]> git.proxmox.com Git - qemu.git/blobdiff - hw/omap1.c
Use glib memory allocation and free functions
[qemu.git] / hw / omap1.c
index a32563bb8fa63a191370d08c52c66e7a62e72e71..614fd31b013c791b5a702dd5f8043b16aeb71960 100644 (file)
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- * MA 02111-1307 USA
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "hw.h"
 #include "arm-misc.h"
@@ -27,6 +25,9 @@
 #include "soc_dma.h"
 /* We use pc-style serial ports.  */
 #include "pc.h"
+#include "blockdev.h"
+#include "range.h"
+#include "sysbus.h"
 
 /* Should signal the TCMI/GPMC */
 uint32_t omap_badwidth_read8(void *opaque, target_phys_addr_t addr)
@@ -81,586 +82,10 @@ void omap_badwidth_write32(void *opaque, target_phys_addr_t addr,
     cpu_physical_memory_write(addr, (void *) &value, 4);
 }
 
-/* Interrupt Handlers */
-struct omap_intr_handler_bank_s {
-    uint32_t irqs;
-    uint32_t inputs;
-    uint32_t mask;
-    uint32_t fiq;
-    uint32_t sens_edge;
-    uint32_t swi;
-    unsigned char priority[32];
-};
-
-struct omap_intr_handler_s {
-    qemu_irq *pins;
-    qemu_irq parent_intr[2];
-    target_phys_addr_t base;
-    unsigned char nbanks;
-    int level_only;
-
-    /* state */
-    uint32_t new_agr[2];
-    int sir_intr[2];
-    int autoidle;
-    uint32_t mask;
-    struct omap_intr_handler_bank_s bank[];
-};
-
-static void omap_inth_sir_update(struct omap_intr_handler_s *s, int is_fiq)
-{
-    int i, j, sir_intr, p_intr, p, f;
-    uint32_t level;
-    sir_intr = 0;
-    p_intr = 255;
-
-    /* Find the interrupt line with the highest dynamic priority.
-     * Note: 0 denotes the hightest priority.
-     * If all interrupts have the same priority, the default order is IRQ_N,
-     * IRQ_N-1,...,IRQ_0. */
-    for (j = 0; j < s->nbanks; ++j) {
-        level = s->bank[j].irqs & ~s->bank[j].mask &
-                (is_fiq ? s->bank[j].fiq : ~s->bank[j].fiq);
-        for (f = ffs(level), i = f - 1, level >>= f - 1; f; i += f,
-                        level >>= f) {
-            p = s->bank[j].priority[i];
-            if (p <= p_intr) {
-                p_intr = p;
-                sir_intr = 32 * j + i;
-            }
-            f = ffs(level >> 1);
-        }
-    }
-    s->sir_intr[is_fiq] = sir_intr;
-}
-
-static inline void omap_inth_update(struct omap_intr_handler_s *s, int is_fiq)
-{
-    int i;
-    uint32_t has_intr = 0;
-
-    for (i = 0; i < s->nbanks; ++i)
-        has_intr |= s->bank[i].irqs & ~s->bank[i].mask &
-                (is_fiq ? s->bank[i].fiq : ~s->bank[i].fiq);
-
-    if (s->new_agr[is_fiq] & has_intr & s->mask) {
-        s->new_agr[is_fiq] = 0;
-        omap_inth_sir_update(s, is_fiq);
-        qemu_set_irq(s->parent_intr[is_fiq], 1);
-    }
-}
-
-#define INT_FALLING_EDGE       0
-#define INT_LOW_LEVEL          1
-
-static void omap_set_intr(void *opaque, int irq, int req)
-{
-    struct omap_intr_handler_s *ih = (struct omap_intr_handler_s *) opaque;
-    uint32_t rise;
-
-    struct omap_intr_handler_bank_s *bank = &ih->bank[irq >> 5];
-    int n = irq & 31;
-
-    if (req) {
-        rise = ~bank->irqs & (1 << n);
-        if (~bank->sens_edge & (1 << n))
-            rise &= ~bank->inputs;
-
-        bank->inputs |= (1 << n);
-        if (rise) {
-            bank->irqs |= rise;
-            omap_inth_update(ih, 0);
-            omap_inth_update(ih, 1);
-        }
-    } else {
-        rise = bank->sens_edge & bank->irqs & (1 << n);
-        bank->irqs &= ~rise;
-        bank->inputs &= ~(1 << n);
-    }
-}
-
-/* Simplified version with no edge detection */
-static void omap_set_intr_noedge(void *opaque, int irq, int req)
-{
-    struct omap_intr_handler_s *ih = (struct omap_intr_handler_s *) opaque;
-    uint32_t rise;
-
-    struct omap_intr_handler_bank_s *bank = &ih->bank[irq >> 5];
-    int n = irq & 31;
-
-    if (req) {
-        rise = ~bank->inputs & (1 << n);
-        if (rise) {
-            bank->irqs |= bank->inputs |= rise;
-            omap_inth_update(ih, 0);
-            omap_inth_update(ih, 1);
-        }
-    } else
-        bank->irqs = (bank->inputs &= ~(1 << n)) | bank->swi;
-}
-
-static uint32_t omap_inth_read(void *opaque, target_phys_addr_t addr)
-{
-    struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int i, offset = addr - s->base;
-    int bank_no = offset >> 8;
-    int line_no;
-    struct omap_intr_handler_bank_s *bank = &s->bank[bank_no];
-    offset &= 0xff;
-
-    switch (offset) {
-    case 0x00: /* ITR */
-        return bank->irqs;
-
-    case 0x04: /* MIR */
-        return bank->mask;
-
-    case 0x10: /* SIR_IRQ_CODE */
-    case 0x14:  /* SIR_FIQ_CODE */
-        if (bank_no != 0)
-            break;
-        line_no = s->sir_intr[(offset - 0x10) >> 2];
-        bank = &s->bank[line_no >> 5];
-        i = line_no & 31;
-        if (((bank->sens_edge >> i) & 1) == INT_FALLING_EDGE)
-            bank->irqs &= ~(1 << i);
-        return line_no;
-
-    case 0x18: /* CONTROL_REG */
-        if (bank_no != 0)
-            break;
-        return 0;
-
-    case 0x1c: /* ILR0 */
-    case 0x20: /* ILR1 */
-    case 0x24: /* ILR2 */
-    case 0x28: /* ILR3 */
-    case 0x2c: /* ILR4 */
-    case 0x30: /* ILR5 */
-    case 0x34: /* ILR6 */
-    case 0x38: /* ILR7 */
-    case 0x3c: /* ILR8 */
-    case 0x40: /* ILR9 */
-    case 0x44: /* ILR10 */
-    case 0x48: /* ILR11 */
-    case 0x4c: /* ILR12 */
-    case 0x50: /* ILR13 */
-    case 0x54: /* ILR14 */
-    case 0x58: /* ILR15 */
-    case 0x5c: /* ILR16 */
-    case 0x60: /* ILR17 */
-    case 0x64: /* ILR18 */
-    case 0x68: /* ILR19 */
-    case 0x6c: /* ILR20 */
-    case 0x70: /* ILR21 */
-    case 0x74: /* ILR22 */
-    case 0x78: /* ILR23 */
-    case 0x7c: /* ILR24 */
-    case 0x80: /* ILR25 */
-    case 0x84: /* ILR26 */
-    case 0x88: /* ILR27 */
-    case 0x8c: /* ILR28 */
-    case 0x90: /* ILR29 */
-    case 0x94: /* ILR30 */
-    case 0x98: /* ILR31 */
-        i = (offset - 0x1c) >> 2;
-        return (bank->priority[i] << 2) |
-                (((bank->sens_edge >> i) & 1) << 1) |
-                ((bank->fiq >> i) & 1);
-
-    case 0x9c: /* ISR */
-        return 0x00000000;
-
-    }
-    OMAP_BAD_REG(addr);
-    return 0;
-}
-
-static void omap_inth_write(void *opaque, target_phys_addr_t addr,
-                uint32_t value)
-{
-    struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int i, offset = addr - s->base;
-    int bank_no = offset >> 8;
-    struct omap_intr_handler_bank_s *bank = &s->bank[bank_no];
-    offset &= 0xff;
-
-    switch (offset) {
-    case 0x00: /* ITR */
-        /* Important: ignore the clearing if the IRQ is level-triggered and
-           the input bit is 1 */
-        bank->irqs &= value | (bank->inputs & bank->sens_edge);
-        return;
-
-    case 0x04: /* MIR */
-        bank->mask = value;
-        omap_inth_update(s, 0);
-        omap_inth_update(s, 1);
-        return;
-
-    case 0x10: /* SIR_IRQ_CODE */
-    case 0x14: /* SIR_FIQ_CODE */
-        OMAP_RO_REG(addr);
-        break;
-
-    case 0x18: /* CONTROL_REG */
-        if (bank_no != 0)
-            break;
-        if (value & 2) {
-            qemu_set_irq(s->parent_intr[1], 0);
-            s->new_agr[1] = ~0;
-            omap_inth_update(s, 1);
-        }
-        if (value & 1) {
-            qemu_set_irq(s->parent_intr[0], 0);
-            s->new_agr[0] = ~0;
-            omap_inth_update(s, 0);
-        }
-        return;
-
-    case 0x1c: /* ILR0 */
-    case 0x20: /* ILR1 */
-    case 0x24: /* ILR2 */
-    case 0x28: /* ILR3 */
-    case 0x2c: /* ILR4 */
-    case 0x30: /* ILR5 */
-    case 0x34: /* ILR6 */
-    case 0x38: /* ILR7 */
-    case 0x3c: /* ILR8 */
-    case 0x40: /* ILR9 */
-    case 0x44: /* ILR10 */
-    case 0x48: /* ILR11 */
-    case 0x4c: /* ILR12 */
-    case 0x50: /* ILR13 */
-    case 0x54: /* ILR14 */
-    case 0x58: /* ILR15 */
-    case 0x5c: /* ILR16 */
-    case 0x60: /* ILR17 */
-    case 0x64: /* ILR18 */
-    case 0x68: /* ILR19 */
-    case 0x6c: /* ILR20 */
-    case 0x70: /* ILR21 */
-    case 0x74: /* ILR22 */
-    case 0x78: /* ILR23 */
-    case 0x7c: /* ILR24 */
-    case 0x80: /* ILR25 */
-    case 0x84: /* ILR26 */
-    case 0x88: /* ILR27 */
-    case 0x8c: /* ILR28 */
-    case 0x90: /* ILR29 */
-    case 0x94: /* ILR30 */
-    case 0x98: /* ILR31 */
-        i = (offset - 0x1c) >> 2;
-        bank->priority[i] = (value >> 2) & 0x1f;
-        bank->sens_edge &= ~(1 << i);
-        bank->sens_edge |= ((value >> 1) & 1) << i;
-        bank->fiq &= ~(1 << i);
-        bank->fiq |= (value & 1) << i;
-        return;
-
-    case 0x9c: /* ISR */
-        for (i = 0; i < 32; i ++)
