diff --git a/adb/adb.h b/adb/adb.h
index a17c8ddc5..aebb81a76 100644
--- a/adb/adb.h
+++ b/adb/adb.h
@@ -359,17 +359,10 @@ typedef enum {
 
 // Google's USB Vendor ID
 #define VENDOR_ID_GOOGLE        0x18d1
+
 // HTC's USB Vendor ID
 #define VENDOR_ID_HTC           0x0bb4
 
-// products for VENDOR_ID_GOOGLE
-#define PRODUCT_ID_SOONER       0xd00d  // Sooner bootloader
-#define PRODUCT_ID_SOONER_COMP  0xdeed  // Sooner composite device
-
-// products for VENDOR_ID_HTC
-#define PRODUCT_ID_DREAM        0x0c01  // Dream bootloader
-#define PRODUCT_ID_DREAM_COMP   0x0c02  // Dream composite device
-
 void local_init();
 int  local_connect(int  port);
 
diff --git a/adb/usb_osx.c b/adb/usb_osx.c
index 49e1eef5b..2d4c1a95b 100644
--- a/adb/usb_osx.c
+++ b/adb/usb_osx.c
@@ -31,21 +31,17 @@
 
 #define  DBG   D
 
-typedef struct {
-    int vid;
-    int pid;
-} VendorProduct;
+#define ADB_SUBCLASS           0x42
+#define ADB_PROTOCOL           0x1
 
-#define kSupportedDeviceCount   4
-VendorProduct kSupportedDevices[kSupportedDeviceCount] = {
-    { VENDOR_ID_GOOGLE, PRODUCT_ID_SOONER },
-    { VENDOR_ID_GOOGLE, PRODUCT_ID_SOONER_COMP },
-    { VENDOR_ID_HTC, PRODUCT_ID_DREAM },
-    { VENDOR_ID_HTC, PRODUCT_ID_DREAM_COMP },
+int vendorIds[] = {
+    VENDOR_ID_GOOGLE,
+    VENDOR_ID_HTC,
 };
+#define NUM_VENDORS             (sizeof(vendorIds)/sizeof(vendorIds[0]))
 
 static IONotificationPortRef    notificationPort = 0;
-static io_iterator_t            notificationIterators[kSupportedDeviceCount];
+static io_iterator_t            notificationIterators[NUM_VENDORS];
 
 struct usb_handle
 {
@@ -61,17 +57,20 @@ static pthread_mutex_t start_lock;
 static pthread_cond_t start_cond;
 
 
-static void AndroidDeviceAdded(void *refCon, io_iterator_t iterator);
-static void AndroidDeviceNotify(void *refCon, io_iterator_t iterator, natural_t messageType, void *messageArgument);
-static usb_handle* FindDeviceInterface(IOUSBDeviceInterface **dev, UInt16 vendor, UInt16 product);
+static void AndroidInterfaceAdded(void *refCon, io_iterator_t iterator);
+static void AndroidInterfaceNotify(void *refCon, io_iterator_t iterator,
+                                   natural_t messageType,
+                                   void *messageArgument);
+static usb_handle* CheckInterface(IOUSBInterfaceInterface **iface,
+                                  UInt16 vendor, UInt16 product);
 
 static int
 InitUSB()
 {
     CFMutableDictionaryRef  matchingDict;
     CFRunLoopSourceRef      runLoopSource;
-    SInt32					vendor, product;
-    int                     i;
+    SInt32                  vendor, if_subclass, if_protocol;
+    unsigned                i;
 
     //* To set up asynchronous notifications, create a notification port and
     //* add its run loop event source to the program's run loop
@@ -81,51 +80,57 @@ InitUSB()
 
     memset(notificationIterators, 0, sizeof(notificationIterators));
 
-    //* loop through all supported vendor/product pairs
-    for (i = 0; i < kSupportedDeviceCount; i++) {
-        //* Create our matching dictionary to find the Android device
-        //* IOServiceAddMatchingNotification consumes the reference, so we do not need to release this
-        matchingDict = IOServiceMatching(kIOUSBDeviceClassName);
+    //* loop through all supported vendors
+    for (i = 0; i < NUM_VENDORS; i++) {
+        //* Create our matching dictionary to find the Android device's
+        //* adb interface
+        //* IOServiceAddMatchingNotification consumes the reference, so we do
+        //* not need to release this
+        matchingDict = IOServiceMatching(kIOUSBInterfaceClassName);
 
         if (!matchingDict) {
             DBG("ERR: Couldn't create USB matching dictionary.\n");
             return -1;
         }
 
-        //* Set up two matching dictionaries, one for each product ID we support.
-        //* This will cause the kernel to notify us only if the vendor and product IDs match.
-        vendor = kSupportedDevices[i].vid;
-        product = kSupportedDevices[i].pid;
-        CFDictionarySetValue(matchingDict, CFSTR(kUSBVendorID), CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &vendor));
-        CFDictionarySetValue(matchingDict, CFSTR(kUSBProductID), CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &product));
-
-        //* Now set up two notifications: one to be called when a raw device
-        //* is first matched by the I/O Kit and another to be called when the
-        //* device is terminated.
-        //* we need to do this with each matching dictionary.
+        //* Match based on vendor id, interface subclass and protocol
+        vendor = vendorIds[i];
+        if_subclass = ADB_SUBCLASS;
+        if_protocol = ADB_PROTOCOL;
+        CFDictionarySetValue(matchingDict, CFSTR(kUSBVendorID),
+                             CFNumberCreate(kCFAllocatorDefault,
+                                            kCFNumberSInt32Type, &vendor));
+        CFDictionarySetValue(matchingDict, CFSTR(kUSBInterfaceSubClass),
+                             CFNumberCreate(kCFAllocatorDefault,
+                                            kCFNumberSInt32Type, &if_subclass));
+        CFDictionarySetValue(matchingDict, CFSTR(kUSBInterfaceProtocol),
+                             CFNumberCreate(kCFAllocatorDefault,
+                                            kCFNumberSInt32Type, &if_protocol));
         IOServiceAddMatchingNotification(
                 notificationPort,
                 kIOFirstMatchNotification,
                 matchingDict,
-                AndroidDeviceAdded,
+                AndroidInterfaceAdded,
                 NULL,
                 &notificationIterators[i]);
 
-        //* Iterate over set of matching devices to access already-present devices
-        //* and to arm the notification
-        AndroidDeviceAdded(NULL, notificationIterators[i]);
+        //* Iterate over set of matching interfaces to access already-present
+        //* devices and to arm the notification
+        AndroidInterfaceAdded(NULL, notificationIterators[i]);
     }
 
     return 0;
 }
 
 static void
-AndroidDeviceAdded(void *refCon, io_iterator_t iterator)
+AndroidInterfaceAdded(void *refCon, io_iterator_t iterator)
 {
     kern_return_t            kr;
     io_service_t             usbDevice;
+    io_service_t             usbInterface;
     IOCFPlugInInterface      **plugInInterface = NULL;
-    IOUSBDeviceInterface182  **dev = NULL;
+    IOUSBInterfaceInterface220  **iface = NULL;
+    IOUSBDeviceInterface197  **dev = NULL;
     HRESULT                  result;
     SInt32                   score;
     UInt16                   vendor;
@@ -133,28 +138,66 @@ AndroidDeviceAdded(void *refCon, io_iterator_t iterator)
     UInt8                    serialIndex;
     char                     serial[256];
 
-    while ((usbDevice = IOIteratorNext(iterator))) {
-        //* Create an intermediate plugin
+    while ((usbInterface = IOIteratorNext(iterator))) {
+        //* Create an intermediate interface plugin
+        kr = IOCreatePlugInInterfaceForService(usbInterface,
+                                               kIOUSBInterfaceUserClientTypeID,
+                                               kIOCFPlugInInterfaceID,
+                                               &plugInInterface, &score);
+        IOObjectRelease(usbInterface);
+        if ((kIOReturnSuccess != kr) || (!plugInInterface)) {
+            DBG("ERR: Unable to create an interface plug-in (%08x)\n", kr);
+            continue;
+        }
+
+        //* This gets us the interface object
+        result = (*plugInInterface)->QueryInterface(plugInInterface,
+                CFUUIDGetUUIDBytes(kIOUSBInterfaceInterfaceID), (LPVOID)
+                &iface);
+        //* We only needed the plugin to get the interface, so discard it
+        (*plugInInterface)->Release(plugInInterface);
+        if (result || !iface) {
+            DBG("ERR: Couldn't query the interface (%08x)\n", (int) result);
+            continue;
+        }
+
+        //* this gets us an ioservice, with which we will find the actual
+        //* device; after getting a plugin, and querying the interface, of
+        //* course.
+        //* Gotta love OS X
+        kr = (*iface)->GetDevice(iface, &usbDevice);
+        if (kIOReturnSuccess != kr || !usbDevice) {
+            DBG("ERR: Couldn't grab device from interface (%08x)\n", kr);
+            continue;
+        }
+
+        plugInInterface = NULL;
+        score = 0;
+        //* create an intermediate device plugin
         kr = IOCreatePlugInInterfaceForService(usbDevice,
                                                kIOUSBDeviceUserClientTypeID,
                                                kIOCFPlugInInterfaceID,
                                                &plugInInterface, &score);
-
+        //* only needed this to find the plugin
+        (void)IOObjectRelease(usbDevice);
         if ((kIOReturnSuccess != kr) || (!plugInInterface)) {
-            DBG("ERR: Unable to create a plug-in (%08x)\n", kr);
-            goto continue1;
+            DBG("ERR: Unable to create a device plug-in (%08x)\n", kr);
+            continue;
         }
 
-        //* Now create the device interface
         result = (*plugInInterface)->QueryInterface(plugInInterface,
                 CFUUIDGetUUIDBytes(kIOUSBDeviceInterfaceID), (LPVOID) &dev);
-
+        //* only needed this to query the plugin
+        (*plugInInterface)->Release(plugInInterface);
         if (result || !dev) {
-            DBG("ERR: Couldn't create a device interface (%08x)\n", (int) result);
-            goto continue2;
+            DBG("ERR: Couldn't create a device interface (%08x)\n",
+                (int) result);
+            continue;
         }
 
-        //* Check the device to see if it's ours
+        //* Now after all that, we actually have a ref to the device and
+        //* the interface that matched our criteria
+
         kr = (*dev)->GetDeviceVendor(dev, &vendor);
         kr = (*dev)->GetDeviceProduct(dev, &product);
         kr = (*dev)->USBGetSerialNumberStringIndex(dev, &serialIndex);
@@ -163,7 +206,8 @@ AndroidDeviceAdded(void *refCon, io_iterator_t iterator)
             IOUSBDevRequest req;
             UInt16          buffer[256];
 
-            req.bmRequestType = USBmakebmRequestType(kUSBIn, kUSBStandard, kUSBDevice);
+            req.bmRequestType =
+                USBmakebmRequestType(kUSBIn, kUSBStandard, kUSBDevice);
             req.bRequest = kUSBRqGetDescriptor;
             req.wValue = (kUSBStringDesc << 8) | serialIndex;
             req.wIndex = 0;
@@ -174,219 +218,149 @@ AndroidDeviceAdded(void *refCon, io_iterator_t iterator)
             if (kr == kIOReturnSuccess && req.wLenDone > 0) {
                 int i, count;
 
-                // skip first word, and copy the rest to the serial string, changing shorts to bytes.
+                // skip first word, and copy the rest to the serial string,
+                // changing shorts to bytes.
                 count = (req.wLenDone - 1) / 2;
                 for (i = 0; i < count; i++)
                   serial[i] = buffer[i + 1];
                 serial[i] = 0;
             }
         }
+        (*dev)->Release(dev);
 
-        usb_handle* handle = NULL;
-
-        //* Open the device
-        kr = (*dev)->USBDeviceOpen(dev);
-
-        if (kr != kIOReturnSuccess) {
-            DBG("ERR: Could not open device: %08x\n", kr);
-            goto continue3;
-        } else {
-            //* Find an interface for the device
-            handle = FindDeviceInterface((IOUSBDeviceInterface**)dev, vendor, product);
-        }
+        DBG("INFO: Found vid=%04x pid=%04x serial=%s\n", vendor, product,
+            serial);
 
+        usb_handle* handle = CheckInterface((IOUSBInterfaceInterface**)iface,
+                                            vendor, product);
         if (handle == NULL) {
             DBG("ERR: Could not find device interface: %08x\n", kr);
-            (*dev)->USBDeviceClose(dev);
-            goto continue3;
+            (*iface)->Release(iface);
+            continue;
         }
 
         DBG("AndroidDeviceAdded calling register_usb_transport\n");
         register_usb_transport(handle, (serial[0] ? serial : NULL));
 
-        // Register for an interest notification of this device being removed. Pass the reference to our
-        // private data as the refCon for the notification.
+        // Register for an interest notification of this device being removed.
+        // Pass the reference to our private data as the refCon for the
+        // notification.
         kr = IOServiceAddInterestNotification(notificationPort,
-                usbDevice,
+                usbInterface,
                 kIOGeneralInterest,
-                AndroidDeviceNotify,
+                AndroidInterfaceNotify,
                 handle,
                 &handle->usbNotification);
+
         if (kIOReturnSuccess != kr) {
             DBG("ERR: Unable to create interest notification (%08x)\n", kr);
         }
-
-continue3:
-        (void)(*dev)->Release(dev);
-continue2:
-        IODestroyPlugInInterface(plugInInterface);
-continue1:
-        IOObjectRelease(usbDevice);
     }
 }
 
 static void
-AndroidDeviceNotify(void *refCon, io_service_t service, natural_t messageType, void *messageArgument)
+AndroidInterfaceNotify(void *refCon, io_service_t service, natural_t messageType, void *messageArgument)
 {
     usb_handle *handle = (usb_handle *)refCon;
 
     if (messageType == kIOMessageServiceIsTerminated) {
-        DBG("AndroidDeviceNotify\n");
+        if (!handle) {
+            DBG("ERR: NULL handle\n");
+            return;
+        }
+        DBG("AndroidInterfaceNotify\n");
         IOObjectRelease(handle->usbNotification);
         usb_kick(handle);
     }
 }
 
+//* TODO: simplify this further since we only register to get ADB interface
+//* subclass+protocol events
 static usb_handle*
-FindDeviceInterface(IOUSBDeviceInterface **dev, UInt16 vendor, UInt16 product)
+CheckInterface(IOUSBInterfaceInterface **interface, UInt16 vendor, UInt16 product)
 {
     usb_handle*                 handle = NULL;
     IOReturn                    kr;
-    IOUSBFindInterfaceRequest   request;
-    io_iterator_t               iterator;
-    io_service_t                usbInterface;
-    IOCFPlugInInterface         **plugInInterface;
-    IOUSBInterfaceInterface     **interface = NULL;
-    HRESULT                     result;
-    SInt32                      score;
     UInt8  interfaceNumEndpoints, interfaceClass, interfaceSubClass, interfaceProtocol;
-    UInt8  endpoint, configuration;
+    UInt8  endpoint;
 
-    //* Placing the constant KIOUSBFindInterfaceDontCare into the following
-    //* fields of the IOUSBFindInterfaceRequest structure will allow us to
-    //* find all of the interfaces
-    request.bInterfaceClass = kIOUSBFindInterfaceDontCare;
-    request.bInterfaceSubClass = kIOUSBFindInterfaceDontCare;
-    request.bInterfaceProtocol = kIOUSBFindInterfaceDontCare;
-    request.bAlternateSetting = kIOUSBFindInterfaceDontCare;
-
-    //* SetConfiguration will kill an existing UMS connection, so let's not do this if not necessary.
-    configuration = 0;
-    (*dev)->GetConfiguration(dev, &configuration);
-    if (configuration != 1)
-        (*dev)->SetConfiguration(dev, 1);
-
-    //* Get an iterator for the interfaces on the device
-    kr = (*dev)->CreateInterfaceIterator(dev, &request, &iterator);
 
+    //* Now open the interface.  This will cause the pipes associated with
+    //* the endpoints in the interface descriptor to be instantiated
+    kr = (*interface)->USBInterfaceOpen(interface);
     if (kr != kIOReturnSuccess) {
-        DBG("ERR: Couldn't create a device interface iterator: (%08x)\n", kr);
+        DBG("ERR: Could not open interface: (%08x)\n", kr);
         return NULL;
     }
 
-    while ((usbInterface = IOIteratorNext(iterator))) {
-    //* Create an intermediate plugin
-        kr = IOCreatePlugInInterfaceForService(
-                usbInterface,
-                kIOUSBInterfaceUserClientTypeID,
-                kIOCFPlugInInterfaceID,
-                &plugInInterface,
-                &score);
-
-        //* No longer need the usbInterface object now that we have the plugin
-        (void) IOObjectRelease(usbInterface);
-
-        if ((kr != kIOReturnSuccess) || (!plugInInterface)) {
-            DBG("ERR: Unable to create plugin (%08x)\n", kr);
-            break;
-        }
-
-        //* Now create the interface interface for the interface
-        result = (*plugInInterface)->QueryInterface(
-                plugInInterface,
-                CFUUIDGetUUIDBytes(kIOUSBInterfaceInterfaceID),
-                (LPVOID) &interface);
-
-        //* No longer need the intermediate plugin
-        (*plugInInterface)->Release(plugInInterface);
-
-        if (result || !interface) {
-            DBG("ERR: Couldn't create interface interface: (%08x)\n",
-               (unsigned int) result);
-            break;
-        }
-
-        //* Now open the interface.  This will cause the pipes associated with
-        //* the endpoints in the interface descriptor to be instantiated
-        kr = (*interface)->USBInterfaceOpen(interface);
-
-        if (kr != kIOReturnSuccess)
-        {
-            DBG("ERR: Could not open interface: (%08x)\n", kr);
-            (void) (*interface)->Release(interface);
-            //* continue so we can try the next interface
-            continue;
-        }
-
-        //* Get the number of endpoints associated with this interface
-        kr = (*interface)->GetNumEndpoints(interface, &interfaceNumEndpoints);
-
-        if (kr != kIOReturnSuccess) {
-            DBG("ERR: Unable to get number of endpoints: (%08x)\n", kr);
-            goto next_interface;
-        }
-
-        //* Get interface class, subclass and protocol
-        if ((*interface)->GetInterfaceClass(interface, &interfaceClass) != kIOReturnSuccess ||
-            (*interface)->GetInterfaceSubClass(interface, &interfaceSubClass) != kIOReturnSuccess ||
-            (*interface)->GetInterfaceProtocol(interface, &interfaceProtocol) != kIOReturnSuccess)
-        {
-            DBG("ERR: Unable to get interface class, subclass and protocol\n");
-            goto next_interface;
-        }
-
-        //* check to make sure interface class, subclass and protocol match ADB
-        //* avoid opening mass storage endpoints
-        if (is_adb_interface(vendor, product, interfaceClass, interfaceSubClass, interfaceProtocol)) {
-            handle = calloc(1, sizeof(usb_handle));
-
-            //* Iterate over the endpoints for this interface and find the first
-            //* bulk in/out pipes available.  These will be our read/write pipes.
-            for (endpoint = 0; endpoint <= interfaceNumEndpoints; endpoint++) {
-                UInt8   transferType;
-                UInt16  maxPacketSize;
-                UInt8   interval;
-                UInt8   number;
-                UInt8   direction;
-
-                kr = (*interface)->GetPipeProperties(interface, endpoint, &direction,
-                        &number, &transferType, &maxPacketSize, &interval);
-
-                if (kIOReturnSuccess == kr) {
-                    if (kUSBBulk != transferType)
-                        continue;
-
-                    if (kUSBIn == direction)
-                        handle->bulkIn = endpoint;
-
-                    if (kUSBOut == direction)
-                        handle->bulkOut = endpoint;
-
-                    if (interfaceProtocol == 0x01) {
-                        handle->zero_mask = maxPacketSize - 1;
-                    }
-
-                } else {
-                    DBG("ERR: FindDeviceInterface - could not get pipe properties\n");
-                }
-            }
-
-            handle->interface = interface;
-            break;
-        }
-
-next_interface:
-        (*interface)->USBInterfaceClose(interface);
-        (*interface)->Release(interface);
+    //* Get the number of endpoints associated with this interface
+    kr = (*interface)->GetNumEndpoints(interface, &interfaceNumEndpoints);
+    if (kr != kIOReturnSuccess) {
+        DBG("ERR: Unable to get number of endpoints: (%08x)\n", kr);
+        goto err_get_num_ep;
     }
 
+    //* Get interface class, subclass and protocol
+    if ((*interface)->GetInterfaceClass(interface, &interfaceClass) != kIOReturnSuccess ||
+            (*interface)->GetInterfaceSubClass(interface, &interfaceSubClass) != kIOReturnSuccess ||
+            (*interface)->GetInterfaceProtocol(interface, &interfaceProtocol) != kIOReturnSuccess) {
+            DBG("ERR: Unable to get interface class, subclass and protocol\n");
+            goto err_get_interface_class;
+    }
+
+    //* check to make sure interface class, subclass and protocol match ADB
+    //* avoid opening mass storage endpoints
+    if (!is_adb_interface(vendor, product, interfaceClass,
+                interfaceSubClass, interfaceProtocol))
+        goto err_bad_adb_interface;
+
+    handle = calloc(1, sizeof(usb_handle));
+
+    //* Iterate over the endpoints for this interface and find the first
+    //* bulk in/out pipes available.  These will be our read/write pipes.
+    for (endpoint = 0; endpoint <= interfaceNumEndpoints; endpoint++) {
+        UInt8   transferType;
+        UInt16  maxPacketSize;
+        UInt8   interval;
+        UInt8   number;
+        UInt8   direction;
+
+        kr = (*interface)->GetPipeProperties(interface, endpoint, &direction,
+                &number, &transferType, &maxPacketSize, &interval);
+
+        if (kIOReturnSuccess == kr) {
+            if (kUSBBulk != transferType)
+                continue;
+
+            if (kUSBIn == direction)
+                handle->bulkIn = endpoint;
+
+            if (kUSBOut == direction)
+                handle->bulkOut = endpoint;
+
+            handle->zero_mask = maxPacketSize - 1;
+        } else {
+            DBG("ERR: FindDeviceInterface - could not get pipe properties\n");
+            goto err_get_pipe_props;
+        }
+    }
+
+    handle->interface = interface;
     return handle;
+
+err_get_pipe_props:
+    free(handle);
+err_bad_adb_interface:
+err_get_interface_class:
+err_get_num_ep:
+    (*interface)->USBInterfaceClose(interface);
+    return NULL;
 }
 
 
 void* RunLoopThread(void* unused)
 {
-    int i;
+    unsigned i;
 
     InitUSB();
 
@@ -400,7 +374,7 @@ void* RunLoopThread(void* unused)
     CFRunLoopRun();
     currentRunLoop = 0;
 
-    for (i = 0; i < kSupportedDeviceCount; i++) {
+    for (i = 0; i < NUM_VENDORS; i++) {
         IOObjectRelease(notificationIterators[i]);
     }
     IONotificationPortDestroy(notificationPort);
@@ -527,6 +501,9 @@ int usb_close(usb_handle *handle)
 void usb_kick(usb_handle *handle)
 {
     /* release the interface */
+    if (!handle)
+        return;
+
     if (handle->interface)
     {
         (*handle->interface)->USBInterfaceClose(handle->interface);
diff --git a/include/sysutils/FrameworkClient.h b/include/sysutils/FrameworkClient.h
new file mode 100644
index 000000000..1eb112a5e
--- /dev/null
+++ b/include/sysutils/FrameworkClient.h
@@ -0,0 +1,21 @@
+#ifndef _FRAMEWORK_CLIENT_H
+#define _FRAMEWORK_CLIENT_H
+
+#include "../../../frameworks/base/include/utils/List.h"
+
+#include <pthread.h>
+
+class FrameworkClient {
+    int             mSocket;
+    pthread_mutex_t mWriteMutex;
+
+public:
+    FrameworkClient(int sock);
+    virtual ~FrameworkClient() {}
+
+    int sendMsg(char *msg);
+    int sendMsg(char *msg, char *data);
+};
+
+typedef android::List<FrameworkClient *> FrameworkClientCollection;
+#endif
diff --git a/include/sysutils/FrameworkCommand.h b/include/sysutils/FrameworkCommand.h
index 952e99a97..5b50247b5 100644
--- a/include/sysutils/FrameworkCommand.h
+++ b/include/sysutils/FrameworkCommand.h
@@ -18,6 +18,7 @@
 
 #include "../../../frameworks/base/include/utils/List.h"
 
+class SocketClient;
 
 class FrameworkCommand { 
 private:
@@ -28,7 +29,7 @@ public:
     FrameworkCommand(const char *cmd);
     virtual ~FrameworkCommand() { }
 
-    virtual int runCommand(char *data);
+    virtual int runCommand(SocketClient *c, char *data) = 0;
 
     const char *getCommand() { return mCommand; }
 };
diff --git a/include/sysutils/FrameworkListener.h b/include/sysutils/FrameworkListener.h
index 1454a6fa3..8a83c3346 100644
--- a/include/sysutils/FrameworkListener.h
+++ b/include/sysutils/FrameworkListener.h
@@ -19,6 +19,8 @@
 #include "SocketListener.h"
 #include "FrameworkCommand.h"
 
+class SocketClient;
+
 class FrameworkListener : public SocketListener {
 private:
     FrameworkCommandCollection *mCommands;
@@ -29,9 +31,9 @@ public:
 
 protected:
     void registerCmd(FrameworkCommand *cmd);
-    virtual bool onDataAvailable(int socket);
+    virtual bool onDataAvailable(SocketClient *c);
 
 private:
-    void dispatchCommand(char *cmd);
+    void dispatchCommand(SocketClient *c, char *cmd);
 };
 #endif
diff --git a/include/sysutils/NetlinkListener.h b/include/sysutils/NetlinkListener.h
index 8ac811c71..6dcc005ca 100644
--- a/include/sysutils/NetlinkListener.h
+++ b/include/sysutils/NetlinkListener.h
@@ -27,6 +27,6 @@ public:
     NetlinkListener(int socket);
     virtual ~NetlinkListener() {}
 protected:
-    virtual bool onDataAvailable(int socket);
+    virtual bool onDataAvailable(SocketClient *cli);
 };
 #endif
diff --git a/include/sysutils/SocketClient.h b/include/sysutils/SocketClient.h
new file mode 100644
index 000000000..cde64a542
--- /dev/null
+++ b/include/sysutils/SocketClient.h
@@ -0,0 +1,23 @@
+#ifndef _SOCKET_CLIENT_H
+#define _SOCKET_CLIENT_H
+
+#include "../../../frameworks/base/include/utils/List.h"
+
+#include <pthread.h>
+
+class SocketClient {
+    int             mSocket;
+    pthread_mutex_t mWriteMutex;
+
+public:
+    SocketClient(int sock);
+    virtual ~SocketClient() {}
+
+    int getSocket() { return mSocket; }
+
+    int sendMsg(int code, char *msg, bool addErrno);
+    int sendMsg(char *msg);
+};
+
+typedef android::List<SocketClient *> SocketClientCollection;
+#endif
diff --git a/include/sysutils/SocketListener.h b/include/sysutils/SocketListener.h
index f079dba19..30d050d47 100644
--- a/include/sysutils/SocketListener.h
+++ b/include/sysutils/SocketListener.h
@@ -16,20 +16,35 @@
 #ifndef _SOCKETLISTENER_H
 #define _SOCKETLISTENER_H
 
+#include <pthread.h>
+
+#include <sysutils/SocketClient.h>
+
 class SocketListener {
-    int mSock;
-    int mCsock;
-    int mAcceptClients;
-    const char *mSocketName;
+    int                     mSock;
+    const char              *mSocketName;
+    SocketClientCollection  *mClients;
+    pthread_mutex_t         mClientsLock;
+    bool                    mListen;
+    int                     mCtrlPipe[2];
+    pthread_t               mThread;
 
 public:
-    SocketListener(const char *socketName, bool acceptClients);
-    SocketListener(int socketFd, bool acceptClients);
+    SocketListener(const char *socketNames, bool listen);
+    SocketListener(int socketFd, bool listen);
 
     virtual ~SocketListener() {}
-    virtual int run();
+    int startListener();
+    int stopListener();
+
+    void sendBroadcast(int code, char *msg, bool addErrno);
+    void sendBroadcast(char *msg);
 
 protected:
-    virtual bool onDataAvailable(int socket);
+    virtual bool onDataAvailable(SocketClient *c) = 0;
+
+private:
+    static void *threadStart(void *obj);
+    void runListener();
 };
 #endif
diff --git a/init/devices.c b/init/devices.c
index c38b063c3..8aea7725f 100644
--- a/init/devices.c
+++ b/init/devices.c
@@ -131,6 +131,9 @@ static struct perms_ devperms[] = {
     { "/dev/qmi0",          0640,   AID_RADIO,      AID_RADIO,      0 },
     { "/dev/qmi1",          0640,   AID_RADIO,      AID_RADIO,      0 },
     { "/dev/qmi2",          0640,   AID_RADIO,      AID_RADIO,      0 },
+
+        /* CDMA radio interface MUX */
+    { "/dev/ts0710mux",     0640,   AID_RADIO,      AID_RADIO,      1 },
     { NULL, 0, 0, 0, 0 },
 };
 
diff --git a/init/init.h b/init/init.h
index c9363daf4..b93eb50af 100644
--- a/init/init.h
+++ b/init/init.h
@@ -137,15 +137,17 @@ struct service {
     struct socketinfo *sockets;
     struct svcenvinfo *envvars;
 
-    int nargs;
-    char *args[1];
     struct action onrestart;  /* Actions to execute on restart. */
     
