Initial import of abandoned HQEMU version 2.5.2HEADmaster

11 files changed, 5413 insertions, 0 deletions

diff --git a/src/target-m68k/Makefile.objs b/src/target-m68k/Makefile.objs
new file mode 100644
index 0000000..02cf616
--- /dev/null
+++ b/src/target-m68k/Makefile.objs
@@ -0,0 +1,3 @@
+obj-y += m68k-semi.o
+obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
diff --git a/src/target-m68k/cpu-qom.h b/src/target-m68k/cpu-qom.h
new file mode 100644
index 0000000..c28e55d
--- /dev/null
+++ b/src/target-m68k/cpu-qom.h
@@ -0,0 +1,84 @@
+/*
+ * QEMU Motorola 68k CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+#ifndef QEMU_M68K_CPU_QOM_H
+#define QEMU_M68K_CPU_QOM_H
+
+#include "qom/cpu.h"
+
+#define TYPE_M68K_CPU "m68k-cpu"
+
+#define M68K_CPU_CLASS(klass) \
+    OBJECT_CLASS_CHECK(M68kCPUClass, (klass), TYPE_M68K_CPU)
+#define M68K_CPU(obj) \
+    OBJECT_CHECK(M68kCPU, (obj), TYPE_M68K_CPU)
+#define M68K_CPU_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(M68kCPUClass, (obj), TYPE_M68K_CPU)
+
+/**
+ * M68kCPUClass:
+ * @parent_realize: The parent class' realize handler.
+ * @parent_reset: The parent class' reset handler.
+ *
+ * A Motorola 68k CPU model.
+ */
+typedef struct M68kCPUClass {
+    /*< private >*/
+    CPUClass parent_class;
+    /*< public >*/
+
+    DeviceRealize parent_realize;
+    void (*parent_reset)(CPUState *cpu);
+} M68kCPUClass;
+
+/**
+ * M68kCPU:
+ * @env: #CPUM68KState
+ *
+ * A Motorola 68k CPU.
+ */
+typedef struct M68kCPU {
+    /*< private >*/
+    CPUState parent_obj;
+    /*< public >*/
+
+    CPUM68KState env;
+} M68kCPU;
+
+static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
+{
+    return container_of(env, M68kCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(m68k_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(M68kCPU, env)
+
+void m68k_cpu_do_interrupt(CPUState *cpu);
+bool m68k_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void m68k_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
+hwaddr m68k_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int m68k_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+
+void m68k_cpu_exec_enter(CPUState *cs);
+void m68k_cpu_exec_exit(CPUState *cs);
+
+#endif
diff --git a/src/target-m68k/cpu.c b/src/target-m68k/cpu.c
new file mode 100644
index 0000000..e8a4eed
--- /dev/null
+++ b/src/target-m68k/cpu.c
@@ -0,0 +1,263 @@
+/*
+ * QEMU Motorola 68k CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+
+#include "cpu.h"
+#include "qemu-common.h"
+#include "migration/vmstate.h"
+
+
+static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
+static bool m68k_cpu_has_work(CPUState *cs)
+{
+    return cs->interrupt_request & CPU_INTERRUPT_HARD;
+}
+
+static void m68k_set_feature(CPUM68KState *env, int feature)
+{
+    env->features |= (1u << feature);
+}
+
+/* CPUClass::reset() */
+static void m68k_cpu_reset(CPUState *s)
+{
+    M68kCPU *cpu = M68K_CPU(s);
+    M68kCPUClass *mcc = M68K_CPU_GET_CLASS(cpu);
+    CPUM68KState *env = &cpu->env;
+
+    mcc->parent_reset(s);
+
+    memset(env, 0, offsetof(CPUM68KState, features));
+#if !defined(CONFIG_USER_ONLY)
+    env->sr = 0x2700;
+#endif
+    m68k_switch_sp(env);
+    /* ??? FP regs should be initialized to NaN.  */
+    env->cc_op = CC_OP_FLAGS;
+    /* TODO: We should set PC from the interrupt vector.  */
+    env->pc = 0;
+    tlb_flush(s, 1);
+}
+
+static void m68k_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
+{
+    info->print_insn = print_insn_m68k;
+}
+
+/* CPU models */
+
+static ObjectClass *m68k_cpu_class_by_name(const char *cpu_model)
+{
+    ObjectClass *oc;
+    char *typename;
+
+    if (cpu_model == NULL) {
+        return NULL;
+    }
+
+    typename = g_strdup_printf("%s-" TYPE_M68K_CPU, cpu_model);
+    oc = object_class_by_name(typename);
+    g_free(typename);
+    if (oc != NULL && (object_class_dynamic_cast(oc, TYPE_M68K_CPU) == NULL ||
+                       object_class_is_abstract(oc))) {
+        return NULL;
+    }
+    return oc;
+}
+
+static void m5206_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+}
+
+static void m5208_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_APLUSC);
+    m68k_set_feature(env, M68K_FEATURE_BRAL);
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
+    m68k_set_feature(env, M68K_FEATURE_USP);
+}
+
+static void cfv4e_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_B);
+    m68k_set_feature(env, M68K_FEATURE_BRAL);
+    m68k_set_feature(env, M68K_FEATURE_CF_FPU);
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
+    m68k_set_feature(env, M68K_FEATURE_USP);
+}
+
+static void any_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_B);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_APLUSC);
+    m68k_set_feature(env, M68K_FEATURE_BRAL);
+    m68k_set_feature(env, M68K_FEATURE_CF_FPU);
+    /* MAC and EMAC are mututally exclusive, so pick EMAC.
+       It's mostly backwards compatible.  */
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC_B);
+    m68k_set_feature(env, M68K_FEATURE_USP);
+    m68k_set_feature(env, M68K_FEATURE_EXT_FULL);
+    m68k_set_feature(env, M68K_FEATURE_WORD_INDEX);
+}
+
+typedef struct M68kCPUInfo {
+    const char *name;
+    void (*instance_init)(Object *obj);
+} M68kCPUInfo;
+
+static const M68kCPUInfo m68k_cpus[] = {
+    { .name = "m5206", .instance_init = m5206_cpu_initfn },
+    { .name = "m5208", .instance_init = m5208_cpu_initfn },
+    { .name = "cfv4e", .instance_init = cfv4e_cpu_initfn },
+    { .name = "any",   .instance_init = any_cpu_initfn },
+};
+
+static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    CPUState *cs = CPU(dev);
+    M68kCPU *cpu = M68K_CPU(dev);
+    M68kCPUClass *mcc = M68K_CPU_GET_CLASS(dev);
+
+    m68k_cpu_init_gdb(cpu);
+
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
+
+    mcc->parent_realize(dev, errp);
+}
+
+static void m68k_cpu_initfn(Object *obj)
+{
+    CPUState *cs = CPU(obj);
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+    static bool inited;
+
+    cs->env_ptr = env;
+    cpu_exec_init(cs, &error_abort);
+
+    if (tcg_enabled() && !inited) {
+        inited = true;
+        m68k_tcg_init();
+    }
+}
+
+static const VMStateDescription vmstate_m68k_cpu = {
+    .name = "cpu",
+    .unmigratable = 1,
+};
+
+static void m68k_cpu_class_init(ObjectClass *c, void *data)
+{
+    M68kCPUClass *mcc = M68K_CPU_CLASS(c);
+    CPUClass *cc = CPU_CLASS(c);
+    DeviceClass *dc = DEVICE_CLASS(c);
+
+    mcc->parent_realize = dc->realize;
+    dc->realize = m68k_cpu_realizefn;
+
+    mcc->parent_reset = cc->reset;
+    cc->reset = m68k_cpu_reset;
+
+    cc->class_by_name = m68k_cpu_class_by_name;
+    cc->has_work = m68k_cpu_has_work;
+    cc->do_interrupt = m68k_cpu_do_interrupt;
+    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
+    cc->dump_state = m68k_cpu_dump_state;
+    cc->set_pc = m68k_cpu_set_pc;
+    cc->gdb_read_register = m68k_cpu_gdb_read_register;
+    cc->gdb_write_register = m68k_cpu_gdb_write_register;
+#ifdef CONFIG_USER_ONLY
+    cc->handle_mmu_fault = m68k_cpu_handle_mmu_fault;
+#else
+    cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
+#endif
+    cc->cpu_exec_enter = m68k_cpu_exec_enter;
+    cc->cpu_exec_exit = m68k_cpu_exec_exit;
+    cc->disas_set_info = m68k_cpu_disas_set_info;
+
+    cc->gdb_num_core_regs = 18;
+    cc->gdb_core_xml_file = "cf-core.xml";
+
+    dc->vmsd = &vmstate_m68k_cpu;
+
+    /*
+     * Reason: m68k_cpu_initfn() calls cpu_exec_init(), which saves
+     * the object in cpus -> dangling pointer after final
+     * object_unref().
+     */
+    dc->cannot_destroy_with_object_finalize_yet = true;
+}
+
+static void register_cpu_type(const M68kCPUInfo *info)
+{
+    TypeInfo type_info = {
+        .parent = TYPE_M68K_CPU,
+        .instance_init = info->instance_init,
+    };
+
+    type_info.name = g_strdup_printf("%s-" TYPE_M68K_CPU, info->name);
+    type_register(&type_info);
+    g_free((void *)type_info.name);
+}
+
+static const TypeInfo m68k_cpu_type_info = {
+    .name = TYPE_M68K_CPU,
+    .parent = TYPE_CPU,
+    .instance_size = sizeof(M68kCPU),
+    .instance_init = m68k_cpu_initfn,
+    .abstract = true,
+    .class_size = sizeof(M68kCPUClass),
+    .class_init = m68k_cpu_class_init,
+};
+
+static void m68k_cpu_register_types(void)
+{
+    int i;
+
+    type_register_static(&m68k_cpu_type_info);
+    for (i = 0; i < ARRAY_SIZE(m68k_cpus); i++) {
+        register_cpu_type(&m68k_cpus[i]);
+    }
+}
+
+type_init(m68k_cpu_register_types)
diff --git a/src/target-m68k/cpu.h b/src/target-m68k/cpu.h
new file mode 100644
index 0000000..224c169
--- /dev/null
+++ b/src/target-m68k/cpu.h
@@ -0,0 +1,245 @@
+/*
+ * m68k virtual CPU header
+ *
+ *  Copyright (c) 2005-2007 CodeSourcery
+ *  Written by Paul Brook
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef CPU_M68K_H
+#define CPU_M68K_H
+
+#define TARGET_LONG_BITS 32
+
+#define CPUArchState struct CPUM68KState
+
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/cpu-defs.h"
+
+#include "fpu/softfloat.h"
+
+#define MAX_QREGS 32
+
+#define EXCP_ACCESS         2   /* Access (MMU) error.  */
+#define EXCP_ADDRESS        3   /* Address error.  */
+#define EXCP_ILLEGAL        4   /* Illegal instruction.  */
+#define EXCP_DIV0           5   /* Divide by zero */
+#define EXCP_PRIVILEGE      8   /* Privilege violation.  */
+#define EXCP_TRACE          9
+#define EXCP_LINEA          10  /* Unimplemented line-A (MAC) opcode.  */
+#define EXCP_LINEF          11  /* Unimplemented line-F (FPU) opcode.  */
+#define EXCP_DEBUGNBP       12  /* Non-breakpoint debug interrupt.  */
+#define EXCP_DEBEGBP        13  /* Breakpoint debug interrupt.  */
+#define EXCP_FORMAT         14  /* RTE format error.  */
+#define EXCP_UNINITIALIZED  15
+#define EXCP_TRAP0          32   /* User trap #0.  */
+#define EXCP_TRAP15         47   /* User trap #15.  */
+#define EXCP_UNSUPPORTED    61
+#define EXCP_ICE            13
+
+#define EXCP_RTE            0x100
+#define EXCP_HALT_INSN      0x101
+
+#define NB_MMU_MODES 2
+
+typedef struct CPUM68KState {
+    uint32_t dregs[8];
+    uint32_t aregs[8];
+    uint32_t pc;
+    uint32_t sr;
+
+    /* SSP and USP.  The current_sp is stored in aregs[7], the other here.  */
+    int current_sp;
+    uint32_t sp[2];
+
+    /* Condition flags.  */
+    uint32_t cc_op;
+    uint32_t cc_dest;
+    uint32_t cc_src;
+    uint32_t cc_x;
+
+    float64 fregs[8];
+    float64 fp_result;
+    uint32_t fpcr;
+    uint32_t fpsr;
+    float_status fp_status;
+
+    uint64_t mactmp;
+    /* EMAC Hardware deals with 48-bit values composed of one 32-bit and
+       two 8-bit parts.  We store a single 64-bit value and
+       rearrange/extend this when changing modes.  */
+    uint64_t macc[4];
+    uint32_t macsr;
+    uint32_t mac_mask;
+
+    /* Temporary storage for DIV helpers.  */
+    uint32_t div1;
+    uint32_t div2;
+
+    /* MMU status.  */
+    struct {
+        uint32_t ar;
+    } mmu;
+
+    /* Control registers.  */
+    uint32_t vbr;
+    uint32_t mbar;
+    uint32_t rambar0;
+    uint32_t cacr;
+
+    int pending_vector;
+    int pending_level;
+
+    uint32_t qregs[MAX_QREGS];
+
+    CPU_COMMON
+
+    /* Fields from here on are preserved across CPU reset. */
+    uint32_t features;
+} CPUM68KState;
+
+#include "cpu-qom.h"
+
+void m68k_tcg_init(void);
+void m68k_cpu_init_gdb(M68kCPU *cpu);
+M68kCPU *cpu_m68k_init(const char *cpu_model);
+int cpu_m68k_exec(CPUState *cpu);
+/* you can call this signal handler from your SIGBUS and SIGSEGV
+   signal handlers to inform the virtual CPU of exceptions. non zero
+   is returned if the signal was handled by the virtual CPU.  */
+int cpu_m68k_signal_handler(int host_signum, void *pinfo,
+                           void *puc);
+void cpu_m68k_flush_flags(CPUM68KState *, int);
+
+enum {
+    CC_OP_DYNAMIC, /* Use env->cc_op  */
+    CC_OP_FLAGS, /* CC_DEST = CVZN, CC_SRC = unused */
+    CC_OP_LOGIC, /* CC_DEST = result, CC_SRC = unused */
+    CC_OP_ADD,   /* CC_DEST = result, CC_SRC = source */
+    CC_OP_SUB,   /* CC_DEST = result, CC_SRC = source */
+    CC_OP_CMPB,  /* CC_DEST = result, CC_SRC = source */
+    CC_OP_CMPW,  /* CC_DEST = result, CC_SRC = source */
+    CC_OP_ADDX,  /* CC_DEST = result, CC_SRC = source */
+    CC_OP_SUBX,  /* CC_DEST = result, CC_SRC = source */
+    CC_OP_SHIFT, /* CC_DEST = result, CC_SRC = carry */
+};
+
+#define CCF_C 0x01
+#define CCF_V 0x02
+#define CCF_Z 0x04
+#define CCF_N 0x08
+#define CCF_X 0x10
+
+#define SR_I_SHIFT 8
+#define SR_I  0x0700
+#define SR_M  0x1000
+#define SR_S  0x2000
+#define SR_T  0x8000
+
+#define M68K_SSP    0
+#define M68K_USP    1
+
+/* CACR fields are implementation defined, but some bits are common.  */
+#define M68K_CACR_EUSP  0x10
+
+#define MACSR_PAV0  0x100
+#define MACSR_OMC   0x080
+#define MACSR_SU    0x040
+#define MACSR_FI    0x020
+#define MACSR_RT    0x010
+#define MACSR_N     0x008
+#define MACSR_Z     0x004
+#define MACSR_V     0x002
+#define MACSR_EV    0x001
+
+void m68k_set_irq_level(M68kCPU *cpu, int level, uint8_t vector);
+void m68k_set_macsr(CPUM68KState *env, uint32_t val);
+void m68k_switch_sp(CPUM68KState *env);
+
+#define M68K_FPCR_PREC (1 << 6)
+
+void do_m68k_semihosting(CPUM68KState *env, int nr);
+
+/* There are 4 ColdFire core ISA revisions: A, A+, B and C.
