diff --git a/hw/mcf.h b/hw/mcf.h
index 91f2821..e464734 100644
--- a/hw/mcf.h
+++ b/hw/mcf.h
@@ -10,7 +10,7 @@ void mcf_uart_mm_init(target_phys_addr_t base, 
qemu_irq irq,
                        CharDriverState *chr);

  /* mcf_intc.c */
-qemu_irq *mcf_intc_init(target_phys_addr_t base, CPUState *env);
+qemu_irq *mcf_intc_init(target_phys_addr_t base, CPUState *env, int 
is_uc5282);

  /* mcf_fec.c */
  void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq);
diff --git a/hw/mcf5208.c b/hw/mcf5208.c
index 17a692d..ad52dff 100644
--- a/hw/mcf5208.c
+++ b/hw/mcf5208.c
@@ -197,6 +197,60 @@ static void mcf5208_sys_init(qemu_irq *pic)
      }
  }

+static uint32_t m5208_resetc_read(void *opaque, target_phys_addr_t addr)
+{
+    switch (addr) {
+    case 0x0: /* RCR */
+    case 0x1: /* RSR */
+        return 0;
+
+    default:
+        hw_error("m5208_resetc_read: Bad offset 0x%x\n", (int)addr);
+        return 0;
+    }
+}
+
+static void m5208_resetc_write(void *opaque, target_phys_addr_t addr,
+                            uint32_t value)
+{
+    switch (addr) {
+    case 0x0: /* RCR */
+        if ( value & 0x80 ) {
+            qemu_system_shutdown_request();
+        }
+        break;
+    case 0x1: /* RSR */
+        break;
+
+    default:
+        hw_error("m5208_resetc_write: Bad offset 0x%x\n", (int)addr);
+        break;
+    }
+}
+
+static CPUReadMemoryFunc *m5208_resetc_readfn[] = {
+   m5208_resetc_read,
+   m5208_resetc_read,
+   m5208_resetc_read
+};
+
+static CPUWriteMemoryFunc *m5208_resetc_writefn[] = {
+   m5208_resetc_write,
+   m5208_resetc_write,
+   m5208_resetc_write
+};
+
+static void mcf5208_resetc_init(target_phys_addr_t offset)
+{
+    int iomemtype;
+
+    iomemtype = cpu_register_io_memory(m5208_resetc_readfn,
+                                       m5208_resetc_writefn, NULL,
+                                       DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(offset, 0x4, iomemtype);
+}
+
+
  static void mcf5208evb_init(ram_addr_t ram_size,
                       const char *boot_device,
                       const char *kernel_filename, const char 
*kernel_cmdline,
@@ -229,12 +283,14 @@ static void mcf5208evb_init(ram_addr_t ram_size,
          qemu_ram_alloc(NULL, "mcf5208.sram", 16384) | IO_MEM_RAM);

      /* Internal peripherals.  */
-    pic = mcf_intc_init(0xfc048000, env);
+    pic = mcf_intc_init(0xfc048000, env, 0);

      mcf_uart_mm_init(0xfc060000, pic[26], serial_hds[0]);
      mcf_uart_mm_init(0xfc064000, pic[27], serial_hds[1]);
      mcf_uart_mm_init(0xfc068000, pic[28], serial_hds[2]);

+    mcf5208_resetc_init(0xfc0a0000);
+
      mcf5208_sys_init(pic);

      if (nb_nics > 1) {
@@ -293,14 +349,139 @@ static void mcf5208evb_init(ram_addr_t ram_size,

  static QEMUMachine mcf5208evb_machine = {
      .name = "mcf5208evb",
-    .desc = "MCF5206EVB",
+    .desc = "MCF5208EVB",
      .init = mcf5208evb_init,
      .is_default = 1,
  };

