp_status), 0))
-FOP_COND_PS(ngle,float32_unordered(fst1, fst0, &env->active_fpu.fp_status),
-                 float32_unordered(fsth1, fsth0, &env->active_fpu.fp_status))
-FOP_COND_PS(seq, float32_eq(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_eq(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(ngl, float32_unordered(fst1, fst0, &env->active_fpu.fp_status)    || float32_eq(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_unordered(fsth1, fsth0, &env->active_fpu.fp_status)  || float32_eq(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(lt,  float32_lt(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_lt(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(nge, float32_unordered(fst1, fst0, &env->active_fpu.fp_status)    || float32_lt(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_unordered(fsth1, fsth0, &env->active_fpu.fp_status)  || float32_lt(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(le,  float32_le(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_le(fsth0, fsth1, &env->active_fpu.fp_status))
-FOP_COND_PS(ngt, float32_unordered(fst1, fst0, &env->active_fpu.fp_status)    || float32_le(fst0, fst1, &env->active_fpu.fp_status),
-                 float32_unordered(fsth1, fsth0, &env->active_fpu.fp_status)  || float32_le(fsth0, fsth1, &env->active_fpu.fp_status))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float32_unordered_quiet() is still called.
+ */
+FOP_COND_PS(f,    (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status), 0),
+                  (float32_unordered_quiet(fsth1, fsth0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_COND_PS(un,   float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered_quiet(fsth1, fsth0,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(eq,   float32_eq_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_eq_quiet(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(ueq,  float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                  || float32_eq_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered_quiet(fsth1, fsth0,
+                                       &env->active_fpu.fp_status)
+                  || float32_eq_quiet(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(olt,  float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_lt_quiet(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(ult,  float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                  || float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered_quiet(fsth1, fsth0,
+                                       &env->active_fpu.fp_status)
+                  || float32_lt_quiet(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(ole,  float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_le_quiet(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(ule,  float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                  || float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered_quiet(fsth1, fsth0,
+                                       &env->active_fpu.fp_status)
+                  || float32_le_quiet(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float32_unordered() is still called.
+ */
+FOP_COND_PS(sf,   (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status), 0),
+                  (float32_unordered(fsth1, fsth0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_COND_PS(ngle, float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered(fsth1, fsth0,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(seq,  float32_eq(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_eq(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(ngl,  float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                  || float32_eq(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered(fsth1, fsth0,
+                                       &env->active_fpu.fp_status)
+                  || float32_eq(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(lt,   float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_lt(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(nge,  float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                  || float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered(fsth1, fsth0,
+                                       &env->active_fpu.fp_status)
+                  || float32_lt(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(le,   float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_le(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
+FOP_COND_PS(ngt,  float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                  || float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status),
+                  float32_unordered(fsth1, fsth0,
+                                       &env->active_fpu.fp_status)
+                  || float32_le(fsth0, fsth1,
+                                       &env->active_fpu.fp_status))
 
 /* R6 compare operations */
 #define FOP_CONDN_D(op, cond)                                       \
-uint64_t helper_r6_cmp_d_ ## op(CPUMIPSState * env, uint64_t fdt0,  \
-                         uint64_t fdt1)                             \
+uint64_t helper_r6_cmp_d_ ## op(CPUMIPSState *env, uint64_t fdt0,   \
+                                uint64_t fdt1)                      \
 {                                                                   \
     uint64_t c;                                                     \
     c = cond;                                                       \
@@ -4236,50 +4472,90 @@ uint64_t helper_r6_cmp_d_ ## op(CPUMIPSState * env, uint64_t fdt0,  \
     }                                                               \
 }
 
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float64_unordered_quiet() is still called. */
-FOP_CONDN_D(af,  (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status), 0))
-FOP_CONDN_D(un,  (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)))
-FOP_CONDN_D(eq,  (float64_eq_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(ueq, (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                  || float64_eq_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(lt,  (float64_lt_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(ult, (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                  || float64_lt_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(le,  (float64_le_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(ule, (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                  || float64_le_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float64_unordered() is still called. */
-FOP_CONDN_D(saf,  (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status), 0))
-FOP_CONDN_D(sun,  (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)))
-FOP_CONDN_D(seq,  (float64_eq(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sueq, (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_eq(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(slt,  (float64_lt(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sult, (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sle,  (float64_le(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sule, (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_le(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(or,   (float64_le_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_le_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(une,  (float64_unordered_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(ne,   (float64_lt_quiet(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt_quiet(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sor,  (float64_le(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_le(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sune, (float64_unordered(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt(fdt0, fdt1, &env->active_fpu.fp_status)))
-FOP_CONDN_D(sne,  (float64_lt(fdt1, fdt0, &env->active_fpu.fp_status)
-                   || float64_lt(fdt0, fdt1, &env->active_fpu.fp_status)))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float64_unordered_quiet() is still called.
+ */
+FOP_CONDN_D(af,  (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_CONDN_D(un,  (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(eq,  (float64_eq_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(ueq, (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_eq_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(lt,  (float64_lt_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(ult, (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_lt_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(le,  (float64_le_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(ule, (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                 || float64_le_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float64_unordered() is still called.\
+ */
+FOP_CONDN_D(saf,  (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_CONDN_D(sun,  (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(seq,  (float64_eq(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sueq, (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_eq(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(slt,  (float64_lt(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sult, (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sle,  (float64_le(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sule, (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_le(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(or,   (float64_le_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_le_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(une,  (float64_unordered_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(ne,   (float64_lt_quiet(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt_quiet(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sor,  (float64_le(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_le(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sune, (float64_unordered(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_D(sne,  (float64_lt(fdt1, fdt0,
+                                       &env->active_fpu.fp_status)
+                   || float64_lt(fdt0, fdt1,
+                                       &env->active_fpu.fp_status)))
 
 #define FOP_CONDN_S(op, cond)                                       \
-uint32_t helper_r6_cmp_s_ ## op(CPUMIPSState * env, uint32_t fst0,  \
-                         uint32_t fst1)                             \
+uint32_t helper_r6_cmp_s_ ## op(CPUMIPSState *env, uint32_t fst0,   \
+                                uint32_t fst1)                      \
 {                                                                   \
     uint64_t c;                                                     \
     c = cond;                                                       \
@@ -4291,46 +4567,86 @@ uint32_t helper_r6_cmp_s_ ## op(CPUMIPSState * env, uint32_t fst0,  \
     }                                                               \
 }
 
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float32_unordered_quiet() is still called. */
-FOP_CONDN_S(af,   (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status), 0))
-FOP_CONDN_S(un,   (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)))
-FOP_CONDN_S(eq,   (float32_eq_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(ueq,  (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_eq_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(lt,   (float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(ult,  (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(le,   (float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(ule,  (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-/* NOTE: the comma operator will make "cond" to eval to false,
- * but float32_unordered() is still called. */
-FOP_CONDN_S(saf,  (float32_unordered(fst1, fst0, &env->active_fpu.fp_status), 0))
-FOP_CONDN_S(sun,  (float32_unordered(fst1, fst0, &env->active_fpu.fp_status)))
-FOP_CONDN_S(seq,  (float32_eq(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sueq, (float32_unordered(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_eq(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(slt,  (float32_lt(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sult, (float32_unordered(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sle,  (float32_le(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sule, (float32_unordered(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_le(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(or,   (float32_le_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_le_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(une,  (float32_unordered_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(ne,   (float32_lt_quiet(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt_quiet(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sor,  (float32_le(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_le(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sune, (float32_unordered(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt(fst0, fst1, &env->active_fpu.fp_status)))
-FOP_CONDN_S(sne,  (float32_lt(fst1, fst0, &env->active_fpu.fp_status)
-                   || float32_lt(fst0, fst1, &env->active_fpu.fp_status)))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float32_unordered_quiet() is still called.
+ */
+FOP_CONDN_S(af,   (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_CONDN_S(un,   (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(eq,   (float32_eq_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(ueq,  (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_eq_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(lt,   (float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(ult,  (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(le,   (float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(ule,  (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+/*
+ * NOTE: the comma operator will make "cond" to eval to false,
+ * but float32_unordered() is still called.
+ */
+FOP_CONDN_S(saf,  (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status), 0))
+FOP_CONDN_S(sun,  (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(seq,  (float32_eq(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sueq, (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_eq(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(slt,  (float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sult, (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sle,  (float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sule, (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(or,   (float32_le_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_le_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(une,  (float32_unordered_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(ne,   (float32_lt_quiet(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt_quiet(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sor,  (float32_le(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_le(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sune, (float32_unordered(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
+FOP_CONDN_S(sne,  (float32_lt(fst1, fst0,
+                                       &env->active_fpu.fp_status)
+                   || float32_lt(fst0, fst1,
+                                       &env->active_fpu.fp_status)))
 
 /* MSA */
 /* Data format min and max values */
@@ -4522,7 +4838,7 @@ void helper_msa_ld_d(CPUMIPSState *env, uint32_t wd,
 }
 
 #define MSA_PAGESPAN(x) \
-        ((((x) & ~TARGET_PAGE_MASK) + MSA_WRLEN/8 - 1) >= TARGET_PAGE_SIZE)
+        ((((x) & ~TARGET_PAGE_MASK) + MSA_WRLEN / 8 - 1) >= TARGET_PAGE_SIZE)
 
 static inline void ensure_writable_pages(CPUMIPSState *env,
                                          target_ulong addr,
diff --git a/target/mips/translate.c b/target/mips/translate.c
index 50397167fc..4bff585bd6 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -5546,78 +5546,181 @@ static void gen_loongson_multimedia(DisasContext *ctx, int rd, int rs, int rt)
     gen_load_fpr64(ctx, t0, rs);
     gen_load_fpr64(ctx, t1, rt);
 
-#define LMI_HELPER(UP, LO) \
-    case OPC_##UP: gen_helper_##LO(t0, t0, t1); break
-#define LMI_HELPER_1(UP, LO) \
-    case OPC_##UP: gen_helper_##LO(t0, t0); break
-#define LMI_DIRECT(UP, LO, OP) \
-    case OPC_##UP: tcg_gen_##OP##_i64(t0, t0, t1); break
-
     switch (opc) {
-    LMI_HELPER(PADDSH, paddsh);
-    LMI_HELPER(PADDUSH, paddush);
-    LMI_HELPER(PADDH, paddh);
-    LMI_HELPER(PADDW, paddw);
-    LMI_HELPER(PADDSB, paddsb);
-    LMI_HELPER(PADDUSB, paddusb);
-    LMI_HELPER(PADDB, paddb);
-
-    LMI_HELPER(PSUBSH, psubsh);
-    LMI_HELPER(PSUBUSH, psubush);
-    LMI_HELPER(PSUBH, psubh);
-    LMI_HELPER(PSUBW, psubw);
-    LMI_HELPER(PSUBSB, psubsb);
-    LMI_HELPER(PSUBUSB, psubusb);
-    LMI_HELPER(PSUBB, psubb);
-
-    LMI_HELPER(PSHUFH, pshufh);
-    LMI_HELPER(PACKSSWH, packsswh);
-    LMI_HELPER(PACKSSHB, packsshb);
-    LMI_HELPER(PACKUSHB, packushb);
-
-    LMI_HELPER(PUNPCKLHW, punpcklhw);
-    LMI_HELPER(PUNPCKHHW, punpckhhw);
-    LMI_HELPER(PUNPCKLBH, punpcklbh);
-    LMI_HELPER(PUNPCKHBH, punpckhbh);
-    LMI_HELPER(PUNPCKLWD, punpcklwd);
-    LMI_HELPER(PUNPCKHWD, punpckhwd);
-
-    LMI_HELPER(PAVGH, pavgh);
-    LMI_HELPER(PAVGB, pavgb);
-    LMI_HELPER(PMAXSH, pmaxsh);
-    LMI_HELPER(PMINSH, pminsh);
-    LMI_HELPER(PMAXUB, pmaxub);
-    LMI_HELPER(PMINUB, pminub);
-
-    LMI_HELPER(PCMPEQW, pcmpeqw);
-    LMI_HELPER(PCMPGTW, pcmpgtw);
-    LMI_HELPER(PCMPEQH, pcmpeqh);
-    LMI_HELPER(PCMPGTH, pcmpgth);
-    LMI_HELPER(PCMPEQB, pcmpeqb);
-    LMI_HELPER(PCMPGTB, pcmpgtb);
-
-    LMI_HELPER(PSLLW, psllw);
-    LMI_HELPER(PSLLH, psllh);
-    LMI_HELPER(PSRLW, psrlw);
-    LMI_HELPER(PSRLH, psrlh);
-    LMI_HELPER(PSRAW, psraw);
-    LMI_HELPER(PSRAH, psrah);
-
-    LMI_HELPER(PMULLH, pmullh);
-    LMI_HELPER(PMULHH, pmulhh);
-    LMI_HELPER(PMULHUH, pmulhuh);
-    LMI_HELPER(PMADDHW, pmaddhw);
-
-    LMI_HELPER(PASUBUB, pasubub);
-    LMI_HELPER_1(BIADD, biadd);
-    LMI_HELPER_1(PMOVMSKB, pmovmskb);
-
-    LMI_DIRECT(PADDD, paddd, add);
-    LMI_DIRECT(PSUBD, psubd, sub);
-    LMI_DIRECT(XOR_CP2, xor, xor);
-    LMI_DIRECT(NOR_CP2, nor, nor);
-    LMI_DIRECT(AND_CP2, and, and);
-    LMI_DIRECT(OR_CP2, or, or);
+    case OPC_PADDSH:
+        gen_helper_paddsh(t0, t0, t1);
+        break;
+    case OPC_PADDUSH:
+        gen_helper_paddush(t0, t0, t1);
+        break;
+    case OPC_PADDH:
+        gen_helper_paddh(t0, t0, t1);
+        break;
+    case OPC_PADDW:
+        gen_helper_paddw(t0, t0, t1);
+        break;
+    case OPC_PADDSB:
+        gen_helper_paddsb(t0, t0, t1);
+        break;
+    case OPC_PADDUSB:
+        gen_helper_paddusb(t0, t0, t1);
+        break;
+    case OPC_PADDB:
+        gen_helper_paddb(t0, t0, t1);
+        break;
+
+    case OPC_PSUBSH:
+        gen_helper_psubsh(t0, t0, t1);
+        break;
+    case OPC_PSUBUSH:
+        gen_helper_psubush(t0, t0, t1);
+        break;
+    case OPC_PSUBH:
+        gen_helper_psubh(t0, t0, t1);
+        break;
+    case OPC_PSUBW:
+        gen_helper_psubw(t0, t0, t1);
+        break;
+    case OPC_PSUBSB:
+        gen_helper_psubsb(t0, t0, t1);
+        break;
+    case OPC_PSUBUSB:
+        gen_helper_psubusb(t0, t0, t1);
+        break;
+    case OPC_PSUBB:
+        gen_helper_psubb(t0, t0, t1);
+        break;
+
+    case OPC_PSHUFH:
+        gen_helper_pshufh(t0, t0, t1);
+        break;
+    case OPC_PACKSSWH:
+        gen_helper_packsswh(t0, t0, t1);
+        break;
+    case OPC_PACKSSHB:
+        gen_helper_packsshb(t0, t0, t1);
+        break;
+    case OPC_PACKUSHB:
+        gen_helper_packushb(t0, t0, t1);
+        break;
+
+    case OPC_PUNPCKLHW:
+        gen_helper_punpcklhw(t0, t0, t1);
+        break;
+    case OPC_PUNPCKHHW:
+        gen_helper_punpckhhw(t0, t0, t1);
+        break;
+    case OPC_PUNPCKLBH:
+        gen_helper_punpcklbh(t0, t0, t1);
+        break;
+    case OPC_PUNPCKHBH:
+        gen_helper_punpckhbh(t0, t0, t1);
+        break;
+    case OPC_PUNPCKLWD:
+        gen_helper_punpcklwd(t0, t0, t1);
+        break;
+    case OPC_PUNPCKHWD:
+        gen_helper_punpckhwd(t0, t0, t1);
+        break;
+
+    case OPC_PAVGH:
+        gen_helper_pavgh(t0, t0, t1);
+        break;
+    case OPC_PAVGB:
+        gen_helper_pavgb(t0, t0, t1);
+        break;
+    case OPC_PMAXSH:
+        gen_helper_pmaxsh(t0, t0, t1);
+        break;
+    case OPC_PMINSH:
+        gen_helper_pminsh(t0, t0, t1);
+        break;
+    case OPC_PMAXUB:
+        gen_helper_pmaxub(t0, t0, t1);
+        break;
+    case OPC_PMINUB:
+        gen_helper_pminub(t0, t0, t1);
+        break;
+
+    case OPC_PCMPEQW:
+        gen_helper_pcmpeqw(t0, t0, t1);
+        break;
+    case OPC_PCMPGTW:
+        gen_helper_pcmpgtw(t0, t0, t1);
+        break;
+    case OPC_PCMPEQH:
+        gen_helper_pcmpeqh(t0, t0, t1);
+        break;
+    case OPC_PCMPGTH:
+        gen_helper_pcmpgth(t0, t0, t1);
+        break;
+    case OPC_PCMPEQB:
+        gen_helper_pcmpeqb(t0, t0, t1);
+        break;
+    case OPC_PCMPGTB:
+        gen_helper_pcmpgtb(t0, t0, t1);
+        break;
+
+    case OPC_PSLLW:
+        gen_helper_psllw(t0, t0, t1);
+        break;
+    case OPC_PSLLH:
+        gen_helper_psllh(t0, t0, t1);
+        break;
+    case OPC_PSRLW:
+        gen_helper_psrlw(t0, t0, t1);
+        break;
+    case OPC_PSRLH:
+        gen_helper_psrlh(t0, t0, t1);
+        break;
+    case OPC_PSRAW:
+        gen_helper_psraw(t0, t0, t1);
+        break;
+    case OPC_PSRAH:
+        gen_helper_psrah(t0, t0, t1);
+        break;
+
+    case OPC_PMULLH:
+        gen_helper_pmullh(t0, t0, t1);
+        break;
+    case OPC_PMULHH:
+        gen_helper_pmulhh(t0, t0, t1);
+        break;
+    case OPC_PMULHUH:
+        gen_helper_pmulhuh(t0, t0, t1);
+        break;
+    case OPC_PMADDHW:
+        gen_helper_pmaddhw(t0, t0, t1);
+        break;
+
+    case OPC_PASUBUB:
+        gen_helper_pasubub(t0, t0, t1);
+        break;
+    case OPC_BIADD:
+        gen_helper_biadd(t0, t0);
+        break;
+    case OPC_PMOVMSKB:
+        gen_helper_pmovmskb(t0, t0);
+        break;
+
+    case OPC_PADDD:
+        tcg_gen_add_i64(t0, t0, t1);
+        break;
+    case OPC_PSUBD:
+        tcg_gen_sub_i64(t0, t0, t1);
+        break;
+    case OPC_XOR_CP2:
+        tcg_gen_xor_i64(t0, t0, t1);
+        break;
+    case OPC_NOR_CP2:
+        tcg_gen_nor_i64(t0, t0, t1);
+        break;
+    case OPC_AND_CP2:
+        tcg_gen_and_i64(t0, t0, t1);
+        break;
+    case OPC_OR_CP2:
+        tcg_gen_or_i64(t0, t0, t1);
+        break;
 
     case OPC_PANDN:
         tcg_gen_andc_i64(t0, t1, t0);
@@ -5770,9 +5873,6 @@ static void gen_loongson_multimedia(DisasContext *ctx, int rd, int rs, int rt)
         return;
     }
 
-#undef LMI_HELPER
-#undef LMI_DIRECT
-
     gen_store_fpr64(ctx, t0, rd);
 
     tcg_temp_free_i64(t0);
@@ -28466,6 +28566,86 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
             break;
         }
         break;
+    case OPC_ADD_A_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_add_a_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_add_a_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_add_a_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_add_a_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ADDS_A_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_adds_a_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_adds_a_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_adds_a_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_adds_a_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ADDS_S_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_adds_s_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_adds_s_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_adds_s_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_adds_s_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ADDS_U_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_adds_u_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_adds_u_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_adds_u_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_adds_u_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ADDV_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_addv_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_addv_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_addv_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_addv_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
     case OPC_AVE_S_df:
         switch (df) {
         case DF_BYTE:
@@ -28642,6 +28822,102 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
             break;
         }
         break;
+    case OPC_MAX_A_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_max_a_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_max_a_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_max_a_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_max_a_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_MAX_S_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_max_s_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_max_s_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_max_s_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_max_s_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_MAX_U_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_max_u_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_max_u_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_max_u_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_max_u_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_MIN_A_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_min_a_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_min_a_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_min_a_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_min_a_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_MIN_S_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_min_s_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_min_s_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_min_s_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_min_s_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_MIN_U_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_min_u_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_min_u_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_min_u_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_min_u_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
     case OPC_MOD_S_df:
         switch (df) {
         case DF_BYTE:
@@ -28674,14 +28950,213 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
             break;
         }
         break;
+    case OPC_ASUB_S_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_asub_s_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_asub_s_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_asub_s_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_asub_s_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ASUB_U_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_asub_u_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_asub_u_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_asub_u_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_asub_u_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ILVEV_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_ilvev_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_ilvev_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_ilvev_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_ilvev_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ILVOD_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_ilvod_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_ilvod_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_ilvod_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_ilvod_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ILVL_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_ilvl_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_ilvl_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_ilvl_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_ilvl_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_ILVR_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_ilvr_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_ilvr_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_ilvr_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_ilvr_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_PCKEV_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_pckev_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_pckev_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_pckev_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_pckev_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_PCKOD_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_pckod_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_pckod_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_pckod_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_pckod_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
     case OPC_SLL_df:
-        gen_helper_msa_sll_df(cpu_env, tdf, twd, tws, twt);
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_sll_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_sll_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_sll_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_sll_d(cpu_env, twd, tws, twt);
+            break;
+        }
         break;
-    case OPC_ADDV_df:
-        gen_helper_msa_addv_df(cpu_env, tdf, twd, tws, twt);
+    case OPC_SRA_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_sra_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_sra_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_sra_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_sra_d(cpu_env, twd, tws, twt);
+            break;
+        }
         break;
-    case OPC_ADD_A_df:
-        gen_helper_msa_add_a_df(cpu_env, tdf, twd, tws, twt);
+    case OPC_SRAR_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_srar_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_srar_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_srar_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_srar_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_SRL_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_srl_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_srl_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_srl_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_srl_d(cpu_env, twd, tws, twt);
+            break;
+        }
+        break;
+    case OPC_SRLR_df:
+        switch (df) {
+        case DF_BYTE:
+            gen_helper_msa_srlr_b(cpu_env, twd, tws, twt);
+            break;
+        case DF_HALF:
+            gen_helper_msa_srlr_h(cpu_env, twd, tws, twt);
+            break;
+        case DF_WORD:
+            gen_helper_msa_srlr_w(cpu_env, twd, tws, twt);
+            break;
+        case DF_DOUBLE:
+            gen_helper_msa_srlr_d(cpu_env, twd, tws, twt);
+            break;
+        }
         break;
     case OPC_SUBS_S_df:
         gen_helper_msa_subs_s_df(cpu_env, tdf, twd, tws, twt);
@@ -28695,15 +29170,9 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
     case OPC_VSHF_df:
         gen_helper_msa_vshf_df(cpu_env, tdf, twd, tws, twt);
         break;
-    case OPC_SRA_df:
-        gen_helper_msa_sra_df(cpu_env, tdf, twd, tws, twt);
-        break;
     case OPC_SUBV_df:
         gen_helper_msa_subv_df(cpu_env, tdf, twd, tws, twt);
         break;
-    case OPC_ADDS_A_df:
-        gen_helper_msa_adds_a_df(cpu_env, tdf, twd, tws, twt);
-        break;
     case OPC_SUBS_U_df:
         gen_helper_msa_subs_u_df(cpu_env, tdf, twd, tws, twt);
         break;
@@ -28713,72 +29182,15 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
     case OPC_SPLAT_df:
         gen_helper_msa_splat_df(cpu_env, tdf, twd, tws, twt);
         break;
-    case OPC_SRAR_df:
-        gen_helper_msa_srar_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_SRL_df:
-        gen_helper_msa_srl_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_MAX_S_df:
-        gen_helper_msa_max_s_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ADDS_S_df:
-        gen_helper_msa_adds_s_df(cpu_env, tdf, twd, tws, twt);
-        break;
     case OPC_SUBSUS_U_df:
         gen_helper_msa_subsus_u_df(cpu_env, tdf, twd, tws, twt);
         break;
     case OPC_MSUBV_df:
         gen_helper_msa_msubv_df(cpu_env, tdf, twd, tws, twt);
         break;
-    case OPC_PCKEV_df:
-        gen_helper_msa_pckev_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_SRLR_df:
-        gen_helper_msa_srlr_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_MAX_U_df:
-        gen_helper_msa_max_u_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ADDS_U_df:
-        gen_helper_msa_adds_u_df(cpu_env, tdf, twd, tws, twt);
-        break;
     case OPC_SUBSUU_S_df:
         gen_helper_msa_subsuu_s_df(cpu_env, tdf, twd, tws, twt);
         break;
-    case OPC_PCKOD_df:
-        gen_helper_msa_pckod_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_MIN_S_df:
-        gen_helper_msa_min_s_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ASUB_S_df:
-        gen_helper_msa_asub_s_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ILVL_df:
-        gen_helper_msa_ilvl_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_MIN_U_df:
-        gen_helper_msa_min_u_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ASUB_U_df:
-        gen_helper_msa_asub_u_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ILVR_df:
-        gen_helper_msa_ilvr_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_MAX_A_df:
-        gen_helper_msa_max_a_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ILVEV_df:
-        gen_helper_msa_ilvev_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_MIN_A_df:
-        gen_helper_msa_min_a_df(cpu_env, tdf, twd, tws, twt);
-        break;
-    case OPC_ILVOD_df:
-        gen_helper_msa_ilvod_df(cpu_env, tdf, twd, tws, twt);
-        break;
 
     case OPC_DOTP_S_df:
     case OPC_DOTP_U_df:
@@ -28795,6 +29207,58 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
             break;
         }
         switch (MASK_MSA_3R(ctx->opcode)) {
+        case OPC_HADD_S_df:
+            switch (df) {
+            case DF_HALF:
+                gen_helper_msa_hadd_s_h(cpu_env, twd, tws, twt);
+                break;
+            case DF_WORD:
+                gen_helper_msa_hadd_s_w(cpu_env, twd, tws, twt);
+                break;
+            case DF_DOUBLE:
+                gen_helper_msa_hadd_s_d(cpu_env, twd, tws, twt);
+                break;
+            }
+            break;
+        case OPC_HADD_U_df:
+            switch (df) {
+            case DF_HALF:
+                gen_helper_msa_hadd_u_h(cpu_env, twd, tws, twt);
+                break;
+            case DF_WORD:
+                gen_helper_msa_hadd_u_w(cpu_env, twd, tws, twt);
+                break;
+            case DF_DOUBLE:
+                gen_helper_msa_hadd_u_d(cpu_env, twd, tws, twt);
+                break;
+            }
+            break;
+        case OPC_HSUB_S_df:
+            switch (df) {
+            case DF_HALF:
+                gen_helper_msa_hsub_s_h(cpu_env, twd, tws, twt);
+                break;
+            case DF_WORD:
+                gen_helper_msa_hsub_s_w(cpu_env, twd, tws, twt);
+                break;
+            case DF_DOUBLE:
+                gen_helper_msa_hsub_s_d(cpu_env, twd, tws, twt);
+                break;
+            }
+            break;
+        case OPC_HSUB_U_df:
+            switch (df) {
+            case DF_HALF:
+                gen_helper_msa_hsub_u_h(cpu_env, twd, tws, twt);
+                break;
+            case DF_WORD:
+                gen_helper_msa_hsub_u_w(cpu_env, twd, tws, twt);
+                break;
+            case DF_DOUBLE:
+                gen_helper_msa_hsub_u_d(cpu_env, twd, tws, twt);
+                break;
+            }
+            break;
         case OPC_DOTP_S_df:
             gen_helper_msa_dotp_s_df(cpu_env, tdf, twd, tws, twt);
             break;
@@ -28810,21 +29274,9 @@ static void gen_msa_3r(CPUMIPSState *env, DisasContext *ctx)
         case OPC_DPSUB_S_df:
             gen_helper_msa_dpsub_s_df(cpu_env, tdf, twd, tws, twt);
             break;
-        case OPC_HADD_S_df:
-            gen_helper_msa_hadd_s_df(cpu_env, tdf, twd, tws, twt);
-            break;
         case OPC_DPSUB_U_df:
             gen_helper_msa_dpsub_u_df(cpu_env, tdf, twd, tws, twt);
             break;
-        case OPC_HADD_U_df:
-            gen_helper_msa_hadd_u_df(cpu_env, tdf, twd, tws, twt);
-            break;
-        case OPC_HSUB_S_df:
-            gen_helper_msa_hsub_s_df(cpu_env, tdf, twd, tws, twt);
-            break;
-        case OPC_HSUB_U_df:
-            gen_helper_msa_hsub_u_df(cpu_env, tdf, twd, tws, twt);
-            break;
         }
         break;
     default:
diff --git a/target/ppc/translate/vmx-impl.inc.c b/target/ppc/translate/vmx-impl.inc.c
index 2472a5217a..81d5a7a341 100644
--- a/target/ppc/translate/vmx-impl.inc.c
+++ b/target/ppc/translate/vmx-impl.inc.c
@@ -590,40 +590,38 @@ static void trans_vsl(DisasContext *ctx)
     int VT = rD(ctx->opcode);
     int VA = rA(ctx->opcode);
     int VB = rB(ctx->opcode);
-    TCGv_i64 avrA = tcg_temp_new_i64();
-    TCGv_i64 avrB = tcg_temp_new_i64();
+    TCGv_i64 avr = tcg_temp_new_i64();
     TCGv_i64 sh = tcg_temp_new_i64();
-    TCGv_i64 shifted = tcg_temp_new_i64();
+    TCGv_i64 carry = tcg_temp_new_i64();
     TCGv_i64 tmp = tcg_temp_new_i64();
 
-    /* Place bits 125-127 of vB in sh. */
-    get_avr64(avrB, VB, false);
-    tcg_gen_andi_i64(sh, avrB, 0x07ULL);
+    /* Place bits 125-127 of vB in 'sh'. */
+    get_avr64(avr, VB, false);
+    tcg_gen_andi_i64(sh, avr, 0x07ULL);
 
     /*
-     * Save highest sh bits of lower doubleword element of vA in variable
-     * shifted and perform shift on lower doubleword.
+     * Save highest 'sh' bits of lower doubleword element of vA in variable
+     * 'carry' and perform shift on lower doubleword.
      */
-    get_avr64(avrA, VA, false);
-    tcg_gen_subfi_i64(tmp, 64, sh);
-    tcg_gen_shr_i64(shifted, avrA, tmp);
-    tcg_gen_andi_i64(shifted, shifted, 0x7fULL);
-    tcg_gen_shl_i64(avrA, avrA, sh);
-    set_avr64(VT, avrA, false);
+    get_avr64(avr, VA, false);
+    tcg_gen_subfi_i64(tmp, 32, sh);
+    tcg_gen_shri_i64(carry, avr, 32);
+    tcg_gen_shr_i64(carry, carry, tmp);
+    tcg_gen_shl_i64(avr, avr, sh);
+    set_avr64(VT, avr, false);
 
     /*
      * Perform shift on higher doubleword element of vA and replace lowest
-     * sh bits with shifted.
+     * 'sh' bits with 'carry'.
      */
-    get_avr64(avrA, VA, true);
-    tcg_gen_shl_i64(avrA, avrA, sh);
-    tcg_gen_or_i64(avrA, avrA, shifted);
-    set_avr64(VT, avrA, true);
+    get_avr64(avr, VA, true);
+    tcg_gen_shl_i64(avr, avr, sh);
+    tcg_gen_or_i64(avr, avr, carry);
+    set_avr64(VT, avr, true);
 
-    tcg_temp_free_i64(avrA);
-    tcg_temp_free_i64(avrB);
+    tcg_temp_free_i64(avr);
     tcg_temp_free_i64(sh);
-    tcg_temp_free_i64(shifted);
+    tcg_temp_free_i64(carry);
     tcg_temp_free_i64(tmp);
 }
 
@@ -639,39 +637,37 @@ static void trans_vsr(DisasContext *ctx)
     int VT = rD(ctx->opcode);
     int VA = rA(ctx->opcode);
     int VB = rB(ctx->opcode);
-    TCGv_i64 avrA = tcg_temp_new_i64();
-    TCGv_i64 avrB = tcg_temp_new_i64();
+    TCGv_i64 avr = tcg_temp_new_i64();
     TCGv_i64 sh = tcg_temp_new_i64();
-    TCGv_i64 shifted = tcg_temp_new_i64();
+    TCGv_i64 carry = tcg_temp_new_i64();
     TCGv_i64 tmp = tcg_temp_new_i64();
 
-    /* Place bits 125-127 of vB in sh. */
-    get_avr64(avrB, VB, false);
-    tcg_gen_andi_i64(sh, avrB, 0x07ULL);
+    /* Place bits 125-127 of vB in 'sh'. */
+    get_avr64(avr, VB, false);
+    tcg_gen_andi_i64(sh, avr, 0x07ULL);
 
     /*
-     * Save lowest sh bits of higher doubleword element of vA in variable
-     * shifted and perform shift on higher doubleword.
+     * Save lowest 'sh' bits of higher doubleword element of vA in variable
+     * 'carry' and perform shift on higher doubleword.
      */
-    get_avr64(avrA, VA, true);
-    tcg_gen_subfi_i64(tmp, 64, sh);
-    tcg_gen_shl_i64(shifted, avrA, tmp);
-    tcg_gen_andi_i64(shifted, shifted, 0xfe00000000000000ULL);
-    tcg_gen_shr_i64(avrA, avrA, sh);
-    set_avr64(VT, avrA, true);
+    get_avr64(avr, VA, true);
+    tcg_gen_subfi_i64(tmp, 32, sh);
+    tcg_gen_shli_i64(carry, avr, 32);
+    tcg_gen_shl_i64(carry, carry, tmp);
+    tcg_gen_shr_i64(avr, avr, sh);
+    set_avr64(VT, avr, true);
     /*
      * Perform shift on lower doubleword element of vA and replace highest
-     * sh bits with shifted.
+     * 'sh' bits with 'carry'.
      */
-    get_avr64(avrA, VA, false);
-    tcg_gen_shr_i64(avrA, avrA, sh);
-    tcg_gen_or_i64(avrA, avrA, shifted);
-    set_avr64(VT, avrA, false);
+    get_avr64(avr, VA, false);
+    tcg_gen_shr_i64(avr, avr, sh);
+    tcg_gen_or_i64(avr, avr, carry);
+    set_avr64(VT, avr, false);
 
-    tcg_temp_free_i64(avrA);
-    tcg_temp_free_i64(avrB);
+    tcg_temp_free_i64(avr);
     tcg_temp_free_i64(sh);
-    tcg_temp_free_i64(shifted);
+    tcg_temp_free_i64(carry);
     tcg_temp_free_i64(tmp);
 }
 
diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index 009afc38b9..7e92fb2e15 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -515,6 +515,7 @@ static void cpu_model_from_info(S390CPUModel *model, const CpuModelInfo *info,
         visitor = qobject_input_visitor_new(info->props);
         visit_start_struct(visitor, NULL, NULL, 0, errp);
         if (*errp) {
+            visit_free(visitor);
             object_unref(obj);
             return;
         }
diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
index c24c869e77..0c9d14b4b1 100644
--- a/target/s390x/kvm.c
+++ b/target/s390x/kvm.c
@@ -320,11 +320,17 @@ void kvm_s390_set_max_pagesize(uint64_t pagesize, Error **errp)
     cap_hpage_1m = 1;
 }
 
-int kvm_arch_init(MachineState *ms, KVMState *s)
+static void ccw_machine_class_foreach(ObjectClass *oc, void *opaque)
 {
-    MachineClass *mc = MACHINE_GET_CLASS(ms);
+    MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->default_cpu_type = S390_CPU_TYPE_NAME("host");
+}
+
+int kvm_arch_init(MachineState *ms, KVMState *s)
+{
+    object_class_foreach(ccw_machine_class_foreach, TYPE_S390_CCW_MACHINE,
+                         false, NULL);
 
     if (!kvm_check_extension(kvm_state, KVM_CAP_DEVICE_CTRL)) {
         error_report("KVM is missing capability KVM_CAP_DEVICE_CTRL - "
diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 90b81335f9..c9f3f34750 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -556,9 +556,7 @@ int mmu_translate_real(CPUS390XState *env, target_ulong raddr, int rw,
         *flags |= PAGE_WRITE_INV;
         if (is_low_address(raddr) && rw == MMU_DATA_STORE) {
             /* LAP sets bit 56 */
-            *tec = (raddr & TARGET_PAGE_MASK)
-                 | (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ)
-                 | 0x80;
+            *tec = (raddr & TARGET_PAGE_MASK) | FS_WRITE | 0x80;
             return PGM_PROTECTION;
         }
     }
diff --git a/target/s390x/translate_vx.inc.c b/target/s390x/translate_vx.inc.c
index 5ce7bfb0af..71059f9ca0 100644
--- a/target/s390x/translate_vx.inc.c
+++ b/target/s390x/translate_vx.inc.c
@@ -2132,12 +2132,12 @@ static DisasJumpType op_vs(DisasContext *s, DisasOps *o)
 
 static void gen_scbi_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
 {
-    tcg_gen_setcond_i32(TCG_COND_LTU, d, a, b);
+    tcg_gen_setcond_i32(TCG_COND_GEU, d, a, b);
 }
 
 static void gen_scbi_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
 {
-    tcg_gen_setcond_i64(TCG_COND_LTU, d, a, b);
+    tcg_gen_setcond_i64(TCG_COND_GEU, d, a, b);
 }
 
 static void gen_scbi2_i64(TCGv_i64 dl, TCGv_i64 dh, TCGv_i64 al,
@@ -2151,7 +2151,8 @@ static void gen_scbi2_i64(TCGv_i64 dl, TCGv_i64 dh, TCGv_i64 al,
     tcg_gen_andi_i64(th, th, 1);
     tcg_gen_sub2_i64(tl, th, ah, zero, th, zero);
     tcg_gen_sub2_i64(tl, th, tl, th, bh, zero);
-    tcg_gen_andi_i64(dl, th, 1);
+    /* "invert" the result: -1 -> 0; 0 -> 1 */
+    tcg_gen_addi_i64(dl, th, 1);
     tcg_gen_mov_i64(dh, zero);
 
     tcg_temp_free_i64(th);
@@ -2186,13 +2187,13 @@ static void gen_sbi2_i64(TCGv_i64 dl, TCGv_i64 dh, TCGv_i64 al, TCGv_i64 ah,
                          TCGv_i64 bl, TCGv_i64 bh, TCGv_i64 cl, TCGv_i64 ch)
 {
     TCGv_i64 tl = tcg_temp_new_i64();
-    TCGv_i64 zero = tcg_const_i64(0);
+    TCGv_i64 th = tcg_temp_new_i64();
 
-    tcg_gen_andi_i64(tl, cl, 1);
-    tcg_gen_sub2_i64(dl, dh, al, ah, bl, bh);
-    tcg_gen_sub2_i64(dl, dh, dl, dh, tl, zero);
+    tcg_gen_not_i64(tl, bl);
+    tcg_gen_not_i64(th, bh);
+    gen_ac2_i64(dl, dh, al, ah, tl, th, cl, ch);
     tcg_temp_free_i64(tl);
-    tcg_temp_free_i64(zero);
+    tcg_temp_free_i64(th);
 }
 
 static DisasJumpType op_vsbi(DisasContext *s, DisasOps *o)
@@ -2213,20 +2214,13 @@ static void gen_sbcbi2_i64(TCGv_i64 dl, TCGv_i64 dh, TCGv_i64 al, TCGv_i64 ah,
 {
     TCGv_i64 th = tcg_temp_new_i64();
     TCGv_i64 tl = tcg_temp_new_i64();
-    TCGv_i64 zero = tcg_const_i64(0);
 
-    tcg_gen_andi_i64(tl, cl, 1);
-    tcg_gen_sub2_i64(tl, th, al, zero, tl, zero);
-    tcg_gen_sub2_i64(tl, th, tl, th, bl, zero);
-    tcg_gen_andi_i64(th, th, 1);
-    tcg_gen_sub2_i64(tl, th, ah, zero, th, zero);
-    tcg_gen_sub2_i64(tl, th, tl, th, bh, zero);
-    tcg_gen_andi_i64(dl, th, 1);
-    tcg_gen_mov_i64(dh, zero);
+    tcg_gen_not_i64(tl, bl);
+    tcg_gen_not_i64(th, bh);
+    gen_accc2_i64(dl, dh, al, ah, tl, th, cl, ch);
 
     tcg_temp_free_i64(tl);
     tcg_temp_free_i64(th);
-    tcg_temp_free_i64(zero);
 }
 
 static DisasJumpType op_vsbcbi(DisasContext *s, DisasOps *o)
diff --git a/target/s390x/vec_int_helper.c b/target/s390x/vec_int_helper.c
index 68eaae407b..0d6bc13dd6 100644
--- a/target/s390x/vec_int_helper.c
+++ b/target/s390x/vec_int_helper.c
@@ -70,15 +70,17 @@ static void s390_vec_sar(S390Vector *d, const S390Vector *a, uint64_t count)
         d->doubleword[0] = a->doubleword[0];
         d->doubleword[1] = a->doubleword[1];
     } else if (count == 64) {
+        tmp = (int64_t)a->doubleword[0] >> 63;
         d->doubleword[1] = a->doubleword[0];
-        d->doubleword[0] = 0;
+        d->doubleword[0] = tmp;
     } else if (count < 64) {
         tmp = a->doubleword[1] >> count;
         d->doubleword[1] = deposit64(tmp, 64 - count, count, a->doubleword[0]);
         d->doubleword[0] = (int64_t)a->doubleword[0] >> count;
     } else {
+        tmp = (int64_t)a->doubleword[0] >> 63;
         d->doubleword[1] = (int64_t)a->doubleword[0] >> (count - 64);
-        d->doubleword[0] = 0;
+        d->doubleword[0] = tmp;
     }
 }
 
@@ -336,7 +338,7 @@ void HELPER(gvec_vmae##BITS)(void *v1, const void *v2, const void *v3,         \
     for (i = 0, j = 0; i < (128 / TBITS); i++, j += 2) {                       \
         int##TBITS##_t a = (int##BITS##_t)s390_vec_read_element##BITS(v2, j);  \
         int##TBITS##_t b = (int##BITS##_t)s390_vec_read_element##BITS(v3, j);  \
-        int##TBITS##_t c = (int##BITS##_t)s390_vec_read_element##BITS(v4, j);  \
+        int##TBITS##_t c = s390_vec_read_element##TBITS(v4, i);                \
                                                                                \
         s390_vec_write_element##TBITS(v1, i, a * b + c);                       \
     }                                                                          \
@@ -354,7 +356,7 @@ void HELPER(gvec_vmale##BITS)(void *v1, const void *v2, const void *v3,        \
     for (i = 0, j = 0; i < (128 / TBITS); i++, j += 2) {                       \
         uint##TBITS##_t a = s390_vec_read_element##BITS(v2, j);                \
         uint##TBITS##_t b = s390_vec_read_element##BITS(v3, j);                \
-        uint##TBITS##_t c = s390_vec_read_element##BITS(v4, j);                \
+        uint##TBITS##_t c = s390_vec_read_element##TBITS(v4, i);               \
                                                                                \
         s390_vec_write_element##TBITS(v1, i, a * b + c);                       \
     }                                                                          \
@@ -372,7 +374,7 @@ void HELPER(gvec_vmao##BITS)(void *v1, const void *v2, const void *v3,         \
     for (i = 0, j = 1; i < (128 / TBITS); i++, j += 2) {                       \
         int##TBITS##_t a = (int##BITS##_t)s390_vec_read_element##BITS(v2, j);  \
         int##TBITS##_t b = (int##BITS##_t)s390_vec_read_element##BITS(v3, j);  \
-        int##TBITS##_t c = (int##BITS##_t)s390_vec_read_element##BITS(v4, j);  \
+        int##TBITS##_t c = s390_vec_read_element##TBITS(v4, i);                \
                                                                                \
         s390_vec_write_element##TBITS(v1, i, a * b + c);                       \
     }                                                                          \
@@ -390,7 +392,7 @@ void HELPER(gvec_vmalo##BITS)(void *v1, const void *v2, const void *v3,        \
     for (i = 0, j = 1; i < (128 / TBITS); i++, j += 2) {                       \
         uint##TBITS##_t a = s390_vec_read_element##BITS(v2, j);                \
         uint##TBITS##_t b = s390_vec_read_element##BITS(v3, j);                \
-        uint##TBITS##_t c = s390_vec_read_element##BITS(v4, j);                \
+        uint##TBITS##_t c = s390_vec_read_element##TBITS(v4, i);               \
                                                                                \
         s390_vec_write_element##TBITS(v1, i, a * b + c);                       \
     }                                                                          \
@@ -488,7 +490,7 @@ void HELPER(gvec_vmlo##BITS)(void *v1, const void *v2, const void *v3,         \
 {                                                                              \
     int i, j;                                                                  \
                                                                                \
-    for (i = 0, j = 0; i < (128 / TBITS); i++, j += 2) {                       \
+    for (i = 0, j = 1; i < (128 / TBITS); i++, j += 2) {                       \
         const uint##TBITS##_t a = s390_vec_read_element##BITS(v2, j);          \
         const uint##TBITS##_t b = s390_vec_read_element##BITS(v3, j);          \
                                                                                \
@@ -591,7 +593,7 @@ void HELPER(gvec_vscbi##BITS)(void *v1, const void *v2, const void *v3,        \
         const uint##BITS##_t a = s390_vec_read_element##BITS(v2, i);           \
         const uint##BITS##_t b = s390_vec_read_element##BITS(v3, i);           \
                                                                                \
-        s390_vec_write_element##BITS(v1, i, a < b);                            \
+        s390_vec_write_element##BITS(v1, i, a >= b);                           \
     }                                                                          \
 }
 DEF_VSCBI(8)
diff --git a/target/xtensa/core-test_mmuhifi_c3.c b/target/xtensa/core-test_mmuhifi_c3.c
index 3a59fefa94..089ed7da5d 100644
--- a/target/xtensa/core-test_mmuhifi_c3.c
+++ b/target/xtensa/core-test_mmuhifi_c3.c
@@ -27,8 +27,8 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/gdbstub.h"
+#include "qemu-common.h"
 #include "qemu/host-utils.h"
 
 #include "core-test_mmuhifi_c3/core-isa.h"
@@ -39,7 +39,6 @@
 
 static XtensaConfig test_mmuhifi_c3 __attribute__((unused)) = {
     .name = "test_mmuhifi_c3",
-    .options = XTENSA_OPTIONS,
     .gdb_regmap = {
         .reg = {
 #include "core-test_mmuhifi_c3/gdb-config.inc.c"
diff --git a/target/xtensa/core-test_mmuhifi_c3/core-isa.h b/target/xtensa/core-test_mmuhifi_c3/core-isa.h
index 704a31f7c8..838b1b09da 100644
--- a/target/xtensa/core-test_mmuhifi_c3/core-isa.h
+++ b/target/xtensa/core-test_mmuhifi_c3/core-isa.h
@@ -1,15 +1,37 @@
 /*
- * Xtensa processor core configuration information.
+ * xtensa/config/core-isa.h -- HAL definitions that are dependent on Xtensa
+ *				processor CORE configuration
  *
- * This file is subject to the terms and conditions of version 2.1 of the GNU
- * Lesser General Public License as published by the Free Software Foundation.
- *
- * Copyright (c) 1999-2009 Tensilica Inc.
+ *  See <xtensa/config/core.h>, which includes this file, for more details.
  */
 
+/* Xtensa processor core configuration information.
+
+   Copyright (c) 1999-2019 Tensilica Inc.
+
+   Permission is hereby granted, free of charge, to any person obtaining
+   a copy of this software and associated documentation files (the
+   "Software"), to deal in the Software without restriction, including
+   without limitation the rights to use, copy, modify, merge, publish,
+   distribute, sublicense, and/or sell copies of the Software, and to
+   permit persons to whom the Software is furnished to do so, subject to
+   the following conditions:
+
+   The above copyright notice and this permission notice shall be included
+   in all copies or substantial portions of the Software.
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+   IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+   CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+   TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.  */
+
 #ifndef XTENSA_CORE_TEST_MMUHIFI_C3_CORE_ISA_H
 #define XTENSA_CORE_TEST_MMUHIFI_C3_CORE_ISA_H
 
+
 /****************************************************************************
 	    Parameters Useful for Any Code, USER or PRIVILEGED
  ****************************************************************************/
@@ -32,6 +54,7 @@
 #define XCHAL_HAVE_DEBUG		1	/* debug option */
 #define XCHAL_HAVE_DENSITY		1	/* 16-bit instructions */
 #define XCHAL_HAVE_LOOPS		1	/* zero-overhead loops */
+#define XCHAL_LOOP_BUFFER_SIZE		0	/* zero-ov. loop instr buffer size */
 #define XCHAL_HAVE_NSA			1	/* NSA/NSAU instructions */
 #define XCHAL_HAVE_MINMAX		1	/* MIN/MAX instructions */
 #define XCHAL_HAVE_SEXT			1	/* SEXT instruction */
@@ -59,44 +82,73 @@
 #define XCHAL_HAVE_TAP_MASTER		0	/* JTAG TAP control instr's */
 #define XCHAL_HAVE_PRID			1	/* processor ID register */
 #define XCHAL_HAVE_EXTERN_REGS		1	/* WER/RER instructions */
+#define XCHAL_HAVE_MX			1	/* MX core (Tensilica internal) */
 #define XCHAL_HAVE_MP_INTERRUPTS	1	/* interrupt distributor port */
 #define XCHAL_HAVE_MP_RUNSTALL		1	/* core RunStall control port */
+#define XCHAL_HAVE_PSO			0	/* Power Shut-Off */
+#define XCHAL_HAVE_PSO_CDM		0	/* core/debug/mem pwr domains */
+#define XCHAL_HAVE_PSO_FULL_RETENTION	0	/* all regs preserved on PSO */
 #define XCHAL_HAVE_THREADPTR		1	/* THREADPTR register */
 #define XCHAL_HAVE_BOOLEANS		1	/* boolean registers */
 #define XCHAL_HAVE_CP			1	/* CPENABLE reg (coprocessor) */
 #define XCHAL_CP_MAXCFG			2	/* max allowed cp id plus one */
 #define XCHAL_HAVE_MAC16		0	/* MAC16 package */
 #define XCHAL_HAVE_VECTORFPU2005	0	/* vector floating-point pkg */
-#define XCHAL_HAVE_FP			0	/* floating point pkg */
+#define XCHAL_HAVE_FP			0	/* single prec floating point */
+#define XCHAL_HAVE_FP_DIV		0	/* FP with DIV instructions */
+#define XCHAL_HAVE_FP_RECIP		0	/* FP with RECIP instructions */
+#define XCHAL_HAVE_FP_SQRT		0	/* FP with SQRT instructions */
+#define XCHAL_HAVE_FP_RSQRT		0	/* FP with RSQRT instructions */
 #define XCHAL_HAVE_DFP			0	/* double precision FP pkg */
+#define XCHAL_HAVE_DFP_DIV		0	/* DFP with DIV instructions */
+#define XCHAL_HAVE_DFP_RECIP		0	/* DFP with RECIP instructions*/
+#define XCHAL_HAVE_DFP_SQRT		0	/* DFP with SQRT instructions */
+#define XCHAL_HAVE_DFP_RSQRT		0	/* DFP with RSQRT instructions*/
 #define XCHAL_HAVE_DFP_accel		0	/* double precision FP acceleration pkg */
 #define XCHAL_HAVE_VECTRA1		0	/* Vectra I  pkg */
 #define XCHAL_HAVE_VECTRALX		0	/* Vectra LX pkg */
 #define XCHAL_HAVE_HIFIPRO		0	/* HiFiPro Audio Engine pkg */
+#define XCHAL_HAVE_HIFI3		0	/* HiFi3 Audio Engine pkg */
 #define XCHAL_HAVE_HIFI2		1	/* HiFi2 Audio Engine pkg */
+#define XCHAL_HAVE_HIFI2EP		0	/* HiFi2EP */
+#define XCHAL_HAVE_HIFI_MINI		0	
 #define XCHAL_HAVE_CONNXD2		0	/* ConnX D2 pkg */
+#define XCHAL_HAVE_BBE16		0	/* ConnX BBE16 pkg */
+#define XCHAL_HAVE_BBE16_RSQRT		0	/* BBE16 & vector recip sqrt */
+#define XCHAL_HAVE_BBE16_VECDIV		0	/* BBE16 & vector divide */
+#define XCHAL_HAVE_BBE16_DESPREAD	0	/* BBE16 & despread */
+#define XCHAL_HAVE_BBENEP		0	/* ConnX BBENEP pkgs */
+#define XCHAL_HAVE_BSP3			0	/* ConnX BSP3 pkg */
+#define XCHAL_HAVE_BSP3_TRANSPOSE	0	/* BSP3 & transpose32x32 */
+#define XCHAL_HAVE_SSP16		0	/* ConnX SSP16 pkg */
+#define XCHAL_HAVE_SSP16_VITERBI	0	/* SSP16 & viterbi */
+#define XCHAL_HAVE_TURBO16		0	/* ConnX Turbo16 pkg */
+#define XCHAL_HAVE_BBP16		0	/* ConnX BBP16 pkg */
+#define XCHAL_HAVE_FLIX3		0	/* basic 3-way FLIX option */
 
 
 /*----------------------------------------------------------------------
 				MISC
   ----------------------------------------------------------------------*/
 
+#define XCHAL_NUM_LOADSTORE_UNITS	1	/* load/store units */
 #define XCHAL_NUM_WRITEBUFFER_ENTRIES	8	/* size of write buffer */
 #define XCHAL_INST_FETCH_WIDTH		8	/* instr-fetch width in bytes */
 #define XCHAL_DATA_WIDTH		8	/* data width in bytes */
+#define XCHAL_DATA_PIPE_DELAY		1	/* d-side pipeline delay
+						   (1 = 5-stage, 2 = 7-stage) */
 /*  In T1050, applies to selected core load and store instructions (see ISA): */
 #define XCHAL_UNALIGNED_LOAD_EXCEPTION	1	/* unaligned loads cause exc. */
 #define XCHAL_UNALIGNED_STORE_EXCEPTION	1	/* unaligned stores cause exc.*/
 #define XCHAL_UNALIGNED_LOAD_HW		0	/* unaligned loads work in hw */
 #define XCHAL_UNALIGNED_STORE_HW	0	/* unaligned stores work in hw*/
 
-#define XCHAL_SW_VERSION		800000	/* sw version of this header */
+#define XCHAL_SW_VERSION		1000006	/* sw version of this header */
 
 #define XCHAL_CORE_ID			"test_mmuhifi_c3"	/* alphanum core name
 						   (CoreID) set in the Xtensa
 						   Processor Generator */
 
-#define XCHAL_CORE_DESCRIPTION		"test_mmuhifi_c3"
 #define XCHAL_BUILD_UNIQUE_ID		0x00005A6A	/* 22-bit sw build ID */
 
 /*
@@ -136,6 +188,10 @@
 #define XCHAL_DCACHE_IS_WRITEBACK	1	/* writeback feature */
 #define XCHAL_DCACHE_IS_COHERENT	1	/* MP coherence feature */
 
+#define XCHAL_HAVE_PREFETCH		0	/* PREFCTL register */
+#define XCHAL_HAVE_PREFETCH_L1		0	/* prefetch to L1 dcache */
+#define XCHAL_PREFETCH_CASTOUT_LINES	0	/* dcache pref. castout bufsz */
+
 
 
 
@@ -172,6 +228,8 @@
 #define XCHAL_ICACHE_ACCESS_SIZE	8
 #define XCHAL_DCACHE_ACCESS_SIZE	8
 
+#define XCHAL_DCACHE_BANKS		1	/* number of banks */
+
 /*  Number of encoded cache attr bits (see <xtensa/hal.h> for decoded bits):  */
 #define XCHAL_CA_BITS			4
 
@@ -187,6 +245,8 @@
 #define XCHAL_NUM_URAM			0	/* number of core unified RAMs*/
 #define XCHAL_NUM_XLMI			0	/* number of core XLMI ports */
 
+#define XCHAL_HAVE_IMEM_LOADSTORE	1	/* can load/store to IROM/IRAM*/
+
 
 /*----------------------------------------------------------------------
 			INTERRUPTS and TIMERS
@@ -261,6 +321,7 @@
 #define XCHAL_INTTYPE_MASK_TIMER	0x00000140
 #define XCHAL_INTTYPE_MASK_NMI		0x00000000
 #define XCHAL_INTTYPE_MASK_WRITE_ERROR	0x00000000
+#define XCHAL_INTTYPE_MASK_PROFILING	0x00000000
 
 /*  Interrupt numbers assigned to specific interrupt sources:  */
 #define XCHAL_TIMER0_INTERRUPT		6	/* CCOMPARE0 */
@@ -273,7 +334,7 @@
 
 
 /*
- *  External interrupt vectors/levels.
+ *  External interrupt mapping.
  *  These macros describe how Xtensa processor interrupt numbers
  *  (as numbered internally, eg. in INTERRUPT and INTENABLE registers)
  *  map to external BInterrupt<n> pins, for those interrupts
@@ -281,7 +342,7 @@
  *  See the Xtensa processor databook for more details.
  */
 
-/*  Core interrupt numbers mapped to each EXTERNAL interrupt number:  */
+/*  Core interrupt numbers mapped to each EXTERNAL BInterrupt pin number:  */
 #define XCHAL_EXTINT0_NUM		0	/* (intlevel 1) */
 #define XCHAL_EXTINT1_NUM		1	/* (intlevel 1) */
 #define XCHAL_EXTINT2_NUM		2	/* (intlevel 1) */
@@ -291,6 +352,16 @@
 #define XCHAL_EXTINT6_NUM		9	/* (intlevel 1) */
 #define XCHAL_EXTINT7_NUM		10	/* (intlevel 1) */
 #define XCHAL_EXTINT8_NUM		11	/* (intlevel 1) */
+/*  EXTERNAL BInterrupt pin numbers mapped to each core interrupt number:  */
+#define XCHAL_INT0_EXTNUM		0	/* (intlevel 1) */
+#define XCHAL_INT1_EXTNUM		1	/* (intlevel 1) */
+#define XCHAL_INT2_EXTNUM		2	/* (intlevel 1) */
+#define XCHAL_INT3_EXTNUM		3	/* (intlevel 1) */
+#define XCHAL_INT4_EXTNUM		4	/* (intlevel 1) */
+#define XCHAL_INT5_EXTNUM		5	/* (intlevel 1) */
+#define XCHAL_INT9_EXTNUM		6	/* (intlevel 1) */
+#define XCHAL_INT10_EXTNUM		7	/* (intlevel 1) */
+#define XCHAL_INT11_EXTNUM		8	/* (intlevel 1) */
 
 
 /*----------------------------------------------------------------------
@@ -300,11 +371,13 @@
 #define XCHAL_XEA_VERSION		2	/* Xtensa Exception Architecture
 						   number: 1 == XEA1 (old)
 							   2 == XEA2 (new)
-							   0 == XEAX (extern) */
+							   0 == XEAX (extern) or TX */
 #define XCHAL_HAVE_XEA1			0	/* Exception Architecture 1 */
 #define XCHAL_HAVE_XEA2			1	/* Exception Architecture 2 */
 #define XCHAL_HAVE_XEAX			0	/* External Exception Arch. */
 #define XCHAL_HAVE_EXCEPTIONS		1	/* exception option */
+#define XCHAL_HAVE_HALT			0	/* halt architecture option */
+#define XCHAL_HAVE_BOOTLOADER		0	/* boot loader (for TX) */
 #define XCHAL_HAVE_MEM_ECC_PARITY	0	/* local memory ECC/parity */
 #define XCHAL_HAVE_VECTOR_SELECT	1	/* relocatable vectors */
 #define XCHAL_HAVE_VECBASE		1	/* relocatable vectors */
@@ -344,13 +417,30 @@
 
 
 /*----------------------------------------------------------------------
-				DEBUG
+				DEBUG MODULE
   ----------------------------------------------------------------------*/
 
+/*  Misc  */
+#define XCHAL_HAVE_DEBUG_ERI		0	/* ERI to debug module */
+#define XCHAL_HAVE_DEBUG_APB		0	/* APB to debug module */
+#define XCHAL_HAVE_DEBUG_JTAG		0	/* JTAG to debug module */
+
+/*  On-Chip Debug (OCD)  */
 #define XCHAL_HAVE_OCD			1	/* OnChipDebug option */
 #define XCHAL_NUM_IBREAK		0	/* number of IBREAKn regs */
 #define XCHAL_NUM_DBREAK		0	/* number of DBREAKn regs */
-#define XCHAL_HAVE_OCD_DIR_ARRAY	0	/* faster OCD option */
+#define XCHAL_HAVE_OCD_DIR_ARRAY	0	/* faster OCD option (to LX4) */
+#define XCHAL_HAVE_OCD_LS32DDR		0	/* L32DDR/S32DDR (faster OCD) */
+
+/*  TRAX (in core)  */
+#define XCHAL_HAVE_TRAX			0	/* TRAX in debug module */
+#define XCHAL_TRAX_MEM_SIZE		0	/* TRAX memory size in bytes */
+#define XCHAL_TRAX_MEM_SHAREABLE	0	/* start/end regs; ready sig. */
+#define XCHAL_TRAX_ATB_WIDTH		0	/* ATB width (bits), 0=no ATB */
+#define XCHAL_TRAX_TIME_WIDTH		0	/* timestamp bitwidth, 0=none */
+
+/*  Perf counters  */
+#define XCHAL_NUM_PERF_COUNTERS		0	/* performance counters */
 
 
 /*----------------------------------------------------------------------
diff --git a/target/xtensa/core-test_mmuhifi_c3/gdb-config.inc.c b/target/xtensa/core-test_mmuhifi_c3/gdb-config.inc.c
index 618d30dffa..0bca70b5af 100644
--- a/target/xtensa/core-test_mmuhifi_c3/gdb-config.inc.c
+++ b/target/xtensa/core-test_mmuhifi_c3/gdb-config.inc.c
@@ -1,23 +1,25 @@
 /* Configuration for the Xtensa architecture for GDB, the GNU debugger.
 