+   Each feature covers the subset of instructions common to the
+   ISA revisions mentioned.  */
+
+enum m68k_features {
+    M68K_FEATURE_CF_ISA_A,
+    M68K_FEATURE_CF_ISA_B, /* (ISA B or C).  */
+    M68K_FEATURE_CF_ISA_APLUSC, /* BIT/BITREV, FF1, STRLDSR (ISA A+ or C).  */
+    M68K_FEATURE_BRAL, /* Long unconditional branch.  (ISA A+ or B).  */
+    M68K_FEATURE_CF_FPU,
+    M68K_FEATURE_CF_MAC,
+    M68K_FEATURE_CF_EMAC,
+    M68K_FEATURE_CF_EMAC_B, /* Revision B EMAC (dual accumulate).  */
+    M68K_FEATURE_USP, /* User Stack Pointer.  (ISA A+, B or C).  */
+    M68K_FEATURE_EXT_FULL, /* 68020+ full extension word.  */
+    M68K_FEATURE_WORD_INDEX /* word sized address index registers.  */
+};
+
+static inline int m68k_feature(CPUM68KState *env, int feature)
+{
+    return (env->features & (1u << feature)) != 0;
+}
+
+void m68k_cpu_list(FILE *f, fprintf_function cpu_fprintf);
+
+void register_m68k_insns (CPUM68KState *env);
+
+#ifdef CONFIG_USER_ONLY
+/* Linux uses 8k pages.  */
+#define TARGET_PAGE_BITS 13
+#else
+/* Smallest TLB entry size is 1k.  */
+#define TARGET_PAGE_BITS 10
+#endif
+
+#define TARGET_PHYS_ADDR_SPACE_BITS 32
+#define TARGET_VIRT_ADDR_SPACE_BITS 32
+
+#define cpu_init(cpu_model) CPU(cpu_m68k_init(cpu_model))
+
+#define cpu_exec cpu_m68k_exec
+#define cpu_signal_handler cpu_m68k_signal_handler
+#define cpu_list m68k_cpu_list
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+static inline int cpu_mmu_index (CPUM68KState *env, bool ifetch)
+{
+    return (env->sr & SR_S) == 0 ? 1 : 0;
+}
+
+int m68k_cpu_handle_mmu_fault(CPUState *cpu, vaddr address, int rw,
+                              int mmu_idx);
+
+#include "exec/cpu-all.h"
+
+static inline void cpu_get_tb_cpu_state(CPUM68KState *env, target_ulong *pc,
+                                        target_ulong *cs_base, int *flags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *flags = (env->fpcr & M68K_FPCR_PREC)       /* Bit  6 */
+            | (env->sr & SR_S)                  /* Bit  13 */
+            | ((env->macsr >> 4) & 0xf);        /* Bits 0-3 */
+}
+
+#include "exec/exec-all.h"
+
+#endif
diff --git a/src/target-m68k/gdbstub.c b/src/target-m68k/gdbstub.c
new file mode 100644
index 0000000..ae8179c
--- /dev/null
+++ b/src/target-m68k/gdbstub.c
@@ -0,0 +1,75 @@
+/*
+ * m68k gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
+
+int m68k_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
+    if (n < 8) {
+        /* D0-D7 */
+        return gdb_get_reg32(mem_buf, env->dregs[n]);
+    } else if (n < 16) {
+        /* A0-A7 */
+        return gdb_get_reg32(mem_buf, env->aregs[n - 8]);
+    } else {
+        switch (n) {
+        case 16:
+            return gdb_get_reg32(mem_buf, env->sr);
+        case 17:
+            return gdb_get_reg32(mem_buf, env->pc);
+        }
+    }
+    /* FP registers not included here because they vary between
+       ColdFire and m68k.  Use XML bits for these.  */
+    return 0;
+}
+
+int m68k_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+    uint32_t tmp;
+
+    tmp = ldl_p(mem_buf);
+
+    if (n < 8) {
+        /* D0-D7 */
+        env->dregs[n] = tmp;
+    } else if (n < 16) {
+        /* A0-A7 */
+        env->aregs[n - 8] = tmp;
+    } else {
+        switch (n) {
+        case 16:
+            env->sr = tmp;
+            break;
+        case 17:
+            env->pc = tmp;
+            break;
+        default:
+            return 0;
+        }
+    }
+    return 4;
+}
diff --git a/src/target-m68k/helper.c b/src/target-m68k/helper.c
new file mode 100644
index 0000000..77225a2
--- /dev/null
+++ b/src/target-m68k/helper.c
@@ -0,0 +1,886 @@
+/*
+ *  m68k op helpers
+ *
+ *  Copyright (c) 2006-2007 CodeSourcery
+ *  Written by Paul Brook
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cpu.h"
+#include "exec/gdbstub.h"
+
+#include "exec/helper-proto.h"
+
+#define SIGNBIT (1u << 31)
+
+/* Sort alphabetically, except for "any". */
+static gint m68k_cpu_list_compare(gconstpointer a, gconstpointer b)
+{
+    ObjectClass *class_a = (ObjectClass *)a;
+    ObjectClass *class_b = (ObjectClass *)b;
+    const char *name_a, *name_b;
+
+    name_a = object_class_get_name(class_a);
+    name_b = object_class_get_name(class_b);
+    if (strcmp(name_a, "any-" TYPE_M68K_CPU) == 0) {
+        return 1;
+    } else if (strcmp(name_b, "any-" TYPE_M68K_CPU) == 0) {
+        return -1;
+    } else {
+        return strcasecmp(name_a, name_b);
+    }
+}
+
+static void m68k_cpu_list_entry(gpointer data, gpointer user_data)
+{
+    ObjectClass *c = data;
+    CPUListState *s = user_data;
+    const char *typename;
+    char *name;
+
+    typename = object_class_get_name(c);
+    name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_M68K_CPU));
+    (*s->cpu_fprintf)(s->file, "%s\n",
+                      name);
+    g_free(name);
+}
+
+void m68k_cpu_list(FILE *f, fprintf_function cpu_fprintf)
+{
+    CPUListState s = {
+        .file = f,
+        .cpu_fprintf = cpu_fprintf,
+    };
+    GSList *list;
+
+    list = object_class_get_list(TYPE_M68K_CPU, false);
+    list = g_slist_sort(list, m68k_cpu_list_compare);
+    g_slist_foreach(list, m68k_cpu_list_entry, &s);
+    g_slist_free(list);
+}
+
+static int fpu_gdb_get_reg(CPUM68KState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 8) {
+        stfq_p(mem_buf, env->fregs[n]);
+        return 8;
+    }
+    if (n < 11) {
+        /* FP control registers (not implemented)  */
+        memset(mem_buf, 0, 4);
+        return 4;
+    }
+    return 0;
+}
+
+static int fpu_gdb_set_reg(CPUM68KState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 8) {
+        env->fregs[n] = ldfq_p(mem_buf);
+        return 8;
+    }
+    if (n < 11) {
+        /* FP control registers (not implemented)  */
+        return 4;
+    }
+    return 0;
+}
+
+M68kCPU *cpu_m68k_init(const char *cpu_model)
+{
+    M68kCPU *cpu;
+    CPUM68KState *env;
+    ObjectClass *oc;
+
+    oc = cpu_class_by_name(TYPE_M68K_CPU, cpu_model);
+    if (oc == NULL) {
+        return NULL;
+    }
+    cpu = M68K_CPU(object_new(object_class_get_name(oc)));
+    env = &cpu->env;
+
+    register_m68k_insns(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
+    return cpu;
+}
+
+void m68k_cpu_init_gdb(M68kCPU *cpu)
+{
+    CPUState *cs = CPU(cpu);
+    CPUM68KState *env = &cpu->env;
+
+    if (m68k_feature(env, M68K_FEATURE_CF_FPU)) {
+        gdb_register_coprocessor(cs, fpu_gdb_get_reg, fpu_gdb_set_reg,
+                                 11, "cf-fp.xml", 18);
+    }
+    /* TODO: Add [E]MAC registers.  */
+}
+
+void cpu_m68k_flush_flags(CPUM68KState *env, int cc_op)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+    int flags;
+    uint32_t src;
+    uint32_t dest;
+    uint32_t tmp;
+
+#define HIGHBIT 0x80000000u
+
+#define SET_NZ(x) do { \
+    if ((x) == 0) \
+        flags |= CCF_Z; \
+    else if ((int32_t)(x) < 0) \
+        flags |= CCF_N; \
+    } while (0)
+
+#define SET_FLAGS_SUB(type, utype) do { \
+    SET_NZ((type)dest); \
+    tmp = dest + src; \
+    if ((utype) tmp < (utype) src) \
+        flags |= CCF_C; \
+    if ((1u << (sizeof(type) * 8 - 1)) & (tmp ^ dest) & (tmp ^ src)) \
+        flags |= CCF_V; \
+    } while (0)
+
+    flags = 0;
+    src = env->cc_src;
+    dest = env->cc_dest;
+    switch (cc_op) {
+    case CC_OP_FLAGS:
+        flags = dest;
+        break;
+    case CC_OP_LOGIC:
+        SET_NZ(dest);
+        break;
+    case CC_OP_ADD:
+        SET_NZ(dest);
+        if (dest < src)
+            flags |= CCF_C;
+        tmp = dest - src;
+        if (HIGHBIT & (src ^ dest) & ~(tmp ^ src))
+            flags |= CCF_V;
+        break;
+    case CC_OP_SUB:
+        SET_FLAGS_SUB(int32_t, uint32_t);
+        break;
+    case CC_OP_CMPB:
+        SET_FLAGS_SUB(int8_t, uint8_t);
+        break;
+    case CC_OP_CMPW:
+        SET_FLAGS_SUB(int16_t, uint16_t);
+        break;
+    case CC_OP_ADDX:
+        SET_NZ(dest);
+        if (dest <= src)
+            flags |= CCF_C;
+        tmp = dest - src - 1;
+        if (HIGHBIT & (src ^ dest) & ~(tmp ^ src))
+            flags |= CCF_V;
+        break;
+    case CC_OP_SUBX:
+        SET_NZ(dest);
+        tmp = dest + src + 1;
+        if (tmp <= src)
+            flags |= CCF_C;
+        if (HIGHBIT & (tmp ^ dest) & (tmp ^ src))
+            flags |= CCF_V;
+        break;
+    case CC_OP_SHIFT:
+        SET_NZ(dest);
+        if (src)
+            flags |= CCF_C;
+        break;
+    default:
+        cpu_abort(CPU(cpu), "Bad CC_OP %d", cc_op);
+    }
+    env->cc_op = CC_OP_FLAGS;
+    env->cc_dest = flags;
+}
+
+void HELPER(movec)(CPUM68KState *env, uint32_t reg, uint32_t val)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+
+    switch (reg) {
+    case 0x02: /* CACR */
+        env->cacr = val;
+        m68k_switch_sp(env);
+        break;
+    case 0x04: case 0x05: case 0x06: case 0x07: /* ACR[0-3] */
+        /* TODO: Implement Access Control Registers.  */
+        break;
+    case 0x801: /* VBR */
+        env->vbr = val;
+        break;
+    /* TODO: Implement control registers.  */
+    default:
+        cpu_abort(CPU(cpu), "Unimplemented control register write 0x%x = 0x%x\n",
+                  reg, val);
+    }
+}
+
+void HELPER(set_macsr)(CPUM68KState *env, uint32_t val)
+{
+    uint32_t acc;
+    int8_t exthigh;
+    uint8_t extlow;
+    uint64_t regval;
+    int i;
+    if ((env->macsr ^ val) & (MACSR_FI | MACSR_SU)) {
+        for (i = 0; i < 4; i++) {
+            regval = env->macc[i];
+            exthigh = regval >> 40;
+            if (env->macsr & MACSR_FI) {
+                acc = regval >> 8;
+                extlow = regval;
+            } else {
+                acc = regval;
+                extlow = regval >> 32;
+            }
+            if (env->macsr & MACSR_FI) {
+                regval = (((uint64_t)acc) << 8) | extlow;
+                regval |= ((int64_t)exthigh) << 40;
+            } else if (env->macsr & MACSR_SU) {
+                regval = acc | (((int64_t)extlow) << 32);
+                regval |= ((int64_t)exthigh) << 40;
+            } else {
+                regval = acc | (((uint64_t)extlow) << 32);
+                regval |= ((uint64_t)(uint8_t)exthigh) << 40;
+            }
+            env->macc[i] = regval;
+        }
+    }
+    env->macsr = val;
+}
+
+void m68k_switch_sp(CPUM68KState *env)
+{
+    int new_sp;
+
+    env->sp[env->current_sp] = env->aregs[7];
+    new_sp = (env->sr & SR_S && env->cacr & M68K_CACR_EUSP)
+             ? M68K_SSP : M68K_USP;
+    env->aregs[7] = env->sp[new_sp];
+    env->current_sp = new_sp;
+}
+
+#if defined(CONFIG_USER_ONLY)
+
+int m68k_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw,
+                              int mmu_idx)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+
+    cs->exception_index = EXCP_ACCESS;
+    cpu->env.mmu.ar = address;
+    return 1;
+}
+
+#else
+
+/* MMU */
+
+/* TODO: This will need fixing once the MMU is implemented.  */
+hwaddr m68k_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
+{
+    return addr;
+}
+
+int m68k_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw,
+                              int mmu_idx)
+{
+    int prot;
+
+    address &= TARGET_PAGE_MASK;
+    prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+    tlb_set_page(cs, address, address, prot, mmu_idx, TARGET_PAGE_SIZE);
+    return 0;
+}
+
+/* Notify CPU of a pending interrupt.  Prioritization and vectoring should
+   be handled by the interrupt controller.  Real hardware only requests
+   the vector when the interrupt is acknowledged by the CPU.  For
+   simplicitly we calculate it when the interrupt is signalled.  */
+void m68k_set_irq_level(M68kCPU *cpu, int level, uint8_t vector)
+{
+    CPUState *cs = CPU(cpu);
+    CPUM68KState *env = &cpu->env;
+
+    env->pending_level = level;
+    env->pending_vector = vector;
+    if (level) {
+        cpu_interrupt(cs, CPU_INTERRUPT_HARD);
+    } else {
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
+    }
+}
+
+#endif
+
+uint32_t HELPER(bitrev)(uint32_t x)
+{
+    x = ((x >> 1) & 0x55555555u) | ((x << 1) & 0xaaaaaaaau);
+    x = ((x >> 2) & 0x33333333u) | ((x << 2) & 0xccccccccu);
+    x = ((x >> 4) & 0x0f0f0f0fu) | ((x << 4) & 0xf0f0f0f0u);
+    return bswap32(x);
+}
+
+uint32_t HELPER(ff1)(uint32_t x)
+{
+    int n;
+    for (n = 32; x; n--)
+        x >>= 1;
+    return n;
+}
+
+uint32_t HELPER(sats)(uint32_t val, uint32_t ccr)
+{
+    /* The result has the opposite sign to the original value.  */
+    if (ccr & CCF_V)
+        val = (((int32_t)val) >> 31) ^ SIGNBIT;
+    return val;
+}
+
+uint32_t HELPER(subx_cc)(CPUM68KState *env, uint32_t op1, uint32_t op2)
+{
+    uint32_t res;
+    uint32_t old_flags;
+
+    old_flags = env->cc_dest;
+    if (env->cc_x) {
+        env->cc_x = (op1 <= op2);
+        env->cc_op = CC_OP_SUBX;
+        res = op1 - (op2 + 1);
+    } else {
+        env->cc_x = (op1 < op2);
+        env->cc_op = CC_OP_SUB;
+        res = op1 - op2;
+    }
+    env->cc_dest = res;
+    env->cc_src = op2;
+    cpu_m68k_flush_flags(env, env->cc_op);
+    /* !Z is sticky.  */
+    env->cc_dest &= (old_flags | ~CCF_Z);
+    return res;
+}
+
+uint32_t HELPER(addx_cc)(CPUM68KState *env, uint32_t op1, uint32_t op2)
+{
+    uint32_t res;
+    uint32_t old_flags;
+
+    old_flags = env->cc_dest;
+    if (env->cc_x) {
+        res = op1 + op2 + 1;
+        env->cc_x = (res <= op2);
+        env->cc_op = CC_OP_ADDX;
+    } else {
+        res = op1 + op2;
+        env->cc_x = (res < op2);
+        env->cc_op = CC_OP_ADD;
+    }
+    env->cc_dest = res;
+    env->cc_src = op2;
+    cpu_m68k_flush_flags(env, env->cc_op);
+    /* !Z is sticky.  */
+    env->cc_dest &= (old_flags | ~CCF_Z);
+    return res;
+}
+
+uint32_t HELPER(xflag_lt)(uint32_t a, uint32_t b)
+{
+    return a < b;
+}
+
+void HELPER(set_sr)(CPUM68KState *env, uint32_t val)
+{
+    env->sr = val & 0xffff;
+    m68k_switch_sp(env);
+}
+
+uint32_t HELPER(shl_cc)(CPUM68KState *env, uint32_t val, uint32_t shift)
+{
+    uint32_t result;
+    uint32_t cf;
+
+    shift &= 63;
+    if (shift == 0) {
+        result = val;
+        cf = env->cc_src & CCF_C;
+    } else if (shift < 32) {
+        result = val << shift;
+        cf = (val >> (32 - shift)) & 1;
+    } else if (shift == 32) {
+        result = 0;
+        cf = val & 1;
+    } else /* shift > 32 */ {
+        result = 0;
+        cf = 0;
+    }
+    env->cc_src = cf;
+    env->cc_x = (cf != 0);
+    env->cc_dest = result;
+    return result;
+}
+
+uint32_t HELPER(shr_cc)(CPUM68KState *env, uint32_t val, uint32_t shift)
+{
+    uint32_t result;
+    uint32_t cf;
+
+    shift &= 63;
+    if (shift == 0) {
+        result = val;
+        cf = env->cc_src & CCF_C;
+    } else if (shift < 32) {
+        result = val >> shift;
+        cf = (val >> (shift - 1)) & 1;
+    } else if (shift == 32) {
+        result = 0;
+        cf = val >> 31;
+    } else /* shift > 32 */ {
+        result = 0;
+        cf = 0;
+    }
+    env->cc_src = cf;
+    env->cc_x = (cf != 0);
+    env->cc_dest = result;
+    return result;
+}
+
+uint32_t HELPER(sar_cc)(CPUM68KState *env, uint32_t val, uint32_t shift)
+{
+    uint32_t result;
+    uint32_t cf;
+
+    shift &= 63;
+    if (shift == 0) {
+        result = val;
+        cf = (env->cc_src & CCF_C) != 0;
+    } else if (shift < 32) {
+        result = (int32_t)val >> shift;
+        cf = (val >> (shift - 1)) & 1;
+    } else /* shift >= 32 */ {
+        result = (int32_t)val >> 31;
+        cf = val >> 31;
+    }
+    env->cc_src = cf;
+    env->cc_x = cf;
+    env->cc_dest = result;
+    return result;
+}
+
+/* FPU helpers.  */
+uint32_t HELPER(f64_to_i32)(CPUM68KState *env, float64 val)
+{
+    return float64_to_int32(val, &env->fp_status);
+}
+
+float32 HELPER(f64_to_f32)(CPUM68KState *env, float64 val)
+{
+    return float64_to_float32(val, &env->fp_status);
+}
+
+float64 HELPER(i32_to_f64)(CPUM68KState *env, uint32_t val)
+{
+    return int32_to_float64(val, &env->fp_status);
+}
+
+float64 HELPER(f32_to_f64)(CPUM68KState *env, float32 val)
+{
+    return float32_to_float64(val, &env->fp_status);
+}
+
+float64 HELPER(iround_f64)(CPUM68KState *env, float64 val)
+{
+    return float64_round_to_int(val, &env->fp_status);
+}
+
+float64 HELPER(itrunc_f64)(CPUM68KState *env, float64 val)
+{
+    return float64_trunc_to_int(val, &env->fp_status);
+}
+
+float64 HELPER(sqrt_f64)(CPUM68KState *env, float64 val)
+{
+    return float64_sqrt(val, &env->fp_status);
+}
+
+float64 HELPER(abs_f64)(float64 val)
+{
+    return float64_abs(val);
+}
+
+float64 HELPER(chs_f64)(float64 val)
+{
+    return float64_chs(val);
+}
+
+float64 HELPER(add_f64)(CPUM68KState *env, float64 a, float64 b)
+{
+    return float64_add(a, b, &env->fp_status);
+}
+
+float64 HELPER(sub_f64)(CPUM68KState *env, float64 a, float64 b)
+{
+    return float64_sub(a, b, &env->fp_status);
+}
+
+float64 HELPER(mul_f64)(CPUM68KState *env, float64 a, float64 b)
+{
+    return float64_mul(a, b, &env->fp_status);
+}
+
+float64 HELPER(div_f64)(CPUM68KState *env, float64 a, float64 b)
+{
+    return float64_div(a, b, &env->fp_status);
+}
+
+float64 HELPER(sub_cmp_f64)(CPUM68KState *env, float64 a, float64 b)
+{
+    /* ??? This may incorrectly raise exceptions.  */
+    /* ??? Should flush denormals to zero.  */
+    float64 res;
+    res = float64_sub(a, b, &env->fp_status);
+    if (float64_is_quiet_nan(res)) {
+        /* +/-inf compares equal against itself, but sub returns nan.  */
+        if (!float64_is_quiet_nan(a)
+            && !float64_is_quiet_nan(b)) {
+            res = float64_zero;
+            if (float64_lt_quiet(a, res, &env->fp_status))
+                res = float64_chs(res);
+        }
+    }
+    return res;
+}
+
+uint32_t HELPER(compare_f64)(CPUM68KState *env, float64 val)
+{
+    return float64_compare_quiet(val, float64_zero, &env->fp_status);
+}
+
+/* MAC unit.  */
+/* FIXME: The MAC unit implementation is a bit of a mess.  Some helpers
+   take values,  others take register numbers and manipulate the contents
+   in-place.  */
+void HELPER(mac_move)(CPUM68KState *env, uint32_t dest, uint32_t src)
+{
+    uint32_t mask;
+    env->macc[dest] = env->macc[src];
+    mask = MACSR_PAV0 << dest;
+    if (env->macsr & (MACSR_PAV0 << src))
+        env->macsr |= mask;
+    else
+        env->macsr &= ~mask;
+}
+
+uint64_t HELPER(macmuls)(CPUM68KState *env, uint32_t op1, uint32_t op2)
+{
+    int64_t product;
+    int64_t res;
+
+    product = (uint64_t)op1 * op2;
+    res = (product << 24) >> 24;
+    if (res != product) {
+        env->macsr |= MACSR_V;
+        if (env->macsr & MACSR_OMC) {
+            /* Make sure the accumulate operation overflows.  */
+            if (product < 0)
+                res = ~(1ll << 50);
+            else
+                res = 1ll << 50;
+        }
+    }
+    return res;
+}
+
+uint64_t HELPER(macmulu)(CPUM68KState *env, uint32_t op1, uint32_t op2)
+{
+    uint64_t product;
+
+    product = (uint64_t)op1 * op2;
+    if (product & (0xffffffull << 40)) {
+        env->macsr |= MACSR_V;
+        if (env->macsr & MACSR_OMC) {
+            /* Make sure the accumulate operation overflows.  */
+            product = 1ll << 50;
+        } else {
+            product &= ((1ull << 40) - 1);
+        }
+    }
+    return product;
+}
+
+uint64_t HELPER(macmulf)(CPUM68KState *env, uint32_t op1, uint32_t op2)
+{
+    uint64_t product;
+    uint32_t remainder;
+
+    product = (uint64_t)op1 * op2;
+    if (env->macsr & MACSR_RT) {
+        remainder = product & 0xffffff;
+        product >>= 24;
+        if (remainder > 0x800000)
+            product++;
+        else if (remainder == 0x800000)
+            product += (product & 1);
+    } else {
+        product >>= 24;
+    }
+    return product;
+}
+
+void HELPER(macsats)(CPUM68KState *env, uint32_t acc)
+{
+    int64_t tmp;
+    int64_t result;
+    tmp = env->macc[acc];
+    result = ((tmp << 16) >> 16);
+    if (result != tmp) {
+        env->macsr |= MACSR_V;
+    }
+    if (env->macsr & MACSR_V) {
+        env->macsr |= MACSR_PAV0 << acc;
+        if (env->macsr & MACSR_OMC) {
+            /* The result is saturated to 32 bits, despite overflow occurring
+               at 48 bits.  Seems weird, but that's what the hardware docs
+               say.  */
+            result = (result >> 63) ^ 0x7fffffff;
+        }
+    }
+    env->macc[acc] = result;
+}
+
+void HELPER(macsatu)(CPUM68KState *env, uint32_t acc)
+{
+    uint64_t val;
+
+    val = env->macc[acc];
+    if (val & (0xffffull << 48)) {
+        env->macsr |= MACSR_V;
+    }
+    if (env->macsr & MACSR_V) {
+        env->macsr |= MACSR_PAV0 << acc;
+        if (env->macsr & MACSR_OMC) {
+            if (val > (1ull << 53))
+                val = 0;
+            else
+                val = (1ull << 48) - 1;
+        } else {
+            val &= ((1ull << 48) - 1);
+        }
+    }
+    env->macc[acc] = val;
+}
+
+void HELPER(macsatf)(CPUM68KState *env, uint32_t acc)
+{
+    int64_t sum;
+    int64_t result;
+
+    sum = env->macc[acc];
+    result = (sum << 16) >> 16;
+    if (result != sum) {
+        env->macsr |= MACSR_V;
+    }
+    if (env->macsr & MACSR_V) {
+        env->macsr |= MACSR_PAV0 << acc;
+        if (env->macsr & MACSR_OMC) {
