diff --git a/compile-qemu-for-decoder.sh b/compile-qemu-for-decoder.sh
index 2b0c7d9..7fd5b1f 100755
--- a/compile-qemu-for-decoder.sh
+++ b/compile-qemu-for-decoder.sh
@@ -20,7 +20,7 @@ function build-qemu() (
     cd "$QEMU_BUILD"
     export CC="clang-20 --target=powerpc64le-linux-gnu"
     export CXX="clang++-20 --target=powerpc64le-linux-gnu"
-    export LD="clang++-20 --target=powerpc64le-linux-gnu"
+    export LDFLAGS="-fuse-ld=lld-20 -Wl,--lto-emit-llvm -Wl,--lto-O0"
     export AR="llvm-ar-20"
     "../$QEMU_SOURCE/configure" \
         --target-list=ppc64-softmmu \
@@ -28,21 +28,9 @@ function build-qemu() (
         --enable-tcg-interpreter \
         --without-default-features \
         --cross-prefix=powerpc64le-linux-gnu-
-    target="$(ninja -t query qemu-system-ppc64)"
-    mapfile -t target_lines <<<"$target"
-    # add missed libs
-    link_inputs=(libpage-vary-common.a libqemuutil.a)
-    # add the rest of the libs and object files
-    for l in "${target_lines[@]}"; do
-        if [[ "$l" =~ ^'    '([a-z].*)$ ]]; then
-            link_inputs+=("${BASH_REMATCH[1]}")
-        elif [[ "$l" == "  outputs:" ]]; then
-            break
-        fi
-    done
     make -j"$(nproc)" qemu-system-ppc64
-    echo "linking bitcode"
-    llvm-link-20 --only-needed --ignore-non-bitcode -o ../qemu-system-ppc64.bc "${link_inputs[@]}"
+    echo "copying bitcode"
+    cp qemu-system-ppc64 ../qemu-system-ppc64.bc
     echo "disassembling bitcode"
     llvm-dis-20 -o ../qemu-system-ppc64.ll ../qemu-system-ppc64.bc
 )
diff --git a/scripts/check-copyright.sh b/scripts/check-copyright.sh
index 05b399d..f171c3c 100755
--- a/scripts/check-copyright.sh
+++ b/scripts/check-copyright.sh
@@ -32,7 +32,7 @@ POUND_HEADER=('^"# SPDX-License-Identifier: LGPL-3.0-or-later"$' '^"# See Notice
 SLASH_HEADER=('^"// SPDX-License-Identifier: LGPL-3.0-or-later"$' '^"// See Notices.txt for copyright information"$')
 MD_HEADER=('^"<!--"$' '^"SPDX-License-Identifier: LGPL-3.0-or-later"$' '^"See Notices.txt for copyright information"$')
 JSON_HEADER=('^"{"$' '^"    \"license_header\": ["$' '^"        \"SPDX-License-Identifier: LGPL-3.0-or-later\","$' '^"        \"See Notices.txt for copyright information\""')
-ROCQ_HEADER=('^"(*  SPDX-License-Identifier: LGPL-3.0-or-later"$' '^"   See Notices.txt for copyright information *)"$')
+LL_HEADER=('^"; SPDX-License-Identifier: LGPL-3.0-or-later"$' '^"; See Notices.txt for copyright information"$')
 
 function main()
 {
@@ -62,8 +62,8 @@ function main()
         *.json)
             check_file "$file" "${JSON_HEADER[@]}"
             ;;
-        *.v)
-            check_file "$file" "${ROCQ_HEADER[@]}"
+        *.ll)
+            check_file "$file" "${LL_HEADER[@]}"
             ;;
         *)
             fail_file "$file" 0 "unimplemented file kind -- you need to add it to $0"
diff --git a/src/lib.rs b/src/lib.rs
index 91d3581..13b83cf 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -10,8 +10,9 @@ use inkwell::{
         LLVMTypeKind, LLVMValueKind,
         core::{
             LLVMGetAggregateElement, LLVMGetCalledValue, LLVMGetConstOpcode,
-            LLVMGetGEPSourceElementType, LLVMGetNumArgOperands, LLVMGetNumOperands, LLVMGetOperand,
-            LLVMGetTypeKind, LLVMGetValueKind, LLVMIsAUser, LLVMLookupIntrinsicID, LLVMTypeOf,
+            LLVMGetGEPSourceElementType, LLVMGetInlineAsmNeedsAlignedStack, LLVMGetNumArgOperands,
+            LLVMGetNumOperands, LLVMGetOperand, LLVMGetTypeKind, LLVMGetValueKind,
+            LLVMIsAInlineAsm, LLVMIsAUser, LLVMLookupIntrinsicID, LLVMTypeOf,
             LLVMValueAsBasicBlock,
         },
     },
@@ -109,52 +110,732 @@ declare_intrinsics! {
     LifetimeEnd,
     #[name = "llvm.memset"]
     Memset,
+    #[name = "llvm.memcpy"]
+    Memcpy,
     #[name = "llvm.ctpop"]
     CtPop,
     #[name = "llvm.cttz"]
     Cttz,
+    #[name = "llvm.threadlocal.address"]
+    ThreadLocalAddress,
 }
 
-macro_rules! declare_known_functions {
+macro_rules! declare_known_inline_asms {
     (
-        $(#[name = $name:literal]
+        $(#[get = $get:expr]
         $Variant:ident,)+
     ) => {
-        #[derive(Copy, Clone, PartialEq, Eq, Ord, PartialOrd, Hash, Debug)]
-        enum KnownFunction {
+        #[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
+        enum KnownInlineAsm {
             $($Variant,)+
         }
 
-        impl KnownFunction {
-            fn name(self) -> &'static CStr {
-                match self {
-                    $(Self::$Variant => $name,)+
+        impl KnownInlineAsm {
+            fn new<'ctx>(maybe_inline_asm: PointerValue<'ctx>, known_inline_asms: &KnownInlineAsms<'ctx>) -> Option<Self> {
+                let known_inline_asms: &KnownInlineAsmsInner<'ctx> = known_inline_asms;
+                $(if known_inline_asms.$Variant == maybe_inline_asm {
+                    Some(Self::$Variant)
+                } else )+ {
+                    None
                 }
             }
+        }
+
+        #[derive(Debug)]
+        #[expect(non_snake_case)]
+        struct KnownInlineAsmsInner<'ctx> {
+            $($Variant: PointerValue<'ctx>,)+
+        }
+
+        #[derive(Clone, Debug)]
+        struct KnownInlineAsms<'ctx>(Option<Rc<KnownInlineAsmsInner<'ctx>>>);
+
+        impl<'ctx> std::ops::Deref for KnownInlineAsms<'ctx> {
+            type Target = KnownInlineAsmsInner<'ctx>;
+
+            fn deref(&self) -> &Self::Target {
+                self.0.as_ref().expect("KnownInlineAsms should have been already filled")
+            }
+        }
+
+        impl<'ctx> KnownInlineAsms<'ctx> {
+            fn new(state: &GlobalState<'ctx>) -> Result<Self> {
+                // help type inference
+                fn inline_asm_getter_identity<'ctx, T: FnOnce(&GlobalState<'ctx>) -> Result<PointerValue<'ctx>>>(v: T) -> T {
+                    v
+                }
+                Ok(Self(Some(Rc::new(KnownInlineAsmsInner {
+                    $($Variant: inline_asm_getter_identity($get)(state)?,)+
+                }))))
+            }
+        }
+    };
+}
+
+declare_known_inline_asms! {
+    #[get = |state| {
+        let context = state.parser.context;
+        let ptr_ty = context.ptr_type(AddressSpace::from(0u16)).into();
+        let fn_type = context.void_type().fn_type(&[ptr_ty, ptr_ty], false);
+        Ok(context.create_inline_asm(fn_type, "".into(), "=*rm,0".into(), true, false, None, false))
+    }]
+    Nop1,
+}
+
+const TARGET_PAGE_SIZE: u64 = 1 << 16;
+
+macro_rules! declare_known_functions {
+    (
+        $(#[trace, name = $trace_name:literal, variant = $TraceVariant:ident]
+        fn $trace_call_fn:ident($($trace_call_fn_args:tt)*) -> $trace_call_fn_ret_ty:ty $trace_call_fn_body:block)+
+        $(#[run, name = $run_name:literal, variant = $RunVariant:ident]
+        fn $run_call_fn:ident($($run_call_fn_args:tt)*) -> $run_call_fn_ret_ty:ty $run_call_fn_body:block)+
+    ) => {
+        #[derive(Copy, Clone, PartialEq, Eq, Ord, PartialOrd, Hash, Debug)]
+        enum KnownFunction {
+            $($TraceVariant,)+
+            $($RunVariant,)+
+        }
+
+        impl KnownFunction {
             fn new(name: &CStr) -> Option<Self> {