-   Copyright (C) 2003, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+   Copyright (c) 2003-2019 Tensilica Inc.
 
-   This file is part of GDB.
+   Permission is hereby granted, free of charge, to any person obtaining
+   a copy of this software and associated documentation files (the
+   "Software"), to deal in the Software without restriction, including
+   without limitation the rights to use, copy, modify, merge, publish,
+   distribute, sublicense, and/or sell copies of the Software, and to
+   permit persons to whom the Software is furnished to do so, subject to
+   the following conditions:
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
+   The above copyright notice and this permission notice shall be included
+   in all copies or substantial portions of the Software.
 
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
-
-  /*    idx ofs bi sz al targno  flags cp typ group name  */
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+   IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+   CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+   TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.  */
   XTREG(  0,  0,32, 4, 4,0x0020,0x0006,-2, 9,0x0100,pc,          0,0,0,0,0,0)
   XTREG(  1,  4,32, 4, 4,0x0100,0x0006,-2, 1,0x0002,ar0,         0,0,0,0,0,0)
   XTREG(  2,  8,32, 4, 4,0x0101,0x0006,-2, 1,0x0002,ar1,         0,0,0,0,0,0)
@@ -58,8 +60,8 @@
   XTREG( 37,148,32, 4, 4,0x0205,0x0006,-2, 2,0x1100,litbase,     0,0,0,0,0,0)
   XTREG( 38,152, 3, 4, 4,0x0248,0x0006,-2, 2,0x1002,windowbase,  0,0,0,0,0,0)
   XTREG( 39,156, 8, 4, 4,0x0249,0x0006,-2, 2,0x1002,windowstart, 0,0,0,0,0,0)
-  XTREG( 40,160,32, 4, 4,0x02b0,0x0002,-2, 2,0x1000,sr176,       0,0,0,0,0,0)
-  XTREG( 41,164,32, 4, 4,0x02d0,0x0002,-2, 2,0x1000,sr208,       0,0,0,0,0,0)
+  XTREG( 40,160,32, 4, 4,0x02b0,0x0002,-2, 2,0x1000,configid0,   0,0,0,0,0,0)
+  XTREG( 41,164,32, 4, 4,0x02d0,0x0002,-2, 2,0x1000,configid1,   0,0,0,0,0,0)
   XTREG( 42,168,19, 4, 4,0x02e6,0x0006,-2, 2,0x1100,ps,          0,0,0,0,0,0)
   XTREG( 43,172,32, 4, 4,0x03e7,0x0006,-2, 3,0x0110,threadptr,   0,0,0,0,0,0)
   XTREG( 44,176,16, 4, 4,0x0204,0x0006,-1, 2,0x1100,br,          0,0,0,0,0,0)
@@ -137,4 +139,82 @@
   XTREG(104,464,32, 4, 4,0x000d,0x0006,-2, 8,0x0100,a13,         0,0,0,0,0,0)
   XTREG(105,468,32, 4, 4,0x000e,0x0006,-2, 8,0x0100,a14,         0,0,0,0,0,0)
   XTREG(106,472,32, 4, 4,0x000f,0x0006,-2, 8,0x0100,a15,         0,0,0,0,0,0)
+  XTREG(107,476, 1, 1, 1,0x0010,0x0006,-2, 6,0x1010,b0,
+            0,0,&xtensa_mask0,0,0,0)
+  XTREG(108,477, 1, 1, 1,0x0011,0x0006,-2, 6,0x1010,b1,
+            0,0,&xtensa_mask1,0,0,0)
+  XTREG(109,478, 1, 1, 1,0x0012,0x0006,-2, 6,0x1010,b2,
+            0,0,&xtensa_mask2,0,0,0)
+  XTREG(110,479, 1, 1, 1,0x0013,0x0006,-2, 6,0x1010,b3,
+            0,0,&xtensa_mask3,0,0,0)
+  XTREG(111,480, 1, 1, 1,0x0014,0x0006,-2, 6,0x1010,b4,
+            0,0,&xtensa_mask4,0,0,0)
+  XTREG(112,481, 1, 1, 1,0x0015,0x0006,-2, 6,0x1010,b5,
+            0,0,&xtensa_mask5,0,0,0)
+  XTREG(113,482, 1, 1, 1,0x0016,0x0006,-2, 6,0x1010,b6,
+            0,0,&xtensa_mask6,0,0,0)
+  XTREG(114,483, 1, 1, 1,0x0017,0x0006,-2, 6,0x1010,b7,
+            0,0,&xtensa_mask7,0,0,0)
+  XTREG(115,484, 1, 1, 1,0x0018,0x0006,-2, 6,0x1010,b8,
+            0,0,&xtensa_mask8,0,0,0)
+  XTREG(116,485, 1, 1, 1,0x0019,0x0006,-2, 6,0x1010,b9,
+            0,0,&xtensa_mask9,0,0,0)
+  XTREG(117,486, 1, 1, 1,0x001a,0x0006,-2, 6,0x1010,b10,
+            0,0,&xtensa_mask10,0,0,0)
+  XTREG(118,487, 1, 1, 1,0x001b,0x0006,-2, 6,0x1010,b11,
+            0,0,&xtensa_mask11,0,0,0)
+  XTREG(119,488, 1, 1, 1,0x001c,0x0006,-2, 6,0x1010,b12,
+            0,0,&xtensa_mask12,0,0,0)
+  XTREG(120,489, 1, 1, 1,0x001d,0x0006,-2, 6,0x1010,b13,
+            0,0,&xtensa_mask13,0,0,0)
+  XTREG(121,490, 1, 1, 1,0x001e,0x0006,-2, 6,0x1010,b14,
+            0,0,&xtensa_mask14,0,0,0)
+  XTREG(122,491, 1, 1, 1,0x001f,0x0006,-2, 6,0x1010,b15,
+            0,0,&xtensa_mask15,0,0,0)
+  XTREG(123,492, 4, 4, 4,0x2003,0x0006,-2, 6,0x1010,psintlevel,
+            0,0,&xtensa_mask16,0,0,0)
+  XTREG(124,496, 1, 4, 4,0x2004,0x0006,-2, 6,0x1010,psum,
+            0,0,&xtensa_mask17,0,0,0)
+  XTREG(125,500, 1, 4, 4,0x2005,0x0006,-2, 6,0x1010,pswoe,
+            0,0,&xtensa_mask18,0,0,0)
+  XTREG(126,504, 2, 4, 4,0x2006,0x0006,-2, 6,0x1010,psring,
+            0,0,&xtensa_mask19,0,0,0)
+  XTREG(127,508, 1, 4, 4,0x2007,0x0006,-2, 6,0x1010,psexcm,
+            0,0,&xtensa_mask20,0,0,0)
+  XTREG(128,512, 2, 4, 4,0x2008,0x0006,-2, 6,0x1010,pscallinc,
+            0,0,&xtensa_mask21,0,0,0)
+  XTREG(129,516, 4, 4, 4,0x2009,0x0006,-2, 6,0x1010,psowb,
+            0,0,&xtensa_mask22,0,0,0)
+  XTREG(130,520,20, 4, 4,0x200a,0x0006,-2, 6,0x1010,litbaddr,
+            0,0,&xtensa_mask23,0,0,0)
+  XTREG(131,524, 1, 4, 4,0x200b,0x0006,-2, 6,0x1010,litben,
+            0,0,&xtensa_mask24,0,0,0)
+  XTREG(132,528, 4, 4, 4,0x200e,0x0006,-2, 6,0x1010,dbnum,
+            0,0,&xtensa_mask25,0,0,0)
+  XTREG(133,532, 8, 4, 4,0x200f,0x0006,-2, 6,0x1010,asid3,
+            0,0,&xtensa_mask26,0,0,0)
+  XTREG(134,536, 8, 4, 4,0x2010,0x0006,-2, 6,0x1010,asid2,
+            0,0,&xtensa_mask27,0,0,0)
+  XTREG(135,540, 8, 4, 4,0x2011,0x0006,-2, 6,0x1010,asid1,
+            0,0,&xtensa_mask28,0,0,0)
+  XTREG(136,544, 2, 4, 4,0x2012,0x0006,-2, 6,0x1010,instpgszid4,
+            0,0,&xtensa_mask29,0,0,0)
+  XTREG(137,548, 2, 4, 4,0x2013,0x0006,-2, 6,0x1010,datapgszid4,
+            0,0,&xtensa_mask30,0,0,0)
+  XTREG(138,552,10, 4, 4,0x2014,0x0006,-2, 6,0x1010,ptbase,
+            0,0,&xtensa_mask31,0,0,0)
+  XTREG(139,556, 1, 4, 4,0x201a,0x0006, 1, 5,0x1010,ae_overflow,
+            0,0,&xtensa_mask32,0,0,0)
+  XTREG(140,560, 6, 4, 4,0x201b,0x0006, 1, 5,0x1010,ae_sar,
+            0,0,&xtensa_mask33,0,0,0)
+  XTREG(141,564, 4, 4, 4,0x201c,0x0006, 1, 5,0x1010,ae_bitptr,
+            0,0,&xtensa_mask34,0,0,0)
+  XTREG(142,568, 4, 4, 4,0x201d,0x0006, 1, 5,0x1010,ae_bitsused,
+            0,0,&xtensa_mask35,0,0,0)
+  XTREG(143,572, 4, 4, 4,0x201e,0x0006, 1, 5,0x1010,ae_tablesize,
+            0,0,&xtensa_mask36,0,0,0)
+  XTREG(144,576, 4, 4, 4,0x201f,0x0006, 1, 5,0x1010,ae_first_ts,
+            0,0,&xtensa_mask37,0,0,0)
+  XTREG(145,580,27, 4, 4,0x2020,0x0006, 1, 5,0x1010,ae_nextoffset,
+            0,0,&xtensa_mask38,0,0,0)
   XTREG_END
diff --git a/target/xtensa/core-test_mmuhifi_c3/xtensa-modules.inc.c b/target/xtensa/core-test_mmuhifi_c3/xtensa-modules.inc.c
index 687631b8fb..28561147fc 100644
--- a/target/xtensa/core-test_mmuhifi_c3/xtensa-modules.inc.c
+++ b/target/xtensa/core-test_mmuhifi_c3/xtensa-modules.inc.c
@@ -1,24 +1,26 @@
 /* Xtensa configuration-specific ISA information.
-   Copyright 2003, 2004, 2005, 2007, 2008 Free Software Foundation, Inc.
 
-   This file is part of BFD, the Binary File Descriptor library.
+   Copyright (c) 2003-2019 Tensilica Inc.
 
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public License as
-   published by the Free Software Foundation; either version 3 of the
-   License, or (at your option) any later version.
+   Permission is hereby granted, free of charge, to any person obtaining
+   a copy of this software and associated documentation files (the
+   "Software"), to deal in the Software without restriction, including
+   without limitation the rights to use, copy, modify, merge, publish,
+   distribute, sublicense, and/or sell copies of the Software, and to
+   permit persons to whom the Software is furnished to do so, subject to
+   the following conditions:
 
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
+   The above copyright notice and this permission notice shall be included
+   in all copies or substantial portions of the Software.
 
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+   IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+   CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+   TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.  */
 
-#include "qemu/osdep.h"
 #include "xtensa-isa.h"
 #include "xtensa-isa-internal.h"
 
@@ -32,8 +34,8 @@ static xtensa_sysreg_internal sysregs[] = {
   { "BR", 4, 0 },
   { "PTEVADDR", 83, 0 },
   { "DDR", 104, 0 },
-  { "176", 176, 0 },
-  { "208", 208, 0 },
+  { "CONFIGID0", 176, 0 },
+  { "CONFIGID1", 208, 0 },
   { "INTERRUPT", 226, 0 },
   { "INTCLEAR", 227, 0 },
   { "CCOUNT", 234, 0 },
@@ -8634,6 +8636,38 @@ Field_ae_s20_Slot_inst_set (xtensa_insnbuf insn, uint32 val)
 }
 
 static unsigned
+Field_ae_fld_ohba_Slot_inst_get (const xtensa_insnbuf insn)
+{
+  unsigned tie_t = 0;
+  tie_t = (tie_t << 4) | ((insn[0] << 12) >> 28);
+  return tie_t;
+}
+
+static void
+Field_ae_fld_ohba_Slot_inst_set (xtensa_insnbuf insn, uint32 val)
+{
+  uint32 tie_t;
+  tie_t = (val << 28) >> 28;
+  insn[0] = (insn[0] & ~0xf0000) | (tie_t << 16);
+}
+
+static unsigned
+Field_ae_fld_ohba2_Slot_inst_get (const xtensa_insnbuf insn)
+{
+  unsigned tie_t = 0;
+  tie_t = (tie_t << 4) | ((insn[0] << 12) >> 28);
+  return tie_t;
+}
+
+static void
+Field_ae_fld_ohba2_Slot_inst_set (xtensa_insnbuf insn, uint32 val)
+{
+  uint32 tie_t;
+  tie_t = (val << 28) >> 28;
+  insn[0] = (insn[0] & ~0xf0000) | (tie_t << 16);
+}
+
+static unsigned
 Field_ftsf12_Slot_inst_get (const xtensa_insnbuf insn)
 {
   unsigned tie_t = 0;
@@ -8794,6 +8828,8 @@ enum xtensa_field_id {
   FIELD_ae_r20,
   FIELD_ae_r10,
   FIELD_ae_s20,
+  FIELD_ae_fld_ohba,
+  FIELD_ae_fld_ohba2,
   FIELD_op0_s3,
   FIELD_ftsf12,
   FIELD_ftsf13,
@@ -9184,7 +9220,7 @@ enum xtensa_interface_id {
   INTERFACE_RMPINT_In
 };
 
-
+
 /* Constant tables.  */
 
 /* constant table ai4c */
@@ -9254,1602 +9290,1462 @@ static const unsigned CONST_TBL_b4cu_0[] = {
 /* Instruction operands.  */
 
 static int
-Operand_soffsetx4_decode (uint32 *valp)
-{
-  unsigned soffsetx4_0, offset_0;
-  offset_0 = *valp & 0x3ffff;
-  soffsetx4_0 = 0x4 + ((((int) offset_0 << 14) >> 14) << 2);
-  *valp = soffsetx4_0;
-  return 0;
-}
-
-static int
-Operand_soffsetx4_encode (uint32 *valp)
-{
-  unsigned offset_0, soffsetx4_0;
-  soffsetx4_0 = *valp;
-  offset_0 = ((soffsetx4_0 - 0x4) >> 2) & 0x3ffff;
-  *valp = offset_0;
-  return 0;
-}
-
-static int
-Operand_soffsetx4_ator (uint32 *valp, uint32 pc)
-{
-  *valp -= (pc & ~0x3);
-  return 0;
-}
-
-static int
-Operand_soffsetx4_rtoa (uint32 *valp, uint32 pc)
-{
-  *valp += (pc & ~0x3);
-  return 0;
-}
-
-static int
-Operand_uimm12x8_decode (uint32 *valp)
+OperandSem_opnd_sem_soffsetx4_decode (uint32 *valp)
 {
-  unsigned uimm12x8_0, imm12_0;
-  imm12_0 = *valp & 0xfff;
-  uimm12x8_0 = imm12_0 << 3;
-  *valp = uimm12x8_0;
+  unsigned soffsetx4_out_0;
+  unsigned soffsetx4_in_0;
+  soffsetx4_in_0 = *valp & 0x3ffff;
+  soffsetx4_out_0 = 0x4 + ((((int) soffsetx4_in_0 << 14) >> 14) << 2);
+  *valp = soffsetx4_out_0;
   return 0;
 }
 
 static int
-Operand_uimm12x8_encode (uint32 *valp)
+OperandSem_opnd_sem_soffsetx4_encode (uint32 *valp)
 {
-  unsigned imm12_0, uimm12x8_0;
-  uimm12x8_0 = *valp;
-  imm12_0 = ((uimm12x8_0 >> 3) & 0xfff);
-  *valp = imm12_0;
+  unsigned soffsetx4_in_0;
+  unsigned soffsetx4_out_0;
+  soffsetx4_out_0 = *valp;
+  soffsetx4_in_0 = ((soffsetx4_out_0 - 0x4) >> 2) & 0x3ffff;
+  *valp = soffsetx4_in_0;
   return 0;
 }
 
 static int
-Operand_simm4_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm12x8_decode (uint32 *valp)
 {
-  unsigned simm4_0, mn_0;
-  mn_0 = *valp & 0xf;
-  simm4_0 = ((int) mn_0 << 28) >> 28;
-  *valp = simm4_0;
+  unsigned uimm12x8_out_0;
+  unsigned uimm12x8_in_0;
+  uimm12x8_in_0 = *valp & 0xfff;
+  uimm12x8_out_0 = uimm12x8_in_0 << 3;
+  *valp = uimm12x8_out_0;
   return 0;
 }
 
 static int
-Operand_simm4_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm12x8_encode (uint32 *valp)
 {
-  unsigned mn_0, simm4_0;
-  simm4_0 = *valp;
-  mn_0 = (simm4_0 & 0xf);
-  *valp = mn_0;
+  unsigned uimm12x8_in_0;
+  unsigned uimm12x8_out_0;
+  uimm12x8_out_0 = *valp;
+  uimm12x8_in_0 = ((uimm12x8_out_0 >> 3) & 0xfff);
+  *valp = uimm12x8_in_0;
   return 0;
 }
 
 static int
-Operand_arr_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_simm4_decode (uint32 *valp)
 {
+  unsigned simm4_out_0;
+  unsigned simm4_in_0;
+  simm4_in_0 = *valp & 0xf;
+  simm4_out_0 = ((int) simm4_in_0 << 28) >> 28;
+  *valp = simm4_out_0;
   return 0;
 }
 
 static int
-Operand_arr_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0xf) != 0;
-  return error;
-}
-
-static int
-Operand_ars_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_simm4_encode (uint32 *valp)
 {
+  unsigned simm4_in_0;
+  unsigned simm4_out_0;
+  simm4_out_0 = *valp;
+  simm4_in_0 = (simm4_out_0 & 0xf);
+  *valp = simm4_in_0;
   return 0;
 }
 
 static int
-Operand_ars_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0xf) != 0;
-  return error;
-}
-
-static int
-Operand_art_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_AR_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
   return 0;
 }
 
 static int
-Operand_art_encode (uint32 *valp)
+OperandSem_opnd_sem_AR_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~0xf) != 0;
+  error = (*valp >= 32);
   return error;
 }
 
 static int
-Operand_ar0_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_AR_0_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
   return 0;
 }
 
 static int
-Operand_ar0_encode (uint32 *valp)
+OperandSem_opnd_sem_AR_0_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~0x1f) != 0;
+  error = (*valp >= 32);
   return error;
 }
 
 static int
-Operand_ar4_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_AR_1_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
   return 0;
 }
 
 static int
-Operand_ar4_encode (uint32 *valp)
+OperandSem_opnd_sem_AR_1_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~0x1f) != 0;
+  error = (*valp >= 32);
   return error;
 }
 
 static int
-Operand_ar8_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_AR_2_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
   return 0;
 }
 
 static int
-Operand_ar8_encode (uint32 *valp)
+OperandSem_opnd_sem_AR_2_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~0x1f) != 0;
+  error = (*valp >= 32);
   return error;
 }
 
 static int
-Operand_ar12_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_AR_3_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
   return 0;
 }
 
 static int
-Operand_ar12_encode (uint32 *valp)
+OperandSem_opnd_sem_AR_3_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~0x1f) != 0;
+  error = (*valp >= 32);
   return error;
 }
 
 static int
-Operand_ars_entry_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_AR_4_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
   return 0;
 }
 
 static int
-Operand_ars_entry_encode (uint32 *valp)
+OperandSem_opnd_sem_AR_4_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~0x1f) != 0;
+  error = (*valp >= 32);
   return error;
 }
 
 static int
-Operand_immrx4_decode (uint32 *valp)
+OperandSem_opnd_sem_immrx4_decode (uint32 *valp)
 {
-  unsigned immrx4_0, r_0;
-  r_0 = *valp & 0xf;
-  immrx4_0 = (((0xfffffff) << 4) | r_0) << 2;
-  *valp = immrx4_0;
+  unsigned immrx4_out_0;
+  unsigned immrx4_in_0;
+  immrx4_in_0 = *valp & 0xf;
+  immrx4_out_0 = (((0xfffffff) << 4) | immrx4_in_0) << 2;
+  *valp = immrx4_out_0;
   return 0;
 }
 
 static int
-Operand_immrx4_encode (uint32 *valp)
+OperandSem_opnd_sem_immrx4_encode (uint32 *valp)
 {
-  unsigned r_0, immrx4_0;
-  immrx4_0 = *valp;
-  r_0 = ((immrx4_0 >> 2) & 0xf);
-  *valp = r_0;
+  unsigned immrx4_in_0;
+  unsigned immrx4_out_0;
+  immrx4_out_0 = *valp;
+  immrx4_in_0 = ((immrx4_out_0 >> 2) & 0xf);
+  *valp = immrx4_in_0;
   return 0;
 }
 
 static int
-Operand_lsi4x4_decode (uint32 *valp)
+OperandSem_opnd_sem_lsi4x4_decode (uint32 *valp)
 {
-  unsigned lsi4x4_0, r_0;
-  r_0 = *valp & 0xf;
-  lsi4x4_0 = r_0 << 2;
-  *valp = lsi4x4_0;
+  unsigned lsi4x4_out_0;
+  unsigned lsi4x4_in_0;
+  lsi4x4_in_0 = *valp & 0xf;
+  lsi4x4_out_0 = lsi4x4_in_0 << 2;
+  *valp = lsi4x4_out_0;
   return 0;
 }
 
 static int
-Operand_lsi4x4_encode (uint32 *valp)
+OperandSem_opnd_sem_lsi4x4_encode (uint32 *valp)
 {
-  unsigned r_0, lsi4x4_0;
-  lsi4x4_0 = *valp;
-  r_0 = ((lsi4x4_0 >> 2) & 0xf);
-  *valp = r_0;
+  unsigned lsi4x4_in_0;
+  unsigned lsi4x4_out_0;
+  lsi4x4_out_0 = *valp;
+  lsi4x4_in_0 = ((lsi4x4_out_0 >> 2) & 0xf);
+  *valp = lsi4x4_in_0;
   return 0;
 }
 
 static int
-Operand_simm7_decode (uint32 *valp)
+OperandSem_opnd_sem_simm7_decode (uint32 *valp)
 {
-  unsigned simm7_0, imm7_0;
-  imm7_0 = *valp & 0x7f;
-  simm7_0 = ((((-((((imm7_0 >> 6) & 1)) & (((imm7_0 >> 5) & 1)))) & 0x1ffffff)) << 7) | imm7_0;
-  *valp = simm7_0;
+  unsigned simm7_out_0;
+  unsigned simm7_in_0;
+  simm7_in_0 = *valp & 0x7f;
+  simm7_out_0 = ((((-((((simm7_in_0 >> 6) & 1)) & (((simm7_in_0 >> 5) & 1)))) & 0x1ffffff)) << 7) | simm7_in_0;
+  *valp = simm7_out_0;
   return 0;
 }
 
 static int
-Operand_simm7_encode (uint32 *valp)
+OperandSem_opnd_sem_simm7_encode (uint32 *valp)
 {
-  unsigned imm7_0, simm7_0;
-  simm7_0 = *valp;
-  imm7_0 = (simm7_0 & 0x7f);
-  *valp = imm7_0;
+  unsigned simm7_in_0;
+  unsigned simm7_out_0;
+  simm7_out_0 = *valp;
+  simm7_in_0 = (simm7_out_0 & 0x7f);
+  *valp = simm7_in_0;
   return 0;
 }
 
 static int
-Operand_uimm6_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm6_decode (uint32 *valp)
 {
-  unsigned uimm6_0, imm6_0;
-  imm6_0 = *valp & 0x3f;
-  uimm6_0 = 0x4 + (((0) << 6) | imm6_0);
-  *valp = uimm6_0;
+  unsigned uimm6_out_0;
+  unsigned uimm6_in_0;
+  uimm6_in_0 = *valp & 0x3f;
+  uimm6_out_0 = 0x4 + (((0) << 6) | uimm6_in_0);
+  *valp = uimm6_out_0;
   return 0;
 }
 
 static int
-Operand_uimm6_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm6_encode (uint32 *valp)
 {
-  unsigned imm6_0, uimm6_0;
-  uimm6_0 = *valp;
-  imm6_0 = (uimm6_0 - 0x4) & 0x3f;
-  *valp = imm6_0;
+  unsigned uimm6_in_0;
+  unsigned uimm6_out_0;
+  uimm6_out_0 = *valp;
+  uimm6_in_0 = (uimm6_out_0 - 0x4) & 0x3f;
+  *valp = uimm6_in_0;
   return 0;
 }
 
 static int
-Operand_uimm6_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ai4const_decode (uint32 *valp)
 {
-  *valp -= pc;
+  unsigned ai4const_out_0;
+  unsigned ai4const_in_0;
+  ai4const_in_0 = *valp & 0xf;
+  ai4const_out_0 = CONST_TBL_ai4c_0[ai4const_in_0 & 0xf];
+  *valp = ai4const_out_0;
   return 0;
 }
 
 static int
-Operand_uimm6_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ai4const_encode (uint32 *valp)
 {
-  *valp += pc;
-  return 0;
-}
-
-static int
-Operand_ai4const_decode (uint32 *valp)
-{
-  unsigned ai4const_0, t_0;
-  t_0 = *valp & 0xf;
-  ai4const_0 = CONST_TBL_ai4c_0[t_0 & 0xf];
-  *valp = ai4const_0;
-  return 0;
-}
-
-static int
-Operand_ai4const_encode (uint32 *valp)
-{
-  unsigned t_0, ai4const_0;
-  ai4const_0 = *valp;
-  switch (ai4const_0)
+  unsigned ai4const_in_0;
+  unsigned ai4const_out_0;
+  ai4const_out_0 = *valp;
+  switch (ai4const_out_0)
     {
-    case 0xffffffff: t_0 = 0; break;
-    case 0x1: t_0 = 0x1; break;
-    case 0x2: t_0 = 0x2; break;
-    case 0x3: t_0 = 0x3; break;
-    case 0x4: t_0 = 0x4; break;
-    case 0x5: t_0 = 0x5; break;
-    case 0x6: t_0 = 0x6; break;
-    case 0x7: t_0 = 0x7; break;
-    case 0x8: t_0 = 0x8; break;
-    case 0x9: t_0 = 0x9; break;
-    case 0xa: t_0 = 0xa; break;
-    case 0xb: t_0 = 0xb; break;
-    case 0xc: t_0 = 0xc; break;
-    case 0xd: t_0 = 0xd; break;
-    case 0xe: t_0 = 0xe; break;
-    default: t_0 = 0xf; break;
+    case 0xffffffff: ai4const_in_0 = 0; break;
+    case 0x1: ai4const_in_0 = 0x1; break;
+    case 0x2: ai4const_in_0 = 0x2; break;
+    case 0x3: ai4const_in_0 = 0x3; break;
+    case 0x4: ai4const_in_0 = 0x4; break;
+    case 0x5: ai4const_in_0 = 0x5; break;
+    case 0x6: ai4const_in_0 = 0x6; break;
+    case 0x7: ai4const_in_0 = 0x7; break;
+    case 0x8: ai4const_in_0 = 0x8; break;
+    case 0x9: ai4const_in_0 = 0x9; break;
+    case 0xa: ai4const_in_0 = 0xa; break;
+    case 0xb: ai4const_in_0 = 0xb; break;
+    case 0xc: ai4const_in_0 = 0xc; break;
+    case 0xd: ai4const_in_0 = 0xd; break;
+    case 0xe: ai4const_in_0 = 0xe; break;
+    default: ai4const_in_0 = 0xf; break;
     }
-  *valp = t_0;
+  *valp = ai4const_in_0;
   return 0;
 }
 
 static int
-Operand_b4const_decode (uint32 *valp)
+OperandSem_opnd_sem_b4const_decode (uint32 *valp)
 {
-  unsigned b4const_0, r_0;
-  r_0 = *valp & 0xf;
-  b4const_0 = CONST_TBL_b4c_0[r_0 & 0xf];
-  *valp = b4const_0;
+  unsigned b4const_out_0;
+  unsigned b4const_in_0;
+  b4const_in_0 = *valp & 0xf;
+  b4const_out_0 = CONST_TBL_b4c_0[b4const_in_0 & 0xf];
+  *valp = b4const_out_0;
   return 0;
 }
 
 static int
-Operand_b4const_encode (uint32 *valp)
+OperandSem_opnd_sem_b4const_encode (uint32 *valp)
 {
-  unsigned r_0, b4const_0;
-  b4const_0 = *valp;
-  switch (b4const_0)
+  unsigned b4const_in_0;
+  unsigned b4const_out_0;
+  b4const_out_0 = *valp;
+  switch (b4const_out_0)
     {
-    case 0xffffffff: r_0 = 0; break;
-    case 0x1: r_0 = 0x1; break;
-    case 0x2: r_0 = 0x2; break;
-    case 0x3: r_0 = 0x3; break;
-    case 0x4: r_0 = 0x4; break;
-    case 0x5: r_0 = 0x5; break;
-    case 0x6: r_0 = 0x6; break;
-    case 0x7: r_0 = 0x7; break;
-    case 0x8: r_0 = 0x8; break;
-    case 0xa: r_0 = 0x9; break;
-    case 0xc: r_0 = 0xa; break;
-    case 0x10: r_0 = 0xb; break;
-    case 0x20: r_0 = 0xc; break;
-    case 0x40: r_0 = 0xd; break;
-    case 0x80: r_0 = 0xe; break;
-    default: r_0 = 0xf; break;
+    case 0xffffffff: b4const_in_0 = 0; break;
+    case 0x1: b4const_in_0 = 0x1; break;
+    case 0x2: b4const_in_0 = 0x2; break;
+    case 0x3: b4const_in_0 = 0x3; break;
+    case 0x4: b4const_in_0 = 0x4; break;
+    case 0x5: b4const_in_0 = 0x5; break;
+    case 0x6: b4const_in_0 = 0x6; break;
+    case 0x7: b4const_in_0 = 0x7; break;
+    case 0x8: b4const_in_0 = 0x8; break;
+    case 0xa: b4const_in_0 = 0x9; break;
+    case 0xc: b4const_in_0 = 0xa; break;
+    case 0x10: b4const_in_0 = 0xb; break;
+    case 0x20: b4const_in_0 = 0xc; break;
+    case 0x40: b4const_in_0 = 0xd; break;
+    case 0x80: b4const_in_0 = 0xe; break;
+    default: b4const_in_0 = 0xf; break;
     }
-  *valp = r_0;
+  *valp = b4const_in_0;
   return 0;
 }
 
 static int
-Operand_b4constu_decode (uint32 *valp)
+OperandSem_opnd_sem_b4constu_decode (uint32 *valp)
 {
-  unsigned b4constu_0, r_0;
-  r_0 = *valp & 0xf;
-  b4constu_0 = CONST_TBL_b4cu_0[r_0 & 0xf];
-  *valp = b4constu_0;
+  unsigned b4constu_out_0;
+  unsigned b4constu_in_0;
+  b4constu_in_0 = *valp & 0xf;
+  b4constu_out_0 = CONST_TBL_b4cu_0[b4constu_in_0 & 0xf];
+  *valp = b4constu_out_0;
   return 0;
 }
 
 static int
-Operand_b4constu_encode (uint32 *valp)
+OperandSem_opnd_sem_b4constu_encode (uint32 *valp)
 {
-  unsigned r_0, b4constu_0;
-  b4constu_0 = *valp;
-  switch (b4constu_0)
+  unsigned b4constu_in_0;
+  unsigned b4constu_out_0;
+  b4constu_out_0 = *valp;
+  switch (b4constu_out_0)
     {
-    case 0x8000: r_0 = 0; break;
-    case 0x10000: r_0 = 0x1; break;
-    case 0x2: r_0 = 0x2; break;
-    case 0x3: r_0 = 0x3; break;
-    case 0x4: r_0 = 0x4; break;
-    case 0x5: r_0 = 0x5; break;
-    case 0x6: r_0 = 0x6; break;
-    case 0x7: r_0 = 0x7; break;
-    case 0x8: r_0 = 0x8; break;
-    case 0xa: r_0 = 0x9; break;
-    case 0xc: r_0 = 0xa; break;
-    case 0x10: r_0 = 0xb; break;
-    case 0x20: r_0 = 0xc; break;
-    case 0x40: r_0 = 0xd; break;
-    case 0x80: r_0 = 0xe; break;
-    default: r_0 = 0xf; break;
+    case 0x8000: b4constu_in_0 = 0; break;
+    case 0x10000: b4constu_in_0 = 0x1; break;
+    case 0x2: b4constu_in_0 = 0x2; break;
+    case 0x3: b4constu_in_0 = 0x3; break;
+    case 0x4: b4constu_in_0 = 0x4; break;
+    case 0x5: b4constu_in_0 = 0x5; break;
+    case 0x6: b4constu_in_0 = 0x6; break;
+    case 0x7: b4constu_in_0 = 0x7; break;
+    case 0x8: b4constu_in_0 = 0x8; break;
+    case 0xa: b4constu_in_0 = 0x9; break;
+    case 0xc: b4constu_in_0 = 0xa; break;
+    case 0x10: b4constu_in_0 = 0xb; break;
+    case 0x20: b4constu_in_0 = 0xc; break;
+    case 0x40: b4constu_in_0 = 0xd; break;
+    case 0x80: b4constu_in_0 = 0xe; break;
+    default: b4constu_in_0 = 0xf; break;
     }
-  *valp = r_0;
-  return 0;
-}
-
-static int
-Operand_uimm8_decode (uint32 *valp)
-{
-  unsigned uimm8_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  uimm8_0 = imm8_0;
-  *valp = uimm8_0;
-  return 0;
-}
-
-static int
-Operand_uimm8_encode (uint32 *valp)
-{
-  unsigned imm8_0, uimm8_0;
-  uimm8_0 = *valp;
-  imm8_0 = (uimm8_0 & 0xff);
-  *valp = imm8_0;
+  *valp = b4constu_in_0;
   return 0;
 }
 
 static int
-Operand_uimm8x2_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm8_decode (uint32 *valp)
 {
-  unsigned uimm8x2_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  uimm8x2_0 = imm8_0 << 1;
-  *valp = uimm8x2_0;
+  unsigned uimm8_out_0;
+  unsigned uimm8_in_0;
+  uimm8_in_0 = *valp & 0xff;
+  uimm8_out_0 = uimm8_in_0;
+  *valp = uimm8_out_0;
   return 0;
 }
 
 static int
-Operand_uimm8x2_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm8_encode (uint32 *valp)
 {
-  unsigned imm8_0, uimm8x2_0;
-  uimm8x2_0 = *valp;
-  imm8_0 = ((uimm8x2_0 >> 1) & 0xff);
-  *valp = imm8_0;
+  unsigned uimm8_in_0;
+  unsigned uimm8_out_0;
+  uimm8_out_0 = *valp;
+  uimm8_in_0 = (uimm8_out_0 & 0xff);
+  *valp = uimm8_in_0;
   return 0;
 }
 
 static int
-Operand_uimm8x4_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm8x2_decode (uint32 *valp)
 {
-  unsigned uimm8x4_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  uimm8x4_0 = imm8_0 << 2;
-  *valp = uimm8x4_0;
+  unsigned uimm8x2_out_0;
+  unsigned uimm8x2_in_0;
+  uimm8x2_in_0 = *valp & 0xff;
+  uimm8x2_out_0 = uimm8x2_in_0 << 1;
+  *valp = uimm8x2_out_0;
   return 0;
 }
 
 static int
-Operand_uimm8x4_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm8x2_encode (uint32 *valp)
 {
-  unsigned imm8_0, uimm8x4_0;
-  uimm8x4_0 = *valp;
-  imm8_0 = ((uimm8x4_0 >> 2) & 0xff);
-  *valp = imm8_0;
+  unsigned uimm8x2_in_0;
+  unsigned uimm8x2_out_0;
+  uimm8x2_out_0 = *valp;
+  uimm8x2_in_0 = ((uimm8x2_out_0 >> 1) & 0xff);
+  *valp = uimm8x2_in_0;
   return 0;
 }
 
 static int
-Operand_uimm4x16_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm8x4_decode (uint32 *valp)
 {
-  unsigned uimm4x16_0, op2_0;
-  op2_0 = *valp & 0xf;
-  uimm4x16_0 = op2_0 << 4;
-  *valp = uimm4x16_0;
+  unsigned uimm8x4_out_0;
+  unsigned uimm8x4_in_0;
+  uimm8x4_in_0 = *valp & 0xff;
+  uimm8x4_out_0 = uimm8x4_in_0 << 2;
+  *valp = uimm8x4_out_0;
   return 0;
 }
 
 static int
-Operand_uimm4x16_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm8x4_encode (uint32 *valp)
 {
-  unsigned op2_0, uimm4x16_0;
-  uimm4x16_0 = *valp;
-  op2_0 = ((uimm4x16_0 >> 4) & 0xf);
-  *valp = op2_0;
+  unsigned uimm8x4_in_0;
+  unsigned uimm8x4_out_0;
+  uimm8x4_out_0 = *valp;
+  uimm8x4_in_0 = ((uimm8x4_out_0 >> 2) & 0xff);
+  *valp = uimm8x4_in_0;
   return 0;
 }
 
 static int
-Operand_simm8_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm4x16_decode (uint32 *valp)
 {
-  unsigned simm8_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  simm8_0 = ((int) imm8_0 << 24) >> 24;
-  *valp = simm8_0;
+  unsigned uimm4x16_out_0;
+  unsigned uimm4x16_in_0;
+  uimm4x16_in_0 = *valp & 0xf;
+  uimm4x16_out_0 = uimm4x16_in_0 << 4;
+  *valp = uimm4x16_out_0;
   return 0;
 }
 
 static int
-Operand_simm8_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm4x16_encode (uint32 *valp)
 {
-  unsigned imm8_0, simm8_0;
-  simm8_0 = *valp;
-  imm8_0 = (simm8_0 & 0xff);
-  *valp = imm8_0;
+  unsigned uimm4x16_in_0;
+  unsigned uimm4x16_out_0;
+  uimm4x16_out_0 = *valp;
+  uimm4x16_in_0 = ((uimm4x16_out_0 >> 4) & 0xf);
+  *valp = uimm4x16_in_0;
   return 0;
 }
 
 static int
-Operand_simm8x256_decode (uint32 *valp)
+OperandSem_opnd_sem_simm8_decode (uint32 *valp)
 {
-  unsigned simm8x256_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  simm8x256_0 = (((int) imm8_0 << 24) >> 24) << 8;
-  *valp = simm8x256_0;
+  unsigned simm8_out_0;
+  unsigned simm8_in_0;
+  simm8_in_0 = *valp & 0xff;
+  simm8_out_0 = ((int) simm8_in_0 << 24) >> 24;
+  *valp = simm8_out_0;
   return 0;
 }
 
 static int
-Operand_simm8x256_encode (uint32 *valp)
-{
-  unsigned imm8_0, simm8x256_0;
-  simm8x256_0 = *valp;
-  imm8_0 = ((simm8x256_0 >> 8) & 0xff);
-  *valp = imm8_0;
-  return 0;
-}
-
-static int
-Operand_simm12b_decode (uint32 *valp)
-{
-  unsigned simm12b_0, imm12b_0;
-  imm12b_0 = *valp & 0xfff;
-  simm12b_0 = ((int) imm12b_0 << 20) >> 20;
-  *valp = simm12b_0;
-  return 0;
-}
-
-static int
-Operand_simm12b_encode (uint32 *valp)
-{
-  unsigned imm12b_0, simm12b_0;
-  simm12b_0 = *valp;
-  imm12b_0 = (simm12b_0 & 0xfff);
-  *valp = imm12b_0;
-  return 0;
-}
-
-static int
-Operand_msalp32_decode (uint32 *valp)
-{
-  unsigned msalp32_0, sal_0;
-  sal_0 = *valp & 0x1f;
-  msalp32_0 = 0x20 - sal_0;
-  *valp = msalp32_0;
-  return 0;
-}
-
-static int
-Operand_msalp32_encode (uint32 *valp)
-{
-  unsigned sal_0, msalp32_0;
-  msalp32_0 = *valp;
-  sal_0 = (0x20 - msalp32_0) & 0x1f;
-  *valp = sal_0;
-  return 0;
-}
-
-static int
-Operand_op2p1_decode (uint32 *valp)
-{
-  unsigned op2p1_0, op2_0;
-  op2_0 = *valp & 0xf;
-  op2p1_0 = op2_0 + 0x1;
-  *valp = op2p1_0;
-  return 0;
-}
-
-static int
-Operand_op2p1_encode (uint32 *valp)
-{
-  unsigned op2_0, op2p1_0;
-  op2p1_0 = *valp;
-  op2_0 = (op2p1_0 - 0x1) & 0xf;
-  *valp = op2_0;
-  return 0;
-}
-
-static int
-Operand_label8_decode (uint32 *valp)
-{
-  unsigned label8_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  label8_0 = 0x4 + (((int) imm8_0 << 24) >> 24);
-  *valp = label8_0;
-  return 0;
-}
-
-static int
-Operand_label8_encode (uint32 *valp)
-{
-  unsigned imm8_0, label8_0;
-  label8_0 = *valp;
-  imm8_0 = (label8_0 - 0x4) & 0xff;
-  *valp = imm8_0;
-  return 0;
-}
-
-static int
-Operand_label8_ator (uint32 *valp, uint32 pc)
-{
-  *valp -= pc;
-  return 0;
-}
-
-static int
-Operand_label8_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_simm8_encode (uint32 *valp)
 {
-  *valp += pc;
+  unsigned simm8_in_0;
+  unsigned simm8_out_0;
+  simm8_out_0 = *valp;
+  simm8_in_0 = (simm8_out_0 & 0xff);
+  *valp = simm8_in_0;
   return 0;
 }
 
 static int
-Operand_ulabel8_decode (uint32 *valp)
+OperandSem_opnd_sem_simm8x256_decode (uint32 *valp)
 {
-  unsigned ulabel8_0, imm8_0;
-  imm8_0 = *valp & 0xff;
-  ulabel8_0 = 0x4 + (((0) << 8) | imm8_0);
-  *valp = ulabel8_0;
+  unsigned simm8x256_out_0;
+  unsigned simm8x256_in_0;
+  simm8x256_in_0 = *valp & 0xff;
+  simm8x256_out_0 = (((int) simm8x256_in_0 << 24) >> 24) << 8;
+  *valp = simm8x256_out_0;
   return 0;
 }
 
 static int
-Operand_ulabel8_encode (uint32 *valp)
+OperandSem_opnd_sem_simm8x256_encode (uint32 *valp)
 {
-  unsigned imm8_0, ulabel8_0;
-  ulabel8_0 = *valp;
-  imm8_0 = (ulabel8_0 - 0x4) & 0xff;
-  *valp = imm8_0;
+  unsigned simm8x256_in_0;
+  unsigned simm8x256_out_0;
+  simm8x256_out_0 = *valp;
+  simm8x256_in_0 = ((simm8x256_out_0 >> 8) & 0xff);
+  *valp = simm8x256_in_0;
   return 0;
 }
 
 static int
-Operand_ulabel8_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_simm12b_decode (uint32 *valp)
 {
-  *valp -= pc;
+  unsigned simm12b_out_0;
+  unsigned simm12b_in_0;
+  simm12b_in_0 = *valp & 0xfff;
+  simm12b_out_0 = ((int) simm12b_in_0 << 20) >> 20;
+  *valp = simm12b_out_0;
   return 0;
 }
 
 static int
-Operand_ulabel8_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_simm12b_encode (uint32 *valp)
 {
-  *valp += pc;
+  unsigned simm12b_in_0;
+  unsigned simm12b_out_0;
+  simm12b_out_0 = *valp;
+  simm12b_in_0 = (simm12b_out_0 & 0xfff);
+  *valp = simm12b_in_0;
   return 0;
 }
 
 static int
-Operand_label12_decode (uint32 *valp)
+OperandSem_opnd_sem_msalp32_decode (uint32 *valp)
 {
-  unsigned label12_0, imm12_0;
-  imm12_0 = *valp & 0xfff;
-  label12_0 = 0x4 + (((int) imm12_0 << 20) >> 20);
-  *valp = label12_0;
+  unsigned msalp32_out_0;
+  unsigned msalp32_in_0;
+  msalp32_in_0 = *valp & 0x1f;
+  msalp32_out_0 = 0x20 - msalp32_in_0;
+  *valp = msalp32_out_0;
   return 0;
 }
 
 static int
-Operand_label12_encode (uint32 *valp)
+OperandSem_opnd_sem_msalp32_encode (uint32 *valp)
 {
-  unsigned imm12_0, label12_0;
-  label12_0 = *valp;
-  imm12_0 = (label12_0 - 0x4) & 0xfff;
-  *valp = imm12_0;
+  unsigned msalp32_in_0;
+  unsigned msalp32_out_0;
+  msalp32_out_0 = *valp;
+  msalp32_in_0 = (0x20 - msalp32_out_0) & 0x1f;
+  *valp = msalp32_in_0;
   return 0;
 }
 
 static int
-Operand_label12_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_op2p1_decode (uint32 *valp)
 {
-  *valp -= pc;
+  unsigned op2p1_out_0;
+  unsigned op2p1_in_0;
+  op2p1_in_0 = *valp & 0xf;
+  op2p1_out_0 = op2p1_in_0 + 0x1;
+  *valp = op2p1_out_0;
   return 0;
 }
 
 static int
-Operand_label12_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_op2p1_encode (uint32 *valp)
 {
-  *valp += pc;
+  unsigned op2p1_in_0;
+  unsigned op2p1_out_0;
+  op2p1_out_0 = *valp;
+  op2p1_in_0 = (op2p1_out_0 - 0x1) & 0xf;
+  *valp = op2p1_in_0;
   return 0;
 }
 
 static int
-Operand_soffset_decode (uint32 *valp)
+OperandSem_opnd_sem_label8_decode (uint32 *valp)
 {
-  unsigned soffset_0, offset_0;
-  offset_0 = *valp & 0x3ffff;
-  soffset_0 = 0x4 + (((int) offset_0 << 14) >> 14);
-  *valp = soffset_0;
+  unsigned label8_out_0;
+  unsigned label8_in_0;
+  label8_in_0 = *valp & 0xff;
+  label8_out_0 = 0x4 + (((int) label8_in_0 << 24) >> 24);
+  *valp = label8_out_0;
   return 0;
 }
 
 static int
-Operand_soffset_encode (uint32 *valp)
+OperandSem_opnd_sem_label8_encode (uint32 *valp)
 {
-  unsigned offset_0, soffset_0;
-  soffset_0 = *valp;
-  offset_0 = (soffset_0 - 0x4) & 0x3ffff;
-  *valp = offset_0;
+  unsigned label8_in_0;
+  unsigned label8_out_0;
+  label8_out_0 = *valp;
+  label8_in_0 = (label8_out_0 - 0x4) & 0xff;
+  *valp = label8_in_0;
   return 0;
 }
 
 static int
-Operand_soffset_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ulabel8_decode (uint32 *valp)
 {
-  *valp -= pc;
+  unsigned ulabel8_out_0;
+  unsigned ulabel8_in_0;
+  ulabel8_in_0 = *valp & 0xff;
+  ulabel8_out_0 = 0x4 + (((0) << 8) | ulabel8_in_0);
+  *valp = ulabel8_out_0;
   return 0;
 }
 
 static int
-Operand_soffset_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ulabel8_encode (uint32 *valp)
 {
-  *valp += pc;
+  unsigned ulabel8_in_0;
+  unsigned ulabel8_out_0;
+  ulabel8_out_0 = *valp;
+  ulabel8_in_0 = (ulabel8_out_0 - 0x4) & 0xff;
+  *valp = ulabel8_in_0;
   return 0;
 }
 
 static int
-Operand_uimm16x4_decode (uint32 *valp)
+OperandSem_opnd_sem_label12_decode (uint32 *valp)
 {
-  unsigned uimm16x4_0, imm16_0;
-  imm16_0 = *valp & 0xffff;
-  uimm16x4_0 = (((0xffff) << 16) | imm16_0) << 2;
-  *valp = uimm16x4_0;
+  unsigned label12_out_0;
+  unsigned label12_in_0;
+  label12_in_0 = *valp & 0xfff;
+  label12_out_0 = 0x4 + (((int) label12_in_0 << 20) >> 20);
+  *valp = label12_out_0;
   return 0;
 }
 
