diff --git a/Changelog b/Changelog
index 3b82c1bac5..1012400231 100644
--- a/Changelog
+++ b/Changelog
@@ -5,7 +5,7 @@
   - CPU model selection support (J. Mayer, Paul Brook, Herve Poussineau)
   - Several Sparc fixes (Aurelien Jarno, Blue Swirl, Robert Reif)
   - MIPS 64-bit FPU support (Thiemo Seufer)
-  - Xscale PDA emulation (Andrzei Zaborowski)
+  - Xscale PDA emulation (Andrzej Zaborowski)
   - ColdFire system emulation (Paul Brook)
   - Improved SH4 support (Magnus Damm)
   - MIPS64 support (Aurelien Jarno, Thiemo Seufer)
@@ -16,6 +16,7 @@
   - SPARC32PLUS execution support (Blue Swirl)
   - MIPS mipssim pequdo machine (Thiemo Seufer)
   - Strace for Linux userland emulation (Stuart Anderson, Thayne Harbaugh)
+  - OMAP310 MPU emulation plus Palm T|E machine (Andrzej Zaborowski)
 
 version 0.9.0:
 
diff --git a/Makefile.target b/Makefile.target
index 07047c18a8..48528413f8 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -519,7 +519,8 @@ VL_OBJS+= arm-semi.o
 VL_OBJS+= pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
 VL_OBJS+= pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o max111x.o max7310.o
 VL_OBJS+= spitz.o ads7846.o ide.o serial.o nand.o ecc.o $(AUDIODRV) wm8750.o
-VL_OBJS+= omap.o omap_lcdc.o omap1_clk.o omap_mmc.o palm.o tsc210x.o
+VL_OBJS+= omap.o omap_lcdc.o omap1_clk.o omap_mmc.o omap_i2c.o
+VL_OBJS+= palm.o tsc210x.o
 CPPFLAGS += -DHAS_AUDIO
 endif
 ifeq ($(TARGET_BASE_ARCH), sh4)
diff --git a/hw/omap.c b/hw/omap.c
index eb80b0a3af..0a77ee4e64 100644
--- a/hw/omap.c
+++ b/hw/omap.c
@@ -24,8 +24,11 @@
 /* Should signal the TCMI */
 uint32_t omap_badwidth_read8(void *opaque, target_phys_addr_t addr)
 {
+    uint8_t ret;
+
     OMAP_8B_REG(addr);
-    return 0;
+    cpu_physical_memory_read(addr, &ret, 1);
+    return ret;
 }
 
 void omap_badwidth_write8(void *opaque, target_phys_addr_t addr,
@@ -3466,15 +3469,15 @@ static void omap_pwl_write(void *opaque, target_phys_addr_t addr,
 }
 
 static CPUReadMemoryFunc *omap_pwl_readfn[] = {
-    omap_badwidth_read8,
-    omap_badwidth_read8,
     omap_pwl_read,
+    omap_badwidth_read8,
+    omap_badwidth_read8,
 };
 
 static CPUWriteMemoryFunc *omap_pwl_writefn[] = {
-    omap_badwidth_write8,
-    omap_badwidth_write8,
     omap_pwl_write,
+    omap_badwidth_write8,
+    omap_badwidth_write8,
 };
 
 void omap_pwl_reset(struct omap_mpu_state_s *s)
@@ -3571,15 +3574,15 @@ static void omap_pwt_write(void *opaque, target_phys_addr_t addr,
 }
 
 static CPUReadMemoryFunc *omap_pwt_readfn[] = {
-    omap_badwidth_read8,
-    omap_badwidth_read8,
     omap_pwt_read,
+    omap_badwidth_read8,
+    omap_badwidth_read8,
 };
 
 static CPUWriteMemoryFunc *omap_pwt_writefn[] = {
-    omap_badwidth_write8,
-    omap_badwidth_write8,
     omap_pwt_write,
+    omap_badwidth_write8,
+    omap_badwidth_write8,
 };
 
 void omap_pwt_reset(struct omap_mpu_state_s *s)
@@ -3603,421 +3606,6 @@ static void omap_pwt_init(target_phys_addr_t base, struct omap_mpu_state_s *s,
     cpu_register_physical_memory(s->pwt.base, 0x800, iomemtype);
 }
 