+            result = (result >> 63) ^ 0x7fffffffffffll;
+        }
+    }
+    env->macc[acc] = result;
+}
+
+void HELPER(mac_set_flags)(CPUM68KState *env, uint32_t acc)
+{
+    uint64_t val;
+    val = env->macc[acc];
+    if (val == 0) {
+        env->macsr |= MACSR_Z;
+    } else if (val & (1ull << 47)) {
+        env->macsr |= MACSR_N;
+    }
+    if (env->macsr & (MACSR_PAV0 << acc)) {
+        env->macsr |= MACSR_V;
+    }
+    if (env->macsr & MACSR_FI) {
+        val = ((int64_t)val) >> 40;
+        if (val != 0 && val != -1)
+            env->macsr |= MACSR_EV;
+    } else if (env->macsr & MACSR_SU) {
+        val = ((int64_t)val) >> 32;
+        if (val != 0 && val != -1)
+            env->macsr |= MACSR_EV;
+    } else {
+        if ((val >> 32) != 0)
+            env->macsr |= MACSR_EV;
+    }
+}
+
+void HELPER(flush_flags)(CPUM68KState *env, uint32_t cc_op)
+{
+    cpu_m68k_flush_flags(env, cc_op);
+}
+
+uint32_t HELPER(get_macf)(CPUM68KState *env, uint64_t val)
+{
+    int rem;
+    uint32_t result;
+
+    if (env->macsr & MACSR_SU) {
+        /* 16-bit rounding.  */
+        rem = val & 0xffffff;
+        val = (val >> 24) & 0xffffu;
+        if (rem > 0x800000)
+            val++;
+        else if (rem == 0x800000)
+            val += (val & 1);
+    } else if (env->macsr & MACSR_RT) {
+        /* 32-bit rounding.  */
+        rem = val & 0xff;
+        val >>= 8;
+        if (rem > 0x80)
+            val++;
+        else if (rem == 0x80)
+            val += (val & 1);
+    } else {
+        /* No rounding.  */
+        val >>= 8;
+    }
+    if (env->macsr & MACSR_OMC) {
+        /* Saturate.  */
+        if (env->macsr & MACSR_SU) {
+            if (val != (uint16_t) val) {
+                result = ((val >> 63) ^ 0x7fff) & 0xffff;
+            } else {
+                result = val & 0xffff;
+            }
+        } else {
+            if (val != (uint32_t)val) {
+                result = ((uint32_t)(val >> 63) & 0x7fffffff);
+            } else {
+                result = (uint32_t)val;
+            }
+        }
+    } else {
+        /* No saturation.  */
+        if (env->macsr & MACSR_SU) {
+            result = val & 0xffff;
+        } else {
+            result = (uint32_t)val;
+        }
+    }
+    return result;
+}
+
+uint32_t HELPER(get_macs)(uint64_t val)
+{
+    if (val == (int32_t)val) {
+        return (int32_t)val;
+    } else {
+        return (val >> 61) ^ ~SIGNBIT;
+    }
+}
+
+uint32_t HELPER(get_macu)(uint64_t val)
+{
+    if ((val >> 32) == 0) {
+        return (uint32_t)val;
+    } else {
+        return 0xffffffffu;
+    }
+}
+
+uint32_t HELPER(get_mac_extf)(CPUM68KState *env, uint32_t acc)
+{
+    uint32_t val;
+    val = env->macc[acc] & 0x00ff;
+    val = (env->macc[acc] >> 32) & 0xff00;
+    val |= (env->macc[acc + 1] << 16) & 0x00ff0000;
+    val |= (env->macc[acc + 1] >> 16) & 0xff000000;
+    return val;
+}
+
+uint32_t HELPER(get_mac_exti)(CPUM68KState *env, uint32_t acc)
+{
+    uint32_t val;
+    val = (env->macc[acc] >> 32) & 0xffff;
+    val |= (env->macc[acc + 1] >> 16) & 0xffff0000;
+    return val;
+}
+
+void HELPER(set_mac_extf)(CPUM68KState *env, uint32_t val, uint32_t acc)
+{
+    int64_t res;
+    int32_t tmp;
+    res = env->macc[acc] & 0xffffffff00ull;
+    tmp = (int16_t)(val & 0xff00);
+    res |= ((int64_t)tmp) << 32;
+    res |= val & 0xff;
+    env->macc[acc] = res;
+    res = env->macc[acc + 1] & 0xffffffff00ull;
+    tmp = (val & 0xff000000);
+    res |= ((int64_t)tmp) << 16;
+    res |= (val >> 16) & 0xff;
+    env->macc[acc + 1] = res;
+}
+
+void HELPER(set_mac_exts)(CPUM68KState *env, uint32_t val, uint32_t acc)
+{
+    int64_t res;
+    int32_t tmp;
+    res = (uint32_t)env->macc[acc];
+    tmp = (int16_t)val;
+    res |= ((int64_t)tmp) << 32;
+    env->macc[acc] = res;
+    res = (uint32_t)env->macc[acc + 1];
+    tmp = val & 0xffff0000;
+    res |= (int64_t)tmp << 16;
+    env->macc[acc + 1] = res;
+}
+
+void HELPER(set_mac_extu)(CPUM68KState *env, uint32_t val, uint32_t acc)
+{
+    uint64_t res;
+    res = (uint32_t)env->macc[acc];
+    res |= ((uint64_t)(val & 0xffff)) << 32;
+    env->macc[acc] = res;
+    res = (uint32_t)env->macc[acc + 1];
+    res |= (uint64_t)(val & 0xffff0000) << 16;
+    env->macc[acc + 1] = res;
+}
+
+void m68k_cpu_exec_enter(CPUState *cs)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
+    env->cc_op = CC_OP_FLAGS;
+    env->cc_dest = env->sr & 0xf;
+    env->cc_x = (env->sr >> 4) & 1;
+}
+
+void m68k_cpu_exec_exit(CPUState *cs)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
+    cpu_m68k_flush_flags(env, env->cc_op);
+    env->cc_op = CC_OP_FLAGS;
+    env->sr = (env->sr & 0xffe0) | env->cc_dest | (env->cc_x << 4);
+}
diff --git a/src/target-m68k/helper.h b/src/target-m68k/helper.h
new file mode 100644
index 0000000..f4e5fdf
--- /dev/null
+++ b/src/target-m68k/helper.h
@@ -0,0 +1,50 @@
+DEF_HELPER_1(bitrev, i32, i32)
+DEF_HELPER_1(ff1, i32, i32)
+DEF_HELPER_2(sats, i32, i32, i32)
+DEF_HELPER_2(divu, void, env, i32)
+DEF_HELPER_2(divs, void, env, i32)
+DEF_HELPER_3(addx_cc, i32, env, i32, i32)
+DEF_HELPER_3(subx_cc, i32, env, i32, i32)
+DEF_HELPER_3(shl_cc, i32, env, i32, i32)
+DEF_HELPER_3(shr_cc, i32, env, i32, i32)
+DEF_HELPER_3(sar_cc, i32, env, i32, i32)
+DEF_HELPER_2(xflag_lt, i32, i32, i32)
+DEF_HELPER_2(set_sr, void, env, i32)
+DEF_HELPER_3(movec, void, env, i32, i32)
+
+DEF_HELPER_2(f64_to_i32, f32, env, f64)
+DEF_HELPER_2(f64_to_f32, f32, env, f64)
+DEF_HELPER_2(i32_to_f64, f64, env, i32)
+DEF_HELPER_2(f32_to_f64, f64, env, f32)
+DEF_HELPER_2(iround_f64, f64, env, f64)
+DEF_HELPER_2(itrunc_f64, f64, env, f64)
+DEF_HELPER_2(sqrt_f64, f64, env, f64)
+DEF_HELPER_1(abs_f64, f64, f64)
+DEF_HELPER_1(chs_f64, f64, f64)
+DEF_HELPER_3(add_f64, f64, env, f64, f64)
+DEF_HELPER_3(sub_f64, f64, env, f64, f64)
+DEF_HELPER_3(mul_f64, f64, env, f64, f64)
+DEF_HELPER_3(div_f64, f64, env, f64, f64)
+DEF_HELPER_3(sub_cmp_f64, f64, env, f64, f64)
+DEF_HELPER_2(compare_f64, i32, env, f64)
+
+DEF_HELPER_3(mac_move, void, env, i32, i32)
+DEF_HELPER_3(macmulf, i64, env, i32, i32)
+DEF_HELPER_3(macmuls, i64, env, i32, i32)
+DEF_HELPER_3(macmulu, i64, env, i32, i32)
+DEF_HELPER_2(macsats, void, env, i32)
+DEF_HELPER_2(macsatu, void, env, i32)
+DEF_HELPER_2(macsatf, void, env, i32)
+DEF_HELPER_2(mac_set_flags, void, env, i32)
+DEF_HELPER_2(set_macsr, void, env, i32)
+DEF_HELPER_2(get_macf, i32, env, i64)
+DEF_HELPER_1(get_macs, i32, i64)
+DEF_HELPER_1(get_macu, i32, i64)
+DEF_HELPER_2(get_mac_extf, i32, env, i32)
+DEF_HELPER_2(get_mac_exti, i32, env, i32)
+DEF_HELPER_3(set_mac_extf, void, env, i32, i32)
+DEF_HELPER_3(set_mac_exts, void, env, i32, i32)
+DEF_HELPER_3(set_mac_extu, void, env, i32, i32)
+
+DEF_HELPER_2(flush_flags, void, env, i32)
+DEF_HELPER_2(raise_exception, void, env, i32)
diff --git a/src/target-m68k/m68k-semi.c b/src/target-m68k/m68k-semi.c
new file mode 100644
index 0000000..9dffe8d
--- /dev/null
+++ b/src/target-m68k/m68k-semi.c
@@ -0,0 +1,469 @@
+/*
+ *  m68k/ColdFire Semihosting syscall interface
+ *
+ *  Copyright (c) 2005-2007 CodeSourcery.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/time.h>
+#include <time.h>
+
+#include "cpu.h"
+#if defined(CONFIG_USER_ONLY)
+#include "qemu.h"
+#define SEMIHOSTING_HEAP_SIZE (128 * 1024 * 1024)
+#else
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
+#include "exec/softmmu-semi.h"
+#endif
+#include "sysemu/sysemu.h"
+
+#define HOSTED_EXIT  0
+#define HOSTED_INIT_SIM 1
+#define HOSTED_OPEN 2
+#define HOSTED_CLOSE 3
+#define HOSTED_READ 4
+#define HOSTED_WRITE 5
+#define HOSTED_LSEEK 6
+#define HOSTED_RENAME 7
+#define HOSTED_UNLINK 8
+#define HOSTED_STAT 9
+#define HOSTED_FSTAT 10
+#define HOSTED_GETTIMEOFDAY 11
+#define HOSTED_ISATTY 12
+#define HOSTED_SYSTEM 13
+
+typedef uint32_t gdb_mode_t;
+typedef uint32_t gdb_time_t;
+
+struct m68k_gdb_stat {
+  uint32_t    gdb_st_dev;     /* device */
+  uint32_t    gdb_st_ino;     /* inode */
+  gdb_mode_t  gdb_st_mode;    /* protection */
+  uint32_t    gdb_st_nlink;   /* number of hard links */
+  uint32_t    gdb_st_uid;     /* user ID of owner */
+  uint32_t    gdb_st_gid;     /* group ID of owner */
+  uint32_t    gdb_st_rdev;    /* device type (if inode device) */
+  uint64_t    gdb_st_size;    /* total size, in bytes */
+  uint64_t    gdb_st_blksize; /* blocksize for filesystem I/O */
+  uint64_t    gdb_st_blocks;  /* number of blocks allocated */
+  gdb_time_t  gdb_st_atime;   /* time of last access */
+  gdb_time_t  gdb_st_mtime;   /* time of last modification */
+  gdb_time_t  gdb_st_ctime;   /* time of last change */
+} QEMU_PACKED;
+
+struct gdb_timeval {
+  gdb_time_t tv_sec;  /* second */
+  uint64_t tv_usec;   /* microsecond */
+} QEMU_PACKED;
+
+#define GDB_O_RDONLY   0x0
+#define GDB_O_WRONLY   0x1
+#define GDB_O_RDWR     0x2
+#define GDB_O_APPEND   0x8
+#define GDB_O_CREAT  0x200
+#define GDB_O_TRUNC  0x400
+#define GDB_O_EXCL   0x800
+
+static int translate_openflags(int flags)
+{
+    int hf;
+
+    if (flags & GDB_O_WRONLY)
+        hf = O_WRONLY;
+    else if (flags & GDB_O_RDWR)
+        hf = O_RDWR;
+    else
+        hf = O_RDONLY;
+
+    if (flags & GDB_O_APPEND) hf |= O_APPEND;
+    if (flags & GDB_O_CREAT) hf |= O_CREAT;
+    if (flags & GDB_O_TRUNC) hf |= O_TRUNC;
+    if (flags & GDB_O_EXCL) hf |= O_EXCL;
+
+    return hf;
+}
+
+static void translate_stat(CPUM68KState *env, target_ulong addr, struct stat *s)
+{
+    struct m68k_gdb_stat *p;
+
+    if (!(p = lock_user(VERIFY_WRITE, addr, sizeof(struct m68k_gdb_stat), 0)))
+        /* FIXME - should this return an error code? */
+        return;
+    p->gdb_st_dev = cpu_to_be32(s->st_dev);
+    p->gdb_st_ino = cpu_to_be32(s->st_ino);
+    p->gdb_st_mode = cpu_to_be32(s->st_mode);
+    p->gdb_st_nlink = cpu_to_be32(s->st_nlink);
+    p->gdb_st_uid = cpu_to_be32(s->st_uid);
+    p->gdb_st_gid = cpu_to_be32(s->st_gid);
+    p->gdb_st_rdev = cpu_to_be32(s->st_rdev);
+    p->gdb_st_size = cpu_to_be64(s->st_size);
+#ifdef _WIN32
+    /* Windows stat is missing some fields.  */
+    p->gdb_st_blksize = 0;
+    p->gdb_st_blocks = 0;
+#else
+    p->gdb_st_blksize = cpu_to_be64(s->st_blksize);
+    p->gdb_st_blocks = cpu_to_be64(s->st_blocks);
+#endif
+    p->gdb_st_atime = cpu_to_be32(s->st_atime);
+    p->gdb_st_mtime = cpu_to_be32(s->st_mtime);
+    p->gdb_st_ctime = cpu_to_be32(s->st_ctime);
+    unlock_user(p, addr, sizeof(struct m68k_gdb_stat));
+}
+
+static void m68k_semi_return_u32(CPUM68KState *env, uint32_t ret, uint32_t err)
+{
+    target_ulong args = env->dregs[1];
+    if (put_user_u32(ret, args) ||
+        put_user_u32(err, args + 4)) {
+        /* The m68k semihosting ABI does not provide any way to report this
+         * error to the guest, so the best we can do is log it in qemu.
+         * It is always a guest error not to pass us a valid argument block.
+         */
+        qemu_log_mask(LOG_GUEST_ERROR, "m68k-semihosting: return value "
+                      "discarded because argument block not writable\n");
+    }
+}
+
+static void m68k_semi_return_u64(CPUM68KState *env, uint64_t ret, uint32_t err)
+{
+    target_ulong args = env->dregs[1];
+    if (put_user_u32(ret >> 32, args) ||
+        put_user_u32(ret, args + 4) ||
+        put_user_u32(err, args + 8)) {
+        /* No way to report this via m68k semihosting ABI; just log it */
+        qemu_log_mask(LOG_GUEST_ERROR, "m68k-semihosting: return value "
+                      "discarded because argument block not writable\n");
+    }
+}
+
+static int m68k_semi_is_fseek;
+
+static void m68k_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
+    if (m68k_semi_is_fseek) {
+        /* FIXME: We've already lost the high bits of the fseek
+           return value.  */
+        m68k_semi_return_u64(env, ret, err);
+        m68k_semi_is_fseek = 0;
+    } else {
+        m68k_semi_return_u32(env, ret, err);
+    }
+}
+
+/* Read the input value from the argument block; fail the semihosting
+ * call if the memory read fails.
+ */
+#define GET_ARG(n) do {                                 \
+    if (get_user_ual(arg ## n, args + (n) * 4)) {       \
+        result = -1;                                    \
+        errno = EFAULT;                                 \
+        goto failed;                                    \
+    }                                                   \
+} while (0)
+
+void do_m68k_semihosting(CPUM68KState *env, int nr)
+{
+    uint32_t args;
+    target_ulong arg0, arg1, arg2, arg3;
+    void *p;
+    void *q;
+    uint32_t len;
+    uint32_t result;
+
+    args = env->dregs[1];
+    switch (nr) {
+    case HOSTED_EXIT:
+        gdb_exit(env, env->dregs[0]);
+        exit(env->dregs[0]);
+    case HOSTED_OPEN:
+        GET_ARG(0);
+        GET_ARG(1);
+        GET_ARG(2);
+        GET_ARG(3);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "open,%s,%x,%x", arg0, (int)arg1,
+                           arg2, arg3);
+            return;
+        } else {
+            p = lock_user_string(arg0);
+            if (!p) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = open(p, translate_openflags(arg2), arg3);
+                unlock_user(p, arg0, 0);
+            }
+        }
+        break;
+    case HOSTED_CLOSE:
+        {
+            /* Ignore attempts to close stdin/out/err.  */
+            GET_ARG(0);
+            int fd = arg0;
+            if (fd > 2) {
+                if (use_gdb_syscalls()) {
+                    gdb_do_syscall(m68k_semi_cb, "close,%x", arg0);
+                    return;
+                } else {
+                    result = close(fd);
+                }
+            } else {
+                result = 0;
+            }
+            break;
+        }
+    case HOSTED_READ:
+        GET_ARG(0);
+        GET_ARG(1);
+        GET_ARG(2);
+        len = arg2;
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "read,%x,%x,%x",
+                           arg0, arg1, len);
+            return;
+        } else {
+            p = lock_user(VERIFY_WRITE, arg1, len, 0);
+            if (!p) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = read(arg0, p, len);
+                unlock_user(p, arg1, len);
+            }
+        }
+        break;
+    case HOSTED_WRITE:
+        GET_ARG(0);
+        GET_ARG(1);
+        GET_ARG(2);
+        len = arg2;
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "write,%x,%x,%x",
+                           arg0, arg1, len);
+            return;
+        } else {
+            p = lock_user(VERIFY_READ, arg1, len, 1);
+            if (!p) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = write(arg0, p, len);
+                unlock_user(p, arg0, 0);
+            }
+        }
+        break;
+    case HOSTED_LSEEK:
+        {
+            uint64_t off;
+            GET_ARG(0);
+            GET_ARG(1);
+            GET_ARG(2);
+            GET_ARG(3);
+            off = (uint32_t)arg2 | ((uint64_t)arg1 << 32);
+            if (use_gdb_syscalls()) {
+                m68k_semi_is_fseek = 1;
+                gdb_do_syscall(m68k_semi_cb, "fseek,%x,%lx,%x",
+                               arg0, off, arg3);
+            } else {
+                off = lseek(arg0, off, arg3);
+                m68k_semi_return_u64(env, off, errno);
+            }
+            return;
+        }
+    case HOSTED_RENAME:
+        GET_ARG(0);
+        GET_ARG(1);
+        GET_ARG(2);
+        GET_ARG(3);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "rename,%s,%s",
+                           arg0, (int)arg1, arg2, (int)arg3);
+            return;
+        } else {
+            p = lock_user_string(arg0);
+            q = lock_user_string(arg2);
+            if (!p || !q) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = rename(p, q);
+            }
+            unlock_user(p, arg0, 0);
+            unlock_user(q, arg2, 0);
+        }
+        break;
+    case HOSTED_UNLINK:
+        GET_ARG(0);
+        GET_ARG(1);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "unlink,%s",
+                           arg0, (int)arg1);
+            return;
+        } else {
+            p = lock_user_string(arg0);
+            if (!p) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = unlink(p);
+                unlock_user(p, arg0, 0);
+            }
+        }
+        break;
+    case HOSTED_STAT:
+        GET_ARG(0);
+        GET_ARG(1);
+        GET_ARG(2);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "stat,%s,%x",
+                           arg0, (int)arg1, arg2);
+            return;
+        } else {
+            struct stat s;
+            p = lock_user_string(arg0);
+            if (!p) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = stat(p, &s);
+                unlock_user(p, arg0, 0);
+            }
+            if (result == 0) {
+                translate_stat(env, arg2, &s);
+            }
+        }
+        break;
+    case HOSTED_FSTAT:
+        GET_ARG(0);
+        GET_ARG(1);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "fstat,%x,%x",
+                           arg0, arg1);
+            return;
+        } else {
+            struct stat s;
+            result = fstat(arg0, &s);
+            if (result == 0) {
+                translate_stat(env, arg1, &s);
+            }
+        }
+        break;
+    case HOSTED_GETTIMEOFDAY:
+        GET_ARG(0);
+        GET_ARG(1);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "gettimeofday,%x,%x",
+                           arg0, arg1);
+            return;
+        } else {
+            qemu_timeval tv;
+            struct gdb_timeval *p;
+            result = qemu_gettimeofday(&tv);
+            if (result != 0) {
+                if (!(p = lock_user(VERIFY_WRITE,
+                                    arg0, sizeof(struct gdb_timeval), 0))) {
+                    /* FIXME - check error code? */
+                    result = -1;
+                } else {
+                    p->tv_sec = cpu_to_be32(tv.tv_sec);
+                    p->tv_usec = cpu_to_be64(tv.tv_usec);
+                    unlock_user(p, arg0, sizeof(struct gdb_timeval));
+                }
+            }
+        }
+        break;
+    case HOSTED_ISATTY:
+        GET_ARG(0);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "isatty,%x", arg0);
+            return;
+        } else {
+            result = isatty(arg0);
+        }
+        break;
+    case HOSTED_SYSTEM:
+        GET_ARG(0);
+        GET_ARG(1);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(m68k_semi_cb, "system,%s",
+                           arg0, (int)arg1);
+            return;
+        } else {
+            p = lock_user_string(arg0);
+            if (!p) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = system(p);
+                unlock_user(p, arg0, 0);
+            }
+        }
+        break;
+    case HOSTED_INIT_SIM:
+#if defined(CONFIG_USER_ONLY)
+        {
+        CPUState *cs = CPU(m68k_env_get_cpu(env));
+        TaskState *ts = cs->opaque;
+        /* Allocate the heap using sbrk.  */
+        if (!ts->heap_limit) {
+            abi_ulong ret;
+            uint32_t size;
+            uint32_t base;
+
+            base = do_brk(0);
+            size = SEMIHOSTING_HEAP_SIZE;
+            /* Try a big heap, and reduce the size if that fails.  */
+            for (;;) {
+                ret = do_brk(base + size);
+                if (ret >= (base + size)) {
+                    break;
+                }
+                size >>= 1;
+            }
+            ts->heap_limit = base + size;
+        }
+        /* This call may happen before we have writable memory, so return
+           values directly in registers.  */
+        env->dregs[1] = ts->heap_limit;
+        env->aregs[7] = ts->stack_base;
+        }
+#else
+        /* FIXME: This is wrong for boards where RAM does not start at
+           address zero.  */
+        env->dregs[1] = ram_size;
+        env->aregs[7] = ram_size;
+#endif
+        return;
+    default:
+        cpu_abort(CPU(m68k_env_get_cpu(env)), "Unsupported semihosting syscall %d\n", nr);
+        result = 0;
+    }
+failed:
+    m68k_semi_return_u32(env, result, errno);
+}
diff --git a/src/target-m68k/op_helper.c b/src/target-m68k/op_helper.c
new file mode 100644
index 0000000..1af0ca6
--- /dev/null
+++ b/src/target-m68k/op_helper.c
@@ -0,0 +1,232 @@
+/*
+ *  M68K helper routines
+ *
+ *  Copyright (c) 2007 CodeSourcery
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#include "cpu.h"
+#include "exec/helper-proto.h"
+#include "exec/cpu_ldst.h"
+#include "exec/semihost.h"
+
+#if defined(CONFIG_USER_ONLY)
+
+void m68k_cpu_do_interrupt(CPUState *cs)
+{
+    cs->exception_index = -1;
+}
+
+static inline void do_interrupt_m68k_hardirq(CPUM68KState *env)
+{
+}
+
+#else
+
+/* Try to fill the TLB and return an exception if error. If retaddr is
+   NULL, it means that the function was called in C code (i.e. not
+   from generated code or from helper.c) */
+void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
+              uintptr_t retaddr)
+{
+    int ret;
+
+    ret = m68k_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
+    if (unlikely(ret)) {
+        if (retaddr) {
+            /* now we have a real cpu fault */
+            cpu_restore_state(cs, retaddr);