-                $(if name == $name {
-                    Some(Self::$Variant)
+                $(if name == $trace_name {
+                    Some(Self::$TraceVariant)
+                } else)+ $(if name == $run_name {
+                    Some(Self::$RunVariant)
                 } else)+ {
                     None
                 }
             }
         }
+
+        impl<'ctx> State<'ctx> {
+            $(fn $trace_call_fn($($trace_call_fn_args)*) -> $trace_call_fn_ret_ty $trace_call_fn_body)+
+            $(fn $run_call_fn($($run_call_fn_args)*) -> $run_call_fn_ret_ty $run_call_fn_body)+
+            fn run_call_known_function(
+                mut self: Rc<Self>,
+                function_value: FunctionValue<'ctx>,
+                known_function: KnownFunction,
+            ) -> Result<Rc<Self>> {
+                let this = Rc::make_mut(&mut self);
+                match known_function {
+                    $(KnownFunction::$TraceVariant => {
+                        this.$trace_call_fn()?;
+                        self.run_normal_call(function_value)
+                    })+
+                    $(KnownFunction::$RunVariant => {
+                        this.$run_call_fn()?;
+                        this.next_instruction = this
+                            .next_instruction
+                            .get_next_instruction()
+                            .expect("not a block terminator");
+                        Ok(self)
+                    })+
+                }
+            }
+        }
     };
 }
 
 declare_known_functions! {
-    #[name = c"g_malloc0"]
-    GMalloc0,
-    #[name = c"clock_gettime"]
-    ClockGetTime,
-    #[name = c"sysconf"]
-    SysConf,
-    #[name = c"getauxval"]
-    GetAuxVal,
-    #[name = c"pthread_atfork"]
-    PThreadAtFork,
-    #[name = c"pthread_mutex_init"]
-    PThreadMutexInit,
+    #[trace, name = c"type_register_static", variant = TypeRegisterStatic]
+    fn trace_call_type_register_static(&mut self) -> Result<()> {
+        let [type_info_ptr] = self.get_call_arg_values()?;
+        let Value::Pointer(type_info_ptr) = type_info_ptr else {
+            bail!("type_register_static argument must be a pointer");
+        };
+        let value = TargetTypeInfo::load(self, type_info_ptr.clone())?;
+        let name = self.load_c_str(value.name.clone())?;
+        let parent = self.load_c_str(value.parent.clone())?;
+        let parsed_type_info = ParsedTypeInfo {
+            type_info_ptr,
+            name,
+            parent,
+            value,
+        };
+        self.global.registered_type_infos.push(parsed_type_info);
+        Ok(())
+    }
+    #[run, name = c"qsort", variant = QSort]
+    fn run_call_qsort(&mut self) -> Result<()> {
+        let [base, len, size, compare] = self.get_call_arg_values()?;
+        let Value::Pointer(base) = base else {
+            bail!("qsort `base` argument must be a pointer");
+        };
+        let Value::ConstantInt(len) = len else {
+            bail!("qsort `len` argument must be an integer");
+        };
+        let len = len as u64;
+        let Value::ConstantInt(size) = size else {
+            bail!("qsort `size` argument must be an integer");
+        };
+        let size = size as u64;
+        let Value::Pointer(compare) = compare else {
+            bail!("qsort `compare` argument must be a pointer");
+        };
+        let PointerBase::Function { name } = &*compare.base else {
+            bail!("qsort `compare` argument must be a pointer to a function");
+        };
+        fn do_qsort<'ctx, K: Ord>(state: &mut State<'ctx>, base: Pointer, len: u64, size: u64, get_key: impl Fn(&mut State<'ctx>, Pointer) -> Result<K>) -> Result<()> {
+            let total_byte_count: usize = len.checked_mul(size).and_then(|v|v.try_into().ok()).expect("total byte count is too big");
+            let mut bytes = Vec::with_capacity(total_byte_count);
+            let mut ptr = base.clone();
+            for _ in 0..total_byte_count {
+                bytes.push(state.do_load(&ptr)?);
+                ptr.offset += 1;
+            }
+            let mut keys_and_bytes = Result::<Vec<(K, &[Byte])>>::from_iter((0..len).map(|i| {
+                let byte_offset = i * size;
+                Ok((get_key(state, base.add(byte_offset))?, &bytes[byte_offset as usize..][..size as usize]))
+            }))?;
+            keys_and_bytes.sort_by(|l, r| l.0.cmp(&r.0));
+            let mut ptr = base;
+            for (_, bytes) in keys_and_bytes {
+                for b in bytes {
+                    state.do_store(&ptr, b.clone())?;
+                    ptr.offset += 1;
+                }
+            }
+            Ok(())
+        }
+        const HMP_COMMAND_SIZE: u64 = TargetHMPCommand::LAYOUT.size;
+        match (name.as_bytes(), size) {
+            (b"compare_mon_cmd", HMP_COMMAND_SIZE) => {
+                do_qsort(self, base, len, size, |state, ptr| {
+                    let name = TargetHMPCommand::load(state, ptr)?.name;
+                    state.load_c_str(name)
+                })?;
+            }
+            (b"compare_cmdname", 72) => {
+                do_qsort(self, base, len, size, |state, ptr| {
+                    let name = state.load_ptr(ptr)?;
+                    state.load_c_str(name)
+                })?;
+            }
+            (_, size) => todo!("qsort comparison function: {name:?}, size={size}"),
+        }
+        Ok(())
+    }
+    #[run, name = c"os_set_line_buffering", variant = OsSetLineBuffering]
+    fn ignore_call_os_set_line_buffering(&mut self) -> Result<()> {
+        Ok(())
+    }
+    #[run, name = c"__errno_location", variant = ErrNoLocation]
+    fn run_call_errno_location(&mut self) -> Result<()> {
+        // TODO: single threaded for now
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::Pointer(Pointer {
+                base: self.global.errno_ptr_base.clone(),
+                offset: 0,
+            }),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"strtoll", variant = StrToLL]
+    fn run_call_strtoll(&mut self) -> Result<()> {
+        let [nptr, endptr, base] = self.get_call_arg_values()?;
+        let Value::Pointer(nptr) = nptr else {
+            bail!("strtoll `nptr` argument must be a pointer");
+        };
+        let Value::Pointer(endptr) = endptr else {
+            bail!("strtoll `endptr` argument must be a pointer");
+        };
+        let Value::ConstantInt(base) = base else {
+            bail!("strtoll `base` argument must be an integer");
+        };
+        let mut ptr = nptr;
+        while let Some(b) = self.do_load(&ptr)?.as_u8() && b.is_ascii_whitespace() {
+            ptr.offset += 1;
+        }
+        let is_negative = if let Some(b @ (b'+' | b'-')) = self.do_load(&ptr)?.as_u8() {
+            ptr.offset += 1;
+            b == b'-'
+        } else {
+            false
+        };
+        let mut any_digits = false;
+        let base = match base as i32 {
+            0 => {
+                if let Some(b'0') = self.do_load(&ptr)?.as_u8() {
+                    ptr.offset += 1;
+                    if let Some(b'x' | b'X') = self.do_load(&ptr)?.as_u8() {