 static int
-Operand_uimm16x4_encode (uint32 *valp)
+OperandSem_opnd_sem_label12_encode (uint32 *valp)
 {
-  unsigned imm16_0, uimm16x4_0;
-  uimm16x4_0 = *valp;
-  imm16_0 = (uimm16x4_0 >> 2) & 0xffff;
-  *valp = imm16_0;
+  unsigned label12_in_0;
+  unsigned label12_out_0;
+  label12_out_0 = *valp;
+  label12_in_0 = (label12_out_0 - 0x4) & 0xfff;
+  *valp = label12_in_0;
   return 0;
 }
 
 static int
-Operand_uimm16x4_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_soffset_decode (uint32 *valp)
 {
-  *valp -= ((pc + 3) & ~0x3);
+  unsigned soffset_out_0;
+  unsigned soffset_in_0;
+  soffset_in_0 = *valp & 0x3ffff;
+  soffset_out_0 = 0x4 + (((int) soffset_in_0 << 14) >> 14);
+  *valp = soffset_out_0;
   return 0;
 }
 
 static int
-Operand_uimm16x4_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_soffset_encode (uint32 *valp)
 {
-  *valp += ((pc + 3) & ~0x3);
+  unsigned soffset_in_0;
+  unsigned soffset_out_0;
+  soffset_out_0 = *valp;
+  soffset_in_0 = (soffset_out_0 - 0x4) & 0x3ffff;
+  *valp = soffset_in_0;
   return 0;
 }
 
 static int
-Operand_immt_decode (uint32 *valp)
+OperandSem_opnd_sem_uimm16x4_decode (uint32 *valp)
 {
-  unsigned immt_0, t_0;
-  t_0 = *valp & 0xf;
-  immt_0 = t_0;
-  *valp = immt_0;
+  unsigned uimm16x4_out_0;
+  unsigned uimm16x4_in_0;
+  uimm16x4_in_0 = *valp & 0xffff;
+  uimm16x4_out_0 = (((0xffff) << 16) | uimm16x4_in_0) << 2;
+  *valp = uimm16x4_out_0;
   return 0;
 }
 
 static int
-Operand_immt_encode (uint32 *valp)
+OperandSem_opnd_sem_uimm16x4_encode (uint32 *valp)
 {
-  unsigned t_0, immt_0;
-  immt_0 = *valp;
-  t_0 = immt_0 & 0xf;
-  *valp = t_0;
+  unsigned uimm16x4_in_0;
+  unsigned uimm16x4_out_0;
+  uimm16x4_out_0 = *valp;
+  uimm16x4_in_0 = (uimm16x4_out_0 >> 2) & 0xffff;
+  *valp = uimm16x4_in_0;
   return 0;
 }
 
 static int
-Operand_imms_decode (uint32 *valp)
+OperandSem_opnd_sem_bbi_decode (uint32 *valp)
 {
-  unsigned imms_0, s_0;
-  s_0 = *valp & 0xf;
-  imms_0 = s_0;
-  *valp = imms_0;
+  unsigned bbi_out_0;
+  unsigned bbi_in_0;
+  bbi_in_0 = *valp & 0x1f;
+  bbi_out_0 = (0 << 5) | bbi_in_0;
+  *valp = bbi_out_0;
   return 0;
 }
 
 static int
-Operand_imms_encode (uint32 *valp)
+OperandSem_opnd_sem_bbi_encode (uint32 *valp)
 {
-  unsigned s_0, imms_0;
-  imms_0 = *valp;
-  s_0 = imms_0 & 0xf;
-  *valp = s_0;
+  unsigned bbi_in_0;
+  unsigned bbi_out_0;
+  bbi_out_0 = *valp;
+  bbi_in_0 = (bbi_out_0 & 0x1f);
+  *valp = bbi_in_0;
   return 0;
 }
 
 static int
-Operand_bt_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_s_decode (uint32 *valp)
 {
+  unsigned s_out_0;
+  unsigned s_in_0;
+  s_in_0 = *valp & 0xf;
+  s_out_0 = (0 << 4) | s_in_0;
+  *valp = s_out_0;
   return 0;
 }
 
 static int
-Operand_bt_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0xf) != 0;
-  return error;
-}
-
-static int
-Operand_bs_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_s_encode (uint32 *valp)
 {
+  unsigned s_in_0;
+  unsigned s_out_0;
+  s_out_0 = *valp;
+  s_in_0 = (s_out_0 & 0xf);
+  *valp = s_in_0;
   return 0;
 }
 
 static int
-Operand_bs_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0xf) != 0;
-  return error;
-}
-
-static int
-Operand_br_decode (uint32 *valp ATTRIBUTE_UNUSED)
+OperandSem_opnd_sem_immt_decode (uint32 *valp)
 {
+  unsigned immt_out_0;
+  unsigned immt_in_0;
+  immt_in_0 = *valp & 0xf;
+  immt_out_0 = immt_in_0;
+  *valp = immt_out_0;
   return 0;
 }
 
 static int
-Operand_br_encode (uint32 *valp)
+OperandSem_opnd_sem_immt_encode (uint32 *valp)
 {
-  int error;
-  error = (*valp & ~0xf) != 0;
-  return error;
-}
-
-static int
-Operand_bt2_decode (uint32 *valp)
-{
-  *valp = *valp << 1;
+  unsigned immt_in_0;
+  unsigned immt_out_0;
+  immt_out_0 = *valp;
+  immt_in_0 = immt_out_0 & 0xf;
+  *valp = immt_in_0;
   return 0;
 }
 
 static int
-Operand_bt2_encode (uint32 *valp)
+OperandSem_opnd_sem_BR_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
-  int error;
-  error = (*valp & ~(0x7 << 1)) != 0;
-  *valp = *valp >> 1;
-  return error;
-}
-
-static int
-Operand_bs2_decode (uint32 *valp)
-{
-  *valp = *valp << 1;
   return 0;
 }
 
 static int
-Operand_bs2_encode (uint32 *valp)
+OperandSem_opnd_sem_BR_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0x7 << 1)) != 0;
-  *valp = *valp >> 1;
+  error = (*valp >= 16);
   return error;
 }
 
 static int
-Operand_br2_decode (uint32 *valp)
+OperandSem_opnd_sem_BR2_decode (uint32 *valp)
 {
   *valp = *valp << 1;
   return 0;
 }
 
 static int
-Operand_br2_encode (uint32 *valp)
+OperandSem_opnd_sem_BR2_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0x7 << 1)) != 0;
+  error = (*valp >= 16) || ((*valp & 1) != 0);
   *valp = *valp >> 1;
   return error;
 }
 
 static int
-Operand_bt4_decode (uint32 *valp)
-{
-  *valp = *valp << 2;
-  return 0;
-}
-
-static int
-Operand_bt4_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~(0x3 << 2)) != 0;
-  *valp = *valp >> 2;
-  return error;
-}
-
-static int
-Operand_bs4_decode (uint32 *valp)
-{
-  *valp = *valp << 2;
-  return 0;
-}
-
-static int
-Operand_bs4_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~(0x3 << 2)) != 0;
-  *valp = *valp >> 2;
-  return error;
-}
-
-static int
-Operand_br4_decode (uint32 *valp)
+OperandSem_opnd_sem_BR4_decode (uint32 *valp)
 {
   *valp = *valp << 2;
   return 0;
 }
 
 static int
-Operand_br4_encode (uint32 *valp)
+OperandSem_opnd_sem_BR4_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0x3 << 2)) != 0;
+  error = (*valp >= 16) || ((*valp & 3) != 0);
   *valp = *valp >> 2;
   return error;
 }
 
 static int
-Operand_bt8_decode (uint32 *valp)
+OperandSem_opnd_sem_BR8_decode (uint32 *valp)
 {
   *valp = *valp << 3;
   return 0;
 }
 
 static int
-Operand_bt8_encode (uint32 *valp)
+OperandSem_opnd_sem_BR8_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0x1 << 3)) != 0;
+  error = (*valp >= 16) || ((*valp & 7) != 0);
   *valp = *valp >> 3;
   return error;
 }
 
 static int
-Operand_bs8_decode (uint32 *valp)
+OperandSem_opnd_sem_BR16_decode (uint32 *valp)
 {
-  *valp = *valp << 3;
+  *valp = *valp << 4;
   return 0;
 }
 
 static int
-Operand_bs8_encode (uint32 *valp)
+OperandSem_opnd_sem_BR16_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0x1 << 3)) != 0;
-  *valp = *valp >> 3;
+  error = (*valp >= 16) || ((*valp & 15) != 0);
+  *valp = *valp >> 4;
   return error;
 }
 
 static int
-Operand_br8_decode (uint32 *valp)
+OperandSem_opnd_sem_tp7_decode (uint32 *valp)
 {
-  *valp = *valp << 3;
+  unsigned tp7_out_0;
+  unsigned tp7_in_0;
+  tp7_in_0 = *valp & 0xf;
+  tp7_out_0 = tp7_in_0 + 0x7;
+  *valp = tp7_out_0;
   return 0;
 }
 
 static int
-Operand_br8_encode (uint32 *valp)
+OperandSem_opnd_sem_tp7_encode (uint32 *valp)
 {
-  int error;
-  error = (*valp & ~(0x1 << 3)) != 0;
-  *valp = *valp >> 3;
-  return error;
+  unsigned tp7_in_0;
+  unsigned tp7_out_0;
+  tp7_out_0 = *valp;
+  tp7_in_0 = (tp7_out_0 - 0x7) & 0xf;
+  *valp = tp7_in_0;
+  return 0;
 }
 
 static int
-Operand_bt16_decode (uint32 *valp)
+OperandSem_opnd_sem_xt_wbr15_label_decode (uint32 *valp)
 {
-  *valp = *valp << 4;
+  unsigned xt_wbr15_label_out_0;
+  unsigned xt_wbr15_label_in_0;
+  xt_wbr15_label_in_0 = *valp & 0x7fff;
+  xt_wbr15_label_out_0 = 0x4 + (((int) xt_wbr15_label_in_0 << 17) >> 17);
+  *valp = xt_wbr15_label_out_0;
   return 0;
 }
 
 static int
-Operand_bt16_encode (uint32 *valp)
+OperandSem_opnd_sem_xt_wbr15_label_encode (uint32 *valp)
 {
-  int error;
-  error = (*valp & ~(0 << 4)) != 0;
-  *valp = *valp >> 4;
-  return error;
+  unsigned xt_wbr15_label_in_0;
+  unsigned xt_wbr15_label_out_0;
+  xt_wbr15_label_out_0 = *valp;
+  xt_wbr15_label_in_0 = (xt_wbr15_label_out_0 - 0x4) & 0x7fff;
+  *valp = xt_wbr15_label_in_0;
+  return 0;
 }
 
 static int
-Operand_bs16_decode (uint32 *valp)
+OperandSem_opnd_sem_ae_samt32_decode (uint32 *valp)
 {
-  *valp = *valp << 4;
+  unsigned ae_samt32_out_0;
+  unsigned ae_samt32_in_0;
+  ae_samt32_in_0 = *valp & 0x1f;
+  ae_samt32_out_0 = (0 << 5) | ae_samt32_in_0;
+  *valp = ae_samt32_out_0;
   return 0;
 }
 
 static int
-Operand_bs16_encode (uint32 *valp)
+OperandSem_opnd_sem_ae_samt32_encode (uint32 *valp)
 {
-  int error;
-  error = (*valp & ~(0 << 4)) != 0;
-  *valp = *valp >> 4;
-  return error;
+  unsigned ae_samt32_in_0;
+  unsigned ae_samt32_out_0;
+  ae_samt32_out_0 = *valp;
+  ae_samt32_in_0 = (ae_samt32_out_0 & 0x1f);
+  *valp = ae_samt32_in_0;
+  return 0;
 }
 
 static int
-Operand_br16_decode (uint32 *valp)
+OperandSem_opnd_sem_AE_PR_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
-  *valp = *valp << 4;
   return 0;
 }
 
 static int
-Operand_br16_encode (uint32 *valp)
+OperandSem_opnd_sem_AE_PR_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0 << 4)) != 0;
-  *valp = *valp >> 4;
+  error = (*valp >= 8);
   return error;
 }
 
 static int
-Operand_brall_decode (uint32 *valp)
+OperandSem_opnd_sem_AE_QR_decode (uint32 *valp ATTRIBUTE_UNUSED)
 {
-  *valp = *valp << 4;
   return 0;
 }
 
 static int
-Operand_brall_encode (uint32 *valp)
+OperandSem_opnd_sem_AE_QR_encode (uint32 *valp)
 {
   int error;
-  error = (*valp & ~(0 << 4)) != 0;
-  *valp = *valp >> 4;
+  error = (*valp >= 4);
   return error;
 }
 
 static int
-Operand_tp7_decode (uint32 *valp)
+OperandSem_opnd_sem_ae_lsimm16_decode (uint32 *valp)
 {
-  unsigned tp7_0, t_0;
-  t_0 = *valp & 0xf;
-  tp7_0 = t_0 + 0x7;
-  *valp = tp7_0;
+  unsigned ae_lsimm16_out_0;
+  unsigned ae_lsimm16_in_0;
+  ae_lsimm16_in_0 = *valp & 0xf;
+  ae_lsimm16_out_0 = (((int) ae_lsimm16_in_0 << 28) >> 28) << 1;
+  *valp = ae_lsimm16_out_0;
   return 0;
 }
 
 static int
-Operand_tp7_encode (uint32 *valp)
+OperandSem_opnd_sem_ae_lsimm16_encode (uint32 *valp)
 {
-  unsigned t_0, tp7_0;
-  tp7_0 = *valp;
-  t_0 = (tp7_0 - 0x7) & 0xf;
-  *valp = t_0;
+  unsigned ae_lsimm16_in_0;
+  unsigned ae_lsimm16_out_0;
+  ae_lsimm16_out_0 = *valp;
+  ae_lsimm16_in_0 = ((ae_lsimm16_out_0 >> 1) & 0xf);
+  *valp = ae_lsimm16_in_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr15_label_decode (uint32 *valp)
+OperandSem_opnd_sem_ae_lsimm32_decode (uint32 *valp)
 {
-  unsigned xt_wbr15_label_0, xt_wbr15_imm_0;
-  xt_wbr15_imm_0 = *valp & 0x7fff;
-  xt_wbr15_label_0 = 0x4 + (((int) xt_wbr15_imm_0 << 17) >> 17);
-  *valp = xt_wbr15_label_0;
+  unsigned ae_lsimm32_out_0;
+  unsigned ae_lsimm32_in_0;
+  ae_lsimm32_in_0 = *valp & 0xf;
+  ae_lsimm32_out_0 = (((int) ae_lsimm32_in_0 << 28) >> 28) << 2;
+  *valp = ae_lsimm32_out_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr15_label_encode (uint32 *valp)
+OperandSem_opnd_sem_ae_lsimm32_encode (uint32 *valp)
 {
-  unsigned xt_wbr15_imm_0, xt_wbr15_label_0;
-  xt_wbr15_label_0 = *valp;
-  xt_wbr15_imm_0 = (xt_wbr15_label_0 - 0x4) & 0x7fff;
-  *valp = xt_wbr15_imm_0;
+  unsigned ae_lsimm32_in_0;
+  unsigned ae_lsimm32_out_0;
+  ae_lsimm32_out_0 = *valp;
+  ae_lsimm32_in_0 = ((ae_lsimm32_out_0 >> 2) & 0xf);
+  *valp = ae_lsimm32_in_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr15_label_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ae_lsimm64_decode (uint32 *valp)
 {
-  *valp -= pc;
+  unsigned ae_lsimm64_out_0;
+  unsigned ae_lsimm64_in_0;
+  ae_lsimm64_in_0 = *valp & 0xf;
+  ae_lsimm64_out_0 = (((int) ae_lsimm64_in_0 << 28) >> 28) << 3;
+  *valp = ae_lsimm64_out_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr15_label_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ae_lsimm64_encode (uint32 *valp)
 {
-  *valp += pc;
+  unsigned ae_lsimm64_in_0;
+  unsigned ae_lsimm64_out_0;
+  ae_lsimm64_out_0 = *valp;
+  ae_lsimm64_in_0 = ((ae_lsimm64_out_0 >> 3) & 0xf);
+  *valp = ae_lsimm64_in_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr18_label_decode (uint32 *valp)
+OperandSem_opnd_sem_ae_samt64_decode (uint32 *valp)
 {
-  unsigned xt_wbr18_label_0, xt_wbr18_imm_0;
-  xt_wbr18_imm_0 = *valp & 0x3ffff;
-  xt_wbr18_label_0 = 0x4 + (((int) xt_wbr18_imm_0 << 14) >> 14);
-  *valp = xt_wbr18_label_0;
+  unsigned ae_samt64_out_0;
+  unsigned ae_samt64_in_0;
+  ae_samt64_in_0 = *valp & 0x3f;
+  ae_samt64_out_0 = (0 << 6) | ae_samt64_in_0;
+  *valp = ae_samt64_out_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr18_label_encode (uint32 *valp)
+OperandSem_opnd_sem_ae_samt64_encode (uint32 *valp)
 {
-  unsigned xt_wbr18_imm_0, xt_wbr18_label_0;
-  xt_wbr18_label_0 = *valp;
-  xt_wbr18_imm_0 = (xt_wbr18_label_0 - 0x4) & 0x3ffff;
-  *valp = xt_wbr18_imm_0;
+  unsigned ae_samt64_in_0;
+  unsigned ae_samt64_out_0;
+  ae_samt64_out_0 = *valp;
+  ae_samt64_in_0 = (ae_samt64_out_0 & 0x3f);
+  *valp = ae_samt64_in_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr18_label_ator (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ae_ohba_decode (uint32 *valp)
 {
-  *valp -= pc;
+  unsigned ae_ohba_out_0;
+  unsigned ae_ohba_in_0;
+  ae_ohba_in_0 = *valp & 0xf;
+  ae_ohba_out_0 = (0 << 5) | (((((ae_ohba_in_0 & 0xf))) == 0) << 4) | ((ae_ohba_in_0 & 0xf));
+  *valp = ae_ohba_out_0;
   return 0;
 }
 
 static int
-Operand_xt_wbr18_label_rtoa (uint32 *valp, uint32 pc)
+OperandSem_opnd_sem_ae_ohba_encode (uint32 *valp)
 {
-  *valp += pc;
+  unsigned ae_ohba_in_0;
+  unsigned ae_ohba_out_0;
+  ae_ohba_out_0 = *valp;
+  ae_ohba_in_0 = (ae_ohba_out_0 & 0xf);
+  *valp = ae_ohba_in_0;
   return 0;
 }
 
 static int
-Operand_ae_samt32_decode (uint32 *valp)
+Operand_soffsetx4_ator (uint32 *valp, uint32 pc)
 {
-  unsigned ae_samt32_0, ftsf14_0;
-  ftsf14_0 = *valp & 0x1f;
-  ae_samt32_0 = (0 << 5) | ftsf14_0;
-  *valp = ae_samt32_0;
+  *valp -= (pc & ~0x3);
   return 0;
 }
 
 static int
-Operand_ae_samt32_encode (uint32 *valp)
+Operand_soffsetx4_rtoa (uint32 *valp, uint32 pc)
 {
-  unsigned ftsf14_0, ae_samt32_0;
-  ae_samt32_0 = *valp;
-  ftsf14_0 = (ae_samt32_0 & 0x1f);
-  *valp = ftsf14_0;
+  *valp += (pc & ~0x3);
   return 0;
 }
 
 static int
-Operand_pr0_decode (uint32 *valp ATTRIBUTE_UNUSED)
+Operand_uimm6_ator (uint32 *valp, uint32 pc)
 {
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_pr0_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0x7) != 0;
-  return error;
-}
-
-static int
-Operand_qr0_decode (uint32 *valp ATTRIBUTE_UNUSED)
+Operand_uimm6_rtoa (uint32 *valp, uint32 pc)
 {
+  *valp += pc;
   return 0;
 }
 
 static int
-Operand_qr0_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0x3) != 0;
-  return error;
-}
-
-static int
-Operand_ae_lsimm16_decode (uint32 *valp)
+Operand_label8_ator (uint32 *valp, uint32 pc)
 {
-  unsigned ae_lsimm16_0, t_0;
-  t_0 = *valp & 0xf;
-  ae_lsimm16_0 = (((int) t_0 << 28) >> 28) << 1;
-  *valp = ae_lsimm16_0;
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_ae_lsimm16_encode (uint32 *valp)
+Operand_label8_rtoa (uint32 *valp, uint32 pc)
 {
-  unsigned t_0, ae_lsimm16_0;
-  ae_lsimm16_0 = *valp;
-  t_0 = ((ae_lsimm16_0 >> 1) & 0xf);
-  *valp = t_0;
+  *valp += pc;
   return 0;
 }
 
 static int
-Operand_ae_lsimm32_decode (uint32 *valp)
+Operand_ulabel8_ator (uint32 *valp, uint32 pc)
 {
-  unsigned ae_lsimm32_0, t_0;
-  t_0 = *valp & 0xf;
-  ae_lsimm32_0 = (((int) t_0 << 28) >> 28) << 2;
-  *valp = ae_lsimm32_0;
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_ae_lsimm32_encode (uint32 *valp)
+Operand_ulabel8_rtoa (uint32 *valp, uint32 pc)
 {
-  unsigned t_0, ae_lsimm32_0;
-  ae_lsimm32_0 = *valp;
-  t_0 = ((ae_lsimm32_0 >> 2) & 0xf);
-  *valp = t_0;
+  *valp += pc;
   return 0;
 }
 
 static int
-Operand_ae_lsimm64_decode (uint32 *valp)
+Operand_label12_ator (uint32 *valp, uint32 pc)
 {
-  unsigned ae_lsimm64_0, t_0;
-  t_0 = *valp & 0xf;
-  ae_lsimm64_0 = (((int) t_0 << 28) >> 28) << 3;
-  *valp = ae_lsimm64_0;
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_ae_lsimm64_encode (uint32 *valp)
+Operand_label12_rtoa (uint32 *valp, uint32 pc)
 {
-  unsigned t_0, ae_lsimm64_0;
-  ae_lsimm64_0 = *valp;
-  t_0 = ((ae_lsimm64_0 >> 3) & 0xf);
-  *valp = t_0;
+  *valp += pc;
   return 0;
 }
 
 static int
-Operand_ae_samt64_decode (uint32 *valp)
+Operand_soffset_ator (uint32 *valp, uint32 pc)
 {
-  unsigned ae_samt64_0, ae_samt_s_t_0;
-  ae_samt_s_t_0 = *valp & 0x3f;
-  ae_samt64_0 = (0 << 6) | ae_samt_s_t_0;
-  *valp = ae_samt64_0;
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_ae_samt64_encode (uint32 *valp)
+Operand_soffset_rtoa (uint32 *valp, uint32 pc)
 {
-  unsigned ae_samt_s_t_0, ae_samt64_0;
-  ae_samt64_0 = *valp;
-  ae_samt_s_t_0 = (ae_samt64_0 & 0x3f);
-  *valp = ae_samt_s_t_0;
+  *valp += pc;
   return 0;
 }
 
 static int
-Operand_ae_ohba_decode (uint32 *valp)
+Operand_uimm16x4_ator (uint32 *valp, uint32 pc)
 {
-  unsigned ae_ohba_0, op1_0;
-  op1_0 = *valp & 0xf;
-  ae_ohba_0 = (0 << 5) | (((((op1_0 & 0xf))) == 0) << 4) | ((op1_0 & 0xf));
-  *valp = ae_ohba_0;
+  *valp -= ((pc + 3) & ~0x3);
   return 0;
 }
 
 static int
-Operand_ae_ohba_encode (uint32 *valp)
+Operand_uimm16x4_rtoa (uint32 *valp, uint32 pc)
 {
-  unsigned op1_0, ae_ohba_0;
-  ae_ohba_0 = *valp;
-  op1_0 = (ae_ohba_0 & 0xf);
-  *valp = op1_0;
+  *valp += ((pc + 3) & ~0x3);
   return 0;
 }
 
 static int
-Operand_pr_decode (uint32 *valp ATTRIBUTE_UNUSED)
+Operand_xt_wbr15_label_ator (uint32 *valp, uint32 pc)
 {
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_pr_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0x7) != 0;
-  return error;
-}
-
-static int
-Operand_qr0_rw_decode (uint32 *valp ATTRIBUTE_UNUSED)
+Operand_xt_wbr15_label_rtoa (uint32 *valp, uint32 pc)
 {
+  *valp += pc;
   return 0;
 }
 
 static int
-Operand_qr0_rw_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0x3) != 0;
-  return error;
-}
-
-static int
-Operand_qr1_w_decode (uint32 *valp ATTRIBUTE_UNUSED)
+Operand_xt_wbr18_label_ator (uint32 *valp, uint32 pc)
 {
+  *valp -= pc;
   return 0;
 }
 
 static int
-Operand_qr1_w_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0x3) != 0;
-  return error;
-}
-
-static int
-Operand_ps_decode (uint32 *valp ATTRIBUTE_UNUSED)
+Operand_xt_wbr18_label_rtoa (uint32 *valp, uint32 pc)
 {
+  *valp += pc;
   return 0;
 }
 
-static int
-Operand_ps_encode (uint32 *valp)
-{
-  int error;
-  error = (*valp & ~0x7) != 0;
-  return error;
-}
-
 static xtensa_operand_internal operands[] = {
   { "soffsetx4", FIELD_offset, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_soffsetx4_encode, Operand_soffsetx4_decode,
+    OperandSem_opnd_sem_soffsetx4_encode, OperandSem_opnd_sem_soffsetx4_decode,
     Operand_soffsetx4_ator, Operand_soffsetx4_rtoa },
   { "uimm12x8", FIELD_imm12, -1, 0,
     0,
-    Operand_uimm12x8_encode, Operand_uimm12x8_decode,
+    OperandSem_opnd_sem_uimm12x8_encode, OperandSem_opnd_sem_uimm12x8_decode,
     0, 0 },
   { "simm4", FIELD_mn, -1, 0,
     0,
-    Operand_simm4_encode, Operand_simm4_decode,
+    OperandSem_opnd_sem_simm4_encode, OperandSem_opnd_sem_simm4_decode,
     0, 0 },
   { "arr", FIELD_r, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_arr_encode, Operand_arr_decode,
+    OperandSem_opnd_sem_AR_encode, OperandSem_opnd_sem_AR_decode,
     0, 0 },
   { "ars", FIELD_s, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_ars_encode, Operand_ars_decode,
+    OperandSem_opnd_sem_AR_encode, OperandSem_opnd_sem_AR_decode,
     0, 0 },
   { "*ars_invisible", FIELD_s, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER | XTENSA_OPERAND_IS_INVISIBLE,
-    Operand_ars_encode, Operand_ars_decode,
+    OperandSem_opnd_sem_AR_encode, OperandSem_opnd_sem_AR_decode,
     0, 0 },
   { "art", FIELD_t, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_art_encode, Operand_art_decode,
+    OperandSem_opnd_sem_AR_encode, OperandSem_opnd_sem_AR_decode,
     0, 0 },
   { "ar0", FIELD__ar0, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER | XTENSA_OPERAND_IS_INVISIBLE,
-    Operand_ar0_encode, Operand_ar0_decode,
+    OperandSem_opnd_sem_AR_0_encode, OperandSem_opnd_sem_AR_0_decode,
     0, 0 },
   { "ar4", FIELD__ar4, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER | XTENSA_OPERAND_IS_INVISIBLE,
-    Operand_ar4_encode, Operand_ar4_decode,
+    OperandSem_opnd_sem_AR_1_encode, OperandSem_opnd_sem_AR_1_decode,
     0, 0 },
   { "ar8", FIELD__ar8, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER | XTENSA_OPERAND_IS_INVISIBLE,
-    Operand_ar8_encode, Operand_ar8_decode,
+    OperandSem_opnd_sem_AR_2_encode, OperandSem_opnd_sem_AR_2_decode,
     0, 0 },
   { "ar12", FIELD__ar12, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER | XTENSA_OPERAND_IS_INVISIBLE,
-    Operand_ar12_encode, Operand_ar12_decode,
+    OperandSem_opnd_sem_AR_3_encode, OperandSem_opnd_sem_AR_3_decode,
     0, 0 },
   { "ars_entry", FIELD_s, REGFILE_AR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_ars_entry_encode, Operand_ars_entry_decode,
+    OperandSem_opnd_sem_AR_4_encode, OperandSem_opnd_sem_AR_4_decode,
     0, 0 },
   { "immrx4", FIELD_r, -1, 0,
     0,
-    Operand_immrx4_encode, Operand_immrx4_decode,
+    OperandSem_opnd_sem_immrx4_encode, OperandSem_opnd_sem_immrx4_decode,
     0, 0 },
   { "lsi4x4", FIELD_r, -1, 0,
     0,
-    Operand_lsi4x4_encode, Operand_lsi4x4_decode,
+    OperandSem_opnd_sem_lsi4x4_encode, OperandSem_opnd_sem_lsi4x4_decode,
     0, 0 },
   { "simm7", FIELD_imm7, -1, 0,
     0,
-    Operand_simm7_encode, Operand_simm7_decode,
+    OperandSem_opnd_sem_simm7_encode, OperandSem_opnd_sem_simm7_decode,
     0, 0 },
   { "uimm6", FIELD_imm6, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_uimm6_encode, Operand_uimm6_decode,
+    OperandSem_opnd_sem_uimm6_encode, OperandSem_opnd_sem_uimm6_decode,
     Operand_uimm6_ator, Operand_uimm6_rtoa },
   { "ai4const", FIELD_t, -1, 0,
     0,
-    Operand_ai4const_encode, Operand_ai4const_decode,
+    OperandSem_opnd_sem_ai4const_encode, OperandSem_opnd_sem_ai4const_decode,
     0, 0 },
   { "b4const", FIELD_r, -1, 0,
     0,
-    Operand_b4const_encode, Operand_b4const_decode,
+    OperandSem_opnd_sem_b4const_encode, OperandSem_opnd_sem_b4const_decode,
     0, 0 },
   { "b4constu", FIELD_r, -1, 0,
     0,
-    Operand_b4constu_encode, Operand_b4constu_decode,
+    OperandSem_opnd_sem_b4constu_encode, OperandSem_opnd_sem_b4constu_decode,
     0, 0 },
   { "uimm8", FIELD_imm8, -1, 0,
     0,
-    Operand_uimm8_encode, Operand_uimm8_decode,
+    OperandSem_opnd_sem_uimm8_encode, OperandSem_opnd_sem_uimm8_decode,
     0, 0 },
   { "uimm8x2", FIELD_imm8, -1, 0,
     0,
-    Operand_uimm8x2_encode, Operand_uimm8x2_decode,
+    OperandSem_opnd_sem_uimm8x2_encode, OperandSem_opnd_sem_uimm8x2_decode,
     0, 0 },
   { "uimm8x4", FIELD_imm8, -1, 0,
     0,
-    Operand_uimm8x4_encode, Operand_uimm8x4_decode,
+    OperandSem_opnd_sem_uimm8x4_encode, OperandSem_opnd_sem_uimm8x4_decode,
     0, 0 },
   { "uimm4x16", FIELD_op2, -1, 0,
     0,
-    Operand_uimm4x16_encode, Operand_uimm4x16_decode,
+    OperandSem_opnd_sem_uimm4x16_encode, OperandSem_opnd_sem_uimm4x16_decode,
+    0, 0 },
+  { "uimmrx4", FIELD_r, -1, 0,
+    0,
+    OperandSem_opnd_sem_lsi4x4_encode, OperandSem_opnd_sem_lsi4x4_decode,
     0, 0 },
   { "simm8", FIELD_imm8, -1, 0,
     0,
-    Operand_simm8_encode, Operand_simm8_decode,
+    OperandSem_opnd_sem_simm8_encode, OperandSem_opnd_sem_simm8_decode,
     0, 0 },
   { "simm8x256", FIELD_imm8, -1, 0,
     0,
-    Operand_simm8x256_encode, Operand_simm8x256_decode,
+    OperandSem_opnd_sem_simm8x256_encode, OperandSem_opnd_sem_simm8x256_decode,
     0, 0 },
   { "simm12b", FIELD_imm12b, -1, 0,
     0,
-    Operand_simm12b_encode, Operand_simm12b_decode,
+    OperandSem_opnd_sem_simm12b_encode, OperandSem_opnd_sem_simm12b_decode,
     0, 0 },
   { "msalp32", FIELD_sal, -1, 0,
     0,
-    Operand_msalp32_encode, Operand_msalp32_decode,
+    OperandSem_opnd_sem_msalp32_encode, OperandSem_opnd_sem_msalp32_decode,
     0, 0 },
   { "op2p1", FIELD_op2, -1, 0,
     0,
-    Operand_op2p1_encode, Operand_op2p1_decode,
+    OperandSem_opnd_sem_op2p1_encode, OperandSem_opnd_sem_op2p1_decode,
     0, 0 },
   { "label8", FIELD_imm8, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_label8_encode, Operand_label8_decode,
+    OperandSem_opnd_sem_label8_encode, OperandSem_opnd_sem_label8_decode,
     Operand_label8_ator, Operand_label8_rtoa },
   { "ulabel8", FIELD_imm8, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_ulabel8_encode, Operand_ulabel8_decode,
+    OperandSem_opnd_sem_ulabel8_encode, OperandSem_opnd_sem_ulabel8_decode,
     Operand_ulabel8_ator, Operand_ulabel8_rtoa },
   { "label12", FIELD_imm12, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_label12_encode, Operand_label12_decode,
+    OperandSem_opnd_sem_label12_encode, OperandSem_opnd_sem_label12_decode,
     Operand_label12_ator, Operand_label12_rtoa },
   { "soffset", FIELD_offset, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_soffset_encode, Operand_soffset_decode,
+    OperandSem_opnd_sem_soffset_encode, OperandSem_opnd_sem_soffset_decode,
     Operand_soffset_ator, Operand_soffset_rtoa },
   { "uimm16x4", FIELD_imm16, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_uimm16x4_encode, Operand_uimm16x4_decode,
+    OperandSem_opnd_sem_uimm16x4_encode, OperandSem_opnd_sem_uimm16x4_decode,
     Operand_uimm16x4_ator, Operand_uimm16x4_rtoa },
+  { "bbi", FIELD_bbi, -1, 0,
+    0,
+    OperandSem_opnd_sem_bbi_encode, OperandSem_opnd_sem_bbi_decode,
+    0, 0 },
+  { "sae", FIELD_sae, -1, 0,
+    0,
+    OperandSem_opnd_sem_bbi_encode, OperandSem_opnd_sem_bbi_decode,
+    0, 0 },
+  { "sas", FIELD_sas, -1, 0,
+    0,
+    OperandSem_opnd_sem_bbi_encode, OperandSem_opnd_sem_bbi_decode,
+    0, 0 },
+  { "sargt", FIELD_sargt, -1, 0,
+    0,
+    OperandSem_opnd_sem_bbi_encode, OperandSem_opnd_sem_bbi_decode,
+    0, 0 },
+  { "s", FIELD_s, -1, 0,
+    0,
+    OperandSem_opnd_sem_s_encode, OperandSem_opnd_sem_s_decode,
+    0, 0 },
   { "immt", FIELD_t, -1, 0,
     0,
-    Operand_immt_encode, Operand_immt_decode,
+    OperandSem_opnd_sem_immt_encode, OperandSem_opnd_sem_immt_decode,
     0, 0 },
   { "imms", FIELD_s, -1, 0,
     0,
-    Operand_imms_encode, Operand_imms_decode,
+    OperandSem_opnd_sem_immt_encode, OperandSem_opnd_sem_immt_decode,
     0, 0 },
   { "bt", FIELD_t, REGFILE_BR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bt_encode, Operand_bt_decode,
+    OperandSem_opnd_sem_BR_encode, OperandSem_opnd_sem_BR_decode,
     0, 0 },
   { "bs", FIELD_s, REGFILE_BR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bs_encode, Operand_bs_decode,
+    OperandSem_opnd_sem_BR_encode, OperandSem_opnd_sem_BR_decode,
     0, 0 },
   { "br", FIELD_r, REGFILE_BR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_br_encode, Operand_br_decode,
+    OperandSem_opnd_sem_BR_encode, OperandSem_opnd_sem_BR_decode,
     0, 0 },
   { "bt2", FIELD_t2, REGFILE_BR, 2,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bt2_encode, Operand_bt2_decode,
+    OperandSem_opnd_sem_BR2_encode, OperandSem_opnd_sem_BR2_decode,
     0, 0 },
   { "bs2", FIELD_s2, REGFILE_BR, 2,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bs2_encode, Operand_bs2_decode,
+    OperandSem_opnd_sem_BR2_encode, OperandSem_opnd_sem_BR2_decode,
     0, 0 },
   { "br2", FIELD_r2, REGFILE_BR, 2,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_br2_encode, Operand_br2_decode,
+    OperandSem_opnd_sem_BR2_encode, OperandSem_opnd_sem_BR2_decode,
     0, 0 },
   { "bt4", FIELD_t4, REGFILE_BR, 4,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bt4_encode, Operand_bt4_decode,
+    OperandSem_opnd_sem_BR4_encode, OperandSem_opnd_sem_BR4_decode,
     0, 0 },
   { "bs4", FIELD_s4, REGFILE_BR, 4,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bs4_encode, Operand_bs4_decode,
+    OperandSem_opnd_sem_BR4_encode, OperandSem_opnd_sem_BR4_decode,
     0, 0 },
   { "br4", FIELD_r4, REGFILE_BR, 4,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_br4_encode, Operand_br4_decode,
+    OperandSem_opnd_sem_BR4_encode, OperandSem_opnd_sem_BR4_decode,
     0, 0 },
   { "bt8", FIELD_t8, REGFILE_BR, 8,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bt8_encode, Operand_bt8_decode,
+    OperandSem_opnd_sem_BR8_encode, OperandSem_opnd_sem_BR8_decode,
     0, 0 },
   { "bs8", FIELD_s8, REGFILE_BR, 8,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bs8_encode, Operand_bs8_decode,
+    OperandSem_opnd_sem_BR8_encode, OperandSem_opnd_sem_BR8_decode,
     0, 0 },
   { "br8", FIELD_r8, REGFILE_BR, 8,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_br8_encode, Operand_br8_decode,
+    OperandSem_opnd_sem_BR8_encode, OperandSem_opnd_sem_BR8_decode,
     0, 0 },
   { "bt16", FIELD__bt16, REGFILE_BR, 16,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bt16_encode, Operand_bt16_decode,
+    OperandSem_opnd_sem_BR16_encode, OperandSem_opnd_sem_BR16_decode,
     0, 0 },
   { "bs16", FIELD__bs16, REGFILE_BR, 16,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_bs16_encode, Operand_bs16_decode,
+    OperandSem_opnd_sem_BR16_encode, OperandSem_opnd_sem_BR16_decode,
     0, 0 },
   { "br16", FIELD__br16, REGFILE_BR, 16,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_br16_encode, Operand_br16_decode,
+    OperandSem_opnd_sem_BR16_encode, OperandSem_opnd_sem_BR16_decode,
     0, 0 },
   { "brall", FIELD__brall, REGFILE_BR, 16,
     XTENSA_OPERAND_IS_REGISTER | XTENSA_OPERAND_IS_INVISIBLE,
-    Operand_brall_encode, Operand_brall_decode,
+    OperandSem_opnd_sem_BR16_encode, OperandSem_opnd_sem_BR16_decode,
     0, 0 },
   { "tp7", FIELD_t, -1, 0,
     0,
-    Operand_tp7_encode, Operand_tp7_decode,
+    OperandSem_opnd_sem_tp7_encode, OperandSem_opnd_sem_tp7_decode,
     0, 0 },
   { "xt_wbr15_label", FIELD_xt_wbr15_imm, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_xt_wbr15_label_encode, Operand_xt_wbr15_label_decode,
+    OperandSem_opnd_sem_xt_wbr15_label_encode, OperandSem_opnd_sem_xt_wbr15_label_decode,
     Operand_xt_wbr15_label_ator, Operand_xt_wbr15_label_rtoa },
   { "xt_wbr18_label", FIELD_xt_wbr18_imm, -1, 0,
     XTENSA_OPERAND_IS_PCRELATIVE,
-    Operand_xt_wbr18_label_encode, Operand_xt_wbr18_label_decode,
+    OperandSem_opnd_sem_soffset_encode, OperandSem_opnd_sem_soffset_decode,
     Operand_xt_wbr18_label_ator, Operand_xt_wbr18_label_rtoa },
   { "ae_samt32", FIELD_ftsf14, -1, 0,
     0,
-    Operand_ae_samt32_encode, Operand_ae_samt32_decode,
+    OperandSem_opnd_sem_ae_samt32_encode, OperandSem_opnd_sem_ae_samt32_decode,
     0, 0 },
   { "pr0", FIELD_ftsf12, REGFILE_AE_PR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_pr0_encode, Operand_pr0_decode,
+    OperandSem_opnd_sem_AE_PR_encode, OperandSem_opnd_sem_AE_PR_decode,
     0, 0 },
   { "qr0", FIELD_ftsf13, REGFILE_AE_QR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_qr0_encode, Operand_qr0_decode,
+    OperandSem_opnd_sem_AE_QR_encode, OperandSem_opnd_sem_AE_QR_decode,
+    0, 0 },
+  { "mac_qr0", FIELD_ftsf13, REGFILE_AE_QR, 1,
+    XTENSA_OPERAND_IS_REGISTER,
+    OperandSem_opnd_sem_AE_QR_encode, OperandSem_opnd_sem_AE_QR_decode,
     0, 0 },
   { "ae_lsimm16", FIELD_t, -1, 0,
     0,
-    Operand_ae_lsimm16_encode, Operand_ae_lsimm16_decode,
+    OperandSem_opnd_sem_ae_lsimm16_encode, OperandSem_opnd_sem_ae_lsimm16_decode,
     0, 0 },
   { "ae_lsimm32", FIELD_t, -1, 0,
     0,
-    Operand_ae_lsimm32_encode, Operand_ae_lsimm32_decode,
+    OperandSem_opnd_sem_ae_lsimm32_encode, OperandSem_opnd_sem_ae_lsimm32_decode,
     0, 0 },
   { "ae_lsimm64", FIELD_t, -1, 0,
     0,
-    Operand_ae_lsimm64_encode, Operand_ae_lsimm64_decode,
+    OperandSem_opnd_sem_ae_lsimm64_encode, OperandSem_opnd_sem_ae_lsimm64_decode,
     0, 0 },
   { "ae_samt64", FIELD_ae_samt_s_t, -1, 0,
     0,
-    Operand_ae_samt64_encode, Operand_ae_samt64_decode,
+    OperandSem_opnd_sem_ae_samt64_encode, OperandSem_opnd_sem_ae_samt64_decode,
     0, 0 },
-  { "ae_ohba", FIELD_op1, -1, 0,
+  { "ae_ohba", FIELD_ae_fld_ohba, -1, 0,
     0,
-    Operand_ae_ohba_encode, Operand_ae_ohba_decode,
+    OperandSem_opnd_sem_ae_ohba_encode, OperandSem_opnd_sem_ae_ohba_decode,
+    0, 0 },
+  { "ae_ohba2", FIELD_ae_fld_ohba2, -1, 0,
+    0,
+    OperandSem_opnd_sem_ae_ohba_encode, OperandSem_opnd_sem_ae_ohba_decode,
     0, 0 },
   { "pr", FIELD_ae_r20, REGFILE_AE_PR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_pr_encode, Operand_pr_decode,
+    OperandSem_opnd_sem_AE_PR_encode, OperandSem_opnd_sem_AE_PR_decode,
+    0, 0 },
+  { "cvt_pr", FIELD_ae_r20, REGFILE_AE_PR, 1,
+    XTENSA_OPERAND_IS_REGISTER,
+    OperandSem_opnd_sem_AE_PR_encode, OperandSem_opnd_sem_AE_PR_decode,
     0, 0 },
   { "qr0_rw", FIELD_ae_r10, REGFILE_AE_QR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_qr0_rw_encode, Operand_qr0_rw_decode,
+    OperandSem_opnd_sem_AE_QR_encode, OperandSem_opnd_sem_AE_QR_decode,
+    0, 0 },
+  { "mac_qr0_rw", FIELD_ae_r10, REGFILE_AE_QR, 1,
+    XTENSA_OPERAND_IS_REGISTER,
+    OperandSem_opnd_sem_AE_QR_encode, OperandSem_opnd_sem_AE_QR_decode,
     0, 0 },
   { "qr1_w", FIELD_ae_r32, REGFILE_AE_QR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_qr1_w_encode, Operand_qr1_w_decode,
+    OperandSem_opnd_sem_AE_QR_encode, OperandSem_opnd_sem_AE_QR_decode,
+    0, 0 },
+  { "mac_qr1_w", FIELD_ae_r32, REGFILE_AE_QR, 1,
+    XTENSA_OPERAND_IS_REGISTER,
+    OperandSem_opnd_sem_AE_QR_encode, OperandSem_opnd_sem_AE_QR_decode,
     0, 0 },
   { "ps", FIELD_ae_s20, REGFILE_AE_PR, 1,
     XTENSA_OPERAND_IS_REGISTER,
-    Operand_ps_encode, Operand_ps_decode,
+    OperandSem_opnd_sem_AE_PR_encode, OperandSem_opnd_sem_AE_PR_decode,
+    0, 0 },
+  { "alupppb_ps", FIELD_ae_s20, REGFILE_AE_PR, 1,
+    XTENSA_OPERAND_IS_REGISTER,
+    OperandSem_opnd_sem_AE_PR_encode, OperandSem_opnd_sem_AE_PR_decode,
     0, 0 },
   { "t", FIELD_t, -1, 0, 0, 0, 0, 0, 0 },
   { "bbi4", FIELD_bbi4, -1, 0, 0, 0, 0, 0, 0 },
-  { "bbi", FIELD_bbi, -1, 0, 0, 0, 0, 0, 0 },
   { "imm12", FIELD_imm12, -1, 0, 0, 0, 0, 0, 0 },
   { "imm8", FIELD_imm8, -1, 0, 0, 0, 0, 0, 0 },
-  { "s", FIELD_s, -1, 0, 0, 0, 0, 0, 0 },
   { "imm12b", FIELD_imm12b, -1, 0, 0, 0, 0, 0, 0 },
   { "imm16", FIELD_imm16, -1, 0, 0, 0, 0, 0, 0 },
   { "m", FIELD_m, -1, 0, 0, 0, 0, 0, 0 },
@@ -10861,11 +10757,8 @@ static xtensa_operand_internal operands[] = {
   { "r", FIELD_r, -1, 0, 0, 0, 0, 0, 0 },
   { "sa4", FIELD_sa4, -1, 0, 0, 0, 0, 0, 0 },
   { "sae4", FIELD_sae4, -1, 0, 0, 0, 0, 0, 0 },
-  { "sae", FIELD_sae, -1, 0, 0, 0, 0, 0, 0 },
   { "sal", FIELD_sal, -1, 0, 0, 0, 0, 0, 0 },
-  { "sargt", FIELD_sargt, -1, 0, 0, 0, 0, 0, 0 },
   { "sas4", FIELD_sas4, -1, 0, 0, 0, 0, 0, 0 },
-  { "sas", FIELD_sas, -1, 0, 0, 0, 0, 0, 0 },
   { "sr", FIELD_sr, -1, 0, 0, 0, 0, 0, 0 },
   { "st", FIELD_st, -1, 0, 0, 0, 0, 0, 0 },
   { "thi3", FIELD_thi3, -1, 0, 0, 0, 0, 0, 0 },
@@ -10898,6 +10791,8 @@ static xtensa_operand_internal operands[] = {
   { "ae_r20", FIELD_ae_r20, -1, 0, 0, 0, 0, 0, 0 },
   { "ae_r10", FIELD_ae_r10, -1, 0, 0, 0, 0, 0, 0 },
   { "ae_s20", FIELD_ae_s20, -1, 0, 0, 0, 0, 0, 0 },
+  { "ae_fld_ohba", FIELD_ae_fld_ohba, -1, 0, 0, 0, 0, 0, 0 },
+  { "ae_fld_ohba2", FIELD_ae_fld_ohba2, -1, 0, 0, 0, 0, 0, 0 },
   { "op0_s3", FIELD_op0_s3, -1, 0, 0, 0, 0, 0, 0 },
   { "ftsf12", FIELD_ftsf12, -1, 0, 0, 0, 0, 0, 0 },
   { "ftsf13", FIELD_ftsf13, -1, 0, 0, 0, 0, 0, 0 },
@@ -11249,6 +11144,7 @@ enum xtensa_operand_id {
   OPERAND_uimm8x2,
   OPERAND_uimm8x4,
   OPERAND_uimm4x16,
+  OPERAND_uimmrx4,
   OPERAND_simm8,
   OPERAND_simm8x256,
   OPERAND_simm12b,
@@ -11259,6 +11155,11 @@ enum xtensa_operand_id {
   OPERAND_label12,
   OPERAND_soffset,
   OPERAND_uimm16x4,
+  OPERAND_bbi,
+  OPERAND_sae,
+  OPERAND_sas,
+  OPERAND_sargt,
+  OPERAND_s,
   OPERAND_immt,
   OPERAND_imms,
   OPERAND_bt,
@@ -11283,21 +11184,25 @@ enum xtensa_operand_id {
   OPERAND_ae_samt32,
   OPERAND_pr0,
   OPERAND_qr0,
+  OPERAND_mac_qr0,
   OPERAND_ae_lsimm16,
   OPERAND_ae_lsimm32,
   OPERAND_ae_lsimm64,
   OPERAND_ae_samt64,
   OPERAND_ae_ohba,
+  OPERAND_ae_ohba2,
   OPERAND_pr,
+  OPERAND_cvt_pr,
   OPERAND_qr0_rw,
+  OPERAND_mac_qr0_rw,
   OPERAND_qr1_w,
+  OPERAND_mac_qr1_w,
   OPERAND_ps,
+  OPERAND_alupppb_ps,
   OPERAND_t,
   OPERAND_bbi4,
-  OPERAND_bbi,
   OPERAND_imm12,
   OPERAND_imm8,
-  OPERAND_s,
   OPERAND_imm12b,
   OPERAND_imm16,
   OPERAND_m,
@@ -11309,11 +11214,8 @@ enum xtensa_operand_id {
   OPERAND_r,
   OPERAND_sa4,
   OPERAND_sae4,
-  OPERAND_sae,
   OPERAND_sal,
-  OPERAND_sargt,
   OPERAND_sas4,
-  OPERAND_sas,
   OPERAND_sr,
   OPERAND_st,
   OPERAND_thi3,
@@ -11346,6 +11248,8 @@ enum xtensa_operand_id {
   OPERAND_ae_r20,
   OPERAND_ae_r10,
   OPERAND_ae_s20,
+  OPERAND_ae_fld_ohba,
+  OPERAND_ae_fld_ohba2,
   OPERAND_op0_s3,
   OPERAND_ftsf12,
   OPERAND_ftsf13,
@@ -12316,29 +12220,29 @@ static xtensa_arg_internal Iclass_xt_iclass_xsr_litbase_stateArgs[] = {
   { { STATE_LITBEN }, 'm' }
 };
 
-static xtensa_arg_internal Iclass_xt_iclass_rsr_176_args[] = {
+static xtensa_arg_internal Iclass_xt_iclass_rsr_configid0_args[] = {
   { { OPERAND_art }, 'o' }
 };
 
-static xtensa_arg_internal Iclass_xt_iclass_rsr_176_stateArgs[] = {
+static xtensa_arg_internal Iclass_xt_iclass_rsr_configid0_stateArgs[] = {
   { { STATE_PSEXCM }, 'i' },
   { { STATE_PSRING }, 'i' }
 };
 
-static xtensa_arg_internal Iclass_xt_iclass_wsr_176_args[] = {
+static xtensa_arg_internal Iclass_xt_iclass_wsr_configid0_args[] = {
   { { OPERAND_art }, 'i' }
 };
 
-static xtensa_arg_internal Iclass_xt_iclass_wsr_176_stateArgs[] = {
+static xtensa_arg_internal Iclass_xt_iclass_wsr_configid0_stateArgs[] = {
   { { STATE_PSEXCM }, 'i' },
   { { STATE_PSRING }, 'i' }
 };
 
-static xtensa_arg_internal Iclass_xt_iclass_rsr_208_args[] = {
+static xtensa_arg_internal Iclass_xt_iclass_rsr_configid1_args[] = {
   { { OPERAND_art }, 'o' }
 };
 
-static xtensa_arg_internal Iclass_xt_iclass_rsr_208_stateArgs[] = {
+static xtensa_arg_internal Iclass_xt_iclass_rsr_configid1_stateArgs[] = {
   { { STATE_PSEXCM }, 'i' },
   { { STATE_PSRING }, 'i' }
 };
@@ -14759,7 +14663,7 @@ static xtensa_arg_internal Iclass_ae_iclass_cvtq48a32s_stateArgs[] = {
 
 static xtensa_arg_internal Iclass_ae_iclass_cvtq48p24s_l_args[] = {
   { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_pr }, 'i' }
+  { { OPERAND_cvt_pr }, 'i' }
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_cvtq48p24s_l_stateArgs[] = {
@@ -14768,7 +14672,7 @@ static xtensa_arg_internal Iclass_ae_iclass_cvtq48p24s_l_stateArgs[] = {
 
 static xtensa_arg_internal Iclass_ae_iclass_cvtq48p24s_h_args[] = {
   { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_pr }, 'i' }
+  { { OPERAND_cvt_pr }, 'i' }
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_cvtq48p24s_h_stateArgs[] = {
@@ -14918,7 +14822,7 @@ static xtensa_arg_internal Iclass_ae_iclass_minp24s_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_maxbp24s_args[] = {
-  { { OPERAND_ps }, 'o' },
+  { { OPERAND_alupppb_ps }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' },
   { { OPERAND_bt2 }, 'o' }
@@ -14929,7 +14833,7 @@ static xtensa_arg_internal Iclass_ae_iclass_maxbp24s_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_minbp24s_args[] = {
-  { { OPERAND_ps }, 'o' },
+  { { OPERAND_alupppb_ps }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' },
   { { OPERAND_bt2 }, 'o' }
@@ -15458,7 +15362,7 @@ static xtensa_arg_internal Iclass_ae_iclass_nsaq56s_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15469,7 +15373,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15479,7 +15383,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulp24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15489,7 +15393,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulp24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15500,7 +15404,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15510,7 +15414,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulp24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15520,7 +15424,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulp24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15531,7 +15435,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15541,7 +15445,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulp24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15551,7 +15455,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulp24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15562,7 +15466,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfs32p16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15572,7 +15476,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfp24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulp24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15582,7 +15486,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulp24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15593,7 +15497,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15603,7 +15507,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulap24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15613,7 +15517,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulap24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15624,7 +15528,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15634,7 +15538,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulap24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15644,7 +15548,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulap24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15655,7 +15559,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15665,7 +15569,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulap24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15675,7 +15579,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulap24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15686,7 +15590,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs32p16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15696,7 +15600,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafp24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulap24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15706,7 +15610,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulap24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15717,7 +15621,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15727,7 +15631,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15737,7 +15641,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15748,7 +15652,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15758,7 +15662,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15768,7 +15672,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15779,7 +15683,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15789,7 +15693,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15799,7 +15703,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15810,7 +15714,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs32p16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15820,7 +15724,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfp24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15830,7 +15734,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsp24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15841,7 +15745,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15852,7 +15756,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15863,7 +15767,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15874,7 +15778,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15885,7 +15789,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15896,7 +15800,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15907,7 +15811,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafs56p24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15918,7 +15822,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulas56p24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15929,7 +15833,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15940,7 +15844,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15951,7 +15855,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15962,7 +15866,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15973,7 +15877,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_hl_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15984,7 +15888,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_hl_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -15995,7 +15899,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfs56p24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16006,8 +15910,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulss56p24s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16s_l_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16016,8 +15920,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16s_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16s_h_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16026,8 +15930,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16s_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16u_l_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16036,8 +15940,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16u_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16u_h_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16046,8 +15950,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulfq32sp16u_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16s_l_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16056,8 +15960,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16s_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16s_h_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16066,8 +15970,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16s_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16u_l_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16076,8 +15980,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16u_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16u_h_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16086,8 +15990,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulq32sp16u_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16s_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16096,8 +16000,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16s_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16s_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16106,8 +16010,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16s_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16u_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16116,8 +16020,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16u_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16u_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16126,8 +16030,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulafq32sp16u_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16s_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16136,8 +16040,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16s_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16s_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16146,8 +16050,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16s_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16u_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16156,8 +16060,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16u_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16u_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16166,8 +16070,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaq32sp16u_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16s_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16176,8 +16080,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16s_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16s_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16186,8 +16090,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16s_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16u_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16196,8 +16100,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16u_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16u_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16206,8 +16110,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsfq32sp16u_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16s_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16216,8 +16120,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16s_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16s_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16226,8 +16130,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16s_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16u_l_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16236,8 +16140,8 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16u_l_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16u_h_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'm' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' }
 };
 