+        }
+        cpu_loop_exit(cs);
+    }
+}
+
+static void do_rte(CPUM68KState *env)
+{
+    uint32_t sp;
+    uint32_t fmt;
+
+    sp = env->aregs[7];
+    fmt = cpu_ldl_kernel(env, sp);
+    env->pc = cpu_ldl_kernel(env, sp + 4);
+    sp |= (fmt >> 28) & 3;
+    env->sr = fmt & 0xffff;
+    env->aregs[7] = sp + 8;
+    m68k_switch_sp(env);
+}
+
+static void do_interrupt_all(CPUM68KState *env, int is_hw)
+{
+    CPUState *cs = CPU(m68k_env_get_cpu(env));
+    uint32_t sp;
+    uint32_t fmt;
+    uint32_t retaddr;
+    uint32_t vector;
+
+    fmt = 0;
+    retaddr = env->pc;
+
+    if (!is_hw) {
+        switch (cs->exception_index) {
+        case EXCP_RTE:
+            /* Return from an exception.  */
+            do_rte(env);
+            return;
+        case EXCP_HALT_INSN:
+            if (semihosting_enabled()
+                    && (env->sr & SR_S) != 0
+                    && (env->pc & 3) == 0
+                    && cpu_lduw_code(env, env->pc - 4) == 0x4e71
+                    && cpu_ldl_code(env, env->pc) == 0x4e7bf000) {
+                env->pc += 4;
+                do_m68k_semihosting(env, env->dregs[0]);
+                return;
+            }
+            cs->halted = 1;
+            cs->exception_index = EXCP_HLT;
+            cpu_loop_exit(cs);
+            return;
+        }
+        if (cs->exception_index >= EXCP_TRAP0
+            && cs->exception_index <= EXCP_TRAP15) {
+            /* Move the PC after the trap instruction.  */
+            retaddr += 2;
+        }
+    }
+
+    vector = cs->exception_index << 2;
+
+    fmt |= 0x40000000;
+    fmt |= vector << 16;
+    fmt |= env->sr;
+
+    env->sr |= SR_S;
+    if (is_hw) {
+        env->sr = (env->sr & ~SR_I) | (env->pending_level << SR_I_SHIFT);
+        env->sr &= ~SR_M;
+    }
+    m68k_switch_sp(env);
+    sp = env->aregs[7];
+    fmt |= (sp & 3) << 28;
+
+    /* ??? This could cause MMU faults.  */
+    sp &= ~3;
+    sp -= 4;
+    cpu_stl_kernel(env, sp, retaddr);
+    sp -= 4;
+    cpu_stl_kernel(env, sp, fmt);
+    env->aregs[7] = sp;
+    /* Jump to vector.  */
+    env->pc = cpu_ldl_kernel(env, env->vbr + vector);
+}
+
+void m68k_cpu_do_interrupt(CPUState *cs)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
+    do_interrupt_all(env, 0);
+}
+
+static inline void do_interrupt_m68k_hardirq(CPUM68KState *env)
+{
+    do_interrupt_all(env, 1);
+}
+#endif
+
+bool m68k_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && ((env->sr & SR_I) >> SR_I_SHIFT) < env->pending_level) {
+        /* Real hardware gets the interrupt vector via an IACK cycle
+           at this point.  Current emulated hardware doesn't rely on
+           this, so we provide/save the vector when the interrupt is
+           first signalled.  */
+        cs->exception_index = env->pending_vector;
+        do_interrupt_m68k_hardirq(env);
+        return true;
+    }
+    return false;
+}
+
+static void raise_exception(CPUM68KState *env, int tt)
+{
+    CPUState *cs = CPU(m68k_env_get_cpu(env));
+
+    cs->exception_index = tt;
+    cpu_loop_exit(cs);
+}
+
+void HELPER(raise_exception)(CPUM68KState *env, uint32_t tt)
+{
+    raise_exception(env, tt);
+}
+
+void HELPER(divu)(CPUM68KState *env, uint32_t word)
+{
+    uint32_t num;
+    uint32_t den;
+    uint32_t quot;
+    uint32_t rem;
+    uint32_t flags;
+
+    num = env->div1;
+    den = env->div2;
+    /* ??? This needs to make sure the throwing location is accurate.  */
+    if (den == 0) {
+        raise_exception(env, EXCP_DIV0);
+    }
+    quot = num / den;
+    rem = num % den;
+    flags = 0;
+    if (word && quot > 0xffff)
+        flags |= CCF_V;
+    if (quot == 0)
+        flags |= CCF_Z;
+    else if ((int32_t)quot < 0)
+        flags |= CCF_N;
+    env->div1 = quot;
+    env->div2 = rem;
+    env->cc_dest = flags;
+}
+
+void HELPER(divs)(CPUM68KState *env, uint32_t word)
+{
+    int32_t num;
+    int32_t den;
+    int32_t quot;
+    int32_t rem;
+    int32_t flags;
+
+    num = env->div1;
+    den = env->div2;
+    if (den == 0) {
+        raise_exception(env, EXCP_DIV0);
+    }
+    quot = num / den;
+    rem = num % den;
+    flags = 0;
+    if (word && quot != (int16_t)quot)
+        flags |= CCF_V;
+    if (quot == 0)
+        flags |= CCF_Z;
+    else if (quot < 0)
+        flags |= CCF_N;
+    env->div1 = quot;
+    env->div2 = rem;
+    env->cc_dest = flags;
+}
diff --git a/src/target-m68k/qregs.def b/src/target-m68k/qregs.def
new file mode 100644
index 0000000..204663e
--- /dev/null
+++ b/src/target-m68k/qregs.def
@@ -0,0 +1,11 @@
+DEFF64(FP_RESULT, fp_result)
+DEFO32(PC, pc)
+DEFO32(SR, sr)
+DEFO32(CC_OP, cc_op)
+DEFO32(CC_DEST, cc_dest)
+DEFO32(CC_SRC, cc_src)
+DEFO32(CC_X, cc_x)
+DEFO32(DIV1, div1)
+DEFO32(DIV2, div2)
+DEFO32(MACSR, macsr)
+DEFO32(MAC_MASK, mac_mask)
diff --git a/src/target-m68k/translate.c b/src/target-m68k/translate.c
new file mode 100644
index 0000000..41ae2c6
--- /dev/null
+++ b/src/target-m68k/translate.c
@@ -0,0 +1,3095 @@
+/*
+ *  m68k translation
+ *
+ *  Copyright (c) 2005-2007 CodeSourcery
+ *  Written by Paul Brook
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cpu.h"
+#include "disas/disas.h"
+#include "tcg-op.h"
+#include "qemu/log.h"
+#include "exec/cpu_ldst.h"
+
+#include "exec/helper-proto.h"
+#include "exec/helper-gen.h"
+
+#include "trace-tcg.h"
+
+
+//#define DEBUG_DISPATCH 1
+
+/* Fake floating point.  */
+#define tcg_gen_mov_f64 tcg_gen_mov_i64
+#define tcg_gen_qemu_ldf64 tcg_gen_qemu_ld64
+#define tcg_gen_qemu_stf64 tcg_gen_qemu_st64
+
+#define DEFO32(name, offset) static TCGv QREG_##name;
+#define DEFO64(name, offset) static TCGv_i64 QREG_##name;
+#define DEFF64(name, offset) static TCGv_i64 QREG_##name;
+#include "qregs.def"
+#undef DEFO32
+#undef DEFO64
+#undef DEFF64
+
+static TCGv_i32 cpu_halted;
+static TCGv_i32 cpu_exception_index;
+
+static TCGv_ptr cpu_env;
+
+static char cpu_reg_names[3*8*3 + 5*4];
+static TCGv cpu_dregs[8];
+static TCGv cpu_aregs[8];
+static TCGv_i64 cpu_fregs[8];
+static TCGv_i64 cpu_macc[4];
+
+#define DREG(insn, pos) cpu_dregs[((insn) >> (pos)) & 7]
+#define AREG(insn, pos) cpu_aregs[((insn) >> (pos)) & 7]
+#define FREG(insn, pos) cpu_fregs[((insn) >> (pos)) & 7]
+#define MACREG(acc) cpu_macc[acc]
+#define QREG_SP cpu_aregs[7]
+
+static TCGv NULL_QREG;
+#define IS_NULL_QREG(t) (TCGV_EQUAL(t, NULL_QREG))
+/* Used to distinguish stores from bad addressing modes.  */
+static TCGv store_dummy;
+
+#include "exec/gen-icount.h"
+
+void m68k_tcg_init(void)
+{
+    char *p;
+    int i;
+
+#define DEFO32(name,  offset) QREG_##name = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUM68KState, offset), #name);
+#define DEFO64(name,  offset) QREG_##name = tcg_global_mem_new_i64(TCG_AREG0, offsetof(CPUM68KState, offset), #name);
+#define DEFF64(name,  offset) DEFO64(name, offset)
+#include "qregs.def"
+#undef DEFO32
+#undef DEFO64
+#undef DEFF64
+
+    cpu_halted = tcg_global_mem_new_i32(TCG_AREG0,
+                                        -offsetof(M68kCPU, env) +
+                                        offsetof(CPUState, halted), "HALTED");
+    cpu_exception_index = tcg_global_mem_new_i32(TCG_AREG0,
+                                                 -offsetof(M68kCPU, env) +
+                                                 offsetof(CPUState, exception_index),
+                                                 "EXCEPTION");
+
+    cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
+
+    p = cpu_reg_names;
+    for (i = 0; i < 8; i++) {
+        sprintf(p, "D%d", i);
+        cpu_dregs[i] = tcg_global_mem_new(TCG_AREG0,
+                                          offsetof(CPUM68KState, dregs[i]), p);
+        p += 3;
+        sprintf(p, "A%d", i);
+        cpu_aregs[i] = tcg_global_mem_new(TCG_AREG0,
+                                          offsetof(CPUM68KState, aregs[i]), p);
+        p += 3;
+        sprintf(p, "F%d", i);
+        cpu_fregs[i] = tcg_global_mem_new_i64(TCG_AREG0,
+                                          offsetof(CPUM68KState, fregs[i]), p);
+        p += 3;
+    }
+    for (i = 0; i < 4; i++) {
+        sprintf(p, "ACC%d", i);
+        cpu_macc[i] = tcg_global_mem_new_i64(TCG_AREG0,
+                                         offsetof(CPUM68KState, macc[i]), p);
+        p += 5;
+    }
+
+    NULL_QREG = tcg_global_mem_new(TCG_AREG0, -4, "NULL");
+    store_dummy = tcg_global_mem_new(TCG_AREG0, -8, "NULL");
+}
+
+/* internal defines */
+typedef struct DisasContext {
+    CPUM68KState *env;
+    target_ulong insn_pc; /* Start of the current instruction.  */
+    target_ulong pc;
+    int is_jmp;
+    int cc_op;
+    int user;
+    uint32_t fpcr;
+    struct TranslationBlock *tb;
+    int singlestep_enabled;
+    TCGv_i64 mactmp;
+    int done_mac;
+} DisasContext;
+
+#define DISAS_JUMP_NEXT 4
+
+#if defined(CONFIG_USER_ONLY)
+#define IS_USER(s) 1
+#else
+#define IS_USER(s) s->user
+#endif
+
+/* XXX: move that elsewhere */
+/* ??? Fix exceptions.  */
+static void *gen_throws_exception;
+#define gen_last_qop NULL
+
+#define OS_BYTE 0
+#define OS_WORD 1
+#define OS_LONG 2
+#define OS_SINGLE 4
+#define OS_DOUBLE 5
+
+typedef void (*disas_proc)(CPUM68KState *env, DisasContext *s, uint16_t insn);
+
+#ifdef DEBUG_DISPATCH
+#define DISAS_INSN(name)                                                \
+    static void real_disas_##name(CPUM68KState *env, DisasContext *s,   \
+                                  uint16_t insn);                       \
+    static void disas_##name(CPUM68KState *env, DisasContext *s,        \
+                             uint16_t insn)                             \
+    {                                                                   \
+        qemu_log("Dispatch " #name "\n");                               \
+        real_disas_##name(s, env, insn);                                \
+    }                                                                   \
+    static void real_disas_##name(CPUM68KState *env, DisasContext *s,   \
+                                  uint16_t insn)
+#else
+#define DISAS_INSN(name)                                                \
+    static void disas_##name(CPUM68KState *env, DisasContext *s,        \
+                             uint16_t insn)
+#endif
+
+/* Generate a load from the specified address.  Narrow values are
+   sign extended to full register width.  */
+static inline TCGv gen_load(DisasContext * s, int opsize, TCGv addr, int sign)
+{
+    TCGv tmp;
+    int index = IS_USER(s);
+    tmp = tcg_temp_new_i32();
+    switch(opsize) {
+    case OS_BYTE:
+        if (sign)
+            tcg_gen_qemu_ld8s(tmp, addr, index);
+        else
+            tcg_gen_qemu_ld8u(tmp, addr, index);
+        break;
+    case OS_WORD:
+        if (sign)
+            tcg_gen_qemu_ld16s(tmp, addr, index);
+        else
+            tcg_gen_qemu_ld16u(tmp, addr, index);
+        break;
+    case OS_LONG:
+    case OS_SINGLE:
+        tcg_gen_qemu_ld32u(tmp, addr, index);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    gen_throws_exception = gen_last_qop;
+    return tmp;
+}
+
+static inline TCGv_i64 gen_load64(DisasContext * s, TCGv addr)
+{
+    TCGv_i64 tmp;
+    int index = IS_USER(s);
+    tmp = tcg_temp_new_i64();
+    tcg_gen_qemu_ldf64(tmp, addr, index);
+    gen_throws_exception = gen_last_qop;
+    return tmp;
+}
+
+/* Generate a store.  */
+static inline void gen_store(DisasContext *s, int opsize, TCGv addr, TCGv val)
+{
+    int index = IS_USER(s);
+    switch(opsize) {
+    case OS_BYTE:
+        tcg_gen_qemu_st8(val, addr, index);
+        break;
+    case OS_WORD:
+        tcg_gen_qemu_st16(val, addr, index);
+        break;
+    case OS_LONG:
+    case OS_SINGLE:
+        tcg_gen_qemu_st32(val, addr, index);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    gen_throws_exception = gen_last_qop;
+}
+
+static inline void gen_store64(DisasContext *s, TCGv addr, TCGv_i64 val)
+{
+    int index = IS_USER(s);
+    tcg_gen_qemu_stf64(val, addr, index);
+    gen_throws_exception = gen_last_qop;
+}
+
+typedef enum {
+    EA_STORE,
+    EA_LOADU,
+    EA_LOADS
+} ea_what;
+
+/* Generate an unsigned load if VAL is 0 a signed load if val is -1,
+   otherwise generate a store.  */
+static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
+                     ea_what what)
+{
+    if (what == EA_STORE) {
+        gen_store(s, opsize, addr, val);
+        return store_dummy;
+    } else {
+        return gen_load(s, opsize, addr, what == EA_LOADS);
+    }
+}
+
+/* Read a 32-bit immediate constant.  */
+static inline uint32_t read_im32(CPUM68KState *env, DisasContext *s)
+{
+    uint32_t im;
+    im = ((uint32_t)cpu_lduw_code(env, s->pc)) << 16;
+    s->pc += 2;
+    im |= cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    return im;
+}
+
+/* Calculate and address index.  */
+static TCGv gen_addr_index(uint16_t ext, TCGv tmp)
+{
+    TCGv add;
+    int scale;
+
+    add = (ext & 0x8000) ? AREG(ext, 12) : DREG(ext, 12);
+    if ((ext & 0x800) == 0) {
+        tcg_gen_ext16s_i32(tmp, add);
+        add = tmp;
+    }
+    scale = (ext >> 9) & 3;
+    if (scale != 0) {
+        tcg_gen_shli_i32(tmp, add, scale);
+        add = tmp;
+    }
+    return add;
+}
+
+/* Handle a base + index + displacement effective addresss.
+   A NULL_QREG base means pc-relative.  */
+static TCGv gen_lea_indexed(CPUM68KState *env, DisasContext *s, TCGv base)
+{
+    uint32_t offset;
+    uint16_t ext;
+    TCGv add;
+    TCGv tmp;
+    uint32_t bd, od;
+
+    offset = s->pc;
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+
+    if ((ext & 0x800) == 0 && !m68k_feature(s->env, M68K_FEATURE_WORD_INDEX))
+        return NULL_QREG;
+
+    if (ext & 0x100) {
+        /* full extension word format */
+        if (!m68k_feature(s->env, M68K_FEATURE_EXT_FULL))
+            return NULL_QREG;
+
+        if ((ext & 0x30) > 0x10) {
+            /* base displacement */
+            if ((ext & 0x30) == 0x20) {
+                bd = (int16_t)cpu_lduw_code(env, s->pc);
+                s->pc += 2;
+            } else {
+                bd = read_im32(env, s);
+            }
+        } else {
+            bd = 0;
+        }
+        tmp = tcg_temp_new();
+        if ((ext & 0x44) == 0) {
+            /* pre-index */
+            add = gen_addr_index(ext, tmp);
+        } else {
+            add = NULL_QREG;
+        }
+        if ((ext & 0x80) == 0) {
+            /* base not suppressed */
+            if (IS_NULL_QREG(base)) {
+                base = tcg_const_i32(offset + bd);
+                bd = 0;
+            }
+            if (!IS_NULL_QREG(add)) {
+                tcg_gen_add_i32(tmp, add, base);
+                add = tmp;
+            } else {
+                add = base;
+            }
+        }
+        if (!IS_NULL_QREG(add)) {
+            if (bd != 0) {
+                tcg_gen_addi_i32(tmp, add, bd);
+                add = tmp;
+            }
+        } else {
+            add = tcg_const_i32(bd);
+        }
+        if ((ext & 3) != 0) {
+            /* memory indirect */
+            base = gen_load(s, OS_LONG, add, 0);
+            if ((ext & 0x44) == 4) {
+                add = gen_addr_index(ext, tmp);
+                tcg_gen_add_i32(tmp, add, base);
+                add = tmp;
+            } else {
+                add = base;
+            }
+            if ((ext & 3) > 1) {
+                /* outer displacement */
+                if ((ext & 3) == 2) {
+                    od = (int16_t)cpu_lduw_code(env, s->pc);
+                    s->pc += 2;
+                } else {
+                    od = read_im32(env, s);
+                }
+            } else {
+                od = 0;
+            }
+            if (od != 0) {
+                tcg_gen_addi_i32(tmp, add, od);
+                add = tmp;
+            }
+        }
+    } else {
+        /* brief extension word format */
+        tmp = tcg_temp_new();
+        add = gen_addr_index(ext, tmp);
+        if (!IS_NULL_QREG(base)) {
+            tcg_gen_add_i32(tmp, add, base);
+            if ((int8_t)ext)
+                tcg_gen_addi_i32(tmp, tmp, (int8_t)ext);
+        } else {
+            tcg_gen_addi_i32(tmp, add, offset + (int8_t)ext);
+        }
+        add = tmp;
+    }
+    return add;
+}
+
+/* Update the CPU env CC_OP state.  */
+static inline void gen_flush_cc_op(DisasContext *s)
+{
+    if (s->cc_op != CC_OP_DYNAMIC)
+        tcg_gen_movi_i32(QREG_CC_OP, s->cc_op);
+}
+
+/* Evaluate all the CC flags.  */
+static inline void gen_flush_flags(DisasContext *s)
+{
+    if (s->cc_op == CC_OP_FLAGS)
+        return;
+    gen_flush_cc_op(s);
+    gen_helper_flush_flags(cpu_env, QREG_CC_OP);
+    s->cc_op = CC_OP_FLAGS;
+}
+
+static void gen_logic_cc(DisasContext *s, TCGv val)
+{
+    tcg_gen_mov_i32(QREG_CC_DEST, val);
+    s->cc_op = CC_OP_LOGIC;
+}
+
+static void gen_update_cc_add(TCGv dest, TCGv src)
+{
+    tcg_gen_mov_i32(QREG_CC_DEST, dest);
+    tcg_gen_mov_i32(QREG_CC_SRC, src);
+}
+
+static inline int opsize_bytes(int opsize)
+{
+    switch (opsize) {
+    case OS_BYTE: return 1;
+    case OS_WORD: return 2;
+    case OS_LONG: return 4;
+    case OS_SINGLE: return 4;
+    case OS_DOUBLE: return 8;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+/* Assign value to a register.  If the width is less than the register width
+   only the low part of the register is set.  */
+static void gen_partset_reg(int opsize, TCGv reg, TCGv val)
+{
+    TCGv tmp;
+    switch (opsize) {
+    case OS_BYTE:
+        tcg_gen_andi_i32(reg, reg, 0xffffff00);
+        tmp = tcg_temp_new();
+        tcg_gen_ext8u_i32(tmp, val);
+        tcg_gen_or_i32(reg, reg, tmp);
+        break;
+    case OS_WORD:
+        tcg_gen_andi_i32(reg, reg, 0xffff0000);
+        tmp = tcg_temp_new();
+        tcg_gen_ext16u_i32(tmp, val);
+        tcg_gen_or_i32(reg, reg, tmp);
+        break;
+    case OS_LONG:
+    case OS_SINGLE:
+        tcg_gen_mov_i32(reg, val);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+/* Sign or zero extend a value.  */
+static inline TCGv gen_extend(TCGv val, int opsize, int sign)
+{
+    TCGv tmp;
+
+    switch (opsize) {
+    case OS_BYTE:
+        tmp = tcg_temp_new();
+        if (sign)
+            tcg_gen_ext8s_i32(tmp, val);
+        else
+            tcg_gen_ext8u_i32(tmp, val);
+        break;
+    case OS_WORD:
+        tmp = tcg_temp_new();
+        if (sign)
+            tcg_gen_ext16s_i32(tmp, val);
+        else
+            tcg_gen_ext16u_i32(tmp, val);
+        break;
+    case OS_LONG:
+    case OS_SINGLE:
+        tmp = val;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return tmp;
+}
+
+/* Generate code for an "effective address".  Does not adjust the base
+   register for autoincrement addressing modes.  */
+static TCGv gen_lea(CPUM68KState *env, DisasContext *s, uint16_t insn,
+                    int opsize)
+{
+    TCGv reg;
+    TCGv tmp;
+    uint16_t ext;
+    uint32_t offset;
+
+    switch ((insn >> 3) & 7) {
+    case 0: /* Data register direct.  */
+    case 1: /* Address register direct.  */
+        return NULL_QREG;
+    case 2: /* Indirect register */
+    case 3: /* Indirect postincrement.  */
+        return AREG(insn, 0);
+    case 4: /* Indirect predecrememnt.  */
+        reg = AREG(insn, 0);
+        tmp = tcg_temp_new();
+        tcg_gen_subi_i32(tmp, reg, opsize_bytes(opsize));
+        return tmp;
+    case 5: /* Indirect displacement.  */
+        reg = AREG(insn, 0);
+        tmp = tcg_temp_new();
+        ext = cpu_lduw_code(env, s->pc);
+        s->pc += 2;
+        tcg_gen_addi_i32(tmp, reg, (int16_t)ext);
+        return tmp;
+    case 6: /* Indirect index + displacement.  */
+        reg = AREG(insn, 0);
+        return gen_lea_indexed(env, s, reg);
+    case 7: /* Other */
+        switch (insn & 7) {
+        case 0: /* Absolute short.  */
+            offset = cpu_ldsw_code(env, s->pc);
+            s->pc += 2;
+            return tcg_const_i32(offset);
+        case 1: /* Absolute long.  */
+            offset = read_im32(env, s);
+            return tcg_const_i32(offset);
+        case 2: /* pc displacement  */
+            offset = s->pc;
+            offset += cpu_ldsw_code(env, s->pc);
+            s->pc += 2;
+            return tcg_const_i32(offset);
+        case 3: /* pc index+displacement.  */
+            return gen_lea_indexed(env, s, NULL_QREG);
+        case 4: /* Immediate.  */
+        default:
+            return NULL_QREG;
+        }
+    }
+    /* Should never happen.  */
+    return NULL_QREG;
+}
+
+/* Helper function for gen_ea. Reuse the computed address between the
+   for read/write operands.  */
+static inline TCGv gen_ea_once(CPUM68KState *env, DisasContext *s,
+                               uint16_t insn, int opsize, TCGv val,
+                               TCGv *addrp, ea_what what)
+{
+    TCGv tmp;
+
+    if (addrp && what == EA_STORE) {
+        tmp = *addrp;
+    } else {
+        tmp = gen_lea(env, s, insn, opsize);
+        if (IS_NULL_QREG(tmp))
+            return tmp;
+        if (addrp)
+            *addrp = tmp;
+    }
+    return gen_ldst(s, opsize, tmp, val, what);
+}
+
+/* Generate code to load/store a value from/into an EA.  If VAL > 0 this is
+   a write otherwise it is a read (0 == sign extend, -1 == zero extend).
