diff --git a/cpu-all.h b/cpu-all.h
index e0b60d96d9317bf17ecd7f1658c31d97411f4a87..eb65b59ead4fc60efee01a621733587db23ad5fc 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -584,22 +584,41 @@ static inline void stfq_be_p(void *ptr, float64 v)
 
 /* MMU memory access macros */
 
+#if defined(CONFIG_USER_ONLY)
+/* On some host systems the guest address space is reserved on the host.
+ * This allows the guest address space to be offset to a convenient location.
+ */
+//#define GUEST_BASE 0x20000000
+#define GUEST_BASE 0
+
+/* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
+#define g2h(x) ((void *)((unsigned long)(x) + GUEST_BASE))
+#define h2g(x) ((target_ulong)(x - GUEST_BASE))
+
+#define saddr(x) g2h(x)
+#define laddr(x) g2h(x)
+
+#else /* !CONFIG_USER_ONLY */
 /* NOTE: we use double casts if pointers and target_ulong have
    different sizes */
-#define ldub_raw(p) ldub_p((uint8_t *)(long)(p))
-#define ldsb_raw(p) ldsb_p((uint8_t *)(long)(p))
-#define lduw_raw(p) lduw_p((uint8_t *)(long)(p))
-#define ldsw_raw(p) ldsw_p((uint8_t *)(long)(p))
-#define ldl_raw(p) ldl_p((uint8_t *)(long)(p))
-#define ldq_raw(p) ldq_p((uint8_t *)(long)(p))
-#define ldfl_raw(p) ldfl_p((uint8_t *)(long)(p))
-#define ldfq_raw(p) ldfq_p((uint8_t *)(long)(p))
-#define stb_raw(p, v) stb_p((uint8_t *)(long)(p), v)
-#define stw_raw(p, v) stw_p((uint8_t *)(long)(p), v)
-#define stl_raw(p, v) stl_p((uint8_t *)(long)(p), v)
-#define stq_raw(p, v) stq_p((uint8_t *)(long)(p), v)
-#define stfl_raw(p, v) stfl_p((uint8_t *)(long)(p), v)
-#define stfq_raw(p, v) stfq_p((uint8_t *)(long)(p), v)
+#define saddr(x) (uint8_t *)(long)(x)
+#define laddr(x) (uint8_t *)(long)(x)
+#endif
+
+#define ldub_raw(p) ldub_p(laddr((p)))
+#define ldsb_raw(p) ldsb_p(laddr((p)))
+#define lduw_raw(p) lduw_p(laddr((p)))
+#define ldsw_raw(p) ldsw_p(laddr((p)))
+#define ldl_raw(p) ldl_p(laddr((p)))
+#define ldq_raw(p) ldq_p(laddr((p)))
+#define ldfl_raw(p) ldfl_p(laddr((p)))
+#define ldfq_raw(p) ldfq_p(laddr((p)))
+#define stb_raw(p, v) stb_p(saddr((p)), v)
+#define stw_raw(p, v) stw_p(saddr((p)), v)
+#define stl_raw(p, v) stl_p(saddr((p)), v)
+#define stq_raw(p, v) stq_p(saddr((p)), v)
+#define stfl_raw(p, v) stfl_p(saddr((p)), v)
+#define stfq_raw(p, v) stfq_p(saddr((p)), v)
 
 
 #if defined(CONFIG_USER_ONLY) 
@@ -648,6 +667,7 @@ static inline void stfq_be_p(void *ptr, float64 v)
 #define TARGET_PAGE_MASK ~(TARGET_PAGE_SIZE - 1)
 #define TARGET_PAGE_ALIGN(addr) (((addr) + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK)
 
+/* ??? These should be the larger of unsigned long and target_ulong.  */
 extern unsigned long qemu_real_host_page_size;
 extern unsigned long qemu_host_page_bits;
 extern unsigned long qemu_host_page_size;
@@ -666,9 +686,9 @@ extern unsigned long qemu_host_page_mask;
 #define PAGE_WRITE_ORG 0x0010 
 
 void page_dump(FILE *f);
-int page_get_flags(unsigned long address);
-void page_set_flags(unsigned long start, unsigned long end, int flags);
-void page_unprotect_range(uint8_t *data, unsigned long data_size);
+int page_get_flags(target_ulong address);
+void page_set_flags(target_ulong start, target_ulong end, int flags);
+void page_unprotect_range(target_ulong data, target_ulong data_size);
 
 #define SINGLE_CPU_DEFINES
 #ifdef SINGLE_CPU_DEFINES
diff --git a/cpu-exec.c b/cpu-exec.c
index 4741a252617511320d195633c71f1c7c7aa96c0c..872f51f62cf6f8a2f9c0f989271adceeac90f7eb 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -913,7 +913,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
                 pc, address, is_write, *(unsigned long *)old_set);
 #endif
     /* XXX: locking issue */
-    if (is_write && page_unprotect(address, pc, puc)) {
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
         return 1;
     }
 
@@ -964,7 +964,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
            pc, address, is_write, *(unsigned long *)old_set);
 #endif
     /* XXX: locking issue */
-    if (is_write && page_unprotect(address, pc, puc)) {
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
         return 1;
     }
     /* see if it is an MMU fault */
@@ -1000,7 +1000,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
            pc, address, is_write, *(unsigned long *)old_set);
 #endif
     /* XXX: locking issue */
-    if (is_write && page_unprotect(address, pc, puc)) {
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
         return 1;
     }
     /* see if it is an MMU fault */
@@ -1036,7 +1036,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
            pc, address, is_write, *(unsigned long *)old_set);
 #endif
     /* XXX: locking issue */
-    if (is_write && page_unprotect(address, pc, puc)) {
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
         return 1;
     }
 
@@ -1086,7 +1086,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
            pc, address, is_write, *(unsigned long *)old_set);
 #endif
     /* XXX: locking issue */
-    if (is_write && page_unprotect(address, pc, puc)) {
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
         return 1;
     }
 
diff --git a/exec-all.h b/exec-all.h
index cc55ab44d395131c12f14b6f0244cde04acb0b55..e4fc1d67335b326a8544c0f75b1fe6d0b6851b70 100644
--- a/exec-all.h
+++ b/exec-all.h
@@ -93,7 +93,7 @@ int cpu_restore_state_copy(struct TranslationBlock *tb,
                            void *puc);
 void cpu_resume_from_signal(CPUState *env1, void *puc);
 void cpu_exec_init(CPUState *env);
-int page_unprotect(unsigned long address, unsigned long pc, void *puc);
+int page_unprotect(target_ulong address, unsigned long pc, void *puc);
 void tb_invalidate_phys_page_range(target_ulong start, target_ulong end, 
                                    int is_cpu_write_access);
 void tb_invalidate_page_range(target_ulong start, target_ulong end);
diff --git a/exec.c b/exec.c
index e4e68d9dca8d085b48b159336f2e625ce6a72d6b..9ad2edcf3b57899798bf9a1ff066c5ed36fd1ed0 100644
--- a/exec.c
+++ b/exec.c
@@ -34,6 +34,9 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#if defined(CONFIG_USER_ONLY)
+#include <qemu.h>
+#endif
 
 //#define DEBUG_TB_INVALIDATE
 //#define DEBUG_FLUSH
@@ -810,7 +813,7 @@ static void tb_invalidate_phys_page(target_ulong addr,
 
 /* add the tb in the target page and protect it if necessary */
 static inline void tb_alloc_page(TranslationBlock *tb, 
-                                 unsigned int n, unsigned int page_addr)
+                                 unsigned int n, target_ulong page_addr)
 {
     PageDesc *p;
     TranslationBlock *last_first_tb;
@@ -826,23 +829,30 @@ static inline void tb_alloc_page(TranslationBlock *tb,
 
 #if defined(CONFIG_USER_ONLY)
     if (p->flags & PAGE_WRITE) {
-        unsigned long host_start, host_end, addr;
+        target_ulong addr;
+        PageDesc *p2;
         int prot;
 
         /* force the host page as non writable (writes will have a
            page fault + mprotect overhead) */
-        host_start = page_addr & qemu_host_page_mask;
-        host_end = host_start + qemu_host_page_size;
+        page_addr &= qemu_host_page_mask;
         prot = 0;
-        for(addr = host_start; addr < host_end; addr += TARGET_PAGE_SIZE)
-            prot |= page_get_flags(addr);
-        mprotect((void *)host_start, qemu_host_page_size, 
+        for(addr = page_addr; addr < page_addr + qemu_host_page_size;
+            addr += TARGET_PAGE_SIZE) {
+
+            p2 = page_find (addr >> TARGET_PAGE_BITS);
+            if (!p2)
+                continue;
+            prot |= p2->flags;
+            p2->flags &= ~PAGE_WRITE;
+            page_get_flags(addr);
+          }
+        mprotect(g2h(page_addr), qemu_host_page_size, 
                  (prot & PAGE_BITS) & ~PAGE_WRITE);
 #ifdef DEBUG_TB_INVALIDATE
         printf("protecting code page: 0x%08lx\n", 
-               host_start);
+               page_addr);
 #endif
-        p->flags &= ~PAGE_WRITE;
     }
 #else
     /* if some code is already present, then the pages are already
@@ -1546,7 +1556,7 @@ int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
 
 /* called from signal handler: invalidate the code and unprotect the
    page. Return TRUE if the fault was succesfully handled. */
-int page_unprotect(unsigned long addr, unsigned long pc, void *puc)
+int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
 {
 #if !defined(CONFIG_SOFTMMU)
     VirtPageDesc *vp;
@@ -1645,7 +1655,7 @@ void page_dump(FILE *f)
     }
 }
 
-int page_get_flags(unsigned long address)
+int page_get_flags(target_ulong address)
 {
     PageDesc *p;
 
@@ -1658,10 +1668,10 @@ int page_get_flags(unsigned long address)
 /* modify the flags of a page and invalidate the code if
    necessary. The flag PAGE_WRITE_ORG is positionned automatically
    depending on PAGE_WRITE */
-void page_set_flags(unsigned long start, unsigned long end, int flags)
+void page_set_flags(target_ulong start, target_ulong end, int flags)
 {
     PageDesc *p;
-    unsigned long addr;
+    target_ulong addr;
 
     start = start & TARGET_PAGE_MASK;
     end = TARGET_PAGE_ALIGN(end);
@@ -1684,11 +1694,11 @@ void page_set_flags(unsigned long start, unsigned long end, int flags)
 
 /* called from signal handler: invalidate the code and unprotect the
    page. Return TRUE if the fault was succesfully handled. */
-int page_unprotect(unsigned long address, unsigned long pc, void *puc)
+int page_unprotect(target_ulong address, unsigned long pc, void *puc)
 {
     unsigned int page_index, prot, pindex;
     PageDesc *p, *p1;
-    unsigned long host_start, host_end, addr;
+    target_ulong host_start, host_end, addr;
 
     host_start = address & qemu_host_page_mask;
     page_index = host_start >> TARGET_PAGE_BITS;
@@ -1707,7 +1717,7 @@ int page_unprotect(unsigned long address, unsigned long pc, void *puc)
     if (prot & PAGE_WRITE_ORG) {
         pindex = (address - host_start) >> TARGET_PAGE_BITS;
         if (!(p1[pindex].flags & PAGE_WRITE)) {
-            mprotect((void *)host_start, qemu_host_page_size, 
+            mprotect((void *)g2h(host_start), qemu_host_page_size, 
                      (prot & PAGE_BITS) | PAGE_WRITE);
             p1[pindex].flags |= PAGE_WRITE;
             /* and since the content will be modified, we must invalidate
@@ -1723,11 +1733,12 @@ int page_unprotect(unsigned long address, unsigned long pc, void *puc)
 }
 
 /* call this function when system calls directly modify a memory area */
-void page_unprotect_range(uint8_t *data, unsigned long data_size)
+/* ??? This should be redundant now we have lock_user.  */
+void page_unprotect_range(target_ulong data, target_ulong data_size)
 {
-    unsigned long start, end, addr;
+    target_ulong start, end, addr;
 
-    start = (unsigned long)data;
+    start = data;
     end = start + data_size;
     start &= TARGET_PAGE_MASK;
     end = TARGET_PAGE_ALIGN(end);
@@ -1932,6 +1943,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
 {
     int l, flags;
     target_ulong page;
+    void * p;
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
@@ -1944,11 +1956,15 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         if (is_write) {
             if (!(flags & PAGE_WRITE))
                 return;
-            memcpy((uint8_t *)addr, buf, len);
+            p = lock_user(addr, len, 0);
+            memcpy(p, buf, len);
+            unlock_user(p, addr, len);
         } else {
             if (!(flags & PAGE_READ))
                 return;
-            memcpy(buf, (uint8_t *)addr, len);
+            p = lock_user(addr, len, 1);
+            memcpy(buf, p, len);
+            unlock_user(p, addr, 0);
         }
         len -= l;
         buf += l;
diff --git a/linux-user/arm-semi.c b/linux-user/arm-semi.c
index 472361a4788902e1b88038572ab5c5a0ac1250e5..250d5b75cc3ef18df097c3f7f0d92dba88a7406b 100644
--- a/linux-user/arm-semi.c
+++ b/linux-user/arm-semi.c
@@ -77,20 +77,20 @@ static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
   return code;
 }
 
-#define ARG(x) tswap32(args[x])
+#define ARG(n) tget32(args + n * 4)
 uint32_t do_arm_semihosting(CPUState *env)
 {
-    uint32_t *args;
+    target_ulong args;
     char * s;
     int nr;
     uint32_t ret;
     TaskState *ts = env->opaque;
 
     nr = env->regs[0];
-    args = (uint32_t *)env->regs[1];
+    args = env->regs[1];
     switch (nr) {
     case SYS_OPEN:
-        s = (char *)ARG(0);
+        s = (char *)g2h(ARG(0));
         if (ARG(1) >= 12)
           return (uint32_t)-1;
         if (strcmp(s, ":tt") == 0) {
@@ -103,18 +103,23 @@ uint32_t do_arm_semihosting(CPUState *env)
     case SYS_CLOSE:
         return set_swi_errno(ts, close(ARG(0)));
     case SYS_WRITEC:
-        /* Write to debug console.  stderr is near enough.  */
-        return write(STDERR_FILENO, args, 1);
+        {
+          char c = tget8(args);
+          /* Write to debug console.  stderr is near enough.  */
+          return write(STDERR_FILENO, &c, 1);
+        }
     case SYS_WRITE0:
-        s = (char *)args;
-        return write(STDERR_FILENO, s, strlen(s));
+        s = lock_user_string(args);
+        ret = write(STDERR_FILENO, s, strlen(s));
+        unlock_user(s, args, 0);
+        return ret;
     case SYS_WRITE:
-        ret = set_swi_errno(ts, write(ARG(0), (void *)ARG(1), ARG(2)));
+        ret = set_swi_errno(ts, write(ARG(0), g2h(ARG(1)), ARG(2)));
         if (ret == (uint32_t)-1)
             return -1;
         return ARG(2) - ret;
     case SYS_READ:
-        ret = set_swi_errno(ts, read(ARG(0), (void *)ARG(1), ARG(2)));
+        ret = set_swi_errno(ts, read(ARG(0), g2h(ARG(1)), ARG(2)));
         if (ret == (uint32_t)-1)
             return -1;
         return ARG(2) - ret;
@@ -140,20 +145,21 @@ uint32_t do_arm_semihosting(CPUState *env)
         /* XXX: Not implemented.  */
         return -1;
     case SYS_REMOVE:
-        return set_swi_errno(ts, remove((char *)ARG(0)));
+        return set_swi_errno(ts, remove((char *)g2h(ARG(0))));
     case SYS_RENAME:
-        return set_swi_errno(ts, rename((char *)ARG(0), (char *)ARG(2)));
+        return set_swi_errno(ts, rename((char *)g2h(ARG(0)),
+                             (char *)g2h(ARG(2))));
     case SYS_CLOCK:
         return clock() / (CLOCKS_PER_SEC / 100);
     case SYS_TIME:
         return set_swi_errno(ts, time(NULL));
     case SYS_SYSTEM:
-        return set_swi_errno(ts, system((char *)ARG(0)));
+        return set_swi_errno(ts, system((char *)g2h(ARG(0))));
     case SYS_ERRNO:
         return ts->swi_errno;
     case SYS_GET_CMDLINE:
         /* XXX: Not implemented.  */
-        s = (char *)ARG(0);
+        s = (char *)g2h(ARG(0));
         *s = 0;
         return -1;
     case SYS_HEAPINFO:
@@ -166,11 +172,11 @@ uint32_t do_arm_semihosting(CPUState *env)
             if (!ts->heap_limit) {
                 long ret;
 
-                ts->heap_base = do_brk(NULL);
+                ts->heap_base = do_brk(0);
                 limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
                 /* Try a big heap, and reduce the size if that fails.  */
                 for (;;) {
-                    ret = do_brk((char *)limit);
+                    ret = do_brk(limit);
                     if (ret != -1)
                         break;
                     limit = (ts->heap_base >> 1) + (limit >> 1);
@@ -178,7 +184,8 @@ uint32_t do_arm_semihosting(CPUState *env)
                 ts->heap_limit = limit;
             }
               
-            ptr = (uint32_t *)ARG(0);
+            page_unprotect_range (ARG(0), 32);
+            ptr = (uint32_t *)g2h(ARG(0));
             ptr[0] = tswap32(ts->heap_base);
             ptr[1] = tswap32(ts->heap_limit);
             ptr[2] = tswap32(ts->stack_base);
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index c934fb831b34675acffaee183e9cec4c4ab71ff0..14c00852a4f88eaa6c60709ecd20e4a5f01089f4 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -97,17 +97,17 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
 
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
-    target_long *stack = (void *)infop->start_stack;
+    target_long stack = infop->start_stack;
     memset(regs, 0, sizeof(*regs));
     regs->ARM_cpsr = 0x10;
     if (infop->entry & 1)
       regs->ARM_cpsr |= CPSR_T;
     regs->ARM_pc = infop->entry & 0xfffffffe;
     regs->ARM_sp = infop->start_stack;
-    regs->ARM_r2 = tswapl(stack[2]); /* envp */
-    regs->ARM_r1 = tswapl(stack[1]); /* argv */
+    regs->ARM_r2 = tgetl(stack + 8); /* envp */
+    regs->ARM_r1 = tgetl(stack + 4); /* envp */
     /* XXX: it seems that r0 is zeroed after ! */
-    //    regs->ARM_r0 = tswapl(stack[0]); /* argc */
+    //    regs->ARM_r0 = tgetl(stack); /* argc */
 }
 
 #define USE_ELF_CORE_DUMP
@@ -202,7 +202,7 @@ do {                                                       \
     _r->gpr[3] = bprm->argc;                               \
     _r->gpr[4] = (unsigned long)++pos;                     \
     for (; tmp != 0; pos++)                                \
-        tmp = *pos;                                        \
+        tmp = ldl(pos);                                    \
     _r->gpr[5] = (unsigned long)pos;                       \
 } while (0)
 
@@ -297,7 +297,7 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
  */
 struct linux_binprm {
         char buf[128];
-        unsigned long page[MAX_ARG_PAGES];
+        void *page[MAX_ARG_PAGES];
         unsigned long p;
         int sh_bang;
 	int fd;
@@ -427,37 +427,13 @@ static void bswap_sym(Elf32_Sym *sym)
 }
 #endif
 
-static void * get_free_page(void)
-{
-    void *	retval;
-
-    /* User-space version of kernel get_free_page.  Returns a page-aligned
-     * page-sized chunk of memory.
-     */
-    retval = (void *)target_mmap(0, qemu_host_page_size, PROT_READ|PROT_WRITE, 
-                                 MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
-
-    if((long)retval == -1) {
-	perror("get_free_page");
-	exit(-1);
-    }
-    else {
-	return(retval);
-    }
-}
-
-static void free_page(void * pageaddr)
-{
-    target_munmap((unsigned long)pageaddr, qemu_host_page_size);
-}
-
 /*
  * 'copy_string()' copies argument/envelope strings from user
  * memory to free pages in kernel mem. These are in a format ready
  * to be put directly into the top of new user memory.
  *
  */
-static unsigned long copy_strings(int argc,char ** argv,unsigned long *page,
+static unsigned long copy_strings(int argc,char ** argv, void **page,
                 unsigned long p)
 {
     char *tmp, *tmp1, *pag = NULL;
@@ -482,10 +458,10 @@ static unsigned long copy_strings(int argc,char ** argv,unsigned long *page,
 	    --p; --tmp; --len;
 	    if (--offset < 0) {
 		offset = p % TARGET_PAGE_SIZE;
-                pag = (char *) page[p/TARGET_PAGE_SIZE];
+                pag = (char *)page[p/TARGET_PAGE_SIZE];
                 if (!pag) {
-                    pag = (char *)get_free_page();
-                    page[p/TARGET_PAGE_SIZE] = (unsigned long)pag;
+                    pag = (char *)malloc(TARGET_PAGE_SIZE);
+                    page[p/TARGET_PAGE_SIZE] = pag;
                     if (!pag)
                         return 0;
 		}
@@ -591,10 +567,20 @@ static int prepare_binprm(struct linux_binprm *bprm)
     }
 }
 
