diff --git a/configure b/configure
index b3f39dd..ed58b0a 100755
--- a/configure
+++ b/configure
@@ -2059,6 +2059,7 @@
     echo "#define TARGET_ARCH \"mips\"" >> $config_h
     echo "#define TARGET_MIPS 1" >> $config_h
     echo "#define TARGET_ABI_MIPSO32 1" >> $config_h
+    target_nptl="yes"
     target_phys_bits=64
   ;;
   mipsn32|mipsn32el)
diff --git a/hw/ac97.c b/hw/ac97.c
index b9dac3c..37aca9e 100644
--- a/hw/ac97.c
+++ b/hw/ac97.c
@@ -1308,29 +1308,13 @@
     mixer_reset (s);
 }
 
-int ac97_init (PCIBus *bus)
+static void ac97_initfn(PCIDevice *dev)
 {
-    PCIAC97LinkState *d;
-    AC97LinkState *s;
-    uint8_t *c;
+    PCIAC97LinkState *d = DO_UPCAST(PCIAC97LinkState, dev, dev);
+    AC97LinkState *s = &d->ac97;
+    uint8_t *c = d->dev.config;
 
-    if (!bus) {
-        AUD_log ("ac97", "No PCI bus\n");
-        return -1;
-    }
-
-    d = (PCIAC97LinkState *) pci_register_device (bus, "AC97",
-                                                  sizeof (PCIAC97LinkState),
-                                                  -1, NULL, NULL);
-
-    if (!d) {
-        AUD_log ("ac97", "Failed to register PCI device\n");
-        return -1;
-    }
-
-    s = &d->ac97;
     s->pci_dev = &d->dev;
-    c = d->dev.config;
     pci_config_set_vendor_id (c, PCI_VENDOR_ID_INTEL); /* ro */
     pci_config_set_device_id (c, PCI_DEVICE_ID_INTEL_82801AA_5); /* ro */
 
@@ -1372,5 +1356,23 @@
     qemu_register_reset (ac97_on_reset, s);
     AUD_register_card ("ac97", &s->card);
     ac97_on_reset (s);
+}
+
+int ac97_init (PCIBus *bus)
+{
+    pci_create_simple(bus, -1, "AC97");
     return 0;
 }
+
+static PCIDeviceInfo ac97_info = {
+    .qdev.name    = "AC97",
+    .qdev.size    = sizeof(PCIAC97LinkState),
+    .init         = ac97_initfn,
+};
+
+static void ac97_register(void)
+{
+    pci_qdev_register(&ac97_info);
+}
+device_init(ac97_register);
+
diff --git a/hw/e1000.c b/hw/e1000.c
index da07c46..4ac8918 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -1125,9 +1125,15 @@
     e1000_reset(d);
 }
 
+static PCIDeviceInfo e1000_info = {
+    .qdev.name = "e1000",
+    .qdev.size = sizeof(E1000State),
+    .init      = pci_e1000_init,
+};
+
 static void e1000_register_devices(void)
 {
-    pci_qdev_register("e1000", sizeof(E1000State), pci_e1000_init);
+    pci_qdev_register(&e1000_info);
 }
 
 device_init(e1000_register_devices)
diff --git a/hw/eepro100.c b/hw/eepro100.c
index 0002140..85446ed 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1792,14 +1792,27 @@
     nic_init(dev, i82559ER);
 }
 
+static PCIDeviceInfo eepro100_info[] = {
+    {
+        .qdev.name = "i82551",
+        .qdev.size = sizeof(PCIEEPRO100State),
+        .init      = pci_i82551_init,
+    },{
+        .qdev.name = "i82557b",
+        .qdev.size = sizeof(PCIEEPRO100State),
+        .init      = pci_i82557b_init,
+    },{
+        .qdev.name = "i82559er",
+        .qdev.size = sizeof(PCIEEPRO100State),
+        .init      = pci_i82559er_init,
+    },{
+        /* end of list */
+    }
+};
+
 static void eepro100_register_devices(void)
 {
-    pci_qdev_register("i82551", sizeof(PCIEEPRO100State),
-                      pci_i82551_init);
-    pci_qdev_register("i82557b", sizeof(PCIEEPRO100State),
-                      pci_i82557b_init);
-    pci_qdev_register("i82559er", sizeof(PCIEEPRO100State),
-                      pci_i82559er_init);
+    pci_qdev_register_many(eepro100_info);
 }
 
 device_init(eepro100_register_devices)
diff --git a/hw/es1370.c b/hw/es1370.c
index f730766..9e860f9 100644
--- a/hw/es1370.c
+++ b/hw/es1370.c
@@ -1005,27 +1005,12 @@
     es1370_reset (s);
 }
 
-int es1370_init (PCIBus *bus)
+static void es1370_initfn(PCIDevice *dev)
 {
-    PCIES1370State *d;
-    ES1370State *s;
-    uint8_t *c;
+    PCIES1370State *d = DO_UPCAST(PCIES1370State, dev, dev);
+    ES1370State *s = &d->es1370;
+    uint8_t *c = d->dev.config;
 
-    if (!bus) {
-        dolog ("No PCI bus\n");
-        return -1;
-    }
-
-    d = (PCIES1370State *) pci_register_device (bus, "ES1370",
-                                                sizeof (PCIES1370State),
-                                                -1, NULL, NULL);
-
-    if (!d) {
-        AUD_log (NULL, "Failed to register PCI device for ES1370\n");
-        return -1;
-    }
-
-    c = d->dev.config;
     pci_config_set_vendor_id (c, PCI_VENDOR_ID_ENSONIQ);
     pci_config_set_device_id (c, PCI_DEVICE_ID_ENSONIQ_ES1370);
     c[0x07] = 2 << 1;
@@ -1059,5 +1044,23 @@
 