-/* Inter-Integrated Circuit Controller (only the "New I2C") */
-struct omap_i2c_s {
-    target_phys_addr_t base;
-    qemu_irq irq;
-    qemu_irq drq[2];
-    i2c_slave slave;
-    i2c_bus *bus;
-
-    uint8_t mask;
-    uint16_t stat;
-    uint16_t dma;
-    uint16_t count;
-    int count_cur;
-    uint32_t fifo;
-    int rxlen;
-    int txlen;
-    uint16_t control;
-    uint16_t addr[2];
-    uint8_t divider;
-    uint8_t times[2];
-    uint16_t test;
-};
-
-static void omap_i2c_interrupts_update(struct omap_i2c_s *s)
-{
-    qemu_set_irq(s->irq, s->stat & s->mask);
-    if ((s->dma >> 15) & 1)				/* RDMA_EN */
-        qemu_set_irq(s->drq[0], (s->stat >> 3) & 1);	/* RRDY */
-    if ((s->dma >> 7) & 1)				/* XDMA_EN */
-        qemu_set_irq(s->drq[1], (s->stat >> 4) & 1);	/* XRDY */
-}
-
-/* These are only stubs now.  */
-static void omap_i2c_event(i2c_slave *i2c, enum i2c_event event)
-{
-    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
-
-    if ((~s->control >> 15) & 1)				/* I2C_EN */
-        return;
-
-    switch (event) {
-    case I2C_START_SEND:
-    case I2C_START_RECV:
-        s->stat |= 1 << 9;					/* AAS */
-        break;
-    case I2C_FINISH:
-        s->stat |= 1 << 2;					/* ARDY */
-        break;
-    case I2C_NACK:
-        s->stat |= 1 << 1;					/* NACK */
-        break;
-    }
-
-    omap_i2c_interrupts_update(s);
-}
-
-static int omap_i2c_rx(i2c_slave *i2c)
-{
-    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
-    uint8_t ret = 0;
-
-    if ((~s->control >> 15) & 1)				/* I2C_EN */
-        return -1;
-
-    if (s->txlen)
-        ret = s->fifo >> ((-- s->txlen) << 3) & 0xff;
-    else
-        s->stat |= 1 << 10;					/* XUDF */
-    s->stat |= 1 << 4;						/* XRDY */
-
-    omap_i2c_interrupts_update(s);
-    return ret;
-}
-
-static int omap_i2c_tx(i2c_slave *i2c, uint8_t data)
-{
-    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
-
-    if ((~s->control >> 15) & 1)				/* I2C_EN */
-        return 1;
-
-    if (s->rxlen < 4)
-        s->fifo |= data << ((s->rxlen ++) << 3);
-    else
-        s->stat |= 1 << 11;					/* ROVR */
-    s->stat |= 1 << 3;						/* RRDY */
-
-    omap_i2c_interrupts_update(s);
-    return 1;
-}
-
-static void omap_i2c_fifo_run(struct omap_i2c_s *s)
-{
-    int ack = 1;
-
-    if (!i2c_bus_busy(s->bus))
-        return;
-
-    if ((s->control >> 2) & 1) {				/* RM */
-        if ((s->control >> 1) & 1) {				/* STP */
-            i2c_end_transfer(s->bus);
-            s->control &= ~(1 << 1);				/* STP */
-            s->count_cur = s->count;
-        } else if ((s->control >> 9) & 1) {			/* TRX */
-            while (ack && s->txlen)
-                ack = (i2c_send(s->bus,
-                                        (s->fifo >> ((-- s->txlen) << 3)) &
-                                        0xff) >= 0);
-            s->stat |= 1 << 4;					/* XRDY */
-        } else {
-            while (s->rxlen < 4)
-                s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
-            s->stat |= 1 << 3;					/* RRDY */
-        }
-    } else {
-        if ((s->control >> 9) & 1) {				/* TRX */
-            while (ack && s->count_cur && s->txlen) {
-                ack = (i2c_send(s->bus,
-                                        (s->fifo >> ((-- s->txlen) << 3)) &
-                                        0xff) >= 0);
-                s->count_cur --;
-            }
-            if (ack && s->count_cur)
-                s->stat |= 1 << 4;				/* XRDY */
-            if (!s->count_cur) {
-                s->stat |= 1 << 2;				/* ARDY */
-                s->control &= ~(1 << 10);			/* MST */
-            }
-        } else {
-            while (s->count_cur && s->rxlen < 4) {
-                s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
-                s->count_cur --;
-            }
-            if (s->rxlen)
-                s->stat |= 1 << 3;				/* RRDY */
-        }
-        if (!s->count_cur) {
-            if ((s->control >> 1) & 1) {			/* STP */
-                i2c_end_transfer(s->bus);
-                s->control &= ~(1 << 1);			/* STP */
-                s->count_cur = s->count;
-            } else {
-                s->stat |= 1 << 2;				/* ARDY */
-                s->control &= ~(1 << 10);			/* MST */
-            }
-        }
-    }
-
-    s->stat |= (!ack) << 1;					/* NACK */
-    if (!ack)
-        s->control &= ~(1 << 1);				/* STP */
-}
-
-static void omap_i2c_reset(struct omap_i2c_s *s)
-{
-    s->mask = 0;
-    s->stat = 0;
-    s->dma = 0;
-    s->count = 0;
-    s->count_cur = 0;
-    s->fifo = 0;
-    s->rxlen = 0;
-    s->txlen = 0;
-    s->control = 0;
-    s->addr[0] = 0;
-    s->addr[1] = 0;
-    s->divider = 0;
-    s->times[0] = 0;
-    s->times[1] = 0;
-    s->test = 0;
-}
-
-static uint32_t omap_i2c_read(void *opaque, target_phys_addr_t addr)
-{
-    struct omap_i2c_s *s = (struct omap_i2c_s *) opaque;
-    int offset = addr - s->base;
-    uint16_t ret;
-
-    switch (offset) {
-    case 0x00:	/* I2C_REV */
-        /* TODO: set a value greater or equal to real hardware */
-        return 0x11;						/* REV */
-
-    case 0x04:	/* I2C_IE */
-        return s->mask;
-
-    case 0x08:	/* I2C_STAT */
-        return s->stat | (i2c_bus_busy(s->bus) << 12);
-
-    case 0x0c:	/* I2C_IV */
-        ret = ffs(s->stat & s->mask);
-        if (ret)
-            s->stat ^= 1 << (ret - 1);
-        omap_i2c_interrupts_update(s);
-        return ret;
-
-    case 0x14:	/* I2C_BUF */
-        return s->dma;
-
-    case 0x18:	/* I2C_CNT */
-        return s->count_cur;					/* DCOUNT */
-
-    case 0x1c:	/* I2C_DATA */
-        ret = 0;
-        if (s->control & (1 << 14)) {				/* BE */
-            ret |= ((s->fifo >> 0) & 0xff) << 8;
-            ret |= ((s->fifo >> 8) & 0xff) << 0;
-        } else {
-            ret |= ((s->fifo >> 8) & 0xff) << 8;
-            ret |= ((s->fifo >> 0) & 0xff) << 0;