+static void mcf5282_sys_init(qemu_irq *pic)
+{
+    int iomemtype;
+    m5208_timer_state *s;
+    QEMUBH *bh;
+    int i;
+
+    /* Timers.  */
+    for (i = 0; i < 4; i++) {
+        s = (m5208_timer_state *)qemu_mallocz(sizeof(m5208_timer_state));
+        bh = qemu_bh_new(m5208_timer_trigger, s);
+        s->timer = ptimer_init(bh);
+        iomemtype = cpu_register_io_memory(m5208_timer_readfn,
+                                           m5208_timer_writefn, s,
+                                           DEVICE_NATIVE_ENDIAN);
+        cpu_register_physical_memory(0x40150000 + 0x10000 * i, 0x00000008,
+                                     iomemtype);
+        s->irq = pic[55 + i];
+    }
+}
+
+static void uc5282_init(ram_addr_t ram_size,
+                     const char *boot_device,
+                     const char *kernel_filename, const char 
*kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    CPUState *env;
+    int kernel_size;
+    uint64_t elf_entry;
+    target_ulong entry;
+    qemu_irq *pic;
+
+    if (!cpu_model)
+        cpu_model = "m5208";
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find m68k CPU definition\n");
+        exit(1);
+    }
+
+    /* Initialize CPU registers.  */
+    env->vbr = 0;
+    /* TODO: Configure BARs.  */
+
+    /* DRAM at 0x00000000 */
+    cpu_register_physical_memory(0x00000000, ram_size,
+        qemu_ram_alloc(NULL, "uc5282.dram", ram_size) | IO_MEM_RAM);
+
+    /* Internal SRAM.  */
+    cpu_register_physical_memory(0x20000000, 65536,
+        qemu_ram_alloc(NULL, "uc5282.sram", 65536) | IO_MEM_RAM);
+
+    /* Internal peripherals.  */
+    pic = mcf_intc_init(0x40000c00, env, 1);
+
+    mcf_uart_mm_init(0x40000200, pic[13], serial_hds[0]);
+    mcf_uart_mm_init(0x40000240, pic[14], serial_hds[1]);
+    mcf_uart_mm_init(0x40000280, pic[15], serial_hds[2]);
+
+    mcf5208_resetc_init(0x40110000);
+
+    mcf5282_sys_init(pic);
+
+    if (nb_nics > 1) {
+        fprintf(stderr, "Too many NICs\n");
+        exit(1);
+    }
+    if (nd_table[0].vlan)
+        mcf_fec_init(&nd_table[0], 0x40001000, pic + 23);
+
+    /*  0xfc000000 SCM.  */
+    /*  0xfc004000 XBS.  */
+    /*  0xfc008000 FlexBus CS.  */
+    /* 0xfc030000 FEC.  */
+    /*  0xfc040000 SCM + Power management.  */
+    /*  0xfc044000 eDMA.  */
+    /* 0xfc048000 INTC.  */
+    /*  0xfc058000 I2C.  */
+    /*  0xfc05c000 QSPI.  */
+    /* 0xfc060000 UART0.  */
+    /* 0xfc064000 UART0.  */
+    /* 0xfc068000 UART0.  */
+    /*  0xfc070000 DMA timers.  */
+    /* 0xfc080000 PIT0.  */
+    /* 0xfc084000 PIT1.  */
+    /*  0xfc088000 EPORT.  */
+    /*  0xfc08c000 Watchdog.  */
+    /*  0xfc090000 clock module.  */
+    /*  0xfc0a0000 CCM + reset.  */
+    /*  0xfc0a4000 GPIO.  */
+    /* 0xfc0a8000 SDRAM controller.  */
+
+    /* Load kernel.  */
+    if (!kernel_filename) {
+        fprintf(stderr, "Kernel image must be specified\n");
+        exit(1);
+    }
+
+    kernel_size = load_elf(kernel_filename, NULL, NULL, &elf_entry,
+                           NULL, NULL, 1, ELF_MACHINE, 0);
+    entry = elf_entry;
+    if (kernel_size < 0) {
+        kernel_size = load_uimage(kernel_filename, &entry, NULL, NULL);
+    }
+    if (kernel_size < 0) {
+        kernel_size = load_image_targphys(kernel_filename, 0x00000000,
+                                          ram_size);
+        entry = 0x00000000;
+    }
+    if (kernel_size < 0) {
+        fprintf(stderr, "qemu: could not load kernel '%s'\n", 
kernel_filename);
+        exit(1);
+    }
+
+    env->pc = entry;
+}
+
+QEMUMachine uc5282_machine = {
+    .name = "uc5282",
+    .desc = "uC5282",
+    .init = uc5282_init,
+    .is_default = 0,
+};
+
  static void mcf5208evb_machine_init(void)
  {
      qemu_register_machine(&mcf5208evb_machine);
+    qemu_register_machine(&uc5282_machine);
  }