     AUD_register_card ("es1370", &s->card);
     es1370_reset (s);
+}
+
+int es1370_init (PCIBus *bus)
+{
+    pci_create_simple(bus, -1, "ES1370");
     return 0;
 }
+
+static PCIDeviceInfo es1370_info = {
+    .qdev.name    = "ES1370",
+    .qdev.size    = sizeof(PCIES1370State),
+    .init         = es1370_initfn,
+};
+
+static void es1370_register(void)
+{
+    pci_qdev_register(&es1370_info);
+}
+device_init(es1370_register);
+
diff --git a/hw/i2c.c b/hw/i2c.c
index 838f40f..98aa7fc 100644
--- a/hw/i2c.c
+++ b/hw/i2c.c
@@ -17,6 +17,11 @@
     int saved_address;
 };
 
+static struct BusInfo i2c_bus_info = {
+    .name = "I2C",
+    .size = sizeof(i2c_bus),
+};
+
 static void i2c_bus_save(QEMUFile *f, void *opaque)
 {
     i2c_bus *bus = (i2c_bus *)opaque;
@@ -44,8 +49,7 @@
 {
     i2c_bus *bus;
 
-    bus = FROM_QBUS(i2c_bus, qbus_create(BUS_TYPE_I2C, sizeof(i2c_bus),
-                                         parent, name));
+    bus = FROM_QBUS(i2c_bus, qbus_create(&i2c_bus_info, parent, name));
     register_savevm("i2c_bus", -1, 1, i2c_bus_save, i2c_bus_load, bus);
     return bus;
 }
@@ -156,7 +160,7 @@
 {
     assert(info->qdev.size >= sizeof(i2c_slave));
     info->qdev.init = i2c_slave_qdev_init;
-    info->qdev.bus_type = BUS_TYPE_I2C;
+    info->qdev.bus_info = &i2c_bus_info;
     qdev_register(&info->qdev);
 }
 
diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index 71f8281..516a468 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -2035,9 +2035,15 @@
     scsi_bus_new(&dev->qdev, lsi_scsi_attach);
 }
 
+static PCIDeviceInfo lsi_info = {
+    .qdev.name = "lsi53c895a",
+    .qdev.size = sizeof(LSIState),
+    .init      = lsi_scsi_init,
+};
+
 static void lsi53c895a_register_devices(void)
 {
-    pci_qdev_register("lsi53c895a", sizeof(LSIState), lsi_scsi_init);
+    pci_qdev_register(&lsi_info);
 }
 
 device_init(lsi53c895a_register_devices);
diff --git a/hw/ne2000.c b/hw/ne2000.c
index 66ae9ab..66ff29d 100644
--- a/hw/ne2000.c
+++ b/hw/ne2000.c
@@ -832,9 +832,15 @@
     register_savevm("ne2000", -1, 3, ne2000_save, ne2000_load, s);
 }
 
+static PCIDeviceInfo ne2000_info = {
+    .qdev.name = "ne2k_pci",
+    .qdev.size = sizeof(PCINE2000State),
+    .init      = pci_ne2000_init,
+};
+
 static void ne2000_register_devices(void)
 {
-    pci_qdev_register("ne2k_pci", sizeof(PCINE2000State), pci_ne2000_init);
+    pci_qdev_register(&ne2000_info);
 }
 
 device_init(ne2000_register_devices)
diff --git a/hw/pci.c b/hw/pci.c
index 4458079..71d9227 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -45,7 +45,15 @@
     /* The bus IRQ state is the logical OR of the connected devices.
        Keep a count of the number of devices with raised IRQs.  */
     int nirq;
-    int irq_count[];
+    int *irq_count;
+};
+
+static void pcibus_dev_print(Monitor *mon, DeviceState *dev, int indent);
+
+static struct BusInfo pci_bus_info = {
+    .name       = "PCI",
+    .size       = sizeof(PCIBus),
+    .print_dev  = pcibus_dev_print,
 };
 
 static void pci_update_mappings(PCIDevice *d);
@@ -109,14 +117,13 @@
     PCIBus *bus;
     static int nbus = 0;
 
-    bus = FROM_QBUS(PCIBus, qbus_create(BUS_TYPE_PCI,
-                                        sizeof(PCIBus) + (nirq * sizeof(int)),
-                                        parent, name));
+    bus = FROM_QBUS(PCIBus, qbus_create(&pci_bus_info, parent, name));
     bus->set_irq = set_irq;
     bus->map_irq = map_irq;
     bus->irq_opaque = pic;
     bus->devfn_min = devfn_min;
     bus->nirq = nirq;
+    bus->irq_count = qemu_malloc(nirq * sizeof(bus->irq_count[0]));
     bus->next = first_bus;
     first_bus = bus;
     register_savevm("PCIBUS", nbus++, 1, pcibus_save, pcibus_load, bus);
@@ -127,7 +134,8 @@
 static PCIBus *pci_register_secondary_bus(PCIDevice *dev, pci_map_irq_fn map_irq)
 {
     PCIBus *bus;
-    bus = qemu_mallocz(sizeof(PCIBus));
+
+    bus = FROM_QBUS(PCIBus, qbus_create(&pci_bus_info, &dev->qdev, NULL));
     bus->map_irq = map_irq;
     bus->parent_dev = dev;
     bus->next = dev->bus->next;
@@ -874,11 +882,6 @@
     return s->bus;
 }
 