+                        ptr.offset += 1;
+                        16
+                    } else {
+                        any_digits = true;
+                        8
+                    }
+                } else {
+                    10
+                }
+            }
+            2..=36 => base as u32,
+            _ => todo!("invalid base: {base}"),
+        };
+        let mut retval = 0u64;
+        while let Some(b) = self.do_load(&ptr)?.as_u8() && let Some(digit) = (b as char).to_digit(base) {
+            ptr.offset += 1;
+            any_digits = true;
+            retval = retval.saturating_mul(base as _).saturating_add(digit as _);
+        }
+        if !any_digits {
+            todo!("conversion failed");
+        }
+        let retval = if is_negative {
+            if retval > i64::MIN.unsigned_abs() {
+                todo!("overflow")
+            } else {
+                // zero extend to u128
+                retval.wrapping_neg() as u128
+            }
+        } else {
+            if retval > i64::MAX as u64 {
+                todo!("overflow")
+            } else {
+                retval as u128
+            }
+        };
+        if let PointerBase::Null = *endptr.base {
+            // do nothing
+        } else {
+            <*mut *mut TargetCChar>::store(self, endptr, ptr)?;
+        }
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(retval),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"g_malloc0", variant = GMalloc0]
+    fn run_call_g_malloc0(&mut self) -> Result<()> {
+        let [size] = self.get_call_arg_values()?;
+        let Value::ConstantInt(size) = size else {
+            bail!("g_malloc0 argument must be an integer");
+        };
+        let size = size as u64;
+        self.run_call_g_realloc_helper(None, size)
+    }
+    #[run, name = c"g_strdup", variant = GStrDup]
+    fn run_call_g_strdup(&mut self) -> Result<()> {
+        let [ptr] = self.get_call_arg_values()?;
+        let Value::Pointer(ptr) = ptr else {
+            bail!("g_strdup argument must be a pointer");
+        };
+        if let PointerBase::Null = *ptr.base {
+            self.insert_local_value(
+                self.next_instruction.as_any_value_enum(),
+                Value::Pointer(Pointer {
+                    base: self.global.null_ptr_base.clone(),
+                    offset: 0,
+                }),
+            )?;
+            return Ok(());
+        }
+        let string = self.load_c_str(ptr)?;
+        let bytes = string.to_bytes_with_nul();
+        let pointer_base = Rc::new(PointerBase::Heap {
+            id: self.global.gen_id(),
+        });
+        self.global.memory.insert(
+            pointer_base.clone(),
+            Rc::from_iter(bytes.iter().map(|&b| Byte::Constant(b))),
+        );
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::Pointer(Pointer {
+                base: pointer_base,
+                offset: 0,
+            }),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"g_realloc_n", variant = GReallocN]
+    fn run_call_g_realloc_n(&mut self) -> Result<()> {
+        let [mem, n_blocks, n_block_bytes] = self.get_call_arg_values()?;
+        let Value::Pointer(mem) = mem else {
+            bail!("g_realloc_n `mem` argument must be a pointer");
+        };
+        let Value::ConstantInt(n_blocks) = n_blocks else {
+            bail!("g_realloc_n `n_blocks` argument must be an integer");
+        };
+        let Value::ConstantInt(n_block_bytes) = n_block_bytes else {
+            bail!("g_realloc_n `n_block_bytes` argument must be an integer");
+        };
+        self.run_call_g_realloc_helper(Some(mem), (n_blocks as u64).checked_mul(n_block_bytes as u64).expect("g_realloc_n size overflow"))
+    }
+    #[run, name = c"g_realloc", variant = GRealloc]
+    fn run_call_g_realloc(&mut self) -> Result<()> {
+        let [mem, n_bytes] = self.get_call_arg_values()?;
+        let Value::Pointer(mem) = mem else {
+            bail!("g_realloc `mem` argument must be a pointer");
+        };
+        let Value::ConstantInt(n_bytes) = n_bytes else {
+            bail!("g_realloc `n_bytes` argument must be an integer");
+        };
+        self.run_call_g_realloc_helper(Some(mem), n_bytes as u64)
+    }
+    #[run, name = c"g_free", variant = GFree]
+    fn run_call_g_free(&mut self) -> Result<()> {
+        let [ptr] = self.get_call_arg_values()?;
+        let Value::Pointer(ptr) = ptr else {
+            bail!("g_free argument must be a pointer");
+        };
+        self.run_call_g_realloc_helper(Some(ptr), 0)
+    }
+    #[run, name = c"g_file_get_contents", variant = GFileGetContents]
+    fn run_call_g_file_get_contents(&mut self) -> Result<()> {
+        let [filename, contents, length, error] = self.get_call_arg_values()?;
+        let Value::Pointer(filename) = filename else {
+            bail!("g_file_get_contents `filename` argument must be a pointer");
+        };
+        let Value::Pointer(contents) = contents else {
+            bail!("g_file_get_contents `contents` argument must be a pointer");
+        };
+        let Value::Pointer(length) = length else {
+            bail!("g_file_get_contents `length` argument must be a pointer");
+        };
+        let Value::Pointer(error) = error else {
+            bail!("g_file_get_contents `error` argument must be a pointer");
+        };
+        if length.base.address() != Some(0) {
+            todo!("g_file_get_contents with non-null `length`");
+        }
+        if error.base.address() != Some(0) {
+            todo!("g_file_get_contents with non-null `error`");
+        }
+        let filename = self.load_c_str(filename)?;
+        let string = self.read_file_into_c_str(&filename)?;
+        let bytes = string.to_bytes_with_nul();
+        let pointer_base = Rc::new(PointerBase::Heap {
+            id: self.global.gen_id(),
+        });
+        self.global.memory.insert(
+            pointer_base.clone(),
+            Rc::from_iter(bytes.iter().map(|&b| Byte::Constant(b))),
+        );
+        <*mut *mut TargetCChar>::store(self, contents, Pointer {
+            base: pointer_base,
+            offset: 0,
+        })?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(1),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"clock_gettime", variant = ClockGetTime]
+    fn run_call_clock_gettime(&mut self) -> Result<()> {
+        let [_clockid, tp] = self.get_call_arg_values()?;
+        let Value::Pointer(tp) = tp else {
+            bail!("clock_gettime tp argument must be a pointer");
+        };
+        TargetTimeSpec::store(
+            self,
+            tp,
+            TargetTimeSpecValue {
+                tv_sec: 0,
+                tv_nsec: 0,
+            },
+        )?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"sysconf", variant = SysConf]
+    fn run_call_sysconf(&mut self) -> Result<()> {
+        let [name] = self.get_call_arg_values()?;
+        let Value::ConstantInt(name) = name else {
+            bail!("sysconf `name` argument must be an integer");
+        };
+        let retval: i64 = match name as i32 {
+            187 => 64, // _SC_LEVEL1_ICACHE_LINESIZE -- 64 since that seems reasonable