-unsigned long setup_arg_pages(unsigned long p, struct linux_binprm * bprm,
-						struct image_info * info)
+static inline void memcpy_to_target(target_ulong dest, const void *src,
+                                    unsigned long len)
 {
-    unsigned long stack_base, size, error;
+    void *host_ptr;
+
+    host_ptr = lock_user(dest, len, 0);
+    memcpy(host_ptr, src, len);
+    unlock_user(host_ptr, dest, 1);
+}
+
+unsigned long setup_arg_pages(target_ulong p, struct linux_binprm * bprm,
+					      struct image_info * info)
+{
+    target_ulong stack_base, size, error;
     int i;
 
     /* Create enough stack to hold everything.  If we don't use
@@ -627,10 +613,10 @@ unsigned long setup_arg_pages(unsigned long p, struct linux_binprm * bprm,
 	if (bprm->page[i]) {
 	    info->rss++;
 
-	    memcpy((void *)stack_base, (void *)bprm->page[i], TARGET_PAGE_SIZE);
-	    free_page((void *)bprm->page[i]);
+	    memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
+	    free(bprm->page[i]);
 	}
-	stack_base += TARGET_PAGE_SIZE;
+        stack_base += TARGET_PAGE_SIZE;
     }
     return p;
 }
@@ -657,7 +643,6 @@ static void set_brk(unsigned long start, unsigned long end)
 static void padzero(unsigned long elf_bss)
 {
         unsigned long nbyte;
-        char * fpnt;
 
         /* XXX: this is really a hack : if the real host page size is
            smaller than the target page size, some pages after the end
@@ -679,55 +664,57 @@ static void padzero(unsigned long elf_bss)
         nbyte = elf_bss & (qemu_host_page_size-1);
         if (nbyte) {
 	    nbyte = qemu_host_page_size - nbyte;
-	    fpnt = (char *) elf_bss;
 	    do {
-		*fpnt++ = 0;
+		tput8(elf_bss, 0);
+                elf_bss++;
 	    } while (--nbyte);
         }
 }
 
-static unsigned int * create_elf_tables(char *p, int argc, int envc,
-                                        struct elfhdr * exec,
-                                        unsigned long load_addr,
-                                        unsigned long load_bias,
-                                        unsigned long interp_load_addr, int ibcs,
-                                        struct image_info *info)
+
+static unsigned long create_elf_tables(target_ulong p, int argc, int envc,
+                                       struct elfhdr * exec,
+                                       unsigned long load_addr,
+                                       unsigned long load_bias,
+                                       unsigned long interp_load_addr, int ibcs,
+                                       struct image_info *info)
 {
-        target_ulong *argv, *envp;
-        target_ulong *sp, *csp;
-        target_ulong *u_platform;
+        target_ulong argv, envp;
+        target_ulong sp;
+        int size;
+        target_ulong u_platform;
         const char *k_platform;
-        int v;
+        const int n = sizeof(target_ulong);
 
-	/*
-	 * Force 16 byte _final_ alignment here for generality.
-	 */
-        sp = (unsigned int *) (~15UL & (unsigned long) p);
-        u_platform = NULL;
+        sp = p;
+        u_platform = 0;
         k_platform = ELF_PLATFORM;
         if (k_platform) {
             size_t len = strlen(k_platform) + 1;
-            sp -= (len + sizeof(target_ulong) - 1) / sizeof(target_ulong);
-            u_platform = (target_ulong *)sp;
-            __copy_to_user(u_platform, k_platform, len);
+            sp -= (len + n - 1) & ~(n - 1);
+            u_platform = sp;
+            memcpy_to_target(sp, k_platform, len);
         }
-        csp = sp;
-        csp -= (DLINFO_ITEMS + 1) * 2;
+	/*
+	 * Force 16 byte _final_ alignment here for generality.
+	 */
+        sp = sp &~ (target_ulong)15;
+        size = (DLINFO_ITEMS + 1) * 2;
         if (k_platform)
-          csp -= 2;
+          size += 2;
 #ifdef DLINFO_ARCH_ITEMS
-	csp -= DLINFO_ARCH_ITEMS*2;
+	size += DLINFO_ARCH_ITEMS * 2;
 #endif
-        csp -= envc+1;
-        csp -= argc+1;
-	csp -= (!ibcs ? 3 : 1);	/* argc itself */
-        if ((unsigned long)csp & 15UL)
-            sp -= ((unsigned long)csp & 15UL) / sizeof(*sp);
+        size += envc + argc + 2;
+	size += (!ibcs ? 3 : 1);	/* argc itself */
+        size *= n;
+        if (size & 15)
+            sp -= 16 - (size & 15);
         
-#define NEW_AUX_ENT(id, val) \
-          sp -= 2; \
-          put_user (id, sp); \
-          put_user (val, sp + 1)
+#define NEW_AUX_ENT(id, val) do { \
+            sp -= n; tputl(sp, val); \
+            sp -= n; tputl(sp, id); \
+          } while(0)
         NEW_AUX_ENT (AT_NULL, 0);
 
         /* There must be exactly DLINFO_ITEMS entries here.  */
@@ -744,7 +731,7 @@ static unsigned int * create_elf_tables(char *p, int argc, int envc,
         NEW_AUX_ENT(AT_EGID, (target_ulong) getegid());
         NEW_AUX_ENT(AT_HWCAP, (target_ulong) ELF_HWCAP);
         if (k_platform)
-            NEW_AUX_ENT(AT_PLATFORM, (target_ulong) u_platform);
+            NEW_AUX_ENT(AT_PLATFORM, u_platform);
 #ifdef ARCH_DLINFO
 	/* 
 	 * ARCH_DLINFO must come last so platform specific code can enforce
@@ -754,39 +741,32 @@ static unsigned int * create_elf_tables(char *p, int argc, int envc,
 #endif
 #undef NEW_AUX_ENT
 
-        sp -= envc+1;
+        sp -= (envc + 1) * n;
         envp = sp;
-        sp -= argc+1;
+        sp -= (argc + 1) * n;
         argv = sp;
         if (!ibcs) {
-                put_user((target_ulong)envp,--sp);
-                put_user((target_ulong)argv,--sp);
+            sp -= n; tputl(sp, envp);
+            sp -= n; tputl(sp, argv);
         }
-        put_user(argc,--sp);
-        info->arg_start = (unsigned int)((unsigned long)p & 0xffffffff);
+        sp -= n; tputl(sp, argc);
+        info->arg_start = p;
         while (argc-->0) {
-                put_user((target_ulong)p,argv++);
-                do {
-                    get_user(v, p);
-                    p++;
-                } while (v != 0);
+            tputl(argv, p); argv += n;
+            p += target_strlen(p) + 1;
         }
-        put_user(0,argv);
-        info->arg_end = info->env_start = (unsigned int)((unsigned long)p & 0xffffffff);
+        tputl(argv, 0);
+        info->arg_end = info->env_start = p;
         while (envc-->0) {
-                put_user((target_ulong)p,envp++);
-                do {
-                    get_user(v, p);
-                    p++;
-                } while (v != 0);
+            tputl(envp, p); envp += n;
+            p += target_strlen(p) + 1;
         }
-        put_user(0,envp);
-        info->env_end = (unsigned int)((unsigned long)p & 0xffffffff);
+        tputl(envp, 0);
+        info->env_end = p;
         return sp;
 }
 
 
-
 static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 				     int interpreter_fd,
 				     unsigned long *interp_load_addr)
@@ -1335,8 +1315,7 @@ static int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * r
 #ifdef LOW_ELF_STACK
     info->start_stack = bprm->p = elf_stack - 4;
 #endif
-    bprm->p = (unsigned long)
-      create_elf_tables((char *)bprm->p,
+    bprm->p = create_elf_tables(bprm->p,
 		    bprm->argc,
 		    bprm->envc,
                     &elf_ex,
@@ -1432,6 +1411,7 @@ int elf_exec(const char * filename, char ** argv, char ** envp,
         if(retval>=0) {
 	    retval = load_elf_binary(&bprm,regs,infop);
 	}
+        
         if(retval>=0) {
 	    /* success.  Initialize important registers */
             init_thread(regs, infop);
@@ -1440,7 +1420,7 @@ int elf_exec(const char * filename, char ** argv, char ** envp,
 
         /* Something went wrong, return the inode and free the argument pages*/
         for (i=0 ; i<MAX_ARG_PAGES ; i++) {
-	    free_page((void *)bprm.page[i]);
+	    free(bprm.page[i]);
 	}
         return(retval);
 }
diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h
index daefaec6f9cf58752ecb474e88d5cab0e46144c4..dae3efaa9712915d406ef115b4c23dd3469b6015 100644
--- a/linux-user/ioctls.h
+++ b/linux-user/ioctls.h
@@ -55,7 +55,7 @@
      IOCTL(KDMKTONE, 0, TYPE_INT)
      IOCTL(KDGKBTYPE, IOC_R, MK_PTR(TYPE_CHAR))
      IOCTL(KDGKBENT, IOC_RW, MK_PTR(MK_STRUCT(STRUCT_kbentry)))
-     IOCTL(KDGKBSENT, IOC_RW, TYPE_PTRVOID)
+     IOCTL(KDGKBSENT, IOC_RW, MK_PTR(MK_STRUCT(STRUCT_kbsentry)))
 
      IOCTL(BLKROSET, IOC_W, MK_PTR(TYPE_INT))
      IOCTL(BLKROGET, IOC_R, MK_PTR(TYPE_INT))
diff --git a/linux-user/main.c b/linux-user/main.c
index 81450051bbbae76a2fd4cc57a1fa72f5c525913e..1f4720516d27dead22832f4c24a55d22747daba7 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -152,21 +152,25 @@ static void write_dt(void *ptr, unsigned long addr, unsigned long limit,
                      int flags)
 {
     unsigned int e1, e2;
+    uint32_t *p;
     e1 = (addr << 16) | (limit & 0xffff);
     e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000);
     e2 |= flags;
-    stl((uint8_t *)ptr, e1);
-    stl((uint8_t *)ptr + 4, e2);
+    p = ptr;
+    p[0] = tswapl(e1);
+    p[1] = tswapl(e2);
 }
 
 static void set_gate(void *ptr, unsigned int type, unsigned int dpl, 
                      unsigned long addr, unsigned int sel)
 {
     unsigned int e1, e2;
+    uint32_t *p;
     e1 = (addr & 0xffff) | (sel << 16);
     e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
-    stl((uint8_t *)ptr, e1);
-    stl((uint8_t *)ptr + 4, e2);
+    p = ptr;
+    p[0] = tswapl(e1);
+    p[1] = tswapl(e2);
 }
 
 uint64_t gdt_table[6];
@@ -343,7 +347,7 @@ void cpu_loop(CPUARMState *env)
 
                 /* we handle the FPU emulation here, as Linux */
                 /* we get the opcode */
-                opcode = ldl_raw((uint8_t *)env->regs[15]);
+                opcode = tget32(env->regs[15]);
                 
                 if (EmulateAll(opcode, &ts->fpa, env) == 0) {
                     info.si_signo = SIGILL;
@@ -364,20 +368,20 @@ void cpu_loop(CPUARMState *env)
                 /* system call */
                 if (trapnr == EXCP_BKPT) {
                     if (env->thumb) {
-                        insn = lduw((void *)(env->regs[15]));
+                        insn = tget16(env->regs[15]);
                         n = insn & 0xff;
                         env->regs[15] += 2;
                     } else {
-                        insn = ldl((void *)(env->regs[15]));
+                        insn = tget32(env->regs[15]);
                         n = (insn & 0xf) | ((insn >> 4) & 0xff0);
                         env->regs[15] += 4;
                     }
                 } else {
                     if (env->thumb) {
-                        insn = lduw((void *)(env->regs[15] - 2));
+                        insn = tget16(env->regs[15] - 2);
                         n = insn & 0xff;
                     } else {
-                        insn = ldl((void *)(env->regs[15] - 4));
+                        insn = tget32(env->regs[15] - 4);
                         n = insn & 0xffffff;
                     }
                 }
@@ -475,16 +479,16 @@ static inline int get_reg_index(CPUSPARCState *env, int cwp, int index)
 static inline void save_window_offset(CPUSPARCState *env, int cwp1)
 {
     unsigned int i;
-    uint32_t *sp_ptr;
+    target_ulong sp_ptr;
     
-    sp_ptr = (uint32_t *)(env->regbase[get_reg_index(env, cwp1, 6)]);
+    sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];
 #if defined(DEBUG_WIN)
     printf("win_overflow: sp_ptr=0x%x save_cwp=%d\n", 
            (int)sp_ptr, cwp1);
 #endif
     for(i = 0; i < 16; i++) {
-        put_user(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);
-        sp_ptr++;
+        tputl(sp_ptr, env->regbase[get_reg_index(env, cwp1, 8 + i)]);
+        sp_ptr += sizeof(target_ulong);
     }
 }
 
@@ -500,22 +504,21 @@ static void save_window(CPUSPARCState *env)
 static void restore_window(CPUSPARCState *env)
 {
     unsigned int new_wim, i, cwp1;
-    uint32_t *sp_ptr, reg;
+    target_ulong sp_ptr;
     
     new_wim = ((env->wim << 1) | (env->wim >> (NWINDOWS - 1))) &
         ((1LL << NWINDOWS) - 1);
     
     /* restore the invalid window */
     cwp1 = (env->cwp + 1) & (NWINDOWS - 1);
-    sp_ptr = (uint32_t *)(env->regbase[get_reg_index(env, cwp1, 6)]);
+    sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];
 #if defined(DEBUG_WIN)
     printf("win_underflow: sp_ptr=0x%x load_cwp=%d\n", 
            (int)sp_ptr, cwp1);
 #endif
     for(i = 0; i < 16; i++) {
-        get_user(reg, sp_ptr);
-        env->regbase[get_reg_index(env, cwp1, 8 + i)] = reg;
-        sp_ptr++;
+        env->regbase[get_reg_index(env, cwp1, 8 + i)] = tgetl(sp_ptr);
+        sp_ptr += sizeof(target_ulong);
     }
     env->wim = new_wim;
 }
@@ -1304,15 +1307,9 @@ void cpu_loop(CPUMIPSState *env)
                     if (nb_args >= 5) {
                         sp_reg = env->gpr[29];
                         /* these arguments are taken from the stack */
-                        if (get_user(arg5, (target_ulong *)(sp_reg + 16))) {
-                            ret = -EFAULT;
-                            goto fail;
-                        }
+                        arg5 = tgetl(sp_reg + 16);
                         if (nb_args >= 6) {
-                            if (get_user(arg6, (target_ulong *)(sp_reg + 20))) {
-                                ret = -EFAULT;
-                                goto fail;
-                            }
+                            arg6 = tgetl(sp_reg + 20);
                         } else {
                             arg6 = 0;
                         }
@@ -1347,8 +1344,7 @@ void cpu_loop(CPUMIPSState *env)
             {
                 uint32_t insn, op;
 
-                if (get_user(insn, (uint32_t *)env->PC) < 0)
-                    goto sigill;
+                insn = tget32(env->PC);
                 op = insn >> 26;
                 //                printf("insn=%08x op=%02x\n", insn, op);
                 /* XXX: totally dummy FP ops just to be able to launch
@@ -1531,7 +1527,7 @@ int main(int argc, char **argv)
         fprintf(logfile, "entry       0x%08lx\n" , info->entry);
     }
 
-    target_set_brk((char *)info->brk);
+    target_set_brk(info->brk);
     syscall_init();
     signal_init();
 
@@ -1566,7 +1562,7 @@ int main(int argc, char **argv)
     env->eip = regs->eip;
 
     /* linux interrupt setup */
-    env->idt.base = (long)idt_table;
+    env->idt.base = h2g(idt_table);
     env->idt.limit = sizeof(idt_table) - 1;
     set_idt(0, 0);
     set_idt(1, 0);
@@ -1591,7 +1587,7 @@ int main(int argc, char **argv)
     set_idt(0x80, 3);
 
     /* linux segment setup */
-    env->gdt.base = (long)gdt_table;
+    env->gdt.base = h2g(gdt_table);
     env->gdt.limit = sizeof(gdt_table) - 1;
     write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff,
              DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | 
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 948f2f6b2e7b1b2a6218596db5c7ff0fca352d64..0c906257b131e124b3070ecf09cafc812c2c432a 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -29,10 +29,10 @@
 
 //#define DEBUG_MMAP
 
-/* NOTE: all the constants are the HOST ones */
-int target_mprotect(unsigned long start, unsigned long len, int prot)
+/* NOTE: all the constants are the HOST ones, but addresses are target. */
+int target_mprotect(target_ulong start, target_ulong len, int prot)
 {
-    unsigned long end, host_start, host_end, addr;
+    target_ulong end, host_start, host_end, addr;
     int prot1, ret;
 
 #ifdef DEBUG_MMAP
@@ -67,7 +67,7 @@ int target_mprotect(unsigned long start, unsigned long len, int prot)
             }
             end = host_end;
         }
-        ret = mprotect((void *)host_start, qemu_host_page_size, prot1 & PAGE_BITS);
+        ret = mprotect(g2h(host_start), qemu_host_page_size, prot1 & PAGE_BITS);
         if (ret != 0)
             return ret;
         host_start += qemu_host_page_size;
@@ -77,7 +77,7 @@ int target_mprotect(unsigned long start, unsigned long len, int prot)
         for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
             prot1 |= page_get_flags(addr);
         }
-        ret = mprotect((void *)(host_end - qemu_host_page_size), qemu_host_page_size, 
+        ret = mprotect(g2h(host_end - qemu_host_page_size), qemu_host_page_size, 
                        prot1 & PAGE_BITS);
         if (ret != 0)
             return ret;
@@ -86,7 +86,7 @@ int target_mprotect(unsigned long start, unsigned long len, int prot)
     
     /* handle the pages in the middle */
     if (host_start < host_end) {
-        ret = mprotect((void *)host_start, host_end - host_start, prot);
+        ret = mprotect(g2h(host_start), host_end - host_start, prot);
         if (ret != 0)
             return ret;
     }
@@ -95,28 +95,31 @@ int target_mprotect(unsigned long start, unsigned long len, int prot)
 }
 
 /* map an incomplete host page */
-int mmap_frag(unsigned long host_start, 
-               unsigned long start, unsigned long end, 
-               int prot, int flags, int fd, unsigned long offset)
+static int mmap_frag(target_ulong real_start, 
+                     target_ulong start, target_ulong end, 
+                     int prot, int flags, int fd, target_ulong offset)
 {
-    unsigned long host_end, ret, addr;
+    target_ulong real_end, ret, addr;
+    void *host_start;
     int prot1, prot_new;
 
-    host_end = host_start + qemu_host_page_size;
+    real_end = real_start + qemu_host_page_size;
+    host_start = g2h(real_start);
 
     /* get the protection of the target pages outside the mapping */
     prot1 = 0;
-    for(addr = host_start; addr < host_end; addr++) {
+    for(addr = real_start; addr < real_end; addr++) {
         if (addr < start || addr >= end)
             prot1 |= page_get_flags(addr);
     }
     
     if (prot1 == 0) {
         /* no page was there, so we allocate one */
-        ret = (long)mmap((void *)host_start, qemu_host_page_size, prot, 
+        ret = (long)mmap(host_start, qemu_host_page_size, prot, 
                          flags | MAP_ANONYMOUS, -1, 0);
         if (ret == -1)
             return ret;
+        prot1 = prot;
     }
     prot1 &= PAGE_BITS;
 
@@ -130,31 +133,35 @@ int mmap_frag(unsigned long host_start,
 
         /* adjust protection to be able to read */
         if (!(prot1 & PROT_WRITE))
-            mprotect((void *)host_start, qemu_host_page_size, prot1 | PROT_WRITE);
+            mprotect(host_start, qemu_host_page_size, prot1 | PROT_WRITE);
         
         /* read the corresponding file data */
-        pread(fd, (void *)start, end - start, offset);
+        pread(fd, g2h(start), end - start, offset);
         
         /* put final protection */
         if (prot_new != (prot1 | PROT_WRITE))
-            mprotect((void *)host_start, qemu_host_page_size, prot_new);
+            mprotect(host_start, qemu_host_page_size, prot_new);
     } else {
         /* just update the protection */
         if (prot_new != prot1) {
-            mprotect((void *)host_start, qemu_host_page_size, prot_new);
+            mprotect(host_start, qemu_host_page_size, prot_new);
         }
     }
     return 0;
 }
 
 /* NOTE: all the constants are the HOST ones */
-long target_mmap(unsigned long start, unsigned long len, int prot, 
-                 int flags, int fd, unsigned long offset)
+long target_mmap(target_ulong start, target_ulong len, int prot, 
+                 int flags, int fd, target_ulong offset)
 {
-    unsigned long ret, end, host_start, host_end, retaddr, host_offset, host_len;
+    target_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len;
+    long host_start;
 #if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__) || \
     defined(__ia64)
-    static unsigned long last_start = 0x40000000;
+    static target_ulong last_start = 0x40000000;
+#elif defined(__CYGWIN__)
+    /* Cygwin doesn't have a whole lot of address space.  */
+    static target_ulong last_start = 0x18000000;
 #endif
 
 #ifdef DEBUG_MMAP
@@ -191,45 +198,49 @@ long target_mmap(unsigned long start, unsigned long len, int prot,
     len = TARGET_PAGE_ALIGN(len);
     if (len == 0)
         return start;
-    host_start = start & qemu_host_page_mask;
+    real_start = start & qemu_host_page_mask;
 
     if (!(flags & MAP_FIXED)) {
 #if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__) || \
-    defined(__ia64)
+    defined(__ia64) || defined(__CYGWIN__)
         /* tell the kenel to search at the same place as i386 */
-        if (host_start == 0) {
-            host_start = last_start;
+        if (real_start == 0) {
+            real_start = last_start;
             last_start += HOST_PAGE_ALIGN(len);
         }
 #endif
         if (qemu_host_page_size != qemu_real_host_page_size) {
             /* NOTE: this code is only for debugging with '-p' option */
+            /* ??? Can also occur when TARGET_PAGE_SIZE > host page size.  */
             /* reserve a memory area */
+            /* ??? This needs fixing for remapping.  */
+abort();
             host_len = HOST_PAGE_ALIGN(len) + qemu_host_page_size - TARGET_PAGE_SIZE;
-            host_start = (long)mmap((void *)host_start, host_len, PROT_NONE, 
+            real_start = (long)mmap(g2h(real_start), host_len, PROT_NONE, 
                                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-            if (host_start == -1)
-                return host_start;
-            host_end = host_start + host_len;
-            start = HOST_PAGE_ALIGN(host_start);
+            if (real_start == -1)
+                return real_start;
+            real_end = real_start + host_len;
+            start = HOST_PAGE_ALIGN(real_start);
             end = start + HOST_PAGE_ALIGN(len);
-            if (start > host_start)
-                munmap((void *)host_start, start - host_start);
-            if (end < host_end)
-                munmap((void *)end, host_end - end);
+            if (start > real_start)
+                munmap((void *)real_start, start - real_start);
+            if (end < real_end)
+                munmap((void *)end, real_end - end);
             /* use it as a fixed mapping */
             flags |= MAP_FIXED;
         } else {
             /* if not fixed, no need to do anything */
             host_offset = offset & qemu_host_page_mask;
             host_len = len + offset - host_offset;
-            start = (long)mmap((void *)host_start, host_len, 
-                               prot, flags, fd, host_offset);
-            if (start == -1)
-                return start;
+            host_start = (long)mmap(real_start ? g2h(real_start) : NULL,
+                                    host_len, prot, flags, fd, host_offset);
+            if (host_start == -1)
+                return host_start;
             /* update start so that it points to the file position at 'offset' */
             if (!(flags & MAP_ANONYMOUS)) 
-                start += offset - host_offset;
+                host_start += offset - host_offset;
+            start = h2g(host_start);
             goto the_end1;
         }
     }
@@ -239,7 +250,7 @@ long target_mmap(unsigned long start, unsigned long len, int prot,
         return -1;
     }
     end = start + len;
-    host_end = HOST_PAGE_ALIGN(end);
+    real_end = HOST_PAGE_ALIGN(end);
 
     /* worst case: we cannot map the file because the offset is not
        aligned, so we read it */
@@ -257,7 +268,7 @@ long target_mmap(unsigned long start, unsigned long len, int prot,
                               -1, 0);
         if (retaddr == -1)
             return retaddr;
-        pread(fd, (void *)start, len, offset);
+        pread(fd, g2h(start), len, offset);
         if (!(prot & PROT_WRITE)) {
             ret = target_mprotect(start, len, prot);
             if (ret != 0)
@@ -267,40 +278,40 @@ long target_mmap(unsigned long start, unsigned long len, int prot,
     }
 
     /* handle the start of the mapping */
-    if (start > host_start) {
-        if (host_end == host_start + qemu_host_page_size) {
+    if (start > real_start) {
+        if (real_end == real_start + qemu_host_page_size) {
             /* one single host page */
-            ret = mmap_frag(host_start, start, end,
+            ret = mmap_frag(real_start, start, end,
                             prot, flags, fd, offset);
             if (ret == -1)
                 return ret;
             goto the_end1;
         }
-        ret = mmap_frag(host_start, start, host_start + qemu_host_page_size,
+        ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
                         prot, flags, fd, offset);
         if (ret == -1)
             return ret;
-        host_start += qemu_host_page_size;
+        real_start += qemu_host_page_size;
     }
     /* handle the end of the mapping */
-    if (end < host_end) {
-        ret = mmap_frag(host_end - qemu_host_page_size, 
-                        host_end - qemu_host_page_size, host_end,
+    if (end < real_end) {
+        ret = mmap_frag(real_end - qemu_host_page_size, 
+                        real_end - qemu_host_page_size, real_end,
                         prot, flags, fd, 
-                        offset + host_end - qemu_host_page_size - start);
+                        offset + real_end - qemu_host_page_size - start);
         if (ret == -1)
             return ret;
-        host_end -= qemu_host_page_size;
+        real_end -= qemu_host_page_size;
     }
     
     /* map the middle (easier) */
-    if (host_start < host_end) {
+    if (real_start < real_end) {
         unsigned long offset1;
 	if (flags & MAP_ANONYMOUS)
 	  offset1 = 0;
 	else
-	  offset1 = offset + host_start - start;
-        ret = (long)mmap((void *)host_start, host_end - host_start, 
+	  offset1 = offset + real_start - start;
+        ret = (long)mmap(g2h(real_start), real_end - real_start, 
                          prot, flags, fd, offset1);
         if (ret == -1)
             return ret;
@@ -316,9 +327,9 @@ long target_mmap(unsigned long start, unsigned long len, int prot,
     return start;
 }
 
-int target_munmap(unsigned long start, unsigned long len)
+int target_munmap(target_ulong start, target_ulong len)
 {
-    unsigned long end, host_start, host_end, addr;
+    target_ulong end, real_start, real_end, addr;
     int prot, ret;
 
 #ifdef DEBUG_MMAP
@@ -330,36 +341,36 @@ int target_munmap(unsigned long start, unsigned long len)
     if (len == 0)
         return -EINVAL;
     end = start + len;
-    host_start = start & qemu_host_page_mask;
-    host_end = HOST_PAGE_ALIGN(end);
+    real_start = start & qemu_host_page_mask;
+    real_end = HOST_PAGE_ALIGN(end);
 
-    if (start > host_start) {
+    if (start > real_start) {
         /* handle host page containing start */
         prot = 0;
-        for(addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) {
+        for(addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
             prot |= page_get_flags(addr);
         }
-        if (host_end == host_start + qemu_host_page_size) {
-            for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
+        if (real_end == real_start + qemu_host_page_size) {
+            for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
                 prot |= page_get_flags(addr);
             }
-            end = host_end;
+            end = real_end;
         }
         if (prot != 0)
-            host_start += qemu_host_page_size;
+            real_start += qemu_host_page_size;
     }
-    if (end < host_end) {
+    if (end < real_end) {
         prot = 0;
-        for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
+        for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
             prot |= page_get_flags(addr);
         }
         if (prot != 0)
-            host_end -= qemu_host_page_size;
+            real_end -= qemu_host_page_size;
     }
     
     /* unmap what we can */
-    if (host_start < host_end) {
-        ret = munmap((void *)host_start, host_end - host_start);
+    if (real_start < real_end) {
+        ret = munmap((void *)real_start, real_end - real_start);
         if (ret != 0)
             return ret;
     }
@@ -370,25 +381,26 @@ int target_munmap(unsigned long start, unsigned long len)
 
 /* XXX: currently, we only handle MAP_ANONYMOUS and not MAP_FIXED
    blocks which have been allocated starting on a host page */
-long target_mremap(unsigned long old_addr, unsigned long old_size, 
-                   unsigned long new_size, unsigned long flags,
-                   unsigned long new_addr)
+long target_mremap(target_ulong old_addr, target_ulong old_size, 
+                   target_ulong new_size, unsigned long flags,
+                   target_ulong new_addr)
 {
     int prot;
 
     /* XXX: use 5 args syscall */
-    new_addr = (long)mremap((void *)old_addr, old_size, new_size, flags);
+    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags);
     if (new_addr == -1)
         return new_addr;
+    new_addr = h2g(new_addr);
     prot = page_get_flags(old_addr);
     page_set_flags(old_addr, old_addr + old_size, 0);
     page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID);
     return new_addr;
 }
 
-int target_msync(unsigned long start, unsigned long len, int flags)
+int target_msync(target_ulong start, target_ulong len, int flags)
 {
-    unsigned long end;
+    target_ulong end;
 
     if (start & ~TARGET_PAGE_MASK)
         return -EINVAL;
@@ -400,6 +412,6 @@ int target_msync(unsigned long start, unsigned long len, int flags)
         return 0;
     
     start &= qemu_host_page_mask;
-    return msync((void *)start, end - start, flags);
+    return msync(g2h(start), end - start, flags);
 }
 
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index f385a1c92b9a26bf13ef578120bd169f45aef6f4..a797c512bb7f0c38360d2c76bc85f7fe082263e7 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -69,7 +69,7 @@ typedef struct TaskState {
     int swi_errno;
 #endif
 #ifdef TARGET_I386
-    struct target_vm86plus_struct *target_v86;
+    target_ulong target_v86;
     struct vm86_saved_state vm86_saved_regs;
     struct target_vm86plus_struct vm86plus;
     uint32_t v86flags;
@@ -84,8 +84,8 @@ extern TaskState *first_task_state;
 int elf_exec(const char * filename, char ** argv, char ** envp, 
              struct target_pt_regs * regs, struct image_info *infop);
 
-void target_set_brk(char *new_brk);
-long do_brk(char *new_brk);
+void target_set_brk(target_ulong new_brk);
+long do_brk(target_ulong new_brk);
 void syscall_init(void);
 long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, 
                 long arg4, long arg5, long arg6);
@@ -112,19 +112,18 @@ long do_rt_sigreturn(CPUState *env);
 void save_v86_state(CPUX86State *env);
 void handle_vm86_trap(CPUX86State *env, int trapno);
 void handle_vm86_fault(CPUX86State *env);
-int do_vm86(CPUX86State *env, long subfunction, 
-            struct target_vm86plus_struct * target_v86);
+int do_vm86(CPUX86State *env, long subfunction, target_ulong v86_addr);
 #endif
 
 /* mmap.c */
-int target_mprotect(unsigned long start, unsigned long len, int prot);
-long target_mmap(unsigned long start, unsigned long len, int prot, 
-                 int flags, int fd, unsigned long offset);
-int target_munmap(unsigned long start, unsigned long len);
-long target_mremap(unsigned long old_addr, unsigned long old_size, 
-                   unsigned long new_size, unsigned long flags,
-                   unsigned long new_addr);
-int target_msync(unsigned long start, unsigned long len, int flags);
+int target_mprotect(target_ulong start, target_ulong len, int prot);
+long target_mmap(target_ulong start, target_ulong len, int prot, 
+                 int flags, int fd, target_ulong offset);
+int target_munmap(target_ulong start, target_ulong len);
+long target_mremap(target_ulong old_addr, target_ulong old_size, 
+                   target_ulong new_size, unsigned long flags,
+                   target_ulong new_addr);
+int target_msync(target_ulong start, target_ulong len, int flags);
 
 /* user access */
 
@@ -133,21 +132,22 @@ int target_msync(unsigned long start, unsigned long len, int flags);
 
 #define access_ok(type,addr,size) (1)
 
+/* NOTE get_user and put_user use host addresses.  */
 #define __put_user(x,ptr)\
 ({\
     int size = sizeof(*ptr);\
     switch(size) {\
     case 1:\
-        stb(ptr, (typeof(*ptr))(x));\
+        *(uint8_t *)(ptr) = (typeof(*ptr))(x);\
         break;\
     case 2:\
-        stw(ptr, (typeof(*ptr))(x));\
+        *(uint16_t *)(ptr) = tswap16((typeof(*ptr))(x));\
         break;\
     case 4:\
-        stl(ptr, (typeof(*ptr))(x));\
+        *(uint32_t *)(ptr) = tswap32((typeof(*ptr))(x));\
         break;\
     case 8:\
-        stq(ptr, (typeof(*ptr))(x));\
+        *(uint64_t *)(ptr) = tswap64((typeof(*ptr))(x));\
         break;\
     default:\
         abort();\
@@ -160,16 +160,16 @@ int target_msync(unsigned long start, unsigned long len, int flags);
     int size = sizeof(*ptr);\
     switch(size) {\
     case 1:\
-        x = (typeof(*ptr))ldub((void *)ptr);\
+        x = (typeof(*ptr))*(uint8_t *)(ptr);\
         break;\
     case 2:\
-        x = (typeof(*ptr))lduw((void *)ptr);\
+        x = (typeof(*ptr))tswap16(*(uint16_t *)(ptr));\
         break;\
     case 4:\
-        x = (typeof(*ptr))ldl((void *)ptr);\
+        x = (typeof(*ptr))tswap32(*(uint32_t *)(ptr));\
         break;\
     case 8:\
-        x = (typeof(*ptr))ldq((void *)ptr);\
+        x = (typeof(*ptr))tswap64(*(uint64_t *)(ptr));\
         break;\
     default:\
         abort();\
@@ -177,26 +177,6 @@ int target_msync(unsigned long start, unsigned long len, int flags);
     0;\
 })
 
-static inline unsigned long __copy_to_user(void *dst, const void *src, 
-                                           unsigned long size)
-{
-    memcpy(dst, src, size);
-    return 0;
-}
-
-static inline unsigned long __copy_from_user(void *dst, const void *src, 
-                                             unsigned long size)
-{
-    memcpy(dst, src, size);
-    return 0;
-}
-
-static inline unsigned long __clear_user(void *dst, unsigned long size)
-{
-    memset(dst, 0, size);
-    return 0;
-}
-
 #define put_user(x,ptr)\
 ({\
     int __ret;\
@@ -217,30 +197,77 @@ static inline unsigned long __clear_user(void *dst, unsigned long size)
     __ret;\
 })
 
-static inline unsigned long copy_to_user(void *dst, const void *src, 
-                                         unsigned long size)
+/* Functions for accessing guest memory.  The tget and tput functions
+   read/write single values, byteswapping as neccessary.  The lock_user
+   gets a pointer to a contiguous area of guest memory, but does not perform
+   and byteswapping.  lock_user may return either a pointer to the guest
+   memory, or a temporary buffer.  */
+
+/* Lock an area of guest memory into the host.  If copy is true then the
+   host area will have the same contents as the guest.  */
+static inline void *lock_user(target_ulong guest_addr, long len, int copy)
 {
-    if (access_ok(VERIFY_WRITE, dst, size))
-        return __copy_to_user(dst, src, size);
+#ifdef DEBUG_REMAP
+    void *addr;
+    addr = malloc(len);
+    if (copy)
+        memcpy(addr, g2h(guest_addr), len);
     else
-        return size;
+        memset(addr, 0, len);
+    return addr;
+#else
+    return g2h(guest_addr);
+#endif
 }
 
-static inline unsigned long copy_from_user(void *dst, const void *src, 
-                                             unsigned long size)
+/* Unlock an area of guest memory.  The first LEN bytes must be flushed back
+   to guest memory.  */
+static inline void unlock_user(void *host_addr, target_ulong guest_addr,
+                                long len)
 {
-    if (access_ok(VERIFY_READ, src, size))
-        return __copy_from_user(dst, src, size);
-    else
-        return size;
+#ifdef DEBUG_REMAP
+    if (host_addr == g2h(guest_addr))
+        return;
+    if (len > 0)
+        memcpy(g2h(guest_addr), host_addr, len);
+    free(host_addr);
+#endif
 }
 
-static inline unsigned long clear_user(void *dst, unsigned long size)
+/* Return the length of a string in target memory.  */
+static inline int target_strlen(target_ulong ptr)
 {
-    if (access_ok(VERIFY_WRITE, dst, size))
-        return __clear_user(dst, size);
-    else
-        return size;
+  return strlen(g2h(ptr));
+}
+
+/* Like lock_user but for null terminated strings.  */
+static inline void *lock_user_string(target_ulong guest_addr)
+{
+    long len;
+    len = target_strlen(guest_addr) + 1;
+    return lock_user(guest_addr, len, 1);
 }
 
+/* Helper macros for locking/ulocking a target struct.  */
+#define lock_user_struct(host_ptr, guest_addr, copy) \
+    host_ptr = lock_user(guest_addr, sizeof(*host_ptr), copy)
+#define unlock_user_struct(host_ptr, guest_addr, copy) \
+    unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
+
+#define tget8(addr) ldub(addr)
+#define tput8(addr, val) stb(addr, val)
+#define tget16(addr) lduw(addr)
+#define tput16(addr, val) stw(addr, val)
+#define tget32(addr) ldl(addr)
+#define tput32(addr, val) stl(addr, val)
+#define tget64(addr) ldq(addr)
+#define tput64(addr, val) stq(addr, val)
+#if TARGET_LONG_BITS == 64
+#define tgetl(addr) ldq(addr)
+#define tputl(addr, val) stq(addr, val)
+#else
+#define tgetl(addr) ldl(addr)
+#define tputl(addr, val) stl(addr, val)
+#endif
+
 #endif /* QEMU_H */
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 29933bda434bd576aef724ac363053aab75cd697..ac4b2897fe3019b32d7ed2e9f484f06ea4f17867 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -135,7 +135,7 @@ void host_to_target_sigset(target_sigset_t *d, const sigset_t *s)
 
     host_to_target_sigset_internal(&d1, s);
     for(i = 0;i < TARGET_NSIG_WORDS; i++)
-        __put_user(d1.sig[i], &d->sig[i]);
+        d->sig[i] = tswapl(d1.sig[i]);
 }
 
 void target_to_host_sigset_internal(sigset_t *d, const target_sigset_t *s)
@@ -168,7 +168,7 @@ void target_to_host_sigset(sigset_t *d, const target_sigset_t *s)
     int i;
 
     for(i = 0;i < TARGET_NSIG_WORDS; i++)
-        __get_user(s1.sig[i], &s->sig[i]);
+        s1.sig[i] = tswapl(s->sig[i]);
     target_to_host_sigset_internal(d, &s1);
 }
     
@@ -647,7 +647,7 @@ get_sigframe(struct emulated_sigaction *ka, CPUX86State *env, size_t frame_size)
             ka->sa.sa_restorer) {
             esp = (unsigned long) ka->sa.sa_restorer;
 	}
-        return (void *)((esp - frame_size) & -8ul);
+        return g2h((esp - frame_size) & -8ul);
 }
 
 static void setup_frame(int sig, struct emulated_sigaction *ka,
@@ -694,7 +694,7 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 		goto give_sigsegv;
 
 	/* Set up registers for signal handler */
-	env->regs[R_ESP] = (unsigned long) frame;
+	env->regs[R_ESP] = h2g(frame);
 	env->eip = (unsigned long) ka->sa._sa_handler;
 
         cpu_x86_load_seg(env, R_DS, __USER_DS);
@@ -835,7 +835,7 @@ badframe:
 
 long do_sigreturn(CPUX86State *env)
 {
-    struct sigframe *frame = (struct sigframe *)(env->regs[R_ESP] - 8);
+    struct sigframe *frame = (struct sigframe *)g2h(env->regs[R_ESP] - 8);
     target_sigset_t target_set;
     sigset_t set;
     int eax, i;
@@ -866,7 +866,7 @@ badframe:
 
 long do_rt_sigreturn(CPUX86State *env)
 {
-	struct rt_sigframe *frame = (struct rt_sigframe *)(env->regs[R_ESP] - 4);
+	struct rt_sigframe *frame = (struct rt_sigframe *)g2h(env->regs[R_ESP] - 4);
         sigset_t set;
         //	stack_t st;
 	int eax;
@@ -1029,7 +1029,7 @@ get_sigframe(struct emulated_sigaction *ka, CPUState *regs, int framesize)
 	/*
 	 * ATPCS B01 mandates 8-byte alignment
 	 */
-	return (void *)((sp - framesize) & ~7);
+	return g2h((sp - framesize) & ~7);
 }
 
 static int
@@ -1084,7 +1084,7 @@ setup_return(CPUState *env, struct emulated_sigaction *ka,
 	}
 
 	env->regs[0] = usig;
-	env->regs[13] = (target_ulong)frame;
+	env->regs[13] = h2g(frame);
 	env->regs[14] = retcode;
 	env->regs[15] = handler & (thumb ? ~1 : ~3);
 