-typedef struct {
-    DeviceInfo qdev;
-    pci_qdev_initfn init;
-} PCIDeviceInfo;
-
 static void pci_qdev_init(DeviceState *qdev, DeviceInfo *base)
 {
     PCIDevice *pci_dev = (PCIDevice *)qdev;
@@ -888,26 +891,27 @@
 
     bus = FROM_QBUS(PCIBus, qdev_get_parent_bus(qdev));
     devfn = qdev_get_prop_int(qdev, "devfn", -1);
-    pci_dev = do_pci_register_device(pci_dev, bus, "FIXME", devfn,
-                                     NULL, NULL);//FIXME:config_read, config_write);
+    pci_dev = do_pci_register_device(pci_dev, bus, base->name, devfn,
+                                     info->config_read, info->config_write);
     assert(pci_dev);
     info->init(pci_dev);
 }
 
-void pci_qdev_register(const char *name, int size, pci_qdev_initfn init)
+void pci_qdev_register(PCIDeviceInfo *info)
 {
-    PCIDeviceInfo *info;
-
-    info = qemu_mallocz(sizeof(*info));
-    info->qdev.name = qemu_strdup(name);
-    info->qdev.size = size;
-    info->init = init;
     info->qdev.init = pci_qdev_init;
-    info->qdev.bus_type = BUS_TYPE_PCI;
-
+    info->qdev.bus_info = &pci_bus_info;
     qdev_register(&info->qdev);
 }
 
+void pci_qdev_register_many(PCIDeviceInfo *info)
+{
+    while (info->qdev.name) {
+        pci_qdev_register(info);
+        info++;
+    }
+}
+
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name)
 {
     DeviceState *dev;
@@ -995,3 +999,39 @@
 {
     return pci_find_capability_list(pdev, cap_id, NULL);
 }
+
+static void pcibus_dev_print(Monitor *mon, DeviceState *dev, int indent)
+{
+    PCIDevice *d = (PCIDevice *)dev;
+    const pci_class_desc *desc;
+    char ctxt[64];
+    PCIIORegion *r;
+    int i, class;
+
+    class = le16_to_cpu(*((uint16_t *)(d->config + PCI_CLASS_DEVICE)));
+    desc = pci_class_descriptions;
+    while (desc->desc && class != desc->class)
+        desc++;
+    if (desc->desc) {
+        snprintf(ctxt, sizeof(ctxt), "%s", desc->desc);
+    } else {
+        snprintf(ctxt, sizeof(ctxt), "Class %04x", class);
+    }
+
+    monitor_printf(mon, "%*sclass %s, addr %02x:%02x.%x, "
+                   "pci id %04x:%04x (sub %04x:%04x)\n",
+                   indent, "", ctxt,
+                   d->bus->bus_num, d->devfn >> 3, d->devfn & 7,
+                   le16_to_cpu(*((uint16_t *)(d->config + PCI_VENDOR_ID))),
+                   le16_to_cpu(*((uint16_t *)(d->config + PCI_DEVICE_ID))),
+                   le16_to_cpu(*((uint16_t *)(d->config + PCI_SUBSYSTEM_VENDOR_ID))),
+                   le16_to_cpu(*((uint16_t *)(d->config + PCI_SUBSYSTEM_ID))));
+    for (i = 0; i < PCI_NUM_REGIONS; i++) {
+        r = &d->io_regions[i];
+        if (!r->size)
+            continue;
+        monitor_printf(mon, "%*sbar %d: %s at 0x%x [0x%x]\n", indent, "",
+                       i, r->type & PCI_ADDRESS_SPACE_IO ? "i/o" : "mem",
+                       r->addr, r->addr + r->size - 1);
+    }
+}
diff --git a/hw/pci.h b/hw/pci.h
index cb0e382..cbfea6a 100644
--- a/hw/pci.h
+++ b/hw/pci.h
@@ -314,7 +314,15 @@
 }
 
 typedef void (*pci_qdev_initfn)(PCIDevice *dev);
-void pci_qdev_register(const char *name, int size, pci_qdev_initfn init);
+typedef struct {
+    DeviceInfo qdev;
+    pci_qdev_initfn init;
+    PCIConfigReadFunc *config_read;
+    PCIConfigWriteFunc *config_write;
+} PCIDeviceInfo;
+
+void pci_qdev_register(PCIDeviceInfo *info);
+void pci_qdev_register_many(PCIDeviceInfo *info);
 
 PCIDevice *pci_create(const char *name, const char *devaddr);
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name);
diff --git a/hw/pcnet.c b/hw/pcnet.c
index a184146..4519780 100644
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -2143,9 +2143,15 @@
 }
 #endif /* TARGET_SPARC */
 
+static PCIDeviceInfo pcnet_info = {
+    .qdev.name = "pcnet",
+    .qdev.size = sizeof(PCIPCNetState),
+    .init      = pci_pcnet_init,
+};
+
 static void pcnet_register_devices(void)
 {
-    pci_qdev_register("pcnet", sizeof(PCIPCNetState), pci_pcnet_init);
+    pci_qdev_register(&pcnet_info);
 #if defined (TARGET_SPARC) && !defined(TARGET_SPARC64)
     sysbus_register_dev("lance", sizeof(SysBusPCNetState), lance_init);
 #endif
diff --git a/hw/qdev.c b/hw/qdev.c
index 385e709..4c55009 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -41,27 +41,20 @@
     DeviceProperty *next;
 };
 