     /* keycodes for triggering this service via /dev/keychord */
     int *keycodes;
     int nkeycodes;
     int keychord_id;
-};
+
+    int nargs;
+    /* "MUST BE AT THE END OF THE STRUCT" */
+    char *args[1];
+}; /*     ^-------'args' MUST be at the end of this struct! */
 
 int parse_config_file(const char *fn);
 
diff --git a/libacc/Android.mk b/libacc/Android.mk
new file mode 100644
index 000000000..c3207cc51
--- /dev/null
+++ b/libacc/Android.mk
@@ -0,0 +1,12 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+#
+# Shared library
+#
+
+LOCAL_MODULE:= acc
+LOCAL_SRC_FILES := acc.cpp disassem.cpp
+LOCAL_MODULE_TAGS := tests
+
+include $(BUILD_EXECUTABLE)
diff --git a/libacc/FEATURES b/libacc/FEATURES
new file mode 100644
index 000000000..3e80890e3
--- /dev/null
+++ b/libacc/FEATURES
@@ -0,0 +1,65 @@
+
+Supported C language subset (read joint example 'otccex.c' to have
+    an introduction to OTCC dialect):
+
+    - Expressions:
+
+        * binary operators, by decreasing priority order: '*' '/' '%',
+          '+' '-', '>>' '<<', '<' '<=' '>' '>=', '==' '!=', '&',
+          '^', '|', '=', '&&', '||'.
+
+        * '&&' and '||' have the same semantics as C : left to right
+          evaluation and early exit.
+
+        * Parenthesis are supported.
+
+        * Unary operators: '&', '*' (pointer indirection), '-'
+          (negation), '+', '!', '~', post fixed '++' and '--'.
+
+        * Pointer indirection ('*') only works with explicit cast to
+          'char *', 'int *' or 'int (*)()' (function pointer).
+
+        * '++', '--', and unary '&' can only be used with variable
+          lvalue (left value).
+
+        * '=' can only be used with variable or '*' (pointer
+          indirection) lvalue.
+
+        * Function calls are supported with standard i386 calling
+          convention. Function pointers are supported with explicit
+          cast. Functions can be used before being declared.
+
+    - Types: only signed integer ('int') variables and functions can
+      be declared. Variables cannot be initialized in
+      declarations. Only old K&R function declarations are parsed
+      (implicit integer return value and no types on arguments).
+
+    - Any function or variable from the libc can be used because OTCC
+      uses the libc dynamic linker to resolve undefined symbols.
+
+    - Instructions: blocks ('{' '}') are supported as in C. 'if' and
+      'else' can be used for tests. The 'while' and 'for' C constructs
+      are supported for loops. 'break' can be used to exit
+      loops. 'return' is used for the return value of a function.
+
+    - Identifiers are parsed the same way as C. Local variables are
+      handled, but there is no local name space (not a problem if
+      different names are used for local and global variables).
+
+    - Numbers can be entered in decimal, hexadecimal ('0x' or '0X'
+      prefix), or octal ('0' prefix).
+
+    - '#define' is supported without function like arguments. No macro
+      recursion is tolerated. Other preprocessor directives are
+      ignored.
+
+    - C Strings and C character constants are supported. Only '\n',
+      '\"', '\'' and '\\' escapes are recognized.
+
+    - C Comments can be used (but no C++ comments).
+
+    - No error is displayed if an incorrect program is given.
+
+    - Memory: the code, data, and symbol sizes are limited to 100KB
+      (it can be changed in the source code).
+
diff --git a/libacc/acc.cpp b/libacc/acc.cpp
new file mode 100644
index 000000000..50d90dd38
--- /dev/null
+++ b/libacc/acc.cpp
@@ -0,0 +1,1572 @@
+/*
+ Obfuscated Tiny C Compiler
+
+ Copyright (C) 2001-2003 Fabrice Bellard
+
+ This software is provided 'as-is', without any express or implied
+ warranty.  In no event will the authors be held liable for any damages
+ arising from the use of this software.
+
+ Permission is granted to anyone to use this software for any purpose,
+ including commercial applications, and to alter it and redistribute it
+ freely, subject to the following restrictions:
+
+ 1. The origin of this software must not be misrepresented; you must not
+ claim that you wrote the original software. If you use this software
+ in a product, an acknowledgment in the product and its documentation
+ *is* required.
+ 2. Altered source versions must be plainly marked as such, and must not be
+ misrepresented as being the original software.
+ 3. This notice may not be removed or altered from any source distribution.
+ */
+
+#include <ctype.h>
+#include <dlfcn.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#if defined(__arm__)
+#include <unistd.h>
+#endif
+
+#include "disassem.h"
+
+namespace acc {
+
+class compiler {
+    class CodeBuf {
+        char* ind;
+        char* pProgramBase;
+
+        void release() {
+            if (pProgramBase != 0) {
+                free(pProgramBase);
+                pProgramBase = 0;
+            }
+        }
+
+    public:
+        CodeBuf() {
+            pProgramBase = 0;
+            ind = 0;
+        }
+
+        ~CodeBuf() {
+            release();
+        }
+
+        void init(int size) {
+            release();
+            pProgramBase = (char*) calloc(1, size);
+            ind = pProgramBase;
+        }
+
+        void o(int n) {
+            /* cannot use unsigned, so we must do a hack */
+            while (n && n != -1) {
+                *ind++ = n;
+                n = n >> 8;
+            }
+        }
+
+        int o4(int n) {
+            int result = (int) ind;
+            * (int*) ind = n;
+            ind += 4;
+            return result;
+        }
+
+        /*
+         * Output a byte. Handles all values, 0..ff.
+         */
+        void ob(int n) {
+            *ind++ = n;
+        }
+
+        /* output a symbol and patch all calls to it */
+        void gsym(int t) {
+            int n;
+            while (t) {
+                n = *(int *) t; /* next value */
+                *(int *) t = ((int) ind) - t - 4;
+                t = n;
+            }
+        }
+
+        /* psym is used to put an instruction with a data field which is a
+         reference to a symbol. It is in fact the same as oad ! */
+        int psym(int n, int t) {
+            return oad(n, t);
+        }
+
+        /* instruction + address */
+        int oad(int n, int t) {
+            o(n);
+            *(int *) ind = t;
+            t = (int) ind;
+            ind = ind + 4;
+            return t;
+        }
+
+        inline void* getBase() {
+            return (void*) pProgramBase;
+        }
+
+        int getSize() {
+            return ind - pProgramBase;
+        }
+
+        int getPC() {
+            return (int) ind;
+        }
+    };
+
+    class CodeGenerator {
+    public:
+        CodeGenerator() {}
+        virtual ~CodeGenerator() {}
+
+        virtual void init(CodeBuf* pCodeBuf) {
+            this->pCodeBuf = pCodeBuf;
+        }
+
+        /* returns address to patch with local variable size
+        */
+        virtual int functionEntry(int argCount) = 0;
+
+        virtual void functionExit(int argCount, int localVariableAddress, int localVariableSize) = 0;
+
+        /* load immediate value */
+        virtual void li(int t) = 0;
+
+        virtual int gjmp(int t) = 0;
+
+        /* l = 0: je, l == 1: jne */
+        virtual int gtst(bool l, int t) = 0;
+
+        virtual void gcmp(int op) = 0;
+
+        virtual void genOp(int op) = 0;
+
+        virtual void clearECX() = 0;
+
+        virtual void pushEAX() = 0;
+
+        virtual void popECX() = 0;
+
+        virtual void storeEAXToAddressECX(bool isInt) = 0;
+
+        virtual void loadEAXIndirect(bool isInt) = 0;
+
+        virtual void leaEAX(int ea) = 0;
+
+        virtual void storeEAX(int ea) = 0;
+
+        virtual void loadEAX(int ea) = 0;
+
+        virtual void postIncrementOrDecrement(int n, int op) = 0;
+
+        virtual int beginFunctionCallArguments() = 0;
+
+        virtual void endFunctionCallArguments(int a, int l) = 0;
+
+        virtual void storeEAToArg(int l) = 0;
+
+        virtual int callForward(int symbol) = 0;
+
+        virtual void callRelative(int t) = 0;
+
+        virtual void callIndirect(int l) = 0;
+
+        virtual void adjustStackAfterCall(int l) = 0;
+
+        virtual int disassemble(FILE* out) = 0;
+
+        /* output a symbol and patch all calls to it */
+        virtual void gsym(int t) {
+            pCodeBuf->gsym(t);
+        }
+
+        virtual int finishCompile() {
+#if defined(__arm__)
+            const long base = long(pCodeBuf->getBase());
+            const long curr = base + long(pCodeBuf->getSize());
+            int err = cacheflush(base, curr, 0);
+            return err;
+#else
+            return 0;
+#endif
+        }
+
+        /**
+         * Adjust relative branches by this amount.
+         */
+        virtual int jumpOffset() = 0;
+
+    protected:
+        void o(int n) {
+            pCodeBuf->o(n);
+        }
+
+        /*
+         * Output a byte. Handles all values, 0..ff.
+         */
+        void ob(int n) {
+            pCodeBuf->ob(n);
+        }
+
+        /* psym is used to put an instruction with a data field which is a
+         reference to a symbol. It is in fact the same as oad ! */
+        int psym(int n, int t) {
+            return oad(n, t);
+        }
+
+        /* instruction + address */
+        int oad(int n, int t) {
+            return pCodeBuf->oad(n,t);
+        }
+
+        int getBase() {
+            return (int) pCodeBuf->getBase();
+        }
+
+        int getPC() {
+            return pCodeBuf->getPC();
+        }
+
+        int o4(int data) {
+            return pCodeBuf->o4(data);
+        }
+    private:
+        CodeBuf* pCodeBuf;
+    };
+
+    class ARMCodeGenerator : public CodeGenerator {
+    public:
+        ARMCodeGenerator() {}
+        virtual ~ARMCodeGenerator() {}
+
+        /* returns address to patch with local variable size
+        */
+        virtual int functionEntry(int argCount) {
+            fprintf(stderr, "functionEntry(%d);\n", argCount);
+            // sp -> arg4 arg5 ...
+            // Push our register-based arguments back on the stack
+            if (argCount > 0) {
+                int regArgCount = argCount <= 4 ? argCount : 4;
+                o4(0xE92D0000 | ((1 << argCount) - 1)); // stmfd    sp!, {}
+            }
+            // sp -> arg0 arg1 ...
+            o4(0xE92D4800); // stmfd sp!, {fp, lr}
+            // sp, fp -> oldfp, retadr, arg0 arg1 ....
+            o4(0xE1A0B00D); // mov    fp, sp
+            return o4(0xE24DD000); // sub    sp, sp, # <local variables>
+        }
+
+        virtual void functionExit(int argCount, int localVariableAddress, int localVariableSize) {
+            fprintf(stderr, "functionExit(%d, %d, %d);\n", argCount, localVariableAddress, localVariableSize);
+            // Patch local variable allocation code:
+            if (localVariableSize < 0 || localVariableSize > 255) {
+                error("localVariables out of range: %d", localVariableSize);
+            }
+            *(char*) (localVariableAddress) = localVariableSize;
+
+            // sp -> locals .... fp -> oldfp, retadr, arg0, arg1, ...
+            o4(0xE1A0E00B); // mov lr, fp
+            o4(0xE59BB000); // ldr fp, [fp]
+            o4(0xE28ED004); // add sp, lr, #4
+            // sp -> retadr, arg0, ...
+            o4(0xE8BD4000); // ldmfd    sp!, {lr}
+            // sp -> arg0 ....
+            if (argCount > 0) {
+                // We store the PC into the lr so we can adjust the sp before
+                // returning. We need to pull off the registers we pushed
+                // earlier. We don't need to actually store them anywhere,
+                // just adjust the stack.
+                int regArgCount = argCount <= 4 ? argCount : 4;
+                o4(0xE28DD000 | (regArgCount << 2)); // add sp, sp, #argCount << 2
+            }
+            o4(0xE12FFF1E); // bx lr
+        }
+
+        /* load immediate value */
+        virtual void li(int t) {
+            fprintf(stderr, "li(%d);\n", t);
+            if (t >= 0 && t < 255) {
+                 o4(0xE3A00000 + t); // mov    r0, #0
+            } else if (t >= -256 && t < 0) {
+                // mvn means move constant ^ ~0
+                o4(0xE3E00001 - t); // mvn    r0, #0
+            } else {
+                  o4(0xE51F0000); //         ldr    r0, .L3
+                  o4(0xEA000000); //         b .L99
+                  o4(t);          // .L3:   .word 0
+                                  // .L99:
+            }
+        }
+
+        virtual int gjmp(int t) {
+            fprintf(stderr, "gjmp(%d);\n", t);
+            return o4(0xEA000000 | encodeAddress(t)); // b .L33
+        }
+
+        /* l = 0: je, l == 1: jne */
+        virtual int gtst(bool l, int t) {
+            fprintf(stderr, "gtst(%d, %d);\n", l, t);
+            o4(0xE3500000); // cmp r0,#0
+            int branch = l ? 0x1A000000 : 0x0A000000; // bne : beq
+            return o4(branch | encodeAddress(t));
+        }
+
+        virtual void gcmp(int op) {
+            fprintf(stderr, "gcmp(%d);\n", op);
+            o4(0xE1510000); // cmp r1, r1
+            switch(op) {
+            case OP_EQUALS:
+                o4(0x03A00001); // moveq r0,#1
+                o4(0x13A00000); // movne r0,#0
+                break;
+            case OP_NOT_EQUALS:
+                o4(0x03A00000); // moveq r0,#0
+                o4(0x13A00001); // movne r0,#1
+                break;
+            case OP_LESS_EQUAL:
+                o4(0xD3A00001); // movle r0,#1
+                o4(0xC3A00000); // movgt r0,#0
+                break;
+            case OP_GREATER:
+                o4(0xD3A00000); // movle r0,#0
+                o4(0xC3A00001); // movgt r0,#1
+                break;
+            case OP_GREATER_EQUAL:
+                o4(0xA3A00001); // movge r0,#1
+                o4(0xB3A00000); // movlt r0,#0
+                break;
+            case OP_LESS:
+                o4(0xA3A00000); // movge r0,#0
+                o4(0xB3A00001); // movlt r0,#1
+                break;
+            default:
+                error("Unknown comparison op %d", op);
+                break;
+            }
+        }
+
+        virtual void genOp(int op) {
+            fprintf(stderr, "genOp(%d);\n", op);
+            switch(op) {
+            case OP_MUL:
+                o4(0x0E0000091); // mul     r0,r1,r0
+                break;
+            case OP_PLUS:
+                o4(0xE0810000);  // add     r0,r1,r0
+                break;
+            case OP_MINUS:
+                o4(0xE0410000);  // sub     r0,r1,r0
+                break;
+            case OP_SHIFT_LEFT:
+                o4(0xE1A00011);  // lsl     r0,r1,r0
+                break;
+            case OP_SHIFT_RIGHT:
+                o4(0xE1A00051);  // asr     r0,r1,r0
+                break;
+            case OP_BIT_AND:
+                o4(0xE0010000);  // and     r0,r1,r0
+                break;
+            case OP_BIT_XOR:
+                o4(0xE0210000);  // eor     r0,r1,r0
+                break;
+            case OP_BIT_OR:
+                o4(0xE1810000);  // orr     r0,r1,r0
+                break;
+            case OP_BIT_NOT:
+                o4(0xE1E00000);  // mvn     r0, r0
+                break;
+            default:
+                error("Unimplemented op %d\n", op);
+                break;
+            }
+#if 0
+            o(decodeOp(op));
+            if (op == OP_MOD)
+                o(0x92); /* xchg %edx, %eax */
+#endif
+        }
+
+        virtual void clearECX() {
+            fprintf(stderr, "clearECX();\n");
+            o4(0xE3A01000);  // mov    r1, #0
+        }
+
+        virtual void pushEAX() {
+            fprintf(stderr, "pushEAX();\n");
+            o4(0xE92D0001);  // stmfd   sp!,{r0}
+        }
+
+        virtual void popECX() {
+            fprintf(stderr, "popECX();\n");
+            o4(0xE8BD0002);  // ldmfd   sp!,{r1}
+        }
+
+        virtual void storeEAXToAddressECX(bool isInt) {
+            fprintf(stderr, "storeEAXToAddressECX(%d);\n", isInt);
+            if (isInt) {
+                o4(0xE5810000); // str r0, [r1]
+            } else {
+                o4(0xE5C10000); // strb r0, [r1]
+            }
+        }
+
+        virtual void loadEAXIndirect(bool isInt) {
+            fprintf(stderr, "loadEAXIndirect(%d);\n", isInt);
+            if (isInt)
+                o4(0xE5900000); // ldr r0, [r0]
+            else
+                o4(0xE5D00000); // ldrb r0, [r0]
+        }
+
+        virtual void leaEAX(int ea) {
+            fprintf(stderr, "leaEAX(%d);\n", ea);
+            if (ea < -1023 || ea > 1023 || ((ea & 3) != 0)) {
+                error("Offset out of range: %08x", ea);
+            }
+            if (ea < 0) {
+                o4(0xE24B0F00 | (0xff & ((-ea) >> 2))); // sub    r0, fp, #ea
+            } else {
+                o4(0xE28B0F00 | (0xff & (ea >> 2))); // add    r0, fp, #ea
+            }
+
+        }
+
+        virtual void storeEAX(int ea) {
+            fprintf(stderr, "storeEAX(%d);\n", ea);
+            if (ea < -4095 || ea > 4095) {
+                error("Offset out of range: %08x", ea);
+            }
+            if (ea < 0) {
+                o4(0xE50B0000 | (0xfff & (-ea))); // str r0, [fp,#-ea]
+            } else {
+                o4(0xE58B0000 | (0xfff & ea)); // str r0, [fp,#ea]
+            }
+        }
+
+        virtual void loadEAX(int ea) {
+            fprintf(stderr, "loadEAX(%d);\n", ea);
+            if (ea < -4095 || ea > 4095) {
+                error("Offset out of range: %08x", ea);
+            }
+            if (ea < 0) {
+                o4(0xE51B0000 | (0xfff & (-ea))); // ldr r0, [fp,#-ea]
+            } else {
+                o4(0xE59B0000 | (0xfff & ea));    // ldr r0, [fp,#ea]
+            }
+        }
+
+        virtual void postIncrementOrDecrement(int ea, int op) {
+            fprintf(stderr, "postIncrementOrDecrement(%d, %d);\n", ea, op);
+            /* R0 has the original value.
+             */
+            switch (op) {
+            case OP_INCREMENT:
+                o4(0xE2801001); // add r1, r0, #1
+                break;
+            case OP_DECREMENT:
+                o4(0xE2401001); // sub r1, r0, #1
+                break;
+            default:
+                error("unknown opcode: %d", op);
+            }
+            if (ea < -4095 || ea > 4095) {
+                error("Offset out of range: %08x", ea);
+            }
+            if (ea < 0) {
+                o4(0xE50B1000 | (0xfff & (-ea))); // str r1, [fp,#-ea]
+            } else {
+                o4(0xE58B1000 | (0xfff & ea));    // str r1, [fp,#ea]
+            }
+        }
+
+        virtual int beginFunctionCallArguments() {
+            fprintf(stderr, "beginFunctionCallArguments();\n");
+            return o4(0xE24DDF00); // Placeholder
+        }
+
+        virtual void endFunctionCallArguments(int a, int l) {
+            fprintf(stderr, "endFunctionCallArguments(0x%08x, %d);\n", a, l);
+            if (l < 0 || l > 0x3FC) {
+                error("L out of range for stack adjustment: 0x%08x", l);
+            }
+            * (int*) a = 0xE24DDF00 | (l >> 2); // sub    sp, sp, #0 << 2
+            int argCount = l >> 2;
+            if (argCount > 0) {
+                int regArgCount = argCount > 4 ? 4 : argCount;
+                o4(0xE8BD0000 | ((1 << regArgCount) - 1)); // ldmfd   sp!,{}
+            }
+        }
+
+        virtual void storeEAToArg(int l) {
+            fprintf(stderr, "storeEAToArg(%d);\n", l);
+            if (l < 0 || l > 4096-4) {
+                error("l out of range for stack offset: 0x%08x", l);
+            }
+            o4(0xE58D0000 + l); // str r0, [sp, #4]
+        }
+
+        virtual int callForward(int symbol) {
+            fprintf(stderr, "callForward(%d);\n", symbol);
+            // Forward calls are always short (local)
+            return o4(0xEB000000 | encodeAddress(symbol));
+        }
+
+        virtual void callRelative(int t) {
+            fprintf(stderr, "callRelative(%d);\n", t);
+            int abs = t + getPC() + jumpOffset();
+            fprintf(stderr, "abs=%d (0x%08x)\n", abs, abs);
+            if (t >= - (1 << 25) && t < (1 << 25)) {
+                o4(0xEB000000 | encodeAddress(t));
+            } else {
+                // Long call.
+                o4(0xE59FC000); //         ldr    r12, .L1
+                o4(0xEA000000); //         b .L99
+                o4(t - 12);     // .L1:    .word 0
+                o4(0xE08CC00F); // .L99:   add r12,pc
+                o4(0xE12FFF3C); //         blx r12
+           }
+        }
+
+        virtual void callIndirect(int l) {
+            fprintf(stderr, "callIndirect(%d);\n", l);
+            oad(0x2494ff, l); /* call *xxx(%esp) */
+        }
+
+        virtual void adjustStackAfterCall(int l) {
+            fprintf(stderr, "adjustStackAfterCall(%d);\n", l);
+            if (l < 0 || l > 0x3FC) {
+                error("L out of range for stack adjustment: 0x%08x", l);
+            }
+            int argCount = l >> 2;
+            if (argCount > 4) {
+                int remainingArgs = argCount - 4;
+                o4(0xE28DDF00 | remainingArgs); // add    sp, sp, #0x3fc
+            }
+
+        }
+
+        virtual int jumpOffset() {
+            return 8;
+        }
+
+        /* output a symbol and patch all calls to it */
+        virtual void gsym(int t) {
+            fprintf(stderr, "gsym(0x%x)\n", t);
+            int n;
+            int base = getBase();
+            int pc = getPC();
+            fprintf(stderr, "pc = 0x%x\n", pc);
+            while (t) {
+                int data = * (int*) t;
+                int decodedOffset = ((BRANCH_REL_ADDRESS_MASK & data) << 2);
+                if (decodedOffset == 0) {
+                    n = 0;
+                } else {
+                    n = base + decodedOffset; /* next value */
+                }
+                *(int *) t = (data & ~BRANCH_REL_ADDRESS_MASK)
+                    | encodeRelAddress(pc - t - 8);
+                t = n;
+            }
+        }
+
+        virtual int disassemble(FILE* out) {
+               disasmOut = out;
+            disasm_interface_t  di;
+            di.di_readword = disassemble_readword;
+            di.di_printaddr = disassemble_printaddr;
+            di.di_printf = disassemble_printf;
+
+            int base = getBase();
+            int pc = getPC();
+            for(int i = base; i < pc; i += 4) {
+                fprintf(out, "%08x: %08x  ", i, *(int*) i);
+                ::disasm(&di, i, 0);
+            }
+            return 0;
+        }
+    private:
+        static FILE* disasmOut;
+
+        static u_int
+        disassemble_readword(u_int address)
+        {
+            return(*((u_int *)address));
+        }
+
+        static void
+        disassemble_printaddr(u_int address)
+        {
+            fprintf(disasmOut, "0x%08x", address);
+        }
+
+        static void
+        disassemble_printf(const char *fmt, ...) {
+            va_list ap;
+            va_start(ap, fmt);
+            vfprintf(disasmOut, fmt, ap);
+            va_end(ap);
+        }
+
+        static const int BRANCH_REL_ADDRESS_MASK = 0x00ffffff;
+
+        /** Encode a relative address that might also be
+         * a label.
+         */
+        int encodeAddress(int value) {
+            int base = getBase();
+            if (value >= base && value <= getPC() ) {
+                // This is a label, encode it relative to the base.
+                value = value - base;
+            }
+            return encodeRelAddress(value);
+        }
+
+        int encodeRelAddress(int value) {
+            return BRANCH_REL_ADDRESS_MASK & (value >> 2);
+        }
+
+        void error(const char* fmt,...) {
+            va_list ap;
+            va_start(ap, fmt);
+            vfprintf(stderr, fmt, ap);
+            va_end(ap);
+            exit(12);
+        }
+    };
+
+    class X86CodeGenerator : public CodeGenerator {
+    public:
+        X86CodeGenerator() {}
+        virtual ~X86CodeGenerator() {}
+
+        /* returns address to patch with local variable size
+        */
+        virtual int functionEntry(int argCount) {
+            o(0xe58955); /* push   %ebp, mov %esp, %ebp */
+            return oad(0xec81, 0); /* sub $xxx, %esp */
+        }
+
+        virtual void functionExit(int argCount, int localVariableAddress, int localVariableSize) {
+            o(0xc3c9); /* leave, ret */
+            *(int *) localVariableAddress = localVariableSize; /* save local variables */
+        }
+
+        /* load immediate value */
+        virtual void li(int t) {
+            oad(0xb8, t); /* mov $xx, %eax */
+        }
+
+        virtual int gjmp(int t) {
+            return psym(0xe9, t);
+        }
+
+        /* l = 0: je, l == 1: jne */
+        virtual int gtst(bool l, int t) {
+            o(0x0fc085); /* test %eax, %eax, je/jne xxx */
+            return psym(0x84 + l, t);
+        }
+
+        virtual void gcmp(int op) {
+            int t = decodeOp(op);
+            o(0xc139); /* cmp %eax,%ecx */
+            li(0);
+            o(0x0f); /* setxx %al */
+            o(t + 0x90);
+            o(0xc0);
+        }
+
+        virtual void genOp(int op) {
+            o(decodeOp(op));
+            if (op == OP_MOD)
+                o(0x92); /* xchg %edx, %eax */
+        }
+
+        virtual void clearECX() {
+            oad(0xb9, 0); /* movl $0, %ecx */
+        }
+
+        virtual void pushEAX() {
+            o(0x50); /* push %eax */
+        }
+
+        virtual void popECX() {
+            o(0x59); /* pop %ecx */
+        }
+
+        virtual void storeEAXToAddressECX(bool isInt) {
+            o(0x0188 + isInt); /* movl %eax/%al, (%ecx) */
+        }
+
+        virtual void loadEAXIndirect(bool isInt) {
+            if (isInt)
+                o(0x8b); /* mov (%eax), %eax */
+            else
+                o(0xbe0f); /* movsbl (%eax), %eax */
+            ob(0); /* add zero in code */
+        }
+
+        virtual void leaEAX(int ea) {
+            gmov(10, ea); /* leal EA, %eax */
+        }
+
+        virtual void storeEAX(int ea) {
+            gmov(6, ea); /* mov %eax, EA */
+        }
+
+        virtual void loadEAX(int ea) {
+            gmov(8, ea); /* mov EA, %eax */
+        }
+
+        virtual void postIncrementOrDecrement(int n, int op) {
+            /* Implement post-increment or post decrement.
+             */
+            gmov(0, n); /* 83 ADD */
+            o(decodeOp(op));
+        }
+
+        virtual int beginFunctionCallArguments() {
+            return oad(0xec81, 0); /* sub $xxx, %esp */
+        }
+
+        virtual void endFunctionCallArguments(int a, int l) {
+            * (int*) a = l;
+        }
+
+        virtual void storeEAToArg(int l) {
+            oad(0x248489, l); /* movl %eax, xxx(%esp) */
+        }
+
+        virtual int callForward(int symbol) {
+            return psym(0xe8, symbol); /* call xxx */
+        }
+
+        virtual void callRelative(int t) {
+            psym(0xe8, t); /* call xxx */
+        }
+
+        virtual void callIndirect(int l) {
+            oad(0x2494ff, l); /* call *xxx(%esp) */
+        }
+
+        virtual void adjustStackAfterCall(int l) {
+            oad(0xc481, l); /* add $xxx, %esp */
+        }
+
+        virtual int jumpOffset() {
+            return 5;
+        }
+
+        virtual int disassemble(FILE* out) {
+            return 1;
+        }
+
+    private:
+        static const int operatorHelper[];
+
+        int decodeOp(int op) {
+            if (op < 0 || op > OP_COUNT) {
+                fprintf(stderr, "Out-of-range operator: %d\n", op);
+                exit(1);
+            }
+            return operatorHelper[op];
+        }
+
+        void gmov(int l, int t) {
+            o(l + 0x83);
+            oad((t < LOCAL) << 7 | 5, t);
+        }
+    };
+
+    /* vars: value of variables
+     loc : local variable index
+     glo : global variable index
+     ind : output code ptr
+     rsym: return symbol
+     prog: output code
+     dstk: define stack
+     dptr, dch: macro state
+     */
+    int tok, tokc, tokl, ch, vars, rsym, loc, glo, sym_stk, dstk,
+            dptr, dch, last_id;
+    void* pSymbolBase;
+    void* pGlobalBase;
+    void* pVarsBase;
+    FILE* file;
+
+    CodeBuf codeBuf;
+    CodeGenerator* pGen;
+
+    static const int ALLOC_SIZE = 99999;
+
+    /* depends on the init string */
+    static const int TOK_STR_SIZE = 48;
+    static const int TOK_IDENT = 0x100;
+    static const int TOK_INT = 0x100;
+    static const int TOK_IF = 0x120;
+    static const int TOK_ELSE = 0x138;
+    static const int TOK_WHILE = 0x160;
+    static const int TOK_BREAK = 0x190;
+    static const int TOK_RETURN = 0x1c0;
+    static const int TOK_FOR = 0x1f8;
+    static const int TOK_DEFINE = 0x218;
+    static const int TOK_MAIN = 0x250;
+
+    static const int TOK_DUMMY = 1;
+    static const int TOK_NUM = 2;
+
+    static const int LOCAL = 0x200;
+
+    static const int SYM_FORWARD = 0;
+    static const int SYM_DEFINE = 1;
+
+    /* tokens in string heap */
+    static const int TAG_TOK = ' ';
+    static const int TAG_MACRO = 2;
+
+    static const int OP_INCREMENT = 0;
+    static const int OP_DECREMENT = 1;
+    static const int OP_MUL = 2;
+    static const int OP_DIV = 3;
+    static const int OP_MOD = 4;
+    static const int OP_PLUS = 5;
+    static const int OP_MINUS = 6;
+    static const int OP_SHIFT_LEFT = 7;
+    static const int OP_SHIFT_RIGHT = 8;
+    static const int OP_LESS_EQUAL = 9;
+    static const int OP_GREATER_EQUAL = 10;
+    static const int OP_LESS = 11;
+    static const int OP_GREATER = 12;
+    static const int OP_EQUALS = 13;
+    static const int OP_NOT_EQUALS = 14;
+    static const int OP_LOGICAL_AND = 15;
+    static const int OP_LOGICAL_OR = 16;
+    static const int OP_BIT_AND = 17;
+    static const int OP_BIT_XOR = 18;
+    static const int OP_BIT_OR = 19;
+    static const int OP_BIT_NOT = 20;
+    static const int OP_LOGICAL_NOT = 21;
+    static const int OP_COUNT = 22;
+
+    /* Operators are searched from front, the two-character operators appear
+     * before the single-character operators with the same first character.
+     * @ is used to pad out single-character operators.
+     */
+    static const char* operatorChars;
+    static const char operatorLevel[];
+
+    void pdef(int t) {
+        *(char *) dstk++ = t;
+    }
+
+    void inp() {
+        if (dptr) {
+            ch = *(char *) dptr++;
+            if (ch == TAG_MACRO) {
+                dptr = 0;
+                ch = dch;
+            }
+        } else
+            ch = fgetc(file);
+        /*    printf("ch=%c 0x%x\n", ch, ch); */
+    }
+
+    int isid() {
+        return isalnum(ch) | (ch == '_');
+    }
+
+    /* read a character constant */
+    void getq() {
+        if (ch == '\\') {
+            inp();
+            if (ch == 'n')
+                ch = '\n';
+        }
+    }
+
+    void next() {
+        int l, a;
+
+        while (isspace(ch) | (ch == '#')) {
+            if (ch == '#') {
+                inp();
+                next();
+                if (tok == TOK_DEFINE) {
+                    next();
+                    pdef(TAG_TOK); /* fill last ident tag */
+                    *(int *) tok = SYM_DEFINE;
+                    *(int *) (tok + 4) = dstk; /* define stack */
+                }
+                /* well we always save the values ! */
+                while (ch != '\n') {
+                    pdef(ch);
+                    inp();
+                }
+                pdef(ch);
+                pdef(TAG_MACRO);
+            }
+            inp();
+        }
+        tokl = 0;
+        tok = ch;
+        /* encode identifiers & numbers */
+        if (isid()) {
+            pdef(TAG_TOK);
+            last_id = dstk;
+            while (isid()) {
+                pdef(ch);
+                inp();
+            }
+            if (isdigit(tok)) {
+                tokc = strtol((char*) last_id, 0, 0);