-        }
-        if (s->rxlen == 1) {
-            s->stat |= 1 << 15;					/* SBD */
-            s->rxlen = 0;
-        } else if (s->rxlen > 1) {
-            if (s->rxlen > 2)
-                s->fifo >>= 16;
-            s->rxlen -= 2;
-        } else
-            /* XXX: remote access (qualifier) error - what's that?  */;
-        if (!s->rxlen) {
-            s->stat |= ~(1 << 3);				/* RRDY */
-            if (((s->control >> 10) & 1) &&			/* MST */
-                            ((~s->control >> 9) & 1)) {		/* TRX */
-                s->stat |= 1 << 2;				/* ARDY */
-                s->control &= ~(1 << 10);			/* MST */
-            }
-        }
-        s->stat &= ~(1 << 11);					/* ROVR */
-        omap_i2c_fifo_run(s);
-        omap_i2c_interrupts_update(s);
-        return ret;
-
-    case 0x24:	/* I2C_CON */
-        return s->control;
-
-    case 0x28:	/* I2C_OA */
-        return s->addr[0];
-
-    case 0x2c:	/* I2C_SA */
-        return s->addr[1];
-
-    case 0x30:	/* I2C_PSC */
-        return s->divider;
-
-    case 0x34:	/* I2C_SCLL */
-        return s->times[0];
-
-    case 0x38:	/* I2C_SCLH */
-        return s->times[1];
-
-    case 0x3c:	/* I2C_SYSTEST */
-        if (s->test & (1 << 15)) {				/* ST_EN */
-            s->test ^= 0xa;
-            return s->test;
-        } else
-            return s->test & ~0x300f;
-    }
-
-    OMAP_BAD_REG(addr);
-    return 0;
-}
-
-static void omap_i2c_write(void *opaque, target_phys_addr_t addr,
-                uint32_t value)
-{
-    struct omap_i2c_s *s = (struct omap_i2c_s *) opaque;
-    int offset = addr - s->base;
-    int nack;
-
-    switch (offset) {
-    case 0x00:	/* I2C_REV */
-    case 0x08:	/* I2C_STAT */
-    case 0x0c:	/* I2C_IV */
-        OMAP_BAD_REG(addr);
-        return;
-
-    case 0x04:	/* I2C_IE */
-        s->mask = value & 0x1f;
-        break;
-
-    case 0x14:	/* I2C_BUF */
-        s->dma = value & 0x8080;
-        if (value & (1 << 15))					/* RDMA_EN */
-            s->mask &= ~(1 << 3);				/* RRDY_IE */
-        if (value & (1 << 7))					/* XDMA_EN */
-            s->mask &= ~(1 << 4);				/* XRDY_IE */
-        break;
-
-    case 0x18:	/* I2C_CNT */
-        s->count = value;					/* DCOUNT */
-        break;
-
-    case 0x1c:	/* I2C_DATA */
-        if (s->txlen > 2) {
-            /* XXX: remote access (qualifier) error - what's that?  */
-            break;
-        }
-        s->fifo <<= 16;
-        s->txlen += 2;
-        if (s->control & (1 << 14)) {				/* BE */
-            s->fifo |= ((value >> 8) & 0xff) << 8;
-            s->fifo |= ((value >> 0) & 0xff) << 0;
-        } else {
-            s->fifo |= ((value >> 0) & 0xff) << 8;
-            s->fifo |= ((value >> 8) & 0xff) << 0;
-        }
-        s->stat &= ~(1 << 10);					/* XUDF */
-        if (s->txlen > 2)
-            s->stat &= ~(1 << 4);				/* XRDY */
-        omap_i2c_fifo_run(s);
-        omap_i2c_interrupts_update(s);
-        break;
-
-    case 0x24:	/* I2C_CON */
-        s->control = value & 0xcf07;
-        if (~value & (1 << 15)) {				/* I2C_EN */
-            omap_i2c_reset(s);
-            break;
-        }
-        if (~value & (1 << 10)) {				/* MST */
-            printf("%s: I^2C slave mode not supported\n", __FUNCTION__);
-            break;
-        }
-        if (value & (1 << 9)) {					/* XA */
-            printf("%s: 10-bit addressing mode not supported\n", __FUNCTION__);
-            break;
-        }
-        if (value & (1 << 0)) {					/* STT */
-            nack = !!i2c_start_transfer(s->bus, s->addr[1],	/* SA */
-                            (~value >> 9) & 1);			/* TRX */
-            s->stat |= nack << 1;				/* NACK */
-            s->control &= ~(1 << 0);				/* STT */
-            if (nack)
-                s->control &= ~(1 << 1);			/* STP */
-            else
-                omap_i2c_fifo_run(s);
-            omap_i2c_interrupts_update(s);
-        }
-        break;
-
-    case 0x28:	/* I2C_OA */
-        s->addr[0] = value & 0x3ff;
-        i2c_set_slave_address(&s->slave, value & 0x7f);
-        break;
-
-    case 0x2c:	/* I2C_SA */
-        s->addr[1] = value & 0x3ff;
-        break;
-
-    case 0x30:	/* I2C_PSC */
-        s->divider = value;
-        break;
-
-    case 0x34:	/* I2C_SCLL */
-        s->times[0] = value;
-        break;
-
-    case 0x38:	/* I2C_SCLH */
-        s->times[1] = value;
-        break;
-
-    case 0x3c:	/* I2C_SYSTEST */
-        s->test = value & 0xf00f;
-        if (value & (1 << 15))					/* ST_EN */
-            printf("%s: System Test not supported\n", __FUNCTION__);
-        break;
-
-    default:
-        OMAP_BAD_REG(addr);
-        return;
-    }
-}
-
-static CPUReadMemoryFunc *omap_i2c_readfn[] = {
-    omap_badwidth_read16,
-    omap_i2c_read,
-    omap_badwidth_read16,
-};
-
-static CPUWriteMemoryFunc *omap_i2c_writefn[] = {
-    omap_badwidth_write16,
-    omap_i2c_write,
-    omap_i2c_write,	/* TODO: Only the last fifo write can be 8 bit.  */
-};
-
-struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
-                qemu_irq irq, qemu_irq *dma, omap_clk clk)
-{
-    int iomemtype;
-    struct omap_i2c_s *s = (struct omap_i2c_s *)
-            qemu_mallocz(sizeof(struct omap_i2c_s));
-
-    s->base = base;
-    s->irq = irq;
-    s->drq[0] = dma[0];
-    s->drq[1] = dma[1];
-    s->slave.event = omap_i2c_event;
-    s->slave.recv = omap_i2c_rx;
-    s->slave.send = omap_i2c_tx;
-    s->bus = i2c_init_bus();
-    omap_i2c_reset(s);
-
-    iomemtype = cpu_register_io_memory(0, omap_i2c_readfn,
-                    omap_i2c_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
-
-    return s;
-}
-
-i2c_bus *omap_i2c_bus(struct omap_i2c_s *s)
-{
-    return s->bus;
-}
-
 /* Real-time Clock module */
 struct omap_rtc_s {
     target_phys_addr_t base;
@@ -4607,6 +4195,26 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
 