-            if (value & (1 << i)) {
-                omap_set_intr(s, 32 * bank_no + i, 1);
-                return;
-            }
-        return;
-    }
-    OMAP_BAD_REG(addr);
-}
-
-static CPUReadMemoryFunc *omap_inth_readfn[] = {
-    omap_badwidth_read32,
-    omap_badwidth_read32,
-    omap_inth_read,
-};
-
-static CPUWriteMemoryFunc *omap_inth_writefn[] = {
-    omap_inth_write,
-    omap_inth_write,
-    omap_inth_write,
-};
-
-void omap_inth_reset(struct omap_intr_handler_s *s)
-{
-    int i;
-
-    for (i = 0; i < s->nbanks; ++i){
-        s->bank[i].irqs = 0x00000000;
-        s->bank[i].mask = 0xffffffff;
-        s->bank[i].sens_edge = 0x00000000;
-        s->bank[i].fiq = 0x00000000;
-        s->bank[i].inputs = 0x00000000;
-        s->bank[i].swi = 0x00000000;
-        memset(s->bank[i].priority, 0, sizeof(s->bank[i].priority));
-
-        if (s->level_only)
-            s->bank[i].sens_edge = 0xffffffff;
-    }
-
-    s->new_agr[0] = ~0;
-    s->new_agr[1] = ~0;
-    s->sir_intr[0] = 0;
-    s->sir_intr[1] = 0;
-    s->autoidle = 0;
-    s->mask = ~0;
-
-    qemu_set_irq(s->parent_intr[0], 0);
-    qemu_set_irq(s->parent_intr[1], 0);
-}
-
-struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
-                unsigned long size, unsigned char nbanks, qemu_irq **pins,
-                qemu_irq parent_irq, qemu_irq parent_fiq, omap_clk clk)
-{
-    int iomemtype;
-    struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
-                            sizeof(struct omap_intr_handler_bank_s) * nbanks);
-
-    s->parent_intr[0] = parent_irq;
-    s->parent_intr[1] = parent_fiq;
-    s->base = base;
-    s->nbanks = nbanks;
-    s->pins = qemu_allocate_irqs(omap_set_intr, s, nbanks * 32);
-    if (pins)
-        *pins = s->pins;
-
-    omap_inth_reset(s);
-
-    iomemtype = cpu_register_io_memory(0, omap_inth_readfn,
-                    omap_inth_writefn, s);
-    cpu_register_physical_memory(s->base, size, iomemtype);
-
-    return s;
-}
-
-static uint32_t omap2_inth_read(void *opaque, target_phys_addr_t addr)
-{
-    struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int offset = addr - s->base;
-    int bank_no, line_no;
-    struct omap_intr_handler_bank_s *bank = 0;
-
-    if ((offset & 0xf80) == 0x80) {
-        bank_no = (offset & 0x60) >> 5;
-        if (bank_no < s->nbanks) {
-            offset &= ~0x60;
-            bank = &s->bank[bank_no];
-        }
-    }
-
-    switch (offset) {
-    case 0x00: /* INTC_REVISION */
-        return 0x21;
-
-    case 0x10: /* INTC_SYSCONFIG */
-        return (s->autoidle >> 2) & 1;
-
-    case 0x14: /* INTC_SYSSTATUS */
-        return 1;                                              /* RESETDONE */
-
-    case 0x40: /* INTC_SIR_IRQ */
-        return s->sir_intr[0];
-
-    case 0x44: /* INTC_SIR_FIQ */
-        return s->sir_intr[1];
-
-    case 0x48: /* INTC_CONTROL */
-        return (!s->mask) << 2;                                        /* GLOBALMASK */
-
-    case 0x4c: /* INTC_PROTECTION */
-        return 0;
-
-    case 0x50: /* INTC_IDLE */
-        return s->autoidle & 3;
-
-    /* Per-bank registers */
-    case 0x80: /* INTC_ITR */
-        return bank->inputs;
-
-    case 0x84: /* INTC_MIR */
-        return bank->mask;
-
-    case 0x88: /* INTC_MIR_CLEAR */
-    case 0x8c: /* INTC_MIR_SET */
-        return 0;
-
-    case 0x90: /* INTC_ISR_SET */
-        return bank->swi;
-
-    case 0x94: /* INTC_ISR_CLEAR */
-        return 0;
-
-    case 0x98: /* INTC_PENDING_IRQ */
-        return bank->irqs & ~bank->mask & ~bank->fiq;
-
-    case 0x9c: /* INTC_PENDING_FIQ */
-        return bank->irqs & ~bank->mask & bank->fiq;
-
-    /* Per-line registers */
-    case 0x100 ... 0x300:      /* INTC_ILR */
-        bank_no = (offset - 0x100) >> 7;
-        if (bank_no > s->nbanks)
-            break;
-        bank = &s->bank[bank_no];
-        line_no = (offset & 0x7f) >> 2;
-        return (bank->priority[line_no] << 2) |
-                ((bank->fiq >> line_no) & 1);
-    }
-    OMAP_BAD_REG(addr);
-    return 0;
-}
-
-static void omap2_inth_write(void *opaque, target_phys_addr_t addr,
-                uint32_t value)
-{
-    struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int offset = addr - s->base;
-    int bank_no, line_no;
-    struct omap_intr_handler_bank_s *bank = 0;
-
-    if ((offset & 0xf80) == 0x80) {
-        bank_no = (offset & 0x60) >> 5;
-        if (bank_no < s->nbanks) {
-            offset &= ~0x60;
-            bank = &s->bank[bank_no];
-        }
-    }
-
-    switch (offset) {
-    case 0x10: /* INTC_SYSCONFIG */
-        s->autoidle &= 4;
-        s->autoidle |= (value & 1) << 2;
-        if (value & 2)                                         /* SOFTRESET */
-            omap_inth_reset(s);
-        return;
-
-    case 0x48: /* INTC_CONTROL */
-        s->mask = (value & 4) ? 0 : ~0;                                /* GLOBALMASK */
-        if (value & 2) {                                       /* NEWFIQAGR */
-            qemu_set_irq(s->parent_intr[1], 0);
-            s->new_agr[1] = ~0;
-            omap_inth_update(s, 1);
-        }
-        if (value & 1) {                                       /* NEWIRQAGR */
-            qemu_set_irq(s->parent_intr[0], 0);
-            s->new_agr[0] = ~0;
-            omap_inth_update(s, 0);
-        }
-        return;
-
-    case 0x4c: /* INTC_PROTECTION */
-        /* TODO: Make a bitmap (or sizeof(char)map) of access privileges
-         * for every register, see Chapter 3 and 4 for privileged mode.  */
-        if (value & 1)
-            fprintf(stderr, "%s: protection mode enable attempt\n",
-                            __FUNCTION__);
-        return;
-
-    case 0x50: /* INTC_IDLE */
-        s->autoidle &= ~3;
-        s->autoidle |= value & 3;
-        return;
-
-    /* Per-bank registers */
-    case 0x84: /* INTC_MIR */
-        bank->mask = value;
-        omap_inth_update(s, 0);
-        omap_inth_update(s, 1);
-        return;
-
-    case 0x88: /* INTC_MIR_CLEAR */
-        bank->mask &= ~value;
-        omap_inth_update(s, 0);
-        omap_inth_update(s, 1);
-        return;
-
-    case 0x8c: /* INTC_MIR_SET */
-        bank->mask |= value;
-        return;
-
-    case 0x90: /* INTC_ISR_SET */
-        bank->irqs |= bank->swi |= value;
-        omap_inth_update(s, 0);
-        omap_inth_update(s, 1);
-        return;
-
-    case 0x94: /* INTC_ISR_CLEAR */
-        bank->swi &= ~value;
-        bank->irqs = bank->swi & bank->inputs;
-        return;
-
-    /* Per-line registers */
-    case 0x100 ... 0x300:      /* INTC_ILR */
-        bank_no = (offset - 0x100) >> 7;
-        if (bank_no > s->nbanks)
-            break;
-        bank = &s->bank[bank_no];
-        line_no = (offset & 0x7f) >> 2;
-        bank->priority[line_no] = (value >> 2) & 0x3f;
-        bank->fiq &= ~(1 << line_no);
-        bank->fiq |= (value & 1) << line_no;
-        return;
-
-    case 0x00: /* INTC_REVISION */
-    case 0x14: /* INTC_SYSSTATUS */
-    case 0x40: /* INTC_SIR_IRQ */
-    case 0x44: /* INTC_SIR_FIQ */
-    case 0x80: /* INTC_ITR */
-    case 0x98: /* INTC_PENDING_IRQ */
-    case 0x9c: /* INTC_PENDING_FIQ */
-        OMAP_RO_REG(addr);
-        return;
-    }
-    OMAP_BAD_REG(addr);
-}
-
-static CPUReadMemoryFunc *omap2_inth_readfn[] = {
-    omap_badwidth_read32,
-    omap_badwidth_read32,
-    omap2_inth_read,
-};
-
-static CPUWriteMemoryFunc *omap2_inth_writefn[] = {
-    omap2_inth_write,
-    omap2_inth_write,
-    omap2_inth_write,
-};
-
-struct omap_intr_handler_s *omap2_inth_init(target_phys_addr_t base,
-                int size, int nbanks, qemu_irq **pins,
-                qemu_irq parent_irq, qemu_irq parent_fiq,
-                omap_clk fclk, omap_clk iclk)
-{
-    int iomemtype;
-    struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
-                            sizeof(struct omap_intr_handler_bank_s) * nbanks);
-
-    s->parent_intr[0] = parent_irq;
-    s->parent_intr[1] = parent_fiq;
-    s->base = base;
-    s->nbanks = nbanks;
-    s->level_only = 1;
-    s->pins = qemu_allocate_irqs(omap_set_intr_noedge, s, nbanks * 32);
-    if (pins)
-        *pins = s->pins;
-
-    omap_inth_reset(s);
-
-    iomemtype = cpu_register_io_memory(0, omap2_inth_readfn,
-                    omap2_inth_writefn, s);
-    cpu_register_physical_memory(s->base, size, iomemtype);
-
-    return s;
-}
-
 /* MPU OS timers */
 struct omap_mpu_timer_s {
     qemu_irq irq;
     omap_clk clk;
-    target_phys_addr_t base;
     uint32_t val;
     int64_t time;
     QEMUTimer *timer;
@@ -677,11 +102,11 @@ struct omap_mpu_timer_s {
 