@@ -16246,10 +16150,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsq32sp16u_h_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16258,10 +16162,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16270,10 +16174,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16282,10 +16186,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16294,10 +16198,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16306,10 +16210,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16318,10 +16222,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16330,10 +16234,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16342,10 +16246,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16354,10 +16258,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16366,10 +16270,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16378,10 +16282,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaaq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16390,10 +16294,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16402,10 +16306,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16414,10 +16318,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16426,10 +16330,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16438,10 +16342,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16450,10 +16354,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16462,10 +16366,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16474,10 +16378,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16486,10 +16390,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16498,10 +16402,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16510,10 +16414,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16522,10 +16426,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16534,10 +16438,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16546,10 +16450,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16558,10 +16462,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16570,10 +16474,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16582,10 +16486,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16594,10 +16498,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16606,10 +16510,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16618,10 +16522,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16630,10 +16534,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16642,10 +16546,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16654,10 +16558,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16666,10 +16570,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsaq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16678,10 +16582,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16690,10 +16594,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16s_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16702,10 +16606,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16s_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16714,10 +16618,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16u_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16726,10 +16630,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16u_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16738,10 +16642,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16s_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16750,10 +16654,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16s_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16762,10 +16666,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16u_hh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16774,10 +16678,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16u_hh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16786,10 +16690,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16s_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16798,10 +16702,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16s_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16810,10 +16714,10 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16u_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
-  { { OPERAND_qr0_rw }, 'i' },
+  { { OPERAND_mac_qr1_w }, 'o' },
+  { { OPERAND_mac_qr0_rw }, 'i' },
   { { OPERAND_pr }, 'i' },
-  { { OPERAND_qr0 }, 'i' },
+  { { OPERAND_mac_qr0 }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
 
@@ -16822,7 +16726,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfq32sp16u_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16832,7 +16736,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaap24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16842,7 +16746,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaap24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaafp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16852,7 +16756,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaafp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzaap24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16862,7 +16766,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzaap24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16872,7 +16776,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16882,7 +16786,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasfp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16892,7 +16796,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasfp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzasp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16902,7 +16806,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzasp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16912,7 +16816,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsap24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16922,7 +16826,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsap24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsafp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16932,7 +16836,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsafp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzsap24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16942,7 +16846,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzsap24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16952,7 +16856,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16962,7 +16866,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssfp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16972,7 +16876,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssfp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulzssp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'o' },
+  { { OPERAND_mac_qr1_w }, 'o' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16982,7 +16886,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulzssp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaafp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -16992,7 +16896,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaafp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaap24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17002,7 +16906,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaap24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaafp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17012,7 +16916,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaafp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulaap24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17022,7 +16926,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulaap24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulasfp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17032,7 +16936,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulasfp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulasp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17042,7 +16946,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulasp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulasfp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17052,7 +16956,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulasfp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulasp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17062,7 +16966,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulasp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsafp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17072,7 +16976,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsafp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsap24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17082,7 +16986,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsap24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsafp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17092,7 +16996,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsafp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulsap24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17102,7 +17006,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulsap24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulssfp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17112,7 +17016,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulssfp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulssp24s_hh_ll_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17122,7 +17026,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulssp24s_hh_ll_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulssfp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17132,7 +17036,7 @@ static xtensa_arg_internal Iclass_ae_iclass_mulssfp24s_hl_lh_stateArgs[] = {
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_mulssp24s_hl_lh_args[] = {
-  { { OPERAND_qr1_w }, 'm' },
+  { { OPERAND_mac_qr1_w }, 'm' },
   { { OPERAND_pr }, 'i' },
   { { OPERAND_pr0 }, 'i' }
 };
@@ -17215,7 +17119,7 @@ static xtensa_arg_internal Iclass_ae_iclass_lb_stateArgs[] = {
 
 static xtensa_arg_internal Iclass_ae_iclass_lbi_args[] = {
   { { OPERAND_arr }, 'o' },
-  { { OPERAND_ae_ohba }, 'i' }
+  { { OPERAND_ae_ohba2 }, 'i' }
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_lbi_stateArgs[] = {
@@ -17239,7 +17143,7 @@ static xtensa_arg_internal Iclass_ae_iclass_lbk_stateArgs[] = {
 static xtensa_arg_internal Iclass_ae_iclass_lbki_args[] = {
   { { OPERAND_arr }, 'o' },
   { { OPERAND_ars }, 'i' },
-  { { OPERAND_ae_ohba }, 'i' }
+  { { OPERAND_ae_ohba2 }, 'i' }
 };
 
 static xtensa_arg_internal Iclass_ae_iclass_lbki_stateArgs[] = {
@@ -17349,8 +17253,6 @@ static xtensa_iclass_internal iclasses[] = {
     3, Iclass_xt_iclass_rfde_stateArgs, 0, 0 },
   { 0, 0 /* xt_iclass_syscall */,
     0, 0, 0, 0 },
-  { 0, 0 /* xt_iclass_simcall */,
-    0, 0, 0, 0 },
   { 2, Iclass_xt_iclass_call12_args,
     1, Iclass_xt_iclass_call12_stateArgs, 0, 0 },
   { 2, Iclass_xt_iclass_call8_args,
@@ -17467,6 +17369,8 @@ static xtensa_iclass_internal iclasses[] = {
     0, 0, 0, 0 },
   { 1, Iclass_xt_iclass_return_args,
     0, 0, 0, 0 },
+  { 0, 0 /* xt_iclass_simcall */,
+    0, 0, 0, 0 },
   { 3, Iclass_xt_iclass_s16i_args,
     0, 0, 0, 0 },
   { 3, Iclass_xt_iclass_s32i_args,
@@ -17529,12 +17433,12 @@ static xtensa_iclass_internal iclasses[] = {
     2, Iclass_xt_iclass_wsr_litbase_stateArgs, 0, 0 },
   { 1, Iclass_xt_iclass_xsr_litbase_args,
     2, Iclass_xt_iclass_xsr_litbase_stateArgs, 0, 0 },
-  { 1, Iclass_xt_iclass_rsr_176_args,
-    2, Iclass_xt_iclass_rsr_176_stateArgs, 0, 0 },
-  { 1, Iclass_xt_iclass_wsr_176_args,
-    2, Iclass_xt_iclass_wsr_176_stateArgs, 0, 0 },
-  { 1, Iclass_xt_iclass_rsr_208_args,
-    2, Iclass_xt_iclass_rsr_208_stateArgs, 0, 0 },
+  { 1, Iclass_xt_iclass_rsr_configid0_args,
+    2, Iclass_xt_iclass_rsr_configid0_stateArgs, 0, 0 },
+  { 1, Iclass_xt_iclass_wsr_configid0_args,
+    2, Iclass_xt_iclass_wsr_configid0_stateArgs, 0, 0 },
+  { 1, Iclass_xt_iclass_rsr_configid1_args,
+    2, Iclass_xt_iclass_rsr_configid1_stateArgs, 0, 0 },
   { 1, Iclass_xt_iclass_rsr_ps_args,
     7, Iclass_xt_iclass_rsr_ps_stateArgs, 0, 0 },
   { 1, Iclass_xt_iclass_wsr_ps_args,
@@ -18524,7 +18428,6 @@ enum xtensa_iclass_id {
   ICLASS_xt_iclass_rfe,
   ICLASS_xt_iclass_rfde,
   ICLASS_xt_iclass_syscall,
-  ICLASS_xt_iclass_simcall,
   ICLASS_xt_iclass_call12,
   ICLASS_xt_iclass_call8,
   ICLASS_xt_iclass_call4,
@@ -18583,6 +18486,7 @@ enum xtensa_iclass_id {
   ICLASS_xt_iclass_neg,
   ICLASS_xt_iclass_nop,
   ICLASS_xt_iclass_return,
+  ICLASS_xt_iclass_simcall,
   ICLASS_xt_iclass_s16i,
   ICLASS_xt_iclass_s32i,
   ICLASS_xt_iclass_s8i,
@@ -18614,9 +18518,9 @@ enum xtensa_iclass_id {
   ICLASS_xt_iclass_rsr_litbase,
   ICLASS_xt_iclass_wsr_litbase,
   ICLASS_xt_iclass_xsr_litbase,
-  ICLASS_xt_iclass_rsr_176,
-  ICLASS_xt_iclass_wsr_176,
-  ICLASS_xt_iclass_rsr_208,
+  ICLASS_xt_iclass_rsr_configid0,
+  ICLASS_xt_iclass_wsr_configid0,
+  ICLASS_xt_iclass_rsr_configid1,
   ICLASS_xt_iclass_rsr_ps,
   ICLASS_xt_iclass_wsr_ps,
   ICLASS_xt_iclass_xsr_ps,
@@ -19138,12 +19042,6 @@ Opcode_syscall_Slot_inst_encode (xtensa_insnbuf slotbuf)
 }
 
 static void
-Opcode_simcall_Slot_inst_encode (xtensa_insnbuf slotbuf)
-{
-  slotbuf[0] = 0x5100;
-}
-
-static void
 Opcode_call12_Slot_inst_encode (xtensa_insnbuf slotbuf)
 {
   slotbuf[0] = 0x35;
@@ -20032,6 +19930,12 @@ Opcode_ret_Slot_inst_encode (xtensa_insnbuf slotbuf)
 }
 
 static void
+Opcode_simcall_Slot_inst_encode (xtensa_insnbuf slotbuf)
+{
+  slotbuf[0] = 0x5100;
+}
+
+static void
 Opcode_s16i_Slot_inst_encode (xtensa_insnbuf slotbuf)
 {
   slotbuf[0] = 0x5002;
@@ -20344,19 +20248,19 @@ Opcode_xsr_litbase_Slot_inst_encode (xtensa_insnbuf slotbuf)
 }
 
 static void
-Opcode_rsr_176_Slot_inst_encode (xtensa_insnbuf slotbuf)
+Opcode_rsr_configid0_Slot_inst_encode (xtensa_insnbuf slotbuf)
 {
   slotbuf[0] = 0x3b000;
 }
 
 static void
-Opcode_wsr_176_Slot_inst_encode (xtensa_insnbuf slotbuf)
+Opcode_wsr_configid0_Slot_inst_encode (xtensa_insnbuf slotbuf)
 {
   slotbuf[0] = 0x13b000;
 }
 
 static void
-Opcode_rsr_208_Slot_inst_encode (xtensa_insnbuf slotbuf)
+Opcode_rsr_configid1_Slot_inst_encode (xtensa_insnbuf slotbuf)
 {
   slotbuf[0] = 0x3d000;
 }
@@ -24175,10 +24079,6 @@ static xtensa_opcode_encode_fn Opcode_syscall_encode_fns[] = {
   Opcode_syscall_Slot_inst_encode, 0, 0, 0, 0
 };
 
-static xtensa_opcode_encode_fn Opcode_simcall_encode_fns[] = {
-  Opcode_simcall_Slot_inst_encode, 0, 0, 0, 0
-};
-
 static xtensa_opcode_encode_fn Opcode_call12_encode_fns[] = {
   Opcode_call12_Slot_inst_encode, 0, 0, 0, 0
 };
@@ -24555,6 +24455,10 @@ static xtensa_opcode_encode_fn Opcode_ret_encode_fns[] = {
   Opcode_ret_Slot_inst_encode, 0, 0, 0, 0
 };
 
+static xtensa_opcode_encode_fn Opcode_simcall_encode_fns[] = {
+  Opcode_simcall_Slot_inst_encode, 0, 0, 0, 0
+};
+
 static xtensa_opcode_encode_fn Opcode_s16i_encode_fns[] = {
   Opcode_s16i_Slot_inst_encode, 0, 0, 0, Opcode_s16i_Slot_ae_slot0_encode
 };
@@ -24703,16 +24607,16 @@ static xtensa_opcode_encode_fn Opcode_xsr_litbase_encode_fns[] = {
   Opcode_xsr_litbase_Slot_inst_encode, 0, 0, 0, 0
 };
 
-static xtensa_opcode_encode_fn Opcode_rsr_176_encode_fns[] = {
-  Opcode_rsr_176_Slot_inst_encode, 0, 0, 0, 0
+static xtensa_opcode_encode_fn Opcode_rsr_configid0_encode_fns[] = {
+  Opcode_rsr_configid0_Slot_inst_encode, 0, 0, 0, 0
 };
 
-static xtensa_opcode_encode_fn Opcode_wsr_176_encode_fns[] = {
-  Opcode_wsr_176_Slot_inst_encode, 0, 0, 0, 0
+static xtensa_opcode_encode_fn Opcode_wsr_configid0_encode_fns[] = {
+  Opcode_wsr_configid0_Slot_inst_encode, 0, 0, 0, 0
 };
 
-static xtensa_opcode_encode_fn Opcode_rsr_208_encode_fns[] = {
-  Opcode_rsr_208_Slot_inst_encode, 0, 0, 0, 0
+static xtensa_opcode_encode_fn Opcode_rsr_configid1_encode_fns[] = {
+  Opcode_rsr_configid1_Slot_inst_encode, 0, 0, 0, 0
 };
 
 static xtensa_opcode_encode_fn Opcode_rsr_ps_encode_fns[] = {
@@ -26873,9 +26777,6 @@ static xtensa_opcode_internal opcodes[] = {
   { "syscall", ICLASS_xt_iclass_syscall,
     0,
     Opcode_syscall_encode_fns, 0, 0 },
-  { "simcall", ICLASS_xt_iclass_simcall,
-    0,
-    Opcode_simcall_encode_fns, 0, 0 },
   { "call12", ICLASS_xt_iclass_call12,
     XTENSA_OPCODE_IS_CALL,
     Opcode_call12_encode_fns, 0, 0 },
@@ -27158,6 +27059,9 @@ static xtensa_opcode_internal opcodes[] = {
   { "ret", ICLASS_xt_iclass_return,
     XTENSA_OPCODE_IS_JUMP,
     Opcode_ret_encode_fns, 0, 0 },
+  { "simcall", ICLASS_xt_iclass_simcall,
+    0,
+    Opcode_simcall_encode_fns, 0, 0 },
   { "s16i", ICLASS_xt_iclass_s16i,
     0,
     Opcode_s16i_encode_fns, 0, 0 },
@@ -27269,15 +27173,15 @@ static xtensa_opcode_internal opcodes[] = {
   { "xsr.litbase", ICLASS_xt_iclass_xsr_litbase,
     0,
     Opcode_xsr_litbase_encode_fns, 0, 0 },
-  { "rsr.176", ICLASS_xt_iclass_rsr_176,
+  { "rsr.configid0", ICLASS_xt_iclass_rsr_configid0,
     0,
-    Opcode_rsr_176_encode_fns, 0, 0 },
-  { "wsr.176", ICLASS_xt_iclass_wsr_176,
+    Opcode_rsr_configid0_encode_fns, 0, 0 },
+  { "wsr.configid0", ICLASS_xt_iclass_wsr_configid0,
     0,
-    Opcode_wsr_176_encode_fns, 0, 0 },
-  { "rsr.208", ICLASS_xt_iclass_rsr_208,
+    Opcode_wsr_configid0_encode_fns, 0, 0 },
+  { "rsr.configid1", ICLASS_xt_iclass_rsr_configid1,
     0,
-    Opcode_rsr_208_encode_fns, 0, 0 },
+    Opcode_rsr_configid1_encode_fns, 0, 0 },
   { "rsr.ps", ICLASS_xt_iclass_rsr_ps,
     0,
     Opcode_rsr_ps_encode_fns, 0, 0 },
@@ -28836,7 +28740,6 @@ enum xtensa_opcode_id {
   OPCODE_RFE,
   OPCODE_RFDE,
   OPCODE_SYSCALL,
-  OPCODE_SIMCALL,
   OPCODE_CALL12,
   OPCODE_CALL8,
   OPCODE_CALL4,
@@ -28931,6 +28834,7 @@ enum xtensa_opcode_id {
   OPCODE_ABS,
   OPCODE_NOP,
   OPCODE_RET,
+  OPCODE_SIMCALL,
   OPCODE_S16I,
   OPCODE_S32I,
   OPCODE_S8I,
@@ -28968,9 +28872,9 @@ enum xtensa_opcode_id {
   OPCODE_RSR_LITBASE,
   OPCODE_WSR_LITBASE,
   OPCODE_XSR_LITBASE,
-  OPCODE_RSR_176,
-  OPCODE_WSR_176,
-  OPCODE_RSR_208,
+  OPCODE_RSR_CONFIGID0,
+  OPCODE_WSR_CONFIGID0,
+  OPCODE_RSR_CONFIGID1,
   OPCODE_RSR_PS,
   OPCODE_WSR_PS,
   OPCODE_XSR_PS,
@@ -29496,1327 +29400,1252 @@ enum xtensa_opcode_id {
 static int
 Slot_inst_decode (const xtensa_insnbuf insn)
 {
-  switch (Field_op0_Slot_inst_get (insn))
+  if (Field_op0_Slot_inst_get (insn) == 0)
     {
-    case 0:
-      switch (Field_op1_Slot_inst_get (insn))
+      if (Field_op1_Slot_inst_get (insn) == 0)
 	{
-	case 0:
-	  switch (Field_op2_Slot_inst_get (insn))
+	  if (Field_op2_Slot_inst_get (insn) == 0)
 	    {
-	    case 0:
-	      switch (Field_r_Slot_inst_get (insn))
+	      if (Field_r_Slot_inst_get (insn) == 0)
 		{
-		case 0:
-		  switch (Field_m_Slot_inst_get (insn))
-		    {
-		    case 0:
-		      if (Field_s_Slot_inst_get (insn) == 0 &&
-			  Field_n_Slot_inst_get (insn) == 0)
-			return OPCODE_ILL;
-		      break;
-		    case 2:
-		      switch (Field_n_Slot_inst_get (insn))
-			{
-			case 0:
-			  return OPCODE_RET;
-			case 1:
-			  return OPCODE_RETW;
-			case 2:
-			  return OPCODE_JX;
-			}
-		      break;
-		    case 3:
-		      switch (Field_n_Slot_inst_get (insn))
-			{
-			case 0:
-			  return OPCODE_CALLX0;
-			case 1:
-			  return OPCODE_CALLX4;
-			case 2:
-			  return OPCODE_CALLX8;
-			case 3:
-			  return OPCODE_CALLX12;
-			}
-		      break;
-		    }
-		  break;
-		case 1:
-		  return OPCODE_MOVSP;
-		case 2:
-		  if (Field_s_Slot_inst_get (insn) == 0)
-		    {
-		      switch (Field_t_Slot_inst_get (insn))
-			{
-			case 0:
-			  return OPCODE_ISYNC;
-			case 1:
-			  return OPCODE_RSYNC;
-			case 2:
-			  return OPCODE_ESYNC;
-			case 3:
-			  return OPCODE_DSYNC;
-			case 8:
-			  return OPCODE_EXCW;
-			case 12:
-			  return OPCODE_MEMW;
-			case 13:
-			  return OPCODE_EXTW;
-			case 15:
-			  return OPCODE_NOP;
-			}
-		    }
-		  break;
-		case 3:
-		  switch (Field_t_Slot_inst_get (insn))
+		  if (Field_m_Slot_inst_get (insn) == 0 &&
+		      Field_s_Slot_inst_get (insn) == 0 &&
+		      Field_n_Slot_inst_get (insn) == 0)
+		    return OPCODE_ILL;
+		  if (Field_m_Slot_inst_get (insn) == 2)
 		    {
-		    case 0:
-		      switch (Field_s_Slot_inst_get (insn))
-			{
-			case 0:
-			  return OPCODE_RFE;
-			case 2:
-			  return OPCODE_RFDE;
-			case 4:
-			  return OPCODE_RFWO;
-			case 5:
-			  return OPCODE_RFWU;
-			}
-		      break;
-		    case 1:
-		      return OPCODE_RFI;
+		      if (Field_n_Slot_inst_get (insn) == 0)
+			return OPCODE_RET;
+		      if (Field_n_Slot_inst_get (insn) == 1)
+			return OPCODE_RETW;
+		      if (Field_n_Slot_inst_get (insn) == 2)
+			return OPCODE_JX;
 		    }
-		  break;
-		case 4:
-		  return OPCODE_BREAK;
-		case 5:
-		  switch (Field_s_Slot_inst_get (insn))
+		  if (Field_m_Slot_inst_get (insn) == 3)
 		    {
-		    case 0:
-		      if (Field_t_Slot_inst_get (insn) == 0)
-			return OPCODE_SYSCALL;
-		      break;
-		    case 1:
-		      if (Field_t_Slot_inst_get (insn) == 0)
-			return OPCODE_SIMCALL;
-		      break;
+		      if (Field_n_Slot_inst_get (insn) == 0)
+			return OPCODE_CALLX0;
+		      if (Field_n_Slot_inst_get (insn) == 1)
+			return OPCODE_CALLX4;
+		      if (Field_n_Slot_inst_get (insn) == 2)
+			return OPCODE_CALLX8;
+		      if (Field_n_Slot_inst_get (insn) == 3)
+			return OPCODE_CALLX12;
 		    }
-		  break;
-		case 6:
-		  return OPCODE_RSIL;
-		case 7:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_WAITI;
-		  break;
-		case 8:
-		  return OPCODE_ANY4;
-		case 9:
-		  return OPCODE_ALL4;
-		case 10:
-		  return OPCODE_ANY8;
-		case 11:
-		  return OPCODE_ALL8;
 		}
-	      break;
-	    case 1:
-	      return OPCODE_AND;
-	    case 2:
-	      return OPCODE_OR;
-	    case 3:
-	      return OPCODE_XOR;
-	    case 4:
-	      switch (Field_r_Slot_inst_get (insn))
+	      if (Field_r_Slot_inst_get (insn) == 1)
+		return OPCODE_MOVSP;
+	      if (Field_r_Slot_inst_get (insn) == 2)
 		{
-		case 0:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_SSR;
-		  break;
-		case 1:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_SSL;
-		  break;
-		case 2:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_SSA8L;
-		  break;
-		case 3:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_SSA8B;
-		  break;
-		case 4:
-		  if (Field_thi3_Slot_inst_get (insn) == 0)
-		    return OPCODE_SSAI;
-		  break;
-		case 6:
-		  return OPCODE_RER;
-		case 7:
-		  return OPCODE_WER;
-		case 8:
 		  if (Field_s_Slot_inst_get (insn) == 0)
-		    return OPCODE_ROTW;
-		  break;
-		case 14:
-		  return OPCODE_NSA;
-		case 15:
-		  return OPCODE_NSAU;
+		    {
+		      if (Field_t_Slot_inst_get (insn) == 0)
+			return OPCODE_ISYNC;
+		      if (Field_t_Slot_inst_get (insn) == 1)
+			return OPCODE_RSYNC;
+		      if (Field_t_Slot_inst_get (insn) == 2)
+			return OPCODE_ESYNC;
+		      if (Field_t_Slot_inst_get (insn) == 3)
+			return OPCODE_DSYNC;
+		      if (Field_t_Slot_inst_get (insn) == 8)
+			return OPCODE_EXCW;
+		      if (Field_t_Slot_inst_get (insn) == 12)
+			return OPCODE_MEMW;
+		      if (Field_t_Slot_inst_get (insn) == 13)
+			return OPCODE_EXTW;
+		      if (Field_t_Slot_inst_get (insn) == 15)
+			return OPCODE_NOP;
+		    }
 		}
-	      break;
-	    case 5:
-	      switch (Field_r_Slot_inst_get (insn))
+	      if (Field_r_Slot_inst_get (insn) == 3)
 		{
-		case 1:
-		  return OPCODE_HWWITLBA;
-		case 3:
-		  return OPCODE_RITLB0;
-		case 4:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_IITLB;
-		  break;
-		case 5:
-		  return OPCODE_PITLB;
-		case 6:
-		  return OPCODE_WITLB;
-		case 7:
-		  return OPCODE_RITLB1;
-		case 9:
-		  return OPCODE_HWWDTLBA;
-		case 11:
-		  return OPCODE_RDTLB0;
-		case 12:
 		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_IDTLB;
-		  break;
-		case 13:
-		  return OPCODE_PDTLB;
-		case 14:
-		  return OPCODE_WDTLB;
-		case 15:
-		  return OPCODE_RDTLB1;
+		    {
+		      if (Field_s_Slot_inst_get (insn) == 0)
+			return OPCODE_RFE;
+		      if (Field_s_Slot_inst_get (insn) == 2)
+			return OPCODE_RFDE;
+		      if (Field_s_Slot_inst_get (insn) == 4)
+			return OPCODE_RFWO;
+		      if (Field_s_Slot_inst_get (insn) == 5)
+			return OPCODE_RFWU;
+		    }
+		  if (Field_t_Slot_inst_get (insn) == 1)
+		    return OPCODE_RFI;
 		}
-	      break;
-	    case 6:
-	      switch (Field_s_Slot_inst_get (insn))
+	      if (Field_r_Slot_inst_get (insn) == 4)
+		return OPCODE_BREAK;
+	      if (Field_r_Slot_inst_get (insn) == 5)
 		{
-		case 0:
-		  return OPCODE_NEG;
-		case 1:
-		  return OPCODE_ABS;
+		  if (Field_s_Slot_inst_get (insn) == 0 &&
+		      Field_t_Slot_inst_get (insn) == 0)
+		    return OPCODE_SYSCALL;
+		  if (Field_s_Slot_inst_get (insn) == 1 &&
+		      Field_t_Slot_inst_get (insn) == 0)
+		    return OPCODE_SIMCALL;
 		}
-	      break;
-	    case 8:
-	      return OPCODE_ADD;
-	    case 9:
-	      return OPCODE_ADDX2;
-	    case 10:
-	      return OPCODE_ADDX4;
-	    case 11:
-	      return OPCODE_ADDX8;
-	    case 12:
-	      return OPCODE_SUB;
-	    case 13:
-	      return OPCODE_SUBX2;
-	    case 14:
-	      return OPCODE_SUBX4;
-	    case 15:
-	      return OPCODE_SUBX8;
+	      if (Field_r_Slot_inst_get (insn) == 6)
+		return OPCODE_RSIL;
+	      if (Field_r_Slot_inst_get (insn) == 7 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_WAITI;
+	      if (Field_r_Slot_inst_get (insn) == 8)
+		return OPCODE_ANY4;
+	      if (Field_r_Slot_inst_get (insn) == 9)
+		return OPCODE_ALL4;
+	      if (Field_r_Slot_inst_get (insn) == 10)
+		return OPCODE_ANY8;
+	      if (Field_r_Slot_inst_get (insn) == 11)
+		return OPCODE_ALL8;
 	    }
-	  break;
-	case 1:
-	  switch (Field_op2_Slot_inst_get (insn))
+	  if (Field_op2_Slot_inst_get (insn) == 1)
+	    return OPCODE_AND;
+	  if (Field_op2_Slot_inst_get (insn) == 2)
+	    return OPCODE_OR;
+	  if (Field_op2_Slot_inst_get (insn) == 3)
+	    return OPCODE_XOR;
+	  if (Field_op2_Slot_inst_get (insn) == 4)
 	    {
-	    case 0:
-	    case 1:
-	      return OPCODE_SLLI;
-	    case 2:
-	    case 3:
-	      return OPCODE_SRAI;
-	    case 4:
-	      return OPCODE_SRLI;
-	    case 6:
-	      switch (Field_sr_Slot_inst_get (insn))
-		{
-		case 0:
-		  return OPCODE_XSR_LBEG;
-		case 1:
-		  return OPCODE_XSR_LEND;
-		case 2:
-		  return OPCODE_XSR_LCOUNT;
-		case 3:
-		  return OPCODE_XSR_SAR;
-		case 4:
-		  return OPCODE_XSR_BR;
-		case 5:
-		  return OPCODE_XSR_LITBASE;
-		case 12:
-		  return OPCODE_XSR_SCOMPARE1;
-		case 72:
-		  return OPCODE_XSR_WINDOWBASE;
-		case 73:
-		  return OPCODE_XSR_WINDOWSTART;
-		case 83:
-		  return OPCODE_XSR_PTEVADDR;
-		case 90:
-		  return OPCODE_XSR_RASID;
-		case 91:
-		  return OPCODE_XSR_ITLBCFG;
-		case 92:
-		  return OPCODE_XSR_DTLBCFG;
-		case 99:
-		  return OPCODE_XSR_ATOMCTL;
-		case 104:
-		  return OPCODE_XSR_DDR;
-		case 177:
-		  return OPCODE_XSR_EPC1;
-		case 178:
-		  return OPCODE_XSR_EPC2;
-		case 192:
-		  return OPCODE_XSR_DEPC;
-		case 194:
-		  return OPCODE_XSR_EPS2;
-		case 209:
-		  return OPCODE_XSR_EXCSAVE1;
-		case 210:
-		  return OPCODE_XSR_EXCSAVE2;
-		case 224:
-		  return OPCODE_XSR_CPENABLE;
-		case 228:
-		  return OPCODE_XSR_INTENABLE;
-		case 230:
-		  return OPCODE_XSR_PS;
-		case 231:
-		  return OPCODE_XSR_VECBASE;
-		case 232:
-		  return OPCODE_XSR_EXCCAUSE;
-		case 233:
-		  return OPCODE_XSR_DEBUGCAUSE;
-		case 234:
-		  return OPCODE_XSR_CCOUNT;
-		case 236:
-		  return OPCODE_XSR_ICOUNT;
-		case 237:
-		  return OPCODE_XSR_ICOUNTLEVEL;
-		case 238:
-		  return OPCODE_XSR_EXCVADDR;
-		case 240:
-		  return OPCODE_XSR_CCOMPARE0;
-		case 241:
-		  return OPCODE_XSR_CCOMPARE1;
-		case 244:
-		  return OPCODE_XSR_MISC0;
-		case 245:
-		  return OPCODE_XSR_MISC1;
-		}
-	      break;
-	    case 8:
-	      return OPCODE_SRC;
-	    case 9:
-	      if (Field_s_Slot_inst_get (insn) == 0)
-		return OPCODE_SRL;
-	      break;
-	    case 10:
-	      if (Field_t_Slot_inst_get (insn) == 0)
-		return OPCODE_SLL;
-	      break;
-	    case 11:
-	      if (Field_s_Slot_inst_get (insn) == 0)
-		return OPCODE_SRA;
-	      break;
-	    case 12:
-	      return OPCODE_MUL16U;
-	    case 13:
-	      return OPCODE_MUL16S;
-	    case 15:
-	      switch (Field_r_Slot_inst_get (insn))
-		{
-		case 0:
-		  return OPCODE_LICT;
-		case 1:
-		  return OPCODE_SICT;
-		case 2:
-		  return OPCODE_LICW;
-		case 3:
-		  return OPCODE_SICW;
-		case 8:
-		  return OPCODE_LDCT;
-		case 9:
-		  return OPCODE_SDCT;
-		case 14:
-		  if (Field_t_Slot_inst_get (insn) == 0)
-		    return OPCODE_RFDO;
-		  if (Field_t_Slot_inst_get (insn) == 1)
-		    return OPCODE_RFDD;
-		  break;
-		case 15:
-		  return OPCODE_LDPTE;
-		}
-	      break;
+	      if (Field_r_Slot_inst_get (insn) == 0 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_SSR;
+	      if (Field_r_Slot_inst_get (insn) == 1 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_SSL;
+	      if (Field_r_Slot_inst_get (insn) == 2 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_SSA8L;
+	      if (Field_r_Slot_inst_get (insn) == 3 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_SSA8B;
+	      if (Field_r_Slot_inst_get (insn) == 4 &&
+		  Field_thi3_Slot_inst_get (insn) == 0)
+		return OPCODE_SSAI;
+	      if (Field_r_Slot_inst_get (insn) == 6)
+		return OPCODE_RER;
+	      if (Field_r_Slot_inst_get (insn) == 7)
+		return OPCODE_WER;
+	      if (Field_r_Slot_inst_get (insn) == 8 &&
+		  Field_s_Slot_inst_get (insn) == 0)
+		return OPCODE_ROTW;
+	      if (Field_r_Slot_inst_get (insn) == 14)
+		return OPCODE_NSA;
+	      if (Field_r_Slot_inst_get (insn) == 15)
+		return OPCODE_NSAU;
 	    }
-	  break;
-	case 2:
-	  switch (Field_op2_Slot_inst_get (insn))
+	  if (Field_op2_Slot_inst_get (insn) == 5)
 	    {
-	    case 0:
-	      return OPCODE_ANDB;
-	    case 1:
-	      return OPCODE_ANDBC;
-	    case 2:
-	      return OPCODE_ORB;
-	    case 3:
-	      return OPCODE_ORBC;
-	    case 4:
-	      return OPCODE_XORB;
-	    case 8:
-	      return OPCODE_MULL;
+	      if (Field_r_Slot_inst_get (insn) == 1)
+		return OPCODE_HWWITLBA;
+	      if (Field_r_Slot_inst_get (insn) == 3)
+		return OPCODE_RITLB0;
+	      if (Field_r_Slot_inst_get (insn) == 4 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_IITLB;
+	      if (Field_r_Slot_inst_get (insn) == 5)
+		return OPCODE_PITLB;
+	      if (Field_r_Slot_inst_get (insn) == 6)
+		return OPCODE_WITLB;
+	      if (Field_r_Slot_inst_get (insn) == 7)
+		return OPCODE_RITLB1;
+	      if (Field_r_Slot_inst_get (insn) == 9)
+		return OPCODE_HWWDTLBA;
+	      if (Field_r_Slot_inst_get (insn) == 11)
+		return OPCODE_RDTLB0;
+	      if (Field_r_Slot_inst_get (insn) == 12 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_IDTLB;
+	      if (Field_r_Slot_inst_get (insn) == 13)
+		return OPCODE_PDTLB;
+	      if (Field_r_Slot_inst_get (insn) == 14)
+		return OPCODE_WDTLB;
+	      if (Field_r_Slot_inst_get (insn) == 15)
+		return OPCODE_RDTLB1;
 	    }
-	  break;
-	case 3:
-	  switch (Field_op2_Slot_inst_get (insn))
+	  if (Field_op2_Slot_inst_get (insn) == 6)
 	    {
-	    case 0:
-	      switch (Field_sr_Slot_inst_get (insn))
-		{
-		case 0:
-		  return OPCODE_RSR_LBEG;
-		case 1:
-		  return OPCODE_RSR_LEND;
-		case 2:
-		  return OPCODE_RSR_LCOUNT;
-		case 3:
-		  return OPCODE_RSR_SAR;
-		case 4:
-		  return OPCODE_RSR_BR;
-		case 5:
-		  return OPCODE_RSR_LITBASE;
-		case 12:
-		  return OPCODE_RSR_SCOMPARE1;
-		case 72:
-		  return OPCODE_RSR_WINDOWBASE;
-		case 73:
-		  return OPCODE_RSR_WINDOWSTART;
-		case 83:
-		  return OPCODE_RSR_PTEVADDR;
-		case 90:
-		  return OPCODE_RSR_RASID;
-		case 91:
-		  return OPCODE_RSR_ITLBCFG;
-		case 92:
-		  return OPCODE_RSR_DTLBCFG;
-		case 99:
-		  return OPCODE_RSR_ATOMCTL;
-		case 104:
-		  return OPCODE_RSR_DDR;
-		case 176:
-		  return OPCODE_RSR_176;
-		case 177:
-		  return OPCODE_RSR_EPC1;
-		case 178:
-		  return OPCODE_RSR_EPC2;
-		case 192:
-		  return OPCODE_RSR_DEPC;
-		case 194:
-		  return OPCODE_RSR_EPS2;
-		case 208:
-		  return OPCODE_RSR_208;
-		case 209:
-		  return OPCODE_RSR_EXCSAVE1;
-		case 210:
-		  return OPCODE_RSR_EXCSAVE2;
-		case 224:
-		  return OPCODE_RSR_CPENABLE;
-		case 226:
-		  return OPCODE_RSR_INTERRUPT;
-		case 228:
-		  return OPCODE_RSR_INTENABLE;
-		case 230:
-		  return OPCODE_RSR_PS;
-		case 231:
-		  return OPCODE_RSR_VECBASE;
-		case 232:
-		  return OPCODE_RSR_EXCCAUSE;
-		case 233:
-		  return OPCODE_RSR_DEBUGCAUSE;
-		case 234:
-		  return OPCODE_RSR_CCOUNT;
-		case 235:
-		  return OPCODE_RSR_PRID;
-		case 236:
-		  return OPCODE_RSR_ICOUNT;
-		case 237:
-		  return OPCODE_RSR_ICOUNTLEVEL;
-		case 238:
-		  return OPCODE_RSR_EXCVADDR;
-		case 240:
-		  return OPCODE_RSR_CCOMPARE0;
-		case 241:
-		  return OPCODE_RSR_CCOMPARE1;
-		case 244:
-		  return OPCODE_RSR_MISC0;
-		case 245:
-		  return OPCODE_RSR_MISC1;
-		}
-	      break;
-	    case 1:
-	      switch (Field_sr_Slot_inst_get (insn))
-		{
-		case 0:
-		  return OPCODE_WSR_LBEG;
-		case 1:
-		  return OPCODE_WSR_LEND;
-		case 2:
-		  return OPCODE_WSR_LCOUNT;
-		case 3:
-		  return OPCODE_WSR_SAR;
-		case 4:
-		  return OPCODE_WSR_BR;
-		case 5:
-		  return OPCODE_WSR_LITBASE;
-		case 12:
-		  return OPCODE_WSR_SCOMPARE1;
-		case 72:
-		  return OPCODE_WSR_WINDOWBASE;
-		case 73:
-		  return OPCODE_WSR_WINDOWSTART;
-		case 83:
-		  return OPCODE_WSR_PTEVADDR;
-		case 90:
-		  return OPCODE_WSR_RASID;
-		case 91:
-		  return OPCODE_WSR_ITLBCFG;
-		case 92:
-		  return OPCODE_WSR_DTLBCFG;
-		case 99:
-		  return OPCODE_WSR_ATOMCTL;
-		case 104:
-		  return OPCODE_WSR_DDR;
-		case 176:
-		  return OPCODE_WSR_176;
-		case 177:
-		  return OPCODE_WSR_EPC1;
-		case 178:
-		  return OPCODE_WSR_EPC2;
-		case 192:
-		  return OPCODE_WSR_DEPC;
-		case 194:
-		  return OPCODE_WSR_EPS2;
-		case 209:
-		  return OPCODE_WSR_EXCSAVE1;
-		case 210:
-		  return OPCODE_WSR_EXCSAVE2;
-		case 224:
-		  return OPCODE_WSR_CPENABLE;
-		case 226:
-		  return OPCODE_WSR_INTSET;
-		case 227:
-		  return OPCODE_WSR_INTCLEAR;
-		case 228:
-		  return OPCODE_WSR_INTENABLE;
-		case 230:
-		  return OPCODE_WSR_PS;
-		case 231:
-		  return OPCODE_WSR_VECBASE;
-		case 232:
-		  return OPCODE_WSR_EXCCAUSE;
-		case 233:
-		  return OPCODE_WSR_DEBUGCAUSE;
-		case 234:
-		  return OPCODE_WSR_CCOUNT;
-		case 236:
-		  return OPCODE_WSR_ICOUNT;
-		case 237:
-		  return OPCODE_WSR_ICOUNTLEVEL;
-		case 238:
-		  return OPCODE_WSR_EXCVADDR;
-		case 240:
-		  return OPCODE_WSR_CCOMPARE0;
-		case 241:
-		  return OPCODE_WSR_CCOMPARE1;
-		case 244:
-		  return OPCODE_WSR_MISC0;
-		case 245:
-		  return OPCODE_WSR_MISC1;
-		}
-	      break;
-	    case 2:
-	      return OPCODE_SEXT;
-	    case 3:
-	      return OPCODE_CLAMPS;
-	    case 4:
-	      return OPCODE_MIN;
-	    case 5:
-	      return OPCODE_MAX;
-	    case 6:
-	      return OPCODE_MINU;
-	    case 7:
-	      return OPCODE_MAXU;
-	    case 8:
-	      return OPCODE_MOVEQZ;
-	    case 9:
-	      return OPCODE_MOVNEZ;
-	    case 10:
-	      return OPCODE_MOVLTZ;
-	    case 11:
-	      return OPCODE_MOVGEZ;
-	    case 12:
-	      return OPCODE_MOVF;
-	    case 13:
-	      return OPCODE_MOVT;
-	    case 14:
-	      switch (Field_st_Slot_inst_get (insn))
-		{
-		case 231:
-		  return OPCODE_RUR_THREADPTR;
-		case 240:
-		  return OPCODE_RUR_AE_OVF_SAR;
-		case 241:
-		  return OPCODE_RUR_AE_BITHEAD;
-		case 242:
-		  return OPCODE_RUR_AE_TS_FTS_BU_BP;
-		case 243:
-		  return OPCODE_RUR_AE_SD_NO;
-		}
-	      break;
-	    case 15:
-	      switch (Field_sr_Slot_inst_get (insn))
-		{
-		case 231:
-		  return OPCODE_WUR_THREADPTR;
-		case 240:
-		  return OPCODE_WUR_AE_OVF_SAR;
-		case 241:
-		  return OPCODE_WUR_AE_BITHEAD;
-		case 242:
-		  return OPCODE_WUR_AE_TS_FTS_BU_BP;
-		case 243:
-		  return OPCODE_WUR_AE_SD_NO;
-		}
-	      break;
-	    }
-	  break;
-	case 4:
-	case 5:
-	  return OPCODE_EXTUI;
-	case 9:
-	  switch (Field_op2_Slot_inst_get (insn))
-	    {
-	    case 0:
-	      return OPCODE_L32E;
-	    case 4:
-	      return OPCODE_S32E;
+	      if (Field_s_Slot_inst_get (insn) == 0)
+		return OPCODE_NEG;
+	      if (Field_s_Slot_inst_get (insn) == 1)
+		return OPCODE_ABS;
 	    }
-	  break;
+	  if (Field_op2_Slot_inst_get (insn) == 8)
+	    return OPCODE_ADD;
+	  if (Field_op2_Slot_inst_get (insn) == 9)
+	    return OPCODE_ADDX2;
+	  if (Field_op2_Slot_inst_get (insn) == 10)
+	    return OPCODE_ADDX4;
+	  if (Field_op2_Slot_inst_get (insn) == 11)
+	    return OPCODE_ADDX8;
+	  if (Field_op2_Slot_inst_get (insn) == 12)
+	    return OPCODE_SUB;
+	  if (Field_op2_Slot_inst_get (insn) == 13)
+	    return OPCODE_SUBX2;
+	  if (Field_op2_Slot_inst_get (insn) == 14)
+	    return OPCODE_SUBX4;
+	  if (Field_op2_Slot_inst_get (insn) == 15)
+	    return OPCODE_SUBX8;
 	}
-      break;
-    case 1:
-      return OPCODE_L32R;
-    case 2:
-      switch (Field_r_Slot_inst_get (insn))
+      if (Field_op1_Slot_inst_get (insn) == 1)
 	{
-	case 0:
-	  return OPCODE_L8UI;
-	case 1:
-	  return OPCODE_L16UI;
-	case 2:
-	  return OPCODE_L32I;
-	case 4:
-	  return OPCODE_S8I;
-	case 5:
-	  return OPCODE_S16I;
-	case 6:
-	  return OPCODE_S32I;
-	case 7:
-	  switch (Field_t_Slot_inst_get (insn))
+	  if ((Field_op2_Slot_inst_get (insn) == 0 ||
+	       Field_op2_Slot_inst_get (insn) == 1))
+	    return OPCODE_SLLI;
+	  if ((Field_op2_Slot_inst_get (insn) == 2 ||
+	       Field_op2_Slot_inst_get (insn) == 3))
+	    return OPCODE_SRAI;
+	  if (Field_op2_Slot_inst_get (insn) == 4)
+	    return OPCODE_SRLI;
+	  if (Field_op2_Slot_inst_get (insn) == 6)
 	    {
-	    case 0:
-	      return OPCODE_DPFR;
-	    case 1:
-	      return OPCODE_DPFW;
-	    case 2:
-	      return OPCODE_DPFRO;
-	    case 3:
-	      return OPCODE_DPFWO;
-	    case 4:
-	      return OPCODE_DHWB;
-	    case 5:
-	      return OPCODE_DHWBI;
-	    case 6:
-	      return OPCODE_DHI;
-	    case 7:
-	      return OPCODE_DII;
-	    case 8:
-	      switch (Field_op1_Slot_inst_get (insn))
-		{
-		case 4:
-		  return OPCODE_DIWB;
-		case 5:
-		  return OPCODE_DIWBI;
-		}
-	      break;
-	    case 12:
-	      return OPCODE_IPF;
-	    case 14:
-	      return OPCODE_IHI;
-	    case 15:
-	      return OPCODE_III;
+	      if (Field_sr_Slot_inst_get (insn) == 0)
+		return OPCODE_XSR_LBEG;
+	      if (Field_sr_Slot_inst_get (insn) == 1)
+		return OPCODE_XSR_LEND;
+	      if (Field_sr_Slot_inst_get (insn) == 2)
+		return OPCODE_XSR_LCOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 3)
+		return OPCODE_XSR_SAR;
+	      if (Field_sr_Slot_inst_get (insn) == 4)
+		return OPCODE_XSR_BR;
+	      if (Field_sr_Slot_inst_get (insn) == 5)
+		return OPCODE_XSR_LITBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 12)
+		return OPCODE_XSR_SCOMPARE1;
+	      if (Field_sr_Slot_inst_get (insn) == 72)
+		return OPCODE_XSR_WINDOWBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 73)
+		return OPCODE_XSR_WINDOWSTART;
+	      if (Field_sr_Slot_inst_get (insn) == 83)
+		return OPCODE_XSR_PTEVADDR;
+	      if (Field_sr_Slot_inst_get (insn) == 90)
+		return OPCODE_XSR_RASID;
+	      if (Field_sr_Slot_inst_get (insn) == 91)
+		return OPCODE_XSR_ITLBCFG;
+	      if (Field_sr_Slot_inst_get (insn) == 92)
+		return OPCODE_XSR_DTLBCFG;
+	      if (Field_sr_Slot_inst_get (insn) == 99)
+		return OPCODE_XSR_ATOMCTL;
+	      if (Field_sr_Slot_inst_get (insn) == 104)
+		return OPCODE_XSR_DDR;
+	      if (Field_sr_Slot_inst_get (insn) == 177)
+		return OPCODE_XSR_EPC1;
+	      if (Field_sr_Slot_inst_get (insn) == 178)
+		return OPCODE_XSR_EPC2;
+	      if (Field_sr_Slot_inst_get (insn) == 192)
+		return OPCODE_XSR_DEPC;
+	      if (Field_sr_Slot_inst_get (insn) == 194)
+		return OPCODE_XSR_EPS2;
+	      if (Field_sr_Slot_inst_get (insn) == 209)
+		return OPCODE_XSR_EXCSAVE1;
+	      if (Field_sr_Slot_inst_get (insn) == 210)
+		return OPCODE_XSR_EXCSAVE2;
+	      if (Field_sr_Slot_inst_get (insn) == 224)
+		return OPCODE_XSR_CPENABLE;
+	      if (Field_sr_Slot_inst_get (insn) == 228)
+		return OPCODE_XSR_INTENABLE;
+	      if (Field_sr_Slot_inst_get (insn) == 230)
+		return OPCODE_XSR_PS;
+	      if (Field_sr_Slot_inst_get (insn) == 231)
+		return OPCODE_XSR_VECBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 232)
+		return OPCODE_XSR_EXCCAUSE;
+	      if (Field_sr_Slot_inst_get (insn) == 233)
+		return OPCODE_XSR_DEBUGCAUSE;
+	      if (Field_sr_Slot_inst_get (insn) == 234)
+		return OPCODE_XSR_CCOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 236)
+		return OPCODE_XSR_ICOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 237)
+		return OPCODE_XSR_ICOUNTLEVEL;
+	      if (Field_sr_Slot_inst_get (insn) == 238)
+		return OPCODE_XSR_EXCVADDR;
+	      if (Field_sr_Slot_inst_get (insn) == 240)
+		return OPCODE_XSR_CCOMPARE0;
+	      if (Field_sr_Slot_inst_get (insn) == 241)
+		return OPCODE_XSR_CCOMPARE1;
+	      if (Field_sr_Slot_inst_get (insn) == 244)
+		return OPCODE_XSR_MISC0;
+	      if (Field_sr_Slot_inst_get (insn) == 245)
+		return OPCODE_XSR_MISC1;
+	    }
+	  if (Field_op2_Slot_inst_get (insn) == 8)
+	    return OPCODE_SRC;
+	  if (Field_op2_Slot_inst_get (insn) == 9 &&
+	      Field_s_Slot_inst_get (insn) == 0)
+	    return OPCODE_SRL;
+	  if (Field_op2_Slot_inst_get (insn) == 10 &&
+	      Field_t_Slot_inst_get (insn) == 0)
+	    return OPCODE_SLL;
+	  if (Field_op2_Slot_inst_get (insn) == 11 &&
+	      Field_s_Slot_inst_get (insn) == 0)
+	    return OPCODE_SRA;
+	  if (Field_op2_Slot_inst_get (insn) == 12)
+	    return OPCODE_MUL16U;
+	  if (Field_op2_Slot_inst_get (insn) == 13)
+	    return OPCODE_MUL16S;
+	  if (Field_op2_Slot_inst_get (insn) == 15)
+	    {
+	      if (Field_r_Slot_inst_get (insn) == 0)
+		return OPCODE_LICT;
+	      if (Field_r_Slot_inst_get (insn) == 1)
+		return OPCODE_SICT;
+	      if (Field_r_Slot_inst_get (insn) == 2)
+		return OPCODE_LICW;
+	      if (Field_r_Slot_inst_get (insn) == 3)
+		return OPCODE_SICW;
+	      if (Field_r_Slot_inst_get (insn) == 8)
+		return OPCODE_LDCT;
+	      if (Field_r_Slot_inst_get (insn) == 9)
+		return OPCODE_SDCT;
+	      if (Field_r_Slot_inst_get (insn) == 14 &&
+		  Field_t_Slot_inst_get (insn) == 0)
+		return OPCODE_RFDO;
+	      if (Field_r_Slot_inst_get (insn) == 14 &&
+		  Field_t_Slot_inst_get (insn) == 1)
+		return OPCODE_RFDD;
+	      if (Field_r_Slot_inst_get (insn) == 15)
+		return OPCODE_LDPTE;
 	    }
-	  break;
-	case 9:
-	  return OPCODE_L16SI;
-	case 10:
-	  return OPCODE_MOVI;
-	case 11:
-	  return OPCODE_L32AI;
-	case 12:
-	  return OPCODE_ADDI;
-	case 13:
-	  return OPCODE_ADDMI;
-	case 14:
-	  return OPCODE_S32C1I;
-	case 15:
-	  return OPCODE_S32RI;
-	}
-      break;
-    case 4:
-      switch (Field_ae_r10_Slot_inst_get (insn))
-	{
-	case 0:
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ56_I;
-	  if (Field_op1_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ56_X;
-	  break;
-	case 1:
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ32F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ32F_X;
-	  break;
-	case 2:
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ56_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ56_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_t_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_CVTQ48A32S;
-	  break;
-	case 3:
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ32F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LQ32F_XU;
-	  break;
-	}
-      switch (Field_ae_r3_Slot_inst_get (insn))
-	{
-	case 0:
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 12 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 15 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16F_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 6 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 13 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 0 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_LP24F_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24X2F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 11 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24X2F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 14 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24X2F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_LP24X2F_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16X2F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16X2F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 8 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16X2F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 11 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16X2F_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 6 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 12 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2F_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 4 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24S_L_I;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24S_L_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24S_L_X;
-	  if (Field_op1_Slot_inst_get (insn) == 13 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24S_L_XU;
-	  if (Field_ae_s3_Slot_inst_get (insn) == 0 &&
-	      Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_MOVP48;
-	  if (Field_op1_Slot_inst_get (insn) == 0 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_MOVPA24X2;
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 11 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_CVTA32P24_L;
-	  if (Field_op1_Slot_inst_get (insn) == 14 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_CVTP24A16X2_LL;
-	  if (Field_op1_Slot_inst_get (insn) == 15 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_CVTP24A16X2_HL;
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_MOVAP24S_L;
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 8 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_TRUNCA16P24S_L;
-	  break;
-	case 1:
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24_I;
-	  if (Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 12 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24_X;
-	  if (Field_op1_Slot_inst_get (insn) == 15 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 6 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16X2F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16X2F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 13 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP16X2F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 0 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_LP16X2F_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24X2_I;
-	  if (Field_op1_Slot_inst_get (insn) == 11 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24X2_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 14 &&
-	      Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LP24X2_X;
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_LP24X2_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2S_I;
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2S_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 8 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2S_X;
-	  if (Field_op1_Slot_inst_get (insn) == 11 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24X2S_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16F_L_I;
-	  if (Field_op1_Slot_inst_get (insn) == 6 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16F_L_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16F_L_X;
-	  if (Field_op1_Slot_inst_get (insn) == 12 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP16F_L_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 4 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24F_L_I;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24F_L_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24F_L_X;
-	  if (Field_op1_Slot_inst_get (insn) == 13 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_SP24F_L_XU;
-	  if (Field_op1_Slot_inst_get (insn) == 0 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_TRUNCP24A32X2;
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 11 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_CVTA32P24_H;
-	  if (Field_op1_Slot_inst_get (insn) == 14 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_CVTP24A16X2_LH;
-	  if (Field_op1_Slot_inst_get (insn) == 15 &&
-	      Field_op2_Slot_inst_get (insn) == 11)
-	    return OPCODE_AE_CVTP24A16X2_HH;
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_MOVAP24S_H;
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 8 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_TRUNCA16P24S_H;
-	  break;
-	}
-      switch (Field_ae_r32_Slot_inst_get (insn))
-	{
-	case 0:
-	  if (Field_op1_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ56S_I;
-	  if (Field_op1_Slot_inst_get (insn) == 4 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ56S_X;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_TRUNCA32Q48;
-	  break;
-	case 1:
-	  if (Field_op1_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ32F_I;
-	  if (Field_op1_Slot_inst_get (insn) == 4 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ32F_X;
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_NSAQ56S;
-	  break;
-	case 2:
-	  if (Field_op1_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ56S_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 4 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ56S_XU;
-	  break;
-	case 3:
-	  if (Field_op1_Slot_inst_get (insn) == 3 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ32F_IU;
-	  if (Field_op1_Slot_inst_get (insn) == 4 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SQ32F_XU;
-	  break;
 	}
-      switch (Field_ae_s_non_samt_Slot_inst_get (insn))
+      if (Field_op1_Slot_inst_get (insn) == 2)
 	{
-	case 0:
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SLLIQ56;
-	  break;
-	case 1:
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SRLIQ56;
-	  break;
-	case 2:
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SRAIQ56;
-	  break;
-	case 3:
-	  if (Field_op1_Slot_inst_get (insn) == 5 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SLLISQ56S;
-	  break;
+	  if (Field_op2_Slot_inst_get (insn) == 0)
+	    return OPCODE_ANDB;
+	  if (Field_op2_Slot_inst_get (insn) == 1)
+	    return OPCODE_ANDBC;
+	  if (Field_op2_Slot_inst_get (insn) == 2)
+	    return OPCODE_ORB;
+	  if (Field_op2_Slot_inst_get (insn) == 3)
+	    return OPCODE_ORBC;
+	  if (Field_op2_Slot_inst_get (insn) == 4)
+	    return OPCODE_XORB;
+	  if (Field_op2_Slot_inst_get (insn) == 8)
+	    return OPCODE_MULL;
 	}
-      switch (Field_op1_Slot_inst_get (insn))
+      if (Field_op1_Slot_inst_get (insn) == 3)
 	{
-	case 0:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_SHA32;
-	  if (Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_VLDL32T;
-	  break;
-	case 1:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_SLLAQ56;
-	  if (Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_VLDL16T;
-	  break;
-	case 2:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_SRLAQ56;
-	  if (Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_LBK;
-	  break;
-	case 3:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_SRAAQ56;
-	  if (Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_VLEL32T;
-	  break;
-	case 4:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_SLLASQ56S;
+	  if (Field_op2_Slot_inst_get (insn) == 0)
+	    {
+	      if (Field_sr_Slot_inst_get (insn) == 0)
+		return OPCODE_RSR_LBEG;
+	      if (Field_sr_Slot_inst_get (insn) == 1)
+		return OPCODE_RSR_LEND;
+	      if (Field_sr_Slot_inst_get (insn) == 2)
+		return OPCODE_RSR_LCOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 3)
+		return OPCODE_RSR_SAR;
+	      if (Field_sr_Slot_inst_get (insn) == 4)
+		return OPCODE_RSR_BR;
+	      if (Field_sr_Slot_inst_get (insn) == 5)
+		return OPCODE_RSR_LITBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 12)
+		return OPCODE_RSR_SCOMPARE1;
+	      if (Field_sr_Slot_inst_get (insn) == 72)
+		return OPCODE_RSR_WINDOWBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 73)
+		return OPCODE_RSR_WINDOWSTART;
+	      if (Field_sr_Slot_inst_get (insn) == 83)
+		return OPCODE_RSR_PTEVADDR;
+	      if (Field_sr_Slot_inst_get (insn) == 90)
+		return OPCODE_RSR_RASID;
+	      if (Field_sr_Slot_inst_get (insn) == 91)
+		return OPCODE_RSR_ITLBCFG;
+	      if (Field_sr_Slot_inst_get (insn) == 92)
+		return OPCODE_RSR_DTLBCFG;
+	      if (Field_sr_Slot_inst_get (insn) == 99)
+		return OPCODE_RSR_ATOMCTL;
+	      if (Field_sr_Slot_inst_get (insn) == 104)
+		return OPCODE_RSR_DDR;
+	      if (Field_sr_Slot_inst_get (insn) == 176)
+		return OPCODE_RSR_CONFIGID0;
+	      if (Field_sr_Slot_inst_get (insn) == 177)
+		return OPCODE_RSR_EPC1;
+	      if (Field_sr_Slot_inst_get (insn) == 178)
+		return OPCODE_RSR_EPC2;
+	      if (Field_sr_Slot_inst_get (insn) == 192)
+		return OPCODE_RSR_DEPC;
+	      if (Field_sr_Slot_inst_get (insn) == 194)
+		return OPCODE_RSR_EPS2;
+	      if (Field_sr_Slot_inst_get (insn) == 208)
+		return OPCODE_RSR_CONFIGID1;
+	      if (Field_sr_Slot_inst_get (insn) == 209)
+		return OPCODE_RSR_EXCSAVE1;
+	      if (Field_sr_Slot_inst_get (insn) == 210)
+		return OPCODE_RSR_EXCSAVE2;
+	      if (Field_sr_Slot_inst_get (insn) == 224)
+		return OPCODE_RSR_CPENABLE;
+	      if (Field_sr_Slot_inst_get (insn) == 226)
+		return OPCODE_RSR_INTERRUPT;
+	      if (Field_sr_Slot_inst_get (insn) == 228)
+		return OPCODE_RSR_INTENABLE;
+	      if (Field_sr_Slot_inst_get (insn) == 230)
+		return OPCODE_RSR_PS;
+	      if (Field_sr_Slot_inst_get (insn) == 231)
+		return OPCODE_RSR_VECBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 232)
+		return OPCODE_RSR_EXCCAUSE;
+	      if (Field_sr_Slot_inst_get (insn) == 233)
+		return OPCODE_RSR_DEBUGCAUSE;
+	      if (Field_sr_Slot_inst_get (insn) == 234)
+		return OPCODE_RSR_CCOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 235)
+		return OPCODE_RSR_PRID;
+	      if (Field_sr_Slot_inst_get (insn) == 236)
+		return OPCODE_RSR_ICOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 237)
+		return OPCODE_RSR_ICOUNTLEVEL;
+	      if (Field_sr_Slot_inst_get (insn) == 238)
+		return OPCODE_RSR_EXCVADDR;
+	      if (Field_sr_Slot_inst_get (insn) == 240)
+		return OPCODE_RSR_CCOMPARE0;
+	      if (Field_sr_Slot_inst_get (insn) == 241)
+		return OPCODE_RSR_CCOMPARE1;
+	      if (Field_sr_Slot_inst_get (insn) == 244)
+		return OPCODE_RSR_MISC0;
+	      if (Field_sr_Slot_inst_get (insn) == 245)
+		return OPCODE_RSR_MISC1;
+	    }
+	  if (Field_op2_Slot_inst_get (insn) == 1)
+	    {
+	      if (Field_sr_Slot_inst_get (insn) == 0)
+		return OPCODE_WSR_LBEG;
+	      if (Field_sr_Slot_inst_get (insn) == 1)
+		return OPCODE_WSR_LEND;
+	      if (Field_sr_Slot_inst_get (insn) == 2)
+		return OPCODE_WSR_LCOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 3)
+		return OPCODE_WSR_SAR;
+	      if (Field_sr_Slot_inst_get (insn) == 4)
+		return OPCODE_WSR_BR;
+	      if (Field_sr_Slot_inst_get (insn) == 5)
+		return OPCODE_WSR_LITBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 12)
+		return OPCODE_WSR_SCOMPARE1;
+	      if (Field_sr_Slot_inst_get (insn) == 72)
+		return OPCODE_WSR_WINDOWBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 73)
+		return OPCODE_WSR_WINDOWSTART;
+	      if (Field_sr_Slot_inst_get (insn) == 83)
+		return OPCODE_WSR_PTEVADDR;
+	      if (Field_sr_Slot_inst_get (insn) == 90)
+		return OPCODE_WSR_RASID;
+	      if (Field_sr_Slot_inst_get (insn) == 91)
+		return OPCODE_WSR_ITLBCFG;
+	      if (Field_sr_Slot_inst_get (insn) == 92)
+		return OPCODE_WSR_DTLBCFG;
+	      if (Field_sr_Slot_inst_get (insn) == 99)
+		return OPCODE_WSR_ATOMCTL;
+	      if (Field_sr_Slot_inst_get (insn) == 104)
+		return OPCODE_WSR_DDR;
+	      if (Field_sr_Slot_inst_get (insn) == 176)
+		return OPCODE_WSR_CONFIGID0;
+	      if (Field_sr_Slot_inst_get (insn) == 177)
+		return OPCODE_WSR_EPC1;
+	      if (Field_sr_Slot_inst_get (insn) == 178)
+		return OPCODE_WSR_EPC2;
+	      if (Field_sr_Slot_inst_get (insn) == 192)
+		return OPCODE_WSR_DEPC;
+	      if (Field_sr_Slot_inst_get (insn) == 194)
+		return OPCODE_WSR_EPS2;
+	      if (Field_sr_Slot_inst_get (insn) == 209)
+		return OPCODE_WSR_EXCSAVE1;
+	      if (Field_sr_Slot_inst_get (insn) == 210)
+		return OPCODE_WSR_EXCSAVE2;
+	      if (Field_sr_Slot_inst_get (insn) == 224)
+		return OPCODE_WSR_CPENABLE;
+	      if (Field_sr_Slot_inst_get (insn) == 226)
+		return OPCODE_WSR_INTSET;
+	      if (Field_sr_Slot_inst_get (insn) == 227)
+		return OPCODE_WSR_INTCLEAR;
+	      if (Field_sr_Slot_inst_get (insn) == 228)
+		return OPCODE_WSR_INTENABLE;
+	      if (Field_sr_Slot_inst_get (insn) == 230)
+		return OPCODE_WSR_PS;
+	      if (Field_sr_Slot_inst_get (insn) == 231)
+		return OPCODE_WSR_VECBASE;
+	      if (Field_sr_Slot_inst_get (insn) == 232)
+		return OPCODE_WSR_EXCCAUSE;
+	      if (Field_sr_Slot_inst_get (insn) == 233)
+		return OPCODE_WSR_DEBUGCAUSE;
+	      if (Field_sr_Slot_inst_get (insn) == 234)
+		return OPCODE_WSR_CCOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 236)
+		return OPCODE_WSR_ICOUNT;
+	      if (Field_sr_Slot_inst_get (insn) == 237)
+		return OPCODE_WSR_ICOUNTLEVEL;
+	      if (Field_sr_Slot_inst_get (insn) == 238)
+		return OPCODE_WSR_EXCVADDR;
+	      if (Field_sr_Slot_inst_get (insn) == 240)
+		return OPCODE_WSR_CCOMPARE0;
+	      if (Field_sr_Slot_inst_get (insn) == 241)
+		return OPCODE_WSR_CCOMPARE1;
+	      if (Field_sr_Slot_inst_get (insn) == 244)
+		return OPCODE_WSR_MISC0;
+	      if (Field_sr_Slot_inst_get (insn) == 245)
+		return OPCODE_WSR_MISC1;
+	    }
+	  if (Field_op2_Slot_inst_get (insn) == 2)
+	    return OPCODE_SEXT;
+	  if (Field_op2_Slot_inst_get (insn) == 3)
+	    return OPCODE_CLAMPS;
+	  if (Field_op2_Slot_inst_get (insn) == 4)
+	    return OPCODE_MIN;
+	  if (Field_op2_Slot_inst_get (insn) == 5)
+	    return OPCODE_MAX;
+	  if (Field_op2_Slot_inst_get (insn) == 6)
+	    return OPCODE_MINU;
+	  if (Field_op2_Slot_inst_get (insn) == 7)
+	    return OPCODE_MAXU;
+	  if (Field_op2_Slot_inst_get (insn) == 8)
+	    return OPCODE_MOVEQZ;
+	  if (Field_op2_Slot_inst_get (insn) == 9)
+	    return OPCODE_MOVNEZ;
 	  if (Field_op2_Slot_inst_get (insn) == 10)
-	    return OPCODE_AE_VLEL16T;
-	  break;
-	case 5:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_MOVTQ56;
-	  break;
-	case 6:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_MOVFQ56;
-	  break;
+	    return OPCODE_MOVLTZ;
+	  if (Field_op2_Slot_inst_get (insn) == 11)
+	    return OPCODE_MOVGEZ;
+	  if (Field_op2_Slot_inst_get (insn) == 12)
+	    return OPCODE_MOVF;
+	  if (Field_op2_Slot_inst_get (insn) == 13)
+	    return OPCODE_MOVT;
+	  if (Field_op2_Slot_inst_get (insn) == 14)
+	    {
+	      if (Field_st_Slot_inst_get (insn) == 231)
+		return OPCODE_RUR_THREADPTR;
+	      if (Field_st_Slot_inst_get (insn) == 240)
+		return OPCODE_RUR_AE_OVF_SAR;
+	      if (Field_st_Slot_inst_get (insn) == 241)
+		return OPCODE_RUR_AE_BITHEAD;
+	      if (Field_st_Slot_inst_get (insn) == 242)
+		return OPCODE_RUR_AE_TS_FTS_BU_BP;
+	      if (Field_st_Slot_inst_get (insn) == 243)
+		return OPCODE_RUR_AE_SD_NO;
+	    }
+	  if (Field_op2_Slot_inst_get (insn) == 15)
+	    {
+	      if (Field_sr_Slot_inst_get (insn) == 231)
+		return OPCODE_WUR_THREADPTR;
+	      if (Field_sr_Slot_inst_get (insn) == 240)
+		return OPCODE_WUR_AE_OVF_SAR;
+	      if (Field_sr_Slot_inst_get (insn) == 241)
+		return OPCODE_WUR_AE_BITHEAD;
+	      if (Field_sr_Slot_inst_get (insn) == 242)
+		return OPCODE_WUR_AE_TS_FTS_BU_BP;
+	      if (Field_sr_Slot_inst_get (insn) == 243)
+		return OPCODE_WUR_AE_SD_NO;
+	    }
 	}
-      switch (Field_r_Slot_inst_get (insn))
+      if ((Field_op1_Slot_inst_get (insn) == 4 ||
+	   Field_op1_Slot_inst_get (insn) == 5))
+	return OPCODE_EXTUI;
+      if (Field_op1_Slot_inst_get (insn) == 9)
 	{
-	case 0:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_OVERFLOW;
-	  if (Field_op2_Slot_inst_get (insn) == 15)
-	    return OPCODE_AE_SBI;
-	  break;
-	case 1:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_SAR;
-	  if (Field_op1_Slot_inst_get (insn) == 0 &&
-	      Field_op2_Slot_inst_get (insn) == 15)
-	    return OPCODE_AE_DB;
-	  if (Field_op1_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 15)
-	    return OPCODE_AE_SB;
-	  break;
-	case 2:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_BITPTR;
-	  break;
-	case 3:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_BITSUSED;
-	  break;
-	case 4:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_TABLESIZE;
-	  break;
-	case 5:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_FIRST_TS;
-	  break;
-	case 6:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_NEXTOFFSET;
-	  break;
-	case 7:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_WUR_AE_SEARCHDONE;
-	  break;
-	case 8:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 10 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_VLDSHT;
-	  break;
-	case 12:
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_VLES16C;
-	  break;
-	case 13:
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_SBF;
-	  break;
-	case 14:
-	  if (Field_op1_Slot_inst_get (insn) == 7 &&
-	      Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_VLDL16C;
-	  break;
+	  if (Field_op2_Slot_inst_get (insn) == 0)
+	    return OPCODE_L32E;
+	  if (Field_op2_Slot_inst_get (insn) == 4)
+	    return OPCODE_S32E;
 	}
-      switch (Field_s_Slot_inst_get (insn))
+    }
+  if (Field_op0_Slot_inst_get (insn) == 1)
+    return OPCODE_L32R;
+  if (Field_op0_Slot_inst_get (insn) == 2)
+    {
+      if (Field_r_Slot_inst_get (insn) == 0)
+	return OPCODE_L8UI;
+      if (Field_r_Slot_inst_get (insn) == 1)
+	return OPCODE_L16UI;
+      if (Field_r_Slot_inst_get (insn) == 2)
+	return OPCODE_L32I;
+      if (Field_r_Slot_inst_get (insn) == 4)
+	return OPCODE_S8I;
+      if (Field_r_Slot_inst_get (insn) == 5)
+	return OPCODE_S16I;
+      if (Field_r_Slot_inst_get (insn) == 6)
+	return OPCODE_S32I;
+      if (Field_r_Slot_inst_get (insn) == 7)
 	{
-	case 0:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SLLSQ56;
-	  if (Field_op1_Slot_inst_get (insn) == 6 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_LB;
-	  break;
-	case 1:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SRLSQ56;
-	  break;
-	case 2:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SRASQ56;
-	  break;
-	case 3:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_SLLSSQ56S;
-	  break;
-	case 4:
-	  if (Field_t_Slot_inst_get (insn) == 1 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_AE_MOVQ56;
-	  break;
-	case 8:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_OVERFLOW;
-	  break;
-	case 9:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_SAR;
-	  break;
-	case 10:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_BITPTR;
-	  break;
-	case 11:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_BITSUSED;
-	  break;
-	case 12:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_TABLESIZE;
-	  break;
-	case 13:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_FIRST_TS;
-	  break;
-	case 14:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_NEXTOFFSET;
-	  break;
-	case 15:
-	  if (Field_t_Slot_inst_get (insn) == 0 &&
-	      Field_op1_Slot_inst_get (insn) == 9 &&
-	      Field_op2_Slot_inst_get (insn) == 12)
-	    return OPCODE_RUR_AE_SEARCHDONE;
-	  break;
+	  if (Field_t_Slot_inst_get (insn) == 0)
+	    return OPCODE_DPFR;
+	  if (Field_t_Slot_inst_get (insn) == 1)
+	    return OPCODE_DPFW;
+	  if (Field_t_Slot_inst_get (insn) == 2)
+	    return OPCODE_DPFRO;
+	  if (Field_t_Slot_inst_get (insn) == 3)
+	    return OPCODE_DPFWO;
+	  if (Field_t_Slot_inst_get (insn) == 4)
+	    return OPCODE_DHWB;
+	  if (Field_t_Slot_inst_get (insn) == 5)
+	    return OPCODE_DHWBI;
+	  if (Field_t_Slot_inst_get (insn) == 6)
+	    return OPCODE_DHI;
+	  if (Field_t_Slot_inst_get (insn) == 7)
+	    return OPCODE_DII;
+	  if (Field_t_Slot_inst_get (insn) == 8)
+	    {
+	      if (Field_op1_Slot_inst_get (insn) == 4)
+		return OPCODE_DIWB;
+	      if (Field_op1_Slot_inst_get (insn) == 5)
+		return OPCODE_DIWBI;
+	    }
+	  if (Field_t_Slot_inst_get (insn) == 12)
+	    return OPCODE_IPF;
+	  if (Field_t_Slot_inst_get (insn) == 14)
+	    return OPCODE_IHI;
+	  if (Field_t_Slot_inst_get (insn) == 15)
+	    return OPCODE_III;
 	}
-      switch (Field_t_Slot_inst_get (insn))
+      if (Field_r_Slot_inst_get (insn) == 9)
+	return OPCODE_L16SI;
+      if (Field_r_Slot_inst_get (insn) == 10)
+	return OPCODE_MOVI;
+      if (Field_r_Slot_inst_get (insn) == 11)
+	return OPCODE_L32AI;
+      if (Field_r_Slot_inst_get (insn) == 12)
+	return OPCODE_ADDI;
+      if (Field_r_Slot_inst_get (insn) == 13)
+	return OPCODE_ADDMI;
+      if (Field_r_Slot_inst_get (insn) == 14)
+	return OPCODE_S32C1I;
+      if (Field_r_Slot_inst_get (insn) == 15)
+	return OPCODE_S32RI;
+    }
+  if (Field_op0_Slot_inst_get (insn) == 4)
+    {
+      if (Field_ae_r10_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ56_I;
+      if (Field_ae_r10_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ56_X;
+      if (Field_ae_r10_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ32F_I;
+      if (Field_ae_r10_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ32F_X;
+      if (Field_ae_r10_Slot_inst_get (insn) == 2 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ56_IU;
+      if (Field_ae_r10_Slot_inst_get (insn) == 2 &&
+	  Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ56_XU;
+      if (Field_ae_r10_Slot_inst_get (insn) == 2 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_t_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_CVTQ48A32S;
+      if (Field_ae_r10_Slot_inst_get (insn) == 3 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ32F_IU;
+      if (Field_ae_r10_Slot_inst_get (insn) == 3 &&
+	  Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LQ32F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16F_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16F_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 12 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16F_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 15 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 6 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24F_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24F_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 13 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24F_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_LP24F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24X2F_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 11 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24X2F_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 14 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24X2F_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_LP24X2F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16X2F_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16X2F_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 8 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16X2F_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 11 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16X2F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2F_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 6 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2F_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2F_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 12 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24S_L_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24S_L_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24S_L_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 13 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24S_L_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_ae_s3_Slot_inst_get (insn) == 0 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_MOVP48;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_MOVPA24X2;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 11 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_CVTA32P24_L;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 14 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_CVTP24A16X2_LL;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 15 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_CVTP24A16X2_HL;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_MOVAP24S_L;
+      if (Field_ae_r3_Slot_inst_get (insn) == 0 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 8 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_TRUNCA16P24S_L;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 12 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 15 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 6 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16X2F_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16X2F_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 13 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP16X2F_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_LP16X2F_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24X2_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 11 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24X2_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 14 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LP24X2_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_LP24X2_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2S_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2S_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 8 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2S_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 11 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24X2S_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16F_L_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 6 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16F_L_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16F_L_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 12 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP16F_L_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24F_L_I;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24F_L_IU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24F_L_X;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 13 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_SP24F_L_XU;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_TRUNCP24A32X2;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 11 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_CVTA32P24_H;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 14 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_CVTP24A16X2_LH;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 15 &&
+	  Field_op2_Slot_inst_get (insn) == 11)
+	return OPCODE_AE_CVTP24A16X2_HH;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_MOVAP24S_H;
+      if (Field_ae_r3_Slot_inst_get (insn) == 1 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 8 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_TRUNCA16P24S_H;
+      if (Field_ae_r32_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ56S_I;
+      if (Field_ae_r32_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ56S_X;
+      if (Field_ae_r32_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_TRUNCA32Q48;
+      if (Field_ae_r32_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ32F_I;
+      if (Field_ae_r32_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ32F_X;
+      if (Field_ae_r32_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_NSAQ56S;
+      if (Field_ae_r32_Slot_inst_get (insn) == 2 &&
+	  Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ56S_IU;
+      if (Field_ae_r32_Slot_inst_get (insn) == 2 &&
+	  Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ56S_XU;
+      if (Field_ae_r32_Slot_inst_get (insn) == 3 &&
+	  Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ32F_IU;
+      if (Field_ae_r32_Slot_inst_get (insn) == 3 &&
+	  Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SQ32F_XU;
+      if (Field_ae_s_non_samt_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SLLIQ56;
+      if (Field_ae_s_non_samt_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SRLIQ56;
+      if (Field_ae_s_non_samt_Slot_inst_get (insn) == 2 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SRAIQ56;
+      if (Field_ae_s_non_samt_Slot_inst_get (insn) == 3 &&
+	  Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SLLISQ56S;
+      if (Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_SHA32;
+      if (Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_VLDL32T;
+      if (Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_SLLAQ56;
+      if (Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_VLDL16T;
+      if (Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_SRLAQ56;
+      if (Field_op1_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_LBK;
+      if (Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_SRAAQ56;
+      if (Field_op1_Slot_inst_get (insn) == 3 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_VLEL32T;
+      if (Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_SLLASQ56S;
+      if (Field_op1_Slot_inst_get (insn) == 4 &&
+	  Field_op2_Slot_inst_get (insn) == 10)
+	return OPCODE_AE_VLEL16T;
+      if (Field_op1_Slot_inst_get (insn) == 5 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_MOVTQ56;
+      if (Field_op1_Slot_inst_get (insn) == 6 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_MOVFQ56;
+      if (Field_r_Slot_inst_get (insn) == 0 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_OVERFLOW;
+      if (Field_r_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 15)
+	return OPCODE_AE_SBI;
+      if (Field_r_Slot_inst_get (insn) == 1 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_SAR;
+      if (Field_r_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 15)
+	return OPCODE_AE_DB;
+      if (Field_r_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 15)
+	return OPCODE_AE_SB;
+      if (Field_r_Slot_inst_get (insn) == 2 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_BITPTR;
+      if (Field_r_Slot_inst_get (insn) == 3 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_BITSUSED;
+      if (Field_r_Slot_inst_get (insn) == 4 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_TABLESIZE;
+      if (Field_r_Slot_inst_get (insn) == 5 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_FIRST_TS;
+      if (Field_r_Slot_inst_get (insn) == 6 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_NEXTOFFSET;
+      if (Field_r_Slot_inst_get (insn) == 7 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_WUR_AE_SEARCHDONE;
+      if (Field_r_Slot_inst_get (insn) == 8 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 10 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_VLDSHT;
+      if (Field_r_Slot_inst_get (insn) == 12 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_VLES16C;
+      if (Field_r_Slot_inst_get (insn) == 13 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_SBF;
+      if (Field_r_Slot_inst_get (insn) == 14 &&
+	  Field_op1_Slot_inst_get (insn) == 7 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_VLDL16C;
+      if (Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SLLSQ56;
+      if (Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 6 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_LB;
+      if (Field_s_Slot_inst_get (insn) == 1 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SRLSQ56;
+      if (Field_s_Slot_inst_get (insn) == 2 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SRASQ56;
+      if (Field_s_Slot_inst_get (insn) == 3 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_SLLSSQ56S;
+      if (Field_s_Slot_inst_get (insn) == 4 &&
+	  Field_t_Slot_inst_get (insn) == 1 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_AE_MOVQ56;
+      if (Field_s_Slot_inst_get (insn) == 8 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_OVERFLOW;
+      if (Field_s_Slot_inst_get (insn) == 9 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_SAR;
+      if (Field_s_Slot_inst_get (insn) == 10 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_BITPTR;
+      if (Field_s_Slot_inst_get (insn) == 11 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_BITSUSED;
+      if (Field_s_Slot_inst_get (insn) == 12 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_TABLESIZE;
+      if (Field_s_Slot_inst_get (insn) == 13 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_FIRST_TS;
+      if (Field_s_Slot_inst_get (insn) == 14 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_NEXTOFFSET;
+      if (Field_s_Slot_inst_get (insn) == 15 &&
+	  Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op1_Slot_inst_get (insn) == 9 &&
+	  Field_op2_Slot_inst_get (insn) == 12)
+	return OPCODE_RUR_AE_SEARCHDONE;
+      if (Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_LBKI;
+      if (Field_t_Slot_inst_get (insn) == 0 &&
+	  Field_r_Slot_inst_get (insn) == 2 &&
+	  Field_op2_Slot_inst_get (insn) == 15)
+	return OPCODE_AE_DBI;
+      if (Field_t_Slot_inst_get (insn) == 2 &&
+	  Field_s_Slot_inst_get (insn) == 0 &&
+	  Field_op2_Slot_inst_get (insn) == 14)
+	return OPCODE_AE_LBI;
+    }
+  if (Field_op0_Slot_inst_get (insn) == 5)
+    {
+      if (Field_n_Slot_inst_get (insn) == 0)
+	return OPCODE_CALL0;
+      if (Field_n_Slot_inst_get (insn) == 1)
+	return OPCODE_CALL4;
+      if (Field_n_Slot_inst_get (insn) == 2)
+	return OPCODE_CALL8;
+      if (Field_n_Slot_inst_get (insn) == 3)
+	return OPCODE_CALL12;
+    }
+  if (Field_op0_Slot_inst_get (insn) == 6)
+    {
+      if (Field_n_Slot_inst_get (insn) == 0)
+	return OPCODE_J;
+      if (Field_n_Slot_inst_get (insn) == 1)
 	{
-	case 0:
-	  if (Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_LBKI;
-	  if (Field_r_Slot_inst_get (insn) == 2 &&
-	      Field_op2_Slot_inst_get (insn) == 15)
-	    return OPCODE_AE_DBI;
-	  break;
-	case 2:
-	  if (Field_s_Slot_inst_get (insn) == 0 &&
-	      Field_op2_Slot_inst_get (insn) == 14)
-	    return OPCODE_AE_LBI;
-	  break;
+	  if (Field_m_Slot_inst_get (insn) == 0)
+	    return OPCODE_BEQZ;
+	  if (Field_m_Slot_inst_get (insn) == 1)
+	    return OPCODE_BNEZ;
+	  if (Field_m_Slot_inst_get (insn) == 2)
+	    return OPCODE_BLTZ;
+	  if (Field_m_Slot_inst_get (insn) == 3)
+	    return OPCODE_BGEZ;
 	}
-      break;
-    case 5:
-      switch (Field_n_Slot_inst_get (insn))
+      if (Field_n_Slot_inst_get (insn) == 2)
 	{
-	case 0:
-	  return OPCODE_CALL0;
-	case 1:
-	  return OPCODE_CALL4;
-	case 2:
-	  return OPCODE_CALL8;
-	case 3:
-	  return OPCODE_CALL12;
+	  if (Field_m_Slot_inst_get (insn) == 0)
+	    return OPCODE_BEQI;
+	  if (Field_m_Slot_inst_get (insn) == 1)
+	    return OPCODE_BNEI;
+	  if (Field_m_Slot_inst_get (insn) == 2)
+	    return OPCODE_BLTI;
+	  if (Field_m_Slot_inst_get (insn) == 3)
+	    return OPCODE_BGEI;
 	}
-      break;
-    case 6:
-      switch (Field_n_Slot_inst_get (insn))
+      if (Field_n_Slot_inst_get (insn) == 3)
 	{
-	case 0:
-	  return OPCODE_J;
-	case 1:
-	  switch (Field_m_Slot_inst_get (insn))
+	  if (Field_m_Slot_inst_get (insn) == 0)
+	    return OPCODE_ENTRY;
+	  if (Field_m_Slot_inst_get (insn) == 1)
 	    {
-	    case 0:
-	      return OPCODE_BEQZ;
-	    case 1:
-	      return OPCODE_BNEZ;
-	    case 2:
-	      return OPCODE_BLTZ;
-	    case 3:
-	      return OPCODE_BGEZ;
+	      if (Field_r_Slot_inst_get (insn) == 0)
+		return OPCODE_BF;
+	      if (Field_r_Slot_inst_get (insn) == 1)
+		return OPCODE_BT;
+	      if (Field_r_Slot_inst_get (insn) == 8)
+		return OPCODE_LOOP;
+	      if (Field_r_Slot_inst_get (insn) == 9)
+		return OPCODE_LOOPNEZ;
+	      if (Field_r_Slot_inst_get (insn) == 10)
+		return OPCODE_LOOPGTZ;
 	    }
-	  break;
-	case 2:
-	  switch (Field_m_Slot_inst_get (insn))
-	    {
-	    case 0:
-	      return OPCODE_BEQI;
-	    case 1:
-	      return OPCODE_BNEI;
-	    case 2:
-	      return OPCODE_BLTI;
-	    case 3:
-	      return OPCODE_BGEI;
-	    }
-	  break;
-	case 3:
-	  switch (Field_m_Slot_inst_get (insn))
-	    {
-	    case 0:
-	      return OPCODE_ENTRY;
-	    case 1:
-	      switch (Field_r_Slot_inst_get (insn))
-		{
-		case 0:
-		  return OPCODE_BF;
-		case 1:
-		  return OPCODE_BT;
-		case 8:
-		  return OPCODE_LOOP;
-		case 9:
-		  return OPCODE_LOOPNEZ;
-		case 10:
-		  return OPCODE_LOOPGTZ;
-		}
-	      break;
-	    case 2:
-	      return OPCODE_BLTUI;
-	    case 3:
-	      return OPCODE_BGEUI;
-	    }
-	  break;
-	}
-      break;
-    case 7:
-      switch (Field_r_Slot_inst_get (insn))
-	{
-	case 0:
-	  return OPCODE_BNONE;
-	case 1:
-	  return OPCODE_BEQ;
-	case 2:
-	  return OPCODE_BLT;
-	case 3:
-	  return OPCODE_BLTU;
-	case 4:
-	  return OPCODE_BALL;
-	case 5:
-	  return OPCODE_BBC;
-	case 6:
-	case 7:
-	  return OPCODE_BBCI;
-	case 8:
-	  return OPCODE_BANY;
-	case 9:
-	  return OPCODE_BNE;
-	case 10:
-	  return OPCODE_BGE;
-	case 11:
-	  return OPCODE_BGEU;
-	case 12:
-	  return OPCODE_BNALL;
-	case 13:
-	  return OPCODE_BBS;
-	case 14:
-	case 15:
-	  return OPCODE_BBSI;
+	  if (Field_m_Slot_inst_get (insn) == 2)
+	    return OPCODE_BLTUI;
+	  if (Field_m_Slot_inst_get (insn) == 3)
+	    return OPCODE_BGEUI;
 	}
-      break;
+    }
+  if (Field_op0_Slot_inst_get (insn) == 7)
+    {
+      if (Field_r_Slot_inst_get (insn) == 0)
+	return OPCODE_BNONE;
+      if (Field_r_Slot_inst_get (insn) == 1)
+	return OPCODE_BEQ;
+      if (Field_r_Slot_inst_get (insn) == 2)
+	return OPCODE_BLT;
+      if (Field_r_Slot_inst_get (insn) == 3)
+	return OPCODE_BLTU;
+      if (Field_r_Slot_inst_get (insn) == 4)
+	return OPCODE_BALL;
+      if (Field_r_Slot_inst_get (insn) == 5)
+	return OPCODE_BBC;
+      if ((Field_r_Slot_inst_get (insn) == 6 ||
+	   Field_r_Slot_inst_get (insn) == 7))
+	return OPCODE_BBCI;
+      if (Field_r_Slot_inst_get (insn) == 8)
+	return OPCODE_BANY;
+      if (Field_r_Slot_inst_get (insn) == 9)
+	return OPCODE_BNE;
+      if (Field_r_Slot_inst_get (insn) == 10)
+	return OPCODE_BGE;
+      if (Field_r_Slot_inst_get (insn) == 11)
+	return OPCODE_BGEU;
+      if (Field_r_Slot_inst_get (insn) == 12)
+	return OPCODE_BNALL;
+      if (Field_r_Slot_inst_get (insn) == 13)
+	return OPCODE_BBS;
+      if ((Field_r_Slot_inst_get (insn) == 14 ||
+	   Field_r_Slot_inst_get (insn) == 15))
+	return OPCODE_BBSI;
     }
   return XTENSA_UNDEFINED;
 }
@@ -30824,50 +30653,37 @@ Slot_inst_decode (const xtensa_insnbuf insn)
 static int
 Slot_inst16b_decode (const xtensa_insnbuf insn)
 {
-  switch (Field_op0_Slot_inst16b_get (insn))
+  if (Field_op0_Slot_inst16b_get (insn) == 12)
     {
-    case 12:
-      switch (Field_i_Slot_inst16b_get (insn))
+      if (Field_i_Slot_inst16b_get (insn) == 0)
+	return OPCODE_MOVI_N;
+      if (Field_i_Slot_inst16b_get (insn) == 1)
 	{
-	case 0:
-	  return OPCODE_MOVI_N;
-	case 1:
-	  switch (Field_z_Slot_inst16b_get (insn))
-	    {
-	    case 0:
-	      return OPCODE_BEQZ_N;
-	    case 1:
-	      return OPCODE_BNEZ_N;
-	    }
-	  break;
+	  if (Field_z_Slot_inst16b_get (insn) == 0)
+	    return OPCODE_BEQZ_N;
+	  if (Field_z_Slot_inst16b_get (insn) == 1)
+	    return OPCODE_BNEZ_N;
 	}
-      break;
-    case 13:
-      switch (Field_r_Slot_inst16b_get (insn))
+    }
+  if (Field_op0_Slot_inst16b_get (insn) == 13)
+    {
+      if (Field_r_Slot_inst16b_get (insn) == 0)
+	return OPCODE_MOV_N;
+      if (Field_r_Slot_inst16b_get (insn) == 15)
 	{
-	case 0:
-	  return OPCODE_MOV_N;
-	case 15:
-	  switch (Field_t_Slot_inst16b_get (insn))
-	    {
-	    case 0:
-	      return OPCODE_RET_N;
-	    case 1:
-	      return OPCODE_RETW_N;
-	    case 2:
-	      return OPCODE_BREAK_N;
-	    case 3:
-	      if (Field_s_Slot_inst16b_get (insn) == 0)
-		return OPCODE_NOP_N;
-	      break;
-	    case 6:
-	      if (Field_s_Slot_inst16b_get (insn) == 0)
-		return OPCODE_ILL_N;
-	      break;
-	    }
-	  break;
+	  if (Field_t_Slot_inst16b_get (insn) == 0)
+	    return OPCODE_RET_N;
+	  if (Field_t_Slot_inst16b_get (insn) == 1)
+	    return OPCODE_RETW_N;
+	  if (Field_t_Slot_inst16b_get (insn) == 2)
+	    return OPCODE_BREAK_N;
+	  if (Field_t_Slot_inst16b_get (insn) == 3 &&
+	      Field_s_Slot_inst16b_get (insn) == 0)
+	    return OPCODE_NOP_N;
+	  if (Field_t_Slot_inst16b_get (insn) == 6 &&
+	      Field_s_Slot_inst16b_get (insn) == 0)
+	    return OPCODE_ILL_N;
 	}
-      break;
     }
   return XTENSA_UNDEFINED;
 }
@@ -30875,17 +30691,14 @@ Slot_inst16b_decode (const xtensa_insnbuf insn)
 static int
 Slot_inst16a_decode (const xtensa_insnbuf insn)
 {
-  switch (Field_op0_Slot_inst16a_get (insn))
-    {
-    case 8:
-      return OPCODE_L32I_N;
-    case 9:
-      return OPCODE_S32I_N;
-    case 10:
-      return OPCODE_ADD_N;
-    case 11:
-      return OPCODE_ADDI_N;
-    }
+  if (Field_op0_Slot_inst16a_get (insn) == 8)
+    return OPCODE_L32I_N;
+  if (Field_op0_Slot_inst16a_get (insn) == 9)
+    return OPCODE_S32I_N;
+  if (Field_op0_Slot_inst16a_get (insn) == 10)
+    return OPCODE_ADD_N;
+  if (Field_op0_Slot_inst16a_get (insn) == 11)
+    return OPCODE_ADDI_N;
   return XTENSA_UNDEFINED;
 }
 