+            190 => 64, // _SC_LEVEL1_DCACHE_LINESIZE -- 64 since that seems reasonable
+            _ => todo!("sysconf({name})"),
+        };
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(retval as u64 as u128),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"getauxval", variant = GetAuxVal]
+    fn run_call_getauxval(&mut self) -> Result<()> {
+        let [type_] = self.get_call_arg_values()?;
+        let Value::ConstantInt(type_) = type_ else {
+            bail!("getauxval `type` argument must be an integer");
+        };
+        let retval: u64 = match type_ as u64 {
+            16 => {
+                // AT_HWCAP
+                const PPC_FEATURE_64: u64 = 0x40000000;
+                #[expect(dead_code)]
+                const PPC_FEATURE_HAS_ALTIVEC: u64 = 0x10000000;
+                const PPC_FEATURE_HAS_FPU: u64 = 0x8000000;
+                #[expect(dead_code)]
+                const PPC_FEATURE_HAS_DFP: u64 = 0x400;
+                const PPC_FEATURE_ARCH_2_06: u64 = 0x100;
+                #[expect(dead_code)]
+                const PPC_FEATURE_HAS_VSX: u64 = 0x80;
+                PPC_FEATURE_64 | PPC_FEATURE_HAS_FPU | PPC_FEATURE_ARCH_2_06
+            }
+            26 => {
+                // AT_HWCAP2
+                const PPC_FEATURE2_ARCH_2_07: u64 = 0x80000000;
+                const PPC_FEATURE2_ISEL: u64 = 0x8000000;
+                const PPC_FEATURE2_TAR: u64 = 0x4000000;
+                #[expect(dead_code)]
+                const PPC_FEATURE2_VEC_CRYPTO: u64 = 0x2000000;
+                const PPC_FEATURE2_ARCH_3_00: u64 = 0x800000;
+                #[expect(dead_code)]
+                const PPC_FEATURE2_HAS_IEEE128: u64 = 0x400000;
+                const PPC_FEATURE2_DARN: u64 = 0x200000;
+                const PPC_FEATURE2_ARCH_3_1: u64 = 0x40000;
+                #[expect(dead_code)]
+                const PPC_FEATURE2_MMA: u64 = 0x20000;
+                PPC_FEATURE2_ARCH_2_07 | PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR | PPC_FEATURE2_ARCH_3_00 | PPC_FEATURE2_DARN | PPC_FEATURE2_ARCH_3_1
+            }
+            _ => todo!("getauxval({type_})"),
+        };
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(retval as u128),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_atfork", variant = PThreadAtFork]
+    fn run_call_pthread_atfork(&mut self) -> Result<()> {
+        // we don't implement forking, so ignore the passed-in function pointers and just return 0
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0 as u128),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_mutex_init", variant = PThreadMutexInit]
+    fn run_call_pthread_mutex_init(&mut self) -> Result<()> {
+        let [mutex, mutexattr] = self.get_call_arg_values()?;
+        let Value::Pointer(mutex) = mutex else {
+            bail!("pthread_mutex_init `mutex` argument must be a pointer");
+        };
+        let Value::Pointer(mutexattr) = mutexattr else {
+            bail!("pthread_mutex_init `mutexattr` argument must be a pointer");
+        };
+        if mutexattr.base.address() != Some(0) {
+            todo!("pthread_mutex_init with non-null `mutexattr`");
+        };
+        let null_ptr = Pointer {
+            base: self.global.null_ptr_base.clone(),
+            offset: 0,
+        };
+        let init = TargetPThreadMutexTValue {
+            lock: 0,
+            count: 0,
+            owner: 0,
+            nusers: 0,
+            kind: 0,
+            spins: 0,
+            elision: 0,
+            list: TargetPThreadListTValue {
+                prev: null_ptr.clone(),
+                next: null_ptr,
+            },
+        };
+        TargetPThreadMutexT::store(self, mutex, init)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_mutex_lock", variant = PThreadMutexLock]
+    fn run_call_pthread_mutex_lock(&mut self) -> Result<()> {
+        let [mutex, ] = self.get_call_arg_values()?;
+        let Value::Pointer(mutex) = mutex else {
+            bail!("pthread_mutex_lock `mutex` argument must be a pointer");
+        };
+        let lock: i32 = self.load_int(mutex.add(TargetPThreadMutexT::OFFSETS.lock))?;
+        if lock != 0 {
+            todo!("mutex already locked");
+        }
+        self.store_int(mutex.add(TargetPThreadMutexT::OFFSETS.lock), 1i32)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_mutex_unlock", variant = PThreadMutexUnlock]
+    fn run_call_pthread_mutex_unlock(&mut self) -> Result<()> {
+        let [mutex, ] = self.get_call_arg_values()?;
+        let Value::Pointer(mutex) = mutex else {
+            bail!("pthread_mutex_unlock `mutex` argument must be a pointer");
+        };
+        let lock: i32 = self.load_int(mutex.add(TargetPThreadMutexT::OFFSETS.lock))?;
+        if lock != 1 {
+            todo!("mutex should be locked");
+        }
+        self.store_int(mutex.add(TargetPThreadMutexT::OFFSETS.lock), 0i32)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_attr_init", variant = PThreadAttrInit]
+    fn run_call_pthread_attr_init(&mut self) -> Result<()> {
+        let [attr] = self.get_call_arg_values()?;
+        let Value::Pointer(attr) = attr else {
+            bail!("pthread_attr_init argument must be a pointer");
+        };
+        let null_ptr = Pointer {
+            base: self.global.null_ptr_base.clone(),
+            offset: 0,
+        };
+        let init = TargetPThreadAttrValue {
+            schedparam: TargetSchedParamValue{ sched_priority: 0 },
+            schedpolicy: 0,
+            flags: 0,
+            guardsize: TargetUsize(TARGET_PAGE_SIZE),
+            stackaddr: null_ptr.clone(),
+            stacksize: TargetUsize(0),
+            extension: null_ptr.clone(),
+            unused: null_ptr,
+        };
+        TargetPThreadAttr::store(self, attr, init)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_attr_destroy", variant = PThreadAttrDestroy]
+    fn run_call_pthread_attr_destroy(&mut self) -> Result<()> {
+        let [attr] = self.get_call_arg_values()?;
+        let Value::Pointer(attr) = attr else {
+            bail!("pthread_attr_destroy argument must be a pointer");
+        };
+        let attr = TargetPThreadAttr::load(self, attr)?;
+        if let PointerBase::Null = *attr.extension.base {
+            self.insert_local_value(
+                self.next_instruction.as_any_value_enum(),
+                Value::ConstantInt(0),
+            )?;
+            return Ok(());
+        }
+        todo!("pthread_attr_destroy")
+    }
+    #[run, name = c"pthread_attr_setdetachstate", variant = PThreadAttrSetDetachState]
+    fn run_call_pthread_attr_setdetachstate(&mut self) -> Result<()> {
+        let [attr, detach_state] = self.get_call_arg_values()?;
+        let Value::Pointer(attr) = attr else {
+            bail!("pthread_attr_setdetachstate `attr` argument must be a pointer");
+        };
+        let Value::ConstantInt(detach_state) = detach_state else {
+            bail!("pthread_attr_setdetachstate `detachstate` argument must be an integer");
+        };
+        let flags = self.load_int::<i32>(attr.add(TargetPThreadAttr::OFFSETS.flags))?;
+        const ATTR_FLAG_DETACHSTATE: i32 = 1;