 static inline uint32_t omap_timer_read(struct omap_mpu_timer_s *timer)
 {
-    uint64_t distance = qemu_get_clock(vm_clock) - timer->time;
+    uint64_t distance = qemu_get_clock_ns(vm_clock) - timer->time;
 
     if (timer->st && timer->enable && timer->rate)
         return timer->val - muldiv64(distance >> (timer->ptv + 1),
-                        timer->rate, ticks_per_sec);
+                                     timer->rate, get_ticks_per_sec());
     else
         return timer->val;
 }
@@ -689,7 +114,7 @@ static inline uint32_t omap_timer_read(struct omap_mpu_timer_s *timer)
 static inline void omap_timer_sync(struct omap_mpu_timer_s *timer)
 {
     timer->val = omap_timer_read(timer);
-    timer->time = qemu_get_clock(vm_clock);
+    timer->time = qemu_get_clock_ns(vm_clock);
 }
 
 static inline void omap_timer_update(struct omap_mpu_timer_s *timer)
@@ -699,7 +124,7 @@ static inline void omap_timer_update(struct omap_mpu_timer_s *timer)
     if (timer->enable && timer->st && timer->rate) {
         timer->val = timer->reset_val; /* Should skip this on clk enable */
         expires = muldiv64((uint64_t) timer->val << (timer->ptv + 1),
-                        ticks_per_sec, timer->rate);
+                           get_ticks_per_sec(), timer->rate);
 
         /* If timer expiry would be sooner than in about 1 ms and
          * auto-reload isn't set, then fire immediately.  This is a hack
@@ -707,7 +132,7 @@ static inline void omap_timer_update(struct omap_mpu_timer_s *timer)
          * sets the interval to a very low value and polls the status bit
          * in a busy loop when it wants to sleep just a couple of CPU
          * ticks.  */
-        if (expires > (ticks_per_sec >> 10) || timer->ar)
+        if (expires > (get_ticks_per_sec() >> 10) || timer->ar)
             qemu_mod_timer(timer->timer, timer->time + expires);
         else
             qemu_bh_schedule(timer->tick);
@@ -757,9 +182,8 @@ static void omap_timer_clk_setup(struct omap_mpu_timer_s *timer)
 static uint32_t omap_mpu_timer_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* CNTL_TIMER */
         return (s->enable << 5) | (s->ptv << 2) | (s->ar << 1) | s->st;
 
@@ -778,9 +202,8 @@ static void omap_mpu_timer_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* CNTL_TIMER */
         omap_timer_sync(s);
         s->enable = (value >> 5) & 1;
@@ -803,13 +226,13 @@ static void omap_mpu_timer_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_mpu_timer_readfn[] = {
+static CPUReadMemoryFunc * const omap_mpu_timer_readfn[] = {
     omap_badwidth_read32,
     omap_badwidth_read32,
     omap_mpu_timer_read,
 };
 
-static CPUWriteMemoryFunc *omap_mpu_timer_writefn[] = {
+static CPUWriteMemoryFunc * const omap_mpu_timer_writefn[] = {
     omap_badwidth_write32,
     omap_badwidth_write32,
     omap_mpu_timer_write,
@@ -827,24 +250,23 @@ static void omap_mpu_timer_reset(struct omap_mpu_timer_s *s)
     s->it_ena = 1;
 }
 
-struct omap_mpu_timer_s *omap_mpu_timer_init(target_phys_addr_t base,
+static struct omap_mpu_timer_s *omap_mpu_timer_init(target_phys_addr_t base,
                 qemu_irq irq, omap_clk clk)
 {
     int iomemtype;
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_timer_s));
+            g_malloc0(sizeof(struct omap_mpu_timer_s));
 
     s->irq = irq;
     s->clk = clk;
-    s->base = base;
-    s->timer = qemu_new_timer(vm_clock, omap_timer_tick, s);
+    s->timer = qemu_new_timer_ns(vm_clock, omap_timer_tick, s);
     s->tick = qemu_bh_new(omap_timer_fire, s);
     omap_mpu_timer_reset(s);
     omap_timer_clk_setup(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_mpu_timer_readfn,
-                    omap_mpu_timer_writefn, s);
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_mpu_timer_readfn,
+                    omap_mpu_timer_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     return s;
 }
@@ -861,9 +283,8 @@ struct omap_watchdog_timer_s {
 static uint32_t omap_wd_timer_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *) opaque;
-    int offset = addr - s->timer.base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* CNTL_TIMER */
         return (s->timer.ptv << 9) | (s->timer.ar << 8) |
                 (s->timer.st << 7) | (s->free << 1);
@@ -883,9 +304,8 @@ static void omap_wd_timer_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *) opaque;
-    int offset = addr - s->timer.base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* CNTL_TIMER */
         omap_timer_sync(&s->timer);
         s->timer.ptv = (value >> 9) & 7;
@@ -924,13 +344,13 @@ static void omap_wd_timer_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_wd_timer_readfn[] = {
+static CPUReadMemoryFunc * const omap_wd_timer_readfn[] = {
     omap_badwidth_read16,
     omap_wd_timer_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_wd_timer_writefn[] = {
+static CPUWriteMemoryFunc * const omap_wd_timer_writefn[] = {
     omap_badwidth_write16,
     omap_wd_timer_write,
     omap_badwidth_write16,
@@ -954,23 +374,22 @@ static void omap_wd_timer_reset(struct omap_watchdog_timer_s *s)
     omap_timer_update(&s->timer);
 }
 