@@ -30898,45 +30711,31 @@ Slot_ae_slot0_decode (const xtensa_insnbuf insn)
   if (Field_ftsf213ae_slot0_Slot_ae_slot0_get (insn) == 2 &&
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
     return OPCODE_EXTUI;
-  switch (Field_ftsf214ae_slot0_Slot_ae_slot0_get (insn))
-    {
-    case 6:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_BGEZ;
-      break;
-    case 7:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_BLTZ;
-      break;
-    case 8:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_BEQZ;
-      break;
-    case 9:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_BNEZ;
-      break;
-    case 10:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVI;
-      break;
-    }
-  switch (Field_ftsf215ae_slot0_Slot_ae_slot0_get (insn))
-    {
-    case 88:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SRAI;
-      break;
-    case 96:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SLLI;
-      break;
-    case 123:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
-	  Field_ftsf364ae_slot0_Slot_ae_slot0_get (insn) == 0)
-	return OPCODE_AE_MOVTQ56;
-      break;
-    }
+  if (Field_ftsf214ae_slot0_Slot_ae_slot0_get (insn) == 6 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_BGEZ;
+  if (Field_ftsf214ae_slot0_Slot_ae_slot0_get (insn) == 7 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_BLTZ;
+  if (Field_ftsf214ae_slot0_Slot_ae_slot0_get (insn) == 8 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_BEQZ;
+  if (Field_ftsf214ae_slot0_Slot_ae_slot0_get (insn) == 9 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_BNEZ;
+  if (Field_ftsf214ae_slot0_Slot_ae_slot0_get (insn) == 10 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVI;
+  if (Field_ftsf215ae_slot0_Slot_ae_slot0_get (insn) == 88 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SRAI;
+  if (Field_ftsf215ae_slot0_Slot_ae_slot0_get (insn) == 96 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SLLI;
+  if (Field_ftsf215ae_slot0_Slot_ae_slot0_get (insn) == 123 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
+      Field_ftsf364ae_slot0_Slot_ae_slot0_get (insn) == 0)
+    return OPCODE_AE_MOVTQ56;
   if (Field_ftsf216ae_slot0_Slot_ae_slot0_get (insn) == 418 &&
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
     return OPCODE_AE_CVTP24A16X2_HH;
@@ -31160,17 +30959,12 @@ Slot_ae_slot0_decode (const xtensa_insnbuf insn)
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
       Field_s_Slot_ae_slot0_get (insn) == 0)
     return OPCODE_ALL8;
-  switch (Field_ftsf293_Slot_ae_slot0_get (insn))
-    {
-    case 0:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BBCI;
-      break;
-    case 1:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BBSI;
-      break;
-    }
+  if (Field_ftsf293_Slot_ae_slot0_get (insn) == 0 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BBCI;
+  if (Field_ftsf293_Slot_ae_slot0_get (insn) == 1 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BBSI;
   if (Field_ftsf294ae_slot0_Slot_ae_slot0_get (insn) == 1915 &&
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
       Field_s_Slot_ae_slot0_get (insn) == 0)
@@ -31188,57 +30982,38 @@ Slot_ae_slot0_decode (const xtensa_insnbuf insn)
   if (Field_ftsf298ae_slot0_Slot_ae_slot0_get (insn) == 963 &&
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
     return OPCODE_AE_SQ56S_IU;
-  switch (Field_ftsf299ae_slot0_Slot_ae_slot0_get (insn))
-    {
-    case 964:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_AE_SLLIQ56;
-      break;
-    case 965:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_AE_SRAIQ56;
-      break;
-    case 966:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_AE_SRLIQ56;
-      break;
-    case 968:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_AE_SLLISQ56S;
-      break;
-    }
-  switch (Field_ftsf300ae_slot0_Slot_ae_slot0_get (insn))
-    {
-    case 3868:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ABS;
-      break;
-    case 3869:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_NEG;
-      break;
-    case 3870:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SRA;
-      break;
-    case 3871:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SRL;
-      break;
-    }
-  switch (Field_ftsf301ae_slot0_Slot_ae_slot0_get (insn))
-    {
-    case 7752:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
-	  Field_ftsf321_Slot_ae_slot0_get (insn) == 0)
-	return OPCODE_AE_MOVP48;
-      break;
-    case 7753:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
-	  Field_ftsf353_Slot_ae_slot0_get (insn) == 0)
-	return OPCODE_ANY4;
-      break;
-    }
+  if (Field_ftsf299ae_slot0_Slot_ae_slot0_get (insn) == 964 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_AE_SLLIQ56;
+  if (Field_ftsf299ae_slot0_Slot_ae_slot0_get (insn) == 965 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_AE_SRAIQ56;
+  if (Field_ftsf299ae_slot0_Slot_ae_slot0_get (insn) == 966 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_AE_SRLIQ56;
+  if (Field_ftsf299ae_slot0_Slot_ae_slot0_get (insn) == 968 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_AE_SLLISQ56S;
+  if (Field_ftsf300ae_slot0_Slot_ae_slot0_get (insn) == 3868 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ABS;
+  if (Field_ftsf300ae_slot0_Slot_ae_slot0_get (insn) == 3869 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_NEG;
+  if (Field_ftsf300ae_slot0_Slot_ae_slot0_get (insn) == 3870 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SRA;
+  if (Field_ftsf300ae_slot0_Slot_ae_slot0_get (insn) == 3871 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SRL;
+  if (Field_ftsf301ae_slot0_Slot_ae_slot0_get (insn) == 7752 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
+      Field_ftsf321_Slot_ae_slot0_get (insn) == 0)
+    return OPCODE_AE_MOVP48;
+  if (Field_ftsf301ae_slot0_Slot_ae_slot0_get (insn) == 7753 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
+      Field_ftsf353_Slot_ae_slot0_get (insn) == 0)
+    return OPCODE_ANY4;
   if (Field_ftsf302ae_slot0_Slot_ae_slot0_get (insn) == 31016 &&
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
       Field_ftsf321_Slot_ae_slot0_get (insn) == 0)
@@ -31328,239 +31103,181 @@ Slot_ae_slot0_decode (const xtensa_insnbuf insn)
       Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
       Field_ftsf362ae_slot0_Slot_ae_slot0_get (insn) == 0)
     return OPCODE_AE_SQ32F_XU;
-  switch (Field_imm8_Slot_ae_slot0_get (insn))
-    {
-    case 178:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ADD;
-      break;
-    case 179:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ADDX8;
-      break;
-    case 180:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ADDX2;
-      break;
-    case 181:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_AND;
-      break;
-    case 182:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ANDB;
-      break;
-    case 183:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ANDBC;
-      break;
-    case 184:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ADDX4;
-      break;
-    case 185:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_CLAMPS;
-      break;
-    case 186:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MAX;
-      break;
-    case 187:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MIN;
-      break;
-    case 188:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MAXU;
-      break;
-    case 189:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MINU;
-      break;
-    case 190:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVEQZ;
-      break;
-    case 191:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVF;
-      break;
-    case 194:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVGEZ;
-      break;
-    case 195:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ORB;
-      break;
-    case 196:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVLTZ;
-      break;
-    case 197:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_ORBC;
-      break;
-    case 198:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SEXT;
-      break;
-    case 199:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SRC;
-      break;
-    case 200:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVNEZ;
-      break;
-    case 201:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SRLI;
-      break;
-    case 202:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SUB;
-      break;
-    case 203:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SUBX4;
-      break;
-    case 204:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SUBX2;
-      break;
-    case 205:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_SUBX8;
-      break;
-    case 206:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_XOR;
-      break;
-    case 207:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_XORB;
-      break;
-    case 208:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_MOVT;
-      break;
-    case 224:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
-	return OPCODE_OR;
-      break;
-    case 244:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
-	  Field_ae_r32_Slot_ae_slot0_get (insn) == 0)
-	return OPCODE_AE_SQ32F_X;
-      break;
-    }
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 178 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ADD;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 179 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ADDX8;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 180 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ADDX2;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 181 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_AND;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 182 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ANDB;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 183 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ANDBC;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 184 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ADDX4;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 185 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_CLAMPS;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 186 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MAX;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 187 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MIN;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 188 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MAXU;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 189 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MINU;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 190 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVEQZ;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 191 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVF;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 194 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVGEZ;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 195 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ORB;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 196 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVLTZ;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 197 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_ORBC;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 198 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SEXT;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 199 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SRC;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 200 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVNEZ;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 201 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SRLI;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 202 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SUB;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 203 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SUBX4;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 204 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SUBX2;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 205 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_SUBX8;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 206 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_XOR;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 207 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_XORB;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 208 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_MOVT;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 224 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1)
+    return OPCODE_OR;
+  if (Field_imm8_Slot_ae_slot0_get (insn) == 244 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 1 &&
+      Field_ae_r32_Slot_ae_slot0_get (insn) == 0)
+    return OPCODE_AE_SQ32F_X;
   if (Field_op0_s4_Slot_ae_slot0_get (insn) == 5)
     return OPCODE_L32R;
-  switch (Field_r_Slot_ae_slot0_get (insn))
-    {
-    case 0:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_BNE;
-      break;
-    case 1:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_BNONE;
-      break;
-    case 2:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_L16SI;
-      break;
-    case 3:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_L8UI;
-      break;
-    case 4:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_ADDI;
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_L16UI;
-      break;
-    case 5:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BALL;
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_S16I;
-      break;
-    case 6:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BANY;
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_S32I;
-      break;
-    case 7:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BBC;
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
-	return OPCODE_S8I;
-      break;
-    case 8:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_ADDMI;
-      break;
-    case 9:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BBS;
-      break;
-    case 10:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BEQ;
-      break;
-    case 11:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BGEU;
-      break;
-    case 12:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BGE;
-      break;
-    case 13:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BLT;
-      break;
-    case 14:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BLTU;
-      break;
-    case 15:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
-	return OPCODE_BNALL;
-      break;
-    }
-  switch (Field_t_Slot_ae_slot0_get (insn))
-    {
-    case 0:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
-	return OPCODE_BEQI;
-      break;
-    case 1:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
-	return OPCODE_BGEI;
-      break;
-    case 2:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
-	return OPCODE_BGEUI;
-      break;
-    case 3:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
-	return OPCODE_BNEI;
-      break;
-    case 4:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
-	return OPCODE_BLTI;
-      break;
-    case 5:
-      if (Field_op0_s4_Slot_ae_slot0_get (insn) == 3 &&
-	  Field_r_Slot_ae_slot0_get (insn) == 0)
-	return OPCODE_BF;
-      break;
-    }
+  if (Field_r_Slot_ae_slot0_get (insn) == 0 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_BNE;
+  if (Field_r_Slot_ae_slot0_get (insn) == 1 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_BNONE;
+  if (Field_r_Slot_ae_slot0_get (insn) == 2 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_L16SI;
+  if (Field_r_Slot_ae_slot0_get (insn) == 3 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_L8UI;
+  if (Field_r_Slot_ae_slot0_get (insn) == 4 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_ADDI;
+  if (Field_r_Slot_ae_slot0_get (insn) == 4 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_L16UI;
+  if (Field_r_Slot_ae_slot0_get (insn) == 5 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BALL;
+  if (Field_r_Slot_ae_slot0_get (insn) == 5 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_S16I;
+  if (Field_r_Slot_ae_slot0_get (insn) == 6 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BANY;
+  if (Field_r_Slot_ae_slot0_get (insn) == 6 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_S32I;
+  if (Field_r_Slot_ae_slot0_get (insn) == 7 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BBC;
+  if (Field_r_Slot_ae_slot0_get (insn) == 7 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 4)
+    return OPCODE_S8I;
+  if (Field_r_Slot_ae_slot0_get (insn) == 8 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_ADDMI;
+  if (Field_r_Slot_ae_slot0_get (insn) == 9 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BBS;
+  if (Field_r_Slot_ae_slot0_get (insn) == 10 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BEQ;
+  if (Field_r_Slot_ae_slot0_get (insn) == 11 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BGEU;
+  if (Field_r_Slot_ae_slot0_get (insn) == 12 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BGE;
+  if (Field_r_Slot_ae_slot0_get (insn) == 13 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BLT;
+  if (Field_r_Slot_ae_slot0_get (insn) == 14 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BLTU;
+  if (Field_r_Slot_ae_slot0_get (insn) == 15 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 2)
+    return OPCODE_BNALL;
+  if (Field_t_Slot_ae_slot0_get (insn) == 0 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
+    return OPCODE_BEQI;
+  if (Field_t_Slot_ae_slot0_get (insn) == 1 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
+    return OPCODE_BGEI;
+  if (Field_t_Slot_ae_slot0_get (insn) == 2 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
+    return OPCODE_BGEUI;
+  if (Field_t_Slot_ae_slot0_get (insn) == 3 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
+    return OPCODE_BNEI;
+  if (Field_t_Slot_ae_slot0_get (insn) == 4 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 3)
+    return OPCODE_BLTI;
+  if (Field_t_Slot_ae_slot0_get (insn) == 5 &&
+      Field_op0_s4_Slot_ae_slot0_get (insn) == 3 &&
+      Field_r_Slot_ae_slot0_get (insn) == 0)
+    return OPCODE_BF;
   return XTENSA_UNDEFINED;
 }
 
@@ -31958,21 +31675,15 @@ Slot_ae_slot1_decode (const xtensa_insnbuf insn)
   if (Field_ftsf36ae_slot1_Slot_ae_slot1_get (insn) == 31 &&
       Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
     return OPCODE_AE_SUBP24;
-  switch (Field_ftsf37ae_slot1_Slot_ae_slot1_get (insn))
-    {
-    case 8:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
-	return OPCODE_AE_SLLIP24;
-      break;
-    case 9:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
-	return OPCODE_AE_SRAIP24;
-      break;
-    case 10:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
-	return OPCODE_AE_SRLIP24;
-      break;
-    }
+  if (Field_ftsf37ae_slot1_Slot_ae_slot1_get (insn) == 8 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
+    return OPCODE_AE_SLLIP24;
+  if (Field_ftsf37ae_slot1_Slot_ae_slot1_get (insn) == 9 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
+    return OPCODE_AE_SRAIP24;
+  if (Field_ftsf37ae_slot1_Slot_ae_slot1_get (insn) == 10 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
+    return OPCODE_AE_SRLIP24;
   if (Field_ftsf38ae_slot1_Slot_ae_slot1_get (insn) == 176 &&
       Field_op0_s3_Slot_ae_slot1_get (insn) == 1)
     return OPCODE_AE_MULAFQ32SP16S_L;
@@ -32148,137 +31859,150 @@ Slot_ae_slot1_decode (const xtensa_insnbuf insn)
       Field_op0_s3_Slot_ae_slot1_get (insn) == 1 &&
       Field_ae_r20_Slot_ae_slot1_get (insn) == 0)
     return OPCODE_AE_ABSP24;
-  switch (Field_t_Slot_ae_slot1_get (insn))
-    {
-    case 0:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAFQ32SP16S_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASFQ32SP16U_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSAQ32SP16S_LL;
-      break;
-    case 1:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAFQ32SP16S_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASFQ32SP16U_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSAQ32SP16U_HH;
-      break;
-    case 2:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAFQ32SP16S_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASQ32SP16S_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSAQ32SP16U_LH;
-      break;
-    case 3:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAFQ32SP16U_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASQ32SP16U_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSFQ32SP16S_LH;
-      break;
-    case 4:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAFQ32SP16U_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASQ32SP16S_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSAQ32SP16U_LL;
-      break;
-    case 5:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAQ32SP16S_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASQ32SP16U_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSFQ32SP16S_LL;
-      break;
-    case 6:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAQ32SP16S_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASQ32SP16U_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSFQ32SP16U_HH;
-      break;
-    case 7:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAQ32SP16S_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAFQ32SP16S_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSFQ32SP16U_LH;
-      break;
-    case 8:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAFQ32SP16U_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZASQ32SP16S_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSFQ32SP16S_HH;
-      break;
-    case 9:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAQ32SP16U_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAFQ32SP16S_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSFQ32SP16U_LL;
-      break;
-    case 10:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAQ32SP16U_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAFQ32SP16S_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSQ32SP16S_HH;
-      break;
-    case 11:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZASFQ32SP16S_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAFQ32SP16U_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSQ32SP16S_LL;
-      break;
-    case 12:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZAAQ32SP16U_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAFQ32SP16U_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSQ32SP16S_LH;
-      break;
-    case 13:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZASFQ32SP16S_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAFQ32SP16U_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSQ32SP16U_HH;
-      break;
-    case 14:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZASFQ32SP16S_LL;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAQ32SP16S_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSQ32SP16U_LH;
-      break;
-    case 15:
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
-	return OPCODE_AE_MULZASFQ32SP16U_HH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
-	return OPCODE_AE_MULZSAQ32SP16S_LH;
-      if (Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
-	return OPCODE_AE_MULZSSQ32SP16U_LL;
-      break;
-    }
+  if (Field_t_Slot_ae_slot1_get (insn) == 0 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAFQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 0 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASFQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 0 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSAQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 1 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAFQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 1 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASFQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 1 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSAQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 2 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAFQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 2 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 2 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSAQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 3 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAFQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 3 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 3 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSFQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 4 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAFQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 4 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 4 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSAQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 5 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 5 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 5 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSFQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 6 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 6 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 6 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSFQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 7 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 7 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAFQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 7 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSFQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 8 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAFQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 8 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZASQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 8 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSFQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 9 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 9 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAFQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 9 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSFQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 10 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 10 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAFQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 10 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 11 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZASFQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 11 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAFQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 11 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 12 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZAAQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 12 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAFQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 12 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 13 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZASFQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 13 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAFQ32SP16U_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 13 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 14 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZASFQ32SP16S_LL;
+  if (Field_t_Slot_ae_slot1_get (insn) == 14 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAQ32SP16S_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 14 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSQ32SP16U_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 15 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 2)
+    return OPCODE_AE_MULZASFQ32SP16U_HH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 15 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 3)
+    return OPCODE_AE_MULZSAQ32SP16S_LH;
+  if (Field_t_Slot_ae_slot1_get (insn) == 15 &&
+      Field_op0_s3_Slot_ae_slot1_get (insn) == 4)
+    return OPCODE_AE_MULZSSQ32SP16U_LL;
   return XTENSA_UNDEFINED;
 }
 