     s->rtc = omap_rtc_init(0xfffb4800, &s->irq[1][OMAP_INT_RTC_TIMER],
                     omap_findclk(s, "clk32-kHz"));
+
+    /* Register mappings not currenlty implemented:
+     * McBSP2 Comm	fffb1000 - fffb17ff
+     * McBSP1 Audio	fffb1800 - fffb1fff (not mapped on OMAP310)
+     * MCSI2 Comm	fffb2000 - fffb27ff (not mapped on OMAP310)
+     * MCSI1 Bluetooth	fffb2800 - fffb2fff (not mapped on OMAP310)
+     * USB W2FC		fffb4000 - fffb47ff
+     * Camera Interface	fffb6800 - fffb6fff
+     * McBSP3		fffb7000 - fffb77ff (not mapped on OMAP310)
+     * USB Host		fffba000 - fffba7ff
+     * FAC		fffba800 - fffbafff
+     * HDQ/1-Wire	fffbc000 - fffbc7ff
+     * LED1		fffbd000 - fffbd7ff
+     * LED2		fffbd800 - fffbdfff
+     * Mailbox		fffcf000 - fffcf7ff
+     * Local bus IF	fffec100 - fffec1ff
+     * Local bus MMU	fffec200 - fffec2ff
+     * DSP MMU		fffed200 - fffed2ff
+     */
+
     qemu_register_reset(omap_mpu_reset, s);
 
     return s;
diff --git a/hw/omap.h b/hw/omap.h
index 9b8da8f31b..aced59329d 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -475,11 +475,6 @@ struct omap_uwire_s *omap_uwire_init(target_phys_addr_t base,
 void omap_uwire_attach(struct omap_uwire_s *s,
                 struct uwire_slave_s *slave, int chipselect);
 
-struct omap_i2c_s;
-struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
-                qemu_irq irq, qemu_irq *dma, omap_clk clk);
-i2c_bus *omap_i2c_bus(struct omap_i2c_s *s);
-
 struct omap_rtc_s;
 struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
                 qemu_irq *irq, omap_clk clk);
@@ -498,6 +493,13 @@ struct omap_mmc_s *omap_mmc_init(target_phys_addr_t base,
 void omap_mmc_reset(struct omap_mmc_s *s);
 void omap_mmc_handlers(struct omap_mmc_s *s, qemu_irq ro, qemu_irq cover);
 
+/* omap_i2c.c */
+struct omap_i2c_s;
+struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
+                qemu_irq irq, qemu_irq *dma, omap_clk clk);
+void omap_i2c_reset(struct omap_i2c_s *s);
+i2c_bus *omap_i2c_bus(struct omap_i2c_s *s);
+
 # define cpu_is_omap310(cpu)		(cpu->mpu_model == omap310)
 # define cpu_is_omap1510(cpu)		(cpu->mpu_model == omap1510)
 # define cpu_is_omap15xx(cpu)		\
@@ -561,6 +563,8 @@ struct omap_mpu_state_s {
 
     struct omap_i2c_s *i2c;
 
+    struct omap_rtc_s *rtc;
+
     /* MPU private TIPB peripherals */
     struct omap_intr_handler_s *ih[2];
 