  machine_init(mcf5208evb_machine_init);
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index 21035da..909ab09 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -172,7 +172,7 @@ static void mcf_fec_do_tx(mcf_fec_state *s)
          if (bd.flags & FEC_BD_L) {
              /* Last buffer in frame.  */
              DPRINTF("Sending packet\n");
-            qemu_send_packet(&s->nic->nc, frame, len);
+            qemu_send_packet(&s->nic->nc, frame, frame_size);
              ptr = frame;
              frame_size = 0;
              s->eir |= FEC_INT_TXF;
@@ -217,7 +217,8 @@ static void mcf_fec_reset(mcf_fec_state *s)
  static uint32_t mcf_fec_read(void *opaque, target_phys_addr_t addr)
  {
      mcf_fec_state *s = (mcf_fec_state *)opaque;
-    switch (addr & 0x3ff) {
+    addr &= 0x3ff;
+    switch (addr) {
      case 0x004: return s->eir;
      case 0x008: return s->eimr;
      case 0x010: return s->rx_enabled ? (1 << 24) : 0; /* RDAR */
@@ -246,6 +247,8 @@ static uint32_t mcf_fec_read(void *opaque, 
target_phys_addr_t addr)
      case 0x184: return s->etdsr;
      case 0x188: return s->emrbr;
      default:
+        if ( addr >= 0x200 && addr < 0x2e4 )
+            return 0xdeadbeef; /* FIXME: MIB counters not implemented */
          hw_error("mcf_fec_read: Bad address 0x%x\n", (int)addr);
          return 0;
      }
@@ -254,7 +257,8 @@ static uint32_t mcf_fec_read(void *opaque, 
target_phys_addr_t addr)
  static void mcf_fec_write(void *opaque, target_phys_addr_t addr, 
uint32_t value)
  {
      mcf_fec_state *s = (mcf_fec_state *)opaque;
-    switch (addr & 0x3ff) {
+    addr &= 0x3ff;
+    switch (addr) {
      case 0x004:
          s->eir &= ~value;
          break;
@@ -285,6 +289,7 @@ static void mcf_fec_write(void *opaque, 
target_phys_addr_t addr, uint32_t value)
      case 0x040:
          /* TODO: Implement MII.  */
          s->mmfr = value;
+        s->eir |= FEC_INT_MII;
          break;
      case 0x044:
          s->mscr = value & 0xfe;
@@ -342,6 +347,8 @@ static void mcf_fec_write(void *opaque, 
target_phys_addr_t addr, uint32_t value)
          s->emrbr = value & 0x7f0;
          break;
      default:
+        if ( addr >= 0x200 && addr < 0x2e4 )
+            return; /* FIXME: MIB counters not implemented */
          hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr);
      }
      mcf_fec_update(s);
diff --git a/hw/mcf_intc.c b/hw/mcf_intc.c
index ac04295..c0e0620 100644
--- a/hw/mcf_intc.c
+++ b/hw/mcf_intc.c
@@ -16,22 +16,38 @@ typedef struct {
      uint8_t icr[64];
      CPUState *env;
      int active_vector;
+    int uc5282_intc;
  } mcf_intc_state;

+static inline int get_int_level(mcf_intc_state *s, int i)
+{
+    return s->uc5282_intc ? (s->icr[i] >> 3) : s->icr[i];
+}
+
+static inline int get_int_prio(mcf_intc_state *s, int i)
+{
+    return s->uc5282_intc ? (s->icr[i] & 7) : 0;
+}
+
+
  static void mcf_intc_update(mcf_intc_state *s)
  {
      uint64_t active;
      int i;
      int best;
-    int best_level;
+    int best_level, best_prio,level,prio;

      active = (s->ipr | s->ifr) & s->enabled & ~s->imr;
      best_level = 0;
+    best_prio  = 0;
      best = 64;
      if (active) {
          for (i = 0; i < 64; i++) {
-            if ((active & 1) != 0 && s->icr[i] >= best_level) {
-                best_level = s->icr[i];
+            level = get_int_level(s,i);
+            prio  = get_int_prio(s,i);
+            if ((active & 1) != 0 && level >= best_level && prio >= 
best_prio) {
+                best_level = level;
+                best_prio  = prio;
                  best = i;
              }
              active >>= 1;
@@ -139,13 +155,14 @@ static CPUWriteMemoryFunc * const 
mcf_intc_writefn[] = {
     mcf_intc_write
  };

-qemu_irq *mcf_intc_init(target_phys_addr_t base, CPUState *env)
+qemu_irq *mcf_intc_init(target_phys_addr_t base, CPUState *env, int 
uc5282_intc)
  {
      mcf_intc_state *s;
      int iomemtype;

      s = qemu_mallocz(sizeof(mcf_intc_state));
      s->env = env;
+    s->uc5282_intc = uc5282_intc;
      mcf_intc_reset(s);

      iomemtype = cpu_register_io_memory(mcf_intc_readfn,
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index a936fe7..7a3c6af 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -289,6 +289,9 @@ void HELPER(movec)(CPUM68KState *env, uint32_t reg, 
uint32_t val)
      case 0x801: /* VBR */
          env->vbr = val;
          break;
+    case 0xc05: /* rambar */
+        env->rambar0 = val;
+        break;
      /* TODO: Implement control registers.  */
      default:
