diff --git a/qemu/Makefile.target b/qemu/Makefile.target
index 31bd65d1..fb626082 100644
--- a/qemu/Makefile.target
+++ b/qemu/Makefile.target
@@ -48,6 +48,7 @@ obj-$(CONFIG_TCG) += tcg/tcg-common.o
 obj-y += fpu/softfloat.o
 obj-y += target/$(TARGET_BASE_ARCH)/
 obj-y += tcg-runtime.o
+obj-y += accel/
 
 #########################################################
 # System emulator target
diff --git a/qemu/aarch64.h b/qemu/aarch64.h
index 3bc68635..bcbaed38 100644
--- a/qemu/aarch64.h
+++ b/qemu/aarch64.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_aarch64
 #define tosa_init tosa_init_aarch64
 #define tosa_machine_init tosa_machine_init_aarch64
+#define translator_loop translator_loop_aarch64
+#define translator_loop_temp_check translator_loop_temp_check_aarch64
 #define tswap32 tswap32_aarch64
 #define tswap64 tswap64_aarch64
 #define type_class_get_size type_class_get_size_aarch64
diff --git a/qemu/aarch64eb.h b/qemu/aarch64eb.h
index f4cbc635..06cea7ee 100644
--- a/qemu/aarch64eb.h
+++ b/qemu/aarch64eb.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_aarch64eb
 #define tosa_init tosa_init_aarch64eb
 #define tosa_machine_init tosa_machine_init_aarch64eb
+#define translator_loop translator_loop_aarch64eb
+#define translator_loop_temp_check translator_loop_temp_check_aarch64eb
 #define tswap32 tswap32_aarch64eb
 #define tswap64 tswap64_aarch64eb
 #define type_class_get_size type_class_get_size_aarch64eb
diff --git a/qemu/accel/Makefile.objs b/qemu/accel/Makefile.objs
new file mode 100644
index 00000000..151dc110
--- /dev/null
+++ b/qemu/accel/Makefile.objs
@@ -0,0 +1 @@
+obj-y += tcg/
diff --git a/qemu/accel/tcg/Makefile.objs b/qemu/accel/tcg/Makefile.objs
new file mode 100644
index 00000000..0a02117e
--- /dev/null
+++ b/qemu/accel/tcg/Makefile.objs
@@ -0,0 +1 @@
+obj-y += translator.o
diff --git a/qemu/accel/tcg/translator.c b/qemu/accel/tcg/translator.c
new file mode 100644
index 00000000..36193d5d
--- /dev/null
+++ b/qemu/accel/tcg/translator.c
@@ -0,0 +1,139 @@
+/*
+ * Generic intermediate code generation.
+ *
+ * Copyright (C) 2016-2017 Lluís Vilanova <vilanova@ac.upc.edu>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "cpu.h"
+#include "tcg/tcg.h"
+#include "tcg/tcg-op.h"
+#include "exec/exec-all.h"
+#include "exec/gen-icount.h"
+#include "exec/translator.h"
+
+/* Pairs with tcg_clear_temp_count.
+   To be called by #TranslatorOps.{translate_insn,tb_stop} if
+   (1) the target is sufficiently clean to support reporting,
+   (2) as and when all temporaries are known to be consumed.
+   For most targets, (2) is at the end of translate_insn.  */
+void translator_loop_temp_check(DisasContextBase *db)
+{
+    if (tcg_check_temp_count()) {
+        qemu_log("warning: TCG temporary leaks before "
+                 TARGET_FMT_lx "\n", db->pc_next);
+    }
+}
+
+void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
+                     CPUState *cpu, TranslationBlock *tb)
+{
+    TCGContext *tcg_ctx = cpu->uc->tcg_ctx;
+    int max_insns;
+
+    /* Initialize DisasContext */
+    db->tb = tb;
+    db->pc_first = tb->pc;
+    db->pc_next = db->pc_first;
+    db->is_jmp = DISAS_NEXT;
+    db->num_insns = 0;
+    db->singlestep_enabled = cpu->singlestep_enabled;
+    db->uc = cpu->uc;
+
+    /* Instruction counting */
+    max_insns = db->tb->cflags & CF_COUNT_MASK;
+    if (max_insns == 0) {
+        max_insns = CF_COUNT_MASK;
+    }
+    if (max_insns > TCG_MAX_INSNS) {
+        max_insns = TCG_MAX_INSNS;
+    }
+    // Unicorn: commented out
+    if (db->singlestep_enabled /*|| singlestep*/) {
+        max_insns = 1;
+    }
+
+    max_insns = ops->init_disas_context(db, cpu, max_insns);
+    tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
+
+    /* Reset the temp count so that we can identify leaks */
+    tcg_clear_temp_count();
+
+    /* Start translating.  */
+    gen_tb_start(tcg_ctx, db->tb);
+    ops->tb_start(db, cpu);
+    tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
+
+    while (true) {
+        db->num_insns++;
+        ops->insn_start(db, cpu);
+        tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
+