diff --git a/hw/omap_i2c.c b/hw/omap_i2c.c
new file mode 100644
index 0000000000..af00be3207
--- /dev/null
+++ b/hw/omap_i2c.c
@@ -0,0 +1,435 @@
+/*
+ * TI OMAP on-chip I2C controller.  Only "new I2C" mode supported.
+ *
+ * Copyright (C) 2007 Andrzej Zaborowski  <balrog@zabor.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+#include "vl.h"
+
+struct omap_i2c_s {
+    target_phys_addr_t base;
+    qemu_irq irq;
+    qemu_irq drq[2];
+    i2c_slave slave;
+    i2c_bus *bus;
+
+    uint8_t mask;
+    uint16_t stat;
+    uint16_t dma;
+    uint16_t count;
+    int count_cur;
+    uint32_t fifo;
+    int rxlen;
+    int txlen;
+    uint16_t control;
+    uint16_t addr[2];
+    uint8_t divider;
+    uint8_t times[2];
+    uint16_t test;
+};
+
+static void omap_i2c_interrupts_update(struct omap_i2c_s *s)
+{
+    qemu_set_irq(s->irq, s->stat & s->mask);
+    if ((s->dma >> 15) & 1)					/* RDMA_EN */
+        qemu_set_irq(s->drq[0], (s->stat >> 3) & 1);		/* RRDY */
+    if ((s->dma >> 7) & 1)					/* XDMA_EN */
+        qemu_set_irq(s->drq[1], (s->stat >> 4) & 1);		/* XRDY */
+}
+
+/* These are only stubs now.  */
+static void omap_i2c_event(i2c_slave *i2c, enum i2c_event event)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
+
+    if ((~s->control >> 15) & 1)				/* I2C_EN */
+        return;
+
+    switch (event) {
+    case I2C_START_SEND:
+    case I2C_START_RECV:
+        s->stat |= 1 << 9;					/* AAS */
+        break;
+    case I2C_FINISH:
+        s->stat |= 1 << 2;					/* ARDY */
+        break;
+    case I2C_NACK:
+        s->stat |= 1 << 1;					/* NACK */
+        break;
+    }
+
+    omap_i2c_interrupts_update(s);
+}
+
+static int omap_i2c_rx(i2c_slave *i2c)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
+    uint8_t ret = 0;
+
+    if ((~s->control >> 15) & 1)				/* I2C_EN */
+        return -1;
+
+    if (s->txlen)
+        ret = s->fifo >> ((-- s->txlen) << 3) & 0xff;
+    else
+        s->stat |= 1 << 10;					/* XUDF */
+    s->stat |= 1 << 4;						/* XRDY */
+
+    omap_i2c_interrupts_update(s);
+    return ret;
+}
+
+static int omap_i2c_tx(i2c_slave *i2c, uint8_t data)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
+
+    if ((~s->control >> 15) & 1)				/* I2C_EN */
+        return 1;
+
+    if (s->rxlen < 4)
+        s->fifo |= data << ((s->rxlen ++) << 3);
+    else
+        s->stat |= 1 << 11;					/* ROVR */
+    s->stat |= 1 << 3;						/* RRDY */
+
+    omap_i2c_interrupts_update(s);
+    return 1;
+}
+
+static void omap_i2c_fifo_run(struct omap_i2c_s *s)
+{
+    int ack = 1;
+
+    if (!i2c_bus_busy(s->bus))
+        return;
+
+    if ((s->control >> 2) & 1) {				/* RM */
+        if ((s->control >> 1) & 1) {				/* STP */
+            i2c_end_transfer(s->bus);
+            s->control &= ~(1 << 1);				/* STP */
+            s->count_cur = s->count;
+        } else if ((s->control >> 9) & 1) {			/* TRX */
+            while (ack && s->txlen)
+                ack = (i2c_send(s->bus,
+                                        (s->fifo >> ((-- s->txlen) << 3)) &
+                                        0xff) >= 0);
+            s->stat |= 1 << 4;					/* XRDY */
+        } else {
+            while (s->rxlen < 4)
+                s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
+            s->stat |= 1 << 3;					/* RRDY */
+        }
+    } else {
+        if ((s->control >> 9) & 1) {				/* TRX */
+            while (ack && s->count_cur && s->txlen) {
+                ack = (i2c_send(s->bus,
+                                        (s->fifo >> ((-- s->txlen) << 3)) &
+                                        0xff) >= 0);
+                s->count_cur --;
+            }
+            if (ack && s->count_cur)
+                s->stat |= 1 << 4;				/* XRDY */
+            if (!s->count_cur) {
+                s->stat |= 1 << 2;				/* ARDY */
+                s->control &= ~(1 << 10);			/* MST */
+            }
+        } else {
+            while (s->count_cur && s->rxlen < 4) {
+                s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
+                s->count_cur --;
+            }
+            if (s->rxlen)
+                s->stat |= 1 << 3;				/* RRDY */
+        }
+        if (!s->count_cur) {
+            if ((s->control >> 1) & 1) {			/* STP */
+                i2c_end_transfer(s->bus);
+                s->control &= ~(1 << 1);			/* STP */
+                s->count_cur = s->count;
+            } else {
+                s->stat |= 1 << 2;				/* ARDY */
+                s->control &= ~(1 << 10);			/* MST */
+            }
+        }
+    }
+
+    s->stat |= (!ack) << 1;					/* NACK */
+    if (!ack)
+        s->control &= ~(1 << 1);				/* STP */
+}
+
+void omap_i2c_reset(struct omap_i2c_s *s)
+{
+    s->mask = 0;
+    s->stat = 0;
+    s->dma = 0;
+    s->count = 0;
+    s->count_cur = 0;
+    s->fifo = 0;
+    s->rxlen = 0;
+    s->txlen = 0;
+    s->control = 0;
+    s->addr[0] = 0;
+    s->addr[1] = 0;
+    s->divider = 0;
+    s->times[0] = 0;
+    s->times[1] = 0;
+    s->test = 0;
+}
+
+static uint32_t omap_i2c_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) opaque;
+    int offset = addr - s->base;
+    uint16_t ret;
+
+    switch (offset) {
+    case 0x00:	/* I2C_REV */
+        /* TODO: set a value greater or equal to real hardware */
+        return 0x11;						/* REV */
+
+    case 0x04:	/* I2C_IE */
+        return s->mask;
+
+    case 0x08:	/* I2C_STAT */
+        return s->stat | (i2c_bus_busy(s->bus) << 12);
+
+    case 0x0c:	/* I2C_IV */
+        ret = ffs(s->stat & s->mask);
+        if (ret)
+            s->stat ^= 1 << (ret - 1);
+        omap_i2c_interrupts_update(s);
+        return ret;
+
+    case 0x14:	/* I2C_BUF */
+        return s->dma;
+
+    case 0x18:	/* I2C_CNT */
+        return s->count_cur;					/* DCOUNT */
+
+    case 0x1c:	/* I2C_DATA */
+        ret = 0;
+        if (s->control & (1 << 14)) {				/* BE */
+            ret |= ((s->fifo >> 0) & 0xff) << 8;
+            ret |= ((s->fifo >> 8) & 0xff) << 0;
+        } else {
+            ret |= ((s->fifo >> 8) & 0xff) << 8;
+            ret |= ((s->fifo >> 0) & 0xff) << 0;
+        }
+        if (s->rxlen == 1) {
+            s->stat |= 1 << 15;					/* SBD */
+            s->rxlen = 0;
+        } else if (s->rxlen > 1) {
+            if (s->rxlen > 2)
+                s->fifo >>= 16;
+            s->rxlen -= 2;
+        } else
+            /* XXX: remote access (qualifier) error - what's that?  */;
+        if (!s->rxlen) {
+            s->stat |= ~(1 << 3);				/* RRDY */
+            if (((s->control >> 10) & 1) &&			/* MST */
+                            ((~s->control >> 9) & 1)) {		/* TRX */
+                s->stat |= 1 << 2;				/* ARDY */
+                s->control &= ~(1 << 10);			/* MST */
+            }
+        }
+        s->stat &= ~(1 << 11);					/* ROVR */
+        omap_i2c_fifo_run(s);
+        omap_i2c_interrupts_update(s);
+        return ret;
+
+    case 0x24:	/* I2C_CON */
+        return s->control;
+
+    case 0x28:	/* I2C_OA */
+        return s->addr[0];
+
+    case 0x2c:	/* I2C_SA */
+        return s->addr[1];
+
+    case 0x30:	/* I2C_PSC */
+        return s->divider;
+
+    case 0x34:	/* I2C_SCLL */
+        return s->times[0];
+
+    case 0x38:	/* I2C_SCLH */
+        return s->times[1];
+
+    case 0x3c:	/* I2C_SYSTEST */
+        if (s->test & (1 << 15)) {				/* ST_EN */
+            s->test ^= 0xa;
+            return s->test;
+        } else
+            return s->test & ~0x300f;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_i2c_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) opaque;
+    int offset = addr - s->base;
+    int nack;
+
+    switch (offset) {
+    case 0x00:	/* I2C_REV */
+    case 0x08:	/* I2C_STAT */
+    case 0x0c:	/* I2C_IV */
+        OMAP_BAD_REG(addr);
+        return;
+
+    case 0x04:	/* I2C_IE */
+        s->mask = value & 0x1f;
+        break;
+
+    case 0x14:	/* I2C_BUF */
+        s->dma = value & 0x8080;
+        if (value & (1 << 15))					/* RDMA_EN */
+            s->mask &= ~(1 << 3);				/* RRDY_IE */
+        if (value & (1 << 7))					/* XDMA_EN */
+            s->mask &= ~(1 << 4);				/* XRDY_IE */
+        break;
+
+    case 0x18:	/* I2C_CNT */
+        s->count = value;					/* DCOUNT */
+        break;
+
+    case 0x1c:	/* I2C_DATA */
+        if (s->txlen > 2) {
+            /* XXX: remote access (qualifier) error - what's that?  */
+            break;
+        }
+        s->fifo <<= 16;
+        s->txlen += 2;
+        if (s->control & (1 << 14)) {				/* BE */
+            s->fifo |= ((value >> 8) & 0xff) << 8;
+            s->fifo |= ((value >> 0) & 0xff) << 0;
+        } else {
+            s->fifo |= ((value >> 0) & 0xff) << 8;