+                tok = TOK_NUM;
+            } else {
+                *(char *) dstk = TAG_TOK; /* no need to mark end of string (we
+                 suppose data is initialized to zero by calloc) */
+                tok = (int) (strstr((char*) sym_stk, (char*) (last_id - 1))
+                        - sym_stk);
+                *(char *) dstk = 0; /* mark real end of ident for dlsym() */
+                tok = tok * 8 + TOK_IDENT;
+                if (tok > TOK_DEFINE) {
+                    tok = vars + tok;
+                    /*        printf("tok=%s %x\n", last_id, tok); */
+                    /* define handling */
+                    if (*(int *) tok == SYM_DEFINE) {
+                        dptr = *(int *) (tok + 4);
+                        dch = ch;
+                        inp();
+                        next();
+                    }
+                }
+            }
+        } else {
+            inp();
+            if (tok == '\'') {
+                tok = TOK_NUM;
+                getq();
+                tokc = ch;
+                inp();
+                inp();
+            } else if ((tok == '/') & (ch == '*')) {
+                inp();
+                while (ch) {
+                    while (ch != '*')
+                        inp();
+                    inp();
+                    if (ch == '/')
+                        ch = 0;
+                }
+                inp();
+                next();
+            } else if ((tok == '/') & (ch == '/')) {
+                inp();
+                while (ch && (ch != '\n')) {
+                    inp();
+                }
+                inp();
+                next();
+            } else {
+                const char* t = operatorChars;
+                int opIndex = 0;
+                while ((l = *t++) != 0) {
+                    a = *t++;
+                    tokl = operatorLevel[opIndex];
+                    tokc = opIndex;
+                    if ((l == tok) & ((a == ch) | (a == '@'))) {
+#if 0
+                        printf("%c%c -> tokl=%d tokc=0x%x\n",
+                                l, a, tokl, tokc);
+#endif
+                        if (a == ch) {
+                            inp();
+                            tok = TOK_DUMMY; /* dummy token for double tokens */
+                        }
+                        break;
+                    }
+                    opIndex++;
+                }
+                if (l == 0) {
+                    tokl = 0;
+                    tokc = 0;
+                }
+            }
+        }
+#if 0
+        {
+            int p;
+
+            printf("tok=0x%x ", tok);
+            if (tok >= TOK_IDENT) {
+                printf("'");
+                if (tok> TOK_DEFINE)
+                p = sym_stk + 1 + (tok - vars - TOK_IDENT) / 8;
+                else
+                p = sym_stk + 1 + (tok - TOK_IDENT) / 8;
+                while (*(char *)p != TAG_TOK && *(char *)p)
+                printf("%c", *(char *)p++);
+                printf("'\n");
+            } else if (tok == TOK_NUM) {
+                printf("%d\n", tokc);
+            } else {
+                printf("'%c'\n", tok);
+            }
+        }
+#endif
+    }
+
+    void error(const char *fmt, ...) {
+        va_list ap;
+
+        va_start(ap, fmt);
+        fprintf(stderr, "%ld: ", ftell((FILE *) file));
+        vfprintf(stderr, fmt, ap);
+        fprintf(stderr, "\n");
+        va_end(ap);
+        exit(1);
+    }
+
+    void skip(int c) {
+        if (tok != c) {
+            error("'%c' expected", c);
+        }
+        next();
+    }
+
+    /* l is one if '=' parsing wanted (quick hack) */
+    void unary(int l) {
+        int n, t, a, c;
+        t = 0;
+        n = 1; /* type of expression 0 = forward, 1 = value, other =
+         lvalue */
+        if (tok == '\"') {
+            pGen->li(glo);
+            while (ch != '\"') {
+                getq();
+                *(char *) glo++ = ch;
+                inp();
+            }
+            *(char *) glo = 0;
+            glo = (glo + 4) & -4; /* align heap */
+            inp();
+            next();
+        } else {
+            c = tokl;
+            a = tokc;
+            t = tok;
+            next();
+            if (t == TOK_NUM) {
+                pGen->li(a);
+            } else if (c == 2) {
+                /* -, +, !, ~ */
+                unary(0);
+                pGen->clearECX();
+                if (t == '!')
+                    pGen->gcmp(a);
+                else
+                    pGen->genOp(a);
+            } else if (t == '(') {
+                expr();
+                skip(')');
+            } else if (t == '*') {
+                /* parse cast */
+                skip('(');
+                t = tok; /* get type */
+                next(); /* skip int/char/void */
+                next(); /* skip '*' or '(' */
+                if (tok == '*') {
+                    /* function type */
+                    skip('*');
+                    skip(')');
+                    skip('(');
+                    skip(')');
+                    t = 0;
+                }
+                skip(')');
+                unary(0);
+                if (tok == '=') {
+                    next();
+                    pGen->pushEAX();
+                    expr();
+                    pGen->popECX();
+                    pGen->storeEAXToAddressECX(t == TOK_INT);
+                } else if (t) {
+                    pGen->loadEAXIndirect(t == TOK_INT);
+                }
+            } else if (t == '&') {
+                pGen->leaEAX(*(int *) tok);
+                next();
+            } else {
+                n = *(int *) t;
+                /* forward reference: try dlsym */
+                if (!n) {
+                    n = (int) dlsym(RTLD_DEFAULT, (char*) last_id);
+                }
+                if ((tok == '=') & l) {
+                    /* assignment */
+                    next();
+                    expr();
+                    pGen->storeEAX(n);
+                } else if (tok != '(') {
+                    /* variable */
+                    pGen->loadEAX(n);
+                    if (tokl == 11) {
+                        pGen->postIncrementOrDecrement(n, tokc);
+                        next();
+                    }
+                }
+            }
+        }
+
+        /* function call */
+        if (tok == '(') {
+            if (n == 1)
+                pGen->pushEAX();
+
+            /* push args and invert order */
+            a = pGen->beginFunctionCallArguments();
+            next();
+            l = 0;
+            while (tok != ')') {
+                expr();
+                pGen->storeEAToArg(l);
+                if (tok == ',')
+                    next();
+                l = l + 4;
+            }
+            pGen->endFunctionCallArguments(a, l);
+            next();
+            if (!n) {
+                /* forward reference */
+                t = t + 4;
+                *(int *) t = pGen->callForward(*(int *) t);
+            } else if (n == 1) {
+                pGen->callIndirect(l);
+                l = l + 4;
+            } else {
+                pGen->callRelative(n - codeBuf.getPC() - pGen->jumpOffset()); /* call xxx */
+            }
+            if (l)
+                pGen->adjustStackAfterCall(l);
+        }
+    }
+
+    void sum(int l) {
+        int t, n, a;
+        t = 0;
+        if (l-- == 1)
+            unary(1);
+        else {
+            sum(l);
+            a = 0;
+            while (l == tokl) {
+                n = tok;
+                t = tokc;
+                next();
+
+                if (l > 8) {
+                    a = pGen->gtst(t == OP_LOGICAL_OR, a); /* && and || output code generation */
+                    sum(l);
+                } else {
+                    pGen->pushEAX();
+                    sum(l);
+                    pGen->popECX();
+
+                    if ((l == 4) | (l == 5)) {
+                        pGen->gcmp(t);
+                    } else {
+                        pGen->genOp(t);
+                    }
+                }
+            }
+            /* && and || output code generation */
+            if (a && l > 8) {
+                a = pGen->gtst(t == OP_LOGICAL_OR, a);
+                pGen->li(t != OP_LOGICAL_OR);
+                pGen->gjmp(5); /* jmp $ + 5 (sizeof li, FIXME for ARM) */
+                pGen->gsym(a);
+                pGen->li(t == OP_LOGICAL_OR);
+            }
+        }
+    }
+
+    void expr() {
+        sum(11);
+    }
+
+    int test_expr() {
+        expr();
+        return pGen->gtst(0, 0);
+    }
+
+    void block(int l) {
+        int a, n, t;
+
+        if (tok == TOK_IF) {
+            next();
+            skip('(');
+            a = test_expr();
+            skip(')');
+            block(l);
+            if (tok == TOK_ELSE) {
+                next();
+                n = pGen->gjmp(0); /* jmp */
+                pGen->gsym(a);
+                block(l);
+                pGen->gsym(n); /* patch else jmp */
+            } else {
+                pGen->gsym(a); /* patch if test */
+            }
+        } else if ((tok == TOK_WHILE) | (tok == TOK_FOR)) {
+            t = tok;
+            next();
+            skip('(');
+            if (t == TOK_WHILE) {
+                n = codeBuf.getPC(); // top of loop, target of "next" iteration
+                a = test_expr();
+            } else {
+                if (tok != ';')
+                    expr();
+                skip(';');
+                n = codeBuf.getPC();
+                a = 0;
+                if (tok != ';')
+                    a = test_expr();
+                skip(';');
+                if (tok != ')') {
+                    t = pGen->gjmp(0);
+                    expr();
+                    pGen->gjmp(n - codeBuf.getPC() - pGen->jumpOffset());
+                    pGen->gsym(t);
+                    n = t + 4;
+                }
+            }
+            skip(')');
+            block((int) &a);
+            pGen->gjmp(n - codeBuf.getPC() - pGen->jumpOffset()); /* jmp */
+            pGen->gsym(a);
+        } else if (tok == '{') {
+            next();
+            /* declarations */
+            decl(1);
+            while (tok != '}')
+                block(l);
+            next();
+        } else {
+            if (tok == TOK_RETURN) {
+                next();
+                if (tok != ';')
+                    expr();
+                rsym = pGen->gjmp(rsym); /* jmp */
+            } else if (tok == TOK_BREAK) {
+                next();
+                *(int *) l = pGen->gjmp(*(int *) l);
+            } else if (tok != ';')
+                expr();
+            skip(';');
+        }
+    }
+
+    /* 'l' is true if local declarations */
+    void decl(int l) {
+        int a;
+
+        while ((tok == TOK_INT) | ((tok != -1) & (!l))) {
+            if (tok == TOK_INT) {
+                next();
+                while (tok != ';') {
+                    if (l) {
+                        loc = loc + 4;
+                        *(int *) tok = -loc;
+                    } else {
+                        *(int *) tok = glo;
+                        glo = glo + 4;
+                    }
+                    next();
+                    if (tok == ',')
+                        next();
+                }
+                skip(';');
+            } else {
+                /* patch forward references (XXX: do not work for function
+                 pointers) */
+                pGen->gsym(*(int *) (tok + 4));
+                /* put function address */
+                *(int *) tok = codeBuf.getPC();
+                next();
+                skip('(');
+                a = 8;
+                int argCount = 0;
+                while (tok != ')') {
+                    /* read param name and compute offset */
+                    *(int *) tok = a;
+                    a = a + 4;
+                    next();
+                    if (tok == ',')
+                        next();
+                    argCount++;
+                }
+                next(); /* skip ')' */
+                rsym = loc = 0;
+                a = pGen->functionEntry(argCount);
+                block(0);
+                pGen->gsym(rsym);
+                pGen->functionExit(argCount, a, loc);
+            }
+        }
+    }
+
+    void cleanup() {
+        if (sym_stk != 0) {
+            free((void*) sym_stk);
+            sym_stk = 0;
+        }
+        if (pGlobalBase != 0) {
+            free((void*) pGlobalBase);
+            pGlobalBase = 0;
+        }
+        if (pVarsBase != 0) {
+            free(pVarsBase);
+            pVarsBase = 0;
+        }
+        if (pGen) {
+            delete pGen;
+            pGen = 0;
+        }
+    }
+
+    void clear() {
+        tok = 0;
+        tokc = 0;
+        tokl = 0;
+        ch = 0;
+        vars = 0;
+        rsym = 0;
+        loc = 0;
+        glo = 0;
+        sym_stk = 0;
+        dstk = 0;
+        dptr = 0;
+        dch = 0;
+        last_id = 0;
+        file = 0;
+        pGlobalBase = 0;
+        pVarsBase = 0;
+        pGen = 0;
+    }
+
+    void setArchitecture(const char* architecture) {
+        delete pGen;
+        pGen = 0;
+
+        if (architecture != NULL) {
+            if (strcmp(architecture, "arm") == 0) {
+                pGen = new ARMCodeGenerator();
+            } else if (strcmp(architecture, "x86") == 0) {
+                pGen = new X86CodeGenerator();
+            } else {
+                fprintf(stderr, "Unknown architecture %s", architecture);
+            }
+        }
+
+        if (pGen == NULL) {
+            pGen = new ARMCodeGenerator();
+        }
+    }
+
+public:
+    struct args {
+        args() {
+            architecture = 0;
+        }
+        const char* architecture;
+    };
+
+    compiler() {
+        clear();
+    }
+
+    ~compiler() {
+        cleanup();
+    }
+
+    int compile(FILE* in, args& args) {
+        cleanup();
+        clear();
+        codeBuf.init(ALLOC_SIZE);
+        setArchitecture(args.architecture);
+        pGen->init(&codeBuf);
+        file = in;
+        sym_stk = (int) calloc(1, ALLOC_SIZE);
+        dstk = (int) strcpy((char*) sym_stk,
+                " int if else while break return for define main ")
+                + TOK_STR_SIZE;
+        pGlobalBase = calloc(1, ALLOC_SIZE);
+        glo = (int) pGlobalBase;
+        pVarsBase = calloc(1, ALLOC_SIZE);
+        vars = (int) pVarsBase;
+        inp();
+        next();
+        decl(0);
+        pGen->finishCompile();
+        return 0;
+    }
+
+    int run(int argc, char** argv) {
+        typedef int (*mainPtr)(int argc, char** argv);
+        mainPtr aMain = (mainPtr) *(int*) (vars + TOK_MAIN);
+        if (!aMain) {
+            fprintf(stderr, "Could not find function \"main\".\n");
+            return -1;
+        }
+        return aMain(argc, argv);
+    }
+
+    int dump(FILE* out) {
+        fwrite(codeBuf.getBase(), 1, codeBuf.getSize(), out);
+        return 0;
+    }
+
+    int disassemble(FILE* out) {
+        return pGen->disassemble(out);
+    }
+
+};
+
+const char* compiler::operatorChars =
+    "++--*@/@%@+@-@<<>><=>=<@>@==!=&&||&@^@|@~@!@";
+
+const char compiler::operatorLevel[] =
+    {11, 11, 1, 1, 1, 2, 2, 3, 3, 4, 4, 4, 4,
+            5, 5, /* ==, != */
+            9, 10, /* &&, || */
+            6, 7, 8, /* & ^ | */
+            2, 2 /* ~ ! */
+            };
+
+FILE* compiler::ARMCodeGenerator::disasmOut;
+
+const int compiler::X86CodeGenerator::operatorHelper[] = {
+        0x1,     // ++
+        0xff,    // --
+        0xc1af0f, // *
+        0xf9f79991, // /
+        0xf9f79991, // % (With manual assist to swap results)
+        0xc801, // +
+        0xd8f7c829, // -
+        0xe0d391, // <<
+        0xf8d391, // >>
+        0xe, // <=
+        0xd, // >=
+        0xc, // <
+        0xf, // >
+        0x4, // ==
+        0x5, // !=
+        0x0, // &&
+        0x1, // ||
+        0xc821, // &
+        0xc831, // ^
+        0xc809, // |
+        0xd0f7, // ~
+        0x4     // !
+};
+
+} // namespace acc
+
+// This is a separate function so it can easily be set by breakpoint in gdb.
+int run(acc::compiler& c, int argc, char** argv) {
+    return c.run(argc, argv);
+}
+
+int main(int argc, char** argv) {
+    bool doDump = false;
+    bool doDisassemble = false;
+    const char* inFile = NULL;
+    const char* outFile = NULL;
+    const char* architecture = "arm";
+    int i;
+    for (i = 1; i < argc; i++) {
+        char* arg = argv[i];
+        if (arg[0] == '-') {
+            switch (arg[1]) {
+            case 'a':
+                if (i + 1 >= argc) {
+                    fprintf(stderr, "Expected architecture after -a\n");
+                    return 2;
+                }
+                architecture = argv[i+1];
+                i += 1;
+                break;
+            case 'd':
+                if (i + 1 >= argc) {
+                    fprintf(stderr, "Expected filename after -d\n");
+                    return 2;
+                }
+                doDump = true;
+                outFile = argv[i + 1];
+                i += 1;
+                break;
+            case 'S':
+                doDisassemble = true;
+                break;
+            default:
+                fprintf(stderr, "Unrecognized flag %s\n", arg);
+                return 3;
+            }
+        } else if (inFile == NULL) {
+            inFile = arg;
+        } else {
+            break;
+        }
+    }
+
+    FILE* in = stdin;
+    if (inFile) {
+        in = fopen(inFile, "r");
+        if (!in) {
+            fprintf(stderr, "Could not open input file %s\n", inFile);
+            return 1;
+        }
+    }
+    acc::compiler compiler;
+    acc::compiler::args args;
+    args.architecture = architecture;
+    int compileResult = compiler.compile(in, args);
+    if (in != stdin) {
+        fclose(in);
+    }
+    if (compileResult) {
+        fprintf(stderr, "Compile failed: %d\n", compileResult);
+        return 6;
+    }
+    if (doDisassemble) {
+        compiler.disassemble(stderr);
+    }
+    if (doDump) {
+        FILE* save = fopen(outFile, "w");
+        if (!save) {
+            fprintf(stderr, "Could not open output file %s\n", outFile);
+            return 5;
+        }
+        compiler.dump(save);
+        fclose(save);
+    } else {
+        fprintf(stderr, "Executing compiled code:\n");
+        int codeArgc = argc - i + 1;
+        char** codeArgv = argv + i - 1;
+        codeArgv[0] = (char*) (inFile ? inFile : "stdin");
+        int result = run(compiler, codeArgc, codeArgv);
+        fprintf(stderr, "result: %d\n", result);
+        return result;
+    }
+
+    return 0;
+}
diff --git a/libacc/armreg.h b/libacc/armreg.h
new file mode 100644
index 000000000..fde81ba89
--- /dev/null
+++ b/libacc/armreg.h
@@ -0,0 +1,300 @@
+/*	$NetBSD: armreg.h,v 1.28 2003/10/31 16:30:15 scw Exp $	*/
+
+/*-
+ * Copyright (c) 1998, 2001 Ben Harris
+ * Copyright (c) 1994-1996 Mark Brinicombe.
+ * Copyright (c) 1994 Brini.
+ * All rights reserved.
+ *
+ * This code is derived from software written for Brini by Mark Brinicombe
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Brini.
+ * 4. The name of the company nor the name of the author may be used to
+ *    endorse or promote products derived from this software without specific
+ *    prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: /repoman/r/ncvs/src/sys/arm/include/armreg.h,v 1.3 2005/11/21 19:06:25 cognet Exp $
+ */
+
+#ifndef MACHINE_ARMREG_H
+#define MACHINE_ARMREG_H
+#define INSN_SIZE	4
+#define INSN_COND_MASK	0xf0000000	/* Condition mask */
+#define PSR_MODE        0x0000001f      /* mode mask */
+#define PSR_USR26_MODE  0x00000000
+#define PSR_FIQ26_MODE  0x00000001
+#define PSR_IRQ26_MODE  0x00000002
+#define PSR_SVC26_MODE  0x00000003
+#define PSR_USR32_MODE  0x00000010
+#define PSR_FIQ32_MODE  0x00000011
+#define PSR_IRQ32_MODE  0x00000012
+#define PSR_SVC32_MODE  0x00000013
+#define PSR_ABT32_MODE  0x00000017
+#define PSR_UND32_MODE  0x0000001b
+#define PSR_SYS32_MODE  0x0000001f
+#define PSR_32_MODE     0x00000010
+#define PSR_FLAGS	0xf0000000    /* flags */
+
+#define PSR_C_bit (1 << 29)       /* carry */
+
+/* The high-order byte is always the implementor */
+#define CPU_ID_IMPLEMENTOR_MASK	0xff000000
+#define CPU_ID_ARM_LTD		0x41000000 /* 'A' */
+#define CPU_ID_DEC		0x44000000 /* 'D' */
+#define CPU_ID_INTEL		0x69000000 /* 'i' */
+#define	CPU_ID_TI		0x54000000 /* 'T' */
+
+/* How to decide what format the CPUID is in. */
+#define CPU_ID_ISOLD(x)		(((x) & 0x0000f000) == 0x00000000)
+#define CPU_ID_IS7(x)		(((x) & 0x0000f000) == 0x00007000)
+#define CPU_ID_ISNEW(x)		(!CPU_ID_ISOLD(x) && !CPU_ID_IS7(x))
+
+/* On ARM3 and ARM6, this byte holds the foundry ID. */
+#define CPU_ID_FOUNDRY_MASK	0x00ff0000
+#define CPU_ID_FOUNDRY_VLSI	0x00560000
+
+/* On ARM7 it holds the architecture and variant (sub-model) */
+#define CPU_ID_7ARCH_MASK	0x00800000
+#define CPU_ID_7ARCH_V3		0x00000000
+#define CPU_ID_7ARCH_V4T	0x00800000
+#define CPU_ID_7VARIANT_MASK	0x007f0000
+
+/* On more recent ARMs, it does the same, but in a different format */
+#define CPU_ID_ARCH_MASK	0x000f0000
+#define CPU_ID_ARCH_V3		0x00000000
+#define CPU_ID_ARCH_V4		0x00010000
+#define CPU_ID_ARCH_V4T		0x00020000
+#define CPU_ID_ARCH_V5		0x00030000
+#define CPU_ID_ARCH_V5T		0x00040000
+#define CPU_ID_ARCH_V5TE	0x00050000
+#define CPU_ID_VARIANT_MASK	0x00f00000
+
+/* Next three nybbles are part number */
+#define CPU_ID_PARTNO_MASK	0x0000fff0
+
+/* Intel XScale has sub fields in part number */
+#define CPU_ID_XSCALE_COREGEN_MASK	0x0000e000 /* core generation */
+#define CPU_ID_XSCALE_COREREV_MASK	0x00001c00 /* core revision */
+#define CPU_ID_XSCALE_PRODUCT_MASK	0x000003f0 /* product number */
+
+/* And finally, the revision number. */
+#define CPU_ID_REVISION_MASK	0x0000000f
+
+/* Individual CPUs are probably best IDed by everything but the revision. */
+#define CPU_ID_CPU_MASK		0xfffffff0
+
+/* Fake CPU IDs for ARMs without CP15 */
+#define CPU_ID_ARM2		0x41560200
+#define CPU_ID_ARM250		0x41560250
+
+/* Pre-ARM7 CPUs -- [15:12] == 0 */
+#define CPU_ID_ARM3		0x41560300
+#define CPU_ID_ARM600		0x41560600
+#define CPU_ID_ARM610		0x41560610
+#define CPU_ID_ARM620		0x41560620
+
+/* ARM7 CPUs -- [15:12] == 7 */
+#define CPU_ID_ARM700		0x41007000 /* XXX This is a guess. */
+#define CPU_ID_ARM710		0x41007100
+#define CPU_ID_ARM7500		0x41027100 /* XXX This is a guess. */
+#define CPU_ID_ARM710A		0x41047100 /* inc ARM7100 */
+#define CPU_ID_ARM7500FE	0x41077100
+#define CPU_ID_ARM710T		0x41807100
+#define CPU_ID_ARM720T		0x41807200
+#define CPU_ID_ARM740T8K	0x41807400 /* XXX no MMU, 8KB cache */
+#define CPU_ID_ARM740T4K	0x41817400 /* XXX no MMU, 4KB cache */
+
+/* Post-ARM7 CPUs */
+#define CPU_ID_ARM810		0x41018100
+#define CPU_ID_ARM920T		0x41129200
+#define CPU_ID_ARM920T_ALT	0x41009200
+#define CPU_ID_ARM922T		0x41029220
+#define CPU_ID_ARM940T		0x41029400 /* XXX no MMU */
+#define CPU_ID_ARM946ES		0x41049460 /* XXX no MMU */
+#define	CPU_ID_ARM966ES		0x41049660 /* XXX no MMU */
+#define	CPU_ID_ARM966ESR1	0x41059660 /* XXX no MMU */
+#define CPU_ID_ARM1020E		0x4115a200 /* (AKA arm10 rev 1) */
+#define CPU_ID_ARM1022ES	0x4105a220
+#define CPU_ID_SA110		0x4401a100
+#define CPU_ID_SA1100		0x4401a110
+#define	CPU_ID_TI925T		0x54029250
+#define CPU_ID_SA1110		0x6901b110
+#define CPU_ID_IXP1200		0x6901c120
+#define CPU_ID_80200		0x69052000
+#define CPU_ID_PXA250    	0x69052100 /* sans core revision */
+#define CPU_ID_PXA210    	0x69052120
+#define CPU_ID_PXA250A		0x69052100 /* 1st version Core */
+#define CPU_ID_PXA210A		0x69052120 /* 1st version Core */
+#define CPU_ID_PXA250B		0x69052900 /* 3rd version Core */
+#define CPU_ID_PXA210B		0x69052920 /* 3rd version Core */
+#define CPU_ID_PXA250C		0x69052d00 /* 4th version Core */
+#define CPU_ID_PXA210C		0x69052d20 /* 4th version Core */
+#define	CPU_ID_80321_400	0x69052420
+#define	CPU_ID_80321_600	0x69052430
+#define	CPU_ID_80321_400_B0	0x69052c20
+#define	CPU_ID_80321_600_B0	0x69052c30
+#define	CPU_ID_IXP425_533	0x690541c0
+#define	CPU_ID_IXP425_400	0x690541d0
+#define	CPU_ID_IXP425_266	0x690541f0
+
+/* ARM3-specific coprocessor 15 registers */
+#define ARM3_CP15_FLUSH		1
+#define ARM3_CP15_CONTROL	2
+#define ARM3_CP15_CACHEABLE	3
+#define ARM3_CP15_UPDATEABLE	4
+#define ARM3_CP15_DISRUPTIVE	5	
+
+/* ARM3 Control register bits */
+#define ARM3_CTL_CACHE_ON	0x00000001
+#define ARM3_CTL_SHARED		0x00000002
+#define ARM3_CTL_MONITOR	0x00000004
+
+/*
+ * Post-ARM3 CP15 registers:
+ *
+ *	1	Control register
+ *
+ *	2	Translation Table Base
+ *
+ *	3	Domain Access Control
+ *
+ *	4	Reserved
+ *
+ *	5	Fault Status
+ *
+ *	6	Fault Address
+ *
+ *	7	Cache/write-buffer Control
+ *
+ *	8	TLB Control
+ *
+ *	9	Cache Lockdown
+ *
+ *	10	TLB Lockdown
+ *
+ *	11	Reserved
+ *
+ *	12	Reserved
+ *
+ *	13	Process ID (for FCSE)
+ *
+ *	14	Reserved
+ *
+ *	15	Implementation Dependent
+ */
+
+/* Some of the definitions below need cleaning up for V3/V4 architectures */
+
+/* CPU control register (CP15 register 1) */
+#define CPU_CONTROL_MMU_ENABLE	0x00000001 /* M: MMU/Protection unit enable */
+#define CPU_CONTROL_AFLT_ENABLE	0x00000002 /* A: Alignment fault enable */
+#define CPU_CONTROL_DC_ENABLE	0x00000004 /* C: IDC/DC enable */
+#define CPU_CONTROL_WBUF_ENABLE 0x00000008 /* W: Write buffer enable */
+#define CPU_CONTROL_32BP_ENABLE 0x00000010 /* P: 32-bit exception handlers */
+#define CPU_CONTROL_32BD_ENABLE 0x00000020 /* D: 32-bit addressing */
+#define CPU_CONTROL_LABT_ENABLE 0x00000040 /* L: Late abort enable */
+#define CPU_CONTROL_BEND_ENABLE 0x00000080 /* B: Big-endian mode */
+#define CPU_CONTROL_SYST_ENABLE 0x00000100 /* S: System protection bit */
+#define CPU_CONTROL_ROM_ENABLE	0x00000200 /* R: ROM protection bit */
+#define CPU_CONTROL_CPCLK	0x00000400 /* F: Implementation defined */
+#define CPU_CONTROL_BPRD_ENABLE 0x00000800 /* Z: Branch prediction enable */
+#define CPU_CONTROL_IC_ENABLE   0x00001000 /* I: IC enable */
+#define CPU_CONTROL_VECRELOC	0x00002000 /* V: Vector relocation */
+#define CPU_CONTROL_ROUNDROBIN	0x00004000 /* RR: Predictable replacement */
+#define CPU_CONTROL_V4COMPAT	0x00008000 /* L4: ARMv4 compat LDR R15 etc */
+
+#define CPU_CONTROL_IDC_ENABLE	CPU_CONTROL_DC_ENABLE
+
+/* XScale Auxillary Control Register (CP15 register 1, opcode2 1) */
+#define	XSCALE_AUXCTL_K		0x00000001 /* dis. write buffer coalescing */
+#define	XSCALE_AUXCTL_P		0x00000002 /* ECC protect page table access */
+#define	XSCALE_AUXCTL_MD_WB_RA	0x00000000 /* mini-D$ wb, read-allocate */
+#define	XSCALE_AUXCTL_MD_WB_RWA	0x00000010 /* mini-D$ wb, read/write-allocate */
+#define	XSCALE_AUXCTL_MD_WT	0x00000020 /* mini-D$ wt, read-allocate */
+#define	XSCALE_AUXCTL_MD_MASK	0x00000030
+
+/* Cache type register definitions */
+#define	CPU_CT_ISIZE(x)		((x) & 0xfff)		/* I$ info */
+#define	CPU_CT_DSIZE(x)		(((x) >> 12) & 0xfff)	/* D$ info */
+#define	CPU_CT_S		(1U << 24)		/* split cache */
+#define	CPU_CT_CTYPE(x)		(((x) >> 25) & 0xf)	/* cache type */
+
+#define	CPU_CT_CTYPE_WT		0	/* write-through */
+#define	CPU_CT_CTYPE_WB1	1	/* write-back, clean w/ read */
+#define	CPU_CT_CTYPE_WB2	2	/* w/b, clean w/ cp15,7 */
+#define	CPU_CT_CTYPE_WB6	6	/* w/b, cp15,7, lockdown fmt A */
+#define	CPU_CT_CTYPE_WB7	7	/* w/b, cp15,7, lockdown fmt B */
+
+#define	CPU_CT_xSIZE_LEN(x)	((x) & 0x3)		/* line size */
+#define	CPU_CT_xSIZE_M		(1U << 2)		/* multiplier */
+#define	CPU_CT_xSIZE_ASSOC(x)	(((x) >> 3) & 0x7)	/* associativity */
+#define	CPU_CT_xSIZE_SIZE(x)	(((x) >> 6) & 0x7)	/* size */
+
+/* Fault status register definitions */
+
+#define FAULT_TYPE_MASK 0x0f
+#define FAULT_USER      0x10
+
+#define FAULT_WRTBUF_0  0x00 /* Vector Exception */
+#define FAULT_WRTBUF_1  0x02 /* Terminal Exception */
+#define FAULT_BUSERR_0  0x04 /* External Abort on Linefetch -- Section */
+#define FAULT_BUSERR_1  0x06 /* External Abort on Linefetch -- Page */
+#define FAULT_BUSERR_2  0x08 /* External Abort on Non-linefetch -- Section */
+#define FAULT_BUSERR_3  0x0a /* External Abort on Non-linefetch -- Page */
+#define FAULT_BUSTRNL1  0x0c /* External abort on Translation -- Level 1 */
+#define FAULT_BUSTRNL2  0x0e /* External abort on Translation -- Level 2 */
+#define FAULT_ALIGN_0   0x01 /* Alignment */
+#define FAULT_ALIGN_1   0x03 /* Alignment */
+#define FAULT_TRANS_S   0x05 /* Translation -- Section */
+#define FAULT_TRANS_P   0x07 /* Translation -- Page */
+#define FAULT_DOMAIN_S  0x09 /* Domain -- Section */
+#define FAULT_DOMAIN_P  0x0b /* Domain -- Page */
+#define FAULT_PERM_S    0x0d /* Permission -- Section */
+#define FAULT_PERM_P    0x0f /* Permission -- Page */
+
+#define	FAULT_IMPRECISE	0x400	/* Imprecise exception (XSCALE) */
+
+/*
+ * Address of the vector page, low and high versions.
+ */
+#define	ARM_VECTORS_LOW		0x00000000U
+#define	ARM_VECTORS_HIGH	0xffff0000U
+
+/*
+ * ARM Instructions
+ *
+ *       3 3 2 2 2                              
+ *       1 0 9 8 7                                                     0
+ *      +-------+-------------------------------------------------------+
+ *      | cond  |              instruction dependant                    |
+ *      |c c c c|                                                       |
+ *      +-------+-------------------------------------------------------+
+ */
+
+#define INSN_SIZE		4		/* Always 4 bytes */
+#define INSN_COND_MASK		0xf0000000	/* Condition mask */
+#define INSN_COND_AL		0xe0000000	/* Always condition */
+
+#endif /* !MACHINE_ARMREG_H */
diff --git a/libacc/disassem.cpp b/libacc/disassem.cpp
new file mode 100644
index 000000000..ac35342fd
--- /dev/null
+++ b/libacc/disassem.cpp
@@ -0,0 +1,711 @@
+/*	$NetBSD: disassem.c,v 1.14 2003/03/27 16:58:36 mycroft Exp $	*/
+
+/*-
+ * Copyright (c) 1996 Mark Brinicombe.
+ * Copyright (c) 1996 Brini.
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Brini.
+ * 4. The name of the company nor the name of the author may be used to
+ *    endorse or promote products derived from this software without specific
+ *    prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * RiscBSD kernel project
+ *
+ * db_disasm.c
+ *
+ * Kernel disassembler
+ *
+ * Created      : 10/02/96
+ *
+ * Structured after the sparc/sparc/db_disasm.c by David S. Miller &
+ * Paul Kranenburg
+ *
+ * This code is not complete. Not all instructions are disassembled.
+ */
+
+#include <sys/cdefs.h>
+//__FBSDID("$FreeBSD: /repoman/r/ncvs/src/sys/arm/arm/disassem.c,v 1.2 2005/01/05 21:58:47 imp Exp $");
+#include <sys/param.h>
+#include <stdio.h>
+#include <stdarg.h>
+
+#include "disassem.h"
+#include "armreg.h"
+//#include <ddb/ddb.h>
+
+/*
+ * General instruction format
+ *
+ *	insn[cc][mod]	[operands]
+ *
+ * Those fields with an uppercase format code indicate that the field
+ * follows directly after the instruction before the separator i.e.
+ * they modify the instruction rather than just being an operand to
+ * the instruction. The only exception is the writeback flag which
+ * follows a operand.
+ *
+ *
+ * 2 - print Operand 2 of a data processing instruction
+ * d - destination register (bits 12-15)
+ * n - n register (bits 16-19)
+ * s - s register (bits 8-11)
+ * o - indirect register rn (bits 16-19) (used by swap)
+ * m - m register (bits 0-3)
+ * a - address operand of ldr/str instruction
+ * e - address operand of ldrh/strh instruction
+ * l - register list for ldm/stm instruction
+ * f - 1st fp operand (register) (bits 12-14)
+ * g - 2nd fp operand (register) (bits 16-18)
+ * h - 3rd fp operand (register/immediate) (bits 0-4)
+ * b - branch address
+ * t - thumb branch address (bits 24, 0-23)
+ * k - breakpoint comment (bits 0-3, 8-19)
+ * X - block transfer type
+ * Y - block transfer type (r13 base)
+ * c - comment field bits(0-23)
+ * p - saved or current status register
+ * F - PSR transfer fields
+ * D - destination-is-r15 (P) flag on TST, TEQ, CMP, CMN
+ * L - co-processor transfer size
+ * S - set status flag
+ * P - fp precision
+ * Q - fp precision (for ldf/stf)
+ * R - fp rounding
+ * v - co-processor data transfer registers + addressing mode