+        /* Pass breakpoint hits to target for further processing */
+        if (unlikely(!QTAILQ_EMPTY(&cpu->breakpoints))) {
+            CPUBreakpoint *bp;
+            QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {
+                if (bp->pc == db->pc_next) {
+                    if (ops->breakpoint_check(db, cpu, bp)) {
+                        break;
+                    }
+                }
+            }
+            /* The breakpoint_check hook may use DISAS_TOO_MANY to indicate
+               that only one more instruction is to be executed.  Otherwise
+               it should use DISAS_NORETURN when generating an exception,
+               but may use a DISAS_TARGET_* value for Something Else.  */
+            if (db->is_jmp > DISAS_TOO_MANY) {
+                break;
+            }
+        }
+
+        /* Disassemble one instruction.  The translate_insn hook should
+           update db->pc_next and db->is_jmp to indicate what should be
+           done next -- either exiting this loop or locate the start of
+           the next instruction.  */
+        if (db->num_insns == max_insns && (db->tb->cflags & CF_LAST_IO)) {
+            /* Accept I/O on the last instruction.  */
+            //gen_io_start();
+            ops->translate_insn(db, cpu);
+            //gen_io_end();
+        } else {
+            ops->translate_insn(db, cpu);
+        }
+
+        /* Stop translation if translate_insn so indicated.  */
+        if (db->is_jmp != DISAS_NEXT) {
+            break;
+        }
+
+        /* Stop translation if the output buffer is full,
+           or we have executed all of the allowed instructions.  */
+        if (tcg_op_buf_full(tcg_ctx) || db->num_insns >= max_insns) {
+            db->is_jmp = DISAS_TOO_MANY;
+            break;
+        }
+    }
+
+    /* Emit code to exit the TB, as indicated by db->is_jmp.  */
+    ops->tb_stop(db, cpu);
+    gen_tb_end(tcg_ctx, db->tb, db->num_insns);
+
+    /* The disas_log hook may use these values rather than recompute.  */
+    db->tb->size = db->pc_next - db->pc_first;
+    db->tb->icount = db->num_insns;
+
+#ifdef DEBUG_DISAS
+    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
+        && qemu_log_in_addr_range(db->pc_first)) {
+        //qemu_log_lock();
+        qemu_log("----------------\n");
+        ops->disas_log(db, cpu);
+        qemu_log("\n");
+        //qemu_log_unlock();
+    }
+#endif
+}
diff --git a/qemu/arm.h b/qemu/arm.h
index 96f680b4..90707252 100644
--- a/qemu/arm.h
+++ b/qemu/arm.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_arm
 #define tosa_init tosa_init_arm
 #define tosa_machine_init tosa_machine_init_arm
+#define translator_loop translator_loop_arm
+#define translator_loop_temp_check translator_loop_temp_check_arm
 #define tswap32 tswap32_arm
 #define tswap64 tswap64_arm
 #define type_class_get_size type_class_get_size_arm
diff --git a/qemu/armeb.h b/qemu/armeb.h
index 0948c2df..9246e3ec 100644
--- a/qemu/armeb.h
+++ b/qemu/armeb.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_armeb
 #define tosa_init tosa_init_armeb
 #define tosa_machine_init tosa_machine_init_armeb
+#define translator_loop translator_loop_armeb
+#define translator_loop_temp_check translator_loop_temp_check_armeb
 #define tswap32 tswap32_armeb
 #define tswap64 tswap64_armeb
 #define type_class_get_size type_class_get_size_armeb
diff --git a/qemu/header_gen.py b/qemu/header_gen.py
index fceed1c7..b85c005d 100644
--- a/qemu/header_gen.py
+++ b/qemu/header_gen.py
@@ -3351,6 +3351,8 @@ symbols = (
     'tokens_append_from_iter',
     'tosa_init',
     'tosa_machine_init',
+    'translator_loop',
+    'translator_loop_temp_check',
     'tswap32',
     'tswap64',
     'type_class_get_size',
diff --git a/qemu/include/exec/translator.h b/qemu/include/exec/translator.h
index b51b8f8a..0c5b5d71 100644
--- a/qemu/include/exec/translator.h
+++ b/qemu/include/exec/translator.h
@@ -10,6 +10,19 @@
 #ifndef EXEC__TRANSLATOR_H
 #define EXEC__TRANSLATOR_H
 
+/*
+ * Include this header from a target-specific file, and add a
+ *
+ *     DisasContextBase base;
+ *
+ * member in your target-specific DisasContext.