+   ADDRP is non-null for readwrite operands.  */
+static TCGv gen_ea(CPUM68KState *env, DisasContext *s, uint16_t insn,
+                   int opsize, TCGv val, TCGv *addrp, ea_what what)
+{
+    TCGv reg;
+    TCGv result;
+    uint32_t offset;
+
+    switch ((insn >> 3) & 7) {
+    case 0: /* Data register direct.  */
+        reg = DREG(insn, 0);
+        if (what == EA_STORE) {
+            gen_partset_reg(opsize, reg, val);
+            return store_dummy;
+        } else {
+            return gen_extend(reg, opsize, what == EA_LOADS);
+        }
+    case 1: /* Address register direct.  */
+        reg = AREG(insn, 0);
+        if (what == EA_STORE) {
+            tcg_gen_mov_i32(reg, val);
+            return store_dummy;
+        } else {
+            return gen_extend(reg, opsize, what == EA_LOADS);
+        }
+    case 2: /* Indirect register */
+        reg = AREG(insn, 0);
+        return gen_ldst(s, opsize, reg, val, what);
+    case 3: /* Indirect postincrement.  */
+        reg = AREG(insn, 0);
+        result = gen_ldst(s, opsize, reg, val, what);
+        /* ??? This is not exception safe.  The instruction may still
+           fault after this point.  */
+        if (what == EA_STORE || !addrp)
+            tcg_gen_addi_i32(reg, reg, opsize_bytes(opsize));
+        return result;
+    case 4: /* Indirect predecrememnt.  */
+        {
+            TCGv tmp;
+            if (addrp && what == EA_STORE) {
+                tmp = *addrp;
+            } else {
+                tmp = gen_lea(env, s, insn, opsize);
+                if (IS_NULL_QREG(tmp))
+                    return tmp;
+                if (addrp)
+                    *addrp = tmp;
+            }
+            result = gen_ldst(s, opsize, tmp, val, what);
+            /* ??? This is not exception safe.  The instruction may still
+               fault after this point.  */
+            if (what == EA_STORE || !addrp) {
+                reg = AREG(insn, 0);
+                tcg_gen_mov_i32(reg, tmp);
+            }
+        }
+        return result;
+    case 5: /* Indirect displacement.  */
+    case 6: /* Indirect index + displacement.  */
+        return gen_ea_once(env, s, insn, opsize, val, addrp, what);
+    case 7: /* Other */
+        switch (insn & 7) {
+        case 0: /* Absolute short.  */
+        case 1: /* Absolute long.  */
+        case 2: /* pc displacement  */
+        case 3: /* pc index+displacement.  */
+            return gen_ea_once(env, s, insn, opsize, val, addrp, what);
+        case 4: /* Immediate.  */
+            /* Sign extend values for consistency.  */
+            switch (opsize) {
+            case OS_BYTE:
+                if (what == EA_LOADS) {
+                    offset = cpu_ldsb_code(env, s->pc + 1);
+                } else {
+                    offset = cpu_ldub_code(env, s->pc + 1);
+                }
+                s->pc += 2;
+                break;
+            case OS_WORD:
+                if (what == EA_LOADS) {
+                    offset = cpu_ldsw_code(env, s->pc);
+                } else {
+                    offset = cpu_lduw_code(env, s->pc);
+                }
+                s->pc += 2;
+                break;
+            case OS_LONG:
+                offset = read_im32(env, s);
+                break;
+            default:
+                g_assert_not_reached();
+            }
+            return tcg_const_i32(offset);
+        default:
+            return NULL_QREG;
+        }
+    }
+    /* Should never happen.  */
+    return NULL_QREG;
+}
+
+/* This generates a conditional branch, clobbering all temporaries.  */
+static void gen_jmpcc(DisasContext *s, int cond, TCGLabel *l1)
+{
+    TCGv tmp;
+
+    /* TODO: Optimize compare/branch pairs rather than always flushing
+       flag state to CC_OP_FLAGS.  */
+    gen_flush_flags(s);
+    switch (cond) {
+    case 0: /* T */
+        tcg_gen_br(l1);
+        break;
+    case 1: /* F */
+        break;
+    case 2: /* HI (!C && !Z) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_C | CCF_Z);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 3: /* LS (C || Z) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_C | CCF_Z);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    case 4: /* CC (!C) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_C);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 5: /* CS (C) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_C);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    case 6: /* NE (!Z) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_Z);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 7: /* EQ (Z) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_Z);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    case 8: /* VC (!V) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_V);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 9: /* VS (V) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_V);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    case 10: /* PL (!N) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_N);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 11: /* MI (N) */
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_N);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    case 12: /* GE (!(N ^ V)) */
+        tmp = tcg_temp_new();
+        assert(CCF_V == (CCF_N >> 2));
+        tcg_gen_shri_i32(tmp, QREG_CC_DEST, 2);
+        tcg_gen_xor_i32(tmp, tmp, QREG_CC_DEST);
+        tcg_gen_andi_i32(tmp, tmp, CCF_V);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 13: /* LT (N ^ V) */
+        tmp = tcg_temp_new();
+        assert(CCF_V == (CCF_N >> 2));
+        tcg_gen_shri_i32(tmp, QREG_CC_DEST, 2);
+        tcg_gen_xor_i32(tmp, tmp, QREG_CC_DEST);
+        tcg_gen_andi_i32(tmp, tmp, CCF_V);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    case 14: /* GT (!(Z || (N ^ V))) */
+        tmp = tcg_temp_new();
+        assert(CCF_V == (CCF_N >> 2));
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_N);
+        tcg_gen_shri_i32(tmp, tmp, 2);
+        tcg_gen_xor_i32(tmp, tmp, QREG_CC_DEST);
+        tcg_gen_andi_i32(tmp, tmp, CCF_V | CCF_Z);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, l1);
+        break;
+    case 15: /* LE (Z || (N ^ V)) */
+        tmp = tcg_temp_new();
+        assert(CCF_V == (CCF_N >> 2));
+        tcg_gen_andi_i32(tmp, QREG_CC_DEST, CCF_N);
+        tcg_gen_shri_i32(tmp, tmp, 2);
+        tcg_gen_xor_i32(tmp, tmp, QREG_CC_DEST);
+        tcg_gen_andi_i32(tmp, tmp, CCF_V | CCF_Z);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, l1);
+        break;
+    default:
+        /* Should ever happen.  */
+        abort();
+    }
+}
+
+DISAS_INSN(scc)
+{
+    TCGLabel *l1;
+    int cond;
+    TCGv reg;
+
+    l1 = gen_new_label();
+    cond = (insn >> 8) & 0xf;
+    reg = DREG(insn, 0);
+    tcg_gen_andi_i32(reg, reg, 0xffffff00);
+    /* This is safe because we modify the reg directly, with no other values
+       live.  */
+    gen_jmpcc(s, cond ^ 1, l1);
+    tcg_gen_ori_i32(reg, reg, 0xff);
+    gen_set_label(l1);
+}
+
+/* Force a TB lookup after an instruction that changes the CPU state.  */
+static void gen_lookup_tb(DisasContext *s)
+{
+    gen_flush_cc_op(s);
+    tcg_gen_movi_i32(QREG_PC, s->pc);
+    s->is_jmp = DISAS_UPDATE;
+}
+
+/* Generate a jump to an immediate address.  */
+static void gen_jmp_im(DisasContext *s, uint32_t dest)
+{
+    gen_flush_cc_op(s);
+    tcg_gen_movi_i32(QREG_PC, dest);
+    s->is_jmp = DISAS_JUMP;
+}
+
+/* Generate a jump to the address in qreg DEST.  */
+static void gen_jmp(DisasContext *s, TCGv dest)
+{
+    gen_flush_cc_op(s);
+    tcg_gen_mov_i32(QREG_PC, dest);
+    s->is_jmp = DISAS_JUMP;
+}
+
+static void gen_exception(DisasContext *s, uint32_t where, int nr)
+{
+    gen_flush_cc_op(s);
+    gen_jmp_im(s, where);
+    gen_helper_raise_exception(cpu_env, tcg_const_i32(nr));
+}
+
+static inline void gen_addr_fault(DisasContext *s)
+{
+    gen_exception(s, s->insn_pc, EXCP_ADDRESS);
+}
+
+#define SRC_EA(env, result, opsize, op_sign, addrp) do {                \
+        result = gen_ea(env, s, insn, opsize, NULL_QREG, addrp,         \
+                        op_sign ? EA_LOADS : EA_LOADU);                 \
+        if (IS_NULL_QREG(result)) {                                     \
+            gen_addr_fault(s);                                          \
+            return;                                                     \
+        }                                                               \
+    } while (0)
+
+#define DEST_EA(env, insn, opsize, val, addrp) do {                     \
+        TCGv ea_result = gen_ea(env, s, insn, opsize, val, addrp, EA_STORE); \
+        if (IS_NULL_QREG(ea_result)) {                                  \
+            gen_addr_fault(s);                                          \
+            return;                                                     \
+        }                                                               \
+    } while (0)
+
+/* Generate a jump to an immediate address.  */
+static void gen_jmp_tb(DisasContext *s, int n, uint32_t dest)
+{
+    TranslationBlock *tb;
+
+    tb = s->tb;
+    if (unlikely(s->singlestep_enabled)) {
+        gen_exception(s, dest, EXCP_DEBUG);
+    } else if ((tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
+               (s->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK)) {
+        tcg_gen_goto_tb(n);
+        tcg_gen_movi_i32(QREG_PC, dest);
+        tcg_gen_exit_tb((uintptr_t)tb + n);
+    } else {
+        gen_jmp_im(s, dest);
+        tcg_gen_exit_tb(0);
+    }
+    s->is_jmp = DISAS_TB_JUMP;
+}
+
+DISAS_INSN(undef_mac)
+{
+    gen_exception(s, s->pc - 2, EXCP_LINEA);
+}
+
+DISAS_INSN(undef_fpu)
+{
+    gen_exception(s, s->pc - 2, EXCP_LINEF);
+}
+
+DISAS_INSN(undef)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+
+    gen_exception(s, s->pc - 2, EXCP_UNSUPPORTED);
+    cpu_abort(CPU(cpu), "Illegal instruction: %04x @ %08x", insn, s->pc - 2);
+}
+
+DISAS_INSN(mulw)
+{
+    TCGv reg;
+    TCGv tmp;
+    TCGv src;
+    int sign;
+
+    sign = (insn & 0x100) != 0;
+    reg = DREG(insn, 9);
+    tmp = tcg_temp_new();
+    if (sign)
+        tcg_gen_ext16s_i32(tmp, reg);
+    else
+        tcg_gen_ext16u_i32(tmp, reg);
+    SRC_EA(env, src, OS_WORD, sign, NULL);
+    tcg_gen_mul_i32(tmp, tmp, src);
+    tcg_gen_mov_i32(reg, tmp);
+    /* Unlike m68k, coldfire always clears the overflow bit.  */
+    gen_logic_cc(s, tmp);
+}
+
+DISAS_INSN(divw)
+{
+    TCGv reg;
+    TCGv tmp;
+    TCGv src;
+    int sign;
+
+    sign = (insn & 0x100) != 0;
+    reg = DREG(insn, 9);
+    if (sign) {
+        tcg_gen_ext16s_i32(QREG_DIV1, reg);
+    } else {
+        tcg_gen_ext16u_i32(QREG_DIV1, reg);
+    }
+    SRC_EA(env, src, OS_WORD, sign, NULL);
+    tcg_gen_mov_i32(QREG_DIV2, src);
+    if (sign) {
+        gen_helper_divs(cpu_env, tcg_const_i32(1));
+    } else {
+        gen_helper_divu(cpu_env, tcg_const_i32(1));
+    }
+
+    tmp = tcg_temp_new();
+    src = tcg_temp_new();
+    tcg_gen_ext16u_i32(tmp, QREG_DIV1);
+    tcg_gen_shli_i32(src, QREG_DIV2, 16);
+    tcg_gen_or_i32(reg, tmp, src);
+    s->cc_op = CC_OP_FLAGS;
+}
+
+DISAS_INSN(divl)
+{
+    TCGv num;
+    TCGv den;
+    TCGv reg;
+    uint16_t ext;
+
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    if (ext & 0x87f8) {
+        gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);
+        return;
+    }
+    num = DREG(ext, 12);
+    reg = DREG(ext, 0);
+    tcg_gen_mov_i32(QREG_DIV1, num);
+    SRC_EA(env, den, OS_LONG, 0, NULL);
+    tcg_gen_mov_i32(QREG_DIV2, den);
+    if (ext & 0x0800) {
+        gen_helper_divs(cpu_env, tcg_const_i32(0));
+    } else {
+        gen_helper_divu(cpu_env, tcg_const_i32(0));
+    }
+    if ((ext & 7) == ((ext >> 12) & 7)) {
+        /* div */
+        tcg_gen_mov_i32 (reg, QREG_DIV1);
+    } else {
+        /* rem */
+        tcg_gen_mov_i32 (reg, QREG_DIV2);
+    }
+    s->cc_op = CC_OP_FLAGS;
+}
+
+DISAS_INSN(addsub)
+{
+    TCGv reg;
+    TCGv dest;
+    TCGv src;
+    TCGv tmp;
+    TCGv addr;
+    int add;
+
+    add = (insn & 0x4000) != 0;
+    reg = DREG(insn, 9);
+    dest = tcg_temp_new();
+    if (insn & 0x100) {
+        SRC_EA(env, tmp, OS_LONG, 0, &addr);
+        src = reg;
+    } else {
+        tmp = reg;
+        SRC_EA(env, src, OS_LONG, 0, NULL);
+    }
+    if (add) {
+        tcg_gen_add_i32(dest, tmp, src);
+        gen_helper_xflag_lt(QREG_CC_X, dest, src);
+        s->cc_op = CC_OP_ADD;
+    } else {
+        gen_helper_xflag_lt(QREG_CC_X, tmp, src);
+        tcg_gen_sub_i32(dest, tmp, src);
+        s->cc_op = CC_OP_SUB;
+    }
+    gen_update_cc_add(dest, src);
+    if (insn & 0x100) {
+        DEST_EA(env, insn, OS_LONG, dest, &addr);
+    } else {
+        tcg_gen_mov_i32(reg, dest);
+    }
+}
+
+
+/* Reverse the order of the bits in REG.  */
+DISAS_INSN(bitrev)
+{
+    TCGv reg;
+    reg = DREG(insn, 0);
+    gen_helper_bitrev(reg, reg);
+}
+
+DISAS_INSN(bitop_reg)
+{
+    int opsize;
+    int op;
+    TCGv src1;
+    TCGv src2;
+    TCGv tmp;
+    TCGv addr;
+    TCGv dest;
+
+    if ((insn & 0x38) != 0)
+        opsize = OS_BYTE;
+    else
+        opsize = OS_LONG;
+    op = (insn >> 6) & 3;
+    SRC_EA(env, src1, opsize, 0, op ? &addr: NULL);
+    src2 = DREG(insn, 9);
+    dest = tcg_temp_new();
+
+    gen_flush_flags(s);
+    tmp = tcg_temp_new();
+    if (opsize == OS_BYTE)
+        tcg_gen_andi_i32(tmp, src2, 7);
+    else
+        tcg_gen_andi_i32(tmp, src2, 31);
+    src2 = tmp;
+    tmp = tcg_temp_new();
+    tcg_gen_shr_i32(tmp, src1, src2);
+    tcg_gen_andi_i32(tmp, tmp, 1);
+    tcg_gen_shli_i32(tmp, tmp, 2);
+    /* Clear CCF_Z if bit set.  */
+    tcg_gen_ori_i32(QREG_CC_DEST, QREG_CC_DEST, CCF_Z);
+    tcg_gen_xor_i32(QREG_CC_DEST, QREG_CC_DEST, tmp);
+
+    tcg_gen_shl_i32(tmp, tcg_const_i32(1), src2);
+    switch (op) {
+    case 1: /* bchg */
+        tcg_gen_xor_i32(dest, src1, tmp);
+        break;
+    case 2: /* bclr */
+        tcg_gen_not_i32(tmp, tmp);
+        tcg_gen_and_i32(dest, src1, tmp);
+        break;
+    case 3: /* bset */
+        tcg_gen_or_i32(dest, src1, tmp);
+        break;
+    default: /* btst */
+        break;
+    }
+    if (op)
+        DEST_EA(env, insn, opsize, dest, &addr);
+}
+
+DISAS_INSN(sats)
+{
+    TCGv reg;
+    reg = DREG(insn, 0);
+    gen_flush_flags(s);
+    gen_helper_sats(reg, reg, QREG_CC_DEST);
+    gen_logic_cc(s, reg);
+}
+
+static void gen_push(DisasContext *s, TCGv val)
+{
+    TCGv tmp;
+
+    tmp = tcg_temp_new();
+    tcg_gen_subi_i32(tmp, QREG_SP, 4);
+    gen_store(s, OS_LONG, tmp, val);
+    tcg_gen_mov_i32(QREG_SP, tmp);
+}
+
+DISAS_INSN(movem)
+{
+    TCGv addr;
+    int i;
+    uint16_t mask;
+    TCGv reg;
+    TCGv tmp;
+    int is_load;
+
+    mask = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    tmp = gen_lea(env, s, insn, OS_LONG);
+    if (IS_NULL_QREG(tmp)) {
+        gen_addr_fault(s);
+        return;
+    }
+    addr = tcg_temp_new();
+    tcg_gen_mov_i32(addr, tmp);
+    is_load = ((insn & 0x0400) != 0);
+    for (i = 0; i < 16; i++, mask >>= 1) {
+        if (mask & 1) {
+            if (i < 8)
+                reg = DREG(i, 0);
+            else
+                reg = AREG(i, 0);
+            if (is_load) {
+                tmp = gen_load(s, OS_LONG, addr, 0);
+                tcg_gen_mov_i32(reg, tmp);
+            } else {
+                gen_store(s, OS_LONG, addr, reg);
+            }
+            if (mask != 1)
+                tcg_gen_addi_i32(addr, addr, 4);
+        }
+    }
+}
+
+DISAS_INSN(bitop_im)
+{
+    int opsize;
+    int op;
+    TCGv src1;
+    uint32_t mask;
+    int bitnum;
+    TCGv tmp;
+    TCGv addr;
+
+    if ((insn & 0x38) != 0)
+        opsize = OS_BYTE;
+    else
+        opsize = OS_LONG;
+    op = (insn >> 6) & 3;
+
+    bitnum = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    if (bitnum & 0xff00) {
+        disas_undef(env, s, insn);
+        return;
+    }
+
+    SRC_EA(env, src1, opsize, 0, op ? &addr: NULL);
+
+    gen_flush_flags(s);
+    if (opsize == OS_BYTE)
+        bitnum &= 7;
+    else
+        bitnum &= 31;
+    mask = 1 << bitnum;
+
+    tmp = tcg_temp_new();
+    assert (CCF_Z == (1 << 2));
+    if (bitnum > 2)
+        tcg_gen_shri_i32(tmp, src1, bitnum - 2);