+        let flags = if detach_state as i32 == 1 {
+            // detach_state == PTHREAD_CREATE_DETACHED
+            flags | ATTR_FLAG_DETACHSTATE
+        } else {
+            flags & !ATTR_FLAG_DETACHSTATE
+        };
+        self.store_int(attr.add(TargetPThreadAttr::OFFSETS.flags), flags)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"sigfillset", variant = SigFillSet]
+    fn run_call_sigfillset(&mut self) -> Result<()> {
+        let [set] = self.get_call_arg_values()?;
+        let Value::Pointer(set) = set else {
+            bail!("sigfillset `set` argument must be a pointer");
+        };
+        self.store_int(set, 0xffff_fffe_7fff_ffff_u64)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"sigdelset", variant = SigDelSet]
+    fn run_call_sigdelset(&mut self) -> Result<()> {
+        let [set, sig] = self.get_call_arg_values()?;
+        let Value::Pointer(set) = set else {
+            bail!("sigdelset `set` argument must be a pointer");
+        };
+        let Value::ConstantInt(sig) = sig else {
+            bail!("sigdelset `sig` argument must be an integer");
+        };
+        let bit = sig.checked_sub(1).expect("sig is not zero") as u32;
+        let mask = 1u64 << (bit % 64);
+        let word = bit / 64;
+        let ptr = set.add(u64::LAYOUT.size * word as u64);
+        let v: u64 = self.load_int(ptr.clone())?;
+        self.store_int(ptr, v & !mask)?;
+        self.insert_local_value(
+            self.next_instruction.as_any_value_enum(),
+            Value::ConstantInt(0),
+        )?;
+        Ok(())
+    }
+    #[run, name = c"pthread_sigmask", variant = PThreadSigMask]
+    fn run_call_pthread_sigmask(&mut self) -> Result<()> {
+        let [how, set, oldset] = self.get_call_arg_values()?;
+        let Value::ConstantInt(how) = how else {
+            bail!("pthread_sigmask `how` argument must be an integer");
+        };
+        let Value::Pointer(set) = set else {
+            bail!("pthread_sigmask `set` argument must be a pointer");
+        };
+        let Value::Pointer(oldset) = oldset else {
+            bail!("pthread_sigmask `oldset` argument must be a pointer");
+        };
+        if self.get_function().get_name() == c"qemu_thread_create" {
+            // we don't implement signals
+            self.insert_local_value(
+                self.next_instruction.as_any_value_enum(),
+                Value::ConstantInt(0),
+            )?;
+            Ok(())
+        } else {
+            todo!("pthread_sigmask")
+        }
+    }
+    #[run, name = c"pthread_create", variant = PThreadCreate]
+    fn run_call_pthread_create(&mut self) -> Result<()> {
+        let [thread, attr, start_routine, arg] = self.get_call_arg_values()?;
+        let Value::Pointer(thread) = thread else {
+            bail!("pthread_create `thread` argument must be a pointer");
+        };
+        let Value::Pointer(attr) = attr else {
+            bail!("pthread_create `attr` argument must be a pointer");
+        };
+        let Value::Pointer(start_routine) = start_routine else {
+            bail!("pthread_create `start_routine` argument must be a pointer");
+        };
+        let Value::Pointer(arg) = arg else {
+            bail!("pthread_create `arg` argument must be a pointer");
+        };
+        if self.get_function().get_name() == c"qemu_thread_create"
+                    && let Some(caller) = &self.return_target
+                    && caller.get_function().get_name() == c"rcu_init" {
+            // we don't yet implement threads, just ignore the RCU thread for now
+            self.insert_local_value(
+                self.next_instruction.as_any_value_enum(),
+                Value::ConstantInt(0),
+            )?;
+            Ok(())
+        } else {
+            todo!("pthread_create")
+        }
+    }
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
@@ -766,6 +1447,55 @@ declare_target_struct! {
     }
 }
 
+declare_target_struct! {
+    #[field_ints = TargetSchedParamFieldInts, value = TargetSchedParamValue]
+    #[repr(C)]
+    struct TargetSchedParam {
+        sched_priority: i32,
+    }
+}
+
+declare_opaque_target_struct! {
+    struct TargetPThreadAttrExtension;
+}
+
+declare_target_struct! {
+    #[field_ints = TargetPThreadAttrFieldInts, value = TargetPThreadAttrValue]
+    #[repr(C)]
+    struct TargetPThreadAttr {
+        schedparam: TargetSchedParam,
+        schedpolicy: i32,
+        flags: i32,
+        guardsize: TargetUsize,
+        stackaddr: *mut (),
+        stacksize: TargetUsize,
+        extension: *mut TargetPThreadAttrExtension,
+        unused: *mut (),
+    }
+}
+
+const _: () = {
+    assert!(TargetPThreadAttr::LAYOUT.size == 56);
+    assert!(TargetPThreadAttr::LAYOUT.align.get() == 8);
+};
+
+declare_target_struct! {
+    #[field_ints = TargetHMPCommandFieldInts, value = TargetHMPCommandValue]
+    #[repr(C)]
+    struct TargetHMPCommand {
+        name: *const TargetCChar,
+        args_type: *const TargetCChar,
+        params: *const TargetCChar,
+        help: *const TargetCChar,
+        flags: *const TargetCChar,
+        cmd: *const (),
+        cmd_info_hrt: *const (),
+        coroutine: TargetMemBool,
+        sub_table: *mut TargetHMPCommand,
+        command_completion: *const (),
+    }
+}
+
 fn get_called_value<'ctx>(instruction: InstructionValue<'ctx>) -> AnyValueEnum<'ctx> {
     match instruction.get_opcode() {
         InstructionOpcode::Call | InstructionOpcode::Invoke => {}
@@ -906,6 +1636,7 @@ enum PointerBase {
     MaxInstructions,
     HostPC,
     Heap { id: u64 },
+    ErrNo,
 }
 
 impl PointerBase {
@@ -921,6 +1652,7 @@ impl PointerBase {
             PointerBase::MaxInstructions => None,
             PointerBase::HostPC => todo!(),
             PointerBase::Heap { .. } => None,
+            PointerBase::ErrNo => None,
         }
     }
 }
@@ -1053,18 +1785,22 @@ struct ParsedTypeInfo {
 struct GlobalState<'ctx> {
     memory: BTreeMap<Rc<PointerBase>, Rc<[Byte]>>,
     null_ptr_base: Rc<PointerBase>,
+    errno_ptr_base: Rc<PointerBase>,
     next_id: u64,
     parser: Rc<Parser<'ctx>>,
+    known_inline_asms: KnownInlineAsms<'ctx>,
     registered_type_infos: Vec<ParsedTypeInfo>,
     global_values: HashMap<AnyValueEnum<'ctx>, Value>,
 }
 
 impl<'ctx> GlobalState<'ctx> {
-    fn new(parser: Rc<Parser<'ctx>>) -> Self {
+    fn new(parser: Rc<Parser<'ctx>>) -> Result<Self> {
         let mut retval = Self {
             memory: BTreeMap::new(),
             null_ptr_base: Rc::new(PointerBase::Null),
+            errno_ptr_base: Rc::new(PointerBase::ErrNo),
             next_id: 0,
+            known_inline_asms: KnownInlineAsms(None),
             parser,
             registered_type_infos: vec![],
             global_values: HashMap::new(),
@@ -1079,7 +1815,12 @@ impl<'ctx> GlobalState<'ctx> {
                 .as_any_value_enum(),
             Value::Pointer(null_ptr),
         );
-        retval
+        retval.add_memory(
+            retval.errno_ptr_base.clone(),
+            Rc::new(0i32.to_le_bytes().map(|b| Byte::Constant(b))),
+        );
+        retval.known_inline_asms = KnownInlineAsms::new(&retval)?;
+        Ok(retval)