+            s->fifo |= ((value >> 8) & 0xff) << 0;
+        }
+        s->stat &= ~(1 << 10);					/* XUDF */
+        if (s->txlen > 2)
+            s->stat &= ~(1 << 4);				/* XRDY */
+        omap_i2c_fifo_run(s);
+        omap_i2c_interrupts_update(s);
+        break;
+
+    case 0x24:	/* I2C_CON */
+        s->control = value & 0xcf07;
+        if (~value & (1 << 15)) {				/* I2C_EN */
+            omap_i2c_reset(s);
+            break;
+        }
+        if (~value & (1 << 10)) {				/* MST */
+            printf("%s: I^2C slave mode not supported\n", __FUNCTION__);
+            break;
+        }
+        if (value & (1 << 9)) {					/* XA */
+            printf("%s: 10-bit addressing mode not supported\n", __FUNCTION__);
+            break;
+        }
+        if (value & (1 << 0)) {					/* STT */
+            nack = !!i2c_start_transfer(s->bus, s->addr[1],	/* SA */
+                            (~value >> 9) & 1);			/* TRX */
+            s->stat |= nack << 1;				/* NACK */
+            s->control &= ~(1 << 0);				/* STT */
+            if (nack)
+                s->control &= ~(1 << 1);			/* STP */
+            else
+                omap_i2c_fifo_run(s);
+            omap_i2c_interrupts_update(s);
+        }
+        break;
+
+    case 0x28:	/* I2C_OA */
+        s->addr[0] = value & 0x3ff;
+        i2c_set_slave_address(&s->slave, value & 0x7f);
+        break;
+
+    case 0x2c:	/* I2C_SA */
+        s->addr[1] = value & 0x3ff;
+        break;
+
+    case 0x30:	/* I2C_PSC */
+        s->divider = value;
+        break;
+
+    case 0x34:	/* I2C_SCLL */
+        s->times[0] = value;
+        break;
+
+    case 0x38:	/* I2C_SCLH */
+        s->times[1] = value;
+        break;
+
+    case 0x3c:	/* I2C_SYSTEST */
+        s->test = value & 0xf00f;
+        if (value & (1 << 15))					/* ST_EN */
+            printf("%s: System Test not supported\n", __FUNCTION__);
+        break;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_i2c_readfn[] = {
+    omap_badwidth_read16,
+    omap_i2c_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_i2c_writefn[] = {
+    omap_badwidth_write16,
+    omap_i2c_write,
+    omap_i2c_write,	/* TODO: Only the last fifo write can be 8 bit.  */
+};
+
+struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
+                qemu_irq irq, qemu_irq *dma, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_i2c_s *s = (struct omap_i2c_s *)
+            qemu_mallocz(sizeof(struct omap_i2c_s));
+
+    s->base = base;
+    s->irq = irq;
+    s->drq[0] = dma[0];
+    s->drq[1] = dma[1];
+    s->slave.event = omap_i2c_event;
+    s->slave.recv = omap_i2c_rx;
+    s->slave.send = omap_i2c_tx;
+    s->bus = i2c_init_bus();
+    omap_i2c_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_i2c_readfn,
+                    omap_i2c_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    return s;
+}
+
+i2c_bus *omap_i2c_bus(struct omap_i2c_s *s)
+{
+    return s->bus;
+}
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 4d31f648e7..75ba3825f3 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -83,6 +83,7 @@ For system emulation, the following hardware targets are supported:
 @item Spitz, Akita, Borzoi and Terrier PDAs (PXA270 processor)
 @item Freescale MCF5208EVB (ColdFire V2).
 @item Arnewsh MCF5206 evaluation board (ColdFire V2).
+@item Palm Tungsten|E PDA (OMAP310 processor)
 @end itemize
 
 For user emulation, x86, PowerPC, ARM, MIPS, Sparc32/64 and ColdFire(m68k) CPUs are supported.
@@ -2208,6 +2209,29 @@ Three on-chip UARTs
 WM8750 audio CODEC on I@math{^2}C and I@math{^2}S busses
 @end itemize
 
+The Palm Tungsten|E PDA (codename "Cheetah") emulation includes the
+following elements:
+
+@itemize @minus
+@item
+Texas Instruments OMAP310 System-on-chip (ARM 925T core)
+@item
+ROM and RAM memories (ROM firmware image can be loaded with -option-rom)
+@item
+On-chip LCD controller
+@item
+On-chip Real Time Clock
+@item
+TI TSC2102i touchscreen controller / analog-digital converter / Audio
+CODEC, connected through MicroWire and I@math{^2}S busses
+@item
+GPIO-connected matrix keypad
+@item
+Secure Digital card connected to OMAP MMC/SD host
+@item
+Three on-chip UARTs
+@end itemize
+
 A Linux 2.6 test image is available on the QEMU web site. More
 information is available in the QEMU mailing-list archive.