+    else if (bitnum < 2)
+        tcg_gen_shli_i32(tmp, src1, 2 - bitnum);
+    else
+        tcg_gen_mov_i32(tmp, src1);
+    tcg_gen_andi_i32(tmp, tmp, CCF_Z);
+    /* Clear CCF_Z if bit set.  */
+    tcg_gen_ori_i32(QREG_CC_DEST, QREG_CC_DEST, CCF_Z);
+    tcg_gen_xor_i32(QREG_CC_DEST, QREG_CC_DEST, tmp);
+    if (op) {
+        switch (op) {
+        case 1: /* bchg */
+            tcg_gen_xori_i32(tmp, src1, mask);
+            break;
+        case 2: /* bclr */
+            tcg_gen_andi_i32(tmp, src1, ~mask);
+            break;
+        case 3: /* bset */
+            tcg_gen_ori_i32(tmp, src1, mask);
+            break;
+        default: /* btst */
+            break;
+        }
+        DEST_EA(env, insn, opsize, tmp, &addr);
+    }
+}
+
+DISAS_INSN(arith_im)
+{
+    int op;
+    uint32_t im;
+    TCGv src1;
+    TCGv dest;
+    TCGv addr;
+
+    op = (insn >> 9) & 7;
+    SRC_EA(env, src1, OS_LONG, 0, (op == 6) ? NULL : &addr);
+    im = read_im32(env, s);
+    dest = tcg_temp_new();
+    switch (op) {
+    case 0: /* ori */
+        tcg_gen_ori_i32(dest, src1, im);
+        gen_logic_cc(s, dest);
+        break;
+    case 1: /* andi */
+        tcg_gen_andi_i32(dest, src1, im);
+        gen_logic_cc(s, dest);
+        break;
+    case 2: /* subi */
+        tcg_gen_mov_i32(dest, src1);
+        gen_helper_xflag_lt(QREG_CC_X, dest, tcg_const_i32(im));
+        tcg_gen_subi_i32(dest, dest, im);
+        gen_update_cc_add(dest, tcg_const_i32(im));
+        s->cc_op = CC_OP_SUB;
+        break;
+    case 3: /* addi */
+        tcg_gen_mov_i32(dest, src1);
+        tcg_gen_addi_i32(dest, dest, im);
+        gen_update_cc_add(dest, tcg_const_i32(im));
+        gen_helper_xflag_lt(QREG_CC_X, dest, tcg_const_i32(im));
+        s->cc_op = CC_OP_ADD;
+        break;
+    case 5: /* eori */
+        tcg_gen_xori_i32(dest, src1, im);
+        gen_logic_cc(s, dest);
+        break;
+    case 6: /* cmpi */
+        tcg_gen_mov_i32(dest, src1);
+        tcg_gen_subi_i32(dest, dest, im);
+        gen_update_cc_add(dest, tcg_const_i32(im));
+        s->cc_op = CC_OP_SUB;
+        break;
+    default:
+        abort();
+    }
+    if (op != 6) {
+        DEST_EA(env, insn, OS_LONG, dest, &addr);
+    }
+}
+
+DISAS_INSN(byterev)
+{
+    TCGv reg;
+
+    reg = DREG(insn, 0);
+    tcg_gen_bswap32_i32(reg, reg);
+}
+
+DISAS_INSN(move)
+{
+    TCGv src;
+    TCGv dest;
+    int op;
+    int opsize;
+
+    switch (insn >> 12) {
+    case 1: /* move.b */
+        opsize = OS_BYTE;
+        break;
+    case 2: /* move.l */
+        opsize = OS_LONG;
+        break;
+    case 3: /* move.w */
+        opsize = OS_WORD;
+        break;
+    default:
+        abort();
+    }
+    SRC_EA(env, src, opsize, 1, NULL);
+    op = (insn >> 6) & 7;
+    if (op == 1) {
+        /* movea */
+        /* The value will already have been sign extended.  */
+        dest = AREG(insn, 9);
+        tcg_gen_mov_i32(dest, src);
+    } else {
+        /* normal move */
+        uint16_t dest_ea;
+        dest_ea = ((insn >> 9) & 7) | (op << 3);
+        DEST_EA(env, dest_ea, opsize, src, NULL);
+        /* This will be correct because loads sign extend.  */
+        gen_logic_cc(s, src);
+    }
+}
+
+DISAS_INSN(negx)
+{
+    TCGv reg;
+
+    gen_flush_flags(s);
+    reg = DREG(insn, 0);
+    gen_helper_subx_cc(reg, cpu_env, tcg_const_i32(0), reg);
+}
+
+DISAS_INSN(lea)
+{
+    TCGv reg;
+    TCGv tmp;
+
+    reg = AREG(insn, 9);
+    tmp = gen_lea(env, s, insn, OS_LONG);
+    if (IS_NULL_QREG(tmp)) {
+        gen_addr_fault(s);
+        return;
+    }
+    tcg_gen_mov_i32(reg, tmp);
+}
+
+DISAS_INSN(clr)
+{
+    int opsize;
+
+    switch ((insn >> 6) & 3) {
+    case 0: /* clr.b */
+        opsize = OS_BYTE;
+        break;
+    case 1: /* clr.w */
+        opsize = OS_WORD;
+        break;
+    case 2: /* clr.l */
+        opsize = OS_LONG;
+        break;
+    default:
+        abort();
+    }
+    DEST_EA(env, insn, opsize, tcg_const_i32(0), NULL);
+    gen_logic_cc(s, tcg_const_i32(0));
+}
+
+static TCGv gen_get_ccr(DisasContext *s)
+{
+    TCGv dest;
+
+    gen_flush_flags(s);
+    dest = tcg_temp_new();
+    tcg_gen_shli_i32(dest, QREG_CC_X, 4);
+    tcg_gen_or_i32(dest, dest, QREG_CC_DEST);
+    return dest;
+}
+
+DISAS_INSN(move_from_ccr)
+{
+    TCGv reg;
+    TCGv ccr;
+
+    ccr = gen_get_ccr(s);
+    reg = DREG(insn, 0);
+    gen_partset_reg(OS_WORD, reg, ccr);
+}
+
+DISAS_INSN(neg)
+{
+    TCGv reg;
+    TCGv src1;
+
+    reg = DREG(insn, 0);
+    src1 = tcg_temp_new();
+    tcg_gen_mov_i32(src1, reg);
+    tcg_gen_neg_i32(reg, src1);
+    s->cc_op = CC_OP_SUB;
+    gen_update_cc_add(reg, src1);
+    gen_helper_xflag_lt(QREG_CC_X, tcg_const_i32(0), src1);
+    s->cc_op = CC_OP_SUB;
+}
+
+static void gen_set_sr_im(DisasContext *s, uint16_t val, int ccr_only)
+{
+    tcg_gen_movi_i32(QREG_CC_DEST, val & 0xf);
+    tcg_gen_movi_i32(QREG_CC_X, (val & 0x10) >> 4);
+    if (!ccr_only) {
+        gen_helper_set_sr(cpu_env, tcg_const_i32(val & 0xff00));
+    }
+}
+
+static void gen_set_sr(CPUM68KState *env, DisasContext *s, uint16_t insn,
+                       int ccr_only)
+{
+    TCGv tmp;
+    TCGv reg;
+
+    s->cc_op = CC_OP_FLAGS;
+    if ((insn & 0x38) == 0)
+      {
+        tmp = tcg_temp_new();
+        reg = DREG(insn, 0);
+        tcg_gen_andi_i32(QREG_CC_DEST, reg, 0xf);
+        tcg_gen_shri_i32(tmp, reg, 4);
+        tcg_gen_andi_i32(QREG_CC_X, tmp, 1);
+        if (!ccr_only) {
+            gen_helper_set_sr(cpu_env, reg);
+        }
+      }
+    else if ((insn & 0x3f) == 0x3c)
+      {
+        uint16_t val;
+        val = cpu_lduw_code(env, s->pc);
+        s->pc += 2;
+        gen_set_sr_im(s, val, ccr_only);
+      }
+    else
+        disas_undef(env, s, insn);
+}
+
+DISAS_INSN(move_to_ccr)
+{
+    gen_set_sr(env, s, insn, 1);
+}
+
+DISAS_INSN(not)
+{
+    TCGv reg;
+
+    reg = DREG(insn, 0);
+    tcg_gen_not_i32(reg, reg);
+    gen_logic_cc(s, reg);
+}
+
+DISAS_INSN(swap)
+{
+    TCGv src1;
+    TCGv src2;
+    TCGv reg;
+
+    src1 = tcg_temp_new();
+    src2 = tcg_temp_new();
+    reg = DREG(insn, 0);
+    tcg_gen_shli_i32(src1, reg, 16);
+    tcg_gen_shri_i32(src2, reg, 16);
+    tcg_gen_or_i32(reg, src1, src2);
+    gen_logic_cc(s, reg);
+}
+
+DISAS_INSN(pea)
+{
+    TCGv tmp;
+
+    tmp = gen_lea(env, s, insn, OS_LONG);
+    if (IS_NULL_QREG(tmp)) {
+        gen_addr_fault(s);
+        return;
+    }
+    gen_push(s, tmp);
+}
+
+DISAS_INSN(ext)
+{
+    int op;
+    TCGv reg;
+    TCGv tmp;
+
+    reg = DREG(insn, 0);
+    op = (insn >> 6) & 7;
+    tmp = tcg_temp_new();
+    if (op == 3)
+        tcg_gen_ext16s_i32(tmp, reg);
+    else
+        tcg_gen_ext8s_i32(tmp, reg);
+    if (op == 2)
+        gen_partset_reg(OS_WORD, reg, tmp);
+    else
+        tcg_gen_mov_i32(reg, tmp);
+    gen_logic_cc(s, tmp);
+}
+
+DISAS_INSN(tst)
+{
+    int opsize;
+    TCGv tmp;
+
+    switch ((insn >> 6) & 3) {
+    case 0: /* tst.b */
+        opsize = OS_BYTE;
+        break;
+    case 1: /* tst.w */
+        opsize = OS_WORD;
+        break;
+    case 2: /* tst.l */
+        opsize = OS_LONG;
+        break;
+    default:
+        abort();
+    }
+    SRC_EA(env, tmp, opsize, 1, NULL);
+    gen_logic_cc(s, tmp);
+}
+
+DISAS_INSN(pulse)
+{
+  /* Implemented as a NOP.  */
+}
+
+DISAS_INSN(illegal)
+{
+    gen_exception(s, s->pc - 2, EXCP_ILLEGAL);
+}
+
+/* ??? This should be atomic.  */
+DISAS_INSN(tas)
+{
+    TCGv dest;
+    TCGv src1;
+    TCGv addr;
+
+    dest = tcg_temp_new();
+    SRC_EA(env, src1, OS_BYTE, 1, &addr);
+    gen_logic_cc(s, src1);
+    tcg_gen_ori_i32(dest, src1, 0x80);
+    DEST_EA(env, insn, OS_BYTE, dest, &addr);
+}
+
+DISAS_INSN(mull)
+{
+    uint16_t ext;
+    TCGv reg;
+    TCGv src1;
+    TCGv dest;
+
+    /* The upper 32 bits of the product are discarded, so
+       muls.l and mulu.l are functionally equivalent.  */
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    if (ext & 0x87ff) {
+        gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);
+        return;
+    }
+    reg = DREG(ext, 12);
+    SRC_EA(env, src1, OS_LONG, 0, NULL);
+    dest = tcg_temp_new();
+    tcg_gen_mul_i32(dest, src1, reg);
+    tcg_gen_mov_i32(reg, dest);
+    /* Unlike m68k, coldfire always clears the overflow bit.  */
+    gen_logic_cc(s, dest);
+}
+
+DISAS_INSN(link)
+{
+    int16_t offset;
+    TCGv reg;
+    TCGv tmp;
+
+    offset = cpu_ldsw_code(env, s->pc);
+    s->pc += 2;
+    reg = AREG(insn, 0);
+    tmp = tcg_temp_new();
+    tcg_gen_subi_i32(tmp, QREG_SP, 4);
+    gen_store(s, OS_LONG, tmp, reg);
+    if ((insn & 7) != 7)
+        tcg_gen_mov_i32(reg, tmp);
+    tcg_gen_addi_i32(QREG_SP, tmp, offset);
+}
+
+DISAS_INSN(unlk)
+{
+    TCGv src;
+    TCGv reg;
+    TCGv tmp;
+
+    src = tcg_temp_new();
+    reg = AREG(insn, 0);
+    tcg_gen_mov_i32(src, reg);
+    tmp = gen_load(s, OS_LONG, src, 0);
+    tcg_gen_mov_i32(reg, tmp);
+    tcg_gen_addi_i32(QREG_SP, src, 4);
+}
+
+DISAS_INSN(nop)
+{
+}
+
+DISAS_INSN(rts)
+{
+    TCGv tmp;
+
+    tmp = gen_load(s, OS_LONG, QREG_SP, 0);
+    tcg_gen_addi_i32(QREG_SP, QREG_SP, 4);
+    gen_jmp(s, tmp);
+}
+
+DISAS_INSN(jump)
+{
+    TCGv tmp;
+
+    /* Load the target address first to ensure correct exception
+       behavior.  */
+    tmp = gen_lea(env, s, insn, OS_LONG);
+    if (IS_NULL_QREG(tmp)) {
+        gen_addr_fault(s);
+        return;
+    }
+    if ((insn & 0x40) == 0) {
+        /* jsr */
+        gen_push(s, tcg_const_i32(s->pc));
+    }
+    gen_jmp(s, tmp);
+}
+
+DISAS_INSN(addsubq)
+{
+    TCGv src1;
+    TCGv src2;
+    TCGv dest;
+    int val;
+    TCGv addr;
+
+    SRC_EA(env, src1, OS_LONG, 0, &addr);
+    val = (insn >> 9) & 7;
+    if (val == 0)
+        val = 8;
+    dest = tcg_temp_new();
+    tcg_gen_mov_i32(dest, src1);
+    if ((insn & 0x38) == 0x08) {
+        /* Don't update condition codes if the destination is an
+           address register.  */
+        if (insn & 0x0100) {
+            tcg_gen_subi_i32(dest, dest, val);
+        } else {
+            tcg_gen_addi_i32(dest, dest, val);
+        }
+    } else {
+        src2 = tcg_const_i32(val);
+        if (insn & 0x0100) {
+            gen_helper_xflag_lt(QREG_CC_X, dest, src2);
+            tcg_gen_subi_i32(dest, dest, val);
+            s->cc_op = CC_OP_SUB;
+        } else {
+            tcg_gen_addi_i32(dest, dest, val);
+            gen_helper_xflag_lt(QREG_CC_X, dest, src2);
+            s->cc_op = CC_OP_ADD;
+        }
+        gen_update_cc_add(dest, src2);
+    }
+    DEST_EA(env, insn, OS_LONG, dest, &addr);
+}
+
+DISAS_INSN(tpf)
+{
+    switch (insn & 7) {
+    case 2: /* One extension word.  */
+        s->pc += 2;
+        break;
+    case 3: /* Two extension words.  */
+        s->pc += 4;
+        break;
+    case 4: /* No extension words.  */
+        break;
+    default:
+        disas_undef(env, s, insn);
+    }
+}
+
+DISAS_INSN(branch)
+{
+    int32_t offset;
+    uint32_t base;
+    int op;
+    TCGLabel *l1;
+
+    base = s->pc;
+    op = (insn >> 8) & 0xf;
+    offset = (int8_t)insn;
+    if (offset == 0) {
+        offset = cpu_ldsw_code(env, s->pc);
+        s->pc += 2;
+    } else if (offset == -1) {
+        offset = read_im32(env, s);
+    }
+    if (op == 1) {
+        /* bsr */
+        gen_push(s, tcg_const_i32(s->pc));
+    }
+    gen_flush_cc_op(s);
+    if (op > 1) {
+        /* Bcc */
+        l1 = gen_new_label();
+        gen_jmpcc(s, ((insn >> 8) & 0xf) ^ 1, l1);
+        gen_jmp_tb(s, 1, base + offset);
+        gen_set_label(l1);
+        gen_jmp_tb(s, 0, s->pc);
+    } else {
+        /* Unconditional branch.  */
+        gen_jmp_tb(s, 0, base + offset);
+    }
+}
+
+DISAS_INSN(moveq)
+{
+    uint32_t val;
+
+    val = (int8_t)insn;
+    tcg_gen_movi_i32(DREG(insn, 9), val);
+    gen_logic_cc(s, tcg_const_i32(val));
+}
+
+DISAS_INSN(mvzs)
+{
+    int opsize;
+    TCGv src;
+    TCGv reg;
+
+    if (insn & 0x40)
+        opsize = OS_WORD;
+    else
+        opsize = OS_BYTE;
+    SRC_EA(env, src, opsize, (insn & 0x80) == 0, NULL);
+    reg = DREG(insn, 9);
+    tcg_gen_mov_i32(reg, src);
+    gen_logic_cc(s, src);
+}
+
+DISAS_INSN(or)
+{
+    TCGv reg;
+    TCGv dest;
+    TCGv src;
+    TCGv addr;
+
+    reg = DREG(insn, 9);
+    dest = tcg_temp_new();
+    if (insn & 0x100) {
+        SRC_EA(env, src, OS_LONG, 0, &addr);
+        tcg_gen_or_i32(dest, src, reg);
+        DEST_EA(env, insn, OS_LONG, dest, &addr);
+    } else {
+        SRC_EA(env, src, OS_LONG, 0, NULL);
+        tcg_gen_or_i32(dest, src, reg);
+        tcg_gen_mov_i32(reg, dest);
+    }
+    gen_logic_cc(s, dest);
+}
+
+DISAS_INSN(suba)
+{
+    TCGv src;
+    TCGv reg;
+
+    SRC_EA(env, src, OS_LONG, 0, NULL);
+    reg = AREG(insn, 9);
+    tcg_gen_sub_i32(reg, reg, src);
+}
+
+DISAS_INSN(subx)
+{
+    TCGv reg;
+    TCGv src;
+
+    gen_flush_flags(s);
+    reg = DREG(insn, 9);
+    src = DREG(insn, 0);
+    gen_helper_subx_cc(reg, cpu_env, reg, src);
+}
+
+DISAS_INSN(mov3q)
+{
+    TCGv src;
+    int val;
+
+    val = (insn >> 9) & 7;
+    if (val == 0)
+        val = -1;
+    src = tcg_const_i32(val);
+    gen_logic_cc(s, src);
+    DEST_EA(env, insn, OS_LONG, src, NULL);
+}
+
+DISAS_INSN(cmp)
+{
+    int op;
+    TCGv src;
+    TCGv reg;
+    TCGv dest;
+    int opsize;
+
+    op = (insn >> 6) & 3;
+    switch (op) {
+    case 0: /* cmp.b */
+        opsize = OS_BYTE;
+        s->cc_op = CC_OP_CMPB;
+        break;
+    case 1: /* cmp.w */
+        opsize = OS_WORD;
+        s->cc_op = CC_OP_CMPW;
+        break;
+    case 2: /* cmp.l */
+        opsize = OS_LONG;
+        s->cc_op = CC_OP_SUB;
+        break;
+    default:
+        abort();
+    }
+    SRC_EA(env, src, opsize, 1, NULL);
+    reg = DREG(insn, 9);
+    dest = tcg_temp_new();
+    tcg_gen_sub_i32(dest, reg, src);
+    gen_update_cc_add(dest, src);
+}
+
+DISAS_INSN(cmpa)
+{
+    int opsize;
+    TCGv src;
+    TCGv reg;
+    TCGv dest;
+
+    if (insn & 0x100) {
+        opsize = OS_LONG;
+    } else {
+        opsize = OS_WORD;
+    }
+    SRC_EA(env, src, opsize, 1, NULL);
+    reg = AREG(insn, 9);
+    dest = tcg_temp_new();
+    tcg_gen_sub_i32(dest, reg, src);
+    gen_update_cc_add(dest, src);
+    s->cc_op = CC_OP_SUB;
+}
+
+DISAS_INSN(eor)
+{
+    TCGv src;
+    TCGv reg;
+    TCGv dest;
+    TCGv addr;
+
+    SRC_EA(env, src, OS_LONG, 0, &addr);
+    reg = DREG(insn, 9);
+    dest = tcg_temp_new();
+    tcg_gen_xor_i32(dest, src, reg);
+    gen_logic_cc(s, dest);
+    DEST_EA(env, insn, OS_LONG, dest, &addr);
+}
+
+DISAS_INSN(and)
+{
+    TCGv src;
+    TCGv reg;
+    TCGv dest;
+    TCGv addr;
+
+    reg = DREG(insn, 9);
+    dest = tcg_temp_new();
+    if (insn & 0x100) {
+        SRC_EA(env, src, OS_LONG, 0, &addr);
+        tcg_gen_and_i32(dest, src, reg);
+        DEST_EA(env, insn, OS_LONG, dest, &addr);
+    } else {
+        SRC_EA(env, src, OS_LONG, 0, NULL);
+        tcg_gen_and_i32(dest, src, reg);
+        tcg_gen_mov_i32(reg, dest);
+    }
+    gen_logic_cc(s, dest);
+}
+
+DISAS_INSN(adda)
+{
+    TCGv src;
+    TCGv reg;
+
+    SRC_EA(env, src, OS_LONG, 0, NULL);
+    reg = AREG(insn, 9);
+    tcg_gen_add_i32(reg, reg, src);
+}
+
+DISAS_INSN(addx)
+{
+    TCGv reg;
+    TCGv src;
+
+    gen_flush_flags(s);
+    reg = DREG(insn, 9);
+    src = DREG(insn, 0);
+    gen_helper_addx_cc(reg, cpu_env, reg, src);
+    s->cc_op = CC_OP_FLAGS;
+}
+
+/* TODO: This could be implemented without helper functions.  */
+DISAS_INSN(shift_im)
+{
+    TCGv reg;
+    int tmp;
+    TCGv shift;
+
+    reg = DREG(insn, 0);
+    tmp = (insn >> 9) & 7;
+    if (tmp == 0)
+        tmp = 8;
+    shift = tcg_const_i32(tmp);
+    /* No need to flush flags becuse we know we will set C flag.  */
+    if (insn & 0x100) {
+        gen_helper_shl_cc(reg, cpu_env, reg, shift);
+    } else {
+        if (insn & 8) {
+            gen_helper_shr_cc(reg, cpu_env, reg, shift);
+        } else {
+            gen_helper_sar_cc(reg, cpu_env, reg, shift);
+        }
+    }
+    s->cc_op = CC_OP_SHIFT;
+}
+
+DISAS_INSN(shift_reg)
+{
+    TCGv reg;
+    TCGv shift;
+
+    reg = DREG(insn, 0);
+    shift = DREG(insn, 9);
+    /* Shift by zero leaves C flag unmodified.   */
+    gen_flush_flags(s);
+    if (insn & 0x100) {
+        gen_helper_shl_cc(reg, cpu_env, reg, shift);
+    } else {
+        if (insn & 8) {
+            gen_helper_shr_cc(reg, cpu_env, reg, shift);