+ */
+
+
+#include "exec/exec-all.h"
+#include "tcg/tcg.h"
+
+
 /**
  * DisasJumpType:
  * @DISAS_NEXT: Next instruction in program order.
@@ -37,4 +50,98 @@ typedef enum DisasJumpType {
     DISAS_TARGET_11,
 } DisasJumpType;
 
+/**
+ * DisasContextBase:
+ * @tb: Translation block for this disassembly.
+ * @pc_first: Address of first guest instruction in this TB.
+ * @pc_next: Address of next guest instruction in this TB (current during
+ *           disassembly).
+ * @is_jmp: What instruction to disassemble next.
+ * @num_insns: Number of translated instructions (including current).
+ * @singlestep_enabled: "Hardware" single stepping enabled.
+ *
+ * Architecture-agnostic disassembly context.
+ */
+typedef struct DisasContextBase {
+    TranslationBlock *tb;
+    target_ulong pc_first;
+    target_ulong pc_next;
+    DisasJumpType is_jmp;
+    unsigned int num_insns;
+    bool singlestep_enabled;
+
+    // Unicorn member variables
+    struct uc_struct *uc;
+} DisasContextBase;
+
+/**
+ * TranslatorOps:
+ * @init_disas_context:
+ *      Initialize the target-specific portions of DisasContext struct.
+ *      The generic DisasContextBase has already been initialized.
+ *      Return max_insns, modified as necessary by db->tb->flags.
+ *
+ * @tb_start:
+ *      Emit any code required before the start of the main loop,
+ *      after the generic gen_tb_start().
+ *
+ * @insn_start:
+ *      Emit the tcg_gen_insn_start opcode.
+ *
+ * @breakpoint_check:
+ *      When called, the breakpoint has already been checked to match the PC,
+ *      but the target may decide the breakpoint missed the address
+ *      (e.g., due to conditions encoded in their flags).  Return true to
+ *      indicate that the breakpoint did hit, in which case no more breakpoints
+ *      are checked.  If the breakpoint did hit, emit any code required to
+ *      signal the exception, and set db->is_jmp as necessary to terminate
+ *      the main loop.
+ *
+ * @translate_insn:
+ *      Disassemble one instruction and set db->pc_next for the start
+ *      of the following instruction.  Set db->is_jmp as necessary to
+ *      terminate the main loop.
+ *
+ * @tb_stop:
+ *      Emit any opcodes required to exit the TB, based on db->is_jmp.
+ *
+ * @disas_log:
+ *      Print instruction disassembly to log.
+ */
+typedef struct TranslatorOps {
+    int (*init_disas_context)(DisasContextBase *db, CPUState *cpu,
+                              int max_insns);
+    void (*tb_start)(DisasContextBase *db, CPUState *cpu);
+    void (*insn_start)(DisasContextBase *db, CPUState *cpu);
+    bool (*breakpoint_check)(DisasContextBase *db, CPUState *cpu,
+                             const CPUBreakpoint *bp);
+    void (*translate_insn)(DisasContextBase *db, CPUState *cpu);
+    void (*tb_stop)(DisasContextBase *db, CPUState *cpu);
+    void (*disas_log)(const DisasContextBase *db, CPUState *cpu);
+} TranslatorOps;
+
+/**
+ * translator_loop:
+ * @ops: Target-specific operations.
+ * @db: Disassembly context.
+ * @cpu: Target vCPU.
+ * @tb: Translation block.
+ *
+ * Generic translator loop.
+ *
+ * Translation will stop in the following cases (in order):
+ * - When is_jmp set by #TranslatorOps::breakpoint_check.
+ *   - set to DISAS_TOO_MANY exits after translating one more insn
+ *   - set to any other value than DISAS_NEXT exits immediately.
+ * - When is_jmp set by #TranslatorOps::translate_insn.
+ *   - set to any value other than DISAS_NEXT exits immediately.
+ * - When the TCG operation buffer is full.
+ * - When single-stepping is enabled (system-wide or on the current vCPU).
+ * - When too many instructions have been translated.