     }
     fn gen_id(&mut self) -> u64 {
         let id = self.next_id;
@@ -1090,7 +1831,9 @@ impl<'ctx> GlobalState<'ctx> {
         let Self {
             memory,
             null_ptr_base,
+            errno_ptr_base,
             next_id,
+            known_inline_asms,
             parser,
             registered_type_infos,
             global_values,
@@ -1098,7 +1841,9 @@ impl<'ctx> GlobalState<'ctx> {
         Self {
             memory: mem::take(memory),
             null_ptr_base: null_ptr_base.clone(),
+            errno_ptr_base: errno_ptr_base.clone(),
             next_id: *next_id,
+            known_inline_asms: known_inline_asms.clone(),
             parser: parser.clone(),
             registered_type_infos: mem::take(registered_type_infos),
             global_values: mem::take(global_values),
@@ -1127,15 +1872,28 @@ impl<'ctx> GlobalState<'ctx> {
             .constructor
             .pointee_llvm_type(&self.parser)
             .into_function_type();
+        let cpuinfo_init_constructor_ty =
+            <Option<unsafe extern "C" fn() -> u32> as TargetPointerType>::Pointee::llvm_type(
+                &self.parser,
+            )
+            .into_function_type();
         for i in 0..ty.len() {
+            println!("running global constructor {i} of {}", ty.len());
             let global_ctor = TargetGlobalCtor::load(
                 &mut self,
                 ptr.add(i as u64 * TargetGlobalCtor::LAYOUT.size),
             )?;
+            let expected_function_type = match &*global_ctor.constructor.base {
+                PointerBase::Function { name } => match name.as_bytes() {
+                    b"cpuinfo_init" => cpuinfo_init_constructor_ty,
+                    _ => constructor_ty,
+                },
+                _ => constructor_ty,
+            };
             let state = Rc::new(State::new_call_ptr(
                 self,
                 &global_ctor.constructor,
-                constructor_ty,
+                expected_function_type,
                 |_| Ok(vec![]),
             )?);
             self = Rc::unwrap_or_clone(state.run_single(max_step_count)?).global;
@@ -1547,9 +2305,19 @@ trait StateTrait<'ctx>: 'ctx {
                 assert!(size <= target_bytes.len() as u64);
                 let mut ptr = ptr.clone();
                 for i in 0..size as usize {
-                    target_bytes[i] = match self.do_load(&ptr)?.as_u8() {
+                    let byte = self.do_load(&ptr)?;
+                    target_bytes[i] = match byte.as_u8() {
                         Some(v) => v,
-                        None => todo!(),
+                        None => {
+                            if let Byte::PointerBits { .. } = byte
+                                && ty.get_bit_width() == 64
+                                && i == 0
+                            {
+                                return self.load_ptr(ptr.clone()).map(Value::Pointer);
+                            } else {
+                                todo!("{byte:?}\nty={ty:?}");
+                            }
+                        }
                     };
                     ptr.offset += 1;
                 }
@@ -1756,6 +2524,25 @@ impl<'ctx> State<'ctx> {
                 }
                 Ok(())
             }
+            Intrinsic::Memcpy => {
+                let [dest, src, len, _is_volatile] = self.get_call_arg_values()?;
+                let Value::Pointer(mut dest) = dest else {
+                    bail!("expected pointer, got: {dest:?}");
+                };
+                let Value::Pointer(mut src) = src else {
+                    bail!("expected pointer, got: {src:?}");
+                };
+                let Value::ConstantInt(len) = len else {
+                    bail!("expected integer length, got: {len:?}");
+                };
+                for _ in 0..len {
+                    let b = self.do_load(&src)?;
+                    self.do_store(&dest, b)?;
+                    src.offset += 1;
+                    dest.offset += 1;
+                }
+                Ok(())
+            }
             Intrinsic::CtPop => {
                 self.int_un_op_unsigned(|_, src| Ok(src.count_ones() as u128))?;
                 Ok(())
@@ -1770,42 +2557,51 @@ impl<'ctx> State<'ctx> {
                 })?;
                 Ok(())
             }
+            Intrinsic::ThreadLocalAddress => {
+                // TODO: threads aren't implemented yet, just return the input
+                let [ptr] = self.get_call_arg_values()?;
+                self.insert_local_value(self.next_instruction.as_any_value_enum(), ptr)?;
+                Ok(())
+            }
             Intrinsic::Unknown(_) => todo!("{function_value}"),
         }
     }
-    fn run_call_type_register_static(&mut self) -> Result<()> {
-        let [type_info_ptr] = self.get_call_arg_values()?;
-        let Value::Pointer(type_info_ptr) = type_info_ptr else {
-            bail!("type_register_static argument must be a pointer");
-        };
-        let value = TargetTypeInfo::load(self, type_info_ptr.clone())?;
-        let name = self.load_c_str(value.name.clone())?;
-        let parent = self.load_c_str(value.parent.clone())?;
-        let parsed_type_info = ParsedTypeInfo {
-            type_info_ptr,
-            name,
-            parent,
-            value,
-        };
-        self.global.registered_type_infos.push(parsed_type_info);
-        Ok(())
-    }
-    fn run_call_g_malloc0(&mut self) -> Result<()> {
-        let [size] = self.get_call_arg_values()?;
-        let Value::ConstantInt(size) = size else {
-            bail!("g_malloc0 argument must be an integer");
-        };
-        let size = size as u64;
-        let pointer_base = if size == 0 {
-            self.global.null_ptr_base.clone()
+    fn run_call_g_realloc_helper(&mut self, mem: Option<Pointer>, size: u64) -> Result<()> {
+        let old_mem;
+        let old_mem = if let Some(mem) = mem {
+            if let PointerBase::Null = *mem.base {
+                &[]
+            } else if let Some(mem) = self.global.memory.remove(&mem.base) {
+                old_mem = mem;
+                &*old_mem
+            } else {
+                bail!("called g_free on already freed memory: {mem:?}");
+            }
         } else {
-            Rc::new(PointerBase::Heap {
-                id: self.global.gen_id(),
-            })
+            &[]
         };
+
+        if size == 0 {
+            self.insert_local_value(
+                self.next_instruction.as_any_value_enum(),
+                Value::Pointer(Pointer {
+                    base: self.global.null_ptr_base.clone(),
+                    offset: 0,
+                }),
+            )?;
+            return Ok(());
+        }
+        let pointer_base = Rc::new(PointerBase::Heap {
+            id: self.global.gen_id(),
+        });
         self.global.memory.insert(
             pointer_base.clone(),
-            Rc::from_iter((0..size).map(|_| Byte::Constant(0))),
+            Rc::from_iter((0..size).map(|i| {
+                old_mem
+                    .get(i as usize)
+                    .cloned()