+        } else {
+            gen_helper_sar_cc(reg, cpu_env, reg, shift);
+        }
+    }
+    s->cc_op = CC_OP_SHIFT;
+}
+
+DISAS_INSN(ff1)
+{
+    TCGv reg;
+    reg = DREG(insn, 0);
+    gen_logic_cc(s, reg);
+    gen_helper_ff1(reg, reg);
+}
+
+static TCGv gen_get_sr(DisasContext *s)
+{
+    TCGv ccr;
+    TCGv sr;
+
+    ccr = gen_get_ccr(s);
+    sr = tcg_temp_new();
+    tcg_gen_andi_i32(sr, QREG_SR, 0xffe0);
+    tcg_gen_or_i32(sr, sr, ccr);
+    return sr;
+}
+
+DISAS_INSN(strldsr)
+{
+    uint16_t ext;
+    uint32_t addr;
+
+    addr = s->pc - 2;
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    if (ext != 0x46FC) {
+        gen_exception(s, addr, EXCP_UNSUPPORTED);
+        return;
+    }
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    if (IS_USER(s) || (ext & SR_S) == 0) {
+        gen_exception(s, addr, EXCP_PRIVILEGE);
+        return;
+    }
+    gen_push(s, gen_get_sr(s));
+    gen_set_sr_im(s, ext, 0);
+}
+
+DISAS_INSN(move_from_sr)
+{
+    TCGv reg;
+    TCGv sr;
+
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    sr = gen_get_sr(s);
+    reg = DREG(insn, 0);
+    gen_partset_reg(OS_WORD, reg, sr);
+}
+
+DISAS_INSN(move_to_sr)
+{
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    gen_set_sr(env, s, insn, 0);
+    gen_lookup_tb(s);
+}
+
+DISAS_INSN(move_from_usp)
+{
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    tcg_gen_ld_i32(AREG(insn, 0), cpu_env,
+                   offsetof(CPUM68KState, sp[M68K_USP]));
+}
+
+DISAS_INSN(move_to_usp)
+{
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    tcg_gen_st_i32(AREG(insn, 0), cpu_env,
+                   offsetof(CPUM68KState, sp[M68K_USP]));
+}
+
+DISAS_INSN(halt)
+{
+    gen_exception(s, s->pc, EXCP_HALT_INSN);
+}
+
+DISAS_INSN(stop)
+{
+    uint16_t ext;
+
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+
+    gen_set_sr_im(s, ext, 0);
+    tcg_gen_movi_i32(cpu_halted, 1);
+    gen_exception(s, s->pc, EXCP_HLT);
+}
+
+DISAS_INSN(rte)
+{
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    gen_exception(s, s->pc - 2, EXCP_RTE);
+}
+
+DISAS_INSN(movec)
+{
+    uint16_t ext;
+    TCGv reg;
+
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+
+    if (ext & 0x8000) {
+        reg = AREG(ext, 12);
+    } else {
+        reg = DREG(ext, 12);
+    }
+    gen_helper_movec(cpu_env, tcg_const_i32(ext & 0xfff), reg);
+    gen_lookup_tb(s);
+}
+
+DISAS_INSN(intouch)
+{
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    /* ICache fetch.  Implement as no-op.  */
+}
+
+DISAS_INSN(cpushl)
+{
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    /* Cache push/invalidate.  Implement as no-op.  */
+}
+
+DISAS_INSN(wddata)
+{
+    gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+}
+
+DISAS_INSN(wdebug)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+
+    if (IS_USER(s)) {
+        gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);
+        return;
+    }
+    /* TODO: Implement wdebug.  */
+    cpu_abort(CPU(cpu), "WDEBUG not implemented");
+}
+
+DISAS_INSN(trap)
+{
+    gen_exception(s, s->pc - 2, EXCP_TRAP0 + (insn & 0xf));
+}
+
+/* ??? FP exceptions are not implemented.  Most exceptions are deferred until
+   immediately before the next FP instruction is executed.  */
+DISAS_INSN(fpu)
+{
+    uint16_t ext;
+    int32_t offset;
+    int opmode;
+    TCGv_i64 src;
+    TCGv_i64 dest;
+    TCGv_i64 res;
+    TCGv tmp32;
+    int round;
+    int set_dest;
+    int opsize;
+
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+    opmode = ext & 0x7f;
+    switch ((ext >> 13) & 7) {
+    case 0: case 2:
+        break;
+    case 1:
+        goto undef;
+    case 3: /* fmove out */
+        src = FREG(ext, 7);
+        tmp32 = tcg_temp_new_i32();
+        /* fmove */
+        /* ??? TODO: Proper behavior on overflow.  */
+        switch ((ext >> 10) & 7) {
+        case 0:
+            opsize = OS_LONG;
+            gen_helper_f64_to_i32(tmp32, cpu_env, src);
+            break;
+        case 1:
+            opsize = OS_SINGLE;
+            gen_helper_f64_to_f32(tmp32, cpu_env, src);
+            break;
+        case 4:
+            opsize = OS_WORD;
+            gen_helper_f64_to_i32(tmp32, cpu_env, src);
+            break;
+        case 5: /* OS_DOUBLE */
+            tcg_gen_mov_i32(tmp32, AREG(insn, 0));
+            switch ((insn >> 3) & 7) {
+            case 2:
+            case 3:
+                break;
+            case 4:
+                tcg_gen_addi_i32(tmp32, tmp32, -8);
+                break;
+            case 5:
+                offset = cpu_ldsw_code(env, s->pc);
+                s->pc += 2;
+                tcg_gen_addi_i32(tmp32, tmp32, offset);
+                break;
+            default:
+                goto undef;
+            }
+            gen_store64(s, tmp32, src);
+            switch ((insn >> 3) & 7) {
+            case 3:
+                tcg_gen_addi_i32(tmp32, tmp32, 8);
+                tcg_gen_mov_i32(AREG(insn, 0), tmp32);
+                break;
+            case 4:
+                tcg_gen_mov_i32(AREG(insn, 0), tmp32);
+                break;
+            }
+            tcg_temp_free_i32(tmp32);
+            return;
+        case 6:
+            opsize = OS_BYTE;
+            gen_helper_f64_to_i32(tmp32, cpu_env, src);
+            break;
+        default:
+            goto undef;
+        }
+        DEST_EA(env, insn, opsize, tmp32, NULL);
+        tcg_temp_free_i32(tmp32);
+        return;
+    case 4: /* fmove to control register.  */
+        switch ((ext >> 10) & 7) {
+        case 4: /* FPCR */
+            /* Not implemented.  Ignore writes.  */
+            break;
+        case 1: /* FPIAR */
+        case 2: /* FPSR */
+        default:
+            cpu_abort(NULL, "Unimplemented: fmove to control %d",
+                      (ext >> 10) & 7);
+        }
+        break;
+    case 5: /* fmove from control register.  */
+        switch ((ext >> 10) & 7) {
+        case 4: /* FPCR */
+            /* Not implemented.  Always return zero.  */
+            tmp32 = tcg_const_i32(0);
+            break;
+        case 1: /* FPIAR */
+        case 2: /* FPSR */
+        default:
+            cpu_abort(NULL, "Unimplemented: fmove from control %d",
+                      (ext >> 10) & 7);
+            goto undef;
+        }
+        DEST_EA(env, insn, OS_LONG, tmp32, NULL);
+        break;
+    case 6: /* fmovem */
+    case 7:
+        {
+            TCGv addr;
+            uint16_t mask;
+            int i;
+            if ((ext & 0x1f00) != 0x1000 || (ext & 0xff) == 0)
+                goto undef;
+            tmp32 = gen_lea(env, s, insn, OS_LONG);
+            if (IS_NULL_QREG(tmp32)) {
+                gen_addr_fault(s);
+                return;
+            }
+            addr = tcg_temp_new_i32();
+            tcg_gen_mov_i32(addr, tmp32);
+            mask = 0x80;
+            for (i = 0; i < 8; i++) {
+                if (ext & mask) {
+                    dest = FREG(i, 0);
+                    if (ext & (1 << 13)) {
+                        /* store */
+                        tcg_gen_qemu_stf64(dest, addr, IS_USER(s));
+                    } else {
+                        /* load */
+                        tcg_gen_qemu_ldf64(dest, addr, IS_USER(s));
+                    }
+                    if (ext & (mask - 1))
+                        tcg_gen_addi_i32(addr, addr, 8);
+                }
+                mask >>= 1;
+            }
+            tcg_temp_free_i32(addr);
+        }
+        return;
+    }
+    if (ext & (1 << 14)) {
+        /* Source effective address.  */
+        switch ((ext >> 10) & 7) {
+        case 0: opsize = OS_LONG; break;
+        case 1: opsize = OS_SINGLE; break;
+        case 4: opsize = OS_WORD; break;
+        case 5: opsize = OS_DOUBLE; break;
+        case 6: opsize = OS_BYTE; break;
+        default:
+            goto undef;
+        }
+        if (opsize == OS_DOUBLE) {
+            tmp32 = tcg_temp_new_i32();
+            tcg_gen_mov_i32(tmp32, AREG(insn, 0));
+            switch ((insn >> 3) & 7) {
+            case 2:
+            case 3:
+                break;
+            case 4:
+                tcg_gen_addi_i32(tmp32, tmp32, -8);
+                break;
+            case 5:
+                offset = cpu_ldsw_code(env, s->pc);
+                s->pc += 2;
+                tcg_gen_addi_i32(tmp32, tmp32, offset);
+                break;
+            case 7:
+                offset = cpu_ldsw_code(env, s->pc);
+                offset += s->pc - 2;
+                s->pc += 2;
+                tcg_gen_addi_i32(tmp32, tmp32, offset);
+                break;
+            default:
+                goto undef;
+            }
+            src = gen_load64(s, tmp32);
+            switch ((insn >> 3) & 7) {
+            case 3:
+                tcg_gen_addi_i32(tmp32, tmp32, 8);
+                tcg_gen_mov_i32(AREG(insn, 0), tmp32);
+                break;
+            case 4:
+                tcg_gen_mov_i32(AREG(insn, 0), tmp32);
+                break;
+            }
+            tcg_temp_free_i32(tmp32);
+        } else {
+            SRC_EA(env, tmp32, opsize, 1, NULL);
+            src = tcg_temp_new_i64();
+            switch (opsize) {
+            case OS_LONG:
+            case OS_WORD:
+            case OS_BYTE:
+                gen_helper_i32_to_f64(src, cpu_env, tmp32);
+                break;
+            case OS_SINGLE:
+                gen_helper_f32_to_f64(src, cpu_env, tmp32);
+                break;
+            }
+        }
+    } else {
+        /* Source register.  */
+        src = FREG(ext, 10);
+    }
+    dest = FREG(ext, 7);
+    res = tcg_temp_new_i64();
+    if (opmode != 0x3a)
+        tcg_gen_mov_f64(res, dest);
+    round = 1;
+    set_dest = 1;
+    switch (opmode) {
+    case 0: case 0x40: case 0x44: /* fmove */
+        tcg_gen_mov_f64(res, src);
+        break;
+    case 1: /* fint */
+        gen_helper_iround_f64(res, cpu_env, src);
+        round = 0;
+        break;
+    case 3: /* fintrz */
+        gen_helper_itrunc_f64(res, cpu_env, src);
+        round = 0;
+        break;
+    case 4: case 0x41: case 0x45: /* fsqrt */
+        gen_helper_sqrt_f64(res, cpu_env, src);
+        break;
+    case 0x18: case 0x58: case 0x5c: /* fabs */
+        gen_helper_abs_f64(res, src);
+        break;
+    case 0x1a: case 0x5a: case 0x5e: /* fneg */
+        gen_helper_chs_f64(res, src);
+        break;
+    case 0x20: case 0x60: case 0x64: /* fdiv */
+        gen_helper_div_f64(res, cpu_env, res, src);
+        break;
+    case 0x22: case 0x62: case 0x66: /* fadd */
+        gen_helper_add_f64(res, cpu_env, res, src);
+        break;
+    case 0x23: case 0x63: case 0x67: /* fmul */
+        gen_helper_mul_f64(res, cpu_env, res, src);
+        break;
+    case 0x28: case 0x68: case 0x6c: /* fsub */
+        gen_helper_sub_f64(res, cpu_env, res, src);
+        break;
+    case 0x38: /* fcmp */
+        gen_helper_sub_cmp_f64(res, cpu_env, res, src);
+        set_dest = 0;
+        round = 0;
+        break;
+    case 0x3a: /* ftst */
+        tcg_gen_mov_f64(res, src);
+        set_dest = 0;
+        round = 0;
+        break;
+    default:
+        goto undef;
+    }
+    if (ext & (1 << 14)) {
+        tcg_temp_free_i64(src);
+    }
+    if (round) {
+        if (opmode & 0x40) {
+            if ((opmode & 0x4) != 0)
+                round = 0;
+        } else if ((s->fpcr & M68K_FPCR_PREC) == 0) {
+            round = 0;
+        }
+    }
+    if (round) {
+        TCGv tmp = tcg_temp_new_i32();
+        gen_helper_f64_to_f32(tmp, cpu_env, res);
+        gen_helper_f32_to_f64(res, cpu_env, tmp);
+        tcg_temp_free_i32(tmp);
+    }
+    tcg_gen_mov_f64(QREG_FP_RESULT, res);
+    if (set_dest) {
+        tcg_gen_mov_f64(dest, res);
+    }
+    tcg_temp_free_i64(res);
+    return;
+undef:
+    /* FIXME: Is this right for offset addressing modes?  */
+    s->pc -= 2;
+    disas_undef_fpu(env, s, insn);
+}
+
+DISAS_INSN(fbcc)
+{
+    uint32_t offset;
+    uint32_t addr;
+    TCGv flag;
+    TCGLabel *l1;
+
+    addr = s->pc;
+    offset = cpu_ldsw_code(env, s->pc);
+    s->pc += 2;
+    if (insn & (1 << 6)) {
+        offset = (offset << 16) | cpu_lduw_code(env, s->pc);
+        s->pc += 2;
+    }
+
+    l1 = gen_new_label();
+    /* TODO: Raise BSUN exception.  */
+    flag = tcg_temp_new();
+    gen_helper_compare_f64(flag, cpu_env, QREG_FP_RESULT);
+    /* Jump to l1 if condition is true.  */
+    switch (insn & 0xf) {
+    case 0: /* f */
+        break;
+    case 1: /* eq (=0) */
+        tcg_gen_brcond_i32(TCG_COND_EQ, flag, tcg_const_i32(0), l1);
+        break;
+    case 2: /* ogt (=1) */
+        tcg_gen_brcond_i32(TCG_COND_EQ, flag, tcg_const_i32(1), l1);
+        break;
+    case 3: /* oge (=0 or =1) */
+        tcg_gen_brcond_i32(TCG_COND_LEU, flag, tcg_const_i32(1), l1);
+        break;
+    case 4: /* olt (=-1) */
+        tcg_gen_brcond_i32(TCG_COND_LT, flag, tcg_const_i32(0), l1);
+        break;
+    case 5: /* ole (=-1 or =0) */
+        tcg_gen_brcond_i32(TCG_COND_LE, flag, tcg_const_i32(0), l1);
+        break;
+    case 6: /* ogl (=-1 or =1) */
+        tcg_gen_andi_i32(flag, flag, 1);
+        tcg_gen_brcond_i32(TCG_COND_NE, flag, tcg_const_i32(0), l1);
+        break;
+    case 7: /* or (=2) */
+        tcg_gen_brcond_i32(TCG_COND_EQ, flag, tcg_const_i32(2), l1);
+        break;
+    case 8: /* un (<2) */
+        tcg_gen_brcond_i32(TCG_COND_LT, flag, tcg_const_i32(2), l1);
+        break;
+    case 9: /* ueq (=0 or =2) */
+        tcg_gen_andi_i32(flag, flag, 1);
+        tcg_gen_brcond_i32(TCG_COND_EQ, flag, tcg_const_i32(0), l1);
+        break;
+    case 10: /* ugt (>0) */
+        tcg_gen_brcond_i32(TCG_COND_GT, flag, tcg_const_i32(0), l1);
+        break;
+    case 11: /* uge (>=0) */
+        tcg_gen_brcond_i32(TCG_COND_GE, flag, tcg_const_i32(0), l1);
+        break;
+    case 12: /* ult (=-1 or =2) */
+        tcg_gen_brcond_i32(TCG_COND_GEU, flag, tcg_const_i32(2), l1);
+        break;
+    case 13: /* ule (!=1) */
+        tcg_gen_brcond_i32(TCG_COND_NE, flag, tcg_const_i32(1), l1);
+        break;
+    case 14: /* ne (!=0) */
+        tcg_gen_brcond_i32(TCG_COND_NE, flag, tcg_const_i32(0), l1);
+        break;
+    case 15: /* t */
+        tcg_gen_br(l1);
+        break;
+    }
+    gen_jmp_tb(s, 0, s->pc);
+    gen_set_label(l1);
+    gen_jmp_tb(s, 1, addr + offset);
+}
+
+DISAS_INSN(frestore)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+
+    /* TODO: Implement frestore.  */
+    cpu_abort(CPU(cpu), "FRESTORE not implemented");
+}
+
+DISAS_INSN(fsave)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+
+    /* TODO: Implement fsave.  */
+    cpu_abort(CPU(cpu), "FSAVE not implemented");
+}
+
+static inline TCGv gen_mac_extract_word(DisasContext *s, TCGv val, int upper)
+{
+    TCGv tmp = tcg_temp_new();
+    if (s->env->macsr & MACSR_FI) {
+        if (upper)
+            tcg_gen_andi_i32(tmp, val, 0xffff0000);
+        else
+            tcg_gen_shli_i32(tmp, val, 16);
+    } else if (s->env->macsr & MACSR_SU) {
+        if (upper)
+            tcg_gen_sari_i32(tmp, val, 16);
+        else
+            tcg_gen_ext16s_i32(tmp, val);
+    } else {
+        if (upper)
+            tcg_gen_shri_i32(tmp, val, 16);
+        else
+            tcg_gen_ext16u_i32(tmp, val);
+    }
+    return tmp;
+}
+
+static void gen_mac_clear_flags(void)
+{
+    tcg_gen_andi_i32(QREG_MACSR, QREG_MACSR,
+                     ~(MACSR_V | MACSR_Z | MACSR_N | MACSR_EV));
+}
+
+DISAS_INSN(mac)
+{
+    TCGv rx;
+    TCGv ry;
+    uint16_t ext;
+    int acc;
+    TCGv tmp;
+    TCGv addr;
+    TCGv loadval;
+    int dual;
+    TCGv saved_flags;
+
+    if (!s->done_mac) {
+        s->mactmp = tcg_temp_new_i64();
+        s->done_mac = 1;
+    }
+
+    ext = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+
+    acc = ((insn >> 7) & 1) | ((ext >> 3) & 2);
+    dual = ((insn & 0x30) != 0 && (ext & 3) != 0);
+    if (dual && !m68k_feature(s->env, M68K_FEATURE_CF_EMAC_B)) {
+        disas_undef(env, s, insn);
+        return;
+    }
+    if (insn & 0x30) {
+        /* MAC with load.  */
+        tmp = gen_lea(env, s, insn, OS_LONG);
+        addr = tcg_temp_new();
+        tcg_gen_and_i32(addr, tmp, QREG_MAC_MASK);
+        /* Load the value now to ensure correct exception behavior.