+ * W - writeback flag
+ * x - instruction in hex
+ * # - co-processor number
+ * y - co-processor data processing registers
+ * z - co-processor register transfer registers
+ */
+
+struct arm32_insn {
+	u_int mask;
+	u_int pattern;
+	const char* name;
+	const char* format;
+};
+
+static const struct arm32_insn arm32_i[] = {
+    { 0x0fffffff, 0x0ff00000, "imb",	"c" },		/* Before swi */
+    { 0x0fffffff, 0x0ff00001, "imbrange",	"c" },	/* Before swi */
+    { 0x0f000000, 0x0f000000, "swi",	"c" },
+    { 0xfe000000, 0xfa000000, "blx",	"t" },		/* Before b and bl */
+    { 0x0f000000, 0x0a000000, "b",	"b" },
+    { 0x0f000000, 0x0b000000, "bl",	"b" },
+    { 0x0fe000f0, 0x00000090, "mul",	"Snms" },
+    { 0x0fe000f0, 0x00200090, "mla",	"Snmsd" },
+    { 0x0fe000f0, 0x00800090, "umull",	"Sdnms" },
+    { 0x0fe000f0, 0x00c00090, "smull",	"Sdnms" },
+    { 0x0fe000f0, 0x00a00090, "umlal",	"Sdnms" },
+    { 0x0fe000f0, 0x00e00090, "smlal",	"Sdnms" },
+    { 0x0d700000, 0x04200000, "strt",	"daW" },
+    { 0x0d700000, 0x04300000, "ldrt",	"daW" },
+    { 0x0d700000, 0x04600000, "strbt",	"daW" },
+    { 0x0d700000, 0x04700000, "ldrbt",	"daW" },
+    { 0x0c500000, 0x04000000, "str",	"daW" },
+    { 0x0c500000, 0x04100000, "ldr",	"daW" },
+    { 0x0c500000, 0x04400000, "strb",	"daW" },
+    { 0x0c500000, 0x04500000, "ldrb",	"daW" },
+    { 0x0e1f0000, 0x080d0000, "stm",	"YnWl" },/* separate out r13 base */
+    { 0x0e1f0000, 0x081d0000, "ldm",	"YnWl" },/* separate out r13 base */    
+    { 0x0e100000, 0x08000000, "stm",	"XnWl" },
+    { 0x0e100000, 0x08100000, "ldm",	"XnWl" },    
+    { 0x0e1000f0, 0x00100090, "ldrb",	"deW" },
+    { 0x0e1000f0, 0x00000090, "strb",	"deW" },
+    { 0x0e1000f0, 0x001000d0, "ldrsb",	"deW" },
+    { 0x0e1000f0, 0x001000b0, "ldrh",	"deW" },
+    { 0x0e1000f0, 0x000000b0, "strh",	"deW" },
+    { 0x0e1000f0, 0x001000f0, "ldrsh",	"deW" },
+    { 0x0f200090, 0x00200090, "und",	"x" },	/* Before data processing */
+    { 0x0e1000d0, 0x000000d0, "und",	"x" },	/* Before data processing */
+    { 0x0ff00ff0, 0x01000090, "swp",	"dmo" },
+    { 0x0ff00ff0, 0x01400090, "swpb",	"dmo" },
+    { 0x0fbf0fff, 0x010f0000, "mrs",	"dp" },	/* Before data processing */
+    { 0x0fb0fff0, 0x0120f000, "msr",	"pFm" },/* Before data processing */
+    { 0x0fb0f000, 0x0320f000, "msr",	"pF2" },/* Before data processing */
+    { 0x0ffffff0, 0x012fff10, "bx",     "m" },
+    { 0x0fff0ff0, 0x016f0f10, "clz",	"dm" },
+    { 0x0ffffff0, 0x012fff30, "blx",	"m" },
+    { 0xfff000f0, 0xe1200070, "bkpt",	"k" },
+    { 0x0de00000, 0x00000000, "and",	"Sdn2" },
+    { 0x0de00000, 0x00200000, "eor",	"Sdn2" },
+    { 0x0de00000, 0x00400000, "sub",	"Sdn2" },
+    { 0x0de00000, 0x00600000, "rsb",	"Sdn2" },
+    { 0x0de00000, 0x00800000, "add",	"Sdn2" },
+    { 0x0de00000, 0x00a00000, "adc",	"Sdn2" },
+    { 0x0de00000, 0x00c00000, "sbc",	"Sdn2" },
+    { 0x0de00000, 0x00e00000, "rsc",	"Sdn2" },
+    { 0x0df00000, 0x01100000, "tst",	"Dn2" },
+    { 0x0df00000, 0x01300000, "teq",	"Dn2" },
+    { 0x0df00000, 0x01500000, "cmp",	"Dn2" },
+    { 0x0df00000, 0x01700000, "cmn",	"Dn2" },
+    { 0x0de00000, 0x01800000, "orr",	"Sdn2" },
+    { 0x0de00000, 0x01a00000, "mov",	"Sd2" },
+    { 0x0de00000, 0x01c00000, "bic",	"Sdn2" },
+    { 0x0de00000, 0x01e00000, "mvn",	"Sd2" },
+    { 0x0ff08f10, 0x0e000100, "adf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e100100, "muf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e200100, "suf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e300100, "rsf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e400100, "dvf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e500100, "rdf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e600100, "pow",	"PRfgh" },
+    { 0x0ff08f10, 0x0e700100, "rpw",	"PRfgh" },
+    { 0x0ff08f10, 0x0e800100, "rmf",	"PRfgh" },
+    { 0x0ff08f10, 0x0e900100, "fml",	"PRfgh" },
+    { 0x0ff08f10, 0x0ea00100, "fdv",	"PRfgh" },
+    { 0x0ff08f10, 0x0eb00100, "frd",	"PRfgh" },
+    { 0x0ff08f10, 0x0ec00100, "pol",	"PRfgh" },
+    { 0x0f008f10, 0x0e000100, "fpbop",	"PRfgh" },
+    { 0x0ff08f10, 0x0e008100, "mvf",	"PRfh" },
+    { 0x0ff08f10, 0x0e108100, "mnf",	"PRfh" },
+    { 0x0ff08f10, 0x0e208100, "abs",	"PRfh" },
+    { 0x0ff08f10, 0x0e308100, "rnd",	"PRfh" },
+    { 0x0ff08f10, 0x0e408100, "sqt",	"PRfh" },
+    { 0x0ff08f10, 0x0e508100, "log",	"PRfh" },
+    { 0x0ff08f10, 0x0e608100, "lgn",	"PRfh" },
+    { 0x0ff08f10, 0x0e708100, "exp",	"PRfh" },
+    { 0x0ff08f10, 0x0e808100, "sin",	"PRfh" },
+    { 0x0ff08f10, 0x0e908100, "cos",	"PRfh" },
+    { 0x0ff08f10, 0x0ea08100, "tan",	"PRfh" },
+    { 0x0ff08f10, 0x0eb08100, "asn",	"PRfh" },
+    { 0x0ff08f10, 0x0ec08100, "acs",	"PRfh" },
+    { 0x0ff08f10, 0x0ed08100, "atn",	"PRfh" },
+    { 0x0f008f10, 0x0e008100, "fpuop",	"PRfh" },
+    { 0x0e100f00, 0x0c000100, "stf",	"QLv" },
+    { 0x0e100f00, 0x0c100100, "ldf",	"QLv" },
+    { 0x0ff00f10, 0x0e000110, "flt",	"PRgd" },
+    { 0x0ff00f10, 0x0e100110, "fix",	"PRdh" },
+    { 0x0ff00f10, 0x0e200110, "wfs",	"d" },
+    { 0x0ff00f10, 0x0e300110, "rfs",	"d" },
+    { 0x0ff00f10, 0x0e400110, "wfc",	"d" },
+    { 0x0ff00f10, 0x0e500110, "rfc",	"d" },
+    { 0x0ff0ff10, 0x0e90f110, "cmf",	"PRgh" },
+    { 0x0ff0ff10, 0x0eb0f110, "cnf",	"PRgh" },
+    { 0x0ff0ff10, 0x0ed0f110, "cmfe",	"PRgh" },
+    { 0x0ff0ff10, 0x0ef0f110, "cnfe",	"PRgh" },
+    { 0xff100010, 0xfe000010, "mcr2",	"#z" },
+    { 0x0f100010, 0x0e000010, "mcr",	"#z" },
+    { 0xff100010, 0xfe100010, "mrc2",	"#z" },
+    { 0x0f100010, 0x0e100010, "mrc",	"#z" },
+    { 0xff000010, 0xfe000000, "cdp2",	"#y" },
+    { 0x0f000010, 0x0e000000, "cdp",	"#y" },
+    { 0xfe100090, 0xfc100000, "ldc2",	"L#v" },
+    { 0x0e100090, 0x0c100000, "ldc",	"L#v" },
+    { 0xfe100090, 0xfc000000, "stc2",	"L#v" },
+    { 0x0e100090, 0x0c000000, "stc",	"L#v" },
+    { 0xf550f000, 0xf550f000, "pld",	"ne" },
+    { 0x0ff00ff0, 0x01000050, "qaad",	"dmn" },
+    { 0x0ff00ff0, 0x01400050, "qdaad",	"dmn" },
+    { 0x0ff00ff0, 0x01600050, "qdsub",	"dmn" },
+    { 0x0ff00ff0, 0x01200050, "dsub",	"dmn" },
+    { 0x0ff000f0, 0x01000080, "smlabb",	"nmsd" },   // d & n inverted!!
+    { 0x0ff000f0, 0x010000a0, "smlatb",	"nmsd" },   // d & n inverted!!
+    { 0x0ff000f0, 0x010000c0, "smlabt",	"nmsd" },   // d & n inverted!!
+    { 0x0ff000f0, 0x010000e0, "smlatt",	"nmsd" },   // d & n inverted!!
+    { 0x0ff000f0, 0x01400080, "smlalbb","ndms" },   // d & n inverted!!
+    { 0x0ff000f0, 0x014000a0, "smlaltb","ndms" },   // d & n inverted!!
+    { 0x0ff000f0, 0x014000c0, "smlalbt","ndms" },   // d & n inverted!!
+    { 0x0ff000f0, 0x014000e0, "smlaltt","ndms" },   // d & n inverted!!
+    { 0x0ff000f0, 0x01200080, "smlawb", "nmsd" },   // d & n inverted!!
+    { 0x0ff0f0f0, 0x012000a0, "smulwb","nms" },   // d & n inverted!!
+    { 0x0ff000f0, 0x012000c0, "smlawt", "nmsd" },   // d & n inverted!!
+    { 0x0ff0f0f0, 0x012000e0, "smulwt","nms" },   // d & n inverted!!
+    { 0x0ff0f0f0, 0x01600080, "smulbb","nms" },   // d & n inverted!!
+    { 0x0ff0f0f0, 0x016000a0, "smultb","nms" },   // d & n inverted!!
+    { 0x0ff0f0f0, 0x016000c0, "smulbt","nms" },   // d & n inverted!!
+    { 0x0ff0f0f0, 0x016000e0, "smultt","nms" },   // d & n inverted!!
+    { 0x00000000, 0x00000000, NULL,	NULL }
+};
+
+static char const arm32_insn_conditions[][4] = {
+	"eq", "ne", "cs", "cc",
+	"mi", "pl", "vs", "vc",
+	"hi", "ls", "ge", "lt",
+	"gt", "le", "",   "nv"
+};
+
+static char const insn_block_transfers[][4] = {
+	"da", "ia", "db", "ib"
+};
+
+static char const insn_stack_block_transfers[][4] = {
+	"ed", "ea", "fd", "fa"
+};
+
+static char const op_shifts[][4] = {
+	"lsl", "lsr", "asr", "ror"
+};
+
+static char const insn_fpa_rounding[][2] = {
+	"", "p", "m", "z"
+};
+
+static char const insn_fpa_precision[][2] = {
+	"s", "d", "e", "p"
+};
+
+static char const insn_fpaconstants[][8] = {
+	"0.0", "1.0", "2.0", "3.0",
+	"4.0", "5.0", "0.5", "10.0"
+};
+
+#define insn_condition(x)	arm32_insn_conditions[(x >> 28) & 0x0f]
+#define insn_blktrans(x)	insn_block_transfers[(x >> 23) & 3]
+#define insn_stkblktrans(x)	insn_stack_block_transfers[(x >> 23) & 3]
+#define op2_shift(x)		op_shifts[(x >> 5) & 3]
+#define insn_fparnd(x)		insn_fpa_rounding[(x >> 5) & 0x03]
+#define insn_fpaprec(x)		insn_fpa_precision[(((x >> 18) & 2)|(x >> 7)) & 1]
+#define insn_fpaprect(x)	insn_fpa_precision[(((x >> 21) & 2)|(x >> 15)) & 1]
+#define insn_fpaimm(x)		insn_fpaconstants[x & 0x07]
+
+/* Local prototypes */
+static void disasm_register_shift(const disasm_interface_t *di, u_int insn);
+static void disasm_print_reglist(const disasm_interface_t *di, u_int insn);
+static void disasm_insn_ldrstr(const disasm_interface_t *di, u_int insn,
+    u_int loc);
+static void disasm_insn_ldrhstrh(const disasm_interface_t *di, u_int insn,
+    u_int loc);
+static void disasm_insn_ldcstc(const disasm_interface_t *di, u_int insn,
+    u_int loc);
+static u_int disassemble_readword(u_int address);
+static void disassemble_printaddr(u_int address);
+
+u_int
+disasm(const disasm_interface_t *di, u_int loc, int altfmt)
+{
+	const struct arm32_insn *i_ptr = &arm32_i[0];
+
+	u_int insn;
+	int matchp;
+	int branch;
+	const char* f_ptr;
+	int fmt;
+
+	fmt = 0;
+	matchp = 0;
+	insn = di->di_readword(loc);
+
+/*	di->di_printf("loc=%08x insn=%08x : ", loc, insn);*/
+
+	while (i_ptr->name) {
+		if ((insn & i_ptr->mask) ==  i_ptr->pattern) {
+			matchp = 1;
+			break;
+		}
+		i_ptr++;
+	}
+
+	if (!matchp) {
+		di->di_printf("und%s\t%08x\n", insn_condition(insn), insn);
+		return(loc + INSN_SIZE);
+	}
+
+	/* If instruction forces condition code, don't print it. */
+	if ((i_ptr->mask & 0xf0000000) == 0xf0000000)
+		di->di_printf("%s", i_ptr->name);
+	else
+		di->di_printf("%s%s", i_ptr->name, insn_condition(insn));
+
+	f_ptr = i_ptr->format;
+
+	/* Insert tab if there are no instruction modifiers */
+
+	if (*(f_ptr) < 'A' || *(f_ptr) > 'Z') {
+		++fmt;
+		di->di_printf("\t");
+	}
+
+	while (*f_ptr) {
+		switch (*f_ptr) {
+		/* 2 - print Operand 2 of a data processing instruction */
+		case '2':
+			if (insn & 0x02000000) {
+				int rotate= ((insn >> 7) & 0x1e);
+
+				di->di_printf("#0x%08x",
+					      (insn & 0xff) << (32 - rotate) |
+					      (insn & 0xff) >> rotate);
+			} else {  
+				disasm_register_shift(di, insn);
+			}
+			break;
+		/* d - destination register (bits 12-15) */
+		case 'd':
+			di->di_printf("r%d", ((insn >> 12) & 0x0f));
+			break;
+		/* D - insert 'p' if Rd is R15 */
+		case 'D':
+			if (((insn >> 12) & 0x0f) == 15)
+				di->di_printf("p");
+			break;
+		/* n - n register (bits 16-19) */
+		case 'n':
+			di->di_printf("r%d", ((insn >> 16) & 0x0f));
+			break;
+		/* s - s register (bits 8-11) */
+		case 's':
+			di->di_printf("r%d", ((insn >> 8) & 0x0f));
+			break;
+		/* o - indirect register rn (bits 16-19) (used by swap) */
+		case 'o':
+			di->di_printf("[r%d]", ((insn >> 16) & 0x0f));
+			break;
+		/* m - m register (bits 0-4) */
+		case 'm':
+			di->di_printf("r%d", ((insn >> 0) & 0x0f));
+			break;
+		/* a - address operand of ldr/str instruction */
+		case 'a':
+			disasm_insn_ldrstr(di, insn, loc);
+			break;
+		/* e - address operand of ldrh/strh instruction */
+		case 'e':
+			disasm_insn_ldrhstrh(di, insn, loc);
+			break;
+		/* l - register list for ldm/stm instruction */
+		case 'l':
+			disasm_print_reglist(di, insn);
+			break;
+		/* f - 1st fp operand (register) (bits 12-14) */
+		case 'f':
+			di->di_printf("f%d", (insn >> 12) & 7);
+			break;
+		/* g - 2nd fp operand (register) (bits 16-18) */
+		case 'g':
+			di->di_printf("f%d", (insn >> 16) & 7);
+			break;
+		/* h - 3rd fp operand (register/immediate) (bits 0-4) */
+		case 'h':
+			if (insn & (1 << 3))
+				di->di_printf("#%s", insn_fpaimm(insn));
+			else
+				di->di_printf("f%d", insn & 7);
+			break;
+		/* b - branch address */
+		case 'b':
+			branch = ((insn << 2) & 0x03ffffff);
+			if (branch & 0x02000000)
+				branch |= 0xfc000000;
+			di->di_printaddr(loc + 8 + branch);
+			break;
+		/* t - blx address */
+		case 't':
+			branch = ((insn << 2) & 0x03ffffff) |
+			    (insn >> 23 & 0x00000002);
+			if (branch & 0x02000000)
+				branch |= 0xfc000000;
+			di->di_printaddr(loc + 8 + branch);
+			break;
+		/* X - block transfer type */
+		case 'X':
+			di->di_printf("%s", insn_blktrans(insn));
+			break;
+		/* Y - block transfer type (r13 base) */
+		case 'Y':
+			di->di_printf("%s", insn_stkblktrans(insn));
+			break;
+		/* c - comment field bits(0-23) */
+		case 'c':
+			di->di_printf("0x%08x", (insn & 0x00ffffff));
+			break;
+		/* k - breakpoint comment (bits 0-3, 8-19) */
+		case 'k':
+			di->di_printf("0x%04x",
+			    (insn & 0x000fff00) >> 4 | (insn & 0x0000000f));
+			break;
+		/* p - saved or current status register */
+		case 'p':
+			if (insn & 0x00400000)
+				di->di_printf("spsr");
+			else
+				di->di_printf("cpsr");
+			break;
+		/* F - PSR transfer fields */
+		case 'F':
+			di->di_printf("_");
+			if (insn & (1 << 16))
+				di->di_printf("c");
+			if (insn & (1 << 17))
+				di->di_printf("x");
+			if (insn & (1 << 18))
+				di->di_printf("s");
+			if (insn & (1 << 19))
+				di->di_printf("f");
+			break;
+		/* B - byte transfer flag */
+		case 'B':
+			if (insn & 0x00400000)
+				di->di_printf("b");
+			break;
+		/* L - co-processor transfer size */
+		case 'L':
+			if (insn & (1 << 22))
+				di->di_printf("l");
+			break;
+		/* S - set status flag */
+		case 'S':
+			if (insn & 0x00100000)
+				di->di_printf("s");
+			break;
+		/* P - fp precision */
+		case 'P':
+			di->di_printf("%s", insn_fpaprec(insn));
+			break;
+		/* Q - fp precision (for ldf/stf) */
+		case 'Q':
+			break;
+		/* R - fp rounding */
+		case 'R':
+			di->di_printf("%s", insn_fparnd(insn));
+			break;
+		/* W - writeback flag */
+		case 'W':
+			if (insn & (1 << 21))
+				di->di_printf("!");
+			break;
+		/* # - co-processor number */
+		case '#':
+			di->di_printf("p%d", (insn >> 8) & 0x0f);
+			break;
+		/* v - co-processor data transfer registers+addressing mode */
+		case 'v':
+			disasm_insn_ldcstc(di, insn, loc);
+			break;
+		/* x - instruction in hex */
+		case 'x':
+			di->di_printf("0x%08x", insn);
+			break;
+		/* y - co-processor data processing registers */
+		case 'y':
+			di->di_printf("%d, ", (insn >> 20) & 0x0f);
+
+			di->di_printf("c%d, c%d, c%d", (insn >> 12) & 0x0f,
+			    (insn >> 16) & 0x0f, insn & 0x0f);
+
+			di->di_printf(", %d", (insn >> 5) & 0x07);
+			break;
+		/* z - co-processor register transfer registers */
+		case 'z':
+			di->di_printf("%d, ", (insn >> 21) & 0x07);
+			di->di_printf("r%d, c%d, c%d, %d",
+			    (insn >> 12) & 0x0f, (insn >> 16) & 0x0f,
+			    insn & 0x0f, (insn >> 5) & 0x07);
+
+/*			if (((insn >> 5) & 0x07) != 0)
+				di->di_printf(", %d", (insn >> 5) & 0x07);*/
+			break;
+		default:
+			di->di_printf("[%c - unknown]", *f_ptr);
+			break;
+		}
+		if (*(f_ptr+1) >= 'A' && *(f_ptr+1) <= 'Z')
+			++f_ptr;
+		else if (*(++f_ptr)) {
+			++fmt;
+			if (fmt == 1)
+				di->di_printf("\t");
+			else
+				di->di_printf(", ");
+		}
+	};
+
+	di->di_printf("\n");
+
+	return(loc + INSN_SIZE);
+}
+
+
+static void
+disasm_register_shift(const disasm_interface_t *di, u_int insn)
+{
+	di->di_printf("r%d", (insn & 0x0f));
+	if ((insn & 0x00000ff0) == 0)
+		;
+	else if ((insn & 0x00000ff0) == 0x00000060)
+		di->di_printf(", rrx");
+	else {
+		if (insn & 0x10)
+			di->di_printf(", %s r%d", op2_shift(insn),
+			    (insn >> 8) & 0x0f);
+		else
+			di->di_printf(", %s #%d", op2_shift(insn),
+			    (insn >> 7) & 0x1f);
+	}
+}
+
+
+static void
+disasm_print_reglist(const disasm_interface_t *di, u_int insn)
+{
+	int loop;
+	int start;
+	int comma;
+
+	di->di_printf("{");
+	start = -1;
+	comma = 0;
+
+	for (loop = 0; loop < 17; ++loop) {
+		if (start != -1) {
+			if (loop == 16 || !(insn & (1 << loop))) {
+				if (comma)
+					di->di_printf(", ");
+				else
+					comma = 1;
+        			if (start == loop - 1)
+        				di->di_printf("r%d", start);
+        			else
+        				di->di_printf("r%d-r%d", start, loop - 1);
+        			start = -1;
+        		}
+        	} else {
+        		if (insn & (1 << loop))
+        			start = loop;
+        	}
+        }
+	di->di_printf("}");
+
+	if (insn & (1 << 22))
+		di->di_printf("^");
+}
+
+static void
+disasm_insn_ldrstr(const disasm_interface_t *di, u_int insn, u_int loc)
+{
+	int offset;
+
+	offset = insn & 0xfff;
+	if ((insn & 0x032f0000) == 0x010f0000) {
+		/* rA = pc, immediate index */
+		if (insn & 0x00800000)
+			loc += offset;
+		else
+			loc -= offset;
+		di->di_printaddr(loc + 8);
+ 	} else {
+		di->di_printf("[r%d", (insn >> 16) & 0x0f);
+		if ((insn & 0x03000fff) != 0x01000000) {
+			di->di_printf("%s, ", (insn & (1 << 24)) ? "" : "]");
+			if (!(insn & 0x00800000))
+				di->di_printf("-");
+			if (insn & (1 << 25))
+				disasm_register_shift(di, insn);
+			else
+				di->di_printf("#0x%03x", offset);
+		}
+		if (insn & (1 << 24))
+			di->di_printf("]");
+	}
+}
+
+static void
+disasm_insn_ldrhstrh(const disasm_interface_t *di, u_int insn, u_int loc)
+{
+	int offset;
+
+	offset = ((insn & 0xf00) >> 4) | (insn & 0xf);
+	if ((insn & 0x004f0000) == 0x004f0000) {
+		/* rA = pc, immediate index */
+		if (insn & 0x00800000)
+			loc += offset;
+		else
+			loc -= offset;
+		di->di_printaddr(loc + 8);
+ 	} else {
+		di->di_printf("[r%d", (insn >> 16) & 0x0f);
+		if ((insn & 0x01400f0f) != 0x01400000) {
+			di->di_printf("%s, ", (insn & (1 << 24)) ? "" : "]");
+			if (!(insn & 0x00800000))
+				di->di_printf("-");
+			if (insn & (1 << 22))
+				di->di_printf("#0x%02x", offset);
+			else
+				di->di_printf("r%d", (insn & 0x0f));
+		}
+		if (insn & (1 << 24))
+			di->di_printf("]");
+	}
+}
+
+static void
+disasm_insn_ldcstc(const disasm_interface_t *di, u_int insn, u_int loc)
+{
+	if (((insn >> 8) & 0xf) == 1)
+		di->di_printf("f%d, ", (insn >> 12) & 0x07);
+	else
+		di->di_printf("c%d, ", (insn >> 12) & 0x0f);
+
+	di->di_printf("[r%d", (insn >> 16) & 0x0f);
+
+	di->di_printf("%s, ", (insn & (1 << 24)) ? "" : "]");
+
+	if (!(insn & (1 << 23)))
+		di->di_printf("-");
+
+	di->di_printf("#0x%03x", (insn & 0xff) << 2);
+
+	if (insn & (1 << 24))
+		di->di_printf("]");
+
+	if (insn & (1 << 21))
+		di->di_printf("!");
+}
+
+static u_int
+disassemble_readword(u_int address)
+{
+	return(*((u_int *)address));
+}
+
+static void
+disassemble_printaddr(u_int address)
+{
+	printf("0x%08x", address);
+}
+
+static void
+disassemble_printf(const char *fmt, ...) {
+	va_list ap;
+	va_start(ap, fmt);
+	vprintf(fmt, ap);
+	va_end(ap);
+}
+
+static const disasm_interface_t disassemble_di = {
+	disassemble_readword, disassemble_printaddr, disassemble_printf
+};
+
+void
+disassemble(u_int address)
+{
+
+	(void)disasm(&disassemble_di, address, 0);
+}
+
+/* End of disassem.c */
diff --git a/libacc/disassem.h b/libacc/disassem.h
new file mode 100644
index 000000000..02747cd06
--- /dev/null
+++ b/libacc/disassem.h
@@ -0,0 +1,65 @@
+/*	$NetBSD: disassem.h,v 1.4 2001/03/04 04:15:58 matt Exp $	*/
+
+/*-
+ * Copyright (c) 1997 Mark Brinicombe.
+ * Copyright (c) 1997 Causality Limited.
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Mark Brinicombe.
+ * 4. The name of the company nor the name of the author may be used to
+ *    endorse or promote products derived from this software without specific
+ *    prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * Define the interface structure required by the disassembler.
+ *
+ * $FreeBSD: /repoman/r/ncvs/src/sys/arm/include/disassem.h,v 1.2 2005/01/05 21:58:48 imp Exp $
+ */
+
+#ifndef ANDROID_MACHINE_DISASSEM_H
+#define ANDROID_MACHINE_DISASSEM_H
+
+#include <sys/types.h>
+
+#if __cplusplus
+extern "C" {
+#endif
+
+typedef struct {
+	u_int	(*di_readword)(u_int);
+	void	(*di_printaddr)(u_int);	
+	void	(*di_printf)(const char *, ...);
+} disasm_interface_t;
+
+/* Prototypes for callable functions */
+
+u_int disasm(const disasm_interface_t *, u_int, int);
+void disassemble(u_int);
+
+#if __cplusplus
+}
+#endif
+
+#endif /* !ANDROID_MACHINE_DISASSEM_H */
diff --git a/libacc/test b/libacc/test
new file mode 100755
index 000000000..0b767da0d
--- /dev/null
+++ b/libacc/test
@@ -0,0 +1,3 @@
+#!/bin/sh
+g++ acc.cpp disassem.cpp -g -ldl -o tests/acc && tests/acc tests/otcc.c -a x86 -d tests/otcc.out && diff tests/otcc.out tests/otcc.out-orig
+tests/acc -S tests/returnval.c
diff --git a/libacc/tests/.gitignore b/libacc/tests/.gitignore
new file mode 100644
index 000000000..99745324e
--- /dev/null
+++ b/libacc/tests/.gitignore
@@ -0,0 +1,2 @@
+acc
+*.out
diff --git a/libacc/tests/bellard.otccex.c b/libacc/tests/bellard.otccex.c
new file mode 100644
index 000000000..e8f098914
--- /dev/null
+++ b/libacc/tests/bellard.otccex.c
@@ -0,0 +1,126 @@
+/* #!/usr/local/bin/otcc */
+/*
+ * Sample OTCC C example. You can uncomment the first line and install
+ * otcc in /usr/local/bin to make otcc scripts !  
+ */
+
+/* Any preprocessor directive except #define are ignored. We put this
+   include so that a standard C compiler can compile this code too. */
+#include <stdio.h>
+
+/* defines are handled, but macro arguments cannot be given. No
+   recursive defines are tolerated */
+#define DEFAULT_BASE 10
+
+/*
+ * Only old style K&R prototypes are parsed. Only int arguments are
+ * allowed (implicit types).
+ * 
+ * By benchmarking the execution time of this function (for example
+ * for fib(35)), you'll notice that OTCC is quite fast because it
+ * generates native i386 machine code.  
+ */
+fib(n)
+{
+    if (n <= 2)
+        return 1;
+    else
+        return fib(n-1) + fib(n-2);
+}
+
+/* Identifiers are parsed the same way as C: begins with letter or
+   '_', and then letters, '_' or digits */
+fact(n)
+{
+    /* local variables can be declared. Only 'int' type is supported */
+    int i, r;
+    r = 1;
+    /* 'while' and 'for' loops are supported */
+    for(i=2;i<=n;i++)
+        r = r * i;
+    return r;
+}
+
+/* Well, we could use printf, but it would be too easy */
+print_num(n, b)
+{
+    int tab, p, c;
+    /* Numbers can be entered in decimal, hexadecimal ('0x' prefix) and
+       octal ('0' prefix) */
+    /* more complex programs use malloc */
+    tab = malloc(0x100); 
+    p = tab;
+    while (1) {
+        c = n % b;
+        /* Character constants can be used */
+        if (c >= 10)
+            c = c + 'a' - 10;
+        else
+            c = c + '0';
+        *(char *)p = c;
+        p++;
+        n = n / b;
+        /* 'break' is supported */
+        if (n == 0)
+            break;
+    }
+    while (p != tab) {
+        p--;
+        printf("%c", *(char *)p);
+    }
+    free(tab);
+}
+
+/* 'main' takes standard 'argc' and 'argv' parameters */
+main(argc, argv)
+{
+    /* no local name space is supported, but local variables ARE
+       supported. As long as you do not use a globally defined
+       variable name as local variable (which is a bad habbit), you
+       won't have any problem */
+    int s, n, f, base;
+    
+    /* && and || operator have the same semantics as C (left to right
+       evaluation and early exit) */
+    if (argc != 2 && argc != 3) {
+        /* '*' operator is supported with explicit casting to 'int *',
+           'char *' or 'int (*)()' (function pointer). Of course, 'int'
+           are supposed to be used as pointers too. */
+        s = *(int *)argv;
+        help(s);
+        return 1;
+    }
+    /* Any libc function can be used because OTCC uses dynamic linking */
+    n = atoi(*(int *)(argv + 4));
+    base = DEFAULT_BASE;
+    if (argc >= 3) {
+        base = atoi(*(int *)(argv + 8));
+        if (base < 2 || base > 36) {
+            /* external variables can be used too (here: 'stderr') */
+            fprintf(stderr, "Invalid base\n");
+            return 1;
+        }
+    }
+    printf("fib(%d) = ", n);
+    print_num(fib(n), base);
+    printf("\n");
+
+    printf("fact(%d) = ", n);
+    if (n > 12) {
+        printf("Overflow");
+    } else {
+        /* why not using a function pointer ? */
+        f = &fact;
+        print_num((*(int (*)())f)(n), base);
+    }
+    printf("\n");
+    return 0;
+}
+
+/* functions can be used before being defined */
+help(name)
+{
+    printf("usage: %s n [base]\n", name);
+    printf("Compute fib(n) and fact(n) and output the result in base 'base'\n");
+}
+
diff --git a/libacc/tests/expr.c b/libacc/tests/expr.c
new file mode 100644
index 000000000..4f2d2e78f
--- /dev/null
+++ b/libacc/tests/expr.c
@@ -0,0 +1,60 @@
+/* Test operators */
+
+testInc() { int a, b; a = 3; b = a++; printf("3++ = %d %d\n", b, a); }
+testDec() { int a, b; a = 3; b = a--; printf("3-- = %d %d\n", b, a); }
+testTimes(){ printf("%d * %d = %d\n", 10, 4, 10 * 4); }
+testDiv(){ printf("%d / %d = %d\n", 11, 4, 11 / 4); }
+testMod(){ printf("%d %% %d = %d\n", 11, 4, 11 % 4); }
+testPlus(){ printf("%d + %d = %d\n", 10, 4, 10 + 4); }
+testMinus(){ printf("%d - %d = %d\n", 10, 4, 10 - 4); }
+testShiftLeft(){ printf("%d << %d = %d\n", 10, 4, 10 << 4); }
+testShiftRight(){ printf("%d >> %d = %d\n", 100, 4, 100 >> 4); }
+testLess(){ printf("%d < %d = %d\n", 10, 4, 10 < 4); }
+testLesEqual(){ printf("%d <= %d = %d\n", 10, 4, 10 <= 4); }
+testGreater(){ printf("%d > %d = %d\n", 10, 4, 10 > 4); }
+testGreaterEqual(){ printf("%d >= %d = %d\n", 10, 4, 10 >= 4); }
+testEqualTo(){ printf("%d == %d = %d\n", 10, 4, 10 == 4); }
+testNotEqualTo(){ printf("%d != %d = %d\n", 10, 4, 10 != 4); }
+testBitAnd(){ printf("%d & %d = %d\n", 10, 7, 10 & 7); }
+testBitXor(){ printf("%d ^ %d = %d\n", 10, 7, 10 ^ 7); }
+testBitOr(){ printf("%d | %d = %d\n", 10, 4, 10 | 4); }
+testAssignment(){ int a, b; a = 3; b = a; printf("b == %d\n", b); }
+testLogicalAnd(){ printf("%d && %d = %d\n", 10, 4, 10 && 4); }
+testLogicalOr(){ printf("%d || %d = %d\n", 10, 4, 10 || 4); }
+testAddressOf(){ int a; printf("&a is %d\n", &a); }
+testPointerIndirection(){ int a, b; a = &b; b = 17; printf("*%d  = %d =?= %d\n", a, * (int*) a, b); }
+testNegation(){ printf("-%d = %d\n", 10, -10); }
+testUnaryPlus(){ printf("+%d = %d\n", 10, +10); }
+testUnaryNot(){ printf("!%d = %d\n", 10, !10); }
+testBitNot(){ printf("~%d = %d\n", 10, ~10); }
+
+main(a,b) {
+    testInc();
+    testDec();
+    testTimes();
+    testDiv();
+    testMod();
+    testPlus();
+    testMinus();
+    testShiftLeft();
+    testShiftRight();
+    testLess();
+    testLesEqual();
+    testGreater();
+    testGreaterEqual();
+    testEqualTo();
+    testNotEqualTo();
+    testBitAnd();
+    testBinXor();
+    testBitOr();
+    testAssignment();
+    testLogicalAnd();
+    testLogicalOr();
+    testAddressOf();
+    testPointerIndirection();
+    testNegation();
+    testUnaryPlus();
+    testUnaryNot();
+    testBitNot();
+    return 0;
+}
\ No newline at end of file
diff --git a/libacc/tests/hello.c b/libacc/tests/hello.c
new file mode 100644
index 000000000..585ce6cad
--- /dev/null
+++ b/libacc/tests/hello.c
@@ -0,0 +1,3 @@
+main(a,b) {
+    printf("Hello, world\n");
+}
diff --git a/libacc/tests/hello.out-orig b/libacc/tests/hello.out-orig
new file mode 100644
index 000000000..1fb7bf5cf
Binary files /dev/null and b/libacc/tests/hello.out-orig differ
diff --git a/libacc/tests/missing-main.c b/libacc/tests/missing-main.c
new file mode 100644
index 000000000..e73eec461
--- /dev/null
+++ b/libacc/tests/missing-main.c
@@ -0,0 +1,4 @@
+/* No main. */
+
+a() {
+}
\ No newline at end of file
diff --git a/libacc/tests/otcc.c b/libacc/tests/otcc.c
new file mode 100644
index 000000000..577fcf37c
--- /dev/null
+++ b/libacc/tests/otcc.c
@@ -0,0 +1,446 @@
+#include <stdio.h>
+#define k *(int*)
+#define a if(
+#define c ad()
+#define i else
+#define p while(
+#define x *(char*)
+#define b ==
+#define V =calloc(1,99999)
+#define f ()
+#define J return
+#define l ae(
+#define n e)
+#define u d!=
+#define F int 
+#define y (j)
+#define r m=
+#define t +4
+F d,z,C,h,P,K,ac,q,G,v,Q,R,D,L,W,M;
+E(n{
+x D++=e;
+}
+o f{
+a L){
+h=x L++;
+a h b 2){
+L=0;
+h=W;
+}
+}
+i h=fgetc(Q);
+}
+X f{
+J isalnum(h)|h b 95;
+}
+Y f{
+a h b 92){
+o f;
+a h b 110)h=10;
+}
+}
+c{
+F e,j,m;
+p isspace(h)|h b 35){
+a h b 35){
+o f;
+c;
+a d b 536){
+c;
+E(32);
+k d=1;
+k(d t)=D;
+}
+p h!=10){
+E(h);
+o f;
+}
+E(h);
+E(2);
+}
+o f;
+}
+C=0;
+d=h;
+a X f){
+E(32);
+M=D;
+p X f){
+E(h);
+o f;
+}
+a isdigit(d)){
+z=strtol(M,0,0);
+d=2;
+}
+i{
+x D=32;
+d=strstr(R,M-1)-R;
+x D=0;
+d=d*8+256;
+a d>536){
+d=P+d;
+a k d b 1){
+L=k(d t);
+W=h;
+o f;
+c;
+}
+}
+}
+}
+i{
+o f;
+a d b 39){
+d=2;
+Y f;
+z=h;
+o f;
+o f;
+}
+i a d b 47&h b 42){
+o f;
+p h){
+p h!=42)o f;
+o f;
+a h b 47)h=0;
+}
+o f;
+c;
+}
+i{
+e="++#m--%am*@R<^1c/@%[_[H3c%@%[_[H3c+@.B#d-@%:_^BKd<<Z/03e>>`/03e<=0f>=/f<@.f>@1f==&g!='g&&k||#l&@.BCh^@.BSi|@.B+j~@/%Yd!@&d*@b";
+p j=x e++){
+r x e++;
+z=0;
+p(C=x e++-98)<0)z=z*64+C+64;
+a j b d&(m b h|m b 64)){
+a m b h){
+o f;
+d=1;
+}
+break;
+}
+}
+}
+}
+}
+l g){
+p g&&g!=-1){
+x q++=g;
+g=g>>8;
+}
+}
+A(n{
+F g;
+p n{
+g=k e;
+k e=q-e-4;
+e=g;
+}
+}
+s(g,n{
+l g);
+k q=e;
+e=q;
+q=q t;
+J e;
+}
+H(n{
+s(184,n;
+}
+B(n{
+J s(233,n;
+}
+S(j,n{
+l 1032325);
+J s(132+j,n;
+}
+Z(n{
+l 49465);
+H(0);
+l 15);
+l e+144);
+l 192);
+}
+N(j,n{
+l j+131);
+s((e<512)<<7|5,n;
+}
+T y{
+F g,e,m,aa;
+g=1;
+a d b 34){
+H(v);
+p h!=34){
+Y f;
+x v++=h;
+o f;
+}
+x v=0;
+v=v t&-4;
+o f;
+c;
+}
+i{
+aa=C;
+r z;
+e=d;
+c;
+a e b 2){
+H(m);
+}
+i a aa b 2){
+T(0);
+s(185,0);
+a e b 33)Z(m);
+i l m);
+}
+i a e b 40){
+w f;
+c;
+}
+i a e b 42){
+c;
+e=d;
+c;
+c;
+a d b 42){
+c;
+c;
+c;
+c;
+e=0;
+}
+c;
+T(0);
+a d b 61){
+c;
+l 80);
+w f;
+l 89);
+l 392+(e b 256));
+}
+i a n{
+a e b 256)l 139);
+i l 48655);
+q++;
+}
+}
+i a e b 38){
+N(10,k d);
+c;
+}
+i{
+g=k e;
+a!g)g=dlsym(0,M);
+a d b 61&j){
+c;
+w f;
+N(6,g);
+}
+i a u 40){
+N(8,g);
+a C b 11){
+N(0,g);
+l z);
+c;
+}
+}
+}
+}
+a d b 40){
+a g b 1)l 80);
+r s(60545,0);
+c;
+j=0;
+p u 41){
+w f;
+s(2393225,j);
+a d b 44)c;
+j=j t;
+}
+k r j;
+c;
+a!g){
+e=e t;
+k e=s(232,k n;
+}
+i a g b 1){
+s(2397439,j);
+j=j t;
+}
+i{
+s(232,g-q-5);
+}
+a j)s(50305,j);
+}
+}
+O y{
+F e,g,m;
+a j--b 1)T(1);
+i{
+O y;
+r 0;
+p j b C){
+g=d;
+e=z;
+c;
+a j>8){
+r S(e,m);
+O y;
+}
+i{
+l 80);
+O y;
+l 89);
+a j b 4|j b 5){
+Z(n;
+}
+i{
+l n;
+a g b 37)l 146);
+}
+}
+}
+a m&&j>8){
+r S(e,m);
+H(e^1);
+B(5);
+A(m);
+H(n;
+}
+}
+}
+w f{
+O(11);
+}
+U f{
+w f;
+J S(0,0);
+}
+I y{
+F m,g,e;
+a d b 288){
+c;
+c;
+r U f;
+c;
+I y;
+a d b 312){
+c;
+g=B(0);
+A(m);
+I y;
+A(g);
+}
+i{
+A(m);
+}
+}
+i a d b 352|d b 504){
+e=d;
+c;
+c;
+a e b 352){
+g=q;
+r U f;
+}
+i{
+a u 59)w f;
+c;
+g=q;
+r 0;
+a u 59)r U f;
+c;
+a u 41){
+e=B(0);
+w f;
+B(g-q-5);
+A(n;
+g=e t;
+}
+}
+c;
+I(&m);
+B(g-q-5);
+A(m);
+}
+i a d b 123){
+c;
+ab(1);
+p u 125)I y;
+c;
+}
+i{
+a d b 448){
+c;
+a u 59)w f;
+K=B(K);
+}
+i a d b 400){
+c;
+k j=B(k j);
+}
+i a u 59)w f;
+c;
+}
+}
+ab y{
+F m;
+p d b 256|u-1&!j){
+a d b 256){
+c;
+p u 59){
+a j){
+G=G t;
+k d=-G;
+}
+i{
+k d=v;
+v=v t;
+}
+c;
+a d b 44)c;
+}
+c;
+}
+i{
+A(k(d t));
+k d=q;
+c;
+c;
+r 8;
+p u 41){
+k d=m;
+r m t;
+c;
+a d b 44)c;
+}
+c;
+K=G=0;
+l 15042901);
+r s(60545,0);
+I(0);
+A(K);
+l 50121);
+k r G;
+}
+}
+}
+main(g,n{
+Q=stdin;
+a g-->1){
+e=e t;
+Q=fopen(k e,"r");
+}
+D=strcpy(R V," int if else while break return for define main ")+48;
+v V;
+q=ac V;
+P V;
+o f;
+c;
+ab(0);
+J(*(int(*)f)k(P+592))(g,n;
+}
+
diff --git a/libacc/tests/otcc.out-orig b/libacc/tests/otcc.out-orig
new file mode 100644
index 000000000..fa14c72ab
Binary files /dev/null and b/libacc/tests/otcc.out-orig differ
diff --git a/libacc/tests/returnval.c b/libacc/tests/returnval.c
new file mode 100644
index 000000000..3142fe2bd
--- /dev/null
+++ b/libacc/tests/returnval.c
@@ -0,0 +1,3 @@
+main() {
+  return 42;
+}
\ No newline at end of file
diff --git a/libacc/tests/simplest.c b/libacc/tests/simplest.c
new file mode 100644
index 000000000..bae895adc
--- /dev/null
+++ b/libacc/tests/simplest.c
@@ -0,0 +1 @@
+main() {}
diff --git a/libsysutils/Android.mk b/libsysutils/Android.mk
index 0b15c1269..2f3e106ce 100644
--- a/libsysutils/Android.mk
+++ b/libsysutils/Android.mk
@@ -1,14 +1,21 @@
+BUILD_LIBSYSUTILS := false
+ifneq ($(TARGET_SIMULATOR),true)
+    BUILD_LIBSYSUTILS := true
+endif
+
+ifeq ($(BUILD_LIBSYSUTILS),true)
+
 LOCAL_PATH:= $(call my-dir)
 