-struct omap_watchdog_timer_s *omap_wd_timer_init(target_phys_addr_t base,
+static struct omap_watchdog_timer_s *omap_wd_timer_init(target_phys_addr_t base,
                 qemu_irq irq, omap_clk clk)
 {
     int iomemtype;
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *)
-            qemu_mallocz(sizeof(struct omap_watchdog_timer_s));
+            g_malloc0(sizeof(struct omap_watchdog_timer_s));
 
     s->timer.irq = irq;
     s->timer.clk = clk;
-    s->timer.base = base;
-    s->timer.timer = qemu_new_timer(vm_clock, omap_timer_tick, &s->timer);
+    s->timer.timer = qemu_new_timer_ns(vm_clock, omap_timer_tick, &s->timer);
     omap_wd_timer_reset(s);
     omap_timer_clk_setup(&s->timer);
 
-    iomemtype = cpu_register_io_memory(0, omap_wd_timer_readfn,
-                    omap_wd_timer_writefn, s);
-    cpu_register_physical_memory(s->timer.base, 0x100, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_wd_timer_readfn,
+                    omap_wd_timer_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     return s;
 }
@@ -1033,13 +452,13 @@ static void omap_os_timer_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_os_timer_readfn[] = {
+static CPUReadMemoryFunc * const omap_os_timer_readfn[] = {
     omap_badwidth_read32,
     omap_badwidth_read32,
     omap_os_timer_read,
 };
 
-static CPUWriteMemoryFunc *omap_os_timer_writefn[] = {
+static CPUWriteMemoryFunc * const omap_os_timer_writefn[] = {
     omap_badwidth_write32,
     omap_badwidth_write32,
     omap_os_timer_write,
@@ -1057,23 +476,22 @@ static void omap_os_timer_reset(struct omap_32khz_timer_s *s)
     s->timer.ar = 1;
 }
 
-struct omap_32khz_timer_s *omap_os_timer_init(target_phys_addr_t base,
+static struct omap_32khz_timer_s *omap_os_timer_init(target_phys_addr_t base,
                 qemu_irq irq, omap_clk clk)
 {
     int iomemtype;
     struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *)
-            qemu_mallocz(sizeof(struct omap_32khz_timer_s));
+            g_malloc0(sizeof(struct omap_32khz_timer_s));
 
     s->timer.irq = irq;
     s->timer.clk = clk;
-    s->timer.base = base;
-    s->timer.timer = qemu_new_timer(vm_clock, omap_timer_tick, &s->timer);
+    s->timer.timer = qemu_new_timer_ns(vm_clock, omap_timer_tick, &s->timer);
     omap_os_timer_reset(s);
     omap_timer_clk_setup(&s->timer);
 
-    iomemtype = cpu_register_io_memory(0, omap_os_timer_readfn,
-                    omap_os_timer_writefn, s);
-    cpu_register_physical_memory(s->timer.base, 0x800, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_os_timer_readfn,
+                    omap_os_timer_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
@@ -1082,13 +500,12 @@ struct omap_32khz_timer_s *omap_os_timer_init(target_phys_addr_t base,
 static uint32_t omap_ulpd_pm_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->ulpd_pm_base;
     uint16_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x14: /* IT_STATUS */
-        ret = s->ulpd_pm_regs[offset >> 2];
-        s->ulpd_pm_regs[offset >> 2] = 0;
+        ret = s->ulpd_pm_regs[addr >> 2];
+        s->ulpd_pm_regs[addr >> 2] = 0;
         qemu_irq_lower(s->irq[1][OMAP_INT_GAUGE_32K]);
         return ret;
 
@@ -1113,7 +530,7 @@ static uint32_t omap_ulpd_pm_read(void *opaque, target_phys_addr_t addr)
     case 0x48: /* LOCL_TIME */
     case 0x4c: /* APLL_CTRL */
     case 0x50: /* POWER_CTRL */
-        return s->ulpd_pm_regs[offset >> 2];
+        return s->ulpd_pm_regs[addr >> 2];
     }
 
     OMAP_BAD_REG(addr);
@@ -1146,13 +563,12 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->ulpd_pm_base;
     int64_t now, ticks;
     int div, mult;
     static const int bypass_div[4] = { 1, 2, 4, 4 };
     uint16_t diff;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* COUNTER_32_LSB */
     case 0x04: /* COUNTER_32_MSB */
     case 0x08: /* COUNTER_HIGH_FREQ_LSB */
@@ -1164,8 +580,8 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
 
     case 0x10: /* GAUGING_CTRL */
         /* Bits 0 and 1 seem to be confused in the OMAP 310 TRM */
-        if ((s->ulpd_pm_regs[offset >> 2] ^ value) & 1) {
-            now = qemu_get_clock(vm_clock);
+        if ((s->ulpd_pm_regs[addr >> 2] ^ value) & 1) {
+            now = qemu_get_clock_ns(vm_clock);
 
             if (value & 1)
                 s->ulpd_gauge_start = now;
@@ -1173,14 +589,14 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
                 now -= s->ulpd_gauge_start;
 
                 /* 32-kHz ticks */
-                ticks = muldiv64(now, 32768, ticks_per_sec);
+                ticks = muldiv64(now, 32768, get_ticks_per_sec());
                 s->ulpd_pm_regs[0x00 >> 2] = (ticks >>  0) & 0xffff;
                 s->ulpd_pm_regs[0x04 >> 2] = (ticks >> 16) & 0xffff;
                 if (ticks >> 32)       /* OVERFLOW_32K */
                     s->ulpd_pm_regs[0x14 >> 2] |= 1 << 2;
 
                 /* High frequency ticks */
-                ticks = muldiv64(now, 12000000, ticks_per_sec);
+                ticks = muldiv64(now, 12000000, get_ticks_per_sec());
                 s->ulpd_pm_regs[0x08 >> 2] = (ticks >>  0) & 0xffff;
                 s->ulpd_pm_regs[0x0c >> 2] = (ticks >> 16) & 0xffff;
                 if (ticks >> 32)       /* OVERFLOW_HI_FREQ */
@@ -1190,7 +606,7 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
                 qemu_irq_raise(s->irq[1][OMAP_INT_GAUGE_32K]);
             }
         }
-        s->ulpd_pm_regs[offset >> 2] = value;
+        s->ulpd_pm_regs[addr >> 2] = value;
         break;
 
     case 0x18: /* Reserved */
@@ -1203,18 +619,18 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
     case 0x38: /* COUNTER_32_FIQ */
     case 0x48: /* LOCL_TIME */
     case 0x50: /* POWER_CTRL */
-        s->ulpd_pm_regs[offset >> 2] = value;
+        s->ulpd_pm_regs[addr >> 2] = value;
         break;
 
     case 0x30: /* CLOCK_CTRL */
-        diff = s->ulpd_pm_regs[offset >> 2] ^ value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0x3f;
+        diff = s->ulpd_pm_regs[addr >> 2] ^ value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0x3f;
         omap_ulpd_clk_update(s, diff, value);
         break;
 
     case 0x34: /* SOFT_REQ */
-        diff = s->ulpd_pm_regs[offset >> 2] ^ value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0x1f;
+        diff = s->ulpd_pm_regs[addr >> 2] ^ value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0x1f;
         omap_ulpd_req_update(s, diff, value);
         break;
 
@@ -1223,8 +639,8 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
          * omitted altogether, probably a typo.  */
         /* This register has identical semantics with DPLL(1:3) control
          * registers, see omap_dpll_write() */
-        diff = s->ulpd_pm_regs[offset >> 2] & value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0x2fff;
+        diff = s->ulpd_pm_regs[addr >> 2] & value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0x2fff;
         if (diff & (0x3ff << 2)) {
             if (value & (1 << 4)) {                    /* PLL_ENABLE */
                 div = ((value >> 5) & 3) + 1;          /* PLL_DIV */
@@ -1237,17 +653,17 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
         }
 
         /* Enter the desired mode.  */
-        s->ulpd_pm_regs[offset >> 2] =
-                (s->ulpd_pm_regs[offset >> 2] & 0xfffe) |
-                ((s->ulpd_pm_regs[offset >> 2] >> 4) & 1);
+        s->ulpd_pm_regs[addr >> 2] =
+                (s->ulpd_pm_regs[addr >> 2] & 0xfffe) |
+                ((s->ulpd_pm_regs[addr >> 2] >> 4) & 1);
 