@@ -32418,6 +32142,8 @@ Slot_inst_get_field_fns[] = {
   Field_ae_r20_Slot_inst_get,
   Field_ae_r10_Slot_inst_get,
   Field_ae_s20_Slot_inst_get,
+  Field_ae_fld_ohba_Slot_inst_get,
+  Field_ae_fld_ohba2_Slot_inst_get,
   0,
   Field_ftsf12_Slot_inst_get,
   Field_ftsf13_Slot_inst_get,
@@ -32809,6 +32535,8 @@ Slot_inst_set_field_fns[] = {
   Field_ae_r20_Slot_inst_set,
   Field_ae_r10_Slot_inst_set,
   Field_ae_s20_Slot_inst_set,
+  Field_ae_fld_ohba_Slot_inst_set,
+  Field_ae_fld_ohba2_Slot_inst_set,
   0,
   Field_ftsf12_Slot_inst_set,
   Field_ftsf13_Slot_inst_set,
@@ -33525,6 +33253,8 @@ Slot_inst16a_get_field_fns[] = {
   0,
   0,
   0,
+  0,
+  0,
   Implicit_Field_ar0_get,
   Implicit_Field_ar4_get,
   Implicit_Field_ar8_get,
@@ -33916,6 +33646,8 @@ Slot_inst16a_set_field_fns[] = {
   0,
   0,
   0,
+  0,
+  0,
   Implicit_Field_set,
   Implicit_Field_set,
   Implicit_Field_set,
@@ -34307,6 +34039,8 @@ Slot_inst16b_get_field_fns[] = {
   0,
   0,
   0,
+  0,
+  0,
   Implicit_Field_ar0_get,
   Implicit_Field_ar4_get,
   Implicit_Field_ar8_get,
@@ -34698,6 +34432,8 @@ Slot_inst16b_set_field_fns[] = {
   0,
   0,
   0,
+  0,
+  0,
   Implicit_Field_set,
   Implicit_Field_set,
   Implicit_Field_set,
@@ -34764,6 +34500,8 @@ Slot_ae_slot1_get_field_fns[] = {
   Field_ae_r20_Slot_ae_slot1_get,
   Field_ae_r10_Slot_ae_slot1_get,
   Field_ae_s20_Slot_ae_slot1_get,
+  0,
+  0,
   Field_op0_s3_Slot_ae_slot1_get,
   Field_ftsf12_Slot_ae_slot1_get,
   Field_ftsf13_Slot_ae_slot1_get,
@@ -35155,6 +34893,8 @@ Slot_ae_slot1_set_field_fns[] = {
   Field_ae_r20_Slot_ae_slot1_set,
   Field_ae_r10_Slot_ae_slot1_set,
   Field_ae_s20_Slot_ae_slot1_set,
+  0,
+  0,
   Field_op0_s3_Slot_ae_slot1_set,
   Field_ftsf12_Slot_ae_slot1_set,
   Field_ftsf13_Slot_ae_slot1_set,
@@ -35745,6 +35485,8 @@ Slot_ae_slot0_get_field_fns[] = {
   0,
   0,
   0,
+  0,
+  0,
   Field_op0_s4_Slot_ae_slot0_get,
   Field_ftsf212ae_slot0_Slot_ae_slot0_get,
   Field_ftsf213ae_slot0_Slot_ae_slot0_get,
@@ -36136,6 +35878,8 @@ Slot_ae_slot0_set_field_fns[] = {
   0,
   0,
   0,
+  0,
+  0,
   Field_op0_s4_Slot_ae_slot0_set,
   Field_ftsf212ae_slot0_Slot_ae_slot0_set,
   Field_ftsf213ae_slot0_Slot_ae_slot0_set,
@@ -36356,7 +36100,247 @@ format_decoder (const xtensa_insnbuf insn)
   return -1;
 }
 
-static int length_table[16] = {
+static int length_table[256] = {
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  3,
+  2,
+  2,
+  2,
+  2,
+  2,
+  2,
+  -1,
+  8,
   3,
   3,
   3,
@@ -36378,8 +36362,8 @@ static int length_table[16] = {
 static int
 length_decoder (const unsigned char *insn)
 {
-  int op0 = insn[0] & 0xf;
-  return length_table[op0];
+  int l = insn[0];
+  return length_table[l];
 }
 
 
@@ -36390,8 +36374,8 @@ xtensa_isa_internal xtensa_modules = {
   8 /* insn_size */, 0,
   4, formats, format_decoder, length_decoder,
   5, slots,
-  387 /* num_fields */,
-  445, operands,
+  389 /* num_fields */,
+  454, operands,
   588, iclasses,
   656, opcodes, 0,
   8, regfiles,
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 3543451ed3..09e5b410dc 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -31,13 +31,20 @@ ifneq ($(wildcard config-host.mak),)
 export SRC_PATH
 
 # TODO don't duplicate $(SRC_PATH)/Makefile's qapi-py here
-qapi-py = $(SRC_PATH)/scripts/qapi/commands.py \
+qapi-py = $(SRC_PATH)/scripts/qapi/__init__.py \
+$(SRC_PATH)/scripts/qapi/commands.py \
+$(SRC_PATH)/scripts/qapi/common.py \
+$(SRC_PATH)/scripts/qapi/doc.py \
+$(SRC_PATH)/scripts/qapi/error.py \
 $(SRC_PATH)/scripts/qapi/events.py \
+$(SRC_PATH)/scripts/qapi/expr.py \
+$(SRC_PATH)/scripts/qapi/gen.py \
 $(SRC_PATH)/scripts/qapi/introspect.py \
+$(SRC_PATH)/scripts/qapi/parser.py \
+$(SRC_PATH)/scripts/qapi/schema.py \
+$(SRC_PATH)/scripts/qapi/source.py \
 $(SRC_PATH)/scripts/qapi/types.py \
 $(SRC_PATH)/scripts/qapi/visit.py \
-$(SRC_PATH)/scripts/qapi/common.py \
-$(SRC_PATH)/scripts/qapi/doc.py \
 $(SRC_PATH)/scripts/qapi-gen.py
 
 # Get the list of all supported sysemu targets
@@ -609,6 +616,7 @@ tests/test-qapi-gen-timestamp: \
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-gen.py \
 		-o tests -p "test-" $<, \
 		"GEN","$(@:%-timestamp=%)")
+	@rm -f tests/test-qapi-doc.texi
 	@>$@
 
 tests/qapi-schema/doc-good.test.texi: $(SRC_PATH)/tests/qapi-schema/doc-good.json $(qapi-py)
@@ -1101,17 +1109,11 @@ check-tests/check-block.sh: tests/check-block.sh qemu-img$(EXESUF) \
 		$(patsubst %,%/all,$(filter %-softmmu,$(TARGET_DIRS)))
 	@$<
 
-.PHONY: $(patsubst %, check-%, $(check-qapi-schema-y))
-$(patsubst %, check-%, $(check-qapi-schema-y)): check-%.json: $(SRC_PATH)/%.json
+.PHONY: check-tests/qapi-schema/frontend
+check-tests/qapi-schema/frontend: $(addprefix $(SRC_PATH)/, $(check-qapi-schema-y))
 	$(call quiet-command, PYTHONPATH=$(SRC_PATH)/scripts \
-		PYTHONIOENCODING=utf-8 $(PYTHON) $(SRC_PATH)/tests/qapi-schema/test-qapi.py \
-		$^ >$*.test.out 2>$*.test.err; \
-		echo $$? >$*.test.exit, \
-		"TEST","$*.out")
-	@# Sanitize error messages (make them independent of build directory)
-	@perl -p -e 's|\Q$(SRC_PATH)\E/||g' $*.test.err | diff -u $(SRC_PATH)/$*.err -
-	@diff -u $(SRC_PATH)/$*.out $*.test.out
-	@diff -u $(SRC_PATH)/$*.exit $*.test.exit
+	  PYTHONIOENCODING=utf-8 $(PYTHON) $(SRC_PATH)/tests/qapi-schema/test-qapi.py $^, \
+	  TEST, check-qapi-schema)
 
 .PHONY: check-tests/qapi-schema/doc-good.texi
 check-tests/qapi-schema/doc-good.texi: tests/qapi-schema/doc-good.test.texi
@@ -1169,7 +1171,7 @@ check-acceptance: check-venv $(TESTS_RESULTS_DIR)
 # Consolidated targets
 
 .PHONY: check-block check-qapi-schema check-qtest check-unit check check-clean
-check-qapi-schema: $(patsubst %,check-%, $(check-qapi-schema-y)) check-tests/qapi-schema/doc-good.texi
+check-qapi-schema: check-tests/qapi-schema/frontend check-tests/qapi-schema/doc-good.texi
 check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
 check-block: $(patsubst %,check-%, $(check-block-y))
 check: check-block check-qapi-schema check-unit check-softfloat check-qtest check-decodetree
diff --git a/tests/acceptance/linux_ssh_mips_malta.py b/tests/acceptance/linux_ssh_mips_malta.py
index 25a1df5098..aa12001942 100644
--- a/tests/acceptance/linux_ssh_mips_malta.py
+++ b/tests/acceptance/linux_ssh_mips_malta.py
@@ -25,15 +25,44 @@ class LinuxSSH(Test):
     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
     VM_IP = '127.0.0.1'
 
+    BASE_URL = 'https://people.debian.org/~aurel32/qemu/'
     IMAGE_INFO = {
-        'be': {'image_url': ('https://people.debian.org/~aurel32/qemu/mips/'
-                             'debian_wheezy_mips_standard.qcow2'),
-               'image_hash': '8987a63270df67345b2135a6b7a4885a35e392d5'},
-        'le': {'image_url': ('https://people.debian.org/~aurel32/qemu/mipsel/'
-                             'debian_wheezy_mipsel_standard.qcow2'),
-               'image_hash': '7866764d9de3ef536ffca24c9fb9f04ffdb45802'}
+        'be': {'base_url': 'mips',
+               'image_name': 'debian_wheezy_mips_standard.qcow2',
+               'image_hash': '8987a63270df67345b2135a6b7a4885a35e392d5',
+               'kernel_hash': {
+                   32: '592e384a4edc16dade52a6cd5c785c637bcbc9ad',
+                   64: 'db6eea7de35d36c77d8c165b6bcb222e16eb91db'}
+              },
+        'le': {'base_url': 'mipsel',
+               'image_name': 'debian_wheezy_mipsel_standard.qcow2',
+               'image_hash': '7866764d9de3ef536ffca24c9fb9f04ffdb45802',
+               'kernel_hash': {
+                   32: 'a66bea5a8adaa2cb3d36a1d4e0ccdb01be8f6c2a',
+                   64: '6a7f77245acf231415a0e8b725d91ed2f3487794'}
+              }
         }
+    CPU_INFO = {
+        32: {'cpu': 'MIPS 24Kc', 'kernel_release': '3.2.0-4-4kc-malta'},
+        64: {'cpu': 'MIPS 20Kc', 'kernel_release': '3.2.0-4-5kc-malta'}
+        }
+
+    def get_url(self, endianess, path=''):
+        qkey = {'le': 'el', 'be': ''}
+        return '%s/mips%s/%s' % (self.BASE_URL, qkey[endianess], path)
+
+    def get_image_info(self, endianess):
+        dinfo = self.IMAGE_INFO[endianess]
+        image_url = self.get_url(endianess, dinfo['image_name'])
+        image_hash = dinfo['image_hash']
+        return (image_url, image_hash)
 
+    def get_kernel_info(self, endianess, wordsize):
+        minfo = self.CPU_INFO[wordsize]
+        kernel_url = self.get_url(endianess,
+                                  'vmlinux-%s' % minfo['kernel_release'])
+        kernel_hash = self.IMAGE_INFO[endianess]['kernel_hash'][wordsize]
+        return kernel_url, kernel_hash
 
     @skipUnless(ssh.SSH_CLIENT_BINARY, 'No SSH client available')
     @skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
@@ -91,8 +120,7 @@ class LinuxSSH(Test):
         return stdout_lines, stderr_lines
 
     def boot_debian_wheezy_image_and_ssh_login(self, endianess, kernel_path):
-        image_url = self.IMAGE_INFO[endianess]['image_url']
-        image_hash = self.IMAGE_INFO[endianess]['image_hash']
+        image_url, image_hash = self.get_image_info(endianess)
         image_path = self.fetch_asset(image_url, asset_hash=image_hash)
 
         self.vm.set_machine('malta')
@@ -102,7 +130,7 @@ class LinuxSSH(Test):
         self.vm.add_args('-no-reboot',
                          '-kernel', kernel_path,
                          '-append', kernel_command_line,
-                         '-hda', image_path,
+                         '-drive', 'file=%s,snapshot=on' % image_path,
                          '-netdev', 'user,id=vnet,hostfwd=:127.0.0.1:0-:22',
                          '-device', 'pcnet,netdev=vnet')
         self.vm.launch()
@@ -127,34 +155,31 @@ class LinuxSSH(Test):
         else:
             self.fail('"%s" output does not contain "%s"' % (cmd, exp))
 
-    def run_common_commands(self):
+    def run_common_commands(self, wordsize):
         self.ssh_command_output_contains(
             'cat /proc/cpuinfo',
-            '24Kc')
+            self.CPU_INFO[wordsize]['cpu'])
         self.ssh_command_output_contains(
             'uname -m',
             'mips')
         self.ssh_command_output_contains(
             'uname -r',
-            '3.2.0-4-4kc-malta')
+            self.CPU_INFO[wordsize]['kernel_release'])
         self.ssh_command_output_contains(
             'cat /proc/interrupts',
-            'timer')
+            'XT-PIC  timer')
         self.ssh_command_output_contains(
             'cat /proc/interrupts',
-            'i8042')
+            'XT-PIC  i8042')
         self.ssh_command_output_contains(
             'cat /proc/interrupts',
-            'serial')
+            'XT-PIC  serial')
         self.ssh_command_output_contains(
             'cat /proc/interrupts',
-            'ata_piix')
+            'XT-PIC  ata_piix')
         self.ssh_command_output_contains(
             'cat /proc/interrupts',
-            'eth0')
-        self.ssh_command_output_contains(
-            'cat /proc/interrupts',
-            'eth0')
+            'XT-PIC  eth0')
         self.ssh_command_output_contains(
             'cat /proc/devices',
             'input')
@@ -166,13 +191,13 @@ class LinuxSSH(Test):
             'fb')
         self.ssh_command_output_contains(
             'cat /proc/ioports',
-            'serial')
+            ' : serial')
         self.ssh_command_output_contains(
             'cat /proc/ioports',
-            'ata_piix')
+            ' : ata_piix')
         self.ssh_command_output_contains(
             'cat /proc/ioports',
-            'piix4_smbus')
+            ' : piix4_smbus')
         self.ssh_command_output_contains(
             'lspci -d 11ab:4620',
             'GT-64120')
@@ -182,18 +207,21 @@ class LinuxSSH(Test):
         self.ssh_command_output_contains(
             'cat /proc/mtd',
             'YAMON')
-        # Empty 'Board Config'
+        # Empty 'Board Config' (64KB)
         self.ssh_command_output_contains(
             'md5sum /dev/mtd2ro',
             '0dfbe8aa4c20b52e1b8bf3cb6cbdf193')
 
-    def check_mips_malta(self, endianess, kernel_path, uname_m):
+    def check_mips_malta(self, uname_m, endianess):
+        wordsize = 64 if '64' in uname_m else 32
+        kernel_url, kernel_hash = self.get_kernel_info(endianess, wordsize)
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
         self.boot_debian_wheezy_image_and_ssh_login(endianess, kernel_path)
 
         stdout, _ = self.ssh_command('uname -a')
         self.assertIn(True, [uname_m + " GNU/Linux" in line for line in stdout])
 
-        self.run_common_commands()
+        self.run_common_commands(wordsize)
         self.shutdown_via_ssh()
 
     def test_mips_malta32eb_kernel3_2_0(self):
@@ -203,12 +231,7 @@ class LinuxSSH(Test):
         :avocado: tags=endian:big
         :avocado: tags=device:pcnet32
         """
-        kernel_url = ('https://people.debian.org/~aurel32/qemu/mips/'
-                      'vmlinux-3.2.0-4-4kc-malta')
-        kernel_hash = '592e384a4edc16dade52a6cd5c785c637bcbc9ad'
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-
-        self.check_mips_malta('be', kernel_path, 'mips')
+        self.check_mips_malta('mips', 'be')
 
     def test_mips_malta32el_kernel3_2_0(self):
         """
@@ -217,12 +240,7 @@ class LinuxSSH(Test):
         :avocado: tags=endian:little
         :avocado: tags=device:pcnet32
         """
-        kernel_url = ('https://people.debian.org/~aurel32/qemu/mipsel/'
-                      'vmlinux-3.2.0-4-4kc-malta')
-        kernel_hash = 'a66bea5a8adaa2cb3d36a1d4e0ccdb01be8f6c2a'
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-
-        self.check_mips_malta('le', kernel_path, 'mips')
+        self.check_mips_malta('mips', 'le')
 
     def test_mips_malta64eb_kernel3_2_0(self):
         """
@@ -231,11 +249,7 @@ class LinuxSSH(Test):
         :avocado: tags=endian:big
         :avocado: tags=device:pcnet32
         """
-        kernel_url = ('https://people.debian.org/~aurel32/qemu/mips/'
-                      'vmlinux-3.2.0-4-5kc-malta')
-        kernel_hash = 'db6eea7de35d36c77d8c165b6bcb222e16eb91db'
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-        self.check_mips_malta('be', kernel_path, 'mips64')
+        self.check_mips_malta('mips64', 'be')
 
     def test_mips_malta64el_kernel3_2_0(self):
         """
@@ -244,8 +258,4 @@ class LinuxSSH(Test):
         :avocado: tags=endian:little
         :avocado: tags=device:pcnet32
         """
-        kernel_url = ('https://people.debian.org/~aurel32/qemu/mipsel/'
-                      'vmlinux-3.2.0-4-5kc-malta')
-        kernel_hash = '6a7f77245acf231415a0e8b725d91ed2f3487794'
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-        self.check_mips_malta('le', kernel_path, 'mips64')
+        self.check_mips_malta('mips64', 'le')
diff --git a/tests/migration/stress.c b/tests/migration/stress.c
index d9aa4afe92..0c23964693 100644
--- a/tests/migration/stress.c
+++ b/tests/migration/stress.c
@@ -192,7 +192,7 @@ static int stressone(unsigned long long ramsizeMB)
 
     /* We don't care about initial state, but we do want
      * to fault it all into RAM, otherwise the first iter
-     * of the loop below will be quite slow. We cna't use
+     * of the loop below will be quite slow. We can't use
      * 0x0 as the byte as gcc optimizes that away into a
      * calloc instead :-) */
     memset(ram, 0xfe, ramsizeMB * 1024 * 1024);
diff --git a/tests/qapi-schema/allow-preconfig-test.err b/tests/qapi-schema/allow-preconfig-test.err
index 2a4e6ce663..3cd672bc61 100644
--- a/tests/qapi-schema/allow-preconfig-test.err
+++ b/tests/qapi-schema/allow-preconfig-test.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/allow-preconfig-test.json: In command 'allow-preconfig-test':
-tests/qapi-schema/allow-preconfig-test.json:2: flag 'allow-preconfig' may only use true value
+allow-preconfig-test.json: In command 'allow-preconfig-test':
+allow-preconfig-test.json:2: flag 'allow-preconfig' may only use true value
diff --git a/tests/qapi-schema/allow-preconfig-test.exit b/tests/qapi-schema/allow-preconfig-test.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/allow-preconfig-test.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-any.err b/tests/qapi-schema/alternate-any.err
index 03aaf29506..baeb3f66d1 100644
--- a/tests/qapi-schema/alternate-any.err
+++ b/tests/qapi-schema/alternate-any.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-any.json: In alternate 'Alt':
-tests/qapi-schema/alternate-any.json:2: branch 'one' cannot use built-in type 'any'
+alternate-any.json: In alternate 'Alt':
+alternate-any.json:2: branch 'one' cannot use built-in type 'any'
diff --git a/tests/qapi-schema/alternate-any.exit b/tests/qapi-schema/alternate-any.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-any.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-array.err b/tests/qapi-schema/alternate-array.err
index dfbe3ee998..b1aa1f4e8d 100644
--- a/tests/qapi-schema/alternate-array.err
+++ b/tests/qapi-schema/alternate-array.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-array.json: In alternate 'Alt':
-tests/qapi-schema/alternate-array.json:5: 'data' member 'two' cannot be an array
+alternate-array.json: In alternate 'Alt':
+alternate-array.json:5: 'data' member 'two' cannot be an array
diff --git a/tests/qapi-schema/alternate-array.exit b/tests/qapi-schema/alternate-array.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-array.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-base.err b/tests/qapi-schema/alternate-base.err
index 04cea97e5c..31ebe56bbf 100644
--- a/tests/qapi-schema/alternate-base.err
+++ b/tests/qapi-schema/alternate-base.err
@@ -1,3 +1,3 @@
-tests/qapi-schema/alternate-base.json: In alternate 'Alt':
-tests/qapi-schema/alternate-base.json:4: alternate has unknown key 'base'
+alternate-base.json: In alternate 'Alt':
+alternate-base.json:4: alternate has unknown key 'base'
 Valid keys are 'alternate', 'data', 'if'.
diff --git a/tests/qapi-schema/alternate-base.exit b/tests/qapi-schema/alternate-base.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-base.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-branch-if-invalid.err b/tests/qapi-schema/alternate-branch-if-invalid.err
index 6c68e5a922..d384929c51 100644
--- a/tests/qapi-schema/alternate-branch-if-invalid.err
+++ b/tests/qapi-schema/alternate-branch-if-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-branch-if-invalid.json: In alternate 'Alt':
-tests/qapi-schema/alternate-branch-if-invalid.json:2: 'if' condition ' ' of 'data' member 'branch' makes no sense
+alternate-branch-if-invalid.json: In alternate 'Alt':
+alternate-branch-if-invalid.json:2: 'if' condition ' ' of 'data' member 'branch' makes no sense
diff --git a/tests/qapi-schema/alternate-branch-if-invalid.exit b/tests/qapi-schema/alternate-branch-if-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-branch-if-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-clash.err b/tests/qapi-schema/alternate-clash.err
index 73a52d69d1..f58b977f7b 100644
--- a/tests/qapi-schema/alternate-clash.err
+++ b/tests/qapi-schema/alternate-clash.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-clash.json: In alternate 'Alt1':
-tests/qapi-schema/alternate-clash.json:7: branch 'a_b' collides with branch 'a-b'
+alternate-clash.json: In alternate 'Alt1':
+alternate-clash.json:7: branch 'a_b' collides with branch 'a-b'
diff --git a/tests/qapi-schema/alternate-clash.exit b/tests/qapi-schema/alternate-clash.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-clash.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-conflict-bool-string.err b/tests/qapi-schema/alternate-conflict-bool-string.err
index f7513b9cbe..59ff5efa87 100644
--- a/tests/qapi-schema/alternate-conflict-bool-string.err
+++ b/tests/qapi-schema/alternate-conflict-bool-string.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-conflict-bool-string.json: In alternate 'Alt':
-tests/qapi-schema/alternate-conflict-bool-string.json:2: branch 'two' can't be distinguished from 'one'
+alternate-conflict-bool-string.json: In alternate 'Alt':
+alternate-conflict-bool-string.json:2: branch 'two' can't be distinguished from 'one'
diff --git a/tests/qapi-schema/alternate-conflict-bool-string.exit b/tests/qapi-schema/alternate-conflict-bool-string.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-conflict-bool-string.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-conflict-dict.err b/tests/qapi-schema/alternate-conflict-dict.err
index e5b42d04c9..d4970284ba 100644
--- a/tests/qapi-schema/alternate-conflict-dict.err
+++ b/tests/qapi-schema/alternate-conflict-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-conflict-dict.json: In alternate 'Alt':
-tests/qapi-schema/alternate-conflict-dict.json:6: branch 'two' can't be distinguished from 'one'
+alternate-conflict-dict.json: In alternate 'Alt':
+alternate-conflict-dict.json:6: branch 'two' can't be distinguished from 'one'
diff --git a/tests/qapi-schema/alternate-conflict-dict.exit b/tests/qapi-schema/alternate-conflict-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-conflict-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-conflict-enum-bool.err b/tests/qapi-schema/alternate-conflict-enum-bool.err
index 3d23aeba51..5f35855274 100644
--- a/tests/qapi-schema/alternate-conflict-enum-bool.err
+++ b/tests/qapi-schema/alternate-conflict-enum-bool.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-conflict-enum-bool.json: In alternate 'Alt':
-tests/qapi-schema/alternate-conflict-enum-bool.json:4: branch 'two' can't be distinguished from 'one'
+alternate-conflict-enum-bool.json: In alternate 'Alt':
+alternate-conflict-enum-bool.json:4: branch 'two' can't be distinguished from 'one'
diff --git a/tests/qapi-schema/alternate-conflict-enum-bool.exit b/tests/qapi-schema/alternate-conflict-enum-bool.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-conflict-enum-bool.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-conflict-enum-int.err b/tests/qapi-schema/alternate-conflict-enum-int.err
index b72768caa4..6a6d156664 100644
--- a/tests/qapi-schema/alternate-conflict-enum-int.err
+++ b/tests/qapi-schema/alternate-conflict-enum-int.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-conflict-enum-int.json: In alternate 'Alt':
-tests/qapi-schema/alternate-conflict-enum-int.json:4: branch 'two' can't be distinguished from 'one'
+alternate-conflict-enum-int.json: In alternate 'Alt':
+alternate-conflict-enum-int.json:4: branch 'two' can't be distinguished from 'one'
diff --git a/tests/qapi-schema/alternate-conflict-enum-int.exit b/tests/qapi-schema/alternate-conflict-enum-int.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-conflict-enum-int.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-conflict-num-string.err b/tests/qapi-schema/alternate-conflict-num-string.err
index b8a2bb1829..38c805ea1f 100644
--- a/tests/qapi-schema/alternate-conflict-num-string.err
+++ b/tests/qapi-schema/alternate-conflict-num-string.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-conflict-num-string.json: In alternate 'Alt':
-tests/qapi-schema/alternate-conflict-num-string.json:2: branch 'two' can't be distinguished from 'one'
+alternate-conflict-num-string.json: In alternate 'Alt':
+alternate-conflict-num-string.json:2: branch 'two' can't be distinguished from 'one'
diff --git a/tests/qapi-schema/alternate-conflict-num-string.exit b/tests/qapi-schema/alternate-conflict-num-string.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-conflict-num-string.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-conflict-string.err b/tests/qapi-schema/alternate-conflict-string.err
index 3edec51911..2fa08193db 100644
--- a/tests/qapi-schema/alternate-conflict-string.err
+++ b/tests/qapi-schema/alternate-conflict-string.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-conflict-string.json: In alternate 'Alt':
-tests/qapi-schema/alternate-conflict-string.json:2: branch 'two' can't be distinguished from 'one'
+alternate-conflict-string.json: In alternate 'Alt':
+alternate-conflict-string.json:2: branch 'two' can't be distinguished from 'one'
diff --git a/tests/qapi-schema/alternate-conflict-string.exit b/tests/qapi-schema/alternate-conflict-string.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-conflict-string.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-empty.err b/tests/qapi-schema/alternate-empty.err
index 908c309518..c6f6401d18 100644
--- a/tests/qapi-schema/alternate-empty.err
+++ b/tests/qapi-schema/alternate-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-empty.json: In alternate 'Alt':
-tests/qapi-schema/alternate-empty.json:2: 'data' must not be empty
+alternate-empty.json: In alternate 'Alt':
+alternate-empty.json:2: 'data' must not be empty
diff --git a/tests/qapi-schema/alternate-empty.exit b/tests/qapi-schema/alternate-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-invalid-dict.err b/tests/qapi-schema/alternate-invalid-dict.err
index d6a18a294b..e9e5025226 100644
--- a/tests/qapi-schema/alternate-invalid-dict.err
+++ b/tests/qapi-schema/alternate-invalid-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-invalid-dict.json: In alternate 'Alt':
-tests/qapi-schema/alternate-invalid-dict.json:2: 'data' member 'two' misses key 'type'
+alternate-invalid-dict.json: In alternate 'Alt':
+alternate-invalid-dict.json:2: 'data' member 'two' misses key 'type'
diff --git a/tests/qapi-schema/alternate-invalid-dict.exit b/tests/qapi-schema/alternate-invalid-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-invalid-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-nested.err b/tests/qapi-schema/alternate-nested.err
index cd7a076ce5..3ae9cd2f11 100644
--- a/tests/qapi-schema/alternate-nested.err
+++ b/tests/qapi-schema/alternate-nested.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-nested.json: In alternate 'Alt2':
-tests/qapi-schema/alternate-nested.json:4: branch 'nested' cannot use alternate type 'Alt1'
+alternate-nested.json: In alternate 'Alt2':
+alternate-nested.json:4: branch 'nested' cannot use alternate type 'Alt1'
diff --git a/tests/qapi-schema/alternate-nested.exit b/tests/qapi-schema/alternate-nested.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-nested.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/alternate-unknown.err b/tests/qapi-schema/alternate-unknown.err
index df05860bba..17fec1cd17 100644
--- a/tests/qapi-schema/alternate-unknown.err
+++ b/tests/qapi-schema/alternate-unknown.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/alternate-unknown.json: In alternate 'Alt':
-tests/qapi-schema/alternate-unknown.json:2: branch 'unknown' uses unknown type 'MissingType'
+alternate-unknown.json: In alternate 'Alt':
+alternate-unknown.json:2: branch 'unknown' uses unknown type 'MissingType'
diff --git a/tests/qapi-schema/alternate-unknown.exit b/tests/qapi-schema/alternate-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/alternate-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-alternate.err b/tests/qapi-schema/args-alternate.err
index 852b81b89c..b1530aa610 100644
--- a/tests/qapi-schema/args-alternate.err
+++ b/tests/qapi-schema/args-alternate.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-alternate.json: In command 'oops':
-tests/qapi-schema/args-alternate.json:3: command's 'data' cannot take alternate type 'Alt'
+args-alternate.json: In command 'oops':
+args-alternate.json:3: command's 'data' cannot take alternate type 'Alt'
diff --git a/tests/qapi-schema/args-alternate.exit b/tests/qapi-schema/args-alternate.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-alternate.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-any.err b/tests/qapi-schema/args-any.err
index 04e11df29f..4b60560247 100644
--- a/tests/qapi-schema/args-any.err
+++ b/tests/qapi-schema/args-any.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-any.json: In command 'oops':
-tests/qapi-schema/args-any.json:2: command's 'data' cannot take built-in type 'any'
+args-any.json: In command 'oops':
+args-any.json:2: command's 'data' cannot take built-in type 'any'
diff --git a/tests/qapi-schema/args-any.exit b/tests/qapi-schema/args-any.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-any.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-array-empty.err b/tests/qapi-schema/args-array-empty.err
index c7d367730e..181222296e 100644
--- a/tests/qapi-schema/args-array-empty.err
+++ b/tests/qapi-schema/args-array-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-array-empty.json: In command 'oops':
-tests/qapi-schema/args-array-empty.json:2: 'data' member 'empty': array type must contain single type name
+args-array-empty.json: In command 'oops':
+args-array-empty.json:2: 'data' member 'empty': array type must contain single type name
diff --git a/tests/qapi-schema/args-array-empty.exit b/tests/qapi-schema/args-array-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-array-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-array-unknown.err b/tests/qapi-schema/args-array-unknown.err
index 218fc4bf9a..cbc598e4ff 100644
--- a/tests/qapi-schema/args-array-unknown.err
+++ b/tests/qapi-schema/args-array-unknown.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-array-unknown.json: In command 'oops':
-tests/qapi-schema/args-array-unknown.json:2: command uses unknown type 'NoSuchType'
+args-array-unknown.json: In command 'oops':
+args-array-unknown.json:2: command uses unknown type 'NoSuchType'
diff --git a/tests/qapi-schema/args-array-unknown.exit b/tests/qapi-schema/args-array-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-array-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-bad-boxed.err b/tests/qapi-schema/args-bad-boxed.err
index 31d39038fc..361276eb29 100644
--- a/tests/qapi-schema/args-bad-boxed.err
+++ b/tests/qapi-schema/args-bad-boxed.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-bad-boxed.json: In command 'foo':
-tests/qapi-schema/args-bad-boxed.json:2: flag 'boxed' may only use true value
+args-bad-boxed.json: In command 'foo':
+args-bad-boxed.json:2: flag 'boxed' may only use true value
diff --git a/tests/qapi-schema/args-bad-boxed.exit b/tests/qapi-schema/args-bad-boxed.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-bad-boxed.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-boxed-anon.err b/tests/qapi-schema/args-boxed-anon.err
index 5e0c2979b7..a89af75bef 100644
--- a/tests/qapi-schema/args-boxed-anon.err
+++ b/tests/qapi-schema/args-boxed-anon.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-boxed-anon.json: In command 'foo':
-tests/qapi-schema/args-boxed-anon.json:2: 'data' should be a type name
+args-boxed-anon.json: In command 'foo':
+args-boxed-anon.json:2: 'data' should be a type name
diff --git a/tests/qapi-schema/args-boxed-anon.exit b/tests/qapi-schema/args-boxed-anon.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-boxed-anon.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-boxed-string.err b/tests/qapi-schema/args-boxed-string.err
index dc2b00f217..415c1148a9 100644
--- a/tests/qapi-schema/args-boxed-string.err
+++ b/tests/qapi-schema/args-boxed-string.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-boxed-string.json: In command 'foo':
-tests/qapi-schema/args-boxed-string.json:2: command's 'data' cannot take built-in type 'str'
+args-boxed-string.json: In command 'foo':
+args-boxed-string.json:2: command's 'data' cannot take built-in type 'str'
diff --git a/tests/qapi-schema/args-boxed-string.exit b/tests/qapi-schema/args-boxed-string.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-boxed-string.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-int.err b/tests/qapi-schema/args-int.err
index 81b6f86b66..a2331c5543 100644
--- a/tests/qapi-schema/args-int.err
+++ b/tests/qapi-schema/args-int.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-int.json: In command 'oops':
-tests/qapi-schema/args-int.json:2: command's 'data' cannot take built-in type 'int'
+args-int.json: In command 'oops':
+args-int.json:2: command's 'data' cannot take built-in type 'int'
diff --git a/tests/qapi-schema/args-int.exit b/tests/qapi-schema/args-int.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-int.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-invalid.err b/tests/qapi-schema/args-invalid.err
index c4971e1399..1527c4a48d 100644
--- a/tests/qapi-schema/args-invalid.err
+++ b/tests/qapi-schema/args-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-invalid.json: In command 'foo':
-tests/qapi-schema/args-invalid.json:1: 'data' should be an object or type name
+args-invalid.json: In command 'foo':
+args-invalid.json:1: 'data' should be an object or type name
diff --git a/tests/qapi-schema/args-invalid.exit b/tests/qapi-schema/args-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-member-array-bad.err b/tests/qapi-schema/args-member-array-bad.err
index f95ac01372..194a3052d2 100644
--- a/tests/qapi-schema/args-member-array-bad.err
+++ b/tests/qapi-schema/args-member-array-bad.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-member-array-bad.json: In command 'oops':
-tests/qapi-schema/args-member-array-bad.json:2: 'data' member 'member': array type must contain single type name
+args-member-array-bad.json: In command 'oops':
+args-member-array-bad.json:2: 'data' member 'member': array type must contain single type name
diff --git a/tests/qapi-schema/args-member-array-bad.exit b/tests/qapi-schema/args-member-array-bad.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-member-array-bad.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-member-case.err b/tests/qapi-schema/args-member-case.err
index 3ecd276040..4f33dbbc38 100644
--- a/tests/qapi-schema/args-member-case.err
+++ b/tests/qapi-schema/args-member-case.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-member-case.json: In command 'no-way-this-will-get-whitelisted':
-tests/qapi-schema/args-member-case.json:2: 'data' member 'Arg' uses uppercase in name
+args-member-case.json: In command 'no-way-this-will-get-whitelisted':
+args-member-case.json:2: 'data' member 'Arg' uses uppercase in name
diff --git a/tests/qapi-schema/args-member-case.exit b/tests/qapi-schema/args-member-case.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-member-case.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-member-unknown.err b/tests/qapi-schema/args-member-unknown.err
index 0626e1209d..96b6e5d289 100644
--- a/tests/qapi-schema/args-member-unknown.err
+++ b/tests/qapi-schema/args-member-unknown.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-member-unknown.json: In command 'oops':
-tests/qapi-schema/args-member-unknown.json:2: parameter 'member' uses unknown type 'NoSuchType'
+args-member-unknown.json: In command 'oops':
+args-member-unknown.json:2: parameter 'member' uses unknown type 'NoSuchType'
diff --git a/tests/qapi-schema/args-member-unknown.exit b/tests/qapi-schema/args-member-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-member-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-name-clash.err b/tests/qapi-schema/args-name-clash.err
index c5916a80fb..3e04817bc0 100644
--- a/tests/qapi-schema/args-name-clash.err
+++ b/tests/qapi-schema/args-name-clash.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-name-clash.json: In command 'oops':
-tests/qapi-schema/args-name-clash.json:4: parameter 'a_b' collides with parameter 'a-b'
+args-name-clash.json: In command 'oops':
+args-name-clash.json:4: parameter 'a_b' collides with parameter 'a-b'
diff --git a/tests/qapi-schema/args-name-clash.exit b/tests/qapi-schema/args-name-clash.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-name-clash.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-union.err b/tests/qapi-schema/args-union.err
index 3a77b2863f..4bf4955027 100644
--- a/tests/qapi-schema/args-union.err
+++ b/tests/qapi-schema/args-union.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-union.json: In command 'oops':
-tests/qapi-schema/args-union.json:3: command's 'data' can take union type 'Uni' only with 'boxed': true
+args-union.json: In command 'oops':
+args-union.json:3: command's 'data' can take union type 'Uni' only with 'boxed': true
diff --git a/tests/qapi-schema/args-union.exit b/tests/qapi-schema/args-union.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-union.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/args-unknown.err b/tests/qapi-schema/args-unknown.err
index 6857d6bf48..44bf8706ae 100644
--- a/tests/qapi-schema/args-unknown.err
+++ b/tests/qapi-schema/args-unknown.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/args-unknown.json: In command 'oops':
-tests/qapi-schema/args-unknown.json:2: command's 'data' uses unknown type 'NoSuchType'
+args-unknown.json: In command 'oops':
+args-unknown.json:2: command's 'data' uses unknown type 'NoSuchType'
diff --git a/tests/qapi-schema/args-unknown.exit b/tests/qapi-schema/args-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/args-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-base.err b/tests/qapi-schema/bad-base.err
index 039678a364..61a1efc2c0 100644
--- a/tests/qapi-schema/bad-base.err
+++ b/tests/qapi-schema/bad-base.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-base.json: In struct 'MyType':
-tests/qapi-schema/bad-base.json:3: 'base' requires a struct type, union type 'Union' isn't
+bad-base.json: In struct 'MyType':
+bad-base.json:3: 'base' requires a struct type, union type 'Union' isn't
diff --git a/tests/qapi-schema/bad-base.exit b/tests/qapi-schema/bad-base.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-base.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-data.err b/tests/qapi-schema/bad-data.err
index 5227bdce7e..7991c8898d 100644
--- a/tests/qapi-schema/bad-data.err
+++ b/tests/qapi-schema/bad-data.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-data.json: In command 'oops':
-tests/qapi-schema/bad-data.json:2: 'data' cannot be an array
+bad-data.json: In command 'oops':
+bad-data.json:2: 'data' cannot be an array
diff --git a/tests/qapi-schema/bad-data.exit b/tests/qapi-schema/bad-data.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-data.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-ident.err b/tests/qapi-schema/bad-ident.err
index ad38a679c7..263fcd3ecd 100644
--- a/tests/qapi-schema/bad-ident.err
+++ b/tests/qapi-schema/bad-ident.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-ident.json: In struct '*oops':
-tests/qapi-schema/bad-ident.json:2: struct has an invalid name
+bad-ident.json: In struct '*oops':
+bad-ident.json:2: struct has an invalid name
diff --git a/tests/qapi-schema/bad-ident.exit b/tests/qapi-schema/bad-ident.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-ident.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-if-empty-list.err b/tests/qapi-schema/bad-if-empty-list.err
index 517519f500..a946376d06 100644
--- a/tests/qapi-schema/bad-if-empty-list.err
+++ b/tests/qapi-schema/bad-if-empty-list.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-if-empty-list.json: In struct 'TestIfStruct':
-tests/qapi-schema/bad-if-empty-list.json:2: 'if' condition [] of struct is useless
+bad-if-empty-list.json: In struct 'TestIfStruct':
+bad-if-empty-list.json:2: 'if' condition [] of struct is useless
diff --git a/tests/qapi-schema/bad-if-empty-list.exit b/tests/qapi-schema/bad-if-empty-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-if-empty-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-if-empty.err b/tests/qapi-schema/bad-if-empty.err
index 5f1767388e..a0f3effefb 100644
--- a/tests/qapi-schema/bad-if-empty.err
+++ b/tests/qapi-schema/bad-if-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-if-empty.json: In struct 'TestIfStruct':
-tests/qapi-schema/bad-if-empty.json:2: 'if' condition '' of struct makes no sense
+bad-if-empty.json: In struct 'TestIfStruct':
+bad-if-empty.json:2: 'if' condition '' of struct makes no sense
diff --git a/tests/qapi-schema/bad-if-empty.exit b/tests/qapi-schema/bad-if-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-if-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-if-list.err b/tests/qapi-schema/bad-if-list.err
index e5d72b2f39..c462f11b90 100644
--- a/tests/qapi-schema/bad-if-list.err
+++ b/tests/qapi-schema/bad-if-list.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-if-list.json: In struct 'TestIfStruct':
-tests/qapi-schema/bad-if-list.json:2: 'if' condition ' ' of struct makes no sense
+bad-if-list.json: In struct 'TestIfStruct':
+bad-if-list.json:2: 'if' condition ' ' of struct makes no sense
diff --git a/tests/qapi-schema/bad-if-list.exit b/tests/qapi-schema/bad-if-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-if-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-if.err b/tests/qapi-schema/bad-if.err
index 65d8efd7e4..f83dee65da 100644
--- a/tests/qapi-schema/bad-if.err
+++ b/tests/qapi-schema/bad-if.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/bad-if.json: In struct 'TestIfStruct':
-tests/qapi-schema/bad-if.json:2: 'if' condition of struct must be a string or a list of strings
+bad-if.json: In struct 'TestIfStruct':
+bad-if.json:2: 'if' condition of struct must be a string or a list of strings
diff --git a/tests/qapi-schema/bad-if.exit b/tests/qapi-schema/bad-if.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-if.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-type-bool.err b/tests/qapi-schema/bad-type-bool.err
index 984a77c4e3..42ccc18988 100644
--- a/tests/qapi-schema/bad-type-bool.err
+++ b/tests/qapi-schema/bad-type-bool.err
@@ -1 +1 @@
-tests/qapi-schema/bad-type-bool.json:2: 'struct' requires a string name
+bad-type-bool.json:2: 'struct' requires a string name
diff --git a/tests/qapi-schema/bad-type-bool.exit b/tests/qapi-schema/bad-type-bool.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-type-bool.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-type-dict.err b/tests/qapi-schema/bad-type-dict.err
index e83b8cfb41..3d97cd3f0a 100644
--- a/tests/qapi-schema/bad-type-dict.err
+++ b/tests/qapi-schema/bad-type-dict.err
@@ -1 +1 @@
-tests/qapi-schema/bad-type-dict.json:2: 'command' requires a string name
+bad-type-dict.json:2: 'command' requires a string name
diff --git a/tests/qapi-schema/bad-type-dict.exit b/tests/qapi-schema/bad-type-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-type-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/bad-type-int.err b/tests/qapi-schema/bad-type-int.err
index 7f5916ea29..90d06bd94d 100644
--- a/tests/qapi-schema/bad-type-int.err
+++ b/tests/qapi-schema/bad-type-int.err
@@ -1 +1 @@
-tests/qapi-schema/bad-type-int.json:3:13: stray '123'
+bad-type-int.json:3:13: stray '123'
diff --git a/tests/qapi-schema/bad-type-int.exit b/tests/qapi-schema/bad-type-int.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/bad-type-int.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/base-cycle-direct.err b/tests/qapi-schema/base-cycle-direct.err
index 233e4b8952..4ea6c5064e 100644
--- a/tests/qapi-schema/base-cycle-direct.err
+++ b/tests/qapi-schema/base-cycle-direct.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/base-cycle-direct.json: In struct 'Loopy':
-tests/qapi-schema/base-cycle-direct.json:2: object Loopy contains itself
+base-cycle-direct.json: In struct 'Loopy':
+base-cycle-direct.json:2: object Loopy contains itself
diff --git a/tests/qapi-schema/base-cycle-direct.exit b/tests/qapi-schema/base-cycle-direct.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/base-cycle-direct.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/base-cycle-indirect.err b/tests/qapi-schema/base-cycle-indirect.err
index 4472f30ba1..9b5e7ec174 100644
--- a/tests/qapi-schema/base-cycle-indirect.err
+++ b/tests/qapi-schema/base-cycle-indirect.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/base-cycle-indirect.json: In struct 'Base1':
-tests/qapi-schema/base-cycle-indirect.json:2: object Base1 contains itself
+base-cycle-indirect.json: In struct 'Base1':
+base-cycle-indirect.json:2: object Base1 contains itself
diff --git a/tests/qapi-schema/base-cycle-indirect.exit b/tests/qapi-schema/base-cycle-indirect.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/base-cycle-indirect.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/command-int.err b/tests/qapi-schema/command-int.err
index 3523d50a79..df0e5f5a57 100644
--- a/tests/qapi-schema/command-int.err
+++ b/tests/qapi-schema/command-int.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/command-int.json: In command 'int':
-tests/qapi-schema/command-int.json:2: built-in type 'int' is already defined
+command-int.json: In command 'int':
+command-int.json:2: built-in type 'int' is already defined
diff --git a/tests/qapi-schema/command-int.exit b/tests/qapi-schema/command-int.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/command-int.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/comments.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/doc-bad-alternate-member.err b/tests/qapi-schema/doc-bad-alternate-member.err
index 19a1ffd76e..a1c282f935 100644
--- a/tests/qapi-schema/doc-bad-alternate-member.err
+++ b/tests/qapi-schema/doc-bad-alternate-member.err
@@ -1 +1 @@
-tests/qapi-schema/doc-bad-alternate-member.json:3: the following documented members are not in the declaration: aa, bb
+doc-bad-alternate-member.json:3: the following documented members are not in the declaration: aa, bb
diff --git a/tests/qapi-schema/doc-bad-alternate-member.exit b/tests/qapi-schema/doc-bad-alternate-member.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-bad-alternate-member.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-bad-command-arg.err b/tests/qapi-schema/doc-bad-command-arg.err
index 6962ebed69..153ea0330a 100644
--- a/tests/qapi-schema/doc-bad-command-arg.err
+++ b/tests/qapi-schema/doc-bad-command-arg.err
@@ -1 +1 @@
-tests/qapi-schema/doc-bad-command-arg.json:3: the following documented members are not in the declaration: b
+doc-bad-command-arg.json:3: the following documented members are not in the declaration: b
diff --git a/tests/qapi-schema/doc-bad-command-arg.exit b/tests/qapi-schema/doc-bad-command-arg.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-bad-command-arg.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-bad-section.exit b/tests/qapi-schema/doc-bad-section.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/doc-bad-section.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/doc-bad-symbol.err b/tests/qapi-schema/doc-bad-symbol.err
index b23e99d160..166c8dcc18 100644
--- a/tests/qapi-schema/doc-bad-symbol.err
+++ b/tests/qapi-schema/doc-bad-symbol.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/doc-bad-symbol.json: In command 'foo':
-tests/qapi-schema/doc-bad-symbol.json:6: documentation comment is for 'food'
+doc-bad-symbol.json: In command 'foo':
+doc-bad-symbol.json:6: documentation comment is for 'food'
diff --git a/tests/qapi-schema/doc-bad-symbol.exit b/tests/qapi-schema/doc-bad-symbol.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-bad-symbol.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-bad-union-member.err b/tests/qapi-schema/doc-bad-union-member.err
index da3cd806e3..8b9d36eab1 100644
--- a/tests/qapi-schema/doc-bad-union-member.err
+++ b/tests/qapi-schema/doc-bad-union-member.err
@@ -1 +1 @@
-tests/qapi-schema/doc-bad-union-member.json:3: the following documented members are not in the declaration: a, b
+doc-bad-union-member.json:3: the following documented members are not in the declaration: a, b
diff --git a/tests/qapi-schema/doc-bad-union-member.exit b/tests/qapi-schema/doc-bad-union-member.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-bad-union-member.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-before-include.err b/tests/qapi-schema/doc-before-include.err
index e5566f11e9..ae23ea2f57 100644
--- a/tests/qapi-schema/doc-before-include.err
+++ b/tests/qapi-schema/doc-before-include.err
@@ -1 +1 @@
-tests/qapi-schema/doc-before-include.json:3: documentation for 'foo' is not followed by the definition
+doc-before-include.json:3: documentation for 'foo' is not followed by the definition
diff --git a/tests/qapi-schema/doc-before-include.exit b/tests/qapi-schema/doc-before-include.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-before-include.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-before-pragma.err b/tests/qapi-schema/doc-before-pragma.err
index 8a97ebb578..c776252e07 100644
--- a/tests/qapi-schema/doc-before-pragma.err
+++ b/tests/qapi-schema/doc-before-pragma.err
@@ -1 +1 @@
-tests/qapi-schema/doc-before-pragma.json:3: documentation for 'foo' is not followed by the definition
+doc-before-pragma.json:3: documentation for 'foo' is not followed by the definition
diff --git a/tests/qapi-schema/doc-before-pragma.exit b/tests/qapi-schema/doc-before-pragma.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-before-pragma.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-duplicated-arg.err b/tests/qapi-schema/doc-duplicated-arg.err
index 1c3f8e0a54..0d0d777a1f 100644
--- a/tests/qapi-schema/doc-duplicated-arg.err
+++ b/tests/qapi-schema/doc-duplicated-arg.err
@@ -1 +1 @@
-tests/qapi-schema/doc-duplicated-arg.json:6:1: 'a' parameter name duplicated
+doc-duplicated-arg.json:6:1: 'a' parameter name duplicated
diff --git a/tests/qapi-schema/doc-duplicated-arg.exit b/tests/qapi-schema/doc-duplicated-arg.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-duplicated-arg.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-duplicated-return.err b/tests/qapi-schema/doc-duplicated-return.err
index 7631933093..fe97e3db8d 100644
--- a/tests/qapi-schema/doc-duplicated-return.err
+++ b/tests/qapi-schema/doc-duplicated-return.err
@@ -1 +1 @@
-tests/qapi-schema/doc-duplicated-return.json:7:1: duplicated 'Returns' section
+doc-duplicated-return.json:7:1: duplicated 'Returns' section
diff --git a/tests/qapi-schema/doc-duplicated-return.exit b/tests/qapi-schema/doc-duplicated-return.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-duplicated-return.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-duplicated-since.err b/tests/qapi-schema/doc-duplicated-since.err
index 5ee15ae2a1..abca141a2c 100644
--- a/tests/qapi-schema/doc-duplicated-since.err
+++ b/tests/qapi-schema/doc-duplicated-since.err
@@ -1 +1 @@
-tests/qapi-schema/doc-duplicated-since.json:7:1: duplicated 'Since' section
+doc-duplicated-since.json:7:1: duplicated 'Since' section
diff --git a/tests/qapi-schema/doc-duplicated-since.exit b/tests/qapi-schema/doc-duplicated-since.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-duplicated-since.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-empty-arg.err b/tests/qapi-schema/doc-empty-arg.err
index 3c78a37ae1..2d0f35f310 100644
--- a/tests/qapi-schema/doc-empty-arg.err
+++ b/tests/qapi-schema/doc-empty-arg.err
@@ -1 +1 @@
-tests/qapi-schema/doc-empty-arg.json:5:1: invalid parameter name
+doc-empty-arg.json:5:1: invalid parameter name
diff --git a/tests/qapi-schema/doc-empty-arg.exit b/tests/qapi-schema/doc-empty-arg.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-empty-arg.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-empty-section.err b/tests/qapi-schema/doc-empty-section.err
index f6586c566f..ba7ba70125 100644
--- a/tests/qapi-schema/doc-empty-section.err
+++ b/tests/qapi-schema/doc-empty-section.err
@@ -1 +1 @@
-tests/qapi-schema/doc-empty-section.json:7:1: empty doc section 'Note'
+doc-empty-section.json:7:1: empty doc section 'Note'
diff --git a/tests/qapi-schema/doc-empty-section.exit b/tests/qapi-schema/doc-empty-section.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-empty-section.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-empty-symbol.err b/tests/qapi-schema/doc-empty-symbol.err
index 2dcddca7f6..81b90e882a 100644
--- a/tests/qapi-schema/doc-empty-symbol.err
+++ b/tests/qapi-schema/doc-empty-symbol.err
@@ -1 +1 @@
-tests/qapi-schema/doc-empty-symbol.json:4:1: invalid name
+doc-empty-symbol.json:4:1: invalid name
diff --git a/tests/qapi-schema/doc-empty-symbol.exit b/tests/qapi-schema/doc-empty-symbol.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-empty-symbol.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-good.exit b/tests/qapi-schema/doc-good.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/doc-good.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/doc-good.json b/tests/qapi-schema/doc-good.json
index f7fb48af38..7dc21e58a3 100644
--- a/tests/qapi-schema/doc-good.json
+++ b/tests/qapi-schema/doc-good.json
@@ -71,8 +71,12 @@
 # A paragraph
 #
 # Another paragraph (but no @var: line)
+#
+# Features:
+# @variant1-feat: a feature
 ##
 { 'struct': 'Variant1',
+  'features': [ 'variant1-feat' ],
   'data': { 'var1': { 'type': 'str', 'if': 'defined(IFSTR)' } } }
 
 ##
@@ -104,6 +108,10 @@
 #
 # @arg2: the second
 # argument
+#
+# Features:
+# @cmd-feat1: a feature
+# @cmd-feat2: another feature
 # Note: @arg3 is undocumented
 # Returns: @Object
 # TODO: frobnicate
@@ -123,11 +131,15 @@
 ##
 { 'command': 'cmd',
   'data': { 'arg1': 'int', '*arg2': 'str', 'arg3': 'bool' },
-  'returns': 'Object' }
+  'returns': 'Object',
+  'features': [ 'cmd-feat1', 'cmd-feat2' ] }
 