@@ -1130,7 +1130,7 @@ static void setup_rt_frame(int usig, struct emulated_sigaction *ka,
 	err |= copy_siginfo_to_user(&frame->info, info);
 
 	/* Clear all the bits of the ucontext we don't use.  */
-	err |= __clear_user(&frame->uc, offsetof(struct ucontext, uc_mcontext));
+	memset(&frame->uc, 0, offsetof(struct target_ucontext, tuc_mcontext));
 
 	err |= setup_sigcontext(&frame->uc.tuc_mcontext, /*&frame->fpstate,*/
 				env, set->sig[0]);
@@ -1202,7 +1202,7 @@ long do_sigreturn(CPUState *env)
 	if (env->regs[13] & 7)
 		goto badframe;
 
-	frame = (struct sigframe *)env->regs[13];
+	frame = (struct sigframe *)g2h(env->regs[13]);
 
 #if 0
 	if (verify_area(VERIFY_READ, frame, sizeof (*frame)))
@@ -1378,7 +1378,7 @@ static inline void *get_sigframe(struct emulated_sigaction *sa, CPUState *env, u
 			sp = current->sas_ss_sp + current->sas_ss_size;
 	}
 #endif
-	return (void *)(sp - framesize);
+	return g2h(sp - framesize);
 }
 
 static int
@@ -1461,10 +1461,10 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 		goto sigsegv;
 
 	/* 3. signal handler back-trampoline and parameters */
-	env->regwptr[UREG_FP] = (target_ulong) sf;
+	env->regwptr[UREG_FP] = h2g(sf);
 	env->regwptr[UREG_I0] = sig;
-	env->regwptr[UREG_I1] = (target_ulong) &sf->info;
-	env->regwptr[UREG_I2] = (target_ulong) &sf->info;
+	env->regwptr[UREG_I1] = h2g(&sf->info);
+	env->regwptr[UREG_I2] = h2g(&sf->info);
 
 	/* 4. signal handler */
 	env->pc = (unsigned long) ka->sa._sa_handler;
@@ -1473,7 +1473,7 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 	if (ka->sa.sa_restorer)
 		env->regwptr[UREG_I7] = (unsigned long)ka->sa.sa_restorer;
 	else {
-		env->regwptr[UREG_I7] = (unsigned long)(&(sf->insns[0]) - 2);
+		env->regwptr[UREG_I7] = h2g(&(sf->insns[0]) - 2);
 
 		/* mov __NR_sigreturn, %g1 */
 		err |= __put_user(0x821020d8, &sf->insns[0]);
@@ -1548,7 +1548,7 @@ long do_sigreturn(CPUState *env)
         target_ulong fpu_save;
         int err, i;
 
-        sf = (struct target_signal_frame *) env->regwptr[UREG_FP];
+        sf = (struct target_signal_frame *)g2h(env->regwptr[UREG_FP]);
 #if 0
 	fprintf(stderr, "sigreturn\n");
 	fprintf(stderr, "sf: %x pc %x fp %x sp %x\n", sf, env->pc, env->regwptr[UREG_FP], env->regwptr[UREG_SP]);
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ab7846d7ac96f3746c69176daf22006db2ab0e54..2b132477f07db20d47d7dfbe3134ebf3f5ca19da 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -252,44 +252,43 @@ static inline int is_error(long ret)
     return (unsigned long)ret >= (unsigned long)(-4096);
 }
 
-static char *target_brk;
-static char *target_original_brk;
+static target_ulong target_brk;
+static target_ulong target_original_brk;
 
-void target_set_brk(char *new_brk)
+void target_set_brk(target_ulong new_brk)
 {
-    target_brk = new_brk;
-    target_original_brk = new_brk;
+    target_original_brk = target_brk = new_brk;
 }
 
-long do_brk(char *new_brk)
+long do_brk(target_ulong new_brk)
 {
-    char *brk_page;
+    target_ulong brk_page;
     long mapped_addr;
     int	new_alloc_size;
 
     if (!new_brk)
-        return (long)target_brk;
+        return target_brk;
     if (new_brk < target_original_brk)
         return -ENOMEM;
     
-    brk_page = (char *)HOST_PAGE_ALIGN((unsigned long)target_brk);
+    brk_page = HOST_PAGE_ALIGN(target_brk);
 
     /* If the new brk is less than this, set it and we're done... */
     if (new_brk < brk_page) {
 	target_brk = new_brk;
-    	return (long)target_brk;
+    	return target_brk;
     }
 
     /* We need to allocate more memory after the brk... */
     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page + 1);
-    mapped_addr = get_errno(target_mmap((unsigned long)brk_page, new_alloc_size, 
+    mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size, 
                                         PROT_READ|PROT_WRITE,
                                         MAP_ANON|MAP_FIXED|MAP_PRIVATE, 0, 0));
     if (is_error(mapped_addr)) {
 	return mapped_addr;
     } else {
 	target_brk = new_brk;
-    	return (long)target_brk;
+    	return target_brk;
     }
 }
 
@@ -354,9 +353,12 @@ static inline long host_to_target_clock_t(long ticks)
 #endif
 }
 
-static inline void host_to_target_rusage(struct target_rusage *target_rusage, 
+static inline void host_to_target_rusage(target_ulong target_addr,
                                          const struct rusage *rusage)
 {
+    struct target_rusage *target_rusage;
+
+    lock_user_struct(target_rusage, target_addr, 0);
     target_rusage->ru_utime.tv_sec = tswapl(rusage->ru_utime.tv_sec);
     target_rusage->ru_utime.tv_usec = tswapl(rusage->ru_utime.tv_usec);
     target_rusage->ru_stime.tv_sec = tswapl(rusage->ru_stime.tv_sec);
@@ -375,35 +377,64 @@ static inline void host_to_target_rusage(struct target_rusage *target_rusage,
     target_rusage->ru_nsignals = tswapl(rusage->ru_nsignals);
     target_rusage->ru_nvcsw = tswapl(rusage->ru_nvcsw);
     target_rusage->ru_nivcsw = tswapl(rusage->ru_nivcsw);
+    unlock_user_struct(target_rusage, target_addr, 1);
 }
 
-static inline void target_to_host_timeval(struct timeval *tv, 
-                                          const struct target_timeval *target_tv)
+static inline void target_to_host_timeval(struct timeval *tv,
+                                          target_ulong target_addr)
 {
+    struct target_timeval *target_tv;
+
+    lock_user_struct(target_tv, target_addr, 1);
     tv->tv_sec = tswapl(target_tv->tv_sec);
     tv->tv_usec = tswapl(target_tv->tv_usec);
+    unlock_user_struct(target_tv, target_addr, 0);
 }
 
-static inline void host_to_target_timeval(struct target_timeval *target_tv, 
+static inline void host_to_target_timeval(target_ulong target_addr,
                                           const struct timeval *tv)
 {
+    struct target_timeval *target_tv;
+
+    lock_user_struct(target_tv, target_addr, 0);
     target_tv->tv_sec = tswapl(tv->tv_sec);
     target_tv->tv_usec = tswapl(tv->tv_usec);
+    unlock_user_struct(target_tv, target_addr, 1);
 }
 
 
 static long do_select(long n, 
-                      target_long *target_rfds, target_long *target_wfds, 
-                      target_long *target_efds, struct target_timeval *target_tv)
+                      target_ulong rfd_p, target_ulong wfd_p, 
+                      target_ulong efd_p, target_ulong target_tv)
 {
     fd_set rfds, wfds, efds;
     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
+    target_long *target_rfds, *target_wfds, *target_efds;
     struct timeval tv, *tv_ptr;
     long ret;
+    int ok;
 
-    rfds_ptr = target_to_host_fds(&rfds, target_rfds, n);
-    wfds_ptr = target_to_host_fds(&wfds, target_wfds, n);
-    efds_ptr = target_to_host_fds(&efds, target_efds, n);
+    if (rfd_p) {
+        target_rfds = lock_user(rfd_p, sizeof(target_long) * n, 1);
+        rfds_ptr = target_to_host_fds(&rfds, target_rfds, n);
+    } else {
+        target_rfds = NULL;
+        rfds_ptr = NULL;
+    }
+    if (wfd_p) {
+        target_wfds = lock_user(wfd_p, sizeof(target_long) * n, 1);
+        wfds_ptr = target_to_host_fds(&wfds, target_wfds, n);
+    } else {
+        target_wfds = NULL;
+        wfds_ptr = NULL;
+    }
+    if (efd_p) {
+        target_efds = lock_user(efd_p, sizeof(target_long) * n, 1);
+        efds_ptr = target_to_host_fds(&efds, target_efds, n);
+    } else {
+        target_efds = NULL;
+        efds_ptr = NULL;
+    }
             
     if (target_tv) {
         target_to_host_timeval(&tv, target_tv);
@@ -412,7 +443,9 @@ static long do_select(long n,
         tv_ptr = NULL;
     }
     ret = get_errno(select(n, rfds_ptr, wfds_ptr, efds_ptr, tv_ptr));
-    if (!is_error(ret)) {
+    ok = !is_error(ret);
+
+    if (ok) {
         host_to_target_fds(target_rfds, rfds_ptr, n);
         host_to_target_fds(target_wfds, wfds_ptr, n);
         host_to_target_fds(target_efds, efds_ptr, n);
@@ -421,25 +454,41 @@ static long do_select(long n,
             host_to_target_timeval(target_tv, &tv);
         }
     }
+    if (target_rfds)
+        unlock_user(target_rfds, rfd_p, ok ? sizeof(target_long) * n : 0);
+    if (target_wfds)
+        unlock_user(target_wfds, wfd_p, ok ? sizeof(target_long) * n : 0);
+    if (target_efds)
+        unlock_user(target_efds, efd_p, ok ? sizeof(target_long) * n : 0);
+
     return ret;
 }
 
 static inline void target_to_host_sockaddr(struct sockaddr *addr,
-                                           struct target_sockaddr *target_addr,
+                                           target_ulong target_addr,
                                            socklen_t len)
 {
-    memcpy(addr, target_addr, len);
-    addr->sa_family = tswap16(target_addr->sa_family);
+    struct target_sockaddr *target_saddr;
+
+    target_saddr = lock_user(target_addr, len, 1);
+    memcpy(addr, target_saddr, len);
+    addr->sa_family = tswap16(target_saddr->sa_family);
+    unlock_user(target_saddr, target_addr, 0);
 }
 
-static inline void host_to_target_sockaddr(struct target_sockaddr *target_addr,
+static inline void host_to_target_sockaddr(target_ulong target_addr,
                                            struct sockaddr *addr,
                                            socklen_t len)
 {
-    memcpy(target_addr, addr, len);
-    target_addr->sa_family = tswap16(addr->sa_family);
+    struct target_sockaddr *target_saddr;
+
+    target_saddr = lock_user(target_addr, len, 0);
+    memcpy(target_saddr, addr, len);
+    target_saddr->sa_family = tswap16(addr->sa_family);
+    unlock_user(target_saddr, target_addr, len);
 }
 
+/* ??? Should this also swap msgh->name?  */
 static inline void target_to_host_cmsg(struct msghdr *msgh,
                                        struct target_msghdr *target_msgh)
 {
@@ -484,6 +533,7 @@ static inline void target_to_host_cmsg(struct msghdr *msgh,
     msgh->msg_controllen = space;
 }
 
+/* ??? Should this also swap msgh->name?  */
 static inline void host_to_target_cmsg(struct target_msghdr *target_msgh,
                                        struct msghdr *msgh)
 {
@@ -528,7 +578,7 @@ static inline void host_to_target_cmsg(struct target_msghdr *target_msgh,
 }
 
 static long do_setsockopt(int sockfd, int level, int optname, 
-                          void *optval, socklen_t optlen)
+                          target_ulong optval, socklen_t optlen)
 {
     int val, ret;
             
@@ -538,8 +588,7 @@ static long do_setsockopt(int sockfd, int level, int optname,
         if (optlen < sizeof(uint32_t))
             return -EINVAL;
         
-        if (get_user(val, (uint32_t *)optval))
-            return -EFAULT;
+        val = tget32(optval);
         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
         break;
     case SOL_IP:
@@ -561,11 +610,9 @@ static long do_setsockopt(int sockfd, int level, int optname,
         case IP_MULTICAST_LOOP:
             val = 0;
             if (optlen >= sizeof(uint32_t)) {
-                if (get_user(val, (uint32_t *)optval))
-                    return -EFAULT;
+                val = tget32(optval);
             } else if (optlen >= 1) {
-                if (get_user(val, (uint8_t *)optval))
-                    return -EFAULT;
+                val = tget8(optval);
             }
             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
             break;
@@ -598,8 +645,8 @@ static long do_setsockopt(int sockfd, int level, int optname,
         case SO_SNDTIMEO:
             if (optlen < sizeof(uint32_t))
                 return -EINVAL;
-            if (get_user(val, (uint32_t *)optval))
-                return -EFAULT;
+
+            val = tget32(optval);
             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
             break;
         default:
@@ -615,7 +662,7 @@ static long do_setsockopt(int sockfd, int level, int optname,
 }
 
 static long do_getsockopt(int sockfd, int level, int optname, 
-                          void *optval, socklen_t *optlen)
+                          target_ulong optval, target_ulong optlen)
 {
     int len, lv, val, ret;
 
@@ -636,8 +683,7 @@ static long do_getsockopt(int sockfd, int level, int optname,
     case SOL_TCP:
         /* TCP options all take an 'int' value.  */
     int_case:
-        if (get_user(len, optlen))
-            return -EFAULT;
+        len = tget32(optlen);
         if (len < 0)
             return -EINVAL;
         lv = sizeof(int);
@@ -647,10 +693,11 @@ static long do_getsockopt(int sockfd, int level, int optname,
         val = tswap32(val);
         if (len > lv)
             len = lv;
-        if (copy_to_user(optval, &val, len))
-            return -EFAULT;
-        if (put_user(len, optlen))
-            return -EFAULT;
+        if (len == 4)
+            tput32(optval, val);
+        else
+            tput8(optval, val);
+        tput32(optlen, len);
         break;
     case SOL_IP:
         switch(optname) {
@@ -669,8 +716,7 @@ static long do_getsockopt(int sockfd, int level, int optname,
 #endif
         case IP_MULTICAST_TTL:
         case IP_MULTICAST_LOOP:
-            if (get_user(len, optlen))
-                return -EFAULT;
+            len = tget32(optlen);
             if (len < 0)
                 return -EINVAL;
             lv = sizeof(int);
@@ -678,20 +724,14 @@ static long do_getsockopt(int sockfd, int level, int optname,
             if (ret < 0)
                 return ret;
             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
-                unsigned char ucval = val;
                 len = 1;
-		if (put_user(len, optlen))
-                    return -EFAULT;
-		if (copy_to_user(optval,&ucval,1))
-                    return -EFAULT;
+                tput32(optlen, len);
+                tput8(optval, val);
             } else {
-                val = tswap32(val);
                 if (len > sizeof(int))
                     len = sizeof(int);
-                if (put_user(len, optlen))
-                    return -EFAULT;
-                if (copy_to_user(optval, &val, len))
-                    return -EFAULT;
+                tput32(optlen, len);
+                tput32(optval, val);
             }
             break;
         default:
@@ -708,25 +748,57 @@ static long do_getsockopt(int sockfd, int level, int optname,
     return ret;
 }
 
-static long do_socketcall(int num, int32_t *vptr)
+static void lock_iovec(struct iovec *vec, target_ulong target_addr,
+                       int count, int copy)
+{
+    struct target_iovec *target_vec;
+    target_ulong base;
+    int i;
+
+    target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1);
+    for(i = 0;i < count; i++) {
+        base = tswapl(target_vec[i].iov_base);
+        vec[i].iov_len = tswapl(target_vec[i].iov_len);
+        vec[i].iov_base = lock_user(base, vec[i].iov_len, copy);
+    }
+    unlock_user (target_vec, target_addr, 0);
+}
+
+static void unlock_iovec(struct iovec *vec, target_ulong target_addr,
+                         int count, int copy)
+{
+    struct target_iovec *target_vec;
+    target_ulong base;
+    int i;
+
+    target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1);
+    for(i = 0;i < count; i++) {
+        base = tswapl(target_vec[i].iov_base);
+        unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
+    }
+    unlock_user (target_vec, target_addr, 0);
+}
+
+static long do_socketcall(int num, target_ulong vptr)
 {
     long ret;
+    const int n = sizeof(target_ulong);
 
     switch(num) {
     case SOCKOP_socket:
 	{
-            int domain = tswap32(vptr[0]);
-            int type = tswap32(vptr[1]);
-            int protocol = tswap32(vptr[2]);
+            int domain = tgetl(vptr);
+            int type = tgetl(vptr + n);
+            int protocol = tgetl(vptr + 2 * n);
 
             ret = get_errno(socket(domain, type, protocol));
 	}
         break;
     case SOCKOP_bind:
 	{
-            int sockfd = tswap32(vptr[0]);
-            void *target_addr = (void *)tswap32(vptr[1]);
-            socklen_t addrlen = tswap32(vptr[2]);
+            int sockfd = tgetl(vptr);
+            target_ulong target_addr = tgetl(vptr + n);
+            socklen_t addrlen = tgetl(vptr + 2 * n);
             void *addr = alloca(addrlen);
 
             target_to_host_sockaddr(addr, target_addr, addrlen);
@@ -735,9 +807,9 @@ static long do_socketcall(int num, int32_t *vptr)
         break;
     case SOCKOP_connect:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *target_addr = (void *)tswap32(vptr[1]);
-            socklen_t addrlen = tswap32(vptr[2]);
+            int sockfd = tgetl(vptr);
+            target_ulong target_addr = tgetl(vptr + n);
+            socklen_t addrlen = tgetl(vptr + 2 * n);
             void *addr = alloca(addrlen);
 
             target_to_host_sockaddr(addr, target_addr, addrlen);
@@ -746,128 +818,142 @@ static long do_socketcall(int num, int32_t *vptr)
         break;
     case SOCKOP_listen:
         {
-            int sockfd = tswap32(vptr[0]);
-            int backlog = tswap32(vptr[1]);
+            int sockfd = tgetl(vptr);
+            int backlog = tgetl(vptr + n);
 
             ret = get_errno(listen(sockfd, backlog));
         }
         break;
     case SOCKOP_accept:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *target_addr = (void *)tswap32(vptr[1]);
-            uint32_t *target_addrlen = (void *)tswap32(vptr[2]);
-            socklen_t addrlen = tswap32(*target_addrlen);
+            int sockfd = tgetl(vptr);
+            target_ulong target_addr = tgetl(vptr + n);
+            target_ulong target_addrlen = tgetl(vptr + 2 * n);
+            socklen_t addrlen = tget32(target_addrlen);
             void *addr = alloca(addrlen);
 
             ret = get_errno(accept(sockfd, addr, &addrlen));
             if (!is_error(ret)) {
                 host_to_target_sockaddr(target_addr, addr, addrlen);
-                *target_addrlen = tswap32(addrlen);
+                tput32(target_addrlen, addrlen);
             }
         }
         break;
     case SOCKOP_getsockname:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *target_addr = (void *)tswap32(vptr[1]);
-            uint32_t *target_addrlen = (void *)tswap32(vptr[2]);
-            socklen_t addrlen = tswap32(*target_addrlen);
+            int sockfd = tgetl(vptr);
+            target_ulong target_addr = tgetl(vptr + n);
+            target_ulong target_addrlen = tgetl(vptr + 2 * n);
+            socklen_t addrlen = tget32(target_addrlen);
             void *addr = alloca(addrlen);
 
             ret = get_errno(getsockname(sockfd, addr, &addrlen));
             if (!is_error(ret)) {
                 host_to_target_sockaddr(target_addr, addr, addrlen);
-                *target_addrlen = tswap32(addrlen);
+                tput32(target_addrlen, addrlen);
             }
         }
         break;
     case SOCKOP_getpeername:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *target_addr = (void *)tswap32(vptr[1]);
-            uint32_t *target_addrlen = (void *)tswap32(vptr[2]);
-            socklen_t addrlen = tswap32(*target_addrlen);
+            int sockfd = tgetl(vptr);
+            target_ulong target_addr = tgetl(vptr + n);
+            target_ulong target_addrlen = tgetl(vptr + 2 * n);
+            socklen_t addrlen = tget32(target_addrlen);
             void *addr = alloca(addrlen);
 
             ret = get_errno(getpeername(sockfd, addr, &addrlen));
             if (!is_error(ret)) {
                 host_to_target_sockaddr(target_addr, addr, addrlen);
-                *target_addrlen = tswap32(addrlen);
+                tput32(target_addrlen, addrlen);
             }
         }
         break;
     case SOCKOP_socketpair:
         {
-            int domain = tswap32(vptr[0]);
-            int type = tswap32(vptr[1]);
-            int protocol = tswap32(vptr[2]);
-            int32_t *target_tab = (void *)tswap32(vptr[3]);
+            int domain = tgetl(vptr);
+            int type = tgetl(vptr + n);
+            int protocol = tgetl(vptr + 2 * n);
+            target_ulong target_tab = tgetl(vptr + 3 * n);
             int tab[2];
 
             ret = get_errno(socketpair(domain, type, protocol, tab));
             if (!is_error(ret)) {
-                target_tab[0] = tswap32(tab[0]);
-                target_tab[1] = tswap32(tab[1]);
+                tput32(target_tab, tab[0]);
+                tput32(target_tab + 4, tab[1]);
             }
         }
         break;
     case SOCKOP_send:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *msg = (void *)tswap32(vptr[1]);
-            size_t len = tswap32(vptr[2]);
-            int flags = tswap32(vptr[3]);
+            int sockfd = tgetl(vptr);
+            target_ulong msg = tgetl(vptr + n);
+            size_t len = tgetl(vptr + 2 * n);
+            int flags = tgetl(vptr + 3 * n);
+            void *host_msg;
 
-            ret = get_errno(send(sockfd, msg, len, flags));
+            host_msg = lock_user(msg, len, 1);
+            ret = get_errno(send(sockfd, host_msg, len, flags));
+            unlock_user(host_msg, msg, 0);
         }
         break;
     case SOCKOP_recv:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *msg = (void *)tswap32(vptr[1]);
-            size_t len = tswap32(vptr[2]);
-            int flags = tswap32(vptr[3]);
+            int sockfd = tgetl(vptr);
+            target_ulong msg = tgetl(vptr + n);
+            size_t len = tgetl(vptr + 2 * n);
+            int flags = tgetl(vptr + 3 * n);
+            void *host_msg;
 
-            ret = get_errno(recv(sockfd, msg, len, flags));
+            host_msg = lock_user(msg, len, 0);
+            ret = get_errno(recv(sockfd, host_msg, len, flags));
+            unlock_user(host_msg, msg, ret);
         }
         break;
     case SOCKOP_sendto:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *msg = (void *)tswap32(vptr[1]);
-            size_t len = tswap32(vptr[2]);
-            int flags = tswap32(vptr[3]);
-            void *target_addr = (void *)tswap32(vptr[4]);
-            socklen_t addrlen = tswap32(vptr[5]);
+            int sockfd = tgetl(vptr);
+            target_ulong msg = tgetl(vptr + n);
+            size_t len = tgetl(vptr + 2 * n);
+            int flags = tgetl(vptr + 3 * n);
+            target_ulong target_addr = tgetl(vptr + 4 * n);
+            socklen_t addrlen = tgetl(vptr + 5 * n);
             void *addr = alloca(addrlen);
+            void *host_msg;
 
+            host_msg = lock_user(msg, len, 1);
             target_to_host_sockaddr(addr, target_addr, addrlen);
-            ret = get_errno(sendto(sockfd, msg, len, flags, addr, addrlen));
+            ret = get_errno(sendto(sockfd, host_msg, len, flags, addr, addrlen));
+            unlock_user(host_msg, msg, 0);
         }
         break;
     case SOCKOP_recvfrom:
         {
-            int sockfd = tswap32(vptr[0]);
-            void *msg = (void *)tswap32(vptr[1]);
-            size_t len = tswap32(vptr[2]);
-            int flags = tswap32(vptr[3]);
-            void *target_addr = (void *)tswap32(vptr[4]);
-            uint32_t *target_addrlen = (void *)tswap32(vptr[5]);
-            socklen_t addrlen = tswap32(*target_addrlen);
+            int sockfd = tgetl(vptr);
+            target_ulong msg = tgetl(vptr + n);
+            size_t len = tgetl(vptr + 2 * n);
+            int flags = tgetl(vptr + 3 * n);
+            target_ulong target_addr = tgetl(vptr + 4 * n);
+            target_ulong target_addrlen = tgetl(vptr + 5 * n);
+            socklen_t addrlen = tget32(target_addrlen);
             void *addr = alloca(addrlen);
+            void *host_msg;
 
-            ret = get_errno(recvfrom(sockfd, msg, len, flags, addr, &addrlen));
+            host_msg = lock_user(msg, len, 0);
+            ret = get_errno(recvfrom(sockfd, host_msg, len, flags, addr, &addrlen));
             if (!is_error(ret)) {
                 host_to_target_sockaddr(target_addr, addr, addrlen);
-                *target_addrlen = tswap32(addrlen);
+                tput32(target_addrlen, addrlen);
+                unlock_user(host_msg, msg, len);
+            } else {
+                unlock_user(host_msg, msg, 0);
             }
         }
         break;
     case SOCKOP_shutdown:
         {
-            int sockfd = tswap32(vptr[0]);
-            int how = tswap32(vptr[1]);
+            int sockfd = tgetl(vptr);
+            int how = tgetl(vptr + n);
 
             ret = get_errno(shutdown(sockfd, how));
         }
@@ -876,32 +962,39 @@ static long do_socketcall(int num, int32_t *vptr)
     case SOCKOP_recvmsg:
         {
             int fd;
+            target_ulong target_msg;
             struct target_msghdr *msgp;
             struct msghdr msg;
-            int flags, count, i;
+            int flags, count;
             struct iovec *vec;
-            struct target_iovec *target_vec;
-
-            msgp = (void *)tswap32(vptr[1]);
-            msg.msg_name = (void *)tswapl(msgp->msg_name);
-            msg.msg_namelen = tswapl(msgp->msg_namelen);
+            target_ulong target_vec;
+            int send = (num == SOCKOP_sendmsg);
+
+            target_msg = tgetl(vptr + n);
+            lock_user_struct(msgp, target_msg, 1);
+            if (msgp->msg_name) {
+                msg.msg_namelen = tswap32(msgp->msg_namelen);
+                msg.msg_name = alloca(msg.msg_namelen);
+                target_to_host_sockaddr(msg.msg_name, tswapl(msgp->msg_name),
+                                        msg.msg_namelen);
+            } else {
+                msg.msg_name = NULL;
+                msg.msg_namelen = 0;
+            }
             msg.msg_controllen = 2 * tswapl(msgp->msg_controllen);
             msg.msg_control = alloca(msg.msg_controllen);
             msg.msg_flags = tswap32(msgp->msg_flags);
 
             count = tswapl(msgp->msg_iovlen);
             vec = alloca(count * sizeof(struct iovec));
-            target_vec = (void *)tswapl(msgp->msg_iov);
-            for(i = 0;i < count; i++) {
-                vec[i].iov_base = (void *)tswapl(target_vec[i].iov_base);
-                vec[i].iov_len = tswapl(target_vec[i].iov_len);
-            }
+            target_vec = tswapl(msgp->msg_iov);
+            lock_iovec(vec, target_vec, count, send);
             msg.msg_iovlen = count;
             msg.msg_iov = vec;
 
-            fd = tswap32(vptr[0]);
-            flags = tswap32(vptr[2]);
-            if (num == SOCKOP_sendmsg) {
+            fd = tgetl(vptr);
+            flags = tgetl(vptr + 2 * n);
+            if (send) {
                 target_to_host_cmsg(&msg, msgp);
                 ret = get_errno(sendmsg(fd, &msg, flags));
             } else {
@@ -909,26 +1002,27 @@ static long do_socketcall(int num, int32_t *vptr)
                 if (!is_error(ret))
                   host_to_target_cmsg(msgp, &msg);
             }
+            unlock_iovec(vec, target_vec, count, !send);
         }
         break;
     case SOCKOP_setsockopt:
         {
-            int sockfd = tswap32(vptr[0]);
-            int level = tswap32(vptr[1]);
-            int optname = tswap32(vptr[2]);
-            void *optval = (void *)tswap32(vptr[3]);
-            socklen_t optlen = tswap32(vptr[4]);
+            int sockfd = tgetl(vptr);
+            int level = tgetl(vptr + n);
+            int optname = tgetl(vptr + 2 * n);
+            target_ulong optval = tgetl(vptr + 3 * n);
+            socklen_t optlen = tgetl(vptr + 4 * n);
 
             ret = do_setsockopt(sockfd, level, optname, optval, optlen);
         }
         break;
     case SOCKOP_getsockopt:
         {
-            int sockfd = tswap32(vptr[0]);
-            int level = tswap32(vptr[1]);
-            int optname = tswap32(vptr[2]);
-            void *optval = (void *)tswap32(vptr[3]);
-            uint32_t *poptlen = (void *)tswap32(vptr[4]);
+            int sockfd = tgetl(vptr);
+            int level = tgetl(vptr + n);
+            int optname = tgetl(vptr + 2 * n);
+            target_ulong optval = tgetl(vptr + 3 * n);
+            target_ulong poptlen = tgetl(vptr + 4 * n);
 
             ret = do_getsockopt(sockfd, level, optname, optval, poptlen);
         }
@@ -949,6 +1043,7 @@ static struct shm_region {
     uint32_t	size;
 } shm_regions[N_SHM_REGIONS];
 
+/* ??? This only works with linear mappings.  */
 static long do_ipc(long call, long first, long second, long third,
 		   long ptr, long fifth)
 {
@@ -1065,12 +1160,15 @@ IOCTLEntry ioctl_entries[] = {
     { 0, 0, },
 };
 
+/* ??? Implement proper locking for ioctls.  */
 static long do_ioctl(long fd, long cmd, long arg)
 {
     const IOCTLEntry *ie;
     const argtype *arg_type;
     long ret;
     uint8_t buf_temp[MAX_STRUCT_SIZE];
+    int target_size;
+    void *argptr;
 
     ie = ioctl_entries;
     for(;;) {
@@ -1098,23 +1196,32 @@ static long do_ioctl(long fd, long cmd, long arg)
         break;
     case TYPE_PTR:
         arg_type++;
+        target_size = thunk_type_size(arg_type, 0);
         switch(ie->access) {
         case IOC_R:
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             if (!is_error(ret)) {
-                thunk_convert((void *)arg, buf_temp, arg_type, THUNK_TARGET);
+                argptr = lock_user(arg, target_size, 0);
+                thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
+                unlock_user(argptr, arg, target_size);
             }
             break;
         case IOC_W:
-            thunk_convert(buf_temp, (void *)arg, arg_type, THUNK_HOST);
+            argptr = lock_user(arg, target_size, 1);
+            thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
+            unlock_user(argptr, arg, 0);
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             break;
         default:
         case IOC_RW:
-            thunk_convert(buf_temp, (void *)arg, arg_type, THUNK_HOST);
+            argptr = lock_user(arg, target_size, 1);
+            thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
+            unlock_user(argptr, arg, 0);
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             if (!is_error(ret)) {
-                thunk_convert((void *)arg, buf_temp, arg_type, THUNK_TARGET);
+                argptr = lock_user(arg, target_size, 0);
+                thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
+                unlock_user(argptr, arg, target_size);
             }
             break;
         }
@@ -1338,35 +1445,41 @@ static bitmask_transtbl fcntl_flags_tbl[] = {
 /* NOTE: there is really one LDT for all the threads */
 uint8_t *ldt_table;
 
-static int read_ldt(void *ptr, unsigned long bytecount)
+static int read_ldt(target_ulong ptr, unsigned long bytecount)
 {
     int size;
+    void *p;
 
     if (!ldt_table)
         return 0;
     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
     if (size > bytecount)
         size = bytecount;
-    memcpy(ptr, ldt_table, size);
+    p = lock_user(ptr, size, 0);
+    /* ??? Shoudl this by byteswapped?  */
+    memcpy(p, ldt_table, size);
+    unlock_user(p, ptr, size);
     return size;
 }
 
 /* XXX: add locking support */
 static int write_ldt(CPUX86State *env, 
-                     void *ptr, unsigned long bytecount, int oldmode)
+                     target_ulong ptr, unsigned long bytecount, int oldmode)
 {
     struct target_modify_ldt_ldt_s ldt_info;
+    struct target_modify_ldt_ldt_s *target_ldt_info;
     int seg_32bit, contents, read_exec_only, limit_in_pages;
     int seg_not_present, useable;
     uint32_t *lp, entry_1, entry_2;
 
     if (bytecount != sizeof(ldt_info))
         return -EINVAL;
-    memcpy(&ldt_info, ptr, sizeof(ldt_info));
-    tswap32s(&ldt_info.entry_number);
-    tswapls((long *)&ldt_info.base_addr);
-    tswap32s(&ldt_info.limit);
-    tswap32s(&ldt_info.flags);
+    lock_user_struct(target_ldt_info, ptr, 1);
+    ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
+    ldt_info.base_addr = tswapl(target_ldt_info->base_addr);
+    ldt_info.limit = tswap32(target_ldt_info->limit);
+    ldt_info.flags = tswap32(target_ldt_info->flags);
+    unlock_user_struct(target_ldt_info, ptr, 0);
     
     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
         return -EINVAL;
@@ -1389,7 +1502,7 @@ static int write_ldt(CPUX86State *env,
         if (!ldt_table)
             return -ENOMEM;
         memset(ldt_table, 0, TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
-        env->ldt.base = (long)ldt_table;
+        env->ldt.base = h2g(ldt_table);
         env->ldt.limit = 0xffff;
     }
 
@@ -1432,7 +1545,7 @@ install:
 }
 
 /* specific and weird i386 syscalls */
-int do_modify_ldt(CPUX86State *env, int func, void *ptr, unsigned long bytecount)
+int do_modify_ldt(CPUX86State *env, int func, target_ulong ptr, unsigned long bytecount)
 {
     int ret = -ENOSYS;
     
@@ -1523,31 +1636,35 @@ int do_fork(CPUState *env, unsigned int flags, unsigned long newsp)
     return ret;
 }
 
-static long do_fcntl(int fd, int cmd, unsigned long arg)
+static long do_fcntl(int fd, int cmd, target_ulong arg)
 {
     struct flock fl;
-    struct target_flock *target_fl = (void *)arg;
+    struct target_flock *target_fl;
     long ret;
-    
+
     switch(cmd) {
     case TARGET_F_GETLK:
         ret = fcntl(fd, cmd, &fl);
         if (ret == 0) {
+            lock_user_struct(target_fl, arg, 0);
             target_fl->l_type = tswap16(fl.l_type);
             target_fl->l_whence = tswap16(fl.l_whence);
             target_fl->l_start = tswapl(fl.l_start);
             target_fl->l_len = tswapl(fl.l_len);
             target_fl->l_pid = tswapl(fl.l_pid);
+            unlock_user_struct(target_fl, arg, 1);
         }
         break;
         
     case TARGET_F_SETLK:
     case TARGET_F_SETLKW:
+        lock_user_struct(target_fl, arg, 1);
         fl.l_type = tswap16(target_fl->l_type);
         fl.l_whence = tswap16(target_fl->l_whence);
         fl.l_start = tswapl(target_fl->l_start);
         fl.l_len = tswapl(target_fl->l_len);
         fl.l_pid = tswapl(target_fl->l_pid);
+        unlock_user_struct(target_fl, arg, 0);
         ret = fcntl(fd, cmd, &fl);
         break;
         
@@ -1690,12 +1807,35 @@ static inline long target_ftruncate64(void *cpu_env, long arg1, long arg2,
 }
 #endif
 
+static inline void target_to_host_timespec(struct timespec *host_ts,
+                                           target_ulong target_addr)
+{
+    struct target_timespec *target_ts;
+
+    lock_user_struct(target_ts, target_addr, 1);
+    host_ts->tv_sec = tswapl(target_ts->tv_sec);
+    host_ts->tv_nsec = tswapl(target_ts->tv_nsec);
+    unlock_user_struct(target_ts, target_addr, 0);
+}
+
+static inline void host_to_target_timespec(target_ulong target_addr,
+                                           struct timespec *host_ts)
+{
+    struct target_timespec *target_ts;
+
+    lock_user_struct(target_ts, target_addr, 0);
+    target_ts->tv_sec = tswapl(host_ts->tv_sec);
+    target_ts->tv_nsec = tswapl(host_ts->tv_nsec);
+    unlock_user_struct(target_ts, target_addr, 1);
+}
+
 long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, 
                 long arg4, long arg5, long arg6)
 {
     long ret;
     struct stat st;
     struct statfs stfs;
+    void *p;
     
 #ifdef DEBUG
     gemu_log("syscall %d", num);
@@ -1711,89 +1851,140 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         ret = 0; /* avoid warning */
         break;
     case TARGET_NR_read:
-        page_unprotect_range((void *)arg2, arg3);
-        ret = get_errno(read(arg1, (void *)arg2, arg3));
+        page_unprotect_range(arg2, arg3);
+        p = lock_user(arg2, arg3, 0);
+        ret = get_errno(read(arg1, p, arg3));
+        unlock_user(p, arg2, ret);
         break;
     case TARGET_NR_write:
-        ret = get_errno(write(arg1, (void *)arg2, arg3));
+        p = lock_user(arg2, arg3, 1);
+        ret = get_errno(write(arg1, p, arg3));
+        unlock_user(p, arg2, 0);
         break;
     case TARGET_NR_open:
-        ret = get_errno(open(path((const char *)arg1),
+        p = lock_user_string(arg1);
+        ret = get_errno(open(path(p),
                              target_to_host_bitmask(arg2, fcntl_flags_tbl),
                              arg3));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_close:
         ret = get_errno(close(arg1));
         break;
     case TARGET_NR_brk:
-        ret = do_brk((char *)arg1);
+        ret = do_brk(arg1);
         break;
     case TARGET_NR_fork:
         ret = get_errno(do_fork(cpu_env, SIGCHLD, 0));
         break;
     case TARGET_NR_waitpid:
         {
-            int *status = (int *)arg2;
-            ret = get_errno(waitpid(arg1, status, arg3));
-            if (!is_error(ret) && status)
-                tswapls((long *)&status);
+            int status;
+            ret = get_errno(waitpid(arg1, &status, arg3));
+            if (!is_error(ret) && arg2)
+                tput32(arg2, status);
         }
         break;
     case TARGET_NR_creat:
-        ret = get_errno(creat((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(creat(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_link:
-        ret = get_errno(link((const char *)arg1, (const char *)arg2));
+        {
+            void * p2;
+            p = lock_user_string(arg1);
+            p2 = lock_user_string(arg2);
+            ret = get_errno(link(p, p2));
+            unlock_user(p2, arg2, 0);
+            unlock_user(p, arg1, 0);
+        }
         break;
     case TARGET_NR_unlink:
-        ret = get_errno(unlink((const char *)arg1));
+        p = lock_user_string(arg1);
+        ret = get_errno(unlink(p));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_execve:
         {
             char **argp, **envp;
             int argc, envc;
-            uint32_t *p;
+            target_ulong gp;
+            target_ulong guest_argp;
+            target_ulong guest_envp;
+            target_ulong addr;
             char **q;
 
             argc = 0;
-            for (p = (void *)arg2; *p; p++)
+            guest_argp = arg2;
+            for (gp = guest_argp; tgetl(gp); gp++)
                 argc++;
             envc = 0;
-            for (p = (void *)arg3; *p; p++)
+            guest_envp = arg3;
+            for (gp = guest_envp; tgetl(gp); gp++)
                 envc++;
 
             argp = alloca((argc + 1) * sizeof(void *));
             envp = alloca((envc + 1) * sizeof(void *));
 
-            for (p = (void *)arg2, q = argp; *p; p++, q++)
-                *q = (void *)tswap32(*p);
+            for (gp = guest_argp, q = argp; ;
+                  gp += sizeof(target_ulong), q++) {
+                addr = tgetl(gp);
+                if (!addr)
+                    break;
+                *q = lock_user_string(addr);
+            }
             *q = NULL;
 
-            for (p = (void *)arg3, q = envp; *p; p++, q++)
-                *q = (void *)tswap32(*p);
+            for (gp = guest_envp, q = envp; ;
+                  gp += sizeof(target_ulong), q++) {
+                addr = tgetl(gp);
+                if (!addr)
+                    break;
+                *q = lock_user_string(addr);
+            }
             *q = NULL;
 
-            ret = get_errno(execve((const char *)arg1, argp, envp));
+            p = lock_user_string(arg1);
+            ret = get_errno(execve(p, argp, envp));
+            unlock_user(p, arg1, 0);
+
+            for (gp = guest_argp, q = argp; *q;
+                  gp += sizeof(target_ulong), q++) {
+                addr = tgetl(gp);
+                unlock_user(*q, addr, 0);
+            }
+            for (gp = guest_envp, q = envp; *q;
+                  gp += sizeof(target_ulong), q++) {
+                addr = tgetl(gp);
+                unlock_user(*q, addr, 0);
+            }
         }
         break;
     case TARGET_NR_chdir:
-        ret = get_errno(chdir((const char *)arg1));
+        p = lock_user_string(arg1);
+        ret = get_errno(chdir(p));
+        unlock_user(p, arg1, 0);
         break;
 #ifdef TARGET_NR_time
     case TARGET_NR_time:
         {
-            int *time_ptr = (int *)arg1;
-            ret = get_errno(time((time_t *)time_ptr));
-            if (!is_error(ret) && time_ptr)
-                tswap32s(time_ptr);
+            time_t host_time;
+            ret = get_errno(time(&host_time));
+            if (!is_error(ret) && arg1)
+                tputl(arg1, host_time);
         }
         break;
 #endif
     case TARGET_NR_mknod:
-        ret = get_errno(mknod((const char *)arg1, arg2, arg3));
+        p = lock_user_string(arg1);
+        ret = get_errno(mknod(p, arg2, arg3));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_chmod:
-        ret = get_errno(chmod((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(chmod(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
 #ifdef TARGET_NR_break
     case TARGET_NR_break:
@@ -1813,14 +2004,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         /* need to look at the data field */
         goto unimplemented;
     case TARGET_NR_umount:
-        ret = get_errno(umount((const char *)arg1));
+        p = lock_user_string(arg1);
+        ret = get_errno(umount(p));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_stime:
         {
-            int *time_ptr = (int *)arg1;
-            if (time_ptr)
-                tswap32s(time_ptr);
-            ret = get_errno(stime((time_t *)time_ptr));
+            time_t host_time;
+            host_time = tgetl(arg1);
+            ret = get_errno(stime(&host_time));
         }
         break;
     case TARGET_NR_ptrace:
@@ -1837,30 +2029,36 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         break;
     case TARGET_NR_utime:
         {
-            struct utimbuf tbuf, *tbuf1;
-            struct target_utimbuf *target_tbuf = (void *)arg2;
-            if (target_tbuf) {
-                get_user(tbuf.actime, &target_tbuf->actime);
-                get_user(tbuf.modtime, &target_tbuf->modtime);
-                tbuf1 = &tbuf;
+            struct utimbuf tbuf, *host_tbuf;
+            struct target_utimbuf *target_tbuf;
+            if (arg2) {
+                lock_user_struct(target_tbuf, arg2, 1);
+                tbuf.actime = tswapl(target_tbuf->actime);
+                tbuf.modtime = tswapl(target_tbuf->modtime);
+                unlock_user_struct(target_tbuf, arg2, 0);
+                host_tbuf = &tbuf;
             } else {
-                tbuf1 = NULL;
+                host_tbuf = NULL;
             }
-            ret = get_errno(utime((const char *)arg1, tbuf1));
+            p = lock_user_string(arg1);
+            ret = get_errno(utime(p, host_tbuf));
+            unlock_user(p, arg1, 0);
         }
         break;
     case TARGET_NR_utimes:
         {
-            struct target_timeval *target_tvp = (struct target_timeval *)arg2;
             struct timeval *tvp, tv[2];
-            if (target_tvp) {
-                target_to_host_timeval(&tv[0], &target_tvp[0]);
-                target_to_host_timeval(&tv[1], &target_tvp[1]);
+            if (arg2) {
+                target_to_host_timeval(&tv[0], arg2);
+                target_to_host_timeval(&tv[1],
+                    arg2 + sizeof (struct target_timeval));
                 tvp = tv;
             } else {
                 tvp = NULL;
             }
-            ret = get_errno(utimes((const char *)arg1, tvp));
+            p = lock_user_string(arg1);
+            ret = get_errno(utimes(p, tvp));
+            unlock_user(p, arg1, 0);
         }
         break;
 #ifdef TARGET_NR_stty
@@ -1872,7 +2070,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         goto unimplemented;
 #endif
     case TARGET_NR_access:
-        ret = get_errno(access((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(access(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_nice:
         ret = get_errno(nice(arg1));
@@ -1889,33 +2089,45 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         ret = get_errno(kill(arg1, arg2));
         break;
     case TARGET_NR_rename:
-        ret = get_errno(rename((const char *)arg1, (const char *)arg2));
+        {
+            void *p2;
+            p = lock_user_string(arg1);
+            p2 = lock_user_string(arg2);
+            ret = get_errno(rename(p, p2));
+            unlock_user(p2, arg2, 0);
+            unlock_user(p, arg1, 0);
+        }
         break;
     case TARGET_NR_mkdir:
-        ret = get_errno(mkdir((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(mkdir(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_rmdir:
-        ret = get_errno(rmdir((const char *)arg1));
+        p = lock_user_string(arg1);
+        ret = get_errno(rmdir(p));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_dup:
         ret = get_errno(dup(arg1));
         break;
     case TARGET_NR_pipe:
         {
-            int *pipe_ptr = (int *)arg1;
-            ret = get_errno(pipe(pipe_ptr));
+            int host_pipe[2];
+            ret = get_errno(pipe(host_pipe));
             if (!is_error(ret)) {
-                tswap32s(&pipe_ptr[0]);
-                tswap32s(&pipe_ptr[1]);
+                tput32(arg1, host_pipe[0]);
+                tput32(arg1 + 4, host_pipe[1]);
             }
         }
         break;
     case TARGET_NR_times:
         {
-            struct target_tms *tmsp = (void *)arg1;
+            struct target_tms *tmsp;
             struct tms tms;
             ret = get_errno(times(&tms));
-            if (tmsp) {
+            if (arg1) {
+                tmsp = lock_user(arg1, sizeof(struct target_tms), 0);
                 tmsp->tms_utime = tswapl(host_to_target_clock_t(tms.tms_utime));
                 tmsp->tms_stime = tswapl(host_to_target_clock_t(tms.tms_stime));
                 tmsp->tms_cutime = tswapl(host_to_target_clock_t(tms.tms_cutime));
@@ -1935,7 +2147,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_acct:
         goto unimplemented;
     case TARGET_NR_umount2:
-        ret = get_errno(umount2((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(umount2(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
 #ifdef TARGET_NR_lock
     case TARGET_NR_lock:
@@ -1966,7 +2180,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         ret = get_errno(umask(arg1));
         break;
     case TARGET_NR_chroot:
-        ret = get_errno(chroot((const char *)arg1));
+        p = lock_user_string(arg1);
+        ret = get_errno(chroot(p));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_ustat:
         goto unimplemented;
@@ -1984,29 +2200,49 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         break;
     case TARGET_NR_sigaction:
         {
-            struct target_old_sigaction *old_act = (void *)arg2;
-            struct target_old_sigaction *old_oact = (void *)arg3;
+            struct target_old_sigaction *old_act;
             struct target_sigaction act, oact, *pact;
-            if (old_act) {
+            if (arg2) {
+                lock_user_struct(old_act, arg2, 1);
                 act._sa_handler = old_act->_sa_handler;
                 target_siginitset(&act.sa_mask, old_act->sa_mask);
                 act.sa_flags = old_act->sa_flags;
                 act.sa_restorer = old_act->sa_restorer;
+                unlock_user_struct(old_act, arg2, 0);
                 pact = &act;
             } else {
                 pact = NULL;
             }
             ret = get_errno(do_sigaction(arg1, pact, &oact));
-            if (!is_error(ret) && old_oact) {
-                old_oact->_sa_handler = oact._sa_handler;
-                old_oact->sa_mask = oact.sa_mask.sig[0];
-                old_oact->sa_flags = oact.sa_flags;
-                old_oact->sa_restorer = oact.sa_restorer;
+            if (!is_error(ret) && arg3) {
+                lock_user_struct(old_act, arg3, 0);
+                old_act->_sa_handler = oact._sa_handler;
+                old_act->sa_mask = oact.sa_mask.sig[0];
+                old_act->sa_flags = oact.sa_flags;
+                old_act->sa_restorer = oact.sa_restorer;
+                unlock_user_struct(old_act, arg3, 1);
             }
         }
         break;
     case TARGET_NR_rt_sigaction:
-        ret = get_errno(do_sigaction(arg1, (void *)arg2, (void *)arg3));
+        {
+            struct target_sigaction *act;
+            struct target_sigaction *oact;
+
+            if (arg2)
+                lock_user_struct(act, arg2, 1);
+            else
+                act = NULL;
+            if (arg3)
+                lock_user_struct(oact, arg3, 0);
+            else
+                oact = NULL;
+            ret = get_errno(do_sigaction(arg1, act, oact));
+            if (arg2)
+                unlock_user_struct(act, arg2, 0);
+            if (arg3)
+                unlock_user_struct(oact, arg3, 1);
+        }
         break;
     case TARGET_NR_sgetmask:
         {
@@ -2033,9 +2269,8 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         {
             int how = arg1;
             sigset_t set, oldset, *set_ptr;
-            target_ulong *pset = (void *)arg2, *poldset = (void *)arg3;
             
-            if (pset) {
+            if (arg2) {
                 switch(how) {
                 case TARGET_SIG_BLOCK:
                     how = SIG_BLOCK;
@@ -2050,15 +2285,19 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                     ret = -EINVAL;
                     goto fail;
                 }
-                target_to_host_old_sigset(&set, pset);
+                p = lock_user(arg2, sizeof(target_sigset_t), 1);
+                target_to_host_old_sigset(&set, p);
+                unlock_user(p, arg2, 0);
                 set_ptr = &set;
             } else {
                 how = 0;
                 set_ptr = NULL;
             }
             ret = get_errno(sigprocmask(arg1, set_ptr, &oldset));
-            if (!is_error(ret) && poldset) {
-                host_to_target_old_sigset(poldset, &oldset);
+            if (!is_error(ret) && arg3) {
+                p = lock_user(arg3, sizeof(target_sigset_t), 0);
+                host_to_target_old_sigset(p, &oldset);
+                unlock_user(p, arg3, sizeof(target_sigset_t));
             }
         }
         break;
@@ -2066,10 +2305,8 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         {
             int how = arg1;
             sigset_t set, oldset, *set_ptr;
-            target_sigset_t *pset = (void *)arg2;
-            target_sigset_t *poldset = (void *)arg3;
             
-            if (pset) {
+            if (arg2) {
                 switch(how) {
                 case TARGET_SIG_BLOCK:
                     how = SIG_BLOCK;
@@ -2084,15 +2321,19 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                     ret = -EINVAL;
                     goto fail;
                 }
-                target_to_host_sigset(&set, pset);
+                p = lock_user(arg2, sizeof(target_sigset_t), 1);
+                target_to_host_sigset(&set, p);
+                unlock_user(p, arg2, 0);
                 set_ptr = &set;
             } else {
                 how = 0;
                 set_ptr = NULL;
             }
             ret = get_errno(sigprocmask(how, set_ptr, &oldset));
-            if (!is_error(ret) && poldset) {
-                host_to_target_sigset(poldset, &oldset);
+            if (!is_error(ret) && arg3) {
+                p = lock_user(arg3, sizeof(target_sigset_t), 0);
+                host_to_target_sigset(p, &oldset);
+                unlock_user(p, arg3, sizeof(target_sigset_t));
             }
         }
         break;
@@ -2101,7 +2342,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
             sigset_t set;
             ret = get_errno(sigpending(&set));
             if (!is_error(ret)) {
-                host_to_target_old_sigset((target_ulong *)arg1, &set);
+                p = lock_user(arg1, sizeof(target_sigset_t), 0);
+                host_to_target_old_sigset(p, &set);
+                unlock_user(p, arg1, sizeof(target_sigset_t));
             }
         }
         break;
@@ -2110,51 +2353,59 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
             sigset_t set;
             ret = get_errno(sigpending(&set));
             if (!is_error(ret)) {
-                host_to_target_sigset((target_sigset_t *)arg1, &set);
+                p = lock_user(arg1, sizeof(target_sigset_t), 0);
+                host_to_target_sigset(p, &set);
+                unlock_user(p, arg1, sizeof(target_sigset_t));
             }
         }
         break;
     case TARGET_NR_sigsuspend:
         {
             sigset_t set;
-            target_to_host_old_sigset(&set, (target_ulong *)arg1);
+            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            target_to_host_old_sigset(&set, p);
+            unlock_user(p, arg1, 0);
             ret = get_errno(sigsuspend(&set));
         }
         break;
     case TARGET_NR_rt_sigsuspend:
         {
             sigset_t set;
-            target_to_host_sigset(&set, (target_sigset_t *)arg1);
+            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            target_to_host_sigset(&set, p);
+            unlock_user(p, arg1, 0);
             ret = get_errno(sigsuspend(&set));
         }
         break;
     case TARGET_NR_rt_sigtimedwait:
         {
-            target_sigset_t *target_set = (void *)arg1;
-            target_siginfo_t *target_uinfo = (void *)arg2;
-            struct target_timespec *target_uts = (void *)arg3;
             sigset_t set;
             struct timespec uts, *puts;
             siginfo_t uinfo;
             
-            target_to_host_sigset(&set, target_set);
-            if (target_uts) {
+            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            target_to_host_sigset(&set, p);
+            unlock_user(p, arg1, 0);
+            if (arg3) {
                 puts = &uts;
-                puts->tv_sec = tswapl(target_uts->tv_sec);
-                puts->tv_nsec = tswapl(target_uts->tv_nsec);
+                target_to_host_timespec(puts, arg3);
             } else {
                 puts = NULL;
             }
             ret = get_errno(sigtimedwait(&set, &uinfo, puts));
-            if (!is_error(ret) && target_uinfo) {
-                host_to_target_siginfo(target_uinfo, &uinfo);
+            if (!is_error(ret) && arg2) {
+                p = lock_user(arg2, sizeof(target_sigset_t), 0);
+                host_to_target_siginfo(p, &uinfo);
+                unlock_user(p, arg2, sizeof(target_sigset_t));
             }
         }
         break;
     case TARGET_NR_rt_sigqueueinfo:
         {
             siginfo_t uinfo;
-            target_to_host_siginfo(&uinfo, (target_siginfo_t *)arg3);
+            p = lock_user(arg3, sizeof(target_sigset_t), 1);
+            target_to_host_siginfo(&uinfo, p);
+            unlock_user(p, arg1, 0);
             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
         }
         break;
@@ -2167,16 +2418,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         ret = do_rt_sigreturn(cpu_env);
         break;
     case TARGET_NR_sethostname:
-        ret = get_errno(sethostname((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(sethostname(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_setrlimit:
         {
             /* XXX: convert resource ? */
             int resource = arg1;
-            struct target_rlimit *target_rlim = (void *)arg2;
+            struct target_rlimit *target_rlim;
             struct rlimit rlim;
+            lock_user_struct(target_rlim, arg2, 1);
             rlim.rlim_cur = tswapl(target_rlim->rlim_cur);
             rlim.rlim_max = tswapl(target_rlim->rlim_max);
+            unlock_user_struct(target_rlim, arg2, 0);
             ret = get_errno(setrlimit(resource, &rlim));
         }
         break;
@@ -2184,72 +2439,91 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         {
             /* XXX: convert resource ? */
             int resource = arg1;
-            struct target_rlimit *target_rlim = (void *)arg2;
+            struct target_rlimit *target_rlim;
             struct rlimit rlim;
             
             ret = get_errno(getrlimit(resource, &rlim));
             if (!is_error(ret)) {
-                target_rlim->rlim_cur = tswapl(rlim.rlim_cur);
-                target_rlim->rlim_max = tswapl(rlim.rlim_max);
+                lock_user_struct(target_rlim, arg2, 0);
+                rlim.rlim_cur = tswapl(target_rlim->rlim_cur);
+                rlim.rlim_max = tswapl(target_rlim->rlim_max);
+                unlock_user_struct(target_rlim, arg2, 1);
             }
         }
         break;
     case TARGET_NR_getrusage:
         {
             struct rusage rusage;
-            struct target_rusage *target_rusage = (void *)arg2;
             ret = get_errno(getrusage(arg1, &rusage));
             if (!is_error(ret)) {
-                host_to_target_rusage(target_rusage, &rusage);
+                host_to_target_rusage(arg2, &rusage);
             }
         }
         break;
     case TARGET_NR_gettimeofday:
         {
-            struct target_timeval *target_tv = (void *)arg1;
             struct timeval tv;
             ret = get_errno(gettimeofday(&tv, NULL));
             if (!is_error(ret)) {
-                host_to_target_timeval(target_tv, &tv);
+                host_to_target_timeval(arg1, &tv);
             }
         }
         break;
     case TARGET_NR_settimeofday:
         {
-            struct target_timeval *target_tv = (void *)arg1;
             struct timeval tv;
-            target_to_host_timeval(&tv, target_tv);
+            target_to_host_timeval(&tv, arg1);
             ret = get_errno(settimeofday(&tv, NULL));
         }
         break;
 #ifdef TARGET_NR_select
     case TARGET_NR_select:
         {
-            struct target_sel_arg_struct *sel = (void *)arg1;
-            sel->n = tswapl(sel->n);
-            sel->inp = tswapl(sel->inp);
-            sel->outp = tswapl(sel->outp);
-            sel->exp = tswapl(sel->exp);
-            sel->tvp = tswapl(sel->tvp);
-            ret = do_select(sel->n, (void *)sel->inp, (void *)sel->outp,
-                            (void *)sel->exp, (void *)sel->tvp);
+            struct target_sel_arg_struct *sel;
+            target_ulong inp, outp, exp, tvp;
+            long nsel;
+
+            lock_user_struct(sel, arg1, 1);
+            nsel = tswapl(sel->n);
+            inp = tswapl(sel->inp);
+            outp = tswapl(sel->outp);
+            exp = tswapl(sel->exp);
+            tvp = tswapl(sel->tvp);
+            unlock_user_struct(sel, arg1, 0);
+            ret = do_select(nsel, inp, outp, exp, tvp);
         }
         break;
 #endif
     case TARGET_NR_symlink:
-        ret = get_errno(symlink((const char *)arg1, (const char *)arg2));
+        {
+            void *p2;
+            p = lock_user_string(arg1);
+            p2 = lock_user_string(arg2);
+            ret = get_errno(symlink(p, p2));
+            unlock_user(p2, arg2, 0);
+            unlock_user(p, arg1, 0);
+        }
         break;
 #ifdef TARGET_NR_oldlstat
     case TARGET_NR_oldlstat:
         goto unimplemented;
 #endif
     case TARGET_NR_readlink:
-        ret = get_errno(readlink(path((const char *)arg1), (char *)arg2, arg3));
+        {
+            void *p2;
+            p = lock_user_string(arg1);
+            p2 = lock_user(arg2, arg3, 0);
+            ret = get_errno(readlink(path(p), p2, arg3));
+            unlock_user(p2, arg2, ret);
+            unlock_user(p, arg1, 0);
+        }
         break;
     case TARGET_NR_uselib:
         goto unimplemented;
     case TARGET_NR_swapon:
-        ret = get_errno(swapon((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(swapon(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_reboot:
         goto unimplemented;
@@ -2258,14 +2532,16 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_mmap:
 #if defined(TARGET_I386) || defined(TARGET_ARM)
         {
-            uint32_t v1, v2, v3, v4, v5, v6, *vptr;
-            vptr = (uint32_t *)arg1;
-            v1 = tswap32(vptr[0]);
-            v2 = tswap32(vptr[1]);
-            v3 = tswap32(vptr[2]);
-            v4 = tswap32(vptr[3]);
-            v5 = tswap32(vptr[4]);
-            v6 = tswap32(vptr[5]);
+            target_ulong *v;
+            target_ulong v1, v2, v3, v4, v5, v6;
+            v = lock_user(arg1, 6 * sizeof(target_ulong), 1);
+            v1 = tswapl(v[0]);
+            v2 = tswapl(v[1]);
+            v3 = tswapl(v[2]);
+            v4 = tswapl(v[3]);
+            v5 = tswapl(v[4]);
+            v6 = tswapl(v[5]);
+            unlock_user(v, arg1, 0);
             ret = get_errno(target_mmap(v1, v2, v3, 
                                         target_to_host_bitmask(v4, mmap_flags_tbl),
                                         v5, v6));
@@ -2299,14 +2575,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_mremap:
         ret = get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
         break;
+        /* ??? msync/mlock/munlock are broken for softmmu.  */
     case TARGET_NR_msync:
-        ret = get_errno(msync((void *)arg1, arg2, arg3));
+        ret = get_errno(msync(g2h(arg1), arg2, arg3));
         break;
     case TARGET_NR_mlock:
-        ret = get_errno(mlock((void *)arg1, arg2));
+        ret = get_errno(mlock(g2h(arg1), arg2));
         break;
     case TARGET_NR_munlock:
-        ret = get_errno(munlock((void *)arg1, arg2));
+        ret = get_errno(munlock(g2h(arg1), arg2));
         break;
     case TARGET_NR_mlockall:
         ret = get_errno(mlockall(arg1));
@@ -2315,7 +2592,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         ret = get_errno(munlockall());
         break;
     case TARGET_NR_truncate:
-        ret = get_errno(truncate((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(truncate(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_ftruncate:
         ret = get_errno(ftruncate(arg1, arg2));
@@ -2334,11 +2613,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         goto unimplemented;
 #endif
     case TARGET_NR_statfs:
-        ret = get_errno(statfs(path((const char *)arg1), &stfs));
+        p = lock_user_string(arg1);
+        ret = get_errno(statfs(path(p), &stfs));
+        unlock_user(p, arg1, 0);
     convert_statfs:
         if (!is_error(ret)) {
-            struct target_statfs *target_stfs = (void *)arg2;
+            struct target_statfs *target_stfs;
             
+            lock_user_struct(target_stfs, arg2, 0);
+            /* ??? put_user is probably wrong.  */
             put_user(stfs.f_type, &target_stfs->f_type);
             put_user(stfs.f_bsize, &target_stfs->f_bsize);
             put_user(stfs.f_blocks, &target_stfs->f_blocks);
@@ -2348,6 +2631,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
             put_user(stfs.f_ffree, &target_stfs->f_ffree);
             put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid);
             put_user(stfs.f_namelen, &target_stfs->f_namelen);
+            unlock_user_struct(target_stfs, arg2, 1);
         }
         break;
     case TARGET_NR_fstatfs:
@@ -2355,11 +2639,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         goto convert_statfs;
 #ifdef TARGET_NR_statfs64
     case TARGET_NR_statfs64:
-        ret = get_errno(statfs(path((const char *)arg1), &stfs));
+        p = lock_user_string(arg1);
+        ret = get_errno(statfs(path(p), &stfs));
+        unlock_user(p, arg1, 0);
     convert_statfs64:
         if (!is_error(ret)) {
-            struct target_statfs64 *target_stfs = (void *)arg3;
-
+            struct target_statfs64 *target_stfs;
+            
+            lock_user_struct(target_stfs, arg3, 0);
+            /* ??? put_user is probably wrong.  */
             put_user(stfs.f_type, &target_stfs->f_type);
             put_user(stfs.f_bsize, &target_stfs->f_bsize);
             put_user(stfs.f_blocks, &target_stfs->f_blocks);
@@ -2369,6 +2657,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
             put_user(stfs.f_ffree, &target_stfs->f_ffree);
             put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid);
             put_user(stfs.f_namelen, &target_stfs->f_namelen);
+            unlock_user_struct(target_stfs, arg3, 0);
         }
         break;
     case TARGET_NR_fstatfs64:
@@ -2380,60 +2669,63 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         goto unimplemented;
 #endif
     case TARGET_NR_socketcall:
-        ret = do_socketcall(arg1, (int32_t *)arg2);
+        ret = do_socketcall(arg1, arg2);
         break;
     case TARGET_NR_syslog:
         goto unimplemented;
     case TARGET_NR_setitimer:
         {
-            struct target_itimerval *target_value = (void *)arg2;
-            struct target_itimerval *target_ovalue = (void *)arg3;
             struct itimerval value, ovalue, *pvalue;
 
-            if (target_value) {
+            if (arg2) {
                 pvalue = &value;
                 target_to_host_timeval(&pvalue->it_interval, 
-                                       &target_value->it_interval);
+                                       arg2);
                 target_to_host_timeval(&pvalue->it_value, 
-                                       &target_value->it_value);
+                                       arg2 + sizeof(struct target_timeval));
             } else {
                 pvalue = NULL;
             }
             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
-            if (!is_error(ret) && target_ovalue) {
-                host_to_target_timeval(&target_ovalue->it_interval, 
+            if (!is_error(ret) && arg3) {
+                host_to_target_timeval(arg3,
                                        &ovalue.it_interval);
-                host_to_target_timeval(&target_ovalue->it_value, 
+                host_to_target_timeval(arg3 + sizeof(struct target_timeval),
                                        &ovalue.it_value);
             }
         }
         break;
     case TARGET_NR_getitimer:
         {
-            struct target_itimerval *target_value = (void *)arg2;
             struct itimerval value;
             
             ret = get_errno(getitimer(arg1, &value));
-            if (!is_error(ret) && target_value) {
-                host_to_target_timeval(&target_value->it_interval, 
+            if (!is_error(ret) && arg2) {
+                host_to_target_timeval(arg2,
                                        &value.it_interval);
-                host_to_target_timeval(&target_value->it_value, 
+                host_to_target_timeval(arg2 + sizeof(struct target_timeval),
                                        &value.it_value);
             }
         }
         break;
     case TARGET_NR_stat:
-        ret = get_errno(stat(path((const char *)arg1), &st));
+        p = lock_user_string(arg1);
+        ret = get_errno(stat(path(p), &st));
+        unlock_user(p, arg1, 0);
         goto do_stat;
     case TARGET_NR_lstat:
-        ret = get_errno(lstat(path((const char *)arg1), &st));
+        p = lock_user_string(arg1);
+        ret = get_errno(lstat(path(p), &st));
+        unlock_user(p, arg1, 0);
         goto do_stat;
     case TARGET_NR_fstat:
         {
             ret = get_errno(fstat(arg1, &st));
         do_stat:
             if (!is_error(ret)) {
-                struct target_stat *target_st = (void *)arg2;
+                struct target_stat *target_st;
+                
+                lock_user_struct(target_st, arg2, 0);
                 target_st->st_dev = tswap16(st.st_dev);
                 target_st->st_ino = tswapl(st.st_ino);
 #if defined(TARGET_PPC)
@@ -2453,6 +2745,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                 target_st->target_st_atime = tswapl(st.st_atime);
                 target_st->target_st_mtime = tswapl(st.st_mtime);
                 target_st->target_st_ctime = tswapl(st.st_ctime);
+                unlock_user_struct(target_st, arg2, 1);
             }
         }
         break;
@@ -2479,9 +2772,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_wait4:
         {
             int status;
-            target_long *status_ptr = (void *)arg2;
+            target_long status_ptr = arg2;
             struct rusage rusage, *rusage_ptr;
-            struct target_rusage *target_rusage = (void *)arg4;
+            target_ulong target_rusage = arg4;
             if (target_rusage)
                 rusage_ptr = &rusage;
             else
@@ -2489,7 +2782,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
             ret = get_errno(wait4(arg1, &status, arg3, rusage_ptr));
             if (!is_error(ret)) {
                 if (status_ptr)
-                    *status_ptr = tswap32(status);
+                    tputl(status_ptr, status);
                 if (target_rusage) {
                     host_to_target_rusage(target_rusage, &rusage);
                 }
@@ -2497,15 +2790,19 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         }
         break;
     case TARGET_NR_swapoff:
-        ret = get_errno(swapoff((const char *)arg1));
+        p = lock_user_string(arg1);
+        ret = get_errno(swapoff(p));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_sysinfo:
         {
-            struct target_sysinfo *target_value = (void *)arg1;
+            struct target_sysinfo *target_value;
             struct sysinfo value;
             ret = get_errno(sysinfo(&value));
-            if (!is_error(ret) && target_value)
+            if (!is_error(ret) && arg1)
             {
+                /* ??? __put_user is probably wrong.  */
+                lock_user_struct(target_value, arg1, 0);
                 __put_user(value.uptime, &target_value->uptime);
                 __put_user(value.loads[0], &target_value->loads[0]);
                 __put_user(value.loads[1], &target_value->loads[1]);
@@ -2520,6 +2817,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                 __put_user(value.totalhigh, &target_value->totalhigh);
                 __put_user(value.freehigh, &target_value->freehigh);
                 __put_user(value.mem_unit, &target_value->mem_unit);
+                unlock_user_struct(target_value, arg1, 1);
             }
         }
         break;
@@ -2540,30 +2838,33 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         break;
 #endif
     case TARGET_NR_setdomainname:
-        ret = get_errno(setdomainname((const char *)arg1, arg2));
+        p = lock_user_string(arg1);
+        ret = get_errno(setdomainname(p, arg2));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_uname:
         /* no need to transcode because we use the linux syscall */
         {
             struct new_utsname * buf;
     
-            buf = (struct new_utsname *)arg1;
+            lock_user_struct(buf, arg1, 0);
             ret = get_errno(sys_uname(buf));
             if (!is_error(ret)) {
                 /* Overrite the native machine name with whatever is being
                    emulated. */
                 strcpy (buf->machine, UNAME_MACHINE);
             }
+            unlock_user_struct(buf, arg1, 1);
         }
         break;
 #ifdef TARGET_I386
     case TARGET_NR_modify_ldt:
-        ret = get_errno(do_modify_ldt(cpu_env, arg1, (void *)arg2, arg3));
+        ret = get_errno(do_modify_ldt(cpu_env, arg1, arg2, arg3));
         break;
     case TARGET_NR_vm86old:
         goto unimplemented;
     case TARGET_NR_vm86:
-        ret = do_vm86(cpu_env, arg1, (void *)arg2);
+        ret = do_vm86(cpu_env, arg1, arg2);
         break;
 #endif
     case TARGET_NR_adjtimex:
@@ -2594,20 +2895,21 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         {
 #if defined (__x86_64__)
             ret = get_errno(lseek(arg1, ((uint64_t )arg2 << 32) | arg3, arg5));
-            *(int64_t *)arg4 = ret;
+            tput64(arg4, ret);
 #else
             int64_t res;
             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
-            *(int64_t *)arg4 = tswap64(res);
+            tput64(arg4, res);
 #endif
         }
         break;
     case TARGET_NR_getdents:
 #if TARGET_LONG_SIZE != 4
+        goto unimplemented;
 #warning not supported
 #elif TARGET_LONG_SIZE == 4 && HOST_LONG_SIZE == 8
         {
-            struct target_dirent *target_dirp = (void *)arg2;
+            struct target_dirent *target_dirp;
             struct dirent *dirp;
             long count = arg3;
 
@@ -2625,6 +2927,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 
 		count1 = 0;
                 de = dirp;
+                target_dirp = lock_user(arg2, count, 0);
 		tde = target_dirp;
                 while (len > 0) {
                     reclen = de->d_reclen;
@@ -2644,13 +2947,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                 }
 		ret = count1;
             }
+            unlock_user(target_dirp, arg2, ret);
 	    free(dirp);
         }
 #else
         {
-            struct dirent *dirp = (void *)arg2;
+            struct dirent *dirp;
             long count = arg3;
 
+            dirp = lock_user(arg2, count, 0);
             ret = get_errno(sys_getdents(arg1, dirp, count));
             if (!is_error(ret)) {
                 struct dirent *de;
@@ -2668,14 +2973,16 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                     len -= reclen;
                 }
             }
+            unlock_user(dirp, arg2, ret);
         }
 #endif
         break;
 #ifdef TARGET_NR_getdents64
     case TARGET_NR_getdents64:
         {
-            struct dirent64 *dirp = (void *)arg2;
+            struct dirent64 *dirp;
             long count = arg3;
+            dirp = lock_user(arg2, count, 0);
             ret = get_errno(sys_getdents64(arg1, dirp, count));
             if (!is_error(ret)) {
                 struct dirent64 *de;
@@ -2693,21 +3000,22 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                     len -= reclen;
                 }
             }
+            unlock_user(dirp, arg2, ret);
         }
         break;
 #endif /* TARGET_NR_getdents64 */
     case TARGET_NR__newselect:
-        ret = do_select(arg1, (void *)arg2, (void *)arg3, (void *)arg4, 
-                        (void *)arg5);
+        ret = do_select(arg1, arg2, arg3, arg4, arg5);
         break;
     case TARGET_NR_poll:
         {
-            struct target_pollfd *target_pfd = (void *)arg1;
+            struct target_pollfd *target_pfd;
             unsigned int nfds = arg2;
             int timeout = arg3;
             struct pollfd *pfd;
             unsigned int i;
 
+            target_pfd = lock_user(arg1, sizeof(struct target_pollfd) * nfds, 1);
             pfd = alloca(sizeof(struct pollfd) * nfds);
             for(i = 0; i < nfds; i++) {
                 pfd[i].fd = tswap32(target_pfd[i].fd);
@@ -2718,7 +3026,10 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                 for(i = 0; i < nfds; i++) {
                     target_pfd[i].revents = tswap16(pfd[i].revents);
                 }
+                ret += nfds * (sizeof(struct target_pollfd)
+                               - sizeof(struct pollfd));
             }
+            unlock_user(target_pfd, arg1, ret);
         }
         break;
     case TARGET_NR_flock:
@@ -2729,31 +3040,23 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_readv:
         {
             int count = arg3;
-            int i;
             struct iovec *vec;
-            struct target_iovec *target_vec = (void *)arg2;
 
             vec = alloca(count * sizeof(struct iovec));
-            for(i = 0;i < count; i++) {
-                vec[i].iov_base = (void *)tswapl(target_vec[i].iov_base);
-                vec[i].iov_len = tswapl(target_vec[i].iov_len);
-            }
+            lock_iovec(vec, arg2, count, 0);
             ret = get_errno(readv(arg1, vec, count));
+            unlock_iovec(vec, arg2, count, 1);
         }
         break;
     case TARGET_NR_writev:
         {
             int count = arg3;
-            int i;
             struct iovec *vec;
-            struct target_iovec *target_vec = (void *)arg2;
 
             vec = alloca(count * sizeof(struct iovec));
-            for(i = 0;i < count; i++) {
-                vec[i].iov_base = (void *)tswapl(target_vec[i].iov_base);
-                vec[i].iov_len = tswapl(target_vec[i].iov_len);
-            }
+            lock_iovec(vec, arg2, count, 1);
             ret = get_errno(writev(arg1, vec, count));
+            unlock_iovec(vec, arg2, count, 0);
         }
         break;
     case TARGET_NR_getsid:
@@ -2768,27 +3071,34 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         return -ENOTDIR;
     case TARGET_NR_sched_setparam:
         {
-            struct sched_param *target_schp = (void *)arg2;
+            struct sched_param *target_schp;
             struct sched_param schp;
+
+            lock_user_struct(target_schp, arg2, 1);
             schp.sched_priority = tswap32(target_schp->sched_priority);
+            unlock_user_struct(target_schp, arg2, 0);
             ret = get_errno(sched_setparam(arg1, &schp));
         }
         break;
     case TARGET_NR_sched_getparam:
         {
-            struct sched_param *target_schp = (void *)arg2;
+            struct sched_param *target_schp;
             struct sched_param schp;
             ret = get_errno(sched_getparam(arg1, &schp));
             if (!is_error(ret)) {
+                lock_user_struct(target_schp, arg2, 0);
                 target_schp->sched_priority = tswap32(schp.sched_priority);
+                unlock_user_struct(target_schp, arg2, 1);
             }
         }
         break;
     case TARGET_NR_sched_setscheduler:
         {
-            struct sched_param *target_schp = (void *)arg3;
+            struct sched_param *target_schp;
             struct sched_param schp;
+            lock_user_struct(target_schp, arg3, 1);
             schp.sched_priority = tswap32(target_schp->sched_priority);
+            unlock_user_struct(target_schp, arg3, 0);
             ret = get_errno(sched_setscheduler(arg1, arg2, &schp));
         }
         break;
@@ -2806,26 +3116,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         break;
     case TARGET_NR_sched_rr_get_interval:
         {
-            struct target_timespec *target_ts = (void *)arg2;
             struct timespec ts;
             ret = get_errno(sched_rr_get_interval(arg1, &ts));
             if (!is_error(ret)) {
-                target_ts->tv_sec = tswapl(ts.tv_sec);
-                target_ts->tv_nsec = tswapl(ts.tv_nsec);
+                host_to_target_timespec(arg2, &ts);
             }
         }
         break;
     case TARGET_NR_nanosleep:
         {
-            struct target_timespec *target_req = (void *)arg1;
-            struct target_timespec *target_rem = (void *)arg2;
             struct timespec req, rem;
-            req.tv_sec = tswapl(target_req->tv_sec);
-            req.tv_nsec = tswapl(target_req->tv_nsec);
+            target_to_host_timespec(&req, arg1);
             ret = get_errno(nanosleep(&req, &rem));
-            if (is_error(ret) && target_rem) {
-                target_rem->tv_sec = tswapl(rem.tv_sec);
-                target_rem->tv_nsec = tswapl(rem.tv_nsec);
+            if (is_error(ret) && arg2) {
+                host_to_target_timespec(arg2, &rem);
             }
         }
         break;
@@ -2837,15 +3141,21 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         goto unimplemented;
 #ifdef TARGET_NR_pread
     case TARGET_NR_pread:
-        page_unprotect_range((void *)arg2, arg3);
-        ret = get_errno(pread(arg1, (void *)arg2, arg3, arg4));
+        page_unprotect_range(arg2, arg3);
+        p = lock_user(arg2, arg3, 0);
+        ret = get_errno(pread(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, ret);
         break;
     case TARGET_NR_pwrite:
-        ret = get_errno(pwrite(arg1, (void *)arg2, arg3, arg4));
+        p = lock_user(arg2, arg3, 1);
+        ret = get_errno(pwrite(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_getcwd:
-        ret = get_errno(sys_getcwd1((char *)arg1, arg2));
+        p = lock_user(arg1, arg2, 0);
+        ret = get_errno(sys_getcwd1(p, arg2));
+        unlock_user(p, arg1, ret);
         break;
     case TARGET_NR_capget:
         goto unimplemented;
@@ -2874,16 +3184,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 	struct rlimit rlim;
 	ret = get_errno(getrlimit(arg1, &rlim));
 	if (!is_error(ret)) {
-	    struct target_rlimit *target_rlim = (void *)arg2;
+	    struct target_rlimit *target_rlim;
+            lock_user_struct(target_rlim, arg2, 0);
 	    target_rlim->rlim_cur = tswapl(rlim.rlim_cur);
 	    target_rlim->rlim_max = tswapl(rlim.rlim_max);
+            unlock_user_struct(target_rlim, arg2, 1);
 	}
 	break;
     }
 #endif
 #ifdef TARGET_NR_truncate64
     case TARGET_NR_truncate64:
-	ret = target_truncate64(cpu_env, (const char *)arg1, arg2, arg3, arg4);
+        p = lock_user_string(arg1);
+	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
+        unlock_user(p, arg1, 0);
 	break;
 #endif
 #ifdef TARGET_NR_ftruncate64
@@ -2893,12 +3207,16 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 #endif
 #ifdef TARGET_NR_stat64
     case TARGET_NR_stat64:
-        ret = get_errno(stat(path((const char *)arg1), &st));
+        p = lock_user_string(arg1);
+        ret = get_errno(stat(path(p), &st));
+        unlock_user(p, arg1, 0);
         goto do_stat64;
 #endif
 #ifdef TARGET_NR_lstat64
     case TARGET_NR_lstat64:
-        ret = get_errno(lstat(path((const char *)arg1), &st));
+        p = lock_user_string(arg1);
+        ret = get_errno(lstat(path(p), &st));
+        unlock_user(p, arg1, 0);
         goto do_stat64;
 #endif
 #ifdef TARGET_NR_fstat64
@@ -2909,8 +3227,10 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
             if (!is_error(ret)) {
 #ifdef TARGET_ARM
                 if (((CPUARMState *)cpu_env)->eabi) {
-                    struct target_eabi_stat64 *target_st = (void *)arg2;
+                    struct target_eabi_stat64 *target_st;
+                    lock_user_struct(target_st, arg2, 1);
                     memset(target_st, 0, sizeof(struct target_eabi_stat64));
+                    /* put_user is probably wrong.  */
                     put_user(st.st_dev, &target_st->st_dev);
                     put_user(st.st_ino, &target_st->st_ino);
 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
@@ -2928,11 +3248,14 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                     put_user(st.st_atime, &target_st->target_st_atime);
                     put_user(st.st_mtime, &target_st->target_st_mtime);
                     put_user(st.st_ctime, &target_st->target_st_ctime);
+                    unlock_user_struct(target_st, arg2, 0);
                 } else
 #endif
                 {
-                    struct target_stat64 *target_st = (void *)arg2;
+                    struct target_stat64 *target_st;
+                    lock_user_struct(target_st, arg2, 1);
                     memset(target_st, 0, sizeof(struct target_stat64));
+                    /* ??? put_user is probably wrong.  */
                     put_user(st.st_dev, &target_st->st_dev);
                     put_user(st.st_ino, &target_st->st_ino);
 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
@@ -2950,6 +3273,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
                     put_user(st.st_atime, &target_st->target_st_atime);
                     put_user(st.st_mtime, &target_st->target_st_mtime);
                     put_user(st.st_ctime, &target_st->target_st_ctime);
+                    unlock_user_struct(target_st, arg2, 0);
                 }
             }
         }
@@ -2957,7 +3281,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 #endif
 #ifdef USE_UID16
     case TARGET_NR_lchown:
-        ret = get_errno(lchown((const char *)arg1, low2highuid(arg2), low2highgid(arg3)));
+        p = lock_user_string(arg1);
+        ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_getuid:
         ret = get_errno(high2lowuid(getuid()));
@@ -2980,28 +3306,32 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_getgroups:
         {
             int gidsetsize = arg1;
-            uint16_t *target_grouplist = (void *)arg2;
+            uint16_t *target_grouplist;
             gid_t *grouplist;
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
             ret = get_errno(getgroups(gidsetsize, grouplist));
             if (!is_error(ret)) {
+                target_grouplist = lock_user(arg2, gidsetsize * 2, 0);
                 for(i = 0;i < gidsetsize; i++)
                     target_grouplist[i] = tswap16(grouplist[i]);
+                unlock_user(target_grouplist, arg2, gidsetsize * 2);
             }
         }
         break;
     case TARGET_NR_setgroups:
         {
             int gidsetsize = arg1;
-            uint16_t *target_grouplist = (void *)arg2;
+            uint16_t *target_grouplist;
             gid_t *grouplist;
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
+            target_grouplist = lock_user(arg2, gidsetsize * 2, 1);
             for(i = 0;i < gidsetsize; i++)
                 grouplist[i] = tswap16(target_grouplist[i]);
+            unlock_user(target_grouplist, arg2, 0);
             ret = get_errno(setgroups(gidsetsize, grouplist));
         }
         break;
@@ -3018,12 +3348,12 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 #ifdef TARGET_NR_getresuid
     case TARGET_NR_getresuid:
         {
-            int ruid, euid, suid;
+            uid_t ruid, euid, suid;
             ret = get_errno(getresuid(&ruid, &euid, &suid));
             if (!is_error(ret)) {
-                *(uint16_t *)arg1 = tswap16(high2lowuid(ruid));
-                *(uint16_t *)arg2 = tswap16(high2lowuid(euid));
-                *(uint16_t *)arg3 = tswap16(high2lowuid(suid));
+                tput16(arg1, tswap16(high2lowuid(ruid)));
+                tput16(arg2, tswap16(high2lowuid(euid)));
+                tput16(arg3, tswap16(high2lowuid(suid)));
             }
         }
         break;
@@ -3038,18 +3368,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 #ifdef TARGET_NR_getresgid
     case TARGET_NR_getresgid:
         {
-            int rgid, egid, sgid;
+            gid_t rgid, egid, sgid;
             ret = get_errno(getresgid(&rgid, &egid, &sgid));
             if (!is_error(ret)) {
-                *(uint16_t *)arg1 = tswap16(high2lowgid(rgid));
-                *(uint16_t *)arg2 = tswap16(high2lowgid(egid));
-                *(uint16_t *)arg3 = tswap16(high2lowgid(sgid));
+                tput16(arg1, tswap16(high2lowgid(rgid)));
+                tput16(arg2, tswap16(high2lowgid(egid)));
+                tput16(arg3, tswap16(high2lowgid(sgid)));
             }
         }
         break;
 #endif
     case TARGET_NR_chown:
-        ret = get_errno(chown((const char *)arg1, low2highuid(arg2), low2highgid(arg3)));
+        p = lock_user_string(arg1);
+        ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
+        unlock_user(p, arg1, 0);
         break;
     case TARGET_NR_setuid:
         ret = get_errno(setuid(low2highuid(arg1)));
@@ -3067,7 +3399,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 
 #ifdef TARGET_NR_lchown32
     case TARGET_NR_lchown32:
-        ret = get_errno(lchown((const char *)arg1, arg2, arg3));
+        p = lock_user_string(arg1);
+        ret = get_errno(lchown(p, arg2, arg3));
+        unlock_user(p, arg1, 0);
         break;
 #endif
 #ifdef TARGET_NR_getuid32
@@ -3104,15 +3438,17 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_getgroups32:
         {
             int gidsetsize = arg1;
-            uint32_t *target_grouplist = (void *)arg2;
+            uint32_t *target_grouplist;
             gid_t *grouplist;
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
             ret = get_errno(getgroups(gidsetsize, grouplist));
             if (!is_error(ret)) {
+                target_grouplist = lock_user(arg2, gidsetsize * 4, 0);
                 for(i = 0;i < gidsetsize; i++)
-                    put_user(grouplist[i], &target_grouplist[i]);
+                    target_grouplist[i] = tswap32(grouplist[i]);
+                unlock_user(target_grouplist, arg2, gidsetsize * 4);
             }
         }
         break;
@@ -3121,13 +3457,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_setgroups32:
         {
             int gidsetsize = arg1;
-            uint32_t *target_grouplist = (void *)arg2;
+            uint32_t *target_grouplist;
             gid_t *grouplist;
             int i;
             
             grouplist = alloca(gidsetsize * sizeof(gid_t));
+            target_grouplist = lock_user(arg2, gidsetsize * 4, 1);
             for(i = 0;i < gidsetsize; i++)
-                get_user(grouplist[i], &target_grouplist[i]);
+                grouplist[i] = tswap32(target_grouplist[i]);
+            unlock_user(target_grouplist, arg2, 0);
             ret = get_errno(setgroups(gidsetsize, grouplist));
         }
         break;
@@ -3145,12 +3483,12 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 #ifdef TARGET_NR_getresuid32
     case TARGET_NR_getresuid32:
         {
-            int ruid, euid, suid;
+            uid_t ruid, euid, suid;
             ret = get_errno(getresuid(&ruid, &euid, &suid));
             if (!is_error(ret)) {
-                *(uint32_t *)arg1 = tswap32(ruid);
-                *(uint32_t *)arg2 = tswap32(euid);
-                *(uint32_t *)arg3 = tswap32(suid);
+                tput32(arg1, tswap32(ruid));
+                tput32(arg2, tswap32(euid));
+                tput32(arg3, tswap32(suid));
             }
         }
         break;
@@ -3163,19 +3501,21 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 #ifdef TARGET_NR_getresgid32
     case TARGET_NR_getresgid32:
         {
-            int rgid, egid, sgid;
+            gid_t rgid, egid, sgid;
             ret = get_errno(getresgid(&rgid, &egid, &sgid));
             if (!is_error(ret)) {
-                *(uint32_t *)arg1 = tswap32(rgid);
-                *(uint32_t *)arg2 = tswap32(egid);
-                *(uint32_t *)arg3 = tswap32(sgid);
+                tput32(arg1, tswap32(rgid));
+                tput32(arg2, tswap32(egid));
+                tput32(arg3, tswap32(sgid));
             }
         }
         break;
 #endif
 #ifdef TARGET_NR_chown32
     case TARGET_NR_chown32:
-        ret = get_errno(chown((const char *)arg1, arg2, arg3));
+        p = lock_user_string(arg1);
+        ret = get_errno(chown(p, arg2, arg3));
+        unlock_user(p, arg1, 0);
         break;
 #endif
 #ifdef TARGET_NR_setuid32
@@ -3213,9 +3553,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
     case TARGET_NR_fcntl64:
     {
 	struct flock64 fl;
-	struct target_flock64 *target_fl = (void *)arg3;
+	struct target_flock64 *target_fl;
 #ifdef TARGET_ARM
-	struct target_eabi_flock64 *target_efl = (void *)arg3;
+	struct target_eabi_flock64 *target_efl;
 #endif
 
         switch(arg2) {
@@ -3224,19 +3564,23 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
 	    if (ret == 0) {
 #ifdef TARGET_ARM
                 if (((CPUARMState *)cpu_env)->eabi) {
+                    lock_user_struct(target_efl, arg3, 0);
                     target_efl->l_type = tswap16(fl.l_type);
                     target_efl->l_whence = tswap16(fl.l_whence);
                     target_efl->l_start = tswap64(fl.l_start);
                     target_efl->l_len = tswap64(fl.l_len);
                     target_efl->l_pid = tswapl(fl.l_pid);
+                    unlock_user_struct(target_efl, arg3, 1);
                 } else
 #endif
                 {
+                    lock_user_struct(target_fl, arg3, 0);
                     target_fl->l_type = tswap16(fl.l_type);
                     target_fl->l_whence = tswap16(fl.l_whence);
                     target_fl->l_start = tswap64(fl.l_start);
                     target_fl->l_len = tswap64(fl.l_len);
                     target_fl->l_pid = tswapl(fl.l_pid);
+                    unlock_user_struct(target_fl, arg3, 1);
                 }
 	    }
 	    break;
@@ -3245,19 +3589,23 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3,
         case F_SETLKW64:
 #ifdef TARGET_ARM
             if (((CPUARMState *)cpu_env)->eabi) {
+                lock_user_struct(target_efl, arg3, 1);
                 fl.l_type = tswap16(target_efl->l_type);
                 fl.l_whence = tswap16(target_efl->l_whence);
                 fl.l_start = tswap64(target_efl->l_start);
                 fl.l_len = tswap64(target_efl->l_len);
                 fl.l_pid = tswapl(target_efl->l_pid);
+                unlock_user_struct(target_efl, arg3, 0);
             } else
 #endif
             {
+                lock_user_struct(target_fl, arg3, 1);
                 fl.l_type = tswap16(target_fl->l_type);
                 fl.l_whence = tswap16(target_fl->l_whence);
                 fl.l_start = tswap64(target_fl->l_start);
                 fl.l_len = tswap64(target_fl->l_len);
                 fl.l_pid = tswapl(target_fl->l_pid);
+                unlock_user_struct(target_fl, arg3, 0);
             }
             ret = get_errno(fcntl(arg1, arg2, &fl));
 	    break;
diff --git a/linux-user/syscall_types.h b/linux-user/syscall_types.h
index 4db47da0f75c9054814c7cb0ed35a2a74af38e3b..308da485738ce92d059d8d20b29a810434177f0e 100644
--- a/linux-user/syscall_types.h
+++ b/linux-user/syscall_types.h
@@ -68,6 +68,9 @@ STRUCT(dirent,
 STRUCT(kbentry,
        TYPE_CHAR, TYPE_CHAR, TYPE_SHORT)
 
+STRUCT(kbsentry,
+       TYPE_CHAR, MK_ARRAY(TYPE_CHAR, 512))
+
 STRUCT(audio_buf_info,
        TYPE_INT, TYPE_INT, TYPE_INT, TYPE_INT)
 
diff --git a/linux-user/vm86.c b/linux-user/vm86.c
index 360d52592d0666995e9822c5f1782c90ea403375..b28eea60d49d47dcd98368aa68859b592a3f7e0c 100644
--- a/linux-user/vm86.c
+++ b/linux-user/vm86.c
@@ -62,25 +62,28 @@ static inline unsigned int vm_getl(uint8_t *segptr, unsigned int reg16)
 void save_v86_state(CPUX86State *env)
 {
     TaskState *ts = env->opaque;
+    struct target_vm86plus_struct * target_v86;
 
+    lock_user_struct(target_v86, ts->target_v86, 0);
     /* put the VM86 registers in the userspace register structure */
-    ts->target_v86->regs.eax = tswap32(env->regs[R_EAX]);
-    ts->target_v86->regs.ebx = tswap32(env->regs[R_EBX]);
-    ts->target_v86->regs.ecx = tswap32(env->regs[R_ECX]);
-    ts->target_v86->regs.edx = tswap32(env->regs[R_EDX]);
-    ts->target_v86->regs.esi = tswap32(env->regs[R_ESI]);
-    ts->target_v86->regs.edi = tswap32(env->regs[R_EDI]);
-    ts->target_v86->regs.ebp = tswap32(env->regs[R_EBP]);
-    ts->target_v86->regs.esp = tswap32(env->regs[R_ESP]);
-    ts->target_v86->regs.eip = tswap32(env->eip);
-    ts->target_v86->regs.cs = tswap16(env->segs[R_CS].selector);
-    ts->target_v86->regs.ss = tswap16(env->segs[R_SS].selector);
-    ts->target_v86->regs.ds = tswap16(env->segs[R_DS].selector);
-    ts->target_v86->regs.es = tswap16(env->segs[R_ES].selector);
-    ts->target_v86->regs.fs = tswap16(env->segs[R_FS].selector);
-    ts->target_v86->regs.gs = tswap16(env->segs[R_GS].selector);
+    target_v86->regs.eax = tswap32(env->regs[R_EAX]);
+    target_v86->regs.ebx = tswap32(env->regs[R_EBX]);
+    target_v86->regs.ecx = tswap32(env->regs[R_ECX]);
+    target_v86->regs.edx = tswap32(env->regs[R_EDX]);
+    target_v86->regs.esi = tswap32(env->regs[R_ESI]);
+    target_v86->regs.edi = tswap32(env->regs[R_EDI]);
+    target_v86->regs.ebp = tswap32(env->regs[R_EBP]);
+    target_v86->regs.esp = tswap32(env->regs[R_ESP]);
+    target_v86->regs.eip = tswap32(env->eip);
+    target_v86->regs.cs = tswap16(env->segs[R_CS].selector);
+    target_v86->regs.ss = tswap16(env->segs[R_SS].selector);
+    target_v86->regs.ds = tswap16(env->segs[R_DS].selector);
+    target_v86->regs.es = tswap16(env->segs[R_ES].selector);
+    target_v86->regs.fs = tswap16(env->segs[R_FS].selector);
+    target_v86->regs.gs = tswap16(env->segs[R_GS].selector);
     set_flags(env->eflags, ts->v86flags, VIF_MASK | ts->v86mask);
-    ts->target_v86->regs.eflags = tswap32(env->eflags);
+    target_v86->regs.eflags = tswap32(env->eflags);
+    unlock_user_struct(target_v86, ts->target_v86, 1);
 #ifdef DEBUG_VM86
     fprintf(logfile, "save_v86_state: eflags=%08x cs:ip=%04x:%04x\n", 
             env->eflags, env->segs[R_CS].selector, env->eip);
@@ -378,10 +381,10 @@ void handle_vm86_fault(CPUX86State *env)
     }
 }
 
-int do_vm86(CPUX86State *env, long subfunction, 
-            struct target_vm86plus_struct * target_v86)
+int do_vm86(CPUX86State *env, long subfunction, target_ulong vm86_addr)
 {
     TaskState *ts = env->opaque;
+    struct target_vm86plus_struct * target_v86;
     int ret;
     
     switch (subfunction) {
@@ -402,7 +405,6 @@ int do_vm86(CPUX86State *env, long subfunction,
         goto out;
     }
 
-    ts->target_v86 = target_v86;
     /* save current CPU regs */
     ts->vm86_saved_regs.eax = 0; /* default vm86 syscall return code */
     ts->vm86_saved_regs.ebx = env->regs[R_EBX];
@@ -421,6 +423,8 @@ int do_vm86(CPUX86State *env, long subfunction,
     ts->vm86_saved_regs.fs = env->segs[R_FS].selector;
     ts->vm86_saved_regs.gs = env->segs[R_GS].selector;
 
+    ts->target_v86 = vm86_addr;
+    lock_user_struct(target_v86, vm86_addr, 1);
     /* build vm86 CPU state */
     ts->v86flags = tswap32(target_v86->regs.eflags);
     env->eflags = (env->eflags & ~SAFE_MASK) | 
@@ -465,6 +469,7 @@ int do_vm86(CPUX86State *env, long subfunction,
     ts->vm86plus.vm86plus.flags = tswapl(target_v86->vm86plus.flags);
     memcpy(&ts->vm86plus.vm86plus.vm86dbg_intxxtab, 
            target_v86->vm86plus.vm86dbg_intxxtab, 32);
+    unlock_user_struct(target_v86, vm86_addr, 0);
     
 #ifdef DEBUG_VM86
     fprintf(logfile, "do_vm86: cs:ip=%04x:%04x\n", 
diff --git a/target-arm/nwfpe/fpa11_cpdt.c b/target-arm/nwfpe/fpa11_cpdt.c
index 3319d88e167eefce43505b56ddc215e59d482ed7..914a86fbc07cdbbd4bbd13d20cf001bdd5884e02 100644
--- a/target-arm/nwfpe/fpa11_cpdt.c
+++ b/target-arm/nwfpe/fpa11_cpdt.c
@@ -31,48 +31,52 @@
 static inline
 void loadSingle(const unsigned int Fn,const unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    fpa11->fType[Fn] = typeSingle;
-   get_user(fpa11->fpreg[Fn].fSingle, pMem);
+   fpa11->fpreg[Fn].fSingle = tget32(addr);
 }
 
 static inline
 void loadDouble(const unsigned int Fn,const unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    unsigned int *p;
    p = (unsigned int*)&fpa11->fpreg[Fn].fDouble;
    fpa11->fType[Fn] = typeDouble;
 #ifdef WORDS_BIGENDIAN
-   get_user(p[0], &pMem[0]); /* sign & exponent */
-   get_user(p[1], &pMem[1]);
+   p[0] = tget32(addr); /* sign & exponent */
+   p[1] = tget32(addr + 4);
 #else
-   get_user(p[0], &pMem[1]);
-   get_user(p[1], &pMem[0]); /* sign & exponent */
+   p[0] = tget32(addr + 4);
+   p[1] = tget32(addr); /* sign & exponent */
 #endif
 }   
 
 static inline
 void loadExtended(const unsigned int Fn,const unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    unsigned int *p;
    p = (unsigned int*)&fpa11->fpreg[Fn].fExtended;
    fpa11->fType[Fn] = typeExtended;
-   get_user(p[0], &pMem[0]);  /* sign & exponent */
-   get_user(p[1], &pMem[2]);  /* ls bits */
-   get_user(p[2], &pMem[1]);  /* ms bits */
+   p[0] = tget32(addr);  /* sign & exponent */
+   p[1] = tget32(addr + 8);  /* ls bits */
+   p[2] = tget32(addr + 4);  /* ms bits */
 }   
 
 static inline
 void loadMultiple(const unsigned int Fn,const unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    register unsigned int *p;
    unsigned long x;
 
    p = (unsigned int*)&(fpa11->fpreg[Fn]);
-   get_user(x, &pMem[0]);
+   x = tget32(addr);
    fpa11->fType[Fn] = (x >> 14) & 0x00000003;
    
    switch (fpa11->fType[Fn])
@@ -80,16 +84,16 @@ void loadMultiple(const unsigned int Fn,const unsigned int *pMem)
       case typeSingle:
       case typeDouble:
       {
-         get_user(p[0], &pMem[2]);  /* Single */
-         get_user(p[1], &pMem[1]);  /* double msw */
+         p[0] = tget32(addr + 8);  /* Single */
+         p[1] = tget32(addr + 4);  /* double msw */
          p[2] = 0;        /* empty */
       }
       break; 
    
       case typeExtended:
       {
-         get_user(p[1], &pMem[2]);
-         get_user(p[2], &pMem[1]);  /* msw */
+         p[1] = tget32(addr + 8);
+         p[2] = tget32(addr + 4);  /* msw */
          p[0] = (x & 0x80003fff);      
       }
       break;
@@ -99,6 +103,7 @@ void loadMultiple(const unsigned int Fn,const unsigned int *pMem)
 static inline
 void storeSingle(const unsigned int Fn,unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    float32 val;
    register unsigned int *p = (unsigned int*)&val;
@@ -116,12 +121,13 @@ void storeSingle(const unsigned int Fn,unsigned int *pMem)
       default: val = fpa11->fpreg[Fn].fSingle;
    }
   
-   put_user(p[0], pMem);
+   tput32(addr, p[0]);
 }   
 
 static inline
 void storeDouble(const unsigned int Fn,unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    float64 val;
    register unsigned int *p = (unsigned int*)&val;
@@ -139,17 +145,18 @@ void storeDouble(const unsigned int Fn,unsigned int *pMem)
       default: val = fpa11->fpreg[Fn].fDouble;
    }
 #ifdef WORDS_BIGENDIAN
-   put_user(p[0], &pMem[0]);	/* msw */
-   put_user(p[1], &pMem[1]);	/* lsw */
+   tput32(addr, p[0]);	/* msw */
+   tput32(addr + 4, p[1]);	/* lsw */
 #else
-   put_user(p[1], &pMem[0]);	/* msw */
-   put_user(p[0], &pMem[1]);	/* lsw */
+   tput32(addr, p[1]);	/* msw */
+   tput32(addr + 4, p[0]);	/* lsw */
 #endif
 }   
 
 static inline
 void storeExtended(const unsigned int Fn,unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    floatx80 val;
    register unsigned int *p = (unsigned int*)&val;
@@ -167,14 +174,15 @@ void storeExtended(const unsigned int Fn,unsigned int *pMem)
       default: val = fpa11->fpreg[Fn].fExtended;
    }
    
-   put_user(p[0], &pMem[0]); /* sign & exp */
-   put_user(p[1], &pMem[2]);
-   put_user(p[2], &pMem[1]); /* msw */
+   tput32(addr, p[0]); /* sign & exp */
+   tput32(addr + 8, p[1]);
+   tput32(addr + 4, p[2]); /* msw */
 }   
 
 static inline
 void storeMultiple(const unsigned int Fn,unsigned int *pMem)
 {
+   target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    register unsigned int nType, *p;
    
@@ -186,17 +194,17 @@ void storeMultiple(const unsigned int Fn,unsigned int *pMem)
       case typeSingle:
       case typeDouble:
       {
-	 put_user(p[0], &pMem[2]); /* single */
-	 put_user(p[1], &pMem[1]); /* double msw */
-	 put_user(nType << 14, &pMem[0]);
+	 tput32(addr + 8, p[0]); /* single */
+	 tput32(addr + 4, p[1]); /* double msw */
+	 tput32(addr, nType << 14);
       }
       break; 
    
       case typeExtended:
       {
-	 put_user(p[2], &pMem[1]); /* msw */
-	 put_user(p[1], &pMem[2]);
-	 put_user((p[0] & 0x80003fff) | (nType << 14), &pMem[0]);
+	 tput32(addr + 4, p[2]); /* msw */
+	 tput32(addr + 8, p[1]);
+	 tput32(addr, (p[0] & 0x80003fff) | (nType << 14));
       }
       break;
    }