+                    .unwrap_or(Byte::Constant(0))
+            })),
         );
         self.insert_local_value(
             self.next_instruction.as_any_value_enum(),
@@ -1816,124 +2612,6 @@ impl<'ctx> State<'ctx> {
         )?;
         Ok(())
     }
-    fn run_call_clock_gettime(&mut self) -> Result<()> {
-        let [_clockid, tp] = self.get_call_arg_values()?;
-        let Value::Pointer(tp) = tp else {
-            bail!("clock_gettime tp argument must be a pointer");
-        };
-        TargetTimeSpec::store(
-            self,
-            tp,
-            TargetTimeSpecValue {
-                tv_sec: 0,
-                tv_nsec: 0,
-            },
-        )?;
-        self.insert_local_value(
-            self.next_instruction.as_any_value_enum(),
-            Value::ConstantInt(0),
-        )?;
-        Ok(())
-    }
-    fn run_call_sysconf(&mut self) -> Result<()> {
-        let [name] = self.get_call_arg_values()?;
-        let Value::ConstantInt(name) = name else {
-            bail!("sysconf `name` argument must be an integer");
-        };
-        let retval: i64 = match name as i32 {
-            187 => 64, // _SC_LEVEL1_ICACHE_LINESIZE -- 64 since that seems reasonable
-            190 => 64, // _SC_LEVEL1_DCACHE_LINESIZE -- 64 since that seems reasonable
-            _ => todo!("sysconf({name})"),
-        };
-        self.insert_local_value(
-            self.next_instruction.as_any_value_enum(),
-            Value::ConstantInt(retval as u64 as u128),
-        )?;
-        Ok(())
-    }
-    fn run_call_getauxval(&mut self) -> Result<()> {
-        let [type_] = self.get_call_arg_values()?;
-        let Value::ConstantInt(type_) = type_ else {
-            bail!("getauxval `type` argument must be an integer");
-        };
-        let retval: u64 = match type_ as u64 {
-            16 => {
-                // AT_HWCAP
-                if self.get_function().get_name() == c"qemu_getauxval"
-                    && let Some(caller) = &self.return_target
-                    && caller.get_function().get_name() == c"init_cache_info"
-                {
-                    // it only cares about PPC_FEATURE_ICACHE_SNOOP, so just set that
-                    0x00002000
-                } else {
-                    todo!("getauxval(AT_HWCAP)")
-                }
-            }
-            _ => todo!("getauxval({type_})"),
-        };
-        self.insert_local_value(
-            self.next_instruction.as_any_value_enum(),
-            Value::ConstantInt(retval as u128),
-        )?;
-        Ok(())
-    }
-    fn run_call_pthread_atfork(&mut self) -> Result<()> {
-        // we don't implement forking, so ignore the passed-in function pointers and just return 0
-        self.insert_local_value(
-            self.next_instruction.as_any_value_enum(),
-            Value::ConstantInt(0 as u128),
-        )?;
-        Ok(())
-    }
-    fn run_call_pthread_mutex_init(&mut self) -> Result<()> {
-        let [mutex, mutexattr] = self.get_call_arg_values()?;
-        let Value::Pointer(mutex) = mutex else {
-            bail!("pthread_mutex_init `mutex` argument must be a pointer");
-        };
-        let Value::Pointer(mutexattr) = mutexattr else {
-            bail!("pthread_mutex_init `mutexattr` argument must be a pointer");
-        };
-        if mutexattr.base.address() != Some(0) {
-            todo!("pthread_mutex_init with non-null `mutexattr`");
-        };
-        let null_ptr = Pointer {
-            base: self.global.null_ptr_base.clone(),
-            offset: 0,
-        };
-        let init = TargetPThreadMutexTValue {
-            lock: 0,
-            count: 0,
-            owner: 0,
-            nusers: 0,
-            kind: 0,
-            spins: 0,
-            elision: 0,
-            list: TargetPThreadListTValue {
-                prev: null_ptr.clone(),
-                next: null_ptr,
-            },
-        };
-        TargetPThreadMutexT::store(self, mutex, init)?;
-        self.insert_local_value(
-            self.next_instruction.as_any_value_enum(),
-            Value::ConstantInt(0),
-        )?;
-        Ok(())
-    }
-    fn run_call_known_function(
-        &mut self,
-        function_value: FunctionValue<'ctx>,
-        known_function: KnownFunction,
-    ) -> Result<()> {
-        match known_function {
-            KnownFunction::GMalloc0 => self.run_call_g_malloc0(),
-            KnownFunction::ClockGetTime => self.run_call_clock_gettime(),
-            KnownFunction::SysConf => self.run_call_sysconf(),
-            KnownFunction::GetAuxVal => self.run_call_getauxval(),
-            KnownFunction::PThreadAtFork => self.run_call_pthread_atfork(),
-            KnownFunction::PThreadMutexInit => self.run_call_pthread_mutex_init(),
-        }
-    }
     fn run_normal_call(mut self: Rc<Self>, function: FunctionValue<'ctx>) -> Result<Rc<Self>> {
         let this = Rc::make_mut(&mut self);
         let call_instruction = this.next_instruction;
@@ -1954,6 +2632,12 @@ impl<'ctx> State<'ctx> {
         retval.return_target = Some(self);
         Ok(Rc::new(retval))
     }
+    fn read_file_into_c_str(&mut self, filename: &CStr) -> Result<CString> {
+        match filename.to_bytes() {
+            b"/proc/sys/vm/max_map_count" => Ok(c"65530\n".into()),
+            _ => todo!("{filename:?}"),
+        }
+    }
     fn branch_to(&mut self, target: BasicBlock<'ctx>) -> Result<()> {
         #[cfg(feature = "verbose-trace")]
         println!("branch_to: {target:?}");
@@ -2208,7 +2892,30 @@ impl<'ctx> State<'ctx> {
                 _ => bail!("invalid branch operand count: {}", this.next_instruction),
             },
             InstructionOpcode::Call => {
-                let called_value = get_called_value(this.next_instruction);
+                let mut called_value = get_called_value(this.next_instruction);
+                if let AnyValueEnum::PointerValue(pointer_value) = called_value {
+                    if let Some(known_inline_asm) =
+                        KnownInlineAsm::new(pointer_value, &this.global.known_inline_asms)
+                    {
+                        match known_inline_asm {
+                            KnownInlineAsm::Nop1 => return_after_non_term!(),
+                        }
+                    }
+                    let Value::Pointer(ptr) = this.get_value(called_value)? else {
+                        bail!("invalid indirect call argument");
+                    };
+                    let PointerBase::Function { name } = &*ptr.base else {
+                        bail!("invalid indirect call argument");
+                    };
+                    ensure!(ptr.offset == 0, "invalid indirect call argument");
+                    let Ok(name) = name.to_str() else {
+                        bail!("function name is not valid UTF-8: {name:?}");
+                    };
+                    let Some(function_value) = this.global.parser.module.get_function(name) else {
+                        unreachable!("known to exist in module");
+                    };
+                    called_value = function_value.into();
+                }
                 match called_value {