 ##
 # @cmd-boxed:
 # If you're bored enough to read this, go see a video of boxed cats
+# Features:
+# @cmd-feat1: a feature
+# @cmd-feat2: another feature
 # Example:
 #
 # -> in
@@ -135,4 +147,5 @@
 # <- out
 ##
 { 'command': 'cmd-boxed', 'boxed': true,
-  'data': 'Object' }
+  'data': 'Object',
+  'features': [ 'cmd-feat1', 'cmd-feat2' ] }
diff --git a/tests/qapi-schema/doc-good.out b/tests/qapi-schema/doc-good.out
index d3bca343eb..f78fdef6a9 100644
--- a/tests/qapi-schema/doc-good.out
+++ b/tests/qapi-schema/doc-good.out
@@ -20,6 +20,7 @@ object Base
 object Variant1
     member var1: str optional=False
         if ['defined(IFSTR)']
+    feature variant1-feat
 object Variant2
 object Object
     base Base
@@ -46,9 +47,13 @@ object q_obj_cmd-arg
     member arg2: str optional=True
     member arg3: bool optional=False
 command cmd q_obj_cmd-arg -> Object
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
+    feature cmd-feat1
+    feature cmd-feat2
 command cmd-boxed Object -> None
-   gen=True success_response=True boxed=True oob=False preconfig=False
+    gen=True success_response=True boxed=True oob=False preconfig=False
+    feature cmd-feat1
+    feature cmd-feat2
 doc freeform
     body=
 = Section
diff --git a/tests/qapi-schema/doc-good.texi b/tests/qapi-schema/doc-good.texi
index 2526abc6d9..2ce8b883c9 100644
--- a/tests/qapi-schema/doc-good.texi
+++ b/tests/qapi-schema/doc-good.texi
@@ -122,6 +122,12 @@ Not documented
 @*@b{If:} @code{defined(IFSTR)}
 @end table
 
+@b{Features:}
+@table @asis
+@item @code{variant1-feat}
+a feature
+@end table
+
 @end deftp
 
 
@@ -182,6 +188,14 @@ argument
 Not documented
 @end table
 
+@b{Features:}
+@table @asis
+@item @code{cmd-feat1}
+a feature
+@item @code{cmd-feat2}
+another feature
+@end table
+
 @b{Note:}
 @code{arg3} is undocumented
 
@@ -227,6 +241,14 @@ If you're bored enough to read this, go see a video of boxed cats
 
 @b{Arguments:} the members of @code{Object}
 
+@b{Features:}
+@table @asis
+@item @code{cmd-feat1}
+a feature
+@item @code{cmd-feat2}
+another feature
+@end table
+
 @b{Example:}
 @example
 -> in
diff --git a/tests/qapi-schema/doc-interleaved-section.err b/tests/qapi-schema/doc-interleaved-section.err
index d373eabc55..715d58cd31 100644
--- a/tests/qapi-schema/doc-interleaved-section.err
+++ b/tests/qapi-schema/doc-interleaved-section.err
@@ -1 +1 @@
-tests/qapi-schema/doc-interleaved-section.json:15:1: '@foobar:' can't follow 'Note' section
+doc-interleaved-section.json:15:1: '@foobar:' can't follow 'Note' section
diff --git a/tests/qapi-schema/doc-interleaved-section.exit b/tests/qapi-schema/doc-interleaved-section.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-interleaved-section.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-invalid-end.err b/tests/qapi-schema/doc-invalid-end.err
index 6345aa6a0f..919e4d317e 100644
--- a/tests/qapi-schema/doc-invalid-end.err
+++ b/tests/qapi-schema/doc-invalid-end.err
@@ -1 +1 @@
-tests/qapi-schema/doc-invalid-end.json:5:2: documentation comment must end with '##'
+doc-invalid-end.json:5:2: documentation comment must end with '##'
diff --git a/tests/qapi-schema/doc-invalid-end.exit b/tests/qapi-schema/doc-invalid-end.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-invalid-end.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-invalid-end2.err b/tests/qapi-schema/doc-invalid-end2.err
index 13ead36fd2..d88a15cc8a 100644
--- a/tests/qapi-schema/doc-invalid-end2.err
+++ b/tests/qapi-schema/doc-invalid-end2.err
@@ -1 +1 @@
-tests/qapi-schema/doc-invalid-end2.json:5:1: junk after '##' at end of documentation comment
+doc-invalid-end2.json:5:1: junk after '##' at end of documentation comment
diff --git a/tests/qapi-schema/doc-invalid-end2.exit b/tests/qapi-schema/doc-invalid-end2.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-invalid-end2.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-invalid-return.err b/tests/qapi-schema/doc-invalid-return.err
index 5aaba33bb4..2ad89c5941 100644
--- a/tests/qapi-schema/doc-invalid-return.err
+++ b/tests/qapi-schema/doc-invalid-return.err
@@ -1 +1 @@
-tests/qapi-schema/doc-invalid-return.json:3: 'Returns:' is only valid for commands
+doc-invalid-return.json:3: 'Returns:' is only valid for commands
diff --git a/tests/qapi-schema/doc-invalid-return.exit b/tests/qapi-schema/doc-invalid-return.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-invalid-return.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-invalid-section.err b/tests/qapi-schema/doc-invalid-section.err
index bda93b44fd..d2d40e5704 100644
--- a/tests/qapi-schema/doc-invalid-section.err
+++ b/tests/qapi-schema/doc-invalid-section.err
@@ -1 +1 @@
-tests/qapi-schema/doc-invalid-section.json:5:1: '@note:' not allowed in free-form documentation
+doc-invalid-section.json:5:1: '@note:' not allowed in free-form documentation
diff --git a/tests/qapi-schema/doc-invalid-section.exit b/tests/qapi-schema/doc-invalid-section.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-invalid-section.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-invalid-start.err b/tests/qapi-schema/doc-invalid-start.err
index dcaa9699d6..276c033600 100644
--- a/tests/qapi-schema/doc-invalid-start.err
+++ b/tests/qapi-schema/doc-invalid-start.err
@@ -1 +1 @@
-tests/qapi-schema/doc-invalid-start.json:3:1: junk after '##' at start of documentation comment
+doc-invalid-start.json:3:1: junk after '##' at start of documentation comment
diff --git a/tests/qapi-schema/doc-invalid-start.exit b/tests/qapi-schema/doc-invalid-start.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-invalid-start.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-missing-colon.err b/tests/qapi-schema/doc-missing-colon.err
index 6fb5a380bd..cbcea00715 100644
--- a/tests/qapi-schema/doc-missing-colon.err
+++ b/tests/qapi-schema/doc-missing-colon.err
@@ -1 +1 @@
-tests/qapi-schema/doc-missing-colon.json:4:1: line should end with ':'
+doc-missing-colon.json:4:1: line should end with ':'
diff --git a/tests/qapi-schema/doc-missing-colon.exit b/tests/qapi-schema/doc-missing-colon.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-missing-colon.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-missing-expr.err b/tests/qapi-schema/doc-missing-expr.err
index 622a37cc6c..c9b32a96fa 100644
--- a/tests/qapi-schema/doc-missing-expr.err
+++ b/tests/qapi-schema/doc-missing-expr.err
@@ -1 +1 @@
-tests/qapi-schema/doc-missing-expr.json:3: documentation for 'bar' is not followed by the definition
+doc-missing-expr.json:3: documentation for 'bar' is not followed by the definition
diff --git a/tests/qapi-schema/doc-missing-expr.exit b/tests/qapi-schema/doc-missing-expr.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-missing-expr.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-missing-space.err b/tests/qapi-schema/doc-missing-space.err
index 1187ba12c4..350031d1d6 100644
--- a/tests/qapi-schema/doc-missing-space.err
+++ b/tests/qapi-schema/doc-missing-space.err
@@ -1 +1 @@
-tests/qapi-schema/doc-missing-space.json:5:1: missing space after #
+doc-missing-space.json:5:1: missing space after #
diff --git a/tests/qapi-schema/doc-missing-space.exit b/tests/qapi-schema/doc-missing-space.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-missing-space.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-missing.err b/tests/qapi-schema/doc-missing.err
index 7fbf54ff65..b89d925bcc 100644
--- a/tests/qapi-schema/doc-missing.err
+++ b/tests/qapi-schema/doc-missing.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/doc-missing.json: In command 'undocumented':
-tests/qapi-schema/doc-missing.json:5: documentation comment required
+doc-missing.json: In command 'undocumented':
+doc-missing.json:5: documentation comment required
diff --git a/tests/qapi-schema/doc-missing.exit b/tests/qapi-schema/doc-missing.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-missing.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/doc-no-symbol.err b/tests/qapi-schema/doc-no-symbol.err
index 9a3057730c..1b4fa14a22 100644
--- a/tests/qapi-schema/doc-no-symbol.err
+++ b/tests/qapi-schema/doc-no-symbol.err
@@ -1 +1 @@
-tests/qapi-schema/doc-no-symbol.json:3: definition documentation required
+doc-no-symbol.json:3: definition documentation required
diff --git a/tests/qapi-schema/doc-no-symbol.exit b/tests/qapi-schema/doc-no-symbol.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/doc-no-symbol.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/double-type.err b/tests/qapi-schema/double-type.err
index 23f88aae99..71fc4dbb52 100644
--- a/tests/qapi-schema/double-type.err
+++ b/tests/qapi-schema/double-type.err
@@ -1,3 +1,3 @@
-tests/qapi-schema/double-type.json: In struct 'bar':
-tests/qapi-schema/double-type.json:2: struct has unknown key 'command'
+double-type.json: In struct 'bar':
+double-type.json:2: struct has unknown key 'command'
 Valid keys are 'base', 'data', 'features', 'if', 'struct'.
diff --git a/tests/qapi-schema/double-type.exit b/tests/qapi-schema/double-type.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/double-type.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/duplicate-key.err b/tests/qapi-schema/duplicate-key.err
index 7f34a34eb6..7ea8e95e8c 100644
--- a/tests/qapi-schema/duplicate-key.err
+++ b/tests/qapi-schema/duplicate-key.err
@@ -1 +1 @@
-tests/qapi-schema/duplicate-key.json:3:10: duplicate key 'key'
+duplicate-key.json:3:10: duplicate key 'key'
diff --git a/tests/qapi-schema/duplicate-key.exit b/tests/qapi-schema/duplicate-key.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/duplicate-key.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/empty.exit b/tests/qapi-schema/empty.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/enum-bad-member.err b/tests/qapi-schema/enum-bad-member.err
index 2b1b4f98d0..f75d8c56ff 100644
--- a/tests/qapi-schema/enum-bad-member.err
+++ b/tests/qapi-schema/enum-bad-member.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-bad-member.json: In enum 'MyEnum':
-tests/qapi-schema/enum-bad-member.json:2: 'data' member requires a string name
+enum-bad-member.json: In enum 'MyEnum':
+enum-bad-member.json:2: 'data' member requires a string name
diff --git a/tests/qapi-schema/enum-bad-member.exit b/tests/qapi-schema/enum-bad-member.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-bad-member.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-bad-name.err b/tests/qapi-schema/enum-bad-name.err
index 3273a9808a..d26044b8e3 100644
--- a/tests/qapi-schema/enum-bad-name.err
+++ b/tests/qapi-schema/enum-bad-name.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-bad-name.json: In enum 'MyEnum':
-tests/qapi-schema/enum-bad-name.json:3: 'data' member 'not\possible' has an invalid name
+enum-bad-name.json: In enum 'MyEnum':
+enum-bad-name.json:3: 'data' member 'not\possible' has an invalid name
diff --git a/tests/qapi-schema/enum-bad-name.exit b/tests/qapi-schema/enum-bad-name.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-bad-name.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-bad-prefix.err b/tests/qapi-schema/enum-bad-prefix.err
index 933e33aa18..7a2b35787e 100644
--- a/tests/qapi-schema/enum-bad-prefix.err
+++ b/tests/qapi-schema/enum-bad-prefix.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-bad-prefix.json: In enum 'MyEnum':
-tests/qapi-schema/enum-bad-prefix.json:2: 'prefix' must be a string
+enum-bad-prefix.json: In enum 'MyEnum':
+enum-bad-prefix.json:2: 'prefix' must be a string
diff --git a/tests/qapi-schema/enum-bad-prefix.exit b/tests/qapi-schema/enum-bad-prefix.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-bad-prefix.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-clash-member.err b/tests/qapi-schema/enum-clash-member.err
index 84e02db82c..5986571427 100644
--- a/tests/qapi-schema/enum-clash-member.err
+++ b/tests/qapi-schema/enum-clash-member.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-clash-member.json: In enum 'MyEnum':
-tests/qapi-schema/enum-clash-member.json:2: value 'one_two' collides with value 'one-two'
+enum-clash-member.json: In enum 'MyEnum':
+enum-clash-member.json:2: value 'one_two' collides with value 'one-two'
diff --git a/tests/qapi-schema/enum-clash-member.exit b/tests/qapi-schema/enum-clash-member.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-clash-member.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-dict-member-unknown.err b/tests/qapi-schema/enum-dict-member-unknown.err
index 5df0236343..f8617ea179 100644
--- a/tests/qapi-schema/enum-dict-member-unknown.err
+++ b/tests/qapi-schema/enum-dict-member-unknown.err
@@ -1,3 +1,3 @@
-tests/qapi-schema/enum-dict-member-unknown.json: In enum 'MyEnum':
-tests/qapi-schema/enum-dict-member-unknown.json:2: 'data' member has unknown key 'bad-key'
+enum-dict-member-unknown.json: In enum 'MyEnum':
+enum-dict-member-unknown.json:2: 'data' member has unknown key 'bad-key'
 Valid keys are 'if', 'name'.
diff --git a/tests/qapi-schema/enum-dict-member-unknown.exit b/tests/qapi-schema/enum-dict-member-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-dict-member-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-if-invalid.err b/tests/qapi-schema/enum-if-invalid.err
index 30c1f0e91c..0556dc967b 100644
--- a/tests/qapi-schema/enum-if-invalid.err
+++ b/tests/qapi-schema/enum-if-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-if-invalid.json: In enum 'TestIfEnum':
-tests/qapi-schema/enum-if-invalid.json:2: 'if' condition of 'data' member 'bar' must be a string or a list of strings
+enum-if-invalid.json: In enum 'TestIfEnum':
+enum-if-invalid.json:2: 'if' condition of 'data' member 'bar' must be a string or a list of strings
diff --git a/tests/qapi-schema/enum-if-invalid.exit b/tests/qapi-schema/enum-if-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-if-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-int-member.err b/tests/qapi-schema/enum-int-member.err
index 27f06e334c..3a15294963 100644
--- a/tests/qapi-schema/enum-int-member.err
+++ b/tests/qapi-schema/enum-int-member.err
@@ -1 +1 @@
-tests/qapi-schema/enum-int-member.json:3:31: stray '1'
+enum-int-member.json:3:31: stray '1'
diff --git a/tests/qapi-schema/enum-int-member.exit b/tests/qapi-schema/enum-int-member.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-int-member.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-member-case.err b/tests/qapi-schema/enum-member-case.err
index e6b080c6e5..8b3aefe37a 100644
--- a/tests/qapi-schema/enum-member-case.err
+++ b/tests/qapi-schema/enum-member-case.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-member-case.json: In enum 'NoWayThisWillGetWhitelisted':
-tests/qapi-schema/enum-member-case.json:4: 'data' member 'Value' uses uppercase in name
+enum-member-case.json: In enum 'NoWayThisWillGetWhitelisted':
+enum-member-case.json:4: 'data' member 'Value' uses uppercase in name
diff --git a/tests/qapi-schema/enum-member-case.exit b/tests/qapi-schema/enum-member-case.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-member-case.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-missing-data.err b/tests/qapi-schema/enum-missing-data.err
index 4809b01f34..ec4bdae037 100644
--- a/tests/qapi-schema/enum-missing-data.err
+++ b/tests/qapi-schema/enum-missing-data.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-missing-data.json: In enum 'MyEnum':
-tests/qapi-schema/enum-missing-data.json:2: enum misses key 'data'
+enum-missing-data.json: In enum 'MyEnum':
+enum-missing-data.json:2: enum misses key 'data'
diff --git a/tests/qapi-schema/enum-missing-data.exit b/tests/qapi-schema/enum-missing-data.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-missing-data.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/enum-wrong-data.err b/tests/qapi-schema/enum-wrong-data.err
index ad5f0ce46f..a9f34481ba 100644
--- a/tests/qapi-schema/enum-wrong-data.err
+++ b/tests/qapi-schema/enum-wrong-data.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/enum-wrong-data.json: In enum 'MyEnum':
-tests/qapi-schema/enum-wrong-data.json:2: 'data' must be an array
+enum-wrong-data.json: In enum 'MyEnum':
+enum-wrong-data.json:2: 'data' must be an array
diff --git a/tests/qapi-schema/enum-wrong-data.exit b/tests/qapi-schema/enum-wrong-data.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/enum-wrong-data.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/escape-outside-string.err b/tests/qapi-schema/escape-outside-string.err
index 06f5f2ed55..c49fe0c285 100644
--- a/tests/qapi-schema/escape-outside-string.err
+++ b/tests/qapi-schema/escape-outside-string.err
@@ -1 +1 @@
-tests/qapi-schema/escape-outside-string.json:3:27: stray '\'
+escape-outside-string.json:3:27: stray '\'
diff --git a/tests/qapi-schema/event-boxed-empty.err b/tests/qapi-schema/event-boxed-empty.err
index 931c10b036..b3872cdab5 100644
--- a/tests/qapi-schema/event-boxed-empty.err
+++ b/tests/qapi-schema/event-boxed-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/event-boxed-empty.json: In event 'FOO':
-tests/qapi-schema/event-boxed-empty.json:2: 'boxed': true requires 'data'
+event-boxed-empty.json: In event 'FOO':
+event-boxed-empty.json:2: 'boxed': true requires 'data'
diff --git a/tests/qapi-schema/event-boxed-empty.exit b/tests/qapi-schema/event-boxed-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/event-boxed-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/event-case.exit b/tests/qapi-schema/event-case.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/event-case.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/event-case.out b/tests/qapi-schema/event-case.out
index ec8a1406e4..42ae519656 100644
--- a/tests/qapi-schema/event-case.out
+++ b/tests/qapi-schema/event-case.out
@@ -11,4 +11,4 @@ enum QType
     member qbool
 module event-case.json
 event oops None
-   boxed=False
+    boxed=False
diff --git a/tests/qapi-schema/event-member-invalid-dict.err b/tests/qapi-schema/event-member-invalid-dict.err
index 8406c43df7..c7a6a24305 100644
--- a/tests/qapi-schema/event-member-invalid-dict.err
+++ b/tests/qapi-schema/event-member-invalid-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/event-member-invalid-dict.json: In event 'EVENT_A':
-tests/qapi-schema/event-member-invalid-dict.json:1: 'data' member 'a' misses key 'type'
+event-member-invalid-dict.json: In event 'EVENT_A':
+event-member-invalid-dict.json:1: 'data' member 'a' misses key 'type'
diff --git a/tests/qapi-schema/event-member-invalid-dict.exit b/tests/qapi-schema/event-member-invalid-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/event-member-invalid-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/event-nest-struct.err b/tests/qapi-schema/event-nest-struct.err
index 1a3254a73c..8c5f6ed311 100644
--- a/tests/qapi-schema/event-nest-struct.err
+++ b/tests/qapi-schema/event-nest-struct.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/event-nest-struct.json: In event 'EVENT_A':
-tests/qapi-schema/event-nest-struct.json:1: 'data' member 'a' should be a type name
+event-nest-struct.json: In event 'EVENT_A':
+event-nest-struct.json:1: 'data' member 'a' should be a type name
diff --git a/tests/qapi-schema/event-nest-struct.exit b/tests/qapi-schema/event-nest-struct.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/event-nest-struct.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-bad-type.err b/tests/qapi-schema/features-bad-type.err
index 30deb8b624..3c63591632 100644
--- a/tests/qapi-schema/features-bad-type.err
+++ b/tests/qapi-schema/features-bad-type.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/features-bad-type.json: In struct 'FeatureStruct0':
-tests/qapi-schema/features-bad-type.json:1: 'features' member requires a string name
+features-bad-type.json: In struct 'FeatureStruct0':
+features-bad-type.json:1: 'features' member requires a string name
diff --git a/tests/qapi-schema/features-bad-type.exit b/tests/qapi-schema/features-bad-type.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-bad-type.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-duplicate-name.err b/tests/qapi-schema/features-duplicate-name.err
index a99bbde737..0adbee6b0a 100644
--- a/tests/qapi-schema/features-duplicate-name.err
+++ b/tests/qapi-schema/features-duplicate-name.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/features-duplicate-name.json: In struct 'FeatureStruct0':
-tests/qapi-schema/features-duplicate-name.json:1: feature 'foo' collides with feature 'foo'
+features-duplicate-name.json: In struct 'FeatureStruct0':
+features-duplicate-name.json:1: feature 'foo' collides with feature 'foo'
diff --git a/tests/qapi-schema/features-duplicate-name.exit b/tests/qapi-schema/features-duplicate-name.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-duplicate-name.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-if-invalid.err b/tests/qapi-schema/features-if-invalid.err
index ffb39378af..f63b89535e 100644
--- a/tests/qapi-schema/features-if-invalid.err
+++ b/tests/qapi-schema/features-if-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/features-if-invalid.json: In struct 'Stru':
-tests/qapi-schema/features-if-invalid.json:2: 'if' condition of 'features' member 'f' must be a string or a list of strings
+features-if-invalid.json: In struct 'Stru':
+features-if-invalid.json:2: 'if' condition of 'features' member 'f' must be a string or a list of strings
diff --git a/tests/qapi-schema/features-if-invalid.exit b/tests/qapi-schema/features-if-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-if-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-missing-name.err b/tests/qapi-schema/features-missing-name.err
index b8db328acc..ce02412d2e 100644
--- a/tests/qapi-schema/features-missing-name.err
+++ b/tests/qapi-schema/features-missing-name.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/features-missing-name.json: In struct 'FeatureStruct0':
-tests/qapi-schema/features-missing-name.json:1: 'features' member misses key 'name'
+features-missing-name.json: In struct 'FeatureStruct0':
+features-missing-name.json:1: 'features' member misses key 'name'
diff --git a/tests/qapi-schema/features-missing-name.exit b/tests/qapi-schema/features-missing-name.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-missing-name.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-name-bad-type.err b/tests/qapi-schema/features-name-bad-type.err
index 86db2c0ea2..4afcd5fdc3 100644
--- a/tests/qapi-schema/features-name-bad-type.err
+++ b/tests/qapi-schema/features-name-bad-type.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/features-name-bad-type.json: In struct 'FeatureStruct0':
-tests/qapi-schema/features-name-bad-type.json:1: 'features' member requires a string name
+features-name-bad-type.json: In struct 'FeatureStruct0':
+features-name-bad-type.json:1: 'features' member requires a string name
diff --git a/tests/qapi-schema/features-name-bad-type.exit b/tests/qapi-schema/features-name-bad-type.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-name-bad-type.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-no-list.err b/tests/qapi-schema/features-no-list.err
index e493f85057..5cfaa3f216 100644
--- a/tests/qapi-schema/features-no-list.err
+++ b/tests/qapi-schema/features-no-list.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/features-no-list.json: In struct 'FeatureStruct0':
-tests/qapi-schema/features-no-list.json:1: 'features' must be an array
+features-no-list.json: In struct 'FeatureStruct0':
+features-no-list.json:1: 'features' must be an array
diff --git a/tests/qapi-schema/features-no-list.exit b/tests/qapi-schema/features-no-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-no-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/features-unknown-key.err b/tests/qapi-schema/features-unknown-key.err
index 22f5dcf4b0..13e359a216 100644
--- a/tests/qapi-schema/features-unknown-key.err
+++ b/tests/qapi-schema/features-unknown-key.err
@@ -1,3 +1,3 @@
-tests/qapi-schema/features-unknown-key.json: In struct 'FeatureStruct0':
-tests/qapi-schema/features-unknown-key.json:1: 'features' member has unknown key 'colour'
+features-unknown-key.json: In struct 'FeatureStruct0':
+features-unknown-key.json:1: 'features' member has unknown key 'colour'
 Valid keys are 'if', 'name'.
diff --git a/tests/qapi-schema/features-unknown-key.exit b/tests/qapi-schema/features-unknown-key.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/features-unknown-key.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-array-branch.err b/tests/qapi-schema/flat-union-array-branch.err
index de07a7b32a..20a8ef1406 100644
--- a/tests/qapi-schema/flat-union-array-branch.err
+++ b/tests/qapi-schema/flat-union-array-branch.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-array-branch.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-array-branch.json:8: 'data' member 'value1' cannot be an array
+flat-union-array-branch.json: In union 'TestUnion':
+flat-union-array-branch.json:8: 'data' member 'value1' cannot be an array
diff --git a/tests/qapi-schema/flat-union-array-branch.exit b/tests/qapi-schema/flat-union-array-branch.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-array-branch.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-bad-base.err b/tests/qapi-schema/flat-union-bad-base.err
index 5da7602c20..e0a205a58c 100644
--- a/tests/qapi-schema/flat-union-bad-base.err
+++ b/tests/qapi-schema/flat-union-bad-base.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-bad-base.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-bad-base.json:8: member 'string' of type 'TestTypeA' collides with base member 'string'
+flat-union-bad-base.json: In union 'TestUnion':
+flat-union-bad-base.json:8: member 'string' of type 'TestTypeA' collides with base member 'string'
diff --git a/tests/qapi-schema/flat-union-bad-base.exit b/tests/qapi-schema/flat-union-bad-base.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-bad-base.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-bad-discriminator.err b/tests/qapi-schema/flat-union-bad-discriminator.err
index c1b4209ffd..b705439bd9 100644
--- a/tests/qapi-schema/flat-union-bad-discriminator.err
+++ b/tests/qapi-schema/flat-union-bad-discriminator.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-bad-discriminator.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-bad-discriminator.json:11: 'discriminator' requires a string name
+flat-union-bad-discriminator.json: In union 'TestUnion':
+flat-union-bad-discriminator.json:11: 'discriminator' requires a string name
diff --git a/tests/qapi-schema/flat-union-bad-discriminator.exit b/tests/qapi-schema/flat-union-bad-discriminator.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-bad-discriminator.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-base-any.err b/tests/qapi-schema/flat-union-base-any.err
index 7ab3402396..c2d4de6a5d 100644
--- a/tests/qapi-schema/flat-union-base-any.err
+++ b/tests/qapi-schema/flat-union-base-any.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-base-any.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-base-any.json:8: 'base' requires a struct type, built-in type 'any' isn't
+flat-union-base-any.json: In union 'TestUnion':
+flat-union-base-any.json:8: 'base' requires a struct type, built-in type 'any' isn't
diff --git a/tests/qapi-schema/flat-union-base-any.exit b/tests/qapi-schema/flat-union-base-any.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-base-any.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-base-union.err b/tests/qapi-schema/flat-union-base-union.err
index 5db7b1e404..3b0087220e 100644
--- a/tests/qapi-schema/flat-union-base-union.err
+++ b/tests/qapi-schema/flat-union-base-union.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-base-union.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-base-union.json:14: 'base' requires a struct type, union type 'UnionBase' isn't
+flat-union-base-union.json: In union 'TestUnion':
+flat-union-base-union.json:14: 'base' requires a struct type, union type 'UnionBase' isn't
diff --git a/tests/qapi-schema/flat-union-base-union.exit b/tests/qapi-schema/flat-union-base-union.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-base-union.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-clash-member.err b/tests/qapi-schema/flat-union-clash-member.err
index 40f10681f8..07551e6ef5 100644
--- a/tests/qapi-schema/flat-union-clash-member.err
+++ b/tests/qapi-schema/flat-union-clash-member.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-clash-member.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-clash-member.json:11: member 'name' of type 'Branch1' collides with member 'name' of type 'Base'
+flat-union-clash-member.json: In union 'TestUnion':
+flat-union-clash-member.json:11: member 'name' of type 'Branch1' collides with member 'name' of type 'Base'
diff --git a/tests/qapi-schema/flat-union-clash-member.exit b/tests/qapi-schema/flat-union-clash-member.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-clash-member.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-discriminator-bad-name.err b/tests/qapi-schema/flat-union-discriminator-bad-name.err
index 2a0deb6a0e..28be49c31a 100644
--- a/tests/qapi-schema/flat-union-discriminator-bad-name.err
+++ b/tests/qapi-schema/flat-union-discriminator-bad-name.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-discriminator-bad-name.json: In union 'MyUnion':
-tests/qapi-schema/flat-union-discriminator-bad-name.json:6: discriminator '*switch' is not a member of 'base'
+flat-union-discriminator-bad-name.json: In union 'MyUnion':
+flat-union-discriminator-bad-name.json:6: discriminator '*switch' is not a member of 'base'
diff --git a/tests/qapi-schema/flat-union-discriminator-bad-name.exit b/tests/qapi-schema/flat-union-discriminator-bad-name.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-discriminator-bad-name.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-empty.err b/tests/qapi-schema/flat-union-empty.err
index 91a5b57f5d..89b0f25cb0 100644
--- a/tests/qapi-schema/flat-union-empty.err
+++ b/tests/qapi-schema/flat-union-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-empty.json: In union 'Union':
-tests/qapi-schema/flat-union-empty.json:4: union has no branches
+flat-union-empty.json: In union 'Union':
+flat-union-empty.json:4: union has no branches
diff --git a/tests/qapi-schema/flat-union-empty.exit b/tests/qapi-schema/flat-union-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-inline-invalid-dict.err b/tests/qapi-schema/flat-union-inline-invalid-dict.err
index d353bdd338..53e5416707 100644
--- a/tests/qapi-schema/flat-union-inline-invalid-dict.err
+++ b/tests/qapi-schema/flat-union-inline-invalid-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-inline-invalid-dict.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-inline-invalid-dict.json:7: 'data' member 'value1' misses key 'type'
+flat-union-inline-invalid-dict.json: In union 'TestUnion':
+flat-union-inline-invalid-dict.json:7: 'data' member 'value1' misses key 'type'
diff --git a/tests/qapi-schema/flat-union-inline-invalid-dict.exit b/tests/qapi-schema/flat-union-inline-invalid-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-inline-invalid-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-inline.err b/tests/qapi-schema/flat-union-inline.err
index 95b1e8c1b7..538283f5db 100644
--- a/tests/qapi-schema/flat-union-inline.err
+++ b/tests/qapi-schema/flat-union-inline.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-inline.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-inline.json:7: 'data' member 'value1' should be a type name
+flat-union-inline.json: In union 'TestUnion':
+flat-union-inline.json:7: 'data' member 'value1' should be a type name
diff --git a/tests/qapi-schema/flat-union-inline.exit b/tests/qapi-schema/flat-union-inline.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-inline.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-int-branch.err b/tests/qapi-schema/flat-union-int-branch.err
index 416b696c8f..ae7f800603 100644
--- a/tests/qapi-schema/flat-union-int-branch.err
+++ b/tests/qapi-schema/flat-union-int-branch.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-int-branch.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-int-branch.json:8: branch 'value1' cannot use built-in type 'int'
+flat-union-int-branch.json: In union 'TestUnion':
+flat-union-int-branch.json:8: branch 'value1' cannot use built-in type 'int'
diff --git a/tests/qapi-schema/flat-union-int-branch.exit b/tests/qapi-schema/flat-union-int-branch.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-int-branch.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-invalid-branch-key.err b/tests/qapi-schema/flat-union-invalid-branch-key.err
index 6997b3387d..5576a25f9b 100644
--- a/tests/qapi-schema/flat-union-invalid-branch-key.err
+++ b/tests/qapi-schema/flat-union-invalid-branch-key.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-invalid-branch-key.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-invalid-branch-key.json:13: branch 'value_wrong' is not a value of enum type 'TestEnum'
+flat-union-invalid-branch-key.json: In union 'TestUnion':
+flat-union-invalid-branch-key.json:13: branch 'value_wrong' is not a value of enum type 'TestEnum'
diff --git a/tests/qapi-schema/flat-union-invalid-branch-key.exit b/tests/qapi-schema/flat-union-invalid-branch-key.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-invalid-branch-key.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-invalid-discriminator.err b/tests/qapi-schema/flat-union-invalid-discriminator.err
index 3f80de3044..99bca2ddab 100644
--- a/tests/qapi-schema/flat-union-invalid-discriminator.err
+++ b/tests/qapi-schema/flat-union-invalid-discriminator.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-invalid-discriminator.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-invalid-discriminator.json:10: discriminator 'enum_wrong' is not a member of 'base'
+flat-union-invalid-discriminator.json: In union 'TestUnion':
+flat-union-invalid-discriminator.json:10: discriminator 'enum_wrong' is not a member of 'base'
diff --git a/tests/qapi-schema/flat-union-invalid-discriminator.exit b/tests/qapi-schema/flat-union-invalid-discriminator.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-invalid-discriminator.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-invalid-if-discriminator.err b/tests/qapi-schema/flat-union-invalid-if-discriminator.err
index d2b35be9ae..350f28da9d 100644
--- a/tests/qapi-schema/flat-union-invalid-if-discriminator.err
+++ b/tests/qapi-schema/flat-union-invalid-if-discriminator.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-invalid-if-discriminator.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-invalid-if-discriminator.json:10: discriminator member 'enum1' of 'base' must not be conditional
+flat-union-invalid-if-discriminator.json: In union 'TestUnion':
+flat-union-invalid-if-discriminator.json:10: discriminator member 'enum1' of 'base' must not be conditional
diff --git a/tests/qapi-schema/flat-union-invalid-if-discriminator.exit b/tests/qapi-schema/flat-union-invalid-if-discriminator.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-invalid-if-discriminator.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-no-base.err b/tests/qapi-schema/flat-union-no-base.err
index a16f3231f1..9bd595bcfb 100644
--- a/tests/qapi-schema/flat-union-no-base.err
+++ b/tests/qapi-schema/flat-union-no-base.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-no-base.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-no-base.json:9: 'discriminator' requires 'base'
+flat-union-no-base.json: In union 'TestUnion':
+flat-union-no-base.json:9: 'discriminator' requires 'base'
diff --git a/tests/qapi-schema/flat-union-no-base.exit b/tests/qapi-schema/flat-union-no-base.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-no-base.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-optional-discriminator.err b/tests/qapi-schema/flat-union-optional-discriminator.err
index 49fbf5b04d..3d60a1b496 100644
--- a/tests/qapi-schema/flat-union-optional-discriminator.err
+++ b/tests/qapi-schema/flat-union-optional-discriminator.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-optional-discriminator.json: In union 'MyUnion':
-tests/qapi-schema/flat-union-optional-discriminator.json:6: discriminator member 'switch' of base type 'Base' must not be optional
+flat-union-optional-discriminator.json: In union 'MyUnion':
+flat-union-optional-discriminator.json:6: discriminator member 'switch' of base type 'Base' must not be optional
diff --git a/tests/qapi-schema/flat-union-optional-discriminator.exit b/tests/qapi-schema/flat-union-optional-discriminator.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-optional-discriminator.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/flat-union-string-discriminator.err b/tests/qapi-schema/flat-union-string-discriminator.err
index fb499188aa..ff42c9728b 100644
--- a/tests/qapi-schema/flat-union-string-discriminator.err
+++ b/tests/qapi-schema/flat-union-string-discriminator.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/flat-union-string-discriminator.json: In union 'TestUnion':
-tests/qapi-schema/flat-union-string-discriminator.json:13: discriminator member 'kind' of base type 'TestBase' must be of enum type
+flat-union-string-discriminator.json: In union 'TestUnion':
+flat-union-string-discriminator.json:13: discriminator member 'kind' of base type 'TestBase' must be of enum type
diff --git a/tests/qapi-schema/flat-union-string-discriminator.exit b/tests/qapi-schema/flat-union-string-discriminator.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/flat-union-string-discriminator.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/funny-char.err b/tests/qapi-schema/funny-char.err
index 132fac93ea..1c8abae2e0 100644
--- a/tests/qapi-schema/funny-char.err
+++ b/tests/qapi-schema/funny-char.err
@@ -1 +1 @@
-tests/qapi-schema/funny-char.json:2:36: stray ';'
+funny-char.json:2:36: stray ';'
diff --git a/tests/qapi-schema/funny-char.exit b/tests/qapi-schema/funny-char.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/funny-char.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/funny-word.err b/tests/qapi-schema/funny-word.err
index d9286c8962..a1d9ade970 100644
--- a/tests/qapi-schema/funny-word.err
+++ b/tests/qapi-schema/funny-word.err
@@ -1 +1 @@
-tests/qapi-schema/funny-word.json:1:3: stray 'command'
+funny-word.json:1:3: stray 'command'
diff --git a/tests/qapi-schema/funny-word.exit b/tests/qapi-schema/funny-word.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/funny-word.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/ident-with-escape.err b/tests/qapi-schema/ident-with-escape.err
index 1117283c81..3f6c1e423c 100644
--- a/tests/qapi-schema/ident-with-escape.err
+++ b/tests/qapi-schema/ident-with-escape.err
@@ -1 +1 @@
-tests/qapi-schema/ident-with-escape.json:3:3: unknown escape \u
+ident-with-escape.json:3:3: unknown escape \u
diff --git a/tests/qapi-schema/ident-with-escape.exit b/tests/qapi-schema/ident-with-escape.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/ident-with-escape.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-before-err.err b/tests/qapi-schema/include-before-err.err
index 098314bc49..16da03026f 100644
--- a/tests/qapi-schema/include-before-err.err
+++ b/tests/qapi-schema/include-before-err.err
@@ -1 +1 @@
-tests/qapi-schema/include-before-err.json:2:13: expected ':'
+include-before-err.json:2:13: expected ':'
diff --git a/tests/qapi-schema/include-before-err.exit b/tests/qapi-schema/include-before-err.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-before-err.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-cycle.err b/tests/qapi-schema/include-cycle.err
index 52028669b5..4c99f5642b 100644
--- a/tests/qapi-schema/include-cycle.err
+++ b/tests/qapi-schema/include-cycle.err
@@ -1,3 +1,3 @@
-In file included from tests/qapi-schema/include-cycle.json:1:
-In file included from tests/qapi-schema/include-cycle-b.json:1:
-tests/qapi-schema/include-cycle-c.json:1: inclusion loop for include-cycle.json
+In file included from include-cycle.json:1:
+In file included from include-cycle-b.json:1:
+include-cycle-c.json:1: inclusion loop for include-cycle.json
diff --git a/tests/qapi-schema/include-cycle.exit b/tests/qapi-schema/include-cycle.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-cycle.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-extra-junk.err b/tests/qapi-schema/include-extra-junk.err
index 854cec3ce3..1f7d2e1437 100644
--- a/tests/qapi-schema/include-extra-junk.err
+++ b/tests/qapi-schema/include-extra-junk.err
@@ -1 +1 @@
-tests/qapi-schema/include-extra-junk.json:3: invalid 'include' directive
+include-extra-junk.json:3: invalid 'include' directive
diff --git a/tests/qapi-schema/include-extra-junk.exit b/tests/qapi-schema/include-extra-junk.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-extra-junk.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-nested-err.err b/tests/qapi-schema/include-nested-err.err
index 11928b4f7f..9eac9eaeea 100644
--- a/tests/qapi-schema/include-nested-err.err
+++ b/tests/qapi-schema/include-nested-err.err
@@ -1,2 +1,2 @@
-In file included from tests/qapi-schema/include-nested-err.json:1:
-tests/qapi-schema/missing-colon.json:1:10: expected ':'
+In file included from include-nested-err.json:1:
+missing-colon.json:1:10: expected ':'
diff --git a/tests/qapi-schema/include-nested-err.exit b/tests/qapi-schema/include-nested-err.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-nested-err.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-no-file.err b/tests/qapi-schema/include-no-file.err
index 0a6c6bb4a9..3115a889fe 100644
--- a/tests/qapi-schema/include-no-file.err
+++ b/tests/qapi-schema/include-no-file.err
@@ -1 +1 @@
-tests/qapi-schema/include-no-file.json:1: can't read include file 'tests/qapi-schema/include-no-file-sub.json': No such file or directory
+include-no-file.json:1: can't read include file 'include-no-file-sub.json': No such file or directory
diff --git a/tests/qapi-schema/include-no-file.exit b/tests/qapi-schema/include-no-file.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-no-file.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-non-file.err b/tests/qapi-schema/include-non-file.err
index 65dd3c7c2c..ec8a331654 100644
--- a/tests/qapi-schema/include-non-file.err
+++ b/tests/qapi-schema/include-non-file.err
@@ -1 +1 @@
-tests/qapi-schema/include-non-file.json:1: value of 'include' must be a string
+include-non-file.json:1: value of 'include' must be a string
diff --git a/tests/qapi-schema/include-non-file.exit b/tests/qapi-schema/include-non-file.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-non-file.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-repetition.exit b/tests/qapi-schema/include-repetition.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/include-repetition.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/include-self-cycle.err b/tests/qapi-schema/include-self-cycle.err
index c84795d1dc..284b0d6f0e 100644
--- a/tests/qapi-schema/include-self-cycle.err
+++ b/tests/qapi-schema/include-self-cycle.err
@@ -1 +1 @@
-tests/qapi-schema/include-self-cycle.json:1: inclusion loop for include-self-cycle.json
+include-self-cycle.json:1: inclusion loop for include-self-cycle.json
diff --git a/tests/qapi-schema/include-self-cycle.exit b/tests/qapi-schema/include-self-cycle.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/include-self-cycle.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/include-simple.exit b/tests/qapi-schema/include-simple.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/include-simple.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/indented-expr.exit b/tests/qapi-schema/indented-expr.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/indented-expr.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/indented-expr.out b/tests/qapi-schema/indented-expr.out
index bffdf6756d..04356775cd 100644
--- a/tests/qapi-schema/indented-expr.out
+++ b/tests/qapi-schema/indented-expr.out
@@ -11,6 +11,6 @@ enum QType
     member qbool
 module indented-expr.json
 command eins None -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 command zwei None -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
diff --git a/tests/qapi-schema/leading-comma-list.err b/tests/qapi-schema/leading-comma-list.err
index cddf471f71..76eed2b5b3 100644
--- a/tests/qapi-schema/leading-comma-list.err
+++ b/tests/qapi-schema/leading-comma-list.err
@@ -1 +1 @@
-tests/qapi-schema/leading-comma-list.json:2:13: expected '{', '[', ']', string, boolean or 'null'
+leading-comma-list.json:2:13: expected '{', '[', ']', string, boolean or 'null'
diff --git a/tests/qapi-schema/leading-comma-list.exit b/tests/qapi-schema/leading-comma-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/leading-comma-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/leading-comma-object.err b/tests/qapi-schema/leading-comma-object.err
index 2f3b193274..25f8b6ffd6 100644
--- a/tests/qapi-schema/leading-comma-object.err
+++ b/tests/qapi-schema/leading-comma-object.err
@@ -1 +1 @@
-tests/qapi-schema/leading-comma-object.json:1:3: expected string or '}'
+leading-comma-object.json:1:3: expected string or '}'
diff --git a/tests/qapi-schema/leading-comma-object.exit b/tests/qapi-schema/leading-comma-object.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/leading-comma-object.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/missing-colon.err b/tests/qapi-schema/missing-colon.err
index e642c7c549..d5fe235cb9 100644
--- a/tests/qapi-schema/missing-colon.err
+++ b/tests/qapi-schema/missing-colon.err
@@ -1 +1 @@
-tests/qapi-schema/missing-colon.json:1:10: expected ':'
+missing-colon.json:1:10: expected ':'
diff --git a/tests/qapi-schema/missing-colon.exit b/tests/qapi-schema/missing-colon.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/missing-colon.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/missing-comma-list.err b/tests/qapi-schema/missing-comma-list.err
index 5359499430..d0a790c2b3 100644
--- a/tests/qapi-schema/missing-comma-list.err
+++ b/tests/qapi-schema/missing-comma-list.err
@@ -1 +1 @@
-tests/qapi-schema/missing-comma-list.json:2:20: expected ',' or ']'
+missing-comma-list.json:2:20: expected ',' or ']'
diff --git a/tests/qapi-schema/missing-comma-list.exit b/tests/qapi-schema/missing-comma-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/missing-comma-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/missing-comma-object.err b/tests/qapi-schema/missing-comma-object.err
index c9b02b0760..aa8efbc2f3 100644
--- a/tests/qapi-schema/missing-comma-object.err
+++ b/tests/qapi-schema/missing-comma-object.err
@@ -1 +1 @@
-tests/qapi-schema/missing-comma-object.json:2:3: expected ',' or '}'
+missing-comma-object.json:2:3: expected ',' or '}'
diff --git a/tests/qapi-schema/missing-comma-object.exit b/tests/qapi-schema/missing-comma-object.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/missing-comma-object.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/missing-type.err b/tests/qapi-schema/missing-type.err
index 19b7c495e7..5755386a18 100644
--- a/tests/qapi-schema/missing-type.err
+++ b/tests/qapi-schema/missing-type.err
@@ -1 +1 @@
-tests/qapi-schema/missing-type.json:2: expression is missing metatype
+missing-type.json:2: expression is missing metatype
diff --git a/tests/qapi-schema/missing-type.exit b/tests/qapi-schema/missing-type.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/missing-type.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/nested-struct-data-invalid-dict.err b/tests/qapi-schema/nested-struct-data-invalid-dict.err
index ed42d6323e..c044b2b17a 100644
--- a/tests/qapi-schema/nested-struct-data-invalid-dict.err
+++ b/tests/qapi-schema/nested-struct-data-invalid-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/nested-struct-data-invalid-dict.json: In command 'foo':
-tests/qapi-schema/nested-struct-data-invalid-dict.json:2: 'data' member 'a' misses key 'type'
+nested-struct-data-invalid-dict.json: In command 'foo':
+nested-struct-data-invalid-dict.json:2: 'data' member 'a' misses key 'type'
diff --git a/tests/qapi-schema/nested-struct-data-invalid-dict.exit b/tests/qapi-schema/nested-struct-data-invalid-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/nested-struct-data-invalid-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/nested-struct-data.err b/tests/qapi-schema/nested-struct-data.err
index b0ec410eb7..c7258a0182 100644
--- a/tests/qapi-schema/nested-struct-data.err
+++ b/tests/qapi-schema/nested-struct-data.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/nested-struct-data.json: In command 'foo':
-tests/qapi-schema/nested-struct-data.json:2: 'data' member 'a' should be a type name
+nested-struct-data.json: In command 'foo':
+nested-struct-data.json:2: 'data' member 'a' should be a type name
diff --git a/tests/qapi-schema/nested-struct-data.exit b/tests/qapi-schema/nested-struct-data.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/nested-struct-data.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/non-objects.err b/tests/qapi-schema/non-objects.err
index 9237af6939..3a4ea36966 100644
--- a/tests/qapi-schema/non-objects.err
+++ b/tests/qapi-schema/non-objects.err
@@ -1 +1 @@
-tests/qapi-schema/non-objects.json:1:1: expected '{'
+non-objects.json:1:1: expected '{'
diff --git a/tests/qapi-schema/non-objects.exit b/tests/qapi-schema/non-objects.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/non-objects.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/oob-test.err b/tests/qapi-schema/oob-test.err
index 3c2ba6e0fd..7b9a50b3d5 100644
--- a/tests/qapi-schema/oob-test.err
+++ b/tests/qapi-schema/oob-test.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/oob-test.json: In command 'oob-command-1':
-tests/qapi-schema/oob-test.json:2: flag 'allow-oob' may only use true value
+oob-test.json: In command 'oob-command-1':
+oob-test.json:2: flag 'allow-oob' may only use true value
diff --git a/tests/qapi-schema/oob-test.exit b/tests/qapi-schema/oob-test.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/oob-test.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/pragma-doc-required-crap.err b/tests/qapi-schema/pragma-doc-required-crap.err
index bcd981ada8..717062cb14 100644
--- a/tests/qapi-schema/pragma-doc-required-crap.err
+++ b/tests/qapi-schema/pragma-doc-required-crap.err
@@ -1 +1 @@
-tests/qapi-schema/pragma-doc-required-crap.json:3: pragma 'doc-required' must be boolean
+pragma-doc-required-crap.json:3: pragma 'doc-required' must be boolean
diff --git a/tests/qapi-schema/pragma-doc-required-crap.exit b/tests/qapi-schema/pragma-doc-required-crap.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/pragma-doc-required-crap.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/pragma-extra-junk.err b/tests/qapi-schema/pragma-extra-junk.err
index 3ae48d3668..ba5cc23f56 100644
--- a/tests/qapi-schema/pragma-extra-junk.err
+++ b/tests/qapi-schema/pragma-extra-junk.err
@@ -1 +1 @@
-tests/qapi-schema/pragma-extra-junk.json:3: invalid 'pragma' directive
+pragma-extra-junk.json:3: invalid 'pragma' directive
diff --git a/tests/qapi-schema/pragma-extra-junk.exit b/tests/qapi-schema/pragma-extra-junk.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/pragma-extra-junk.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/pragma-name-case-whitelist-crap.err b/tests/qapi-schema/pragma-name-case-whitelist-crap.err
index 81f829ff36..fbea90d6c5 100644
--- a/tests/qapi-schema/pragma-name-case-whitelist-crap.err
+++ b/tests/qapi-schema/pragma-name-case-whitelist-crap.err
@@ -1 +1 @@
-tests/qapi-schema/pragma-name-case-whitelist-crap.json:3: pragma name-case-whitelist must be a list of strings
+pragma-name-case-whitelist-crap.json:3: pragma name-case-whitelist must be a list of strings
diff --git a/tests/qapi-schema/pragma-name-case-whitelist-crap.exit b/tests/qapi-schema/pragma-name-case-whitelist-crap.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/pragma-name-case-whitelist-crap.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/pragma-non-dict.err b/tests/qapi-schema/pragma-non-dict.err
index 8221724b0a..802f1806c5 100644
--- a/tests/qapi-schema/pragma-non-dict.err
+++ b/tests/qapi-schema/pragma-non-dict.err
@@ -1 +1 @@
-tests/qapi-schema/pragma-non-dict.json:3: value of 'pragma' must be an object
+pragma-non-dict.json:3: value of 'pragma' must be an object
diff --git a/tests/qapi-schema/pragma-non-dict.exit b/tests/qapi-schema/pragma-non-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/pragma-non-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/pragma-returns-whitelist-crap.err b/tests/qapi-schema/pragma-returns-whitelist-crap.err
index c0cae5de18..69784259df 100644
--- a/tests/qapi-schema/pragma-returns-whitelist-crap.err
+++ b/tests/qapi-schema/pragma-returns-whitelist-crap.err
@@ -1 +1 @@
-tests/qapi-schema/pragma-returns-whitelist-crap.json:3: pragma returns-whitelist must be a list of strings
+pragma-returns-whitelist-crap.json:3: pragma returns-whitelist must be a list of strings
diff --git a/tests/qapi-schema/pragma-returns-whitelist-crap.exit b/tests/qapi-schema/pragma-returns-whitelist-crap.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/pragma-returns-whitelist-crap.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/pragma-unknown.err b/tests/qapi-schema/pragma-unknown.err
index f1335f0a0a..d99a772503 100644
--- a/tests/qapi-schema/pragma-unknown.err
+++ b/tests/qapi-schema/pragma-unknown.err
@@ -1 +1 @@
-tests/qapi-schema/pragma-unknown.json:1: unknown pragma 'no-such-pragma'
+pragma-unknown.json:1: unknown pragma 'no-such-pragma'
diff --git a/tests/qapi-schema/pragma-unknown.exit b/tests/qapi-schema/pragma-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/pragma-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/qapi-schema-test.exit b/tests/qapi-schema/qapi-schema-test.exit
deleted file mode 100644
index 573541ac97..0000000000
--- a/tests/qapi-schema/qapi-schema-test.exit
+++ /dev/null
@@ -1 +0,0 @@
-0
diff --git a/tests/qapi-schema/qapi-schema-test.json b/tests/qapi-schema/qapi-schema-test.json
index 75c42eb0e3..9abf175fe0 100644
--- a/tests/qapi-schema/qapi-schema-test.json
+++ b/tests/qapi-schema/qapi-schema-test.json
@@ -290,3 +290,21 @@
             'cfs1': 'CondFeatureStruct1',
             'cfs2': 'CondFeatureStruct2',
             'cfs3': 'CondFeatureStruct3' } }
+
+# test 'features' for command
+
+{ 'command': 'test-command-features0',
+  'features': [] }
+{ 'command': 'test-command-features1',
+  'features': [ 'feature1' ] }
+{ 'command': 'test-command-features3',
+  'features': [ 'feature1', 'feature2' ] }
+
+{ 'command': 'test-command-cond-features1',
+  'features': [ { 'name': 'feature1', 'if': 'defined(TEST_IF_FEATURE_1)'} ] }
+{ 'command': 'test-command-cond-features2',
+  'features': [ { 'name': 'feature1', 'if': 'defined(TEST_IF_FEATURE_1)'},
+                { 'name': 'feature2', 'if': 'defined(TEST_IF_FEATURE_2)'} ] }
+{ 'command': 'test-command-cond-features3',
+  'features': [ { 'name': 'feature1', 'if': [ 'defined(TEST_IF_COND_1)',
+                                              'defined(TEST_IF_COND_2)'] } ] }
diff --git a/tests/qapi-schema/qapi-schema-test.out b/tests/qapi-schema/qapi-schema-test.out
index 98031da96f..3660e75a48 100644
--- a/tests/qapi-schema/qapi-schema-test.out
+++ b/tests/qapi-schema/qapi-schema-test.out
@@ -33,7 +33,7 @@ object Union
     case value3: q_empty
     case value4: q_empty
 command user_def_cmd0 Empty2 -> Empty2
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 enum QEnumTwo
     prefix QENUM_TWO
     member value1
@@ -205,35 +205,35 @@ object SecondArrayRef
     member s: StatusList optional=False
 module qapi-schema-test.json
 command user_def_cmd None -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 object q_obj_user_def_cmd1-arg
     member ud1a: UserDefOne optional=False
 command user_def_cmd1 q_obj_user_def_cmd1-arg -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 object q_obj_user_def_cmd2-arg
     member ud1a: UserDefOne optional=False
     member ud1b: UserDefOne optional=True
 command user_def_cmd2 q_obj_user_def_cmd2-arg -> UserDefTwo
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 command cmd-success-response None -> None
-   gen=True success_response=False boxed=False oob=False preconfig=False
+    gen=True success_response=False boxed=False oob=False preconfig=False
 object q_obj_guest-get-time-arg
     member a: int optional=False
     member b: int optional=True
 command guest-get-time q_obj_guest-get-time-arg -> int
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 object q_obj_guest-sync-arg
     member arg: any optional=False
 command guest-sync q_obj_guest-sync-arg -> any
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 command boxed-struct UserDefZero -> None
-   gen=True success_response=True boxed=True oob=False preconfig=False
+    gen=True success_response=True boxed=True oob=False preconfig=False
 command boxed-union UserDefListUnion -> None
-   gen=True success_response=True boxed=True oob=False preconfig=False
+    gen=True success_response=True boxed=True oob=False preconfig=False
 command boxed-empty Empty1 -> None
-   gen=True success_response=True boxed=True oob=False preconfig=False
+    gen=True success_response=True boxed=True oob=False preconfig=False
 command test-flags-command None -> None
-   gen=True success_response=True boxed=False oob=True preconfig=True
+    gen=True success_response=True boxed=False oob=True preconfig=True
 object UserDefOptions
     member i64: intList optional=True
     member u64: uint64List optional=True
@@ -245,28 +245,28 @@ object EventStructOne
     member string: str optional=False
     member enum2: EnumOne optional=True
 event EVENT_A None
-   boxed=False
+    boxed=False
 event EVENT_B None
-   boxed=False
+    boxed=False
 object q_obj_EVENT_C-arg
     member a: int optional=True
     member b: UserDefOne optional=True
     member c: str optional=False
 event EVENT_C q_obj_EVENT_C-arg
-   boxed=False
+    boxed=False
 object q_obj_EVENT_D-arg
     member a: EventStructOne optional=False
     member b: str optional=False
     member c: str optional=True
     member enum3: EnumOne optional=True
 event EVENT_D q_obj_EVENT_D-arg
-   boxed=False
+    boxed=False
 event EVENT_E UserDefZero
-   boxed=True
+    boxed=True
 event EVENT_F UserDefFlatUnion
-   boxed=True
+    boxed=True
 event EVENT_G Empty1
-   boxed=True
+    boxed=True
 enum __org.qemu_x-Enum
     member __org.qemu_x-value
 object __org.qemu_x-Base
@@ -297,7 +297,7 @@ alternate __org.qemu_x-Alt
     tag type
     case __org.qemu_x-branch: __org.qemu_x-Base
 event __ORG.QEMU_X-EVENT __org.qemu_x-Struct
-   boxed=False
+    boxed=False
 array __org.qemu_x-EnumList __org.qemu_x-Enum
 array __org.qemu_x-StructList __org.qemu_x-Struct
 object q_obj___org.qemu_x-command-arg
@@ -306,7 +306,7 @@ object q_obj___org.qemu_x-command-arg
     member c: __org.qemu_x-Union2 optional=False
     member d: __org.qemu_x-Alt optional=False
 command __org.qemu_x-command q_obj___org.qemu_x-command-arg -> __org.qemu_x-Union1
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 object TestIfStruct
     member foo: int optional=False
     member bar: int optional=False
@@ -335,7 +335,7 @@ object q_obj_TestIfUnionCmd-arg
     member union_cmd_arg: TestIfUnion optional=False
     if ['defined(TEST_IF_UNION)']
 command TestIfUnionCmd q_obj_TestIfUnionCmd-arg -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
     if ['defined(TEST_IF_UNION)']
 alternate TestIfAlternate
     tag type
@@ -347,7 +347,7 @@ object q_obj_TestIfAlternateCmd-arg
     member alt_cmd_arg: TestIfAlternate optional=False
     if ['defined(TEST_IF_ALT)']
 command TestIfAlternateCmd q_obj_TestIfAlternateCmd-arg -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
     if ['defined(TEST_IF_ALT)']
 object q_obj_TestIfCmd-arg
     member foo: TestIfStruct optional=False
@@ -355,10 +355,10 @@ object q_obj_TestIfCmd-arg
         if ['defined(TEST_IF_CMD_BAR)']
     if ['defined(TEST_IF_CMD)', 'defined(TEST_IF_STRUCT)']
 command TestIfCmd q_obj_TestIfCmd-arg -> UserDefThree
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
     if ['defined(TEST_IF_CMD)', 'defined(TEST_IF_STRUCT)']
 command TestCmdReturnDefThree None -> UserDefThree
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
 array TestIfEnumList TestIfEnum
     if ['defined(TEST_IF_ENUM)']
 object q_obj_TestIfEvent-arg
@@ -367,7 +367,7 @@ object q_obj_TestIfEvent-arg
         if ['defined(TEST_IF_EVT_BAR)']
     if ['defined(TEST_IF_EVT) && defined(TEST_IF_STRUCT)']
 event TestIfEvent q_obj_TestIfEvent-arg
-   boxed=False
+    boxed=False
     if ['defined(TEST_IF_EVT) && defined(TEST_IF_STRUCT)']
 object FeatureStruct0
     member foo: int optional=False
@@ -411,4 +411,27 @@ object q_obj_test-features-arg
     member cfs2: CondFeatureStruct2 optional=False
     member cfs3: CondFeatureStruct3 optional=False
 command test-features q_obj_test-features-arg -> None
-   gen=True success_response=True boxed=False oob=False preconfig=False
+    gen=True success_response=True boxed=False oob=False preconfig=False
+command test-command-features0 None -> None
+    gen=True success_response=True boxed=False oob=False preconfig=False
+command test-command-features1 None -> None
+    gen=True success_response=True boxed=False oob=False preconfig=False
+    feature feature1
+command test-command-features3 None -> None
+    gen=True success_response=True boxed=False oob=False preconfig=False
+    feature feature1
+    feature feature2
+command test-command-cond-features1 None -> None
+    gen=True success_response=True boxed=False oob=False preconfig=False
+    feature feature1
+        if ['defined(TEST_IF_FEATURE_1)']
+command test-command-cond-features2 None -> None
+    gen=True success_response=True boxed=False oob=False preconfig=False
+    feature feature1
+        if ['defined(TEST_IF_FEATURE_1)']
+    feature feature2
+        if ['defined(TEST_IF_FEATURE_2)']
+command test-command-cond-features3 None -> None
+    gen=True success_response=True boxed=False oob=False preconfig=False
+    feature feature1
+        if ['defined(TEST_IF_COND_1)', 'defined(TEST_IF_COND_2)']
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
index d8460a63a7..07d1561d1f 100644
--- a/tests/qapi-schema/quoted-structural-chars.err
+++ b/tests/qapi-schema/quoted-structural-chars.err
@@ -1 +1 @@
-tests/qapi-schema/quoted-structural-chars.json:1:1: expected '{'
+quoted-structural-chars.json:1:1: expected '{'
diff --git a/tests/qapi-schema/quoted-structural-chars.exit b/tests/qapi-schema/quoted-structural-chars.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/quoted-structural-chars.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/redefined-builtin.err b/tests/qapi-schema/redefined-builtin.err
index 47c8933759..58c7e42ffc 100644
--- a/tests/qapi-schema/redefined-builtin.err
+++ b/tests/qapi-schema/redefined-builtin.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/redefined-builtin.json: In struct 'size':
-tests/qapi-schema/redefined-builtin.json:2: built-in type 'size' is already defined
+redefined-builtin.json: In struct 'size':
+redefined-builtin.json:2: built-in type 'size' is already defined
diff --git a/tests/qapi-schema/redefined-builtin.exit b/tests/qapi-schema/redefined-builtin.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/redefined-builtin.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/redefined-command.err b/tests/qapi-schema/redefined-command.err
index 54e366bbf3..888eea87ca 100644
--- a/tests/qapi-schema/redefined-command.err
+++ b/tests/qapi-schema/redefined-command.err
@@ -1,4 +1,4 @@
-tests/qapi-schema/redefined-command.json: In command 'foo':
-tests/qapi-schema/redefined-command.json:3: 'foo' is already defined
-tests/qapi-schema/redefined-command.json: In command 'foo':
-tests/qapi-schema/redefined-command.json:2: previous definition
+redefined-command.json: In command 'foo':
+redefined-command.json:3: 'foo' is already defined
+redefined-command.json: In command 'foo':
+redefined-command.json:2: previous definition
diff --git a/tests/qapi-schema/redefined-command.exit b/tests/qapi-schema/redefined-command.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/redefined-command.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/redefined-event.err b/tests/qapi-schema/redefined-event.err
index 606c6e4497..b1a6d99d2f 100644
--- a/tests/qapi-schema/redefined-event.err
+++ b/tests/qapi-schema/redefined-event.err
@@ -1,4 +1,4 @@
-tests/qapi-schema/redefined-event.json: In event 'EVENT_A':
-tests/qapi-schema/redefined-event.json:3: 'EVENT_A' is already defined
-tests/qapi-schema/redefined-event.json: In event 'EVENT_A':
-tests/qapi-schema/redefined-event.json:2: previous definition
+redefined-event.json: In event 'EVENT_A':
+redefined-event.json:3: 'EVENT_A' is already defined
+redefined-event.json: In event 'EVENT_A':
+redefined-event.json:2: previous definition
diff --git a/tests/qapi-schema/redefined-event.exit b/tests/qapi-schema/redefined-event.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/redefined-event.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/redefined-type.err b/tests/qapi-schema/redefined-type.err
index 77786f98ae..b7103fc15f 100644
--- a/tests/qapi-schema/redefined-type.err
+++ b/tests/qapi-schema/redefined-type.err
@@ -1,4 +1,4 @@
-tests/qapi-schema/redefined-type.json: In enum 'foo':
-tests/qapi-schema/redefined-type.json:3: 'foo' is already defined
-tests/qapi-schema/redefined-type.json: In struct 'foo':
-tests/qapi-schema/redefined-type.json:2: previous definition
+redefined-type.json: In enum 'foo':
+redefined-type.json:3: 'foo' is already defined
+redefined-type.json: In struct 'foo':
+redefined-type.json:2: previous definition
diff --git a/tests/qapi-schema/redefined-type.exit b/tests/qapi-schema/redefined-type.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/redefined-type.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-command-q.err b/tests/qapi-schema/reserved-command-q.err
index 7f65cda02d..6fecbaa046 100644
--- a/tests/qapi-schema/reserved-command-q.err
+++ b/tests/qapi-schema/reserved-command-q.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-command-q.json: In command 'q-unix':
-tests/qapi-schema/reserved-command-q.json:5: command has an invalid name
+reserved-command-q.json: In command 'q-unix':
+reserved-command-q.json:5: command has an invalid name
diff --git a/tests/qapi-schema/reserved-command-q.exit b/tests/qapi-schema/reserved-command-q.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-command-q.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-enum-q.err b/tests/qapi-schema/reserved-enum-q.err
index e202f9ff7b..fc3c757874 100644
--- a/tests/qapi-schema/reserved-enum-q.err
+++ b/tests/qapi-schema/reserved-enum-q.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-enum-q.json: In enum 'Foo':
-tests/qapi-schema/reserved-enum-q.json:4: 'data' member 'q-Unix' has an invalid name
+reserved-enum-q.json: In enum 'Foo':
+reserved-enum-q.json:4: 'data' member 'q-Unix' has an invalid name
diff --git a/tests/qapi-schema/reserved-enum-q.exit b/tests/qapi-schema/reserved-enum-q.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-enum-q.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-member-has.err b/tests/qapi-schema/reserved-member-has.err
index c7ad721ad1..436e1749f2 100644
--- a/tests/qapi-schema/reserved-member-has.err
+++ b/tests/qapi-schema/reserved-member-has.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-member-has.json: In command 'oops':
-tests/qapi-schema/reserved-member-has.json:5: 'data' member 'has-a' uses reserved name
+reserved-member-has.json: In command 'oops':
+reserved-member-has.json:5: 'data' member 'has-a' uses reserved name
diff --git a/tests/qapi-schema/reserved-member-has.exit b/tests/qapi-schema/reserved-member-has.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-member-has.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-member-q.err b/tests/qapi-schema/reserved-member-q.err
index 04078604fa..9ac8654a8b 100644
--- a/tests/qapi-schema/reserved-member-q.err
+++ b/tests/qapi-schema/reserved-member-q.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-member-q.json: In struct 'Foo':
-tests/qapi-schema/reserved-member-q.json:4: 'data' member 'q-unix' has an invalid name
+reserved-member-q.json: In struct 'Foo':
+reserved-member-q.json:4: 'data' member 'q-unix' has an invalid name
diff --git a/tests/qapi-schema/reserved-member-q.exit b/tests/qapi-schema/reserved-member-q.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-member-q.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-member-u.err b/tests/qapi-schema/reserved-member-u.err
index 2e92c11ba5..231d552494 100644
--- a/tests/qapi-schema/reserved-member-u.err
+++ b/tests/qapi-schema/reserved-member-u.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-member-u.json: In struct 'Oops':
-tests/qapi-schema/reserved-member-u.json:7: 'data' member 'u' uses reserved name
+reserved-member-u.json: In struct 'Oops':
+reserved-member-u.json:7: 'data' member 'u' uses reserved name
diff --git a/tests/qapi-schema/reserved-member-u.exit b/tests/qapi-schema/reserved-member-u.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-member-u.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-member-underscore.err b/tests/qapi-schema/reserved-member-underscore.err
index da62b48222..df3ab8a11a 100644
--- a/tests/qapi-schema/reserved-member-underscore.err
+++ b/tests/qapi-schema/reserved-member-underscore.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-member-underscore.json: In struct 'Oops':
-tests/qapi-schema/reserved-member-underscore.json:4: 'data' member '_oops' has an invalid name
+reserved-member-underscore.json: In struct 'Oops':
+reserved-member-underscore.json:4: 'data' member '_oops' has an invalid name
diff --git a/tests/qapi-schema/reserved-member-underscore.exit b/tests/qapi-schema/reserved-member-underscore.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-member-underscore.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-type-kind.err b/tests/qapi-schema/reserved-type-kind.err
index f8112cf92e..d8fb769f9d 100644
--- a/tests/qapi-schema/reserved-type-kind.err
+++ b/tests/qapi-schema/reserved-type-kind.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-type-kind.json: In enum 'UnionKind':
-tests/qapi-schema/reserved-type-kind.json:2: enum name should not end in 'Kind'
+reserved-type-kind.json: In enum 'UnionKind':
+reserved-type-kind.json:2: enum name should not end in 'Kind'
diff --git a/tests/qapi-schema/reserved-type-kind.exit b/tests/qapi-schema/reserved-type-kind.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-type-kind.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/reserved-type-list.err b/tests/qapi-schema/reserved-type-list.err
index c6eee0585c..e09f5352f8 100644
--- a/tests/qapi-schema/reserved-type-list.err
+++ b/tests/qapi-schema/reserved-type-list.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/reserved-type-list.json: In struct 'FooList':
-tests/qapi-schema/reserved-type-list.json:5: struct name should not end in 'List'
+reserved-type-list.json: In struct 'FooList':
+reserved-type-list.json:5: struct name should not end in 'List'
diff --git a/tests/qapi-schema/reserved-type-list.exit b/tests/qapi-schema/reserved-type-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/reserved-type-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/returns-alternate.err b/tests/qapi-schema/returns-alternate.err
index c1caf98c47..b6421a8917 100644
--- a/tests/qapi-schema/returns-alternate.err
+++ b/tests/qapi-schema/returns-alternate.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/returns-alternate.json: In command 'oops':
-tests/qapi-schema/returns-alternate.json:3: command's 'returns' cannot take alternate type 'Alt'
+returns-alternate.json: In command 'oops':
+returns-alternate.json:3: command's 'returns' cannot take alternate type 'Alt'
diff --git a/tests/qapi-schema/returns-alternate.exit b/tests/qapi-schema/returns-alternate.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/returns-alternate.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/returns-array-bad.err b/tests/qapi-schema/returns-array-bad.err
index 1b86777d8f..52712d139d 100644
--- a/tests/qapi-schema/returns-array-bad.err
+++ b/tests/qapi-schema/returns-array-bad.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/returns-array-bad.json: In command 'oops':
-tests/qapi-schema/returns-array-bad.json:2: 'returns': array type must contain single type name
+returns-array-bad.json: In command 'oops':
+returns-array-bad.json:2: 'returns': array type must contain single type name
diff --git a/tests/qapi-schema/returns-array-bad.exit b/tests/qapi-schema/returns-array-bad.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/returns-array-bad.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/returns-dict.err b/tests/qapi-schema/returns-dict.err
index 52e4f3ad71..9b2d90c010 100644
--- a/tests/qapi-schema/returns-dict.err
+++ b/tests/qapi-schema/returns-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/returns-dict.json: In command 'oops':
-tests/qapi-schema/returns-dict.json:2: 'returns' should be a type name
+returns-dict.json: In command 'oops':
+returns-dict.json:2: 'returns' should be a type name
diff --git a/tests/qapi-schema/returns-dict.exit b/tests/qapi-schema/returns-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/returns-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/returns-unknown.err b/tests/qapi-schema/returns-unknown.err
index f0a989a175..bf59086d0c 100644
--- a/tests/qapi-schema/returns-unknown.err
+++ b/tests/qapi-schema/returns-unknown.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/returns-unknown.json: In command 'oops':
-tests/qapi-schema/returns-unknown.json:2: command's 'returns' uses unknown type 'NoSuchType'
+returns-unknown.json: In command 'oops':
+returns-unknown.json:2: command's 'returns' uses unknown type 'NoSuchType'
diff --git a/tests/qapi-schema/returns-unknown.exit b/tests/qapi-schema/returns-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/returns-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/returns-whitelist.err b/tests/qapi-schema/returns-whitelist.err
index 5b0285220f..c6e46b9b86 100644
--- a/tests/qapi-schema/returns-whitelist.err
+++ b/tests/qapi-schema/returns-whitelist.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/returns-whitelist.json: In command 'no-way-this-will-get-whitelisted':
-tests/qapi-schema/returns-whitelist.json:14: command's 'returns' cannot take array type ['int']
+returns-whitelist.json: In command 'no-way-this-will-get-whitelisted':
+returns-whitelist.json:14: command's 'returns' cannot take array type ['int']
diff --git a/tests/qapi-schema/returns-whitelist.exit b/tests/qapi-schema/returns-whitelist.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/returns-whitelist.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/string-code-point-127.err b/tests/qapi-schema/string-code-point-127.err
index b4fa2610a9..eb0d1c71a6 100644
--- a/tests/qapi-schema/string-code-point-127.err
+++ b/tests/qapi-schema/string-code-point-127.err
@@ -1 +1 @@
-tests/qapi-schema/string-code-point-127.json:2:14: funny character in string
+string-code-point-127.json:2:14: funny character in string
diff --git a/tests/qapi-schema/string-code-point-127.exit b/tests/qapi-schema/string-code-point-127.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/string-code-point-127.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/string-code-point-31.err b/tests/qapi-schema/string-code-point-31.err
index 0bb5ce37b8..ae969d6e10 100644
--- a/tests/qapi-schema/string-code-point-31.err
+++ b/tests/qapi-schema/string-code-point-31.err
@@ -1 +1 @@
-tests/qapi-schema/string-code-point-31.json:2:14: funny character in string
+string-code-point-31.json:2:14: funny character in string
diff --git a/tests/qapi-schema/string-code-point-31.exit b/tests/qapi-schema/string-code-point-31.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/string-code-point-31.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/struct-base-clash-deep.err b/tests/qapi-schema/struct-base-clash-deep.err
index 2b12b3c07f..79879681d9 100644
--- a/tests/qapi-schema/struct-base-clash-deep.err
+++ b/tests/qapi-schema/struct-base-clash-deep.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/struct-base-clash-deep.json: In struct 'Sub':
-tests/qapi-schema/struct-base-clash-deep.json:10: member 'name' collides with member 'name' of type 'Base'
+struct-base-clash-deep.json: In struct 'Sub':
+struct-base-clash-deep.json:10: member 'name' collides with member 'name' of type 'Base'
diff --git a/tests/qapi-schema/struct-base-clash-deep.exit b/tests/qapi-schema/struct-base-clash-deep.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/struct-base-clash-deep.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/struct-base-clash.err b/tests/qapi-schema/struct-base-clash.err
index 8c3ee1c435..46473947e6 100644
--- a/tests/qapi-schema/struct-base-clash.err
+++ b/tests/qapi-schema/struct-base-clash.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/struct-base-clash.json: In struct 'Sub':
-tests/qapi-schema/struct-base-clash.json:5: member 'name' collides with member 'name' of type 'Base'
+struct-base-clash.json: In struct 'Sub':
+struct-base-clash.json:5: member 'name' collides with member 'name' of type 'Base'
diff --git a/tests/qapi-schema/struct-base-clash.exit b/tests/qapi-schema/struct-base-clash.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/struct-base-clash.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/struct-data-invalid.err b/tests/qapi-schema/struct-data-invalid.err
index aa868bf974..5ed4bec573 100644
--- a/tests/qapi-schema/struct-data-invalid.err
+++ b/tests/qapi-schema/struct-data-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/struct-data-invalid.json: In struct 'foo':
-tests/qapi-schema/struct-data-invalid.json:1: 'data' should be an object or type name
+struct-data-invalid.json: In struct 'foo':
+struct-data-invalid.json:1: 'data' should be an object or type name
diff --git a/tests/qapi-schema/struct-data-invalid.exit b/tests/qapi-schema/struct-data-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/struct-data-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/struct-member-if-invalid.err b/tests/qapi-schema/struct-member-if-invalid.err
index 4c5983674b..42e7fdae3c 100644
--- a/tests/qapi-schema/struct-member-if-invalid.err
+++ b/tests/qapi-schema/struct-member-if-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/struct-member-if-invalid.json: In struct 'Stru':
-tests/qapi-schema/struct-member-if-invalid.json:2: 'if' condition of 'data' member 'member' must be a string or a list of strings
+struct-member-if-invalid.json: In struct 'Stru':
+struct-member-if-invalid.json:2: 'if' condition of 'data' member 'member' must be a string or a list of strings
diff --git a/tests/qapi-schema/struct-member-if-invalid.exit b/tests/qapi-schema/struct-member-if-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/struct-member-if-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/struct-member-invalid-dict.err b/tests/qapi-schema/struct-member-invalid-dict.err
index 46ec991c28..0621aecfbd 100644
--- a/tests/qapi-schema/struct-member-invalid-dict.err
+++ b/tests/qapi-schema/struct-member-invalid-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/struct-member-invalid-dict.json: In struct 'foo':
-tests/qapi-schema/struct-member-invalid-dict.json:2: 'data' member '*a' misses key 'type'
+struct-member-invalid-dict.json: In struct 'foo':
+struct-member-invalid-dict.json:2: 'data' member '*a' misses key 'type'
diff --git a/tests/qapi-schema/struct-member-invalid-dict.exit b/tests/qapi-schema/struct-member-invalid-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/struct-member-invalid-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/struct-member-invalid.err b/tests/qapi-schema/struct-member-invalid.err
index 92d4973832..9a2c934538 100644
--- a/tests/qapi-schema/struct-member-invalid.err
+++ b/tests/qapi-schema/struct-member-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/struct-member-invalid.json: In struct 'foo':
-tests/qapi-schema/struct-member-invalid.json:1: 'data' member 'a' should be a type name
+struct-member-invalid.json: In struct 'foo':
+struct-member-invalid.json:1: 'data' member 'a' should be a type name
diff --git a/tests/qapi-schema/struct-member-invalid.exit b/tests/qapi-schema/struct-member-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/struct-member-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
index b0f770b9bd..2bd9fd8742 100644..100755
--- a/tests/qapi-schema/test-qapi.py
+++ b/tests/qapi-schema/test-qapi.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python
 #
 # QAPI parser test harness
 #
@@ -11,8 +12,19 @@
 #
 