         /* Act as if the lock is restored.  */
-        s->ulpd_pm_regs[offset >> 2] |= 2;
+        s->ulpd_pm_regs[addr >> 2] |= 2;
         break;
 
     case 0x4c: /* APLL_CTRL */
-        diff = s->ulpd_pm_regs[offset >> 2] & value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0xf;
+        diff = s->ulpd_pm_regs[addr >> 2] & value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0xf;
         if (diff & (1 << 0))                           /* APLL_NDPLL_SWITCH */
             omap_clk_reparent(omap_findclk(s, "ck_48m"), omap_findclk(s,
                                     (value & (1 << 0)) ? "apll" : "dpll4"));
@@ -1258,13 +674,13 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_ulpd_pm_readfn[] = {
+static CPUReadMemoryFunc * const omap_ulpd_pm_readfn[] = {
     omap_badwidth_read16,
     omap_ulpd_pm_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_ulpd_pm_writefn[] = {
+static CPUWriteMemoryFunc * const omap_ulpd_pm_writefn[] = {
     omap_badwidth_write16,
     omap_ulpd_pm_write,
     omap_badwidth_write16,
@@ -1300,11 +716,10 @@ static void omap_ulpd_pm_reset(struct omap_mpu_state_s *mpu)
 static void omap_ulpd_pm_init(target_phys_addr_t base,
                 struct omap_mpu_state_s *mpu)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_ulpd_pm_readfn,
-                    omap_ulpd_pm_writefn, mpu);
+    int iomemtype = cpu_register_io_memory(omap_ulpd_pm_readfn,
+                    omap_ulpd_pm_writefn, mpu, DEVICE_NATIVE_ENDIAN);
 
-    mpu->ulpd_pm_base = base;
-    cpu_register_physical_memory(mpu->ulpd_pm_base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
     omap_ulpd_pm_reset(mpu);
 }
 
@@ -1312,13 +727,12 @@ static void omap_ulpd_pm_init(target_phys_addr_t base,
 static uint32_t omap_pin_cfg_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->pin_cfg_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* FUNC_MUX_CTRL_0 */
     case 0x04: /* FUNC_MUX_CTRL_1 */
     case 0x08: /* FUNC_MUX_CTRL_2 */
-        return s->func_mux_ctrl[offset >> 2];
+        return s->func_mux_ctrl[addr >> 2];
 
     case 0x0c: /* COMP_MODE_CTRL_0 */
         return s->comp_mode_ctrl[0];
@@ -1334,13 +748,13 @@ static uint32_t omap_pin_cfg_read(void *opaque, target_phys_addr_t addr)
     case 0x30: /* FUNC_MUX_CTRL_B */
     case 0x34: /* FUNC_MUX_CTRL_C */
     case 0x38: /* FUNC_MUX_CTRL_D */
-        return s->func_mux_ctrl[(offset >> 2) - 1];
+        return s->func_mux_ctrl[(addr >> 2) - 1];
 
     case 0x40: /* PULL_DWN_CTRL_0 */
     case 0x44: /* PULL_DWN_CTRL_1 */
     case 0x48: /* PULL_DWN_CTRL_2 */
     case 0x4c: /* PULL_DWN_CTRL_3 */
-        return s->pull_dwn_ctrl[(offset & 0xf) >> 2];
+        return s->pull_dwn_ctrl[(addr & 0xf) >> 2];
 
     case 0x50: /* GATE_INH_CTRL_0 */
         return s->gate_inh_ctrl[0];
@@ -1416,24 +830,23 @@ static void omap_pin_cfg_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->pin_cfg_base;
     uint32_t diff;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* FUNC_MUX_CTRL_0 */
-        diff = s->func_mux_ctrl[offset >> 2] ^ value;
-        s->func_mux_ctrl[offset >> 2] = value;
+        diff = s->func_mux_ctrl[addr >> 2] ^ value;
+        s->func_mux_ctrl[addr >> 2] = value;
         omap_pin_funcmux0_update(s, diff, value);
         return;
 
     case 0x04: /* FUNC_MUX_CTRL_1 */
-        diff = s->func_mux_ctrl[offset >> 2] ^ value;
-        s->func_mux_ctrl[offset >> 2] = value;
+        diff = s->func_mux_ctrl[addr >> 2] ^ value;
+        s->func_mux_ctrl[addr >> 2] = value;
         omap_pin_funcmux1_update(s, diff, value);
         return;
 
     case 0x08: /* FUNC_MUX_CTRL_2 */
-        s->func_mux_ctrl[offset >> 2] = value;
+        s->func_mux_ctrl[addr >> 2] = value;
         return;
 
     case 0x0c: /* COMP_MODE_CTRL_0 */
@@ -1454,14 +867,14 @@ static void omap_pin_cfg_write(void *opaque, target_phys_addr_t addr,
     case 0x30: /* FUNC_MUX_CTRL_B */
     case 0x34: /* FUNC_MUX_CTRL_C */
     case 0x38: /* FUNC_MUX_CTRL_D */
-        s->func_mux_ctrl[(offset >> 2) - 1] = value;
+        s->func_mux_ctrl[(addr >> 2) - 1] = value;
         return;
 
     case 0x40: /* PULL_DWN_CTRL_0 */
     case 0x44: /* PULL_DWN_CTRL_1 */
     case 0x48: /* PULL_DWN_CTRL_2 */
     case 0x4c: /* PULL_DWN_CTRL_3 */
-        s->pull_dwn_ctrl[(offset & 0xf) >> 2] = value;
+        s->pull_dwn_ctrl[(addr & 0xf) >> 2] = value;
         return;
 
     case 0x50: /* GATE_INH_CTRL_0 */
@@ -1487,13 +900,13 @@ static void omap_pin_cfg_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_pin_cfg_readfn[] = {
+static CPUReadMemoryFunc * const omap_pin_cfg_readfn[] = {
     omap_badwidth_read32,
     omap_badwidth_read32,
     omap_pin_cfg_read,
 };
 
-static CPUWriteMemoryFunc *omap_pin_cfg_writefn[] = {
+static CPUWriteMemoryFunc * const omap_pin_cfg_writefn[] = {
     omap_badwidth_write32,
     omap_badwidth_write32,
     omap_pin_cfg_write,
@@ -1518,11 +931,10 @@ static void omap_pin_cfg_reset(struct omap_mpu_state_s *mpu)
 static void omap_pin_cfg_init(target_phys_addr_t base,
                 struct omap_mpu_state_s *mpu)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_pin_cfg_readfn,
-                    omap_pin_cfg_writefn, mpu);
+    int iomemtype = cpu_register_io_memory(omap_pin_cfg_readfn,
+                    omap_pin_cfg_writefn, mpu, DEVICE_NATIVE_ENDIAN);
 
-    mpu->pin_cfg_base = base;
-    cpu_register_physical_memory(mpu->pin_cfg_base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
     omap_pin_cfg_reset(mpu);
 }
 
@@ -1549,7 +961,7 @@ static uint32_t omap_id_read(void *opaque, target_phys_addr_t addr)
         case omap1510:
             return 0x03310115;
         default:
-            cpu_abort(cpu_single_env, "%s: bad mpu model\n", __FUNCTION__);
+            hw_error("%s: bad mpu model\n", __FUNCTION__);
         }
         break;
 
@@ -1560,7 +972,7 @@ static uint32_t omap_id_read(void *opaque, target_phys_addr_t addr)
         case omap1510:
             return 0xfb47002f;
         default:
-            cpu_abort(cpu_single_env, "%s: bad mpu model\n", __FUNCTION__);
+            hw_error("%s: bad mpu model\n", __FUNCTION__);
         }
         break;
     }
@@ -1575,13 +987,13 @@ static void omap_id_write(void *opaque, target_phys_addr_t addr,
     OMAP_BAD_REG(addr);
 }
 
-static CPUReadMemoryFunc *omap_id_readfn[] = {
+static CPUReadMemoryFunc * const omap_id_readfn[] = {
     omap_badwidth_read32,
     omap_badwidth_read32,
     omap_id_read,
 };
 
-static CPUWriteMemoryFunc *omap_id_writefn[] = {
+static CPUWriteMemoryFunc * const omap_id_writefn[] = {
     omap_badwidth_write32,
     omap_badwidth_write32,
     omap_id_write,
@@ -1589,21 +1001,20 @@ static CPUWriteMemoryFunc *omap_id_writefn[] = {
 
 static void omap_id_init(struct omap_mpu_state_s *mpu)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_id_readfn,
-                    omap_id_writefn, mpu);
-    cpu_register_physical_memory(0xfffe1800, 0x800, iomemtype);
-    cpu_register_physical_memory(0xfffed400, 0x100, iomemtype);
+    int iomemtype = cpu_register_io_memory(omap_id_readfn,
+                    omap_id_writefn, mpu, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory_offset(0xfffe1800, 0x800, iomemtype, 0xfffe1800);
+    cpu_register_physical_memory_offset(0xfffed400, 0x100, iomemtype, 0xfffed400);
     if (!cpu_is_omap15xx(mpu))
-        cpu_register_physical_memory(0xfffe2000, 0x800, iomemtype);
+        cpu_register_physical_memory_offset(0xfffe2000, 0x800, iomemtype, 0xfffe2000);
 }
 