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES:=                             \
-                  src/FrameworkManager.cpp    \
                   src/SocketListener.cpp      \
                   src/FrameworkListener.cpp   \
                   src/NetlinkListener.cpp     \
                   src/NetlinkEvent.cpp        \
                   src/FrameworkCommand.cpp    \
+                  src/SocketClient.cpp        \
 
 LOCAL_MODULE:= libsysutils
 
@@ -18,4 +25,10 @@ LOCAL_CFLAGS :=
 
 LOCAL_SHARED_LIBRARIES := libcutils
 
+ifeq ($(TARGET_SIMULATOR),true)
+  LOCAL_LDLIBS += -lpthread
+endif
+
 include $(BUILD_SHARED_LIBRARY)
+
+endif
diff --git a/libsysutils/src/FrameworkClient.cpp b/libsysutils/src/FrameworkClient.cpp
new file mode 100644
index 000000000..237bb60f9
--- /dev/null
+++ b/libsysutils/src/FrameworkClient.cpp
@@ -0,0 +1,41 @@
+#include <alloca.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <pthread.h>
+
+#define LOG_TAG "FrameworkClient"
+#include <cutils/log.h>
+
+#include <sysutils/FrameworkClient.h>
+
+FrameworkClient::FrameworkClient(int socket) {
+    mSocket = socket;
+    pthread_mutex_init(&mWriteMutex, NULL);
+}
+
+int FrameworkClient::sendMsg(char *msg) {
+    LOGD("FrameworkClient::sendMsg(%s)", msg);
+    if (mSocket < 0) {
+        errno = EHOSTUNREACH;
+        return -1;
+    }
+
+    pthread_mutex_lock(&mWriteMutex);
+    if (write(mSocket, msg, strlen(msg) +1) < 0) {
+        LOGW("Unable to send msg '%s' (%s)", msg, strerror(errno));
+    }
+    pthread_mutex_unlock(&mWriteMutex);
+    return 0;
+}
+
+int FrameworkClient::sendMsg(char *msg, char *data) {
+    char *buffer = (char *) alloca(strlen(msg) + strlen(data) + 1);
+    if (!buffer) {
+        errno = -ENOMEM;
+        return -1;
+    }
+    strcpy(buffer, msg);
+    strcat(buffer, data);
+    return sendMsg(buffer);
+}
+
diff --git a/libsysutils/src/FrameworkCommand.cpp b/libsysutils/src/FrameworkCommand.cpp
index 0444de5c6..94e7426ca 100644
--- a/libsysutils/src/FrameworkCommand.cpp
+++ b/libsysutils/src/FrameworkCommand.cpp
@@ -25,7 +25,7 @@ FrameworkCommand::FrameworkCommand(const char *cmd) {
     mCommand = cmd;
 }
 
-int FrameworkCommand::runCommand(char *data) {
+int FrameworkCommand::runCommand(SocketClient *c, char *data) {
     LOGW("Command %s has no run handler!", getCommand());
     errno = ENOSYS;
     return -1;
diff --git a/libsysutils/src/FrameworkListener.cpp b/libsysutils/src/FrameworkListener.cpp
index b920215f6..71e077226 100644
--- a/libsysutils/src/FrameworkListener.cpp
+++ b/libsysutils/src/FrameworkListener.cpp
@@ -22,17 +22,18 @@
 
 #include <sysutils/FrameworkListener.h>
 #include <sysutils/FrameworkCommand.h>
+#include <sysutils/SocketClient.h>
 
 FrameworkListener::FrameworkListener(const char *socketName) :
                             SocketListener(socketName, true) {
     mCommands = new FrameworkCommandCollection();
 }
 
-bool FrameworkListener::onDataAvailable(int socket) {
-    char buffer[101];
+bool FrameworkListener::onDataAvailable(SocketClient *c) {
+    char buffer[255];
     int len;
 
-    if ((len = read(socket, buffer, sizeof(buffer) -1)) < 0) {
+    if ((len = read(c->getSocket(), buffer, sizeof(buffer) -1)) < 0) {
         LOGE("read() failed (%s)", strerror(errno));
         return errno;
     } else if (!len) {
@@ -40,15 +41,14 @@ bool FrameworkListener::onDataAvailable(int socket) {
         return false;
     }
 
-    int start = 0;
+    int offset = 0;
     int i;
 
-    buffer[len] = '\0';
-
     for (i = 0; i < len; i++) {
-        if (buffer[i] == '\0') {
-            dispatchCommand(buffer + start);
-            start = i + 1;
+        if (buffer[i] == '\n') {
+            buffer[i] = '\0';
+            dispatchCommand(c, buffer + offset);
+            offset = i + 1;
         }
     }
     return true;
@@ -58,20 +58,28 @@ void FrameworkListener::registerCmd(FrameworkCommand *cmd) {
     mCommands->push_back(cmd);
 }
 
-void FrameworkListener::dispatchCommand(char *cmd) {
+void FrameworkListener::dispatchCommand(SocketClient *cli, char *cmd) {
+    char *cm, *last;
+
+    if (!(cm = strtok_r(cmd, ":", &last))) {
+        cli->sendMsg(500, "Malformatted message", false);
+        return;
+    }
+
     FrameworkCommandCollection::iterator i;
 
     for (i = mCommands->begin(); i != mCommands->end(); ++i) {
         FrameworkCommand *c = *i;
 
-        if (!strncmp(cmd, c->getCommand(), strlen(c->getCommand()))) {
-            if (c->runCommand(cmd)) {
+        if (!strcmp(cm, c->getCommand())) {
+            cm += strlen(cm) +1;
+            if (c->runCommand(cli, cm)) {
                 LOGW("Handler '%s' error (%s)", c->getCommand(), strerror(errno));
             }
             return;
         }
     }
 
-    LOGE("No cmd handlers defined for '%s'", cmd);
+    cli->sendMsg(500, "Command not recognized", false);
+    return;
 }
-
diff --git a/libsysutils/src/FrameworkManager.cpp b/libsysutils/src/FrameworkManager.cpp
deleted file mode 100644
index 5dceb9f15..000000000
--- a/libsysutils/src/FrameworkManager.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <stdio.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <sys/socket.h>
-#include <sys/select.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/un.h>
-
-#include <cutils/config_utils.h>
-#include <cutils/cpu_info.h>
-#include <cutils/properties.h>
-#include <cutils/sockets.h>
-
-#define LOG_TAG "FrameworkManager"
-#include <cutils/log.h>
-
-#include <sysutils/FrameworkManager.h>
-#include <sysutils/FrameworkListener.h>
-
-FrameworkManager::FrameworkManager(FrameworkListener *Listener) {
-    mDoorbell = -1;
-    mFwSock = -1;
-    mListener = Listener;
-
-    pthread_mutex_init(&mWriteMutex, NULL);
-}
-
-int FrameworkManager::run() {
-
-    if (mListener->run()) {
-        LOGE("Error running listener (%s)", strerror(errno));
-        return -1;
-    }
-
-    return 0;
-}
-
-/* ========
- * Privates
- * ========
- */
-
-int FrameworkManager::sendMsg(char *msg) {
-    LOGD("FrameworkManager::sendMsg(%s)", msg);
-    if (mFwSock < 0) {
-        errno = EHOSTUNREACH;
-        return -1;
-    }
-
-    pthread_mutex_lock(&mWriteMutex);
-    if (write(mFwSock, msg, strlen(msg) +1) < 0) {
-        LOGW("Unable to send msg '%s' (%s)", msg, strerror(errno));
-    }
-    pthread_mutex_unlock(&mWriteMutex);
-    return 0;
-}
-
-int FrameworkManager::sendMsg(char *msg, char *data) {
-    char *buffer = (char *) alloca(strlen(msg) + strlen(data) + 1);
-    if (!buffer) {
-        errno = -ENOMEM;
-        return -1;
-    }
-    strcpy(buffer, msg);
-    strcat(buffer, data);
-    return sendMsg(buffer);
-}
diff --git a/libsysutils/src/NetlinkListener.cpp b/libsysutils/src/NetlinkListener.cpp
index 96a616dee..3ec9d9dfd 100644
--- a/libsysutils/src/NetlinkListener.cpp
+++ b/libsysutils/src/NetlinkListener.cpp
@@ -29,8 +29,9 @@ NetlinkListener::NetlinkListener(int socket) :
                             SocketListener(socket, false) {
 }
 