-struct DeviceType {
-    DeviceInfo *info;
-    DeviceType *next;
-};
-
 /* This is a nasty hack to allow passing a NULL bus to qdev_create.  */
 static BusState *main_system_bus;
+extern struct BusInfo system_bus_info;
 
-static DeviceType *device_type_list;
+static DeviceInfo *device_info_list;
 
 /* Register a new device type.  */
 void qdev_register(DeviceInfo *info)
 {
-    DeviceType *t;
-
     assert(info->size >= sizeof(DeviceState));
+    assert(!info->next);
 
-    t = qemu_mallocz(sizeof(DeviceType));
-    t->next = device_type_list;
-    device_type_list = t;
-    t->info = info;
+    info->next = device_info_list;
+    device_info_list = info;
 }
 
 /* Create a new device.  This only initializes the device state structure
@@ -69,34 +62,29 @@
    initialize the actual device emulation.  */
 DeviceState *qdev_create(BusState *bus, const char *name)
 {
-    DeviceType *t;
+    DeviceInfo *info;
     DeviceState *dev;
 
-    for (t = device_type_list; t; t = t->next) {
-        if (strcmp(t->info->name, name) == 0) {
-            break;
-        }
-    }
-    if (!t) {
-        hw_error("Unknown device '%s'\n", name);
-    }
-
-    dev = qemu_mallocz(t->info->size);
-    dev->type = t;
-
     if (!bus) {
-        /* ???: This assumes system busses have no additional state.  */
         if (!main_system_bus) {
-            main_system_bus = qbus_create(BUS_TYPE_SYSTEM, sizeof(BusState),
-                                          NULL, "main-system-bus");
+            main_system_bus = qbus_create(&system_bus_info, NULL, "main-system-bus");
         }
         bus = main_system_bus;
     }
-    if (t->info->bus_type != bus->type) {
-        /* TODO: Print bus type names.  */
-        hw_error("Device '%s' on wrong bus type (%d/%d)", name,
-                 t->info->bus_type, bus->type);
+
+    for (info = device_info_list; info != NULL; info = info->next) {
+        if (info->bus_info != bus->info)
+            continue;
+        if (strcmp(info->name, name) != 0)
+            continue;
+        break;
     }
+    if (!info) {
+        hw_error("Unknown device '%s' for bus '%s'\n", name, bus->info->name);
+    }
+
+    dev = qemu_mallocz(info->size);
+    dev->info = info;
     dev->parent_bus = bus;
     LIST_INSERT_HEAD(&bus->children, dev, sibling);
     return dev;
@@ -107,7 +95,7 @@
    calling this function.  */
 void qdev_init(DeviceState *dev)
 {
-    dev->type->info->init(dev, dev->type->info);
+    dev->info->init(dev, dev->info);
 }
 
 /* Unlink device from bus and free the structure.  */
@@ -169,7 +157,7 @@
     static int next_serial;
     static int next_virtconsole;
     /* FIXME: This is a nasty hack that needs to go away.  */
-    if (strncmp(dev->type->info->name, "virtio", 6) == 0) {
+    if (strncmp(dev->info->name, "virtio", 6) == 0) {
         return virtcon_hds[next_virtconsole++];
     } else {
         return serial_hds[next_serial++];
@@ -320,13 +308,12 @@
    }
 }
 
-BusState *qbus_create(BusType type, size_t size,
-                      DeviceState *parent, const char *name)
+BusState *qbus_create(BusInfo *info, DeviceState *parent, const char *name)
 {
     BusState *bus;
 
-    bus = qemu_mallocz(size);
-    bus->type = type;
+    bus = qemu_mallocz(info->size);
+    bus->info = info;
     bus->parent = parent;
     bus->name = qemu_strdup(name);
     LIST_INIT(&bus->children);
@@ -336,14 +323,6 @@
     return bus;
 }
 
-static const char *bus_type_names[] = {
-    [ BUS_TYPE_SYSTEM ] = "System",
-    [ BUS_TYPE_PCI ]    = "PCI",
-    [ BUS_TYPE_SCSI ]   = "SCSI",
-    [ BUS_TYPE_I2C ]    = "I2C",
-    [ BUS_TYPE_SSI ]    = "SSI",
-};
-
 #define qdev_printf(fmt, ...) monitor_printf(mon, "%*s" fmt, indent, "", ## __VA_ARGS__)
 static void qbus_print(Monitor *mon, BusState *bus, int indent);
 
@@ -351,7 +330,7 @@
 {
     DeviceProperty *prop;
     BusState *child;
-    qdev_printf("dev: %s\n", dev->type->info->name);
+    qdev_printf("dev: %s\n", dev->info->name);
     indent += 2;
     if (dev->num_gpio_in) {
         qdev_printf("gpio-in %d\n", dev->num_gpio_in);
@@ -370,20 +349,15 @@
             break;
         case PROP_TYPE_DEV:
             qdev_printf("prop-dev %s %s\n", prop->name,
-                        ((DeviceState *)prop->value.ptr)->type->info->name);
+                        ((DeviceState *)prop->value.ptr)->info->name);
             break;
         default:
             qdev_printf("prop-unknown%d %s\n", prop->type, prop->name);
             break;
         }
     }
-    switch (dev->parent_bus->type) {
-    case BUS_TYPE_SYSTEM:
-        sysbus_dev_print(mon, dev, indent);
-        break;
-    default:
-        break;
-    }
+    if (dev->parent_bus->info->print_dev)
+        dev->parent_bus->info->print_dev(mon, dev, indent);
     LIST_FOREACH(child, &dev->child_bus, sibling) {
         qbus_print(mon, child, indent);
     }
@@ -395,7 +369,7 @@
 
     qdev_printf("bus: %s\n", bus->name);
     indent += 2;
-    qdev_printf("type %s\n", bus_type_names[bus->type]);
+    qdev_printf("type %s\n", bus->info->name);
     LIST_FOREACH(dev, &bus->children, sibling) {
         qdev_print(mon, dev, indent);
     }
diff --git a/hw/qdev.h b/hw/qdev.h
index ad10499..b18dbf9 100644
--- a/hw/qdev.h
+++ b/hw/qdev.h
@@ -4,16 +4,18 @@
 #include "hw.h"
 #include "sys-queue.h"
 