 /* MPUI Control (Dummy) */
 static uint32_t omap_mpui_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->mpui_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* CTRL */
         return s->mpui_ctrl;
     case 0x04: /* DEBUG_ADDR */
@@ -1631,9 +1042,8 @@ static void omap_mpui_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->mpui_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* CTRL */
         s->mpui_ctrl = value & 0x007fffff;
         break;
@@ -1654,13 +1064,13 @@ static void omap_mpui_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_mpui_readfn[] = {
+static CPUReadMemoryFunc * const omap_mpui_readfn[] = {
     omap_badwidth_read32,
     omap_badwidth_read32,
     omap_mpui_read,
 };
 
-static CPUWriteMemoryFunc *omap_mpui_writefn[] = {
+static CPUWriteMemoryFunc * const omap_mpui_writefn[] = {
     omap_badwidth_write32,
     omap_badwidth_write32,
     omap_mpui_write,
@@ -1674,18 +1084,16 @@ static void omap_mpui_reset(struct omap_mpu_state_s *s)
 static void omap_mpui_init(target_phys_addr_t base,
                 struct omap_mpu_state_s *mpu)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_mpui_readfn,
-                    omap_mpui_writefn, mpu);
+    int iomemtype = cpu_register_io_memory(omap_mpui_readfn,
+                    omap_mpui_writefn, mpu, DEVICE_NATIVE_ENDIAN);
 
-    mpu->mpui_base = base;
-    cpu_register_physical_memory(mpu->mpui_base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     omap_mpui_reset(mpu);
 }
 
 /* TIPB Bridges */
 struct omap_tipb_bridge_s {
-    target_phys_addr_t base;
     qemu_irq abort;
 
     int width_intr;
@@ -1698,9 +1106,8 @@ struct omap_tipb_bridge_s {
 static uint32_t omap_tipb_bridge_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* TIPB_CNTL */
         return s->control;
     case 0x04: /* TIPB_BUS_ALLOC */
@@ -1725,9 +1132,8 @@ static void omap_tipb_bridge_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* TIPB_CNTL */
         s->control = value & 0xffff;
         break;
@@ -1757,13 +1163,13 @@ static void omap_tipb_bridge_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_tipb_bridge_readfn[] = {
+static CPUReadMemoryFunc * const omap_tipb_bridge_readfn[] = {
     omap_badwidth_read16,
     omap_tipb_bridge_read,
     omap_tipb_bridge_read,
 };
 
-static CPUWriteMemoryFunc *omap_tipb_bridge_writefn[] = {
+static CPUWriteMemoryFunc * const omap_tipb_bridge_writefn[] = {
     omap_badwidth_write16,
     omap_tipb_bridge_write,
     omap_tipb_bridge_write,
@@ -1777,20 +1183,19 @@ static void omap_tipb_bridge_reset(struct omap_tipb_bridge_s *s)
     s->enh_control = 0x000f;
 }
 
-struct omap_tipb_bridge_s *omap_tipb_bridge_init(target_phys_addr_t base,
+static struct omap_tipb_bridge_s *omap_tipb_bridge_init(target_phys_addr_t base,
                 qemu_irq abort_irq, omap_clk clk)
 {
     int iomemtype;
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *)
-            qemu_mallocz(sizeof(struct omap_tipb_bridge_s));
+            g_malloc0(sizeof(struct omap_tipb_bridge_s));
 
     s->abort = abort_irq;
-    s->base = base;
     omap_tipb_bridge_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_tipb_bridge_readfn,
-                    omap_tipb_bridge_writefn, s);
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_tipb_bridge_readfn,
+                    omap_tipb_bridge_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     return s;
 }
@@ -1799,10 +1204,9 @@ struct omap_tipb_bridge_s *omap_tipb_bridge_init(target_phys_addr_t base,
 static uint32_t omap_tcmi_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->tcmi_base;
     uint32_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* IMIF_PRIO */
     case 0x04: /* EMIFS_PRIO */
     case 0x08: /* EMIFF_PRIO */
@@ -1817,11 +1221,11 @@ static uint32_t omap_tcmi_read(void *opaque, target_phys_addr_t addr)
     case 0x30: /* TIMEOUT3 */
     case 0x3c: /* EMIFF_SDRAM_CONFIG_2 */
     case 0x40: /* EMIFS_CFG_DYN_WAIT */
-        return s->tcmi_regs[offset >> 2];
+        return s->tcmi_regs[addr >> 2];
 
     case 0x20: /* EMIFF_SDRAM_CONFIG */
-        ret = s->tcmi_regs[offset >> 2];
-        s->tcmi_regs[offset >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */
+        ret = s->tcmi_regs[addr >> 2];
+        s->tcmi_regs[addr >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */
         /* XXX: We can try using the VGA_DIRTY flag for this */
         return ret;
     }
@@ -1834,9 +1238,8 @@ static void omap_tcmi_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->tcmi_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* IMIF_PRIO */
     case 0x04: /* EMIFS_PRIO */
     case 0x08: /* EMIFF_PRIO */
@@ -1851,10 +1254,10 @@ static void omap_tcmi_write(void *opaque, target_phys_addr_t addr,
     case 0x30: /* TIMEOUT3 */
     case 0x3c: /* EMIFF_SDRAM_CONFIG_2 */
     case 0x40: /* EMIFS_CFG_DYN_WAIT */
-        s->tcmi_regs[offset >> 2] = value;
+        s->tcmi_regs[addr >> 2] = value;
         break;
     case 0x0c: /* EMIFS_CONFIG */
-        s->tcmi_regs[offset >> 2] = (value & 0xf) | (1 << 4);
+        s->tcmi_regs[addr >> 2] = (value & 0xf) | (1 << 4);
         break;
 
     default:
@@ -1862,13 +1265,13 @@ static void omap_tcmi_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_tcmi_readfn[] = {
+static CPUReadMemoryFunc * const omap_tcmi_readfn[] = {
     omap_badwidth_read32,
     omap_badwidth_read32,
     omap_tcmi_read,
 };
 
-static CPUWriteMemoryFunc *omap_tcmi_writefn[] = {
+static CPUWriteMemoryFunc * const omap_tcmi_writefn[] = {
     omap_badwidth_write32,
     omap_badwidth_write32,
     omap_tcmi_write,
@@ -1896,11 +1299,10 @@ static void omap_tcmi_reset(struct omap_mpu_state_s *mpu)
 static void omap_tcmi_init(target_phys_addr_t base,
                 struct omap_mpu_state_s *mpu)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_tcmi_readfn,
-                    omap_tcmi_writefn, mpu);
+    int iomemtype = cpu_register_io_memory(omap_tcmi_readfn,
+                    omap_tcmi_writefn, mpu, DEVICE_NATIVE_ENDIAN);
 
-    mpu->tcmi_base = base;
-    cpu_register_physical_memory(mpu->tcmi_base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
     omap_tcmi_reset(mpu);
 }
 
@@ -1908,9 +1310,8 @@ static void omap_tcmi_init(target_phys_addr_t base,
 static uint32_t omap_dpll_read(void *opaque, target_phys_addr_t addr)
 {
     struct dpll_ctl_s *s = (struct dpll_ctl_s *) opaque;
-    int offset = addr - s->base;
 
-    if (offset == 0x00)        /* CTL_REG */
+    if (addr == 0x00)  /* CTL_REG */
         return s->mode;
 
     OMAP_BAD_REG(addr);
@@ -1922,11 +1323,10 @@ static void omap_dpll_write(void *opaque, target_phys_addr_t addr,
 {
     struct dpll_ctl_s *s = (struct dpll_ctl_s *) opaque;
     uint16_t diff;
-    int offset = addr - s->base;
     static const int bypass_div[4] = { 1, 2, 4, 4 };
     int div, mult;
 
-    if (offset == 0x00) {      /* CTL_REG */
+    if (addr == 0x00) {        /* CTL_REG */
         /* See omap_ulpd_pm_write() too */
         diff = s->mode & value;
         s->mode = value & 0x2fff;
@@ -1951,13 +1351,13 @@ static void omap_dpll_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_dpll_readfn[] = {
+static CPUReadMemoryFunc * const omap_dpll_readfn[] = {
     omap_badwidth_read16,
     omap_dpll_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_dpll_writefn[] = {
+static CPUWriteMemoryFunc * const omap_dpll_writefn[] = {
     omap_badwidth_write16,
     omap_dpll_write,
     omap_badwidth_write16,
@@ -1972,172 +1372,21 @@ static void omap_dpll_reset(struct dpll_ctl_s *s)
 static void omap_dpll_init(struct dpll_ctl_s *s, target_phys_addr_t base,
                 omap_clk clk)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_dpll_readfn,
-                    omap_dpll_writefn, s);
+    int iomemtype = cpu_register_io_memory(omap_dpll_readfn,
+                    omap_dpll_writefn, s, DEVICE_NATIVE_ENDIAN);
 
-    s->base = base;
     s->dpll = clk;
     omap_dpll_reset(s);
 
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
-}
-
-/* UARTs */
-struct omap_uart_s {
-    SerialState *serial; /* TODO */
-    struct omap_target_agent_s *ta;
-    target_phys_addr_t base;
-    omap_clk fclk;
-    qemu_irq irq;
-
-    uint8_t eblr;
-    uint8_t syscontrol;
-    uint8_t wkup;
-    uint8_t cfps;
-    uint8_t mdr[2];
-    uint8_t scr;
-};
-
-void omap_uart_reset(struct omap_uart_s *s)
-{
-    s->eblr = 0x00;
-    s->syscontrol = 0;
-    s->wkup = 0x3f;
-    s->cfps = 0x69;
-}
-
-struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
-                qemu_irq irq, omap_clk fclk, omap_clk iclk,
-                qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr)
-{
-    struct omap_uart_s *s = (struct omap_uart_s *)
-            qemu_mallocz(sizeof(struct omap_uart_s));
-
-    s->base = base;
-    s->fclk = fclk;
-    s->irq = irq;
-    s->serial = serial_mm_init(base, 2, irq, omap_clk_getrate(fclk)/16,
-                               chr ?: qemu_chr_open("null"), 1);
-
-    return s;
-}
-
-static uint32_t omap_uart_read(void *opaque, target_phys_addr_t addr)
-{
-    struct omap_uart_s *s = (struct omap_uart_s *) opaque;
-    int offset = addr - s->base;
-
-    switch (offset) {
-    case 0x20: /* MDR1 */
-        return s->mdr[0];
-    case 0x24: /* MDR2 */
-        return s->mdr[1];
-    case 0x40: /* SCR */
-        return s->scr;
-    case 0x44: /* SSR */
-        return 0x0;
-    case 0x48: /* EBLR */
-        return s->eblr;
-    case 0x50: /* MVR */
-        return 0x30;
-    case 0x54: /* SYSC */
-        return s->syscontrol;
-    case 0x58: /* SYSS */
-        return 1;
-    case 0x5c: /* WER */
-        return s->wkup;
-    case 0x60: /* CFPS */
-        return s->cfps;
-    }
-
-    OMAP_BAD_REG(addr);
-    return 0;
-}
-
-static void omap_uart_write(void *opaque, target_phys_addr_t addr,
-                uint32_t value)
-{
-    struct omap_uart_s *s = (struct omap_uart_s *) opaque;
-    int offset = addr - s->base;
-
-    switch (offset) {
-    case 0x20: /* MDR1 */
-        s->mdr[0] = value & 0x7f;
-        break;
-    case 0x24: /* MDR2 */
-        s->mdr[1] = value & 0xff;
-        break;
-    case 0x40: /* SCR */
-        s->scr = value & 0xff;
-        break;
-    case 0x48: /* EBLR */
-        s->eblr = value & 0xff;
-        break;
-    case 0x44: /* SSR */
-    case 0x50: /* MVR */
-    case 0x58: /* SYSS */
-        OMAP_RO_REG(addr);
-        break;
-    case 0x54: /* SYSC */
-        s->syscontrol = value & 0x1d;
-        if (value & 2)
-            omap_uart_reset(s);
-        break;
-    case 0x5c: /* WER */
-        s->wkup = value & 0x7f;
-        break;
-    case 0x60: /* CFPS */
-        s->cfps = value & 0xff;
-        break;
-    default:
-        OMAP_BAD_REG(addr);
-    }
-}
-
-static CPUReadMemoryFunc *omap_uart_readfn[] = {
-    omap_uart_read,
-    omap_uart_read,
-    omap_badwidth_read8,
-};
-
-static CPUWriteMemoryFunc *omap_uart_writefn[] = {
-    omap_uart_write,
-    omap_uart_write,
-    omap_badwidth_write8,
-};
-
-struct omap_uart_s *omap2_uart_init(struct omap_target_agent_s *ta,
-                qemu_irq irq, omap_clk fclk, omap_clk iclk,
-                qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr)
-{
-    target_phys_addr_t base = omap_l4_attach(ta, 0, 0);
-    struct omap_uart_s *s = omap_uart_init(base, irq,
-                    fclk, iclk, txdma, rxdma, chr);
-    int iomemtype = cpu_register_io_memory(0, omap_uart_readfn,
-                    omap_uart_writefn, s);
-
-    s->ta = ta;
-
-    cpu_register_physical_memory(s->base + 0x20, 0x100, iomemtype);
-
-    return s;
-}
-
-void omap_uart_attach(struct omap_uart_s *s, CharDriverState *chr)
-{
-    /* TODO: Should reuse or destroy current s->serial */
-    s->serial = serial_mm_init(s->base, 2, s->irq,
-                    omap_clk_getrate(s->fclk) / 16,
-                    chr ?: qemu_chr_open("null"), 1);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 }
 
 /* MPU Clock/Reset/Power Mode Control */
 static uint32_t omap_clkm_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.mpu_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* ARM_CKCTL */
         return s->clkm.arm_ckctl;
 
@@ -2333,7 +1582,6 @@ static void omap_clkm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.mpu_base;
     uint16_t diff;
     omap_clk clk;
     static const char *clkschemename[8] = {
@@ -2341,7 +1589,7 @@ static void omap_clkm_write(void *opaque, target_phys_addr_t addr,
         "mix mode 1", "mix mode 2", "bypass mode", "mix mode 3", "mix mode 4",
     };
 
-    switch (offset) {
+    switch (addr) {
     case 0x00: /* ARM_CKCTL */
         diff = s->clkm.arm_ckctl ^ value;
         s->clkm.arm_ckctl = value & 0x7fff;
@@ -2361,7 +1609,6 @@ static void omap_clkm_write(void *opaque, target_phys_addr_t addr,
         return;
 
     case 0x0c: /* ARM_EWUPCT */
-        diff = s->clkm.arm_ewupct ^ value;
         s->clkm.arm_ewupct = value & 0x003f;
         return;
 
@@ -2408,13 +1655,13 @@ static void omap_clkm_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_clkm_readfn[] = {
+static CPUReadMemoryFunc * const omap_clkm_readfn[] = {
     omap_badwidth_read16,
     omap_clkm_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_clkm_writefn[] = {
+static CPUWriteMemoryFunc * const omap_clkm_writefn[] = {
     omap_badwidth_write16,
     omap_clkm_write,
     omap_badwidth_write16,
@@ -2423,9 +1670,8 @@ static CPUWriteMemoryFunc *omap_clkm_writefn[] = {
 static uint32_t omap_clkdsp_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.dsp_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x04: /* DSP_IDLECT1 */
         return s->clkm.dsp_idlect1;
 
@@ -2464,10 +1710,9 @@ static void omap_clkdsp_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.dsp_base;
     uint16_t diff;
 
-    switch (offset) {
+    switch (addr) {
     case 0x04: /* DSP_IDLECT1 */
         diff = s->clkm.dsp_idlect1 ^ value;
         s->clkm.dsp_idlect1 = value & 0x01f7;
@@ -2493,13 +1738,13 @@ static void omap_clkdsp_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_clkdsp_readfn[] = {
+static CPUReadMemoryFunc * const omap_clkdsp_readfn[] = {
     omap_badwidth_read16,
     omap_clkdsp_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_clkdsp_writefn[] = {
+static CPUWriteMemoryFunc * const omap_clkdsp_writefn[] = {
     omap_badwidth_write16,
     omap_clkdsp_write,
     omap_badwidth_write16,
@@ -2532,25 +1777,24 @@ static void omap_clkm_init(target_phys_addr_t mpu_base,
                 target_phys_addr_t dsp_base, struct omap_mpu_state_s *s)
 {
     int iomemtype[2] = {
-        cpu_register_io_memory(0, omap_clkm_readfn, omap_clkm_writefn, s),
-        cpu_register_io_memory(0, omap_clkdsp_readfn, omap_clkdsp_writefn, s),
+        cpu_register_io_memory(omap_clkm_readfn, omap_clkm_writefn, s,
+                               DEVICE_NATIVE_ENDIAN),
+        cpu_register_io_memory(omap_clkdsp_readfn, omap_clkdsp_writefn, s,
+                               DEVICE_NATIVE_ENDIAN),
     };
 
-    s->clkm.mpu_base = mpu_base;
-    s->clkm.dsp_base = dsp_base;
     s->clkm.arm_idlect1 = 0x03ff;
     s->clkm.arm_idlect2 = 0x0100;
     s->clkm.dsp_idlect1 = 0x0002;
     omap_clkm_reset(s);
     s->clkm.cold_start = 0x3a;
 
-    cpu_register_physical_memory(s->clkm.mpu_base, 0x100, iomemtype[0]);
-    cpu_register_physical_memory(s->clkm.dsp_base, 0x1000, iomemtype[1]);
+    cpu_register_physical_memory(mpu_base, 0x100, iomemtype[0]);
+    cpu_register_physical_memory(dsp_base, 0x1000, iomemtype[1]);
 }
 