-bool NetlinkListener::onDataAvailable(int socket)
+bool NetlinkListener::onDataAvailable(SocketClient *cli)
 {
+    int socket = cli->getSocket();
     LOGD("NetlinkListener::onDataAvailable()");
 
     int count;
diff --git a/libsysutils/src/SocketClient.cpp b/libsysutils/src/SocketClient.cpp
new file mode 100644
index 000000000..ab020ca7b
--- /dev/null
+++ b/libsysutils/src/SocketClient.cpp
@@ -0,0 +1,66 @@
+#include <alloca.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <pthread.h>
+#include <string.h>
+
+#define LOG_TAG "SocketClient"
+#include <cutils/log.h>
+
+#include <sysutils/SocketClient.h>
+
+SocketClient::SocketClient(int socket) {
+    mSocket = socket;
+    pthread_mutex_init(&mWriteMutex, NULL);
+}
+
+int SocketClient::sendMsg(int code, char *msg, bool addErrno) {
+    char *buf;
+    
+    if (addErrno) {
+        buf = (char *) alloca(strlen(msg) + strlen(strerror(errno)) + 8);
+        sprintf(buf, "%.3d %s (%s)", code, msg, strerror(errno));
+    } else {
+        buf = (char *) alloca(strlen(msg) + strlen("XXX "));
+        sprintf(buf, "%.3d %s", code, msg);
+    }
+    return sendMsg(buf);
+}
+
+int SocketClient::sendMsg(char *msg) {
+    if (mSocket < 0) {
+        errno = EHOSTUNREACH;
+        return -1;
+    }
+
+    char *bp;
+  
+    if (msg[strlen(msg)] != '\n') {
+        bp = (char *) alloca(strlen(msg) + 1);
+        strcpy(bp, msg);
+        strcat(bp, "\n");
+    } else
+        bp = msg;
+       
+    int rc = 0;
+    char *p = bp;
+    int brtw = strlen(bp);
+
+    pthread_mutex_lock(&mWriteMutex);
+    while(brtw) {
+        if ((rc = write(mSocket,p, brtw)) < 0) {
+            LOGW("Unable to send msg '%s' (%s)", msg, strerror(errno));
+            pthread_mutex_unlock(&mWriteMutex);
+            return -1;
+        } else if (!rc) {
+            LOGW("0 length write :(");
+            errno = EIO;
+            pthread_mutex_unlock(&mWriteMutex);
+            return -1;
+        }
+        p += rc;
+        brtw -= rc;
+    }
+    pthread_mutex_unlock(&mWriteMutex);
+    return 0;
+}
diff --git a/libsysutils/src/SocketListener.cpp b/libsysutils/src/SocketListener.cpp
index f92e30d78..acc4a67df 100644
--- a/libsysutils/src/SocketListener.cpp
+++ b/libsysutils/src/SocketListener.cpp
@@ -24,26 +24,28 @@
 
 #define LOG_TAG "SocketListener"
 #include <cutils/log.h>
-
 #include <cutils/sockets.h>
 
 #include <sysutils/SocketListener.h>
+#include <sysutils/SocketClient.h>
 
-SocketListener::SocketListener(const char *socketName, bool acceptClients) {
-    mAcceptClients = acceptClients;
-    mCsock = -1;
+SocketListener::SocketListener(const char *socketName, bool listen) {
+    mListen = listen;
     mSocketName = socketName;
     mSock = -1;
+    pthread_mutex_init(&mClientsLock, NULL);
+    mClients = new SocketClientCollection();
 }
 
-SocketListener::SocketListener(int socketFd, bool acceptClients) {
-    mAcceptClients = acceptClients;
-    mCsock = -1;
+SocketListener::SocketListener(int socketFd, bool listen) {
+    mListen = listen;
     mSocketName = NULL;
     mSock = socketFd;
+    pthread_mutex_init(&mClientsLock, NULL);
+    mClients = new SocketClientCollection();
 }
 
-int SocketListener::run() {
+int SocketListener::startListener() {
 
     if (!mSocketName && mSock == -1) {
         errno = EINVAL;
@@ -56,72 +58,141 @@ int SocketListener::run() {
         }
     }
 
-    if (mAcceptClients) {
-        if (listen(mSock, 4) < 0) {
-            LOGE("Unable to listen on socket (%s)", strerror(errno));
-            return -1;
-        }
-    }
+    if (mListen && listen(mSock, 4) < 0) {
+        LOGE("Unable to listen on socket (%s)", strerror(errno));
+        return -1;
+    } else if (!mListen)
+        mClients->push_back(new SocketClient(mSock));
 
-    while(1) {
-        fd_set read_fds;
-        struct timeval to;
-        int max = 0;
-        int rc = 0;
+    if (pipe(mCtrlPipe))
+        return -1;
 
-        to.tv_sec = 60 * 60;
-        to.tv_usec = 0;
+    if (pthread_create(&mThread, NULL, SocketListener::threadStart, this))
+        return -1;
 
-        FD_ZERO(&read_fds);
-
-        if ((mAcceptClients == false) ||
-            (mAcceptClients == true && mCsock == -1)) {
-            FD_SET(mSock, &read_fds);
-            max = mSock;
-        } else if (mCsock != -1) {
-            FD_SET(mCsock, &read_fds);
-            max = mCsock;
-        }
-
-        if ((rc = select(max + 1, &read_fds, NULL, NULL, &to)) < 0) {
-            LOGE("select failed (%s)", strerror(errno));
-            return -errno;
-        } else if (!rc)
-            continue;
-        else if (FD_ISSET(mSock, &read_fds)) {
-            /*
-             * If we're accepting client connections then 
-             * accept and gobble the event. Otherwise
-             * pass it on to the handlers.
-             */
-            if (mAcceptClients) {
-                struct sockaddr addr;
-                socklen_t alen = sizeof(addr);
-
-                if ((mCsock = accept(mSock, &addr, &alen)) < 0) {
-                    LOGE("accept failed (%s)", strerror(errno));
-                    return -errno;
-                }
-                LOGD("SocketListener client connection accepted");
-            } else if (!onDataAvailable(mSock)) {
-                LOGW("SocketListener closing listening socket (Will shut down)");
-                close(mSock);
-                return -ESHUTDOWN;
-            }
-        } else if ((FD_ISSET(mCsock, &read_fds)) &&
-                   !onDataAvailable(mCsock)) {
-                /*
-                 * Once mCsock == -1, we'll start
-                 * accepting connections on mSock again.
-                 */
-                LOGD("SocketListener closing client socket");
-                close(mCsock);
-                mCsock = -1;
-            }
-    }
     return 0;
 }
 
-bool SocketListener::onDataAvailable(int socket) {
-    return false;
+int SocketListener::stopListener() {
+    char c = 0;
+
+    if (write(mCtrlPipe[1], &c, 1) != 1) {
+        LOGE("Error writing to control pipe (%s)", strerror(errno));
+        return -1;
+    }
+
+    void *ret;
+    if (pthread_join(mThread, &ret)) {
+        LOGE("Error joining to listener thread (%s)", strerror(errno));
+        return -1;
+    }
+    close(mCtrlPipe[0]);
+    close(mCtrlPipe[1]);
+    return 0;
+}
+
+void *SocketListener::threadStart(void *obj) {
+    SocketListener *me = reinterpret_cast<SocketListener *>(obj);
+
+    me->runListener();
+    pthread_exit(NULL);
+    return NULL;
+}
+
+void SocketListener::runListener() {
+
+    while(1) {
+        SocketClientCollection::iterator it;
+        fd_set read_fds;
+        int rc = 0;
+        int max = 0;
+
+        FD_ZERO(&read_fds);
+
+        if (mListen) {
+            max = mSock;
+            FD_SET(mSock, &read_fds);
+        }
+
+        FD_SET(mCtrlPipe[0], &read_fds);
+        if (mCtrlPipe[0] > max)
+            max = mCtrlPipe[0];
+
+        pthread_mutex_lock(&mClientsLock);
+        for (it = mClients->begin(); it != mClients->end(); ++it) {
+            FD_SET((*it)->getSocket(), &read_fds);
+            if ((*it)->getSocket() > max)
+                max = (*it)->getSocket();
+        }
+        pthread_mutex_unlock(&mClientsLock);
+        
+        if ((rc = select(max + 1, &read_fds, NULL, NULL, NULL)) < 0) {
+            LOGE("select failed (%s)", strerror(errno));
+            sleep(1);
+            continue;
+        } else if (!rc)
+            continue;
+
+        if (FD_ISSET(mCtrlPipe[0], &read_fds))
+            break;
+        if (mListen && FD_ISSET(mSock, &read_fds)) {
+            struct sockaddr addr;
+            socklen_t alen = sizeof(addr);
+            int c;
+
+            if ((c = accept(mSock, &addr, &alen)) < 0) {
+                LOGE("accept failed (%s)", strerror(errno));
+                sleep(1);
+                continue;
+            }
+            pthread_mutex_lock(&mClientsLock);
+            mClients->push_back(new SocketClient(c));
+            pthread_mutex_unlock(&mClientsLock);
+        }
+
+        do {
+            pthread_mutex_lock(&mClientsLock);
+            for (it = mClients->begin(); it != mClients->end(); ++it) {
+                int fd = (*it)->getSocket();
+                if (FD_ISSET(fd, &read_fds)) {
+                    pthread_mutex_unlock(&mClientsLock);
+                    if (!onDataAvailable(*it)) {
+                        LOGD("SocketListener closing client socket");
+                        close(fd);
+                        pthread_mutex_lock(&mClientsLock);
+                        delete *it;
+                        it = mClients->erase(it);
+                        pthread_mutex_unlock(&mClientsLock);
+                    }
+                    FD_CLR(fd, &read_fds);
+                    continue;
+                }
+            }
+            pthread_mutex_unlock(&mClientsLock);
+        } while (0);
+    }
+}
+
+void SocketListener::sendBroadcast(int code, char *msg, bool addErrno) {
+    pthread_mutex_lock(&mClientsLock);
+    SocketClientCollection::iterator i;
+
+    for (i = mClients->begin(); i != mClients->end(); ++i) {
+        if ((*i)->sendMsg(code, msg, addErrno)) {
+            LOGW("Error sending broadcast (%s)", strerror(errno));
+        }
+    }
+    pthread_mutex_unlock(&mClientsLock);
+}
+
+void SocketListener::sendBroadcast(char *msg) {
+    pthread_mutex_lock(&mClientsLock);
+    SocketClientCollection::iterator i;
+
+    for (i = mClients->begin(); i != mClients->end(); ++i) {
+        if ((*i)->sendMsg(msg)) {
+            LOGW("Error sending broadcast (%s)", strerror(errno));
+        }
+    }
+    pthread_mutex_unlock(&mClientsLock);
 }
diff --git a/nexus/Android.mk b/nexus/Android.mk
index e76cb27e7..df170b81c 100644
--- a/nexus/Android.mk
+++ b/nexus/Android.mk
@@ -19,6 +19,9 @@ LOCAL_SRC_FILES:=                          \
                   SupplicantListener.cpp   \
                   VpnController.cpp        \
                   ScanResult.cpp           \
+                  WifiScanner.cpp          \
+                  WifiNetwork.cpp          \
+                  OpenVpnController.cpp    \
 
 LOCAL_MODULE:= nexus
 
diff --git a/nexus/CommandListener.cpp b/nexus/CommandListener.cpp
index cdb1db51f..d9ee971c9 100644
--- a/nexus/CommandListener.cpp
+++ b/nexus/CommandListener.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 The Android Open Source Project
+ * Copyright (C) ErrorCode::CommandOkay8 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,106 +19,258 @@
 #define LOG_TAG "CommandListener"
 #include <cutils/log.h>
 
+#include <sysutils/SocketClient.h>
+
 #include "CommandListener.h"
 #include "Controller.h"
 #include "NetworkManager.h"
 #include "WifiController.h"
+#include "ErrorCode.h"
 
-CommandListener::CommandListener(NetworkManager *netman) :
+CommandListener::CommandListener() :
                  FrameworkListener("nexus") {
-    mNetman = netman;
+    registerCmd(new WifiEnableCmd());
+    registerCmd(new WifiDisableCmd());
+    registerCmd(new WifiScanCmd());
+    registerCmd(new WifiScanResultsCmd());
+    registerCmd(new WifiListNetworksCmd());
+    registerCmd(new WifiAddNetworkCmd());
+    registerCmd(new WifiRemoveNetworkCmd());
+    registerCmd(new WifiSetVarCmd());
+    registerCmd(new WifiGetVarCmd());
 
-    registerCmd(new WifiEnableCmd(netman));
-    registerCmd(new WifiDisableCmd(netman));
-    registerCmd(new WifiScanCmd(netman));
-
-    registerCmd(new VpnEnableCmd(netman));
-    registerCmd(new VpnDisableCmd(netman));
+    registerCmd(new VpnEnableCmd());
+    registerCmd(new VpnDisableCmd());
 }
  
 /* -------------
  * Wifi Commands
  * ------------ */
 
-CommandListener::WifiEnableCmd::WifiEnableCmd(NetworkManager *netman) :
-                 NexusCommand("wifi_enable", netman) {
+CommandListener::WifiEnableCmd::WifiEnableCmd() :
+                 NexusCommand("wifi_enable") {
 } 
                
-int CommandListener::WifiEnableCmd::runCommand(char *data) {
-    Controller *c = mNetman->findController("WIFI");
-    char buffer[32];
+int CommandListener::WifiEnableCmd::runCommand(SocketClient *cli, char *data) {
+    Controller *c = NetworkManager::Instance()->findController("WIFI");
 
-    sprintf(buffer, "WIFI_ENABLE:%d", (c->enable() ? errno : 0));
-    mNetman->getFrameworkManager()->sendMsg(buffer);
+    if (c->enable())
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to enable wifi", true);
+    else
+        cli->sendMsg(ErrorCode::CommandOkay, "Wifi Enabled", false);
     return 0;
 }
 
-CommandListener::WifiDisableCmd::WifiDisableCmd(NetworkManager *netman) :
-                 NexusCommand("wifi_disable", netman) {
+CommandListener::WifiDisableCmd::WifiDisableCmd() :
+                 NexusCommand("wifi_disable") {
 } 
                
-int CommandListener::WifiDisableCmd::runCommand(char *data) {
-    Controller *c = mNetman->findController("WIFI");
-    char buffer[32];
+int CommandListener::WifiDisableCmd::runCommand(SocketClient *cli, char *data) {
+    Controller *c = NetworkManager::Instance()->findController("WIFI");
 
-    sprintf(buffer, "WIFI_DISABLE:%d", (c->disable() ? errno : 0));
-    mNetman->getFrameworkManager()->sendMsg(buffer);
+    if (c->disable())
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to disable wifi", true);
+    else
+        cli->sendMsg(ErrorCode::CommandOkay, "Wifi Disabled", false);
     return 0;
 }
 
-CommandListener::WifiScanCmd::WifiScanCmd(NetworkManager *netman) :
-                 NexusCommand("wifi_scan", netman) {
+CommandListener::WifiAddNetworkCmd::WifiAddNetworkCmd() :
+                 NexusCommand("wifi_add_network") {
+} 
+               
+int CommandListener::WifiAddNetworkCmd::runCommand(SocketClient *cli, char *data) {
+    NetworkManager *nm = NetworkManager::Instance();
+    WifiController *wc = (WifiController *) nm->findController("WIFI");
+    int networkId;
+
+    if ((networkId = wc->addNetwork()) < 0)
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to add network", true);
+    else {
+        char tmp[128];
+        sprintf(tmp, "Added network id %d.", networkId);
+        cli->sendMsg(ErrorCode::CommandOkay, tmp, false);
+    }
+    return 0;
+}
+
+CommandListener::WifiRemoveNetworkCmd::WifiRemoveNetworkCmd() :
+                 NexusCommand("wifi_remove_network") {
+} 
+               
+int CommandListener::WifiRemoveNetworkCmd::runCommand(SocketClient *cli, char *data) {
+    NetworkManager *nm = NetworkManager::Instance();
+    WifiController *wc = (WifiController *) nm->findController("WIFI");
+
+    if (wc->removeNetwork(atoi(data)))
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to remove network", true);
+    else {
+        cli->sendMsg(ErrorCode::CommandOkay, "Network removed.", false);
+    }
+    return 0;
+}
+
+CommandListener::WifiScanCmd::WifiScanCmd() :
+                 NexusCommand("wifi_scan") {
 } 
 
-int CommandListener::WifiScanCmd::runCommand(char *data) {
-    LOGD("WifiScanCmd(%s)", data);
-    WifiController *wc = (WifiController *) mNetman->findController("WIFI");
-    char buffer[32];
-    int mode = 0;
-    char *bword, *last;
+int CommandListener::WifiScanCmd::runCommand(SocketClient *cli, char *data) {
+    WifiController *wc = (WifiController *) NetworkManager::Instance()->findController("WIFI");
 
-    if (!(bword = strtok_r(data, ":", &last))) {
-        errno = EINVAL;
-        return -1;
+    if (wc->setScanMode(atoi(data)))
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to set scan mode", true);
+    else
+        cli->sendMsg(ErrorCode::CommandOkay, "Scan mode set", false);
+
+    return 0;
+}
+
+CommandListener::WifiScanResultsCmd::WifiScanResultsCmd() :
+                 NexusCommand("wifi_scan_results") {
+} 
+
+int CommandListener::WifiScanResultsCmd::runCommand(SocketClient *cli, char *data) {
+    NetworkManager *nm = NetworkManager::Instance();
+    WifiController *wc = (WifiController *) nm->findController("WIFI");
+
+    ScanResultCollection *src = wc->createScanResults();
+    ScanResultCollection::iterator it;
+    char buffer[256];
+    
+    for(it = src->begin(); it != src->end(); ++it) {
+        sprintf(buffer, "%s:%u:%d:%s:%s",
+                (*it)->getBssid(), (*it)->getFreq(), (*it)->getLevel(),
+                (*it)->getFlags(), (*it)->getSsid());
+        cli->sendMsg(ErrorCode::WifiScanResult, buffer, false);
+        delete (*it);
+        it = src->erase(it);
     }
 
-    if (!(bword = strtok_r(NULL, ":", &last))) {
-        errno = EINVAL;
-        return -1;
+    delete src;
+    cli->sendMsg(ErrorCode::CommandOkay, "Scan results complete", false);
+    return 0;
+}
+
+CommandListener::WifiListNetworksCmd::WifiListNetworksCmd() :
+                 NexusCommand("wifi_list_networks") {
+} 
+
+int CommandListener::WifiListNetworksCmd::runCommand(SocketClient *cli, char *data) {
+    NetworkManager *nm = NetworkManager::Instance();
+    WifiController *wc = (WifiController *) nm->findController("WIFI");
+
+    WifiNetworkCollection *src = wc->createNetworkList();
+    WifiNetworkCollection::iterator it;
+    char buffer[256];
+    
+    for(it = src->begin(); it != src->end(); ++it) {
+        sprintf(buffer, "%d:%s", (*it)->getNetworkId(), (*it)->getSsid());
+        cli->sendMsg(ErrorCode::WifiNetworkList, buffer, false);
+        delete (*it);
+        it = src->erase(it);
     }
 
-    mode = atoi(bword);
+    delete src;
+    cli->sendMsg(ErrorCode::CommandOkay, "Network listing complete.", false);
+    return 0;
+}
 
-    sprintf(buffer, "WIFI_SCAN:%d", (wc->setScanMode(mode) ? errno : 0));
-    mNetman->getFrameworkManager()->sendMsg(buffer);
+CommandListener::WifiSetVarCmd::WifiSetVarCmd() :
+                 NexusCommand("wifi_setvar") {
+} 
+
+int CommandListener::WifiSetVarCmd::runCommand(SocketClient *cli, char *data) {
+    WifiController *wc = (WifiController *) NetworkManager::Instance()->findController("WIFI");
+
+    char *bword;
+    char *last;
+    char varname[32];
+    char val[250];
+    int networkId;
+
+    if (!(bword = strtok_r(data, ":", &last)))
+        goto out_inval;
+
+    networkId = atoi(bword);
+   
+    if (!(bword = strtok_r(NULL, ":", &last)))
+        goto out_inval;
+
+    strncpy(varname, bword, sizeof(varname));
+
+    if (!(bword = strtok_r(NULL, ":", &last)))
+        goto out_inval;
+
+    strncpy(val, bword, sizeof(val));
+
+    LOGD("Network id %d, varname '%s', value '%s'", networkId, varname, val);
+
+    return 0;
+
+out_inval:
+    errno = EINVAL;
+    cli->sendMsg(ErrorCode::CommandParameterError, "Failed to set variable.", true);
+    return 0;
+}
+
+CommandListener::WifiGetVarCmd::WifiGetVarCmd() :
+                 NexusCommand("wifi_getvar") {
+} 
+
+int CommandListener::WifiGetVarCmd::runCommand(SocketClient *cli, char *data) {
+    WifiController *wc = (WifiController *) NetworkManager::Instance()->findController("WIFI");
+
+    char *bword;
+    char *last;
+    char varname[32];
+    int networkId;
+
+    if (!(bword = strtok_r(data, ":", &last)))
+        goto out_inval;
+   
+    networkId = atoi(bword);
+
+    if (!(bword = strtok_r(NULL, ":", &last)))
+        goto out_inval;
+
+    strncpy(varname, bword, sizeof(varname));
+
+    LOGD("networkId = %d, varname '%s'", networkId, varname);
+
+    return 0;
+out_inval:
+    errno = EINVAL;
+    cli->sendMsg(ErrorCode::CommandParameterError, "Failed to get variable.", true);
     return 0;
 }
 
 /* ------------
  * Vpn Commands
  * ------------ */
-CommandListener::VpnEnableCmd::VpnEnableCmd(NetworkManager *netman) :
-                 NexusCommand("vpn_enable", netman) {
+CommandListener::VpnEnableCmd::VpnEnableCmd() :
+                 NexusCommand("vpn_enable") {
 } 
                
-int CommandListener::VpnEnableCmd::runCommand(char *data) {
-    Controller *c = mNetman->findController("VPN");
-    char buffer[32];
+int CommandListener::VpnEnableCmd::runCommand(SocketClient *cli, char *data) {
+    Controller *c = NetworkManager::Instance()->findController("VPN");
 
-    sprintf(buffer, "VPN_ENABLE:%d", (c->enable() ? errno : 0));
-    mNetman->getFrameworkManager()->sendMsg(buffer);
+    if (c->enable())
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to enable VPN", true);
+    else
+        cli->sendMsg(ErrorCode::CommandOkay, "VPN enabled", false);
     return 0;
 }
 
-CommandListener::VpnDisableCmd::VpnDisableCmd(NetworkManager *netman) :
-                 NexusCommand("vpn_disable", netman) {
+CommandListener::VpnDisableCmd::VpnDisableCmd() :
+                 NexusCommand("vpn_disable") {
 } 
                
-int CommandListener::VpnDisableCmd::runCommand(char *data) {
-    Controller *c = mNetman->findController("VPN");
-    char buffer[32];
+int CommandListener::VpnDisableCmd::runCommand(SocketClient *cli, char *data) {
+    Controller *c = NetworkManager::Instance()->findController("VPN");
 
-    sprintf(buffer, "VPN_DISABLE:%d", (c->disable() ? errno : 0));
-    mNetman->getFrameworkManager()->sendMsg(buffer);
+    if (c->disable())
+        cli->sendMsg(ErrorCode::OperationFailed, "Failed to disable VPN", true);
+    else
+        cli->sendMsg(ErrorCode::CommandOkay, "VPN disabled", false);
     return 0;
 }
diff --git a/nexus/CommandListener.h b/nexus/CommandListener.h
index 261c0936a..7bc89e3f4 100644
--- a/nexus/CommandListener.h
+++ b/nexus/CommandListener.h
@@ -19,50 +19,87 @@
 #include <sysutils/FrameworkListener.h>
 #include "NexusCommand.h"
 
-class NetworkManager;
-
 class CommandListener : public FrameworkListener {
-protected:
-    NetworkManager *mNetman;
-
 public:
-    CommandListener(NetworkManager *netman);
+    CommandListener();
     virtual ~CommandListener() {}
 
 private:
     class WifiEnableCmd : public NexusCommand {
     public:
-        WifiEnableCmd(NetworkManager *);
+        WifiEnableCmd();
         virtual ~WifiEnableCmd() {}
-        int runCommand(char *data);
+        int runCommand(SocketClient *c, char *data);
     };
 
     class WifiDisableCmd : public NexusCommand {
     public:
-        WifiDisableCmd(NetworkManager *);
+        WifiDisableCmd();
         virtual ~WifiDisableCmd() {}
-        int runCommand(char *data);
+        int runCommand(SocketClient *c, char *data);
     };
 
     class WifiScanCmd : public NexusCommand {
     public:
-        WifiScanCmd(NetworkManager *);
+        WifiScanCmd();
         virtual ~WifiScanCmd() {}
-        int runCommand(char *data);
+        int runCommand(SocketClient *c, char *data);
+    };
+
+    class WifiScanResultsCmd : public NexusCommand {
+    public:
+        WifiScanResultsCmd();
+        virtual ~WifiScanResultsCmd() {}
+        int runCommand(SocketClient *c, char *data);
+    };
+
+    class WifiAddNetworkCmd : public NexusCommand {
+    public:
+        WifiAddNetworkCmd();
+        virtual ~WifiAddNetworkCmd() {}
+        int runCommand(SocketClient *c, char *data);
+    };
+
+    class WifiRemoveNetworkCmd : public NexusCommand {
+    public:
+        WifiRemoveNetworkCmd();
+        virtual ~WifiRemoveNetworkCmd() {}
+        int runCommand(SocketClient *c, char *data);
+    };
+
+    class WifiListNetworksCmd : public NexusCommand {
+    public:
+        WifiListNetworksCmd();
+        virtual ~WifiListNetworksCmd() {}
+        int runCommand(SocketClient *c, char *data);
+    };
+
+    class WifiSetVarCmd : public NexusCommand {
+    public:
+        WifiSetVarCmd();
+        virtual ~WifiSetVarCmd() {}
+        int runCommand(SocketClient *c, char *data);
+    };
+
+    class WifiGetVarCmd : public NexusCommand {
+    public:
+        WifiGetVarCmd();
+        virtual ~WifiGetVarCmd() {}
+        int runCommand(SocketClient *c, char *data);
     };
 
     class VpnEnableCmd : public NexusCommand {
     public:
-        VpnEnableCmd(NetworkManager *);
+        VpnEnableCmd();
         virtual ~VpnEnableCmd() {}
-        int runCommand(char *data);
+        int runCommand(SocketClient *c, char *data);
     };
 
     class VpnDisableCmd : public NexusCommand {
     public:
-        VpnDisableCmd(NetworkManager *);
+        VpnDisableCmd();
         virtual ~VpnDisableCmd() {}
-        int runCommand(char *data);
+        int runCommand(SocketClient *c, char *data);
     };
 
 };
diff --git a/nexus/ErrorCode.h b/nexus/ErrorCode.h
new file mode 100644
index 000000000..8ca6cae58
--- /dev/null
+++ b/nexus/ErrorCode.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _ERRORCODE_H
+#define _ERRORCODE_H
+
+class ErrorCode {
+public:
+    // 100 series - Requestion action was initiated; expect another reply
+    // before proceeding with a new command.
+    static const int ActionInitiated = 100;
+
+    static const int WifiScanResult = 125;
+    static const int WifiNetworkList = 126;
+
+    // 200 series - Requested action has been successfully completed
+    static const int CommandOkay = 200;
+
+    // 400 series - The command was accepted but the requested action
+    // did not take place.
+    static const int OperationFailed = 400;
+
+    // 500 series - The command was not accepted and the requested
+    // action did not take place.
+    static const int CommandSyntaxError = 500;
+    static const int CommandParameterError = 501;
+
+    // 600 series - Unsolicited broadcasts
+    static const int UnsolicitedInformational = 600;
+};
+#endif
diff --git a/nexus/NetworkManager.cpp b/nexus/NetworkManager.cpp
index 9c649459d..3b823d15d 100644
--- a/nexus/NetworkManager.cpp
+++ b/nexus/NetworkManager.cpp
@@ -21,36 +21,30 @@
 #include <cutils/log.h>
 
 #include "NetworkManager.h"
-#include "CommandListener.h"
-#include "LoopController.h"
-#include "VpnController.h"
 
-#include "TiwlanWifiController.h"
+NetworkManager *NetworkManager::sInstance = NULL;
+
+NetworkManager *NetworkManager::Instance() {
+    if (!sInstance)
+        sInstance = new NetworkManager();
+    return sInstance;
+}
 
 NetworkManager::NetworkManager() {
-    mListener = new CommandListener(this);
-    mFm = new FrameworkManager(mListener);
+    mBroadcaster = NULL;
     mControllers = new ControllerCollection();
 }
 
 int NetworkManager::run() {
-    LOGD("NetworkManager::start()");
-
-    // XXX: Factory needed
-    addController(new LoopController());
-    addController(new TiwlanWifiController("/system/lib/modules/wlan.ko", "wlan", ""));
-    addController(new VpnController());
-    //addController(new GenericController("rmnet0"));
-
     if (startControllers()) {
         LOGW("Unable to start all controllers (%s)", strerror(errno));
     }
-    mFm->run();
     return 0;
 }
 
-void NetworkManager::addController(Controller *c) {
+int NetworkManager::attachController(Controller *c) {
     mControllers->push_back(c);
+    return 0;
 }
 
 int NetworkManager::startControllers() {
diff --git a/nexus/NetworkManager.h b/nexus/NetworkManager.h
index 8f362a95f..0ac4a4dbb 100644
--- a/nexus/NetworkManager.h
+++ b/nexus/NetworkManager.h
@@ -16,31 +16,36 @@
 #ifndef _NETWORKMANAGER_H
 #define _NETWORKMANAGER_H
 
-#include "Controller.h"
+#include <sysutils/SocketListener.h>
 
-#include <sysutils/FrameworkManager.h>
+#include "Controller.h"
 
 class NetworkManager {
 private:
-    FrameworkListener    *mListener;
-    FrameworkManager     *mFm;
+    static NetworkManager *sInstance;
+
+private:
     ControllerCollection *mControllers;
+    SocketListener       *mBroadcaster;
 
 public:
-    NetworkManager();
     virtual ~NetworkManager() {}
 
     int run();
 
+    int attachController(Controller *controller);
+
+    Controller *findController(const char *name);
+
+    void setBroadcaster(SocketListener *sl) { mBroadcaster = sl; }
+    SocketListener *getBroadcaster() { return mBroadcaster; }
+
+    static NetworkManager *Instance();
+
 private:
-    void addController(Controller *c);
     int startControllers();
     int stopControllers();
-
-public:
-    Controller *findController(const char *name);
-    ControllerCollection *getControllers() { return mControllers; }
-    FrameworkManager *getFrameworkManager() { return mFm; }
+    NetworkManager();
 
 public:
 // XXX: Extract these into an interface
diff --git a/nexus/NexusCommand.cpp b/nexus/NexusCommand.cpp
index 090113c09..92bb1c31b 100644
--- a/nexus/NexusCommand.cpp
+++ b/nexus/NexusCommand.cpp
@@ -15,7 +15,6 @@
  */
 #include "NexusCommand.h"
 
-NexusCommand::NexusCommand(const char *cmd, NetworkManager *netman) :
+NexusCommand::NexusCommand(const char *cmd) :
               FrameworkCommand(cmd)  {
-    mNetman = netman;
 }
diff --git a/nexus/NexusCommand.h b/nexus/NexusCommand.h
index 204541c1d..1482998c1 100644
--- a/nexus/NexusCommand.h
+++ b/nexus/NexusCommand.h
@@ -18,14 +18,9 @@
 