 from __future__ import print_function
+
+import argparse
+import difflib
+import os
 import sys
-from qapi.common import QAPIError, QAPISchema, QAPISchemaVisitor
+
+from qapi.error import QAPIError
+from qapi.schema import QAPISchema, QAPISchemaVisitor
+
+if sys.version_info[0] < 3:
+    from cStringIO import StringIO
+else:
+    from io import StringIO
 
 
 class QAPISchemaTestVisitor(QAPISchemaVisitor):
@@ -49,10 +61,7 @@ class QAPISchemaTestVisitor(QAPISchemaVisitor):
             self._print_if(m.ifcond, 8)
         self._print_variants(variants)
         self._print_if(ifcond)
-        if features:
-            for f in features:
-                print('    feature %s' % f.name)
-                self._print_if(f.ifcond, 8)
+        self._print_features(features)
 
     def visit_alternate_type(self, name, info, ifcond, variants):
         print('alternate %s' % name)
@@ -60,17 +69,19 @@ class QAPISchemaTestVisitor(QAPISchemaVisitor):
         self._print_if(ifcond)
 
     def visit_command(self, name, info, ifcond, arg_type, ret_type, gen,
-                      success_response, boxed, allow_oob, allow_preconfig):
+                      success_response, boxed, allow_oob, allow_preconfig,
+                      features):
         print('command %s %s -> %s'
               % (name, arg_type and arg_type.name,
                  ret_type and ret_type.name))
-        print('   gen=%s success_response=%s boxed=%s oob=%s preconfig=%s'
+        print('    gen=%s success_response=%s boxed=%s oob=%s preconfig=%s'
               % (gen, success_response, boxed, allow_oob, allow_preconfig))
         self._print_if(ifcond)
+        self._print_features(features)
 
     def visit_event(self, name, info, ifcond, arg_type, boxed):
         print('event %s %s' % (name, arg_type and arg_type.name))
-        print('   boxed=%s' % boxed)
+        print('    boxed=%s' % boxed)
         self._print_if(ifcond)
 
     @staticmethod
@@ -86,22 +97,110 @@ class QAPISchemaTestVisitor(QAPISchemaVisitor):
         if ifcond:
             print('%sif %s' % (' ' * indent, ifcond))
 
-
-try:
-    schema = QAPISchema(sys.argv[1])
-except QAPIError as err:
-    print(err, file=sys.stderr)
-    exit(1)
-
-schema.visit(QAPISchemaTestVisitor())
-
-for doc in schema.docs:
-    if doc.symbol:
-        print('doc symbol=%s' % doc.symbol)
+    @classmethod
+    def _print_features(cls, features):
+        if features:
+            for f in features:
+                print('    feature %s' % f.name)
+                cls._print_if(f.ifcond, 8)
+
+
+def test_frontend(fname):
+    schema = QAPISchema(fname)
+    schema.visit(QAPISchemaTestVisitor())
+
+    for doc in schema.docs:
+        if doc.symbol:
+            print('doc symbol=%s' % doc.symbol)
+        else:
+            print('doc freeform')
+        print('    body=\n%s' % doc.body.text)
+        for arg, section in doc.args.items():
+            print('    arg=%s\n%s' % (arg, section.text))
+        for section in doc.sections:
+            print('    section=%s\n%s' % (section.name, section.text))
+
+
+def test_and_diff(test_name, dir_name, update):
+    sys.stdout = StringIO()
+    try:
+        test_frontend(os.path.join(dir_name, test_name + '.json'))
+    except QAPIError as err:
+        if err.info.fname is None:
+            print("%s" % err, file=sys.stderr)
+            return 2
+        errstr = str(err) + '\n'
+        if dir_name:
+            errstr = errstr.replace(dir_name + '/', '')
+        actual_err = errstr.splitlines(True)
     else:
-        print('doc freeform')
-    print('    body=\n%s' % doc.body.text)
-    for arg, section in doc.args.items():
-        print('    arg=%s\n%s' % (arg, section.text))
-    for section in doc.sections:
-        print('    section=%s\n%s' % (section.name, section.text))
+        actual_err = []
+    finally:
+        actual_out = sys.stdout.getvalue().splitlines(True)
+        sys.stdout.close()
+        sys.stdout = sys.__stdout__
+
+    mode = 'r+' if update else 'r'
+    try:
+        outfp = open(os.path.join(dir_name, test_name + '.out'), mode)
+        errfp = open(os.path.join(dir_name, test_name + '.err'), mode)
+        expected_out = outfp.readlines()
+        expected_err = errfp.readlines()
+    except IOError as err:
+        print("%s: can't open '%s': %s"
+              % (sys.argv[0], err.filename, err.strerror),
+              file=sys.stderr)
+        return 2
+
+    if actual_out == expected_out and actual_err == expected_err:
+        return 0
+
+    print("%s %s" % (test_name, 'UPDATE' if update else 'FAIL'),
+          file=sys.stderr)
+    out_diff = difflib.unified_diff(expected_out, actual_out, outfp.name)
+    err_diff = difflib.unified_diff(expected_err, actual_err, errfp.name)
+    sys.stdout.writelines(out_diff)
+    sys.stdout.writelines(err_diff)
+
+    if not update:
+        return 1
+
+    try:
+        outfp.truncate(0)
+        outfp.seek(0)
+        outfp.writelines(actual_out)
+        errfp.truncate(0)
+        errfp.seek(0)
+        errfp.writelines(actual_err)
+    except IOError as err:
+        print("%s: can't write '%s': %s"
+              % (sys.argv[0], err.filename, err.strerror),
+              file=sys.stderr)
+        return 2
+
+    return 0
+
+
+def main(argv):
+    parser = argparse.ArgumentParser(
+        description='QAPI schema tester')
+    parser.add_argument('-d', '--dir', action='store', default='',
+                        help="directory containing tests")
+    parser.add_argument('-u', '--update', action='store_true',
+                        help="update expected test results")
+    parser.add_argument('tests', nargs='*', metavar='TEST', action='store')
+    args = parser.parse_args()
+
+    status = 0
+    for t in args.tests:
+        (dir_name, base_name) = os.path.split(t)
+        dir_name = dir_name or args.dir
+        test_name = os.path.splitext(base_name)[0]
+        status |= test_and_diff(test_name, dir_name, args.update)
+
+    exit(status)
+
+
+if __name__ == '__main__':
+    main(sys.argv)
+    exit(0)
diff --git a/tests/qapi-schema/trailing-comma-list.err b/tests/qapi-schema/trailing-comma-list.err
index 167d688beb..ad2f2d7c97 100644
--- a/tests/qapi-schema/trailing-comma-list.err
+++ b/tests/qapi-schema/trailing-comma-list.err
@@ -1 +1 @@
-tests/qapi-schema/trailing-comma-list.json:2:36: expected '{', '[', string, boolean or 'null'
+trailing-comma-list.json:2:36: expected '{', '[', string, boolean or 'null'
diff --git a/tests/qapi-schema/trailing-comma-list.exit b/tests/qapi-schema/trailing-comma-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/trailing-comma-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/trailing-comma-object.err b/tests/qapi-schema/trailing-comma-object.err
index 186df0fa45..29aafc69cd 100644
--- a/tests/qapi-schema/trailing-comma-object.err
+++ b/tests/qapi-schema/trailing-comma-object.err
@@ -1 +1 @@
-tests/qapi-schema/trailing-comma-object.json:2:38: expected string
+trailing-comma-object.json:2:38: expected string
diff --git a/tests/qapi-schema/trailing-comma-object.exit b/tests/qapi-schema/trailing-comma-object.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/trailing-comma-object.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/type-bypass-bad-gen.err b/tests/qapi-schema/type-bypass-bad-gen.err
index 1077651896..2ca95cd86d 100644
--- a/tests/qapi-schema/type-bypass-bad-gen.err
+++ b/tests/qapi-schema/type-bypass-bad-gen.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/type-bypass-bad-gen.json: In command 'foo':
-tests/qapi-schema/type-bypass-bad-gen.json:2: flag 'gen' may only use false value
+type-bypass-bad-gen.json: In command 'foo':
+type-bypass-bad-gen.json:2: flag 'gen' may only use false value
diff --git a/tests/qapi-schema/type-bypass-bad-gen.exit b/tests/qapi-schema/type-bypass-bad-gen.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/type-bypass-bad-gen.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/unclosed-list.err b/tests/qapi-schema/unclosed-list.err
index 6648a8e30b..aa2c430b22 100644
--- a/tests/qapi-schema/unclosed-list.err
+++ b/tests/qapi-schema/unclosed-list.err
@@ -1 +1 @@
-tests/qapi-schema/unclosed-list.json:1:20: expected ',' or ']'
+unclosed-list.json:1:20: expected ',' or ']'
diff --git a/tests/qapi-schema/unclosed-list.exit b/tests/qapi-schema/unclosed-list.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/unclosed-list.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/unclosed-object.err b/tests/qapi-schema/unclosed-object.err
index 54d221e3a9..c08499b341 100644
--- a/tests/qapi-schema/unclosed-object.err
+++ b/tests/qapi-schema/unclosed-object.err
@@ -1 +1 @@
-tests/qapi-schema/unclosed-object.json:1:21: expected ',' or '}'
+unclosed-object.json:1:21: expected ',' or '}'
diff --git a/tests/qapi-schema/unclosed-object.exit b/tests/qapi-schema/unclosed-object.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/unclosed-object.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/unclosed-string.err b/tests/qapi-schema/unclosed-string.err
index 9439698fe0..175e192b24 100644
--- a/tests/qapi-schema/unclosed-string.err
+++ b/tests/qapi-schema/unclosed-string.err
@@ -1 +1 @@
-tests/qapi-schema/unclosed-string.json:1:11: missing terminating "'"
+unclosed-string.json:1:11: missing terminating "'"
diff --git a/tests/qapi-schema/unclosed-string.exit b/tests/qapi-schema/unclosed-string.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/unclosed-string.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-base-empty.err b/tests/qapi-schema/union-base-empty.err
index b76542d47a..3630b341a6 100644
--- a/tests/qapi-schema/union-base-empty.err
+++ b/tests/qapi-schema/union-base-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-base-empty.json: In union 'TestUnion':
-tests/qapi-schema/union-base-empty.json:5: discriminator 'type' is not a member of 'base'
+union-base-empty.json: In union 'TestUnion':
+union-base-empty.json:5: discriminator 'type' is not a member of 'base'
diff --git a/tests/qapi-schema/union-base-empty.exit b/tests/qapi-schema/union-base-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-base-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-base-no-discriminator.err b/tests/qapi-schema/union-base-no-discriminator.err
index f4c16a2c14..9cd5d11b0b 100644
--- a/tests/qapi-schema/union-base-no-discriminator.err
+++ b/tests/qapi-schema/union-base-no-discriminator.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-base-no-discriminator.json: In union 'TestUnion':
-tests/qapi-schema/union-base-no-discriminator.json:11: 'base' requires 'discriminator'
+union-base-no-discriminator.json: In union 'TestUnion':
+union-base-no-discriminator.json:11: 'base' requires 'discriminator'
diff --git a/tests/qapi-schema/union-base-no-discriminator.exit b/tests/qapi-schema/union-base-no-discriminator.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-base-no-discriminator.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-branch-case.err b/tests/qapi-schema/union-branch-case.err
index a0684ae637..b1e9417303 100644
--- a/tests/qapi-schema/union-branch-case.err
+++ b/tests/qapi-schema/union-branch-case.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-branch-case.json: In union 'Uni':
-tests/qapi-schema/union-branch-case.json:2: 'data' member 'Branch' uses uppercase in name
+union-branch-case.json: In union 'Uni':
+union-branch-case.json:2: 'data' member 'Branch' uses uppercase in name
diff --git a/tests/qapi-schema/union-branch-case.exit b/tests/qapi-schema/union-branch-case.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-branch-case.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-branch-if-invalid.err b/tests/qapi-schema/union-branch-if-invalid.err
index 14819bf8b8..dd4518233e 100644
--- a/tests/qapi-schema/union-branch-if-invalid.err
+++ b/tests/qapi-schema/union-branch-if-invalid.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-branch-if-invalid.json: In union 'Uni':
-tests/qapi-schema/union-branch-if-invalid.json:4: 'if' condition '' of 'data' member 'branch1' makes no sense
+union-branch-if-invalid.json: In union 'Uni':
+union-branch-if-invalid.json:4: 'if' condition '' of 'data' member 'branch1' makes no sense
diff --git a/tests/qapi-schema/union-branch-if-invalid.exit b/tests/qapi-schema/union-branch-if-invalid.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-branch-if-invalid.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-branch-invalid-dict.err b/tests/qapi-schema/union-branch-invalid-dict.err
index 2967cd6260..8137c5a767 100644
--- a/tests/qapi-schema/union-branch-invalid-dict.err
+++ b/tests/qapi-schema/union-branch-invalid-dict.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-branch-invalid-dict.json: In union 'UnionInvalidBranch':
-tests/qapi-schema/union-branch-invalid-dict.json:2: 'data' member 'integer' misses key 'type'
+union-branch-invalid-dict.json: In union 'UnionInvalidBranch':
+union-branch-invalid-dict.json:2: 'data' member 'integer' misses key 'type'
diff --git a/tests/qapi-schema/union-branch-invalid-dict.exit b/tests/qapi-schema/union-branch-invalid-dict.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-branch-invalid-dict.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-clash-branches.err b/tests/qapi-schema/union-clash-branches.err
index 931399f076..73bbc2cabd 100644
--- a/tests/qapi-schema/union-clash-branches.err
+++ b/tests/qapi-schema/union-clash-branches.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-clash-branches.json: In union 'TestUnion':
-tests/qapi-schema/union-clash-branches.json:4: branch 'a_b' collides with branch 'a-b'
+union-clash-branches.json: In union 'TestUnion':
+union-clash-branches.json:4: branch 'a_b' collides with branch 'a-b'
diff --git a/tests/qapi-schema/union-clash-branches.exit b/tests/qapi-schema/union-clash-branches.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-clash-branches.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-empty.err b/tests/qapi-schema/union-empty.err
index 35c0d62eb0..59788c94ce 100644
--- a/tests/qapi-schema/union-empty.err
+++ b/tests/qapi-schema/union-empty.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-empty.json: In union 'Union':
-tests/qapi-schema/union-empty.json:2: union has no branches
+union-empty.json: In union 'Union':
+union-empty.json:2: union has no branches
diff --git a/tests/qapi-schema/union-empty.exit b/tests/qapi-schema/union-empty.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-empty.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-invalid-base.err b/tests/qapi-schema/union-invalid-base.err
index 10fecf0b56..a804028438 100644
--- a/tests/qapi-schema/union-invalid-base.err
+++ b/tests/qapi-schema/union-invalid-base.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-invalid-base.json: In union 'TestUnion':
-tests/qapi-schema/union-invalid-base.json:8: 'base' requires a struct type, built-in type 'int' isn't
+union-invalid-base.json: In union 'TestUnion':
+union-invalid-base.json:8: 'base' requires a struct type, built-in type 'int' isn't
diff --git a/tests/qapi-schema/union-invalid-base.exit b/tests/qapi-schema/union-invalid-base.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-invalid-base.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-optional-branch.err b/tests/qapi-schema/union-optional-branch.err
index 9f24274923..b33f111de4 100644
--- a/tests/qapi-schema/union-optional-branch.err
+++ b/tests/qapi-schema/union-optional-branch.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-optional-branch.json: In union 'Union':
-tests/qapi-schema/union-optional-branch.json:2: 'data' member '*a' has an invalid name
+union-optional-branch.json: In union 'Union':
+union-optional-branch.json:2: 'data' member '*a' has an invalid name
diff --git a/tests/qapi-schema/union-optional-branch.exit b/tests/qapi-schema/union-optional-branch.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-optional-branch.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/union-unknown.err b/tests/qapi-schema/union-unknown.err
index a7f340ddca..7aba9f94da 100644
--- a/tests/qapi-schema/union-unknown.err
+++ b/tests/qapi-schema/union-unknown.err
@@ -1,2 +1,2 @@
-tests/qapi-schema/union-unknown.json: In union 'Union':
-tests/qapi-schema/union-unknown.json:2: union uses unknown type 'MissingType'
+union-unknown.json: In union 'Union':
+union-unknown.json:2: union uses unknown type 'MissingType'
diff --git a/tests/qapi-schema/union-unknown.exit b/tests/qapi-schema/union-unknown.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/union-unknown.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/unknown-escape.err b/tests/qapi-schema/unknown-escape.err
index e24bbaf046..759a5990d8 100644
--- a/tests/qapi-schema/unknown-escape.err
+++ b/tests/qapi-schema/unknown-escape.err
@@ -1 +1 @@
-tests/qapi-schema/unknown-escape.json:3:21: unknown escape \x
+unknown-escape.json:3:21: unknown escape \x
diff --git a/tests/qapi-schema/unknown-escape.exit b/tests/qapi-schema/unknown-escape.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/unknown-escape.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qapi-schema/unknown-expr-key.err b/tests/qapi-schema/unknown-expr-key.err
index be9f99c4ef..c5f395bf79 100644
--- a/tests/qapi-schema/unknown-expr-key.err
+++ b/tests/qapi-schema/unknown-expr-key.err
@@ -1,3 +1,3 @@
-tests/qapi-schema/unknown-expr-key.json: In struct 'bar':
-tests/qapi-schema/unknown-expr-key.json:2: struct has unknown keys 'bogus', 'phony'
+unknown-expr-key.json: In struct 'bar':
+unknown-expr-key.json:2: struct has unknown keys 'bogus', 'phony'
 Valid keys are 'base', 'data', 'features', 'if', 'struct'.
diff --git a/tests/qapi-schema/unknown-expr-key.exit b/tests/qapi-schema/unknown-expr-key.exit
deleted file mode 100644
index d00491fd7e..0000000000
--- a/tests/qapi-schema/unknown-expr-key.exit
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/tests/qemu-iotests/118 b/tests/qemu-iotests/118
index ea0b326ae0..e20080e9a6 100755
--- a/tests/qemu-iotests/118
+++ b/tests/qemu-iotests/118
@@ -446,6 +446,7 @@ class TestChangeReadOnly(ChangeBaseClass):
         self.assert_qmp(result, 'return[0]/inserted/ro', True)
         self.assert_qmp(result, 'return[0]/inserted/image/filename', new_img)
 
+    @iotests.skip_if_user_is_root
     def test_rw_ro_retain(self):
         os.chmod(new_img, 0o444)
         self.vm.add_drive(old_img, 'media=disk', 'none')
@@ -530,6 +531,7 @@ class TestChangeReadOnly(ChangeBaseClass):
         self.assert_qmp(result, 'return[0]/inserted/ro', True)
         self.assert_qmp(result, 'return[0]/inserted/image/filename', new_img)
 
+    @iotests.skip_if_user_is_root
     def test_make_ro_rw(self):
         os.chmod(new_img, 0o444)
         self.vm.add_drive(old_img, 'media=disk', 'none')
@@ -571,6 +573,7 @@ class TestChangeReadOnly(ChangeBaseClass):
         self.assert_qmp(result, 'return[0]/inserted/ro', True)
         self.assert_qmp(result, 'return[0]/inserted/image/filename', new_img)
 
+    @iotests.skip_if_user_is_root
     def test_make_ro_rw_by_retain(self):
         os.chmod(new_img, 0o444)
         self.vm.add_drive(old_img, 'media=disk', 'none')
diff --git a/tests/qemu-iotests/264 b/tests/qemu-iotests/264
new file mode 100755
index 0000000000..c8cd97ae2b
--- /dev/null
+++ b/tests/qemu-iotests/264
@@ -0,0 +1,95 @@
+#!/usr/bin/env python
+#
+# Test nbd reconnect
+#
+# Copyright (c) 2019 Virtuozzo International GmbH.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import time
+
+import iotests
+from iotests import qemu_img_create, qemu_io_silent_check, file_path, \
+        qemu_nbd_popen, log
+
+disk_a, disk_b, nbd_sock = file_path('disk_a', 'disk_b', 'nbd-sock')
+nbd_uri = 'nbd+unix:///?socket=' + nbd_sock
+size = 5 * 1024 * 1024
+wait_limit = 3
+wait_step = 0.2
+
+qemu_img_create('-f', iotests.imgfmt, disk_a, str(size))
+qemu_img_create('-f', iotests.imgfmt, disk_b, str(size))
+srv = qemu_nbd_popen('-k', nbd_sock, '-f', iotests.imgfmt, disk_b)
+
+# Wait for NBD server availability
+t = 0
+ok = False
+while t < wait_limit:
+    ok = qemu_io_silent_check('-f', 'raw', '-c', 'read 0 512', nbd_uri)
+    if ok:
+        break
+    time.sleep(wait_step)
+    t += wait_step
+
+assert ok
+
+vm = iotests.VM().add_drive(disk_a)
+vm.launch()
+vm.hmp_qemu_io('drive0', 'write 0 {}'.format(size))
+
+vm.qmp_log('blockdev-add', filters=[iotests.filter_qmp_testfiles],
+           **{'node_name': 'backup0',
+              'driver': 'raw',
+              'file': {'driver': 'nbd',
+                       'server': {'type': 'unix', 'path': nbd_sock},
+                       'reconnect-delay': 10}})
+vm.qmp_log('blockdev-backup', device='drive0', sync='full', target='backup0',
+           speed=(1 * 1024 * 1024))
+
+# Wait for some progress
+t = 0
+while t < wait_limit:
+    jobs = vm.qmp('query-block-jobs')['return']
+    if jobs and jobs[0]['offset'] > 0:
+        break
+    time.sleep(wait_step)
+    t += wait_step
+
+if jobs and jobs[0]['offset'] > 0:
+    log('Backup job is started')
+
+log('Kill NBD server')
+srv.kill()
+srv.wait()
+
+jobs = vm.qmp('query-block-jobs')['return']
+if jobs and jobs[0]['offset'] < jobs[0]['len']:
+    log('Backup job is still in progress')
+
+vm.qmp_log('block-job-set-speed', device='drive0', speed=0)
+
+# Emulate server down time for 1 second
+time.sleep(1)
+
+log('Start NBD server')
+srv = qemu_nbd_popen('-k', nbd_sock, '-f', iotests.imgfmt, disk_b)
+
+e = vm.event_wait('BLOCK_JOB_COMPLETED')
+log('Backup completed: {}'.format(e['data']['offset']))
+
+vm.qmp_log('blockdev-del', node_name='backup0')
+srv.kill()
+vm.shutdown()
diff --git a/tests/qemu-iotests/264.out b/tests/qemu-iotests/264.out
new file mode 100644
index 0000000000..3000944b09
--- /dev/null
+++ b/tests/qemu-iotests/264.out
@@ -0,0 +1,13 @@
+{"execute": "blockdev-add", "arguments": {"driver": "raw", "file": {"driver": "nbd", "reconnect-delay": 10, "server": {"path": "TEST_DIR/PID-nbd-sock", "type": "unix"}}, "node-name": "backup0"}}
+{"return": {}}
+{"execute": "blockdev-backup", "arguments": {"device": "drive0", "speed": 1048576, "sync": "full", "target": "backup0"}}
+{"return": {}}
+Backup job is started
+Kill NBD server
+Backup job is still in progress
+{"execute": "block-job-set-speed", "arguments": {"device": "drive0", "speed": 0}}
+{"return": {}}
+Start NBD server
+Backup completed: 5242880
+{"execute": "blockdev-del", "arguments": {"node-name": "backup0"}}
+{"return": {}}
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index a73df279e5..af322af756 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -276,6 +276,7 @@
 260 rw quick
 262 rw quick migration
 263 rw quick
+264 rw
 265 rw auto quick
 266 rw quick
 267 rw auto quick snapshot
diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
index 3a8f378f90..709def4d5d 100644
--- a/tests/qemu-iotests/iotests.py
+++ b/tests/qemu-iotests/iotests.py
@@ -165,6 +165,13 @@ def qemu_io_silent(*args):
                          (-exitcode, ' '.join(args)))
     return exitcode
 
+def qemu_io_silent_check(*args):
+    '''Run qemu-io and return the true if subprocess returned 0'''
+    args = qemu_io_args + list(args)
+    exitcode = subprocess.call(args, stdout=open('/dev/null', 'w'),
+                               stderr=subprocess.STDOUT)
+    return exitcode == 0
+
 def get_virtio_scsi_device():
     if qemu_default_machine == 's390-ccw-virtio':
         return 'virtio-scsi-ccw'
@@ -230,6 +237,10 @@ def qemu_nbd_early_pipe(*args):
     else:
         return exitcode, subp.communicate()[0]
 
+def qemu_nbd_popen(*args):
+    '''Run qemu-nbd in daemon mode and return the parent's exit code'''
+    return subprocess.Popen(qemu_nbd_args + ['--persistent'] + list(args))
+
 def compare_images(img1, img2, fmt1=imgfmt, fmt2=imgfmt):
     '''Return True if two image files are identical'''
     return qemu_img('compare', '-f', fmt1,
@@ -920,6 +931,16 @@ def skip_if_unsupported(required_formats=[], read_only=False):
         return func_wrapper
     return skip_test_decorator
 
+def skip_if_user_is_root(func):
+    '''Skip Test Decorator
+       Runs the test only without root permissions'''
+    def func_wrapper(*args, **kwargs):
+        if os.getuid() == 0:
+            case_notrun('{}: cannot be run as root'.format(args[0]))
+        else:
+            return func(*args, **kwargs)
+    return func_wrapper
+
 def execute_unittest(output, verbosity, debug):
     runner = unittest.TextTestRunner(stream=output, descriptions=True,
                                      verbosity=verbosity)
diff --git a/tests/rtc-test.c b/tests/rtc-test.c
index 18f895690f..c7af34f6b1 100644
--- a/tests/rtc-test.c
+++ b/tests/rtc-test.c
@@ -15,8 +15,8 @@
 
 #include "libqtest-single.h"
 #include "qemu/timer.h"
-#include "hw/timer/mc146818rtc.h"
-#include "hw/timer/mc146818rtc_regs.h"
+#include "hw/rtc/mc146818rtc.h"
+#include "hw/rtc/mc146818rtc_regs.h"
 
 #define UIP_HOLD_LENGTH           (8 * NANOSECONDS_PER_SECOND / 32768)
 
diff --git a/tests/test-qmp-cmds.c b/tests/test-qmp-cmds.c
index 36fdf5b115..27b0afe55a 100644
--- a/tests/test-qmp-cmds.c
+++ b/tests/test-qmp-cmds.c
@@ -51,6 +51,30 @@ void qmp_test_features(FeatureStruct0 *fs0, FeatureStruct1 *fs1,
 {
 }
 
+void qmp_test_command_features0(Error **errp)
+{
+}
+
+void qmp_test_command_features1(Error **errp)
+{
+}
+
+void qmp_test_command_features3(Error **errp)
+{
+}
+
+void qmp_test_command_cond_features1(Error **errp)
+{
+}
+
+void qmp_test_command_cond_features2(Error **errp)
+{
+}
+
+void qmp_test_command_cond_features3(Error **errp)
+{
+}
+
 UserDefTwo *qmp_user_def_cmd2(UserDefOne *ud1a,
                               bool has_udb1, UserDefOne *ud1b,
                               Error **errp)
diff --git a/util/async.c b/util/async.c
index ca83e32c7f..b1fa5319e5 100644
--- a/util/async.c
+++ b/util/async.c
@@ -429,7 +429,6 @@ AioContext *aio_context_new(Error **errp)
 
     aio_set_event_notifier(ctx, &ctx->notifier,
                            false,
-                           (EventNotifierHandler *)
                            event_notifier_dummy_cb,
                            event_notifier_poll);
 #ifdef CONFIG_LINUX_AIO
diff --git a/util/event_notifier-posix.c b/util/event_notifier-posix.c
index 73c4046b58..00d93204f9 100644
--- a/util/event_notifier-posix.c
+++ b/util/event_notifier-posix.c
@@ -80,8 +80,8 @@ void event_notifier_cleanup(EventNotifier *e)
 {
     if (e->rfd != e->wfd) {
         close(e->rfd);
-        e->rfd = -1;
     }
+    e->rfd = -1;
     close(e->wfd);
     e->wfd = -1;
 }
diff --git a/util/qemu-coroutine-io.c b/util/qemu-coroutine-io.c
index 44a8969a69..5b80bb416f 100644
--- a/util/qemu-coroutine-io.c
+++ b/util/qemu-coroutine-io.c
@@ -67,6 +67,7 @@ qemu_co_send_recv(int sockfd, void *buf, size_t bytes, bool do_send)
 }
 
 typedef struct {
+    AioContext *ctx;
     Coroutine *co;
     int fd;
 } FDYieldUntilData;
@@ -74,7 +75,7 @@ typedef struct {
 static void fd_coroutine_enter(void *opaque)
 {
     FDYieldUntilData *data = opaque;
-    qemu_set_fd_handler(data->fd, NULL, NULL, NULL);
+    aio_set_fd_handler(data->ctx, data->fd, false, NULL, NULL, NULL, NULL);
     qemu_coroutine_enter(data->co);
 }
 
@@ -83,8 +84,10 @@ void coroutine_fn yield_until_fd_readable(int fd)
     FDYieldUntilData data;
 
     assert(qemu_in_coroutine());
+    data.ctx = qemu_get_current_aio_context();
     data.co = qemu_coroutine_self();
     data.fd = fd;
-    qemu_set_fd_handler(fd, fd_coroutine_enter, NULL, &data);
+    aio_set_fd_handler(
+        data.ctx, fd, false, fd_coroutine_enter, NULL, NULL, &data);
     qemu_coroutine_yield();
 }
diff --git a/util/qemu-coroutine-sleep.c b/util/qemu-coroutine-sleep.c
index 4bfdd30cbf..ae91b92b6e 100644
--- a/util/qemu-coroutine-sleep.c
+++ b/util/qemu-coroutine-sleep.c
@@ -17,31 +17,56 @@
 #include "qemu/timer.h"
 #include "block/aio.h"
 
-static void co_sleep_cb(void *opaque)
-{
-    Coroutine *co = opaque;
+static const char *qemu_co_sleep_ns__scheduled = "qemu_co_sleep_ns";
+
+struct QemuCoSleepState {
+    Coroutine *co;
+    QEMUTimer *ts;
+    QemuCoSleepState **user_state_pointer;
+};
 
+void qemu_co_sleep_wake(QemuCoSleepState *sleep_state)
+{
     /* Write of schedule protected by barrier write in aio_co_schedule */
-    atomic_set(&co->scheduled, NULL);
-    aio_co_wake(co);
+    const char *scheduled = atomic_cmpxchg(&sleep_state->co->scheduled,
+                                           qemu_co_sleep_ns__scheduled, NULL);
+
+    assert(scheduled == qemu_co_sleep_ns__scheduled);
+    if (sleep_state->user_state_pointer) {
+        *sleep_state->user_state_pointer = NULL;
+    }
+    timer_del(sleep_state->ts);
+    aio_co_wake(sleep_state->co);
 }
 
-void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns)
+static void co_sleep_cb(void *opaque)
+{
+    qemu_co_sleep_wake(opaque);
+}
+
+void coroutine_fn qemu_co_sleep_ns_wakeable(QEMUClockType type, int64_t ns,
+                                            QemuCoSleepState **sleep_state)
 {
     AioContext *ctx = qemu_get_current_aio_context();
-    QEMUTimer *ts;
-    Coroutine *co = qemu_coroutine_self();
+    QemuCoSleepState state = {
+        .co = qemu_coroutine_self(),
+        .ts = aio_timer_new(ctx, type, SCALE_NS, co_sleep_cb, &state),
+        .user_state_pointer = sleep_state,
+    };
 
-    const char *scheduled = atomic_cmpxchg(&co->scheduled, NULL, __func__);
+    const char *scheduled = atomic_cmpxchg(&state.co->scheduled, NULL,
+                                           qemu_co_sleep_ns__scheduled);
     if (scheduled) {
         fprintf(stderr,
                 "%s: Co-routine was already scheduled in '%s'\n",
                 __func__, scheduled);
         abort();
     }
-    ts = aio_timer_new(ctx, type, SCALE_NS, co_sleep_cb, co);
-    timer_mod(ts, qemu_clock_get_ns(type) + ns);
+
+    if (sleep_state) {
+        *sleep_state = &state;
+    }
+    timer_mod(state.ts, qemu_clock_get_ns(type) + ns);
     qemu_coroutine_yield();
-    timer_del(ts);
-    timer_free(ts);
+    timer_free(state.ts);
 }
diff --git a/util/qemu-timer.c b/util/qemu-timer.c
index d428fec567..ef52d28d37 100644
--- a/util/qemu-timer.c
+++ b/util/qemu-timer.c
@@ -322,11 +322,7 @@ int qemu_timeout_ns_to_ms(int64_t ns)
     ms = DIV_ROUND_UP(ns, SCALE_MS);
 
     /* To avoid overflow problems, limit this to 2^31, i.e. approx 25 days */
-    if (ms > (int64_t) INT32_MAX) {
-        ms = INT32_MAX;
-    }
-
-    return (int) ms;
+    return MIN(ms, INT32_MAX);
 }