                     AnyValueEnum::ArrayValue(_)
                     | AnyValueEnum::IntValue(_)
@@ -2228,8 +2935,10 @@ impl<'ctx> State<'ctx> {
                         } else if let Some(known_function) =
                             KnownFunction::new(function_value.get_name())
                         {
-                            this.run_call_known_function(function_value, known_function)?;
-                            return_after_non_term!();
+                            new_states.push(
+                                self.run_call_known_function(function_value, known_function)?,
+                            );
+                            return Ok(ControlFlow::Continue(()));
                         } else if function_value.get_first_basic_block().is_some() {
                             new_states.push(self.run_normal_call(function_value)?);
                             return Ok(ControlFlow::Continue(()));
@@ -2238,7 +2947,7 @@ impl<'ctx> State<'ctx> {
                             todo!("{}", function_value.get_name().to_string_lossy());
                         }
                     }
-                    AnyValueEnum::PointerValue(pointer_value) => todo!(),
+                    AnyValueEnum::PointerValue(pointer_value) => todo!("{}", this.next_instruction),
                 }
             }
             InstructionOpcode::CallBr => todo!("{}", this.next_instruction),
@@ -2272,6 +2981,66 @@ impl<'ctx> State<'ctx> {
                 return_after_non_term!();
             }
             InstructionOpcode::ICmp => {
+                let ty = this
+                    .next_instruction
+                    .get_operand(0)
+                    .expect("known to have lhs operand")
+                    .unwrap_value()
+                    .get_type();
+                match ty {
+                    BasicTypeEnum::ArrayType(_) => unreachable!(),
+                    BasicTypeEnum::FloatType(_) => unreachable!(),
+                    BasicTypeEnum::IntType(_) => {}
+                    BasicTypeEnum::PointerType(_) => {
+                        let lhs = this
+                            .next_instruction
+                            .get_operand(0)
+                            .expect("known to have lhs operand")
+                            .unwrap_value();
+                        let lhs = this.get_value(lhs)?;
+                        let Value::Pointer(lhs) = lhs else {
+                            todo!("{lhs:?}");
+                        };
+                        let rhs = this
+                            .next_instruction
+                            .get_operand(1)
+                            .expect("known to have rhs operand")
+                            .unwrap_value();
+                        let rhs = this.get_value(rhs)?;
+                        let Value::Pointer(rhs) = rhs else {
+                            todo!("{rhs:?}");
+                        };
+                        let pred = this
+                            .next_instruction
+                            .get_icmp_predicate()
+                            .expect("known to be icmp");
+                        let (is_eq, is_gt_lt) = if lhs.base == rhs.base {
+                            (
+                                lhs.offset == rhs.offset,
+                                Some((lhs.offset > rhs.offset, lhs.offset < rhs.offset)),
+                            )
+                        } else {
+                            (false, None)
+                        };
+                        let retval = match (pred, is_gt_lt) {
+                            (IntPredicate::EQ, _) => is_eq,
+                            (IntPredicate::NE, _) => !is_eq,
+                            (IntPredicate::UGT, Some((is_gt, _))) => is_gt,
+                            (IntPredicate::ULE, Some((is_gt, _))) => !is_gt,
+                            (IntPredicate::ULT, Some((_, is_lt))) => is_lt,
+                            (IntPredicate::UGE, Some((_, is_lt))) => !is_lt,
+                            _ => todo!("comparing pointers {lhs:?} {pred:?} {rhs:?}"),
+                        };
+                        this.insert_local_value(
+                            this.next_instruction.as_any_value_enum(),
+                            Value::ConstantInt(retval as u128),
+                        )?;
+                        return_after_non_term!();
+                    }
+                    BasicTypeEnum::StructType(_) => unreachable!(),
+                    BasicTypeEnum::VectorType(_) => todo!("{}", this.next_instruction),
+                    BasicTypeEnum::ScalableVectorType(_) => todo!("{}", this.next_instruction),
+                }
                 match this
                     .next_instruction
                     .get_icmp_predicate()
@@ -2313,7 +3082,22 @@ impl<'ctx> State<'ctx> {
             InstructionOpcode::IndirectBr => todo!("{}", this.next_instruction),
             InstructionOpcode::InsertElement => todo!("{}", this.next_instruction),
             InstructionOpcode::InsertValue => todo!("{}", this.next_instruction),
-            InstructionOpcode::IntToPtr => todo!("{}", this.next_instruction),
+            InstructionOpcode::IntToPtr => {
+                let arg = this
+                    .next_instruction
+                    .get_operand(0)
+                    .expect("known to have arg operand")
+                    .unwrap_value();
+                let arg = this.get_value(arg)?;
+                match arg {
+                    Value::Pointer(_) => {
+                        this.insert_local_value(this.next_instruction.as_any_value_enum(), arg)?;
+                        return_after_non_term!();
+                    }
+                    Value::ConstantInt(_) => todo!("{}", this.next_instruction),
+                    Value::Aggregate(_) => unreachable!(),
+                }
+            }
             InstructionOpcode::Invoke => todo!("{}", this.next_instruction),
             InstructionOpcode::LandingPad => todo!("{}", this.next_instruction),
             InstructionOpcode::Load => {
@@ -2542,6 +3326,7 @@ impl<'ctx> State<'ctx> {
                 return Ok(finished_states);
             }
         }
+        states[0].print_backtrace();
         bail!("too many steps");
     }
     fn run(self: Rc<Self>, max_step_count: u64, max_state_count: usize) -> Result<Vec<Rc<Self>>> {
@@ -2561,7 +3346,18 @@ pub fn parse_qemu_system_ppc64(
     let context = &context;
     let module = Rc::new(Module::parse_bitcode_from_path(path, context).map_err(map_llvm_err)?);
     let parser = Rc::new(Parser::new(context, module)?);
-    let global = GlobalState::new(parser).run_global_ctors(200)?;
+    let global = GlobalState::new(parser)?.run_global_ctors(20000)?;
+    let global = Rc::unwrap_or_clone(
+        Rc::new(State::new(
+            global,
+            "qemu_init_subsystems",
+            context.void_type().fn_type(&[], false),
+            |_| Ok(vec![]),
+        )?)
+        .run_single(100000)?,
+    )
+    .global;
+    dbg!(&global.registered_type_infos);
     let powerpc64_cpu_type_info = global
         .registered_type_infos
         .iter()