 #include <sysutils/FrameworkCommand.h>
 
-class NetworkManager;
-
 class NexusCommand : public FrameworkCommand {
-protected:
-    NetworkManager *mNetman;
-
 public:
-    NexusCommand(const char *cmd, NetworkManager *netman);
+    NexusCommand(const char *cmd);
     virtual ~NexusCommand() {}
 };
 
diff --git a/nexus/OpenVpnController.cpp b/nexus/OpenVpnController.cpp
new file mode 100644
index 000000000..eff653a8b
--- /dev/null
+++ b/nexus/OpenVpnController.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <errno.h>
+
+#define LOG_TAG "OpenVpnController"
+#include <cutils/log.h>
+#include <cutils/properties.h>
+
+#include "OpenVpnController.h"
+
+#define DAEMON_PROP_NAME "vpn.openvpn.status"
+
+OpenVpnController::OpenVpnController() :
+                   VpnController() {
+}
+
+int OpenVpnController::start() {
+    return 0;
+}
+
+int OpenVpnController::stop() {
+    return 0;
+}
+
+int OpenVpnController::enable() {
+
+    // Validate configuration file
+   
+    // Validate key file
+
+    if (startServiceDaemon())
+        return -1;
+
+    errno = -ENOSYS;
+    return -1;
+}
+
+int OpenVpnController::startServiceDaemon() {
+    char status[PROPERTY_VALUE_MAX];
+    int count = 100;
+
+    property_set("ctl.start", "openvpn");
+    sched_yield();
+
+    while (count-- > 0) {
+        if (property_get(DAEMON_PROP_NAME, status, NULL)) {
+            if (strcmp(status, "ok") == 0)
+                return 0;
+            else if (strcmp(DAEMON_PROP_NAME, "failed") == 0)
+                return -1;
+        }
+        usleep(200000);
+    }
+    property_set(DAEMON_PROP_NAME, "timeout");
+    return -1;
+}
+
+int OpenVpnController::stopServiceDaemon() {
+    char status[PROPERTY_VALUE_MAX] = {'\0'};
+    int count = 50;
+
+    if (property_get(DAEMON_PROP_NAME, status, NULL) &&
+        !strcmp(status, "stopped")) {
+        LOGD("Service already stopped");
+        return 0;
+    }
+
+    property_set("ctl.stop", "openvpn");
+    sched_yield();
+
+    while (count-- > 0) {
+        if (property_get(DAEMON_PROP_NAME, status, NULL)) {
+            if (!strcmp(status, "stopped"))
+                break;
+        }
+        usleep(100000);
+    }
+
+    if (!count) {
+        LOGD("Timed out waiting for openvpn to stop");
+        errno = ETIMEDOUT;
+        return -1;
+    }
+
+    return 0;
+}
+
+int OpenVpnController::disable() {
+    errno = -ENOSYS;
+    return -1;
+}
diff --git a/include/sysutils/FrameworkManager.h b/nexus/OpenVpnController.h
similarity index 54%
rename from include/sysutils/FrameworkManager.h
rename to nexus/OpenVpnController.h
index 8a24d3332..1ecc3fb3c 100644
--- a/include/sysutils/FrameworkManager.h
+++ b/nexus/OpenVpnController.h
@@ -13,28 +13,28 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#ifndef _FRAMEWORKMANAGER_H
-#define _FRAMEWORKMANAGER_H
 
-#include <pthread.h>
+#ifndef _OPEN_VPN_CONTROLLER_H
+#define _OPEN_VPN_CONTROLLER_H
 
-class FrameworkListener;
+#include "VpnController.h"
 
-class FrameworkManager {
-    int mDoorbell;        // Socket used to accept connections from framework
-    int mFwSock;          // Socket used to communicate with framework
-    const char *mSocketName;
-
-    FrameworkListener *mListener;
-    
-    pthread_mutex_t mWriteMutex;
+class OpenVpnController : public VpnController {
 
 public:
-    FrameworkManager(FrameworkListener *Listener);
-    virtual ~FrameworkManager() {}
+    OpenVpnController();
+    virtual ~OpenVpnController() {}
 
-    int run();
-    int sendMsg(char *msg);
-    int sendMsg(char *msg, char *data);
+    int start();
+    int stop();
+    int enable();
+    int disable();
+
+protected:
+
+private:
+    int startServiceDaemon();
+    int stopServiceDaemon();
 };
+
 #endif
diff --git a/nexus/ScanResult.cpp b/nexus/ScanResult.cpp
index b7237b574..dc7599afe 100644
--- a/nexus/ScanResult.cpp
+++ b/nexus/ScanResult.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 #include <stdlib.h>
+#include <ctype.h>
 
 #define LOG_TAG "ScanResult"
 #include <cutils/log.h>
@@ -24,30 +25,53 @@ ScanResult::ScanResult() {
 }
 
 ScanResult::ScanResult(char *rawResult) {
-    char *tok, *next = NULL;
+    char *p = rawResult, *q = rawResult;
+    char tmp[255];
 
-    if (!(tok = strtok_r(rawResult, "\t", &next)))
-        goto out_bad;
-    mBssid = strdup(tok);
+    // BSSID
+    for (q = p; *q != '\t'; ++q);
+    strncpy(tmp, p, (q - p));
+    tmp[q-p] = '\0';
+    mBssid = strdup(tmp);
+    ++q;
 
-    if (!(tok = strtok_r(NULL, "\t", &next)))
-        goto out_bad;
-    mFreq = atoi(tok);
+    // FREQ
+    for (p = q; *q != '\t'; ++q);
+    strncpy(tmp, p, (q - p));
+    tmp[q-p] = '\0';
+    mFreq = atoi(tmp);
+    ++q;
 
-    if (!(tok = strtok_r(NULL, "\t", &next)))
-        goto out_bad;
-    mLevel = atoi(tok);
+    // LEVEL 
+    for (p = q; *q != '\t'; ++q);
+    strncpy(tmp, p, (q - p));
+    tmp[q-p] = '\0';
+    mLevel = atoi(tmp);
+    ++q;
 
-    if (!(tok = strtok_r(rawResult, "\t", &next)))
-        goto out_bad;
-    mFlags = strdup(tok);
+    // FLAGS
+    for (p = q; *q != '\t'; ++q);
+    strncpy(tmp, p, (q - p));
+    tmp[q-p] = '\0';
+    mFlags = strdup(tmp);
+    ++q;
 
-    if (!(tok = strtok_r(rawResult, "\t", &next)))
-        goto out_bad;
-    mSsid = strdup(tok);
+    // XXX: For some reason Supplicant sometimes sends a double-tab here.
+    // haven't had time to dig into it ...
+    if (*q == '\t')
+        q++;
+ 
+    for (p = q; *q != '\t'; ++q) {
+        if (*q == '\0')
+            break;
+    }
+
+    strncpy(tmp, p, (q - p));
+    tmp[q-p] = '\0';
+    mSsid = strdup(tmp);
+    ++q;
 
     return;
-
  out_bad:
     LOGW("Malformatted scan result (%s)", rawResult);
 }
diff --git a/nexus/ScanResult.h b/nexus/ScanResult.h
index 79b2b659f..f70a1a906 100644
--- a/nexus/ScanResult.h
+++ b/nexus/ScanResult.h
@@ -38,6 +38,7 @@ public:
 
     const char *getBssid() { return mBssid; }
     uint32_t getFreq() { return mFreq; }
+    int getLevel() { return mLevel; }
     const char *getFlags() { return mFlags; }
     const char *getSsid() { return mSsid; }
 };
diff --git a/nexus/Supplicant.cpp b/nexus/Supplicant.cpp
index 215a8b347..22964bbc8 100644
--- a/nexus/Supplicant.cpp
+++ b/nexus/Supplicant.cpp
@@ -13,12 +13,18 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
+#include <stdlib.h>
+#include <sys/types.h>
+#include <fcntl.h>
 #include <errno.h>
 
 #define LOG_TAG "Supplicant"
 #include <cutils/log.h>
 #include <cutils/properties.h>
 
+#include "private/android_filesystem_config.h"
+
 #undef HAVE_LIBC_SYSTEM_PROPERTIES
 
 #ifdef HAVE_LIBC_SYSTEM_PROPERTIES
@@ -31,6 +37,8 @@
 #include "SupplicantState.h"
 #include "SupplicantEvent.h"
 #include "ScanResult.h"
+#include "NetworkManager.h"
+#include "ErrorCode.h"
 
 #include "libwpa_client/wpa_ctrl.h"
 
@@ -38,6 +46,9 @@
 #define DRIVER_PROP_NAME "wlan.driver.status"
 #define SUPPLICANT_NAME  "wpa_supplicant"
 #define SUPP_PROP_NAME   "init.svc.wpa_supplicant"
+#define SUPP_CONFIG_TEMPLATE "/system/etc/wifi/wpa_supplicant.conf"
+#define SUPP_CONFIG_FILE "/data/misc/wifi/wpa_supplicant.conf"
+
 
 Supplicant::Supplicant() {
     mCtrl = NULL;
@@ -52,8 +63,10 @@ Supplicant::Supplicant() {
 }
 
 int Supplicant::start() {
-    LOGD("start():");
-    // XXX: Validate supplicant config file
+
+    if (setupConfig()) {
+        LOGW("Unable to setup supplicant.conf");
+    }
     
     char status[PROPERTY_VALUE_MAX] = {'\0'};
     int count = 200;
@@ -63,47 +76,46 @@ int Supplicant::start() {
 #endif
 
     if (property_get(SUPP_PROP_NAME, status, NULL) &&
-        strcmp(status, "running") == 0) {
-        return 0;
+        !strcmp(status, "running")) {
+    } else {
+#ifdef HAVE_LIBC_SYSTEM_PROPERTIES
+        pi = __system_property_find(SUPP_PROP_NAME);
+        if (pi != NULL)
+            serial = pi->serial;
+#endif
+
+        LOGD("Starting Supplicant");
+        property_set("ctl.start", SUPPLICANT_NAME);
+        sched_yield();
+        while (count--) {
+#ifdef HAVE_LIBC_SYSTEM_PROPERTIES
+            if (!pi)
+                pi = __system_property_find(SUPP_PROP_NAME);
+            if (pi) {
+                __system_property_read(pi, NULL, status);
+                if (strcmp(status, "running") == 0)
+                    break;
+                else if (pi->serial != serial &&
+                        strcmp(status, "stopped") == 0) {
+                    errno = EIO;
+                    return -1;
+                }
+            }
+#else
+            if (property_get(SUPP_PROP_NAME, status, NULL)) {
+                if (!strcmp(status, "running"))
+                    break;
+            }
+#endif
+            usleep(100000);
+        }
+        if (!count) {
+            errno = ETIMEDOUT;
+            return -1;
+        }
     }
 
     wpa_ctrl_cleanup();
-#ifdef HAVE_LIBC_SYSTEM_PROPERTIES
-    pi = __system_property_find(SUPP_PROP_NAME);
-    if (pi != NULL)
-        serial = pi->serial;
-#endif
-
-    property_set("ctl.start", SUPPLICANT_NAME);
-    sched_yield();
-    while (count--) {
-#ifdef HAVE_LIBC_SYSTEM_PROPERTIES
-        if (!pi)
-            pi = __system_property_find(SUPP_PROP_NAME);
-        if (pi) {
-            __system_property_read(pi, NULL, status);
-            if (strcmp(status, "running") == 0)
-                return 0;
-            else if (pi->serial != serial &&
-                    strcmp(status, "stopped") == 0) {
-                errno = EIO;
-                return -1;
-            }
-        }
-#else
-        if (property_get(SUPP_PROP_NAME, status, NULL)) {
-            if (strcmp(status, "running") == 0)
-                break;
-        }
-#endif
-        usleep(100000);
-    }
-
-    if (!count) {
-        errno = ETIMEDOUT;
-        return -1;
-    }
-  
     if (connectToSupplicant()) {
         LOGE("Error connecting to supplicant (%s)\n", strerror(errno));
         return -1;
@@ -112,7 +124,6 @@ int Supplicant::start() {
 }
 
 int Supplicant::stop() {
-    LOGD("stop()");
 
     char supp_status[PROPERTY_VALUE_MAX] = {'\0'};
     int count = 50; 
@@ -124,9 +135,11 @@ int Supplicant::stop() {
 
     if (property_get(SUPP_PROP_NAME, supp_status, NULL)
         && strcmp(supp_status, "stopped") == 0) {
+        LOGD("Supplicant already stopped");
         return 0;
     }
 
+    LOGD("Stopping Supplicant");
     property_set("ctl.stop", SUPPLICANT_NAME);
     sched_yield();
 
@@ -153,24 +166,27 @@ int Supplicant::stop() {
         return -1;
     }
 
-    LOGD("Stopped OK");
+    LOGD("Supplicant shutdown");
 
     return 0;
 }
 
 bool Supplicant::isStarted() {
     char supp_status[PROPERTY_VALUE_MAX] = {'\0'};
-    if (!property_get(SUPP_PROP_NAME, supp_status, NULL) ||
-        !strcmp(supp_status, "running")) {
-        return false;
-    }
-    return true;
+
+    property_get(SUPP_PROP_NAME, supp_status, NULL);
+
+    if (!strcmp(supp_status, "running"))
+        return true;
+
+    return false;
 }
 
 int Supplicant::connectToSupplicant() {
     char ifname[256];
     char supp_status[PROPERTY_VALUE_MAX] = {'\0'};
 
+    LOGD("connectToSupplicant()");
     if (!property_get(SUPP_PROP_NAME, supp_status, NULL)
             || strcmp(supp_status, "running") != 0) {
         LOGE("Supplicant not running, cannot connect");
@@ -220,6 +236,7 @@ int Supplicant::sendCommand(const char *cmd, char *reply, size_t *reply_len)
         errno = ETIMEDOUT;
         return -1;
     } else if (rc < 0 || !strncmp(reply, "FAIL", 4)) {
+        LOGW("sendCommand(): <- '%s'", reply);
         errno = EIO;
         return -1;
     }
@@ -297,8 +314,6 @@ int Supplicant::onEapFailureEvent(SupplicantEvent *evt) {
 }
 
 int Supplicant::onScanResultsEvent(SupplicantEvent *evt) {
-    LOGD("onScanResultsEvent(%s)", evt->getEvent());
-
     if (!strcmp(evt->getEvent(), "Ready")) {
         char *reply;
 
@@ -332,12 +347,17 @@ int Supplicant::onScanResultsEvent(SupplicantEvent *evt) {
 
         if (!strtok_r(reply, "\n", &linep_next)) {
             free(reply);
-            return 0;;
+            pthread_mutex_unlock(&mLatestScanResultsLock);
+            return 0;
         }
 
         while((linep = strtok_r(NULL, "\n", &linep_next)))
             mLatestScanResults->push_back(new ScanResult(linep));
-
+    
+        char tmp[128];
+        sprintf(tmp, "Scan results ready (%d)", mLatestScanResults->size());
+        NetworkManager::Instance()->getBroadcaster()->
+                                    sendBroadcast(ErrorCode::UnsolicitedInformational, tmp, false);
         pthread_mutex_unlock(&mLatestScanResultsLock);
         free(reply);
     } else {
@@ -347,8 +367,24 @@ int Supplicant::onScanResultsEvent(SupplicantEvent *evt) {
 }
 
 int Supplicant::onStateChangeEvent(SupplicantEvent *evt) {
-    LOGD("onStateChangeEvent(%s)", evt->getEvent());
-    // XXX: Update mState
+    char *bword, *last;
+    char *tmp = strdup(evt->getEvent());
+
+    if (!(bword = strtok_r(tmp, " ", &last))) {
+        LOGE("Malformatted state update (%s)", evt->getEvent());
+        free(tmp);
+        return 0;
+    }
+
+    if (!(bword = strtok_r(NULL, " ", &last))) {
+        LOGE("Malformatted state update (%s)", evt->getEvent());
+        free(tmp);
+        return 0;
+    }
+
+    mState = atoi(&bword[strlen("state=")]);
+    LOGD("State changed to %d", mState);
+    free(tmp);
     return 0;
 }
 
@@ -363,7 +399,7 @@ int Supplicant::onDriverStateEvent(SupplicantEvent *evt) {
 }
 
 // XXX: Use a cursor + smartptr instead
-const ScanResultCollection *Supplicant::getLatestScanResults() {
+ScanResultCollection *Supplicant::createLatestScanResults() {
     ScanResultCollection *d = new ScanResultCollection();
     ScanResultCollection::iterator i;
 
@@ -374,4 +410,81 @@ const ScanResultCollection *Supplicant::getLatestScanResults() {
 
     pthread_mutex_unlock(&mLatestScanResultsLock);
     return d;
-};
+}
+
+WifiNetworkCollection *Supplicant::createNetworkList() {
+    WifiNetworkCollection *d = new WifiNetworkCollection();
+    return d;
+}
+
+int Supplicant::addNetwork() {
+    char reply[32];
+    size_t len = sizeof(reply) -1;
+
+    memset(reply, 0, sizeof(reply));
+    if (sendCommand("ADD_NETWORK", reply, &len))
+        return -1;
+
+    return atoi(reply);
+}
+
+int Supplicant::removeNetwork(int networkId) {
+    char req[64];
+
+    sprintf(req, "REMOVE_NETWORK %d", networkId);
+    char reply[32];
+    size_t len = sizeof(reply) -1;
+    memset(reply, 0, sizeof(reply));
+    
+    if (sendCommand(req, reply, &len))
+        return -1;
+    return 0;
+}
+
+int Supplicant::setupConfig() {
+    char buf[2048];
+    int srcfd, destfd;
+    int nread;
+
+    if (access(SUPP_CONFIG_FILE, R_OK|W_OK) == 0) {
+        return 0;
+    } else if (errno != ENOENT) {
+        LOGE("Cannot access \"%s\": %s", SUPP_CONFIG_FILE, strerror(errno));
+        return -1;
+    }
+
+    srcfd = open(SUPP_CONFIG_TEMPLATE, O_RDONLY);
+    if (srcfd < 0) {
+        LOGE("Cannot open \"%s\": %s", SUPP_CONFIG_TEMPLATE, strerror(errno));
+        return -1;
+    }
+
+    destfd = open(SUPP_CONFIG_FILE, O_CREAT|O_WRONLY, 0660);
+    if (destfd < 0) {
+        close(srcfd);
+        LOGE("Cannot create \"%s\": %s", SUPP_CONFIG_FILE, strerror(errno));
+        return -1;
+    }
+
+    while ((nread = read(srcfd, buf, sizeof(buf))) != 0) {
+        if (nread < 0) {
+            LOGE("Error reading \"%s\": %s", SUPP_CONFIG_TEMPLATE, strerror(errno));
+            close(srcfd);
+            close(destfd);
+            unlink(SUPP_CONFIG_FILE);
+            return -1;
+        }
+        write(destfd, buf, nread);
+    }
+
+    close(destfd);
+    close(srcfd);
+
+    if (chown(SUPP_CONFIG_FILE, AID_SYSTEM, AID_WIFI) < 0) {
+        LOGE("Error changing group ownership of %s to %d: %s",
+             SUPP_CONFIG_FILE, AID_WIFI, strerror(errno));
+        unlink(SUPP_CONFIG_FILE);
+        return -1;
+    }
+    return 0;
+}
diff --git a/nexus/Supplicant.h b/nexus/Supplicant.h
index 46a9e86ce..4a7ec3a60 100644
--- a/nexus/Supplicant.h
+++ b/nexus/Supplicant.h
@@ -23,6 +23,7 @@ class SupplicantEvent;
 #include <pthread.h>
 
 #include "ScanResult.h"
+#include "WifiNetwork.h"
 
 class Supplicant {
 private:
@@ -38,17 +39,23 @@ public:
     Supplicant();
     virtual ~Supplicant() {}
 
-    virtual int start();
-    virtual int stop();
-    virtual bool isStarted();
+    int start();
+    int stop();
+    bool isStarted();
+
+    int triggerScan(bool active);
+    ScanResultCollection *createLatestScanResults();
+
+    int addNetwork();
+    int removeNetwork(int networkId);
+    WifiNetworkCollection *createNetworkList();
 
-    virtual int triggerScan(bool active);
 
     int getState() { return mState; }
 
-    const ScanResultCollection *getLatestScanResults();
 
 // XXX: Extract these into an interface
+// handlers for SupplicantListener
 public:
     virtual int onConnectedEvent(SupplicantEvent *evt);
     virtual int onDisconnectedEvent(SupplicantEvent *evt);
@@ -67,6 +74,7 @@ public:
 private:
     int connectToSupplicant();
     int sendCommand(const char *cmd, char *reply, size_t *reply_len);
+    int setupConfig();
 };
 
 #endif
diff --git a/nexus/SupplicantListener.cpp b/nexus/SupplicantListener.cpp
index 16306b5b6..76e99456e 100644
--- a/nexus/SupplicantListener.cpp
+++ b/nexus/SupplicantListener.cpp
@@ -30,31 +30,9 @@ SupplicantListener::SupplicantListener(Supplicant *supplicant, struct wpa_ctrl *
                     SocketListener(wpa_ctrl_get_fd(monitor), false) {
     mSupplicant = supplicant;
     mMonitor = monitor;
-    mThread = NULL;
 }
 
-int SupplicantListener::startListener() {
-    LOGD("startListener()");
-    pthread_attr_t attr;
-    pthread_attr_init(&attr);
-    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
-
-    return pthread_create(&mThread, &attr, &SupplicantListener::threadStart, this);
-}
-
-int SupplicantListener::stopListener() {
-    errno = -ENOSYS;
-    return -1;
-}
-
-void *SupplicantListener::threadStart(void *obj) {
-    LOGD("threadStart(): Worker thread started");
-    reinterpret_cast<SupplicantListener *>(obj)->run();
-    LOGD("threadStart(): Worker thread exited");
-    return NULL;
-}
-
-bool SupplicantListener::onDataAvailable(int socket) {
+bool SupplicantListener::onDataAvailable(SocketClient *cli) {
     char buf[255];
     size_t buflen = sizeof(buf);
     int rc;
@@ -62,7 +40,7 @@ bool SupplicantListener::onDataAvailable(int socket) {
 
     if ((rc = wpa_ctrl_recv(mMonitor, buf, &nread))) {
         LOGE("wpa_ctrl_recv failed (%s)", strerror(errno));
-        return -errno;
+        return false;
     }
 
     buf[nread] = '\0';
@@ -108,7 +86,9 @@ bool SupplicantListener::onDataAvailable(int socket) {
 
     delete evt;
     
-    if (rc)
+    if (rc) {
+        LOGW("Handler %d (%s) error: %s", evt->getType(), evt->getEvent(), strerror(errno));
         return false;
+    }
     return true;
 }
diff --git a/nexus/SupplicantListener.h b/nexus/SupplicantListener.h
index 3d27a6810..95bad9a28 100644
--- a/nexus/SupplicantListener.h
+++ b/nexus/SupplicantListener.h
@@ -16,33 +16,27 @@
 #ifndef _SUPPLICANTLISTENER_H__
 #define _SUPPLICANTLISTENER_H__
 
-#include <pthread.h>
-
 #include <sysutils/SocketListener.h>
 
 struct wpa_ctrl;
 class Supplicant;
+class SocketClient;
 
 class SupplicantListener: public SocketListener {
 private:
     struct wpa_ctrl *mMonitor;
     Supplicant      *mSupplicant;
-    pthread_t       mThread;
 
 public:
     SupplicantListener(Supplicant *supplicant, struct wpa_ctrl *monitor);
     virtual ~SupplicantListener() {}
-    int startListener();
-    int stopListener();
 
     struct wpa_ctrl *getMonitor() { return mMonitor; }
     Supplicant *getSupplicant() { return mSupplicant; }
 
 protected:
-    virtual bool onDataAvailable(int socket);
+    virtual bool onDataAvailable(SocketClient *c);
 
-private:
-    static void *threadStart(void *obj);
 };
 
 #endif
diff --git a/nexus/SupplicantState.h b/nexus/SupplicantState.h
index f2cf6039c..e85dcb505 100644
--- a/nexus/SupplicantState.h
+++ b/nexus/SupplicantState.h
@@ -18,16 +18,16 @@
 
 class SupplicantState {
 public:
-    static const int UNKNOWN           = 0;
-    static const int DISCONNECTED      = 1;
-    static const int INACTIVE          = 2;
-    static const int SCANNING          = 3;
-    static const int ASSOCIATING       = 4;
-    static const int ASSOCIATED        = 5;
-    static const int FOURWAY_HANDSHAKE = 6;
-    static const int GROUP_HANDSHAKE   = 7;
-    static const int COMPLETED         = 8;
-    static const int IDLE              = 9;
+    static const int UNKNOWN           = -1;
+    static const int DISCONNECTED      = 0;
+    static const int INACTIVE          = 1;
+    static const int SCANNING          = 2;
+    static const int ASSOCIATING       = 3;
+    static const int ASSOCIATED        = 4;
+    static const int FOURWAY_HANDSHAKE = 5;
+    static const int GROUP_HANDSHAKE   = 6;
+    static const int COMPLETED         = 7;
+    static const int IDLE              = 8;
 };
 
 #endif
diff --git a/nexus/TiwlanWifiController.cpp b/nexus/TiwlanWifiController.cpp
index ec83825b8..27c972ba5 100644
--- a/nexus/TiwlanWifiController.cpp
+++ b/nexus/TiwlanWifiController.cpp
@@ -48,7 +48,6 @@ int TiwlanWifiController::loadFirmware() {
     char driver_status[PROPERTY_VALUE_MAX];
     int count = 100;
 
-    LOGD("loadFirmware()");
     property_set("ctl.start", "wlan_loader");
     sched_yield();
 
@@ -65,3 +64,8 @@ int TiwlanWifiController::loadFirmware() {
     property_set(DRIVER_PROP_NAME, "timeout");
     return -1;
 }
+
+bool TiwlanWifiController::isFirmwareLoaded() {
+    // Always load the firmware
+    return false;
+}
diff --git a/nexus/TiwlanWifiController.h b/nexus/TiwlanWifiController.h
index a93d61004..f17ef51f5 100644
--- a/nexus/TiwlanWifiController.h
+++ b/nexus/TiwlanWifiController.h
@@ -27,5 +27,6 @@ public:
     virtual int powerDown();
     virtual bool isPoweredUp();
     virtual int loadFirmware();
+    virtual bool isFirmwareLoaded();
 };
 #endif
diff --git a/nexus/VpnController.cpp b/nexus/VpnController.cpp
index 2d3db852b..17bfe4161 100644
--- a/nexus/VpnController.cpp
+++ b/nexus/VpnController.cpp
@@ -31,9 +31,6 @@ int VpnController::stop() {
 }
 
 int VpnController::enable() {
-
-    // Load modules
-    // Start daemons
     errno = -ENOSYS;
     return -1;
 }
diff --git a/nexus/VpnController.h b/nexus/VpnController.h
index f792ce3bc..049fe6e1b 100644
--- a/nexus/VpnController.h
+++ b/nexus/VpnController.h
@@ -31,8 +31,6 @@ public:
     virtual int disable();
 
 protected:
-
-private:
 };
 
 #endif
diff --git a/nexus/WifiController.cpp b/nexus/WifiController.cpp
index 8a7e33f9e..126db69e1 100644
--- a/nexus/WifiController.cpp
+++ b/nexus/WifiController.cpp
@@ -21,6 +21,9 @@
 
 #include "Supplicant.h"
 #include "WifiController.h"
+#include "WifiScanner.h"
+#include "NetworkManager.h"
+#include "ErrorCode.h"
 
 WifiController::WifiController(char *modpath, char *modname, char *modargs) :
                 Controller("WIFI") {
@@ -29,6 +32,7 @@ WifiController::WifiController(char *modpath, char *modname, char *modargs) :
     strncpy(mModuleArgs, modargs, sizeof(mModuleArgs));
 
     mSupplicant = new Supplicant();
+    mScanner = new WifiScanner(mSupplicant, 10);
     mCurrentScanMode = 0;
 }
 
@@ -42,26 +46,36 @@ int WifiController::stop() {
 }
 
 int WifiController::enable() {
-    if (!isPoweredUp() && powerUp()) {
-        LOGE("Powerup failed (%s)", strerror(errno));
-        return -1;
+    if (!isPoweredUp()) {
+        sendStatusBroadcast("POWERING_UP");
+        if (powerUp()) {
+            LOGE("Powerup failed (%s)", strerror(errno));
+            return -1;
+        }
     }
-   
+
     if (mModuleName[0] != '\0' && !isKernelModuleLoaded(mModuleName)) {
+        sendStatusBroadcast("LOADING_DRIVER");
         if (loadKernelModule(mModulePath, mModuleArgs)) {
             LOGE("Kernel module load failed (%s)", strerror(errno));
             goto out_powerdown;
         }
     }
 
-    if (loadFirmware()) {
-        LOGE("Firmware load failed (%s)", strerror(errno));
-        goto out_powerdown;
+    if (!isFirmwareLoaded()) {
+        sendStatusBroadcast("LOADING_FIRMWARE");
+        if (loadFirmware()) {
+            LOGE("Firmware load failed (%s)", strerror(errno));
+            goto out_powerdown;
+        }
     }
 
-    if (!mSupplicant->isStarted() && mSupplicant->start()) {
-        LOGE("Supplicant start failed (%s)", strerror(errno));
-        goto out_unloadmodule;
+    if (!mSupplicant->isStarted()) {
+        sendStatusBroadcast("STARTING_SUPPLICANT");
+        if (mSupplicant->start()) {
+            LOGE("Supplicant start failed (%s)", strerror(errno));
+            goto out_unloadmodule;
+        }
     }
 
     return 0;
@@ -80,24 +94,37 @@ out_powerdown:
     return -1;
 }
 
-int WifiController::disable() {
-    LOGD("disable()");
+void WifiController::sendStatusBroadcast(char *msg) {
+    NetworkManager::Instance()->
+                    getBroadcaster()->
+                    sendBroadcast(ErrorCode::UnsolicitedInformational, msg, false);
+}
 
-    if (mSupplicant->isStarted() && mSupplicant->stop()) {
-        LOGE("Supplicant stop failed (%s)", strerror(errno));
-        return -1;
-    }
+int WifiController::disable() {
+
+    if (mSupplicant->isStarted()) {
+        sendStatusBroadcast("STOPPING_SUPPLICANT");
+        if (mSupplicant->stop()) {
+            LOGE("Supplicant stop failed (%s)", strerror(errno));
+            return -1;
+        }
+    } else 
+        LOGW("disable(): Supplicant not running?");
 
     if (mModuleName[0] != '\0' && isKernelModuleLoaded(mModuleName)) {
+        sendStatusBroadcast("UNLOADING_DRIVER");
         if (unloadKernelModule(mModuleName)) {
             LOGE("Unable to unload module (%s)", strerror(errno));
             return -1;
         }
     }
 
-    if (isPoweredUp() && powerDown()) {
-        LOGE("Powerdown failed (%s)", strerror(errno));
-        return -1;
+    if (isPoweredUp()) {
+        sendStatusBroadcast("POWERING_DOWN");
+        if (powerDown()) {
+            LOGE("Powerdown failed (%s)", strerror(errno));
+            return -1;
+        }
     }
     return 0;
 }
@@ -106,7 +133,7 @@ int WifiController::loadFirmware() {
     return 0;
 }
 
-int WifiController::setScanMode(int mode) {
+int WifiController::setScanMode(uint32_t mode) {
     int rc = 0;
 
     if (mCurrentScanMode == mode)
@@ -114,21 +141,29 @@ int WifiController::setScanMode(int mode) {
 
     if (!(mode & SCAN_ENABLE_MASK)) {
         if (mCurrentScanMode & SCAN_REPEAT_MASK)
-            stopPeriodicScan();
+            mScanner->stop();
     } else if (mode & SCAN_REPEAT_MASK)
-        rc = startPeriodicScan();
+        rc = mScanner->start(mode & SCAN_ACTIVE_MASK);
     else
         rc = mSupplicant->triggerScan(mode & SCAN_ACTIVE_MASK);
-    
+
+    mCurrentScanMode = mode;
     return rc;
 }
 
-int WifiController::startPeriodicScan() {
-    errno = -ENOSYS;
-    return -1;
+int WifiController::addNetwork() {
+    return mSupplicant->addNetwork();
 }
 
-int WifiController::stopPeriodicScan() {
-    errno = -ENOSYS;
-    return -1;
+int WifiController::removeNetwork(int networkId) {
+    return mSupplicant->removeNetwork(networkId);
+}
+
+ScanResultCollection *WifiController::createScanResults() {
+    return mSupplicant->createLatestScanResults();
+}
+
+// XXX: This should be a const list
+WifiNetworkCollection *WifiController::createNetworkList() {
+    return mSupplicant->createNetworkList();
 }
diff --git a/nexus/WifiController.h b/nexus/WifiController.h
index 6d0051323..b9c981c91 100644
--- a/nexus/WifiController.h
+++ b/nexus/WifiController.h
@@ -22,6 +22,10 @@
 
 class NetInterface;
 class Supplicant;
+class WifiScanner;
+
+#include "ScanResult.h"
+#include "WifiNetwork.h"
 
 class WifiController : public Controller {
 public:
@@ -40,8 +44,8 @@ private:
     char        mModulePath[255];
     char        mModuleName[64];
     char        mModuleArgs[255];
-    int         mCurrentScanMode;
-
+    uint32_t    mCurrentScanMode;
+    WifiScanner *mScanner;
 
 public:
     WifiController(char *modpath, char *modname, char *modargs);
@@ -53,7 +57,13 @@ public:
     int enable();
     int disable();
 
-    int getType();
+    int addNetwork();
+    int removeNetwork(int networkId);
+    WifiNetworkCollection *createNetworkList();
+
+    int getScanMode() { return mCurrentScanMode; }
+    int setScanMode(uint32_t mode);
+    ScanResultCollection *createScanResults();
 
     char *getModulePath() { return mModulePath; }
     char *getModuleName() { return mModuleName; }
@@ -61,18 +71,15 @@ public:
 
     Supplicant *getSupplicant() { return mSupplicant; }
 
-    int getScanMode() { return mCurrentScanMode; }
-    int setScanMode(int mode);
-
 protected:
     virtual int powerUp() = 0;
     virtual int powerDown() = 0;
     virtual int loadFirmware();
+
+    virtual bool isFirmwareLoaded() = 0;
     virtual bool isPoweredUp() = 0;
 
-private:
-    int startPeriodicScan();
-    int stopPeriodicScan();
+    void sendStatusBroadcast(char *msg);
 };
 
 #endif
diff --git a/nexus/WifiNetwork.cpp b/nexus/WifiNetwork.cpp
new file mode 100644
index 000000000..ef013c09c
--- /dev/null
+++ b/nexus/WifiNetwork.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <sys/types.h>
+
+#include "WifiNetwork.h"
+#include "Supplicant.h"
+
+WifiNetwork::WifiNetwork(Supplicant *suppl) {
+    mSuppl = suppl;
+    mNetid = -1;
+    mSsid = NULL;
+    mBssid = NULL;
+    mPsk = NULL;
+    memset(mWepKeys, 0, sizeof(mWepKeys));
+    mDefaultKeyIndex = -1;
+    mPriority = -1;
+    mHiddenSsid = NULL;
+    mAllowedKeyManagement = 0;
+    mAllowedProtocols = 0;
+    mAllowedAuthAlgorithms = 0;
+    mAllowedPairwiseCiphers = 0;
+    mAllowedGroupCiphers = 0;
+}
+
+WifiNetwork::~WifiNetwork() {
+    if (mSsid)
+        free(mSsid);
+    if (mBssid)
+        free(mBssid);
+    if (mPsk)
+        free(mPsk);
+    for (int i = 0; i < 4; i++) {
+        if (mWepKeys[i])
+            free(mWepKeys[i]);
+    }
+    if (mHiddenSsid)
+        free(mHiddenSsid);
+}
+
+int WifiNetwork::setSsid(char *ssid) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setBssid(char *bssid) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setPsk(char *psk) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setWepKey(int idx, char *key) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setDefaultKeyIndex(int idx) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setPriority(int idx) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setHiddenSsid(char *ssid) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setAllowedKeyManagement(uint32_t mask) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setAllowedProtocols(uint32_t mask) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setAllowedPairwiseCiphers(uint32_t mask) {
+    errno = ENOSYS;
+    return -1;
+}
+
+int WifiNetwork::setAllowedGroupCiphers(uint32_t mask) {
+    errno = ENOSYS;
+    return -1;
+}
diff --git a/nexus/WifiNetwork.h b/nexus/WifiNetwork.h
new file mode 100644
index 000000000..135473007
--- /dev/null
+++ b/nexus/WifiNetwork.h
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _WIFI_NETWORK_H
+#define _WIFI_NETWORK_H
+
+#include <sys/types.h>
+
+#include "../../../frameworks/base/include/utils/List.h"
+
+class KeyManagementMask {
+public:
+    static const uint32_t NONE      = 0;
+    static const uint32_t WPA_PSK   = 0x01;
+    static const uint32_t WPA_EAP   = 0x02;
+    static const uint32_t IEEE8021X = 0x04;
+    static const uint32_t ALL       = WPA_PSK | WPA_EAP | IEEE8021X;
+};
+
+class SecurityProtocolMask {
+public:
+    static const uint32_t WPA = 0x01;
+    static const uint32_t RSN = 0x02;
+};
+
+class AuthenticationAlgorithmMask {
+public:
+    static const uint32_t OPEN   = 0x01;
+    static const uint32_t SHARED = 0x02;
+    static const uint32_t LEAP   = 0x04;
+};
+
+class PairwiseCipherMask {
+public:
+    static const uint32_t NONE = 0x00;
+    static const uint32_t TKIP = 0x01;
+    static const uint32_t CCMP = 0x02;
+};
+
+class GroupCipherMask {
+public:
+    static const uint32_t WEP40  = 0x01;
+    static const uint32_t WEP104 = 0x02;
+    static const uint32_t TKIP   = 0x04;
+    static const uint32_t CCMP   = 0x08;
+};
+
+class Supplicant;
+
+class WifiNetwork {
+    Supplicant *mSuppl;
+
+    /*
+     * Unique network id - normally provided by supplicant
+     */
+    int mNetid;
+
+    /*
+     * The networks' SSID. Can either be an ASCII string,
+     * which must be enclosed in double quotation marks
+     * (ie: "MyNetwork"), or a string of hex digits which
+     * are not enclosed in quotes (ie: 01ab7893)
+     */
+    char *mSsid;
+
+    /*
+     * When set, this entry should only be used
+     * when associating with the AP having the specified
+     * BSSID. The value is a string in the format of an
+     * Ethernet MAC address
+     */
+    char *mBssid;
+
+    /*
+     *  Pre-shared key for use with WPA-PSK
+     */
+    char *mPsk;
+
+    /*
+     * Up to four WEP keys. Either in ASCII string enclosed in
+     * double quotes, or a string of hex digits
+     */
+    char *mWepKeys[4];
+
+    /*
+     * Default WEP key index, ranging from 0 -> NUM_WEP_KEYS -1
+     */
+    int mDefaultKeyIndex;
+
+    /*
+     * Priority determines the preference given to a network by 
+     * supplicant when choosing an access point with which
+     * to associate
+     */
+    int mPriority;
+
+    /*
+     * This is a network that does not broadcast it's SSID, so an
+     * SSID-specific probe request must be used for scans.
+     */
+    char *mHiddenSsid;
+
+    /*
+     * The set of key management protocols supported by this configuration.
+     */
+    uint32_t mAllowedKeyManagement;
+
+    /*
+     * The set of security protocols supported by this configuration.
+     */
+    uint32_t mAllowedProtocols;
+
+    /*
+     * The set of authentication protocols supported by this configuration.
+     */
+    uint32_t mAllowedAuthAlgorithms;
+
+    /*
+     * The set of pairwise ciphers for WPA supported by this configuration.
+     */
+    uint32_t mAllowedPairwiseCiphers;
+
+    /*
+     * The set of group ciphers for WPA supported by this configuration.
+     */
+    uint32_t mAllowedGroupCiphers;
+
+public:
+    WifiNetwork(Supplicant *suppl);
+    virtual ~WifiNetwork();
+
+    int getNetworkId() { return mNetid; }
+    const char *getSsid() { return mSsid; }
+    const char *getBssid() { return mBssid; }
+    const char *getPsk() { return mPsk; }
+    const char *getWepKey(int idx) { return mWepKeys[idx]; }
+    int getDefaultKeyIndex() { return mDefaultKeyIndex; }
+    int getPriority() { return mPriority; }
+    const char *getHiddenSsid() { return mHiddenSsid; }
+    uint32_t getAllowedKeyManagement() { return mAllowedKeyManagement; }
+    uint32_t getAllowedProtocols() { return mAllowedProtocols; }
+    uint32_t getAllowedAuthAlgorithms() { return mAllowedAuthAlgorithms; }
+    uint32_t getAllowedPairwiseCiphers() { return mAllowedPairwiseCiphers; }
+    uint32_t getAllowedGroupCiphers() { return mAllowedGroupCiphers; }
+
+    int setSsid(char *ssid);
+    int setBssid(char *bssid);
+    int setPsk(char *psk);
+    int setWepKey(int idx, char *key);
+    int setDefaultKeyIndex(int idx);
+    int setPriority(int pri);
+    int setHiddenSsid(char *ssid);
+    int setAllowedKeyManagement(uint32_t mask);
+    int setAllowedProtocols(uint32_t mask);
+    int setAllowedPairwiseCiphers(uint32_t mask);
+    int setAllowedGroupCiphers(uint32_t mask);
+};
+
+typedef android::List<WifiNetwork *> WifiNetworkCollection;
+
+#endif
diff --git a/nexus/WifiScanner.cpp b/nexus/WifiScanner.cpp
new file mode 100644
index 000000000..1bc972209
--- /dev/null
+++ b/nexus/WifiScanner.cpp
@@ -0,0 +1,86 @@
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <errno.h>
+#include <pthread.h>
+
+#define LOG_TAG "WifiScanner"
+#include <cutils/log.h>
+
+#include "WifiScanner.h"
+#include "Supplicant.h"
+
+extern "C" int pthread_cancel(pthread_t thread);
+
+WifiScanner::WifiScanner(Supplicant *suppl, int period) {
+    mSuppl = suppl;
+    mPeriod = period;
+    mActive = false;
+}
+
+int WifiScanner::start(bool active) {
+    mActive = active;
+
+    if(pipe(mCtrlPipe))
+        return -1;
+
+    if (pthread_create(&mThread, NULL, WifiScanner::threadStart, this))
+        return -1;
+    return 0;
+}
+
+void *WifiScanner::threadStart(void *obj) {
+    WifiScanner *me = reinterpret_cast<WifiScanner *>(obj);
+    me->run();
+    pthread_exit(NULL);
+    return NULL;
+}
+
+int WifiScanner::stop() {
+    char c = 0;
+
+    if (write(mCtrlPipe[1], &c, 1) != 1) {
+        LOGE("Error writing to control pipe (%s)", strerror(errno));
+        return -1;
+    }
+
+    void *ret;
+    if (pthread_join(mThread, &ret)) {
+        LOGE("Error joining to scanner thread (%s)", strerror(errno));
+        return -1;
+    }
+
+    close(mCtrlPipe[0]);
+    close(mCtrlPipe[1]);
+    return 0;
+}
+
+void WifiScanner::run() {
+    LOGD("Starting wifi scanner (active = %d)", mActive);
+
+    while(1) {
+        fd_set read_fds;
+        struct timeval to;
+        int rc = 0;
+
+        to.tv_sec = 0;
+        to.tv_sec = mPeriod;
+
+        FD_ZERO(&read_fds);
+        FD_SET(mCtrlPipe[0], &read_fds);
+
+        if (mSuppl->triggerScan(mActive)) {
+            LOGW("Error triggering scan (%s)", strerror(errno));
+        }
+
+        if ((rc = select(mCtrlPipe[0] + 1, &read_fds, NULL, NULL, &to)) < 0) {
+            LOGE("select failed (%s) - sleeping for one scanner period", strerror(errno));
+            sleep(mPeriod);
+            continue;
+        } else if (!rc) {
+        } else if (FD_ISSET(mCtrlPipe[0], &read_fds))
+            break;
+    } // while
+}
diff --git a/nexus/WifiScanner.h b/nexus/WifiScanner.h
new file mode 100644
index 000000000..4406e9fec
--- /dev/null
+++ b/nexus/WifiScanner.h
@@ -0,0 +1,31 @@
+#ifndef _WIFISCANNER_H
+#define _WIFISCANNER_H
+
+#include <pthread.h>
+
+class Supplicant;
+
+class WifiScanner {
+    pthread_t  mThread;
+    int        mCtrlPipe[2];
+    Supplicant *mSuppl;
+    int        mPeriod;
+    bool       mActive;
+    
+
+public:
+    WifiScanner(Supplicant *suppl, int period);
+    virtual ~WifiScanner() {}
+
+    int getPeriod() { return mPeriod; }
+
+    int start(bool active);
+    int stop();
+
+private:
+    static void *threadStart(void *obj);
+
+    void run();
+};
+
+#endif
diff --git a/nexus/main.cpp b/nexus/main.cpp
index a26a14d37..0aec3e5df 100644
--- a/nexus/main.cpp
+++ b/nexus/main.cpp
@@ -20,22 +20,47 @@
 
 #include "cutils/log.h"
 #include "NetworkManager.h"
+#include "CommandListener.h"
+
+#include "LoopController.h"
+#include "OpenVpnController.h"
+#include "TiwlanWifiController.h"
 
 int main() {
-    NetworkManager    *nm;
-
     LOGI("Nexus version 0.1 firing up");
 
-    if (!(nm = new NetworkManager())) {
+    CommandListener *cl = new CommandListener();
+
+    NetworkManager *nm;
+    if (!(nm = NetworkManager::Instance())) {
         LOGE("Unable to create NetworkManager");
         exit (-1);
     };
 
-    if (nm->run()) {
+    nm->setBroadcaster((SocketListener *) cl);
+
+    nm->attachController(new LoopController());
+    nm->attachController(new TiwlanWifiController("/system/lib/modules/wlan.ko", "wlan", ""));
+//    nm->attachController(new AndroidL2TPVpnController());
+    nm->attachController(new OpenVpnController());
+
+
+    if (NetworkManager::Instance()->run()) {
         LOGE("Unable to Run NetworkManager (%s)", strerror(errno));
         exit (1);
     }
 
+    if (cl->startListener()) {
+        LOGE("Unable to start CommandListener (%s)", strerror(errno));
+        exit (1);
+    }
+
+    // XXX: we'll use the main thread for the NetworkManager eventually
+    
+    while(1) {
+        sleep(1000);
+    }
+
     LOGI("Nexus exiting");
     exit(0);
 }
diff --git a/nexus/nexctl.c b/nexus/nexctl.c
index 6d117c778..4ad73c485 100644
--- a/nexus/nexctl.c
+++ b/nexus/nexctl.c
@@ -31,10 +31,6 @@
 
 #include <private/android_filesystem_config.h>
 
-static void signal_handler(int sig) {
-    fprintf(stdout, "{ interrupt! }\n");
-}
-
 int main(int argc, char **argv) {
     int sock;
 
@@ -47,58 +43,81 @@ int main(int argc, char **argv) {
 
     printf("Connected to nexus\n");
 
+    char line[255];
+    char *buffer = malloc(4096);
+    int cursor = 0;
+    int col = 0;
+
     while(1) {
         fd_set read_fds;
         struct timeval to;
         int rc = 0;
 
-        signal(SIGINT, SIG_DFL);
-
-        printf("-> ");
-        fflush(stdout);
-
-        char buffer[255];
-        if (!fgets(buffer, sizeof(buffer) -1, stdin)) {
-            printf("Exiting...\n");
-            exit(0);
-        }
-
-        buffer[strlen(buffer) -1] = 0;
-
-        printf("sending '%s'\n", buffer);
-        if (write(sock, buffer, strlen(buffer) +1) < 0) {
-            fprintf(stderr, "Error writing data (%s)\n", strerror(errno));
-            exit(2);
-        }
-
-wait:
-        to.tv_sec = 5;
+        to.tv_sec = 10;
         to.tv_usec = 0;
+
         FD_ZERO(&read_fds);
         FD_SET(sock, &read_fds);
+        FD_SET(0, &read_fds);
+
+        if (col == 0) {
+            fprintf(stdout, "-> ");
+            fflush(stdout);
+            col = 3;
+        }
     
-        signal(SIGINT, signal_handler);
-     
         if ((rc = select(sock +1, &read_fds, NULL, NULL, &to)) < 0) {
-            if (errno == EINTR)
-                continue;
             fprintf(stderr, "Error in select (%s)\n", strerror(errno));
             exit(2);
         } else if (!rc) {
-            printf("{response timeout}\n");
             continue;
         } else if (FD_ISSET(sock, &read_fds)) {
-printf("got data!\n");
-             if ((rc = read(sock, buffer, sizeof(buffer)-1)) < 0) {
+            memset(buffer, 0, 4096);
+            if ((rc = read(sock, buffer, 4096)) <= 0) {
                  fprintf(stderr, "Error reading response (%s)\n", strerror(errno));
                  exit(2);
-             }
-            printf(" |%s|\n", buffer);
-            goto wait;
+            }
+            int i;
+            for (i = 0; i < col; i++) {
+                fprintf(stdout, "%c", 8);
+            }
+
+            printf("%s", buffer);
+            printf("-> ");
+            for (i = 0; i < cursor; i++) {
+                fprintf(stdout, "%c", line[i]);
+            }
+            fflush(stdout);
+        } else if (FD_ISSET(0, &read_fds)) {
+            char c;
+
+            if ((rc = read(0, &c, 1)) < 0) {
+                fprintf(stderr, "Error reading from terminal (%s)\n", strerror(errno));
+                exit(2);
+            } else if (!rc) {
+                fprintf(stderr, "0 length read from terminal\n");
+                exit(2);
+            }
+
+            fprintf(stdout, "%c", c);
+            fflush(stdout);
+
+            line[cursor] = c;
+
+            if (c == '\n') {
+                if ((rc = write(sock, line, strlen(line))) < 0) {
+                    fprintf(stderr, "Error writing to nexus (%s)\n", strerror(errno));
+                    exit(2);
+                }
+                memset(line, 0, sizeof(line));
+                cursor = 0;
+                col = 0;
+            } else {
+                cursor++;
+                col++;
+            }
         }
     }
 
-
     exit(0);
-
 }
diff --git a/toolbox/ifconfig.c b/toolbox/ifconfig.c
index e83cd8bad..80c0e5ce0 100644
--- a/toolbox/ifconfig.c
+++ b/toolbox/ifconfig.c
@@ -28,20 +28,32 @@ static void setflags(int s, struct ifreq *ifr, int set, int clr)
 
 static inline void init_sockaddr_in(struct sockaddr_in *sin, const char *addr)
 {
-	sin->sin_family = AF_INET;
-	sin->sin_port = 0;
-	sin->sin_addr.s_addr = inet_addr(addr);
+    sin->sin_family = AF_INET;
+    sin->sin_port = 0;
+    sin->sin_addr.s_addr = inet_addr(addr);
+}
+
+static void setmtu(int s, struct ifreq *ifr, const char *mtu)
+{
+    int m = atoi(mtu);
+    ifr->ifr_mtu = m;
+    if(ioctl(s, SIOCSIFMTU, ifr) < 0) die("SIOCSIFMTU");
+}
+static void setdstaddr(int s, struct ifreq *ifr, const char *addr)
+{
+    init_sockaddr_in((struct sockaddr_in *) &ifr->ifr_dstaddr, addr);
+    if(ioctl(s, SIOCSIFDSTADDR, ifr) < 0) die("SIOCSIFDSTADDR");
 }
 
 static void setnetmask(int s, struct ifreq *ifr, const char *addr)
 {
-	init_sockaddr_in((struct sockaddr_in *) &ifr->ifr_netmask, addr);
+    init_sockaddr_in((struct sockaddr_in *) &ifr->ifr_netmask, addr);
     if(ioctl(s, SIOCSIFNETMASK, ifr) < 0) die("SIOCSIFNETMASK");
 }
 
 static void setaddr(int s, struct ifreq *ifr, const char *addr)
 {
-	init_sockaddr_in((struct sockaddr_in *) &ifr->ifr_addr, addr);
+    init_sockaddr_in((struct sockaddr_in *) &ifr->ifr_addr, addr);
     if(ioctl(s, SIOCSIFADDR, ifr) < 0) die("SIOCSIFADDR");
 }
 
@@ -109,31 +121,43 @@ int ifconfig_main(int argc, char *argv[])
         running = (flags & IFF_RUNNING)      ? " running" : "";
         multi =   (flags & IFF_MULTICAST)    ? " multicast" : "";
         printf("%s%s%s%s%s%s]\n", updown, brdcst, loopbk, ppp, running, multi);
-
-
-
-/*    char *updown, *brdcst, *loopbk, *ppp, *running, *multi; */
-
         return 0;
     }
     
-    while(argc > 0){
-        if(!strcmp(argv[0], "up")) {
+    while(argc > 0) {
+        if (!strcmp(argv[0], "up")) {
             setflags(s, &ifr, IFF_UP, 0);
-        } else if(!strcmp(argv[0], "down")) {
+        } else if (!strcmp(argv[0], "mtu")) {
+            argc--, argv++;
+            if (!argc) {
+                errno = EINVAL;
+                die("expecting a value for parameter \"mtu\"");
+            }
+            setmtu(s, &ifr, argv[0]);
+        } else if (!strcmp(argv[0], "-pointopoint")) {
+            setflags(s, &ifr, IFF_POINTOPOINT, 1);
+        } else if (!strcmp(argv[0], "pointopoint")) {
+            argc--, argv++;
+            if (!argc) { 
+                errno = EINVAL;
+                die("expecting an IP address for parameter \"pointtopoint\"");
+            }
+            setdstaddr(s, &ifr, argv[0]);
+            setflags(s, &ifr, IFF_POINTOPOINT, 0);
+        } else if (!strcmp(argv[0], "down")) {
             setflags(s, &ifr, 0, IFF_UP);
-		} else if(!strcmp(argv[0], "netmask")) {
-			argc--, argv++;
-			if (0 == argc) { 
-				errno = EINVAL;
-				die("expecting an IP address for parameter \"netmask\"");
-			}
-			setnetmask(s, &ifr, argv[0]);
-        } else if(isdigit(argv[0][0])){
+        } else if (!strcmp(argv[0], "netmask")) {
+            argc--, argv++;
+            if (!argc) { 
+                errno = EINVAL;
+                die("expecting an IP address for parameter \"netmask\"");
+            }
+            setnetmask(s, &ifr, argv[0]);
+        } else if (isdigit(argv[0][0])) {
             setaddr(s, &ifr, argv[0]);
+            setflags(s, &ifr, IFF_UP, 0);
         }
         argc--, argv++;
     }
-
     return 0;
 }
diff --git a/toolbox/route.c b/toolbox/route.c
index 86fc35b3e..2fd71080c 100644
--- a/toolbox/route.c
+++ b/toolbox/route.c
@@ -51,75 +51,79 @@ int route_main(int argc, char *argv[])
 {
     struct ifreq ifr;
     int s,i;
-	struct rtentry rt;
-	struct sockaddr_in ina;
+    struct rtentry rt;
+    struct sockaddr_in ina;
    
-    if(argc == 0) return 0;
-    
+    if (!argc)
+        return 0;
+
     strncpy(ifr.ifr_name, argv[0], IFNAMSIZ);
     ifr.ifr_name[IFNAMSIZ-1] = 0;
-	ADVANCE(argc, argv);
+    ADVANCE(argc, argv);
 
-    if((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+    if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
         die("cannot open control socket\n");
     }
 
     while(argc > 0){
-        if(!strcmp(argv[0], "add")) {
-			EXPECT_NEXT(argc, argv);
-			if(!strcmp(argv[0], "default")) {
-				EXPECT_NEXT(argc, argv);
-				memset((char *) &rt, 0, sizeof(struct rtentry));
-				rt.rt_dst.sa_family = AF_INET;	
-				if(!strcmp(argv[0], "dev")) {
-				  EXPECT_NEXT(argc, argv);
-				  rt.rt_flags = RTF_UP | RTF_HOST;
-				  rt.rt_dev = argv[0];
-				  if (ioctl(s, SIOCADDRT, &rt) < 0) die("SIOCADDRT\n");
-				}else if(!strcmp(argv[0], "gw")) {
-				  EXPECT_NEXT(argc, argv);
-				  rt.rt_flags = RTF_UP | RTF_GATEWAY;
-				  init_sockaddr_in((struct sockaddr_in *)&(rt.rt_genmask), "0.0.0.0");
-				  if(isdigit(argv[0][0])){
-					init_sockaddr_in((struct sockaddr_in *)&(rt.rt_gateway), argv[0]);
-				  }else{
-					die("expecting an IP address for parameter \"gw\"\n");
-				  }
-				  EXPECT_NEXT(argc, argv);
-				  if(!strcmp(argv[0], "dev")) {
-					EXPECT_NEXT(argc, argv);
-					rt.rt_dev = argv[0];
-					if (ioctl(s, SIOCADDRT, &rt) < 0){
-					  die("SIOCADDRT\n");
-					}
-				  }
-				}
-			} else  {
-                          char keywords[3][5] = { "net", "mask", "gw" };
-                          struct sockaddr_in *paddr[3] = { &rt.rt_dst, &rt.rt_genmask, &rt.rt_gateway };
-                          int k = 0;
-
-                          memset((char *) &rt, 0, sizeof(struct rtentry));
-                          rt.rt_flags = RTF_UP | RTF_GATEWAY;
-                          do {
-                            if(!strcmp(argv[0], keywords[k])) {
-                              EXPECT_NEXT(argc, argv);
-                              if(isdigit(argv[0][0])) {
-                                init_sockaddr_in(paddr[k], argv[0]);
-                              } else {
-                                die("expecting an IP/MASK address for parameter %s\n", keywords[k]);
-                              }
-                              if(k < 2) EXPECT_NEXT(argc, argv);
-                            } else {
-                              die("expecting keyword(s)\n");
-                            }
-                          } while(++k < 3);
-                          if(ioctl(s, SIOCADDRT, &rt) < 0) {
+        if (!strcmp(argv[0], "add")) {
+            EXPECT_NEXT(argc, argv);
+            if (!strcmp(argv[0], "default")) {
+                EXPECT_NEXT(argc, argv);
+                memset((char *) &rt, 0, sizeof(struct rtentry));
+                rt.rt_dst.sa_family = AF_INET;	
+                if(!strcmp(argv[0], "dev")) {
+                    EXPECT_NEXT(argc, argv);
+                    rt.rt_flags = RTF_UP | RTF_HOST;
+                    rt.rt_dev = argv[0];
+                    if (ioctl(s, SIOCADDRT, &rt) < 0)
+                        die("SIOCADDRT\n");
+                } else if (!strcmp(argv[0], "gw")) {
+                    EXPECT_NEXT(argc, argv);
+                    rt.rt_flags = RTF_UP | RTF_GATEWAY;
+                    init_sockaddr_in((struct sockaddr_in *)&(rt.rt_genmask), "0.0.0.0");
+                    if(isdigit(argv[0][0])) {
+                        init_sockaddr_in((struct sockaddr_in *)&(rt.rt_gateway), argv[0]);
+                    } else {
+                        die("expecting an IP address for parameter \"gw\"\n");
+                    }
+                    EXPECT_NEXT(argc, argv);
+                    if (!strcmp(argv[0], "dev")) {
+                        EXPECT_NEXT(argc, argv);
+                        rt.rt_dev = argv[0];
+                        if (ioctl(s, SIOCADDRT, &rt) < 0) {
                             die("SIOCADDRT\n");
-                          }
                         }
+                    }
+                }
+            } else {
+                char keywords[3][10] = { "-net", "netmask", "gw" };
+                struct sockaddr_in *paddr[3] = { &rt.rt_dst, &rt.rt_genmask, &rt.rt_gateway };
+                int k = 0;
+
+                memset((char *) &rt, 0, sizeof(struct rtentry));
+                rt.rt_flags = RTF_UP | RTF_GATEWAY;
+                do {
+                     if (!strcmp(argv[0], keywords[k])) {
+                         EXPECT_NEXT(argc, argv);
+                         if (isdigit(argv[0][0])) {
+                             init_sockaddr_in(paddr[k], argv[0]);
+                         } else {
+                            die("expecting an IP/MASK address for parameter %s\n", keywords[k]);
+                         }
+                     if (k < 2)
+                         EXPECT_NEXT(argc, argv);
+                     } else {
+                         die("expecting keyword(s)\n");
+                     }
+                 } while (++k < 3);
+
+                if (ioctl(s, SIOCADDRT, &rt) < 0) {
+                    die("SIOCADDRT\n");
+                }
+            }
         }
-		ADVANCE(argc, argv);
+        ADVANCE(argc, argv);
     }
 
     return 0;