+ */
+void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
+                     CPUState *cpu, TranslationBlock *tb);
+
+void translator_loop_temp_check(DisasContextBase *db);
+
 #endif  /* EXEC__TRANSLATOR_H */
diff --git a/qemu/m68k.h b/qemu/m68k.h
index bae562b9..31a26452 100644
--- a/qemu/m68k.h
+++ b/qemu/m68k.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_m68k
 #define tosa_init tosa_init_m68k
 #define tosa_machine_init tosa_machine_init_m68k
+#define translator_loop translator_loop_m68k
+#define translator_loop_temp_check translator_loop_temp_check_m68k
 #define tswap32 tswap32_m68k
 #define tswap64 tswap64_m68k
 #define type_class_get_size type_class_get_size_m68k
diff --git a/qemu/mips.h b/qemu/mips.h
index 4c7eb3dc..e20aaa44 100644
--- a/qemu/mips.h
+++ b/qemu/mips.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_mips
 #define tosa_init tosa_init_mips
 #define tosa_machine_init tosa_machine_init_mips
+#define translator_loop translator_loop_mips
+#define translator_loop_temp_check translator_loop_temp_check_mips
 #define tswap32 tswap32_mips
 #define tswap64 tswap64_mips
 #define type_class_get_size type_class_get_size_mips
diff --git a/qemu/mips64.h b/qemu/mips64.h
index 191aa5cf..6ab326c2 100644
--- a/qemu/mips64.h
+++ b/qemu/mips64.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_mips64
 #define tosa_init tosa_init_mips64
 #define tosa_machine_init tosa_machine_init_mips64
+#define translator_loop translator_loop_mips64
+#define translator_loop_temp_check translator_loop_temp_check_mips64
 #define tswap32 tswap32_mips64
 #define tswap64 tswap64_mips64
 #define type_class_get_size type_class_get_size_mips64
diff --git a/qemu/mips64el.h b/qemu/mips64el.h
index 56bed548..17ebc59a 100644
--- a/qemu/mips64el.h
+++ b/qemu/mips64el.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_mips64el
 #define tosa_init tosa_init_mips64el
 #define tosa_machine_init tosa_machine_init_mips64el
+#define translator_loop translator_loop_mips64el
+#define translator_loop_temp_check translator_loop_temp_check_mips64el
 #define tswap32 tswap32_mips64el
 #define tswap64 tswap64_mips64el
 #define type_class_get_size type_class_get_size_mips64el
diff --git a/qemu/mipsel.h b/qemu/mipsel.h
index 2a0d8d79..86edf8cf 100644
--- a/qemu/mipsel.h
+++ b/qemu/mipsel.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_mipsel
 #define tosa_init tosa_init_mipsel
 #define tosa_machine_init tosa_machine_init_mipsel
+#define translator_loop translator_loop_mipsel
+#define translator_loop_temp_check translator_loop_temp_check_mipsel
 #define tswap32 tswap32_mipsel
 #define tswap64 tswap64_mipsel
 #define type_class_get_size type_class_get_size_mipsel
diff --git a/qemu/powerpc.h b/qemu/powerpc.h
index f5bd581e..9d4c3116 100644
--- a/qemu/powerpc.h
+++ b/qemu/powerpc.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_powerpc
 #define tosa_init tosa_init_powerpc
 #define tosa_machine_init tosa_machine_init_powerpc
+#define translator_loop translator_loop_powerpc
+#define translator_loop_temp_check translator_loop_temp_check_powerpc
 #define tswap32 tswap32_powerpc
 #define tswap64 tswap64_powerpc
 #define type_class_get_size type_class_get_size_powerpc
diff --git a/qemu/sparc.h b/qemu/sparc.h
index 2fe7e1b9..bf0bc158 100644
--- a/qemu/sparc.h
+++ b/qemu/sparc.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_sparc
 #define tosa_init tosa_init_sparc
 #define tosa_machine_init tosa_machine_init_sparc
+#define translator_loop translator_loop_sparc
+#define translator_loop_temp_check translator_loop_temp_check_sparc
 #define tswap32 tswap32_sparc
 #define tswap64 tswap64_sparc
 #define type_class_get_size type_class_get_size_sparc
diff --git a/qemu/sparc64.h b/qemu/sparc64.h
index c44cad23..1475ea51 100644
--- a/qemu/sparc64.h
+++ b/qemu/sparc64.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_sparc64
 #define tosa_init tosa_init_sparc64
 #define tosa_machine_init tosa_machine_init_sparc64
+#define translator_loop translator_loop_sparc64
+#define translator_loop_temp_check translator_loop_temp_check_sparc64
 #define tswap32 tswap32_sparc64
 #define tswap64 tswap64_sparc64
 #define type_class_get_size type_class_get_size_sparc64
diff --git a/qemu/x86_64.h b/qemu/x86_64.h
index 09255c9e..069c13aa 100644
--- a/qemu/x86_64.h
+++ b/qemu/x86_64.h
@@ -3345,6 +3345,8 @@
 #define tokens_append_from_iter tokens_append_from_iter_x86_64
 #define tosa_init tosa_init_x86_64
 #define tosa_machine_init tosa_machine_init_x86_64
+#define translator_loop translator_loop_x86_64
+#define translator_loop_temp_check translator_loop_temp_check_x86_64
 #define tswap32 tswap32_x86_64
 #define tswap64 tswap64_x86_64
 #define type_class_get_size type_class_get_size_x86_64