-typedef struct DeviceType DeviceType;
+typedef struct DeviceInfo DeviceInfo;
 
 typedef struct DeviceProperty DeviceProperty;
 
 typedef struct BusState BusState;
 
+typedef struct BusInfo BusInfo;
+
 /* This structure should not be accessed directly.  We declare it here
    so that it can be embedded in individual device state structures.  */
 struct DeviceState {
-    DeviceType *type;
+    DeviceInfo *info;
     BusState *parent_bus;
     DeviceProperty *props;
     int num_gpio_out;
@@ -25,18 +27,17 @@
     LIST_ENTRY(DeviceState) sibling;
 };
 
-typedef enum {
-    BUS_TYPE_SYSTEM,
-    BUS_TYPE_PCI,
-    BUS_TYPE_SCSI,
-    BUS_TYPE_I2C,
-    BUS_TYPE_SSI
-} BusType;
+typedef void (*bus_dev_printfn)(Monitor *mon, DeviceState *dev, int indent);
+struct BusInfo {
+    const char *name;
+    size_t size;
+    bus_dev_printfn print_dev;
+};
 
 struct BusState {
     DeviceState *parent;
+    BusInfo *info;
     const char *name;
-    BusType type;
     LIST_HEAD(, DeviceState) children;
     LIST_ENTRY(BusState) sibling;
 };
@@ -71,8 +72,6 @@
     DevicePropType type;
 } DevicePropList;
 
-typedef struct DeviceInfo DeviceInfo;
-
 typedef void (*qdev_initfn)(DeviceState *dev, DeviceInfo *info);
 typedef void (*SCSIAttachFn)(DeviceState *host, BlockDriverState *bdrv,
               int unit);
@@ -84,7 +83,8 @@
 
     /* Private to qdev / bus.  */
     qdev_initfn init;
-    BusType bus_type;
+    BusInfo *bus_info;
+    struct DeviceInfo *next;
 };
 
 void qdev_register(DeviceInfo *info);
@@ -116,14 +116,12 @@
 
 /*** BUS API. ***/
 
-BusState *qbus_create(BusType type, size_t size,
-                      DeviceState *parent, const char *name);
+BusState *qbus_create(BusInfo *info, DeviceState *parent, const char *name);
 
 #define FROM_QBUS(type, dev) DO_UPCAST(type, qbus, dev)
 
 /*** monitor commands ***/
 
 void do_info_qtree(Monitor *mon);
-void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent);
 
 #endif
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index 2280018..91165db 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -3499,9 +3499,15 @@
 #endif /* RTL8139_ONBOARD_TIMER */
 }
 
+static PCIDeviceInfo rtl8139_info = {
+    .qdev.name = "rtl8139",
+    .qdev.size = sizeof(PCIRTL8139State),
+    .init      = pci_rtl8139_init,
+};
+
 static void rtl8139_register_devices(void)
 {
-    pci_qdev_register("rtl8139", sizeof(PCIRTL8139State), pci_rtl8139_init);
+    pci_qdev_register(&rtl8139_info);
 }
 
 device_init(rtl8139_register_devices)
diff --git a/hw/ssi.c b/hw/ssi.c
index b0bcf97..a5133be 100644
--- a/hw/ssi.c
+++ b/hw/ssi.c
@@ -13,6 +13,11 @@
     BusState qbus;
 };
 
+static struct BusInfo ssi_bus_info = {
+    .name = "SSI",
+    .size = sizeof(SSIBus),
+};
+
 static void ssi_slave_init(DeviceState *dev, DeviceInfo *base_info)
 {
     SSISlaveInfo *info = container_of(base_info, SSISlaveInfo, qdev);
@@ -33,7 +38,7 @@
 {
     assert(info->qdev.size >= sizeof(SSISlave));
     info->qdev.init = ssi_slave_init;
-    info->qdev.bus_type = BUS_TYPE_SSI;
+    info->qdev.bus_info = &ssi_bus_info;
     qdev_register(&info->qdev);
 }
 
@@ -48,7 +53,7 @@
 SSIBus *ssi_create_bus(DeviceState *parent, const char *name)
 {
     BusState *bus;
-    bus = qbus_create(BUS_TYPE_SSI, sizeof(SSIBus), parent, name);
+    bus = qbus_create(&ssi_bus_info, parent, name);
     return FROM_QBUS(SSIBus, bus);
 }
 
diff --git a/hw/sysbus.c b/hw/sysbus.c
index ef3a701..08f15e4 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -22,6 +22,14 @@
 #include "sysemu.h"
 #include "monitor.h"
 
+static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent);
+
+struct BusInfo system_bus_info = {
+    .name       = "System",
+    .size       = sizeof(BusState),
+    .print_dev  = sysbus_dev_print,
+};
+
 void sysbus_connect_irq(SysBusDevice *dev, int n, qemu_irq irq)
 {
     assert(n >= 0 && n < dev->num_irq);
@@ -108,7 +116,7 @@
 void sysbus_register_withprop(SysBusDeviceInfo *info)
 {
     info->qdev.init = sysbus_device_init;
-    info->qdev.bus_type = BUS_TYPE_SYSTEM;
+    info->qdev.bus_info = &system_bus_info;
 
     assert(info->qdev.size >= sizeof(SysBusDevice));
     qdev_register(&info->qdev);
@@ -153,7 +161,7 @@
     return dev;
 }
 
-void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
+static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
 {
     SysBusDevice *s = sysbus_from_qdev(dev);
     int i;
diff --git a/hw/versatile_pci.c b/hw/versatile_pci.c
index e89add1..5eb2625 100644
--- a/hw/versatile_pci.c
+++ b/hw/versatile_pci.c
@@ -153,13 +153,18 @@
     d->config[0x0D] = 0x10; // latency_timer
 }
 
+static PCIDeviceInfo versatile_pci_host_info = {
+    .qdev.name = "versatile_pci_host",
+    .qdev.size = sizeof(PCIDevice),
+    .init      = versatile_pci_host_init,
+};
+
 static void versatile_pci_register_devices(void)
 {
     sysbus_register_dev("versatile_pci", sizeof(PCIVPBState), pci_vpb_init);
     sysbus_register_dev("realview_pci", sizeof(PCIVPBState),
                         pci_realview_init);
-    pci_qdev_register("versatile_pci_host", sizeof(PCIDevice),
-                      versatile_pci_host_init);
+    pci_qdev_register(&versatile_pci_host_info);
 }
 
 device_init(versatile_pci_register_devices)
diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c
index f7da503..39e290d 100644
--- a/hw/virtio-pci.c
+++ b/hw/virtio-pci.c
@@ -466,16 +466,31 @@
                     0x00);
 }
 
+static PCIDeviceInfo virtio_info[] = {
+    {
+        .qdev.name = "virtio-blk-pci",
+        .qdev.size = sizeof(VirtIOPCIProxy),
+        .init      = virtio_blk_init_pci,
+    },{
+        .qdev.name = "virtio-net-pci",
+        .qdev.size = sizeof(VirtIOPCIProxy),
+        .init      = virtio_net_init_pci,
+    },{
+        .qdev.name = "virtio-console-pci",
+        .qdev.size = sizeof(VirtIOPCIProxy),
+        .init      = virtio_console_init_pci,
+    },{
+        .qdev.name = "virtio-balloon-pci",
+        .qdev.size = sizeof(VirtIOPCIProxy),
+        .init      = virtio_balloon_init_pci,
+    },{
+        /* end of list */
+    }
+};
+
 static void virtio_pci_register_devices(void)
 {
-    pci_qdev_register("virtio-blk-pci", sizeof(VirtIOPCIProxy),
-                      virtio_blk_init_pci);
-    pci_qdev_register("virtio-net-pci", sizeof(VirtIOPCIProxy),
-                      virtio_net_init_pci);
-    pci_qdev_register("virtio-console-pci", sizeof(VirtIOPCIProxy),
-                      virtio_console_init_pci);
-    pci_qdev_register("virtio-balloon-pci", sizeof(VirtIOPCIProxy),
-                      virtio_balloon_init_pci);
+    pci_qdev_register_many(virtio_info);
 }
 
 device_init(virtio_pci_register_devices)
diff --git a/linux-user/main.c b/linux-user/main.c
index 345d338..d49605b 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -1626,7 +1626,7 @@
 	MIPS_SYS(sys_ipc		, 6)
 	MIPS_SYS(sys_fsync	, 1)
 	MIPS_SYS(sys_sigreturn	, 0)
-	MIPS_SYS(sys_clone	, 0)	/* 4120 */
+	MIPS_SYS(sys_clone	, 6)	/* 4120 */
 	MIPS_SYS(sys_setdomainname, 2)
 	MIPS_SYS(sys_newuname	, 1)
 	MIPS_SYS(sys_ni_syscall	, 0)	/* sys_modify_ldt */
@@ -1826,6 +1826,55 @@
 
 #undef MIPS_SYS
 
+static int do_store_exclusive(CPUMIPSState *env)
+{
+    target_ulong addr;
+    target_ulong page_addr;
+    target_ulong val;
+    int flags;
+    int segv = 0;
+    int reg;
+    int d;
+
+    addr = env->CP0_LLAddr;
+    page_addr = addr & TARGET_PAGE_MASK;
+    start_exclusive();
+    mmap_lock();
+    flags = page_get_flags(page_addr);
+    if ((flags & PAGE_READ) == 0) {
+        segv = 1;
+    } else {
+        reg = env->llreg & 0x1f;
+        d = (env->llreg & 0x20) != 0;
+        if (d) {
+            segv = get_user_s64(val, addr);
+        } else {
+            segv = get_user_s32(val, addr);
+        }
+        if (!segv) {
+            if (val != env->llval) {
+                env->active_tc.gpr[reg] = 0;
+            } else {
+                if (d) {
+                    segv = put_user_u64(env->llnewval, addr);
+                } else {
+                    segv = put_user_u32(env->llnewval, addr);
+                }
+                if (!segv) {
+                    env->active_tc.gpr[reg] = 1;
+                }
+            }
+        }
+    }
+    env->CP0_LLAddr = -1;
+    if (!segv) {
+        env->active_tc.PC += 4;
+    }
+    mmap_unlock();
+    end_exclusive();
+    return segv;
+}
+
 void cpu_loop(CPUMIPSState *env)
 {
     target_siginfo_t info;
@@ -1833,7 +1882,9 @@
     unsigned int syscall_num;
 
     for(;;) {
+        cpu_exec_start(env);
         trapnr = cpu_mips_exec(env);
+        cpu_exec_end(env);
         switch(trapnr) {
         case EXCP_SYSCALL:
             syscall_num = env->active_tc.gpr[2] - 4000;
@@ -1910,6 +1961,15 @@
                   }
             }
             break;
+        case EXCP_SC:
+            if (do_store_exclusive(env)) {
+                info.si_signo = TARGET_SIGSEGV;
+                info.si_errno = 0;
+                info.si_code = TARGET_SEGV_MAPERR;
+                info._sifields._sigfault._addr = env->active_tc.PC;
+                queue_signal(env, info.si_signo, &info);
+            }
+            break;
         default:
             //        error:
             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 6a34171..6ee61a9 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -2330,6 +2330,7 @@
     uint32_t   sc_fpc_eir;     /* Unused */
     uint32_t   sc_used_math;
     uint32_t   sc_dsp;         /* dsp status, was sc_ssflags */
+    uint32_t   pad0;
     uint64_t   sc_mdhi;
     uint64_t   sc_mdlo;
     target_ulong   sc_hi1;         /* Was sc_cause */
@@ -2351,6 +2352,7 @@
     target_ulong uc_flags;
     target_ulong uc_link;
     target_stack_t uc_stack;
+    target_ulong pad0;
     struct target_sigcontext uc_mcontext;
     target_sigset_t uc_sigmask;
 };
diff --git a/osdep.c b/osdep.c
index b300ba1..410e436 100644
--- a/osdep.c
+++ b/osdep.c
@@ -51,10 +51,23 @@
 #include "sysemu.h"
 #include "qemu_socket.h"
 
+#if !defined(_POSIX_C_SOURCE) || defined(_WIN32)
+static void *oom_check(void *ptr)
+{
+    if (ptr == NULL) {
+        abort();
+    }
+    return ptr;
+}
+#endif
+
 #if defined(_WIN32)
 void *qemu_memalign(size_t alignment, size_t size)
 {
-    return VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);
+    if (!size) {
+        abort();
+    }
+    return oom_check(VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE));
 }
 
 void *qemu_vmalloc(size_t size)
@@ -62,7 +75,10 @@
     /* FIXME: this is not exactly optimal solution since VirtualAlloc
        has 64Kb granularity, but at least it guarantees us that the
        memory is page aligned. */
-    return VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);
+    if (!size) {
+        abort();
+    }
+    return oom_check(VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE));
 }
 
 void qemu_vfree(void *ptr)
@@ -106,6 +122,10 @@
     struct statfs stfs;
 #endif
 
+    if (!size) {
+        abort ();
+    }
+
     if (phys_ram_fd < 0) {
         tmpdir = getenv("QEMU_TMPDIR");
         if (!tmpdir)
@@ -188,12 +208,12 @@
     void *ptr;
     ret = posix_memalign(&ptr, alignment, size);
     if (ret != 0)
-        return NULL;
+        abort();
     return ptr;
 #elif defined(HOST_BSD)
-    return valloc(size);
+    return oom_check(valloc(size));
 #else
-    return memalign(alignment, size);
+    return oom_check(memalign(alignment, size));
 #endif
 }
 
diff --git a/sdl_zoom.h b/sdl_zoom.h
index 9bc13ae..74955bc 100644
--- a/sdl_zoom.h
+++ b/sdl_zoom.h
@@ -14,7 +14,7 @@
 #ifndef SDL_zoom_h
 #define SDL_zoom_h
 
-#include <SDL/SDL.h>
+#include <SDL.h>
 
 #define SMOOTHING_OFF		0
 #define SMOOTHING_ON		1
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index b415dc4..bb9a49b 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -375,6 +375,9 @@
     int32_t CP0_Config7;
     /* XXX: Maybe make LLAddr per-TC? */
     target_ulong CP0_LLAddr;
+    target_ulong llval;
+    target_ulong llnewval;
+    target_ulong llreg;
     target_ulong CP0_WatchLo[8];
     int32_t CP0_WatchHi[8];
     target_ulong CP0_XContext;
@@ -559,6 +562,8 @@
 
     EXCP_LAST = EXCP_CACHE,
 };
+/* Dummy exception for conditional stores.  */
+#define EXCP_SC 0x100
 
 int cpu_mips_exec(CPUMIPSState *s);
 CPUMIPSState *cpu_mips_init(const char *cpu_model);
@@ -597,4 +602,9 @@
     *flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK);
 }
 
+static inline void cpu_set_tls(CPUState *env, target_ulong newtls)
+{
+    env->tls_value = newtls;
+}
+
 #endif /* !defined (__MIPS_CPU_H__) */
diff --git a/target-mips/translate.c b/target-mips/translate.c
index d316b9d..cf467f8 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -919,6 +919,7 @@
     tcg_gen_mov_tl(t0, arg1);                                              \
     tcg_gen_qemu_##fname(ret, arg1, ctx->mem_idx);                         \
     tcg_gen_st_tl(t0, cpu_env, offsetof(CPUState, CP0_LLAddr));            \
+    tcg_gen_st_tl(ret, cpu_env, offsetof(CPUState, llval));                \
     tcg_temp_free(t0);                                                     \
 }
 OP_LD_ATOMIC(ll,ld32s);
@@ -927,32 +928,66 @@
 #endif
 #undef OP_LD_ATOMIC
 