+           Perform writeback after reading the MAC inputs.  */
+        loadval = gen_load(s, OS_LONG, addr, 0);
+
+        acc ^= 1;
+        rx = (ext & 0x8000) ? AREG(ext, 12) : DREG(insn, 12);
+        ry = (ext & 8) ? AREG(ext, 0) : DREG(ext, 0);
+    } else {
+        loadval = addr = NULL_QREG;
+        rx = (insn & 0x40) ? AREG(insn, 9) : DREG(insn, 9);
+        ry = (insn & 8) ? AREG(insn, 0) : DREG(insn, 0);
+    }
+
+    gen_mac_clear_flags();
+#if 0
+    l1 = -1;
+    /* Disabled because conditional branches clobber temporary vars.  */
+    if ((s->env->macsr & MACSR_OMC) != 0 && !dual) {
+        /* Skip the multiply if we know we will ignore it.  */
+        l1 = gen_new_label();
+        tmp = tcg_temp_new();
+        tcg_gen_andi_i32(tmp, QREG_MACSR, 1 << (acc + 8));
+        gen_op_jmp_nz32(tmp, l1);
+    }
+#endif
+
+    if ((ext & 0x0800) == 0) {
+        /* Word.  */
+        rx = gen_mac_extract_word(s, rx, (ext & 0x80) != 0);
+        ry = gen_mac_extract_word(s, ry, (ext & 0x40) != 0);
+    }
+    if (s->env->macsr & MACSR_FI) {
+        gen_helper_macmulf(s->mactmp, cpu_env, rx, ry);
+    } else {
+        if (s->env->macsr & MACSR_SU)
+            gen_helper_macmuls(s->mactmp, cpu_env, rx, ry);
+        else
+            gen_helper_macmulu(s->mactmp, cpu_env, rx, ry);
+        switch ((ext >> 9) & 3) {
+        case 1:
+            tcg_gen_shli_i64(s->mactmp, s->mactmp, 1);
+            break;
+        case 3:
+            tcg_gen_shri_i64(s->mactmp, s->mactmp, 1);
+            break;
+        }
+    }
+
+    if (dual) {
+        /* Save the overflow flag from the multiply.  */
+        saved_flags = tcg_temp_new();
+        tcg_gen_mov_i32(saved_flags, QREG_MACSR);
+    } else {
+        saved_flags = NULL_QREG;
+    }
+
+#if 0
+    /* Disabled because conditional branches clobber temporary vars.  */
+    if ((s->env->macsr & MACSR_OMC) != 0 && dual) {
+        /* Skip the accumulate if the value is already saturated.  */
+        l1 = gen_new_label();
+        tmp = tcg_temp_new();
+        gen_op_and32(tmp, QREG_MACSR, tcg_const_i32(MACSR_PAV0 << acc));
+        gen_op_jmp_nz32(tmp, l1);
+    }
+#endif
+
+    if (insn & 0x100)
+        tcg_gen_sub_i64(MACREG(acc), MACREG(acc), s->mactmp);
+    else
+        tcg_gen_add_i64(MACREG(acc), MACREG(acc), s->mactmp);
+
+    if (s->env->macsr & MACSR_FI)
+        gen_helper_macsatf(cpu_env, tcg_const_i32(acc));
+    else if (s->env->macsr & MACSR_SU)
+        gen_helper_macsats(cpu_env, tcg_const_i32(acc));
+    else
+        gen_helper_macsatu(cpu_env, tcg_const_i32(acc));
+
+#if 0
+    /* Disabled because conditional branches clobber temporary vars.  */
+    if (l1 != -1)
+        gen_set_label(l1);
+#endif
+
+    if (dual) {
+        /* Dual accumulate variant.  */
+        acc = (ext >> 2) & 3;
+        /* Restore the overflow flag from the multiplier.  */
+        tcg_gen_mov_i32(QREG_MACSR, saved_flags);
+#if 0
+        /* Disabled because conditional branches clobber temporary vars.  */
+        if ((s->env->macsr & MACSR_OMC) != 0) {
+            /* Skip the accumulate if the value is already saturated.  */
+            l1 = gen_new_label();
+            tmp = tcg_temp_new();
+            gen_op_and32(tmp, QREG_MACSR, tcg_const_i32(MACSR_PAV0 << acc));
+            gen_op_jmp_nz32(tmp, l1);
+        }
+#endif
+        if (ext & 2)
+            tcg_gen_sub_i64(MACREG(acc), MACREG(acc), s->mactmp);
+        else
+            tcg_gen_add_i64(MACREG(acc), MACREG(acc), s->mactmp);
+        if (s->env->macsr & MACSR_FI)
+            gen_helper_macsatf(cpu_env, tcg_const_i32(acc));
+        else if (s->env->macsr & MACSR_SU)
+            gen_helper_macsats(cpu_env, tcg_const_i32(acc));
+        else
+            gen_helper_macsatu(cpu_env, tcg_const_i32(acc));
+#if 0
+        /* Disabled because conditional branches clobber temporary vars.  */
+        if (l1 != -1)
+            gen_set_label(l1);
+#endif
+    }
+    gen_helper_mac_set_flags(cpu_env, tcg_const_i32(acc));
+
+    if (insn & 0x30) {
+        TCGv rw;
+        rw = (insn & 0x40) ? AREG(insn, 9) : DREG(insn, 9);
+        tcg_gen_mov_i32(rw, loadval);
+        /* FIXME: Should address writeback happen with the masked or
+           unmasked value?  */
+        switch ((insn >> 3) & 7) {
+        case 3: /* Post-increment.  */
+            tcg_gen_addi_i32(AREG(insn, 0), addr, 4);
+            break;
+        case 4: /* Pre-decrement.  */
+            tcg_gen_mov_i32(AREG(insn, 0), addr);
+        }
+    }
+}
+
+DISAS_INSN(from_mac)
+{
+    TCGv rx;
+    TCGv_i64 acc;
+    int accnum;
+
+    rx = (insn & 8) ? AREG(insn, 0) : DREG(insn, 0);
+    accnum = (insn >> 9) & 3;
+    acc = MACREG(accnum);
+    if (s->env->macsr & MACSR_FI) {
+        gen_helper_get_macf(rx, cpu_env, acc);
+    } else if ((s->env->macsr & MACSR_OMC) == 0) {
+        tcg_gen_extrl_i64_i32(rx, acc);
+    } else if (s->env->macsr & MACSR_SU) {
+        gen_helper_get_macs(rx, acc);
+    } else {
+        gen_helper_get_macu(rx, acc);
+    }
+    if (insn & 0x40) {
+        tcg_gen_movi_i64(acc, 0);
+        tcg_gen_andi_i32(QREG_MACSR, QREG_MACSR, ~(MACSR_PAV0 << accnum));
+    }
+}
+
+DISAS_INSN(move_mac)
+{
+    /* FIXME: This can be done without a helper.  */
+    int src;
+    TCGv dest;
+    src = insn & 3;
+    dest = tcg_const_i32((insn >> 9) & 3);
+    gen_helper_mac_move(cpu_env, dest, tcg_const_i32(src));
+    gen_mac_clear_flags();
+    gen_helper_mac_set_flags(cpu_env, dest);
+}
+
+DISAS_INSN(from_macsr)
+{
+    TCGv reg;
+
+    reg = (insn & 8) ? AREG(insn, 0) : DREG(insn, 0);
+    tcg_gen_mov_i32(reg, QREG_MACSR);
+}
+
+DISAS_INSN(from_mask)
+{
+    TCGv reg;
+    reg = (insn & 8) ? AREG(insn, 0) : DREG(insn, 0);
+    tcg_gen_mov_i32(reg, QREG_MAC_MASK);
+}
+
+DISAS_INSN(from_mext)
+{
+    TCGv reg;
+    TCGv acc;
+    reg = (insn & 8) ? AREG(insn, 0) : DREG(insn, 0);
+    acc = tcg_const_i32((insn & 0x400) ? 2 : 0);
+    if (s->env->macsr & MACSR_FI)
+        gen_helper_get_mac_extf(reg, cpu_env, acc);
+    else
+        gen_helper_get_mac_exti(reg, cpu_env, acc);
+}
+
+DISAS_INSN(macsr_to_ccr)
+{
+    tcg_gen_movi_i32(QREG_CC_X, 0);
+    tcg_gen_andi_i32(QREG_CC_DEST, QREG_MACSR, 0xf);
+    s->cc_op = CC_OP_FLAGS;
+}
+
+DISAS_INSN(to_mac)
+{
+    TCGv_i64 acc;
+    TCGv val;
+    int accnum;
+    accnum = (insn >> 9) & 3;
+    acc = MACREG(accnum);
+    SRC_EA(env, val, OS_LONG, 0, NULL);
+    if (s->env->macsr & MACSR_FI) {
+        tcg_gen_ext_i32_i64(acc, val);
+        tcg_gen_shli_i64(acc, acc, 8);
+    } else if (s->env->macsr & MACSR_SU) {
+        tcg_gen_ext_i32_i64(acc, val);
+    } else {
+        tcg_gen_extu_i32_i64(acc, val);
+    }
+    tcg_gen_andi_i32(QREG_MACSR, QREG_MACSR, ~(MACSR_PAV0 << accnum));
+    gen_mac_clear_flags();
+    gen_helper_mac_set_flags(cpu_env, tcg_const_i32(accnum));
+}
+
+DISAS_INSN(to_macsr)
+{
+    TCGv val;
+    SRC_EA(env, val, OS_LONG, 0, NULL);
+    gen_helper_set_macsr(cpu_env, val);
+    gen_lookup_tb(s);
+}
+
+DISAS_INSN(to_mask)
+{
+    TCGv val;
+    SRC_EA(env, val, OS_LONG, 0, NULL);
+    tcg_gen_ori_i32(QREG_MAC_MASK, val, 0xffff0000);
+}
+
+DISAS_INSN(to_mext)
+{
+    TCGv val;
+    TCGv acc;
+    SRC_EA(env, val, OS_LONG, 0, NULL);
+    acc = tcg_const_i32((insn & 0x400) ? 2 : 0);
+    if (s->env->macsr & MACSR_FI)
+        gen_helper_set_mac_extf(cpu_env, val, acc);
+    else if (s->env->macsr & MACSR_SU)
+        gen_helper_set_mac_exts(cpu_env, val, acc);
+    else
+        gen_helper_set_mac_extu(cpu_env, val, acc);
+}
+
+static disas_proc opcode_table[65536];
+
+static void
+register_opcode (disas_proc proc, uint16_t opcode, uint16_t mask)
+{
+  int i;
+  int from;
+  int to;
+
+  /* Sanity check.  All set bits must be included in the mask.  */
+  if (opcode & ~mask) {
+      fprintf(stderr,
+              "qemu internal error: bogus opcode definition %04x/%04x\n",
+              opcode, mask);
+      abort();
+  }
+  /* This could probably be cleverer.  For now just optimize the case where
+     the top bits are known.  */
+  /* Find the first zero bit in the mask.  */
+  i = 0x8000;
+  while ((i & mask) != 0)
+      i >>= 1;
+  /* Iterate over all combinations of this and lower bits.  */
+  if (i == 0)
+      i = 1;
+  else
+      i <<= 1;
+  from = opcode & ~(i - 1);
+  to = from + i;
+  for (i = from; i < to; i++) {
+      if ((i & mask) == opcode)
+          opcode_table[i] = proc;
+  }
+}
+
+/* Register m68k opcode handlers.  Order is important.
+   Later insn override earlier ones.  */
+void register_m68k_insns (CPUM68KState *env)
+{
+#define INSN(name, opcode, mask, feature) do { \
+    if (m68k_feature(env, M68K_FEATURE_##feature)) \
+        register_opcode(disas_##name, 0x##opcode, 0x##mask); \
+    } while(0)
+    INSN(undef,     0000, 0000, CF_ISA_A);
+    INSN(arith_im,  0080, fff8, CF_ISA_A);
+    INSN(bitrev,    00c0, fff8, CF_ISA_APLUSC);
+    INSN(bitop_reg, 0100, f1c0, CF_ISA_A);
+    INSN(bitop_reg, 0140, f1c0, CF_ISA_A);
+    INSN(bitop_reg, 0180, f1c0, CF_ISA_A);
+    INSN(bitop_reg, 01c0, f1c0, CF_ISA_A);
+    INSN(arith_im,  0280, fff8, CF_ISA_A);
+    INSN(byterev,   02c0, fff8, CF_ISA_APLUSC);
+    INSN(arith_im,  0480, fff8, CF_ISA_A);
+    INSN(ff1,       04c0, fff8, CF_ISA_APLUSC);
+    INSN(arith_im,  0680, fff8, CF_ISA_A);
+    INSN(bitop_im,  0800, ffc0, CF_ISA_A);
+    INSN(bitop_im,  0840, ffc0, CF_ISA_A);
+    INSN(bitop_im,  0880, ffc0, CF_ISA_A);
+    INSN(bitop_im,  08c0, ffc0, CF_ISA_A);
+    INSN(arith_im,  0a80, fff8, CF_ISA_A);
+    INSN(arith_im,  0c00, ff38, CF_ISA_A);
+    INSN(move,      1000, f000, CF_ISA_A);
+    INSN(move,      2000, f000, CF_ISA_A);
+    INSN(move,      3000, f000, CF_ISA_A);
+    INSN(strldsr,   40e7, ffff, CF_ISA_APLUSC);
+    INSN(negx,      4080, fff8, CF_ISA_A);
+    INSN(move_from_sr, 40c0, fff8, CF_ISA_A);
+    INSN(lea,       41c0, f1c0, CF_ISA_A);
+    INSN(clr,       4200, ff00, CF_ISA_A);
+    INSN(undef,     42c0, ffc0, CF_ISA_A);
+    INSN(move_from_ccr, 42c0, fff8, CF_ISA_A);
+    INSN(neg,       4480, fff8, CF_ISA_A);
+    INSN(move_to_ccr, 44c0, ffc0, CF_ISA_A);
+    INSN(not,       4680, fff8, CF_ISA_A);
+    INSN(move_to_sr, 46c0, ffc0, CF_ISA_A);
+    INSN(pea,       4840, ffc0, CF_ISA_A);
+    INSN(swap,      4840, fff8, CF_ISA_A);
+    INSN(movem,     48c0, fbc0, CF_ISA_A);
+    INSN(ext,       4880, fff8, CF_ISA_A);
+    INSN(ext,       48c0, fff8, CF_ISA_A);
+    INSN(ext,       49c0, fff8, CF_ISA_A);
+    INSN(tst,       4a00, ff00, CF_ISA_A);
+    INSN(tas,       4ac0, ffc0, CF_ISA_B);
+    INSN(halt,      4ac8, ffff, CF_ISA_A);
+    INSN(pulse,     4acc, ffff, CF_ISA_A);
+    INSN(illegal,   4afc, ffff, CF_ISA_A);
+    INSN(mull,      4c00, ffc0, CF_ISA_A);
+    INSN(divl,      4c40, ffc0, CF_ISA_A);
+    INSN(sats,      4c80, fff8, CF_ISA_B);
+    INSN(trap,      4e40, fff0, CF_ISA_A);
+    INSN(link,      4e50, fff8, CF_ISA_A);
+    INSN(unlk,      4e58, fff8, CF_ISA_A);
+    INSN(move_to_usp, 4e60, fff8, USP);
+    INSN(move_from_usp, 4e68, fff8, USP);
+    INSN(nop,       4e71, ffff, CF_ISA_A);
+    INSN(stop,      4e72, ffff, CF_ISA_A);
+    INSN(rte,       4e73, ffff, CF_ISA_A);
+    INSN(rts,       4e75, ffff, CF_ISA_A);
+    INSN(movec,     4e7b, ffff, CF_ISA_A);
+    INSN(jump,      4e80, ffc0, CF_ISA_A);
+    INSN(jump,      4ec0, ffc0, CF_ISA_A);
+    INSN(addsubq,   5180, f1c0, CF_ISA_A);
+    INSN(scc,       50c0, f0f8, CF_ISA_A);
+    INSN(addsubq,   5080, f1c0, CF_ISA_A);
+    INSN(tpf,       51f8, fff8, CF_ISA_A);
+
+    /* Branch instructions.  */
+    INSN(branch,    6000, f000, CF_ISA_A);
+    /* Disable long branch instructions, then add back the ones we want.  */
+    INSN(undef,     60ff, f0ff, CF_ISA_A); /* All long branches.  */
+    INSN(branch,    60ff, f0ff, CF_ISA_B);
+    INSN(undef,     60ff, ffff, CF_ISA_B); /* bra.l */
+    INSN(branch,    60ff, ffff, BRAL);
+
+    INSN(moveq,     7000, f100, CF_ISA_A);
+    INSN(mvzs,      7100, f100, CF_ISA_B);
+    INSN(or,        8000, f000, CF_ISA_A);
+    INSN(divw,      80c0, f0c0, CF_ISA_A);
+    INSN(addsub,    9000, f000, CF_ISA_A);
+    INSN(subx,      9180, f1f8, CF_ISA_A);
+    INSN(suba,      91c0, f1c0, CF_ISA_A);
+
+    INSN(undef_mac, a000, f000, CF_ISA_A);
+    INSN(mac,       a000, f100, CF_EMAC);
+    INSN(from_mac,  a180, f9b0, CF_EMAC);
+    INSN(move_mac,  a110, f9fc, CF_EMAC);
+    INSN(from_macsr,a980, f9f0, CF_EMAC);
+    INSN(from_mask, ad80, fff0, CF_EMAC);
+    INSN(from_mext, ab80, fbf0, CF_EMAC);
+    INSN(macsr_to_ccr, a9c0, ffff, CF_EMAC);
+    INSN(to_mac,    a100, f9c0, CF_EMAC);
+    INSN(to_macsr,  a900, ffc0, CF_EMAC);
+    INSN(to_mext,   ab00, fbc0, CF_EMAC);
+    INSN(to_mask,   ad00, ffc0, CF_EMAC);
+
+    INSN(mov3q,     a140, f1c0, CF_ISA_B);
+    INSN(cmp,       b000, f1c0, CF_ISA_B); /* cmp.b */
+    INSN(cmp,       b040, f1c0, CF_ISA_B); /* cmp.w */
+    INSN(cmpa,      b0c0, f1c0, CF_ISA_B); /* cmpa.w */
+    INSN(cmp,       b080, f1c0, CF_ISA_A);
+    INSN(cmpa,      b1c0, f1c0, CF_ISA_A);
+    INSN(eor,       b180, f1c0, CF_ISA_A);
+    INSN(and,       c000, f000, CF_ISA_A);
+    INSN(mulw,      c0c0, f0c0, CF_ISA_A);
+    INSN(addsub,    d000, f000, CF_ISA_A);
+    INSN(addx,      d180, f1f8, CF_ISA_A);
+    INSN(adda,      d1c0, f1c0, CF_ISA_A);
+    INSN(shift_im,  e080, f0f0, CF_ISA_A);
+    INSN(shift_reg, e0a0, f0f0, CF_ISA_A);
+    INSN(undef_fpu, f000, f000, CF_ISA_A);
+    INSN(fpu,       f200, ffc0, CF_FPU);
+    INSN(fbcc,      f280, ffc0, CF_FPU);
+    INSN(frestore,  f340, ffc0, CF_FPU);
+    INSN(fsave,     f340, ffc0, CF_FPU);
+    INSN(intouch,   f340, ffc0, CF_ISA_A);
+    INSN(cpushl,    f428, ff38, CF_ISA_A);
+    INSN(wddata,    fb00, ff00, CF_ISA_A);
+    INSN(wdebug,    fbc0, ffc0, CF_ISA_A);
+#undef INSN
+}
+
+/* ??? Some of this implementation is not exception safe.  We should always
+   write back the result to memory before setting the condition codes.  */
+static void disas_m68k_insn(CPUM68KState * env, DisasContext *s)
+{
+    uint16_t insn;
+
+    insn = cpu_lduw_code(env, s->pc);
+    s->pc += 2;
+
+    opcode_table[insn](env, s, insn);
+}
+
+/* generate intermediate code for basic block 'tb'.  */
+void gen_intermediate_code(CPUM68KState *env, TranslationBlock *tb)
+{
+    M68kCPU *cpu = m68k_env_get_cpu(env);
+    CPUState *cs = CPU(cpu);
+    DisasContext dc1, *dc = &dc1;
+    target_ulong pc_start;
+    int pc_offset;
+    int num_insns;
+    int max_insns;
+
+    /* generate intermediate code */
+    pc_start = tb->pc;
+
+    dc->tb = tb;
+
+    dc->env = env;
+    dc->is_jmp = DISAS_NEXT;
+    dc->pc = pc_start;
+    dc->cc_op = CC_OP_DYNAMIC;
+    dc->singlestep_enabled = cs->singlestep_enabled;
+    dc->fpcr = env->fpcr;
+    dc->user = (env->sr & SR_S) == 0;
+    dc->done_mac = 0;
+    num_insns = 0;
+    max_insns = tb->cflags & CF_COUNT_MASK;
+    if (max_insns == 0) {
+        max_insns = CF_COUNT_MASK;
+    }
+    if (max_insns > TCG_MAX_INSNS) {
+        max_insns = TCG_MAX_INSNS;
+    }
+
+    gen_tb_start(tb);
+    do {
+        pc_offset = dc->pc - pc_start;
+        gen_throws_exception = NULL;
+        tcg_gen_insn_start(dc->pc);
+        num_insns++;
+
+        if (unlikely(cpu_breakpoint_test(cs, dc->pc, BP_ANY))) {
+            gen_exception(dc, dc->pc, EXCP_DEBUG);
+            dc->is_jmp = DISAS_JUMP;
+            /* The address covered by the breakpoint must be included in
+               [tb->pc, tb->pc + tb->size) in order to for it to be
+               properly cleared -- thus we increment the PC here so that
+               the logic setting tb->size below does the right thing.  */
+            dc->pc += 2;
+            break;
+        }
+
+        if (num_insns == max_insns && (tb->cflags & CF_LAST_IO)) {
+            gen_io_start();
+        }
+
+        dc->insn_pc = dc->pc;
+	disas_m68k_insn(env, dc);
+    } while (!dc->is_jmp && !tcg_op_buf_full() &&
+             !cs->singlestep_enabled &&
+             !singlestep &&
+             (pc_offset) < (TARGET_PAGE_SIZE - 32) &&
+             num_insns < max_insns);
+
+    if (tb->cflags & CF_LAST_IO)
+        gen_io_end();
+    if (unlikely(cs->singlestep_enabled)) {
+        /* Make sure the pc is updated, and raise a debug exception.  */
+        if (!dc->is_jmp) {
+            gen_flush_cc_op(dc);
+            tcg_gen_movi_i32(QREG_PC, dc->pc);
+        }
+        gen_helper_raise_exception(cpu_env, tcg_const_i32(EXCP_DEBUG));
+    } else {
+        switch(dc->is_jmp) {
+        case DISAS_NEXT:
+            gen_flush_cc_op(dc);
+            gen_jmp_tb(dc, 0, dc->pc);
+            break;
+        default:
+        case DISAS_JUMP:
+        case DISAS_UPDATE:
+            gen_flush_cc_op(dc);
+            /* indicate that the hash table must be used to find the next TB */
+            tcg_gen_exit_tb(0);
+            break;
+        case DISAS_TB_JUMP:
+            /* nothing more to generate */
+            break;
+        }
+    }
+    gen_tb_end(tb, num_insns);
+
+#ifdef DEBUG_DISAS
+    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
+        qemu_log("----------------\n");
+        qemu_log("IN: %s\n", lookup_symbol(pc_start));
+        log_target_disas(cs, pc_start, dc->pc - pc_start, 0);
+        qemu_log("\n");
+    }
+#endif
+    tb->size = dc->pc - pc_start;
+    tb->icount = num_insns;
+}
+
+void m68k_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+    int i;
+    uint16_t sr;
+    CPU_DoubleU u;
+    for (i = 0; i < 8; i++)
+      {
+        u.d = env->fregs[i];
+        cpu_fprintf (f, "D%d = %08x   A%d = %08x   F%d = %08x%08x (%12g)\n",
+                     i, env->dregs[i], i, env->aregs[i],
+                     i, u.l.upper, u.l.lower, *(double *)&u.d);
+      }
+    cpu_fprintf (f, "PC = %08x   ", env->pc);
+    sr = env->sr;
+    cpu_fprintf (f, "SR = %04x %c%c%c%c%c ", sr, (sr & 0x10) ? 'X' : '-',
+                 (sr & CCF_N) ? 'N' : '-', (sr & CCF_Z) ? 'Z' : '-',
+                 (sr & CCF_V) ? 'V' : '-', (sr & CCF_C) ? 'C' : '-');
+    cpu_fprintf (f, "FPRESULT = %12g\n", *(double *)&env->fp_result);
+}
+
+void restore_state_to_opc(CPUM68KState *env, TranslationBlock *tb,
+                          target_ulong *data)
+{
+    env->pc = data[0];
+}