-#define OP_ST_ATOMIC(insn,fname,almask)                                              \
-static inline void op_ldst_##insn(TCGv ret, TCGv arg1, TCGv arg2, DisasContext *ctx) \
-{                                                                                    \
-    TCGv t0 = tcg_temp_new();                                                        \
-    int l1 = gen_new_label();                                                        \
-    int l2 = gen_new_label();                                                        \
-    int l3 = gen_new_label();                                                        \
-                                                                                     \
-    tcg_gen_andi_tl(t0, arg2, almask);                                               \
-    tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0, l1);                                      \
-    tcg_gen_st_tl(arg2, cpu_env, offsetof(CPUState, CP0_BadVAddr));                  \
-    generate_exception(ctx, EXCP_AdES);                                              \
-    gen_set_label(l1);                                                               \
-    tcg_gen_ld_tl(t0, cpu_env, offsetof(CPUState, CP0_LLAddr));                      \
-    tcg_gen_brcond_tl(TCG_COND_NE, arg2, t0, l2);                                    \
-    tcg_temp_free(t0);                                                               \
-    tcg_gen_qemu_##fname(arg1, arg2, ctx->mem_idx);                                  \
-    tcg_gen_movi_tl(ret, 1);                                                         \
-    tcg_gen_br(l3);                                                                  \
-    gen_set_label(l2);                                                               \
-    tcg_gen_movi_tl(ret, 0);                                                         \
-    gen_set_label(l3);                                                               \
+#ifdef CONFIG_USER_ONLY
+#define OP_ST_ATOMIC(insn,fname,ldname,almask)                               \
+static inline void op_ldst_##insn(TCGv arg1, TCGv arg2, int rt, DisasContext *ctx) \
+{                                                                            \
+    TCGv t0 = tcg_temp_new();                                                \
+    int l1 = gen_new_label();                                                \
+    int l2 = gen_new_label();                                                \
+                                                                             \
+    tcg_gen_andi_tl(t0, arg2, almask);                                       \
+    tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0, l1);                              \
+    tcg_gen_st_tl(arg2, cpu_env, offsetof(CPUState, CP0_BadVAddr));          \
+    generate_exception(ctx, EXCP_AdES);                                      \
+    gen_set_label(l1);                                                       \
+    tcg_gen_ld_tl(t0, cpu_env, offsetof(CPUState, CP0_LLAddr));              \
+    tcg_gen_brcond_tl(TCG_COND_NE, arg2, t0, l2);                            \
+    tcg_gen_movi_tl(t0, rt | ((almask << 3) & 0x20));                        \
+    tcg_gen_st_tl(t0, cpu_env, offsetof(CPUState, llreg));                   \
+    tcg_gen_st_tl(arg1, cpu_env, offsetof(CPUState, llnewval));              \
+    gen_helper_0i(raise_exception, EXCP_SC);                                 \
+    gen_set_label(l2);                                                       \
+    tcg_gen_movi_tl(t0, 0);                                                  \
+    gen_store_gpr(t0, rt);                                                   \
+    tcg_temp_free(t0);                                                       \
 }
-OP_ST_ATOMIC(sc,st32,0x3);
+#else
+#define OP_ST_ATOMIC(insn,fname,ldname,almask)                               \
+static inline void op_ldst_##insn(TCGv arg1, TCGv arg2, int rt, DisasContext *ctx) \
+{                                                                            \
+    TCGv t0 = tcg_temp_new();                                                \
+    TCGv t1 = tcg_temp_new();                                                \
+    int l1 = gen_new_label();                                                \
+    int l2 = gen_new_label();                                                \
+    int l3 = gen_new_label();                                                \
+                                                                             \
+    tcg_gen_andi_tl(t0, arg2, almask);                                       \
+    tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0, l1);                              \
+    tcg_gen_st_tl(arg2, cpu_env, offsetof(CPUState, CP0_BadVAddr));          \
+    generate_exception(ctx, EXCP_AdES);                                      \
+    gen_set_label(l1);                                                       \
+    tcg_gen_ld_tl(t0, cpu_env, offsetof(CPUState, CP0_LLAddr));              \
+    tcg_gen_brcond_tl(TCG_COND_NE, arg2, t0, l2);                            \
+    tcg_gen_ld_tl(t0, cpu_env, offsetof(CPUState, llval));                   \
+    tcg_gen_qemu_##ldname(t1, arg2, ctx->mem_idx);                           \
+    tcg_gen_brcond_tl(TCG_COND_NE, t0, t1, l2);                              \
+    tcg_temp_free(t1);                                                       \
+    tcg_gen_qemu_##fname(arg1, arg2, ctx->mem_idx);                          \
+    tcg_gen_movi_tl(t0, 1);                                                  \
+    gen_store_gpr(t0, rt);                                                   \
+    tcg_gen_br(l3);                                                          \
+    gen_set_label(l2);                                                       \
+    tcg_gen_movi_tl(t0, 0);                                                  \
+    gen_store_gpr(t0, rt);                                                   \
+    gen_set_label(l3);                                                       \
+    tcg_temp_free(t0);                                                       \
+}
+#endif
+
+OP_ST_ATOMIC(sc,st32,ld32s,0x3);
 #if defined(TARGET_MIPS64)
-OP_ST_ATOMIC(scd,st64,0x7);
+OP_ST_ATOMIC(scd,st64,ld64,0x7);
 #endif
 #undef OP_ST_ATOMIC