 /* MPU I/O */
 struct omap_mpuio_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq kbd_irq;
     qemu_irq *in;
@@ -2738,13 +1982,13 @@ static void omap_mpuio_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_mpuio_readfn[] = {
+static CPUReadMemoryFunc * const omap_mpuio_readfn[] = {
     omap_badwidth_read16,
     omap_mpuio_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_mpuio_writefn[] = {
+static CPUWriteMemoryFunc * const omap_mpuio_writefn[] = {
     omap_badwidth_write16,
     omap_mpuio_write,
     omap_badwidth_write16,
@@ -2781,18 +2025,17 @@ struct omap_mpuio_s *omap_mpuio_init(target_phys_addr_t base,
 {
     int iomemtype;
     struct omap_mpuio_s *s = (struct omap_mpuio_s *)
-            qemu_mallocz(sizeof(struct omap_mpuio_s));
+            g_malloc0(sizeof(struct omap_mpuio_s));
 
-    s->base = base;
     s->irq = gpio_int;
     s->kbd_irq = kbd_int;
     s->wakeup = wakeup;
     s->in = qemu_allocate_irqs(omap_mpuio_set, s, 16);
     omap_mpuio_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_mpuio_readfn,
-                    omap_mpuio_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_mpuio_readfn,
+                    omap_mpuio_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     omap_clk_adduser(clk, qemu_allocate_irqs(omap_mpuio_onoff, s, 1)[0]);
 
@@ -2807,15 +2050,14 @@ qemu_irq *omap_mpuio_in_get(struct omap_mpuio_s *s)
 void omap_mpuio_out_set(struct omap_mpuio_s *s, int line, qemu_irq handler)
 {
     if (line >= 16 || line < 0)
-        cpu_abort(cpu_single_env, "%s: No GPIO line %i\n", __FUNCTION__, line);
+        hw_error("%s: No GPIO line %i\n", __FUNCTION__, line);
     s->handler[line] = handler;
 }
 
 void omap_mpuio_key(struct omap_mpuio_s *s, int row, int col, int down)
 {
     if (row >= 5 || row < 0)
-        cpu_abort(cpu_single_env, "%s: No key %i-%i\n",
-                        __FUNCTION__, col, row);
+        hw_error("%s: No key %i-%i\n", __FUNCTION__, col, row);
 
     if (down)
         s->buttons[row] |= 1 << col;
@@ -2825,192 +2067,8 @@ void omap_mpuio_key(struct omap_mpuio_s *s, int row, int col, int down)
     omap_mpuio_kbd_update(s);
 }
 
-/* General-Purpose I/O */
-struct omap_gpio_s {
-    target_phys_addr_t base;
-    qemu_irq irq;
-    qemu_irq *in;
-    qemu_irq handler[16];
-
-    uint16_t inputs;
-    uint16_t outputs;
-    uint16_t dir;
-    uint16_t edge;
-    uint16_t mask;
-    uint16_t ints;
-    uint16_t pins;
-};
-
-static void omap_gpio_set(void *opaque, int line, int level)
-{
-    struct omap_gpio_s *s = (struct omap_gpio_s *) opaque;
-    uint16_t prev = s->inputs;
-
-    if (level)
-        s->inputs |= 1 << line;
-    else
-        s->inputs &= ~(1 << line);
-
-    if (((s->edge & s->inputs & ~prev) | (~s->edge & ~s->inputs & prev)) &
-                    (1 << line) & s->dir & ~s->mask) {
-        s->ints |= 1 << line;
-        qemu_irq_raise(s->irq);
-    }
-}
-
-static uint32_t omap_gpio_read(void *opaque, target_phys_addr_t addr)
-{
-    struct omap_gpio_s *s = (struct omap_gpio_s *) opaque;
-    int offset = addr & OMAP_MPUI_REG_MASK;
-
-    switch (offset) {
-    case 0x00: /* DATA_INPUT */
-        return s->inputs & s->pins;
-
-    case 0x04: /* DATA_OUTPUT */
-        return s->outputs;
-
-    case 0x08: /* DIRECTION_CONTROL */
-        return s->dir;
-
-    case 0x0c: /* INTERRUPT_CONTROL */
-        return s->edge;
-
-    case 0x10: /* INTERRUPT_MASK */
-        return s->mask;
-
-    case 0x14: /* INTERRUPT_STATUS */
-        return s->ints;
-
-    case 0x18: /* PIN_CONTROL (not in OMAP310) */
-        OMAP_BAD_REG(addr);
-        return s->pins;
-    }
-
-    OMAP_BAD_REG(addr);
-    return 0;
-}
-
-static void omap_gpio_write(void *opaque, target_phys_addr_t addr,
-                uint32_t value)
-{
-    struct omap_gpio_s *s = (struct omap_gpio_s *) opaque;
-    int offset = addr & OMAP_MPUI_REG_MASK;
-    uint16_t diff;
-    int ln;
-
-    switch (offset) {
-    case 0x00: /* DATA_INPUT */
-        OMAP_RO_REG(addr);
-        return;
-
-    case 0x04: /* DATA_OUTPUT */
-        diff = (s->outputs ^ value) & ~s->dir;
-        s->outputs = value;
-        while ((ln = ffs(diff))) {
-            ln --;
-            if (s->handler[ln])
-                qemu_set_irq(s->handler[ln], (value >> ln) & 1);
-            diff &= ~(1 << ln);
-        }
-        break;
-
-    case 0x08: /* DIRECTION_CONTROL */
-        diff = s->outputs & (s->dir ^ value);
-        s->dir = value;
-
-        value = s->outputs & ~s->dir;
-        while ((ln = ffs(diff))) {
-            ln --;
-            if (s->handler[ln])
-                qemu_set_irq(s->handler[ln], (value >> ln) & 1);
-            diff &= ~(1 << ln);
-        }
-        break;
-
-    case 0x0c: /* INTERRUPT_CONTROL */
-        s->edge = value;
-        break;
-
-    case 0x10: /* INTERRUPT_MASK */
-        s->mask = value;
-        break;
-
-    case 0x14: /* INTERRUPT_STATUS */
-        s->ints &= ~value;
-        if (!s->ints)
-            qemu_irq_lower(s->irq);
-        break;
-
-    case 0x18: /* PIN_CONTROL (not in OMAP310 TRM) */
-        OMAP_BAD_REG(addr);
-        s->pins = value;
-        break;
-
-    default:
-        OMAP_BAD_REG(addr);
-        return;
-    }
-}
-
-/* *Some* sources say the memory region is 32-bit.  */
-static CPUReadMemoryFunc *omap_gpio_readfn[] = {
-    omap_badwidth_read16,
-    omap_gpio_read,
-    omap_badwidth_read16,
-};
-
-static CPUWriteMemoryFunc *omap_gpio_writefn[] = {
-    omap_badwidth_write16,
-    omap_gpio_write,
-    omap_badwidth_write16,
-};
-
-static void omap_gpio_reset(struct omap_gpio_s *s)
-{
-    s->inputs = 0;
-    s->outputs = ~0;
-    s->dir = ~0;
-    s->edge = ~0;
-    s->mask = ~0;
-    s->ints = 0;
-    s->pins = ~0;
-}
-
-struct omap_gpio_s *omap_gpio_init(target_phys_addr_t base,
-                qemu_irq irq, omap_clk clk)
-{
-    int iomemtype;
-    struct omap_gpio_s *s = (struct omap_gpio_s *)
-            qemu_mallocz(sizeof(struct omap_gpio_s));
-
-    s->base = base;
-    s->irq = irq;
-    s->in = qemu_allocate_irqs(omap_gpio_set, s, 16);
-    omap_gpio_reset(s);
-
-    iomemtype = cpu_register_io_memory(0, omap_gpio_readfn,
-                    omap_gpio_writefn, s);
-    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
-
-    return s;
-}
-
-qemu_irq *omap_gpio_in_get(struct omap_gpio_s *s)
-{
-    return s->in;
-}
-
-void omap_gpio_out_set(struct omap_gpio_s *s, int line, qemu_irq handler)
-{
-    if (line >= 16 || line < 0)
-        cpu_abort(cpu_single_env, "%s: No GPIO line %i\n", __FUNCTION__, line);
-    s->handler[line] = handler;
-}
-
 /* MicroWire Interface */
 struct omap_uwire_s {
-    target_phys_addr_t base;
     qemu_irq txirq;
     qemu_irq rxirq;
     qemu_irq txdrq;
@@ -3020,13 +2078,13 @@ struct omap_uwire_s {
     uint16_t control;
     uint16_t setup[5];
 
-    struct uwire_slave_s *chip[4];
+    uWireSlave *chip[4];
 };
 
 static void omap_uwire_transfer_start(struct omap_uwire_s *s)
 {
     int chipselect = (s->control >> 10) & 3;           /* INDEX */
-    struct uwire_slave_s *slave = s->chip[chipselect];
+    uWireSlave *slave = s->chip[chipselect];
 
     if ((s->control >> 5) & 0x1f) {                    /* NB_BITS_WR */
         if (s->control & (1 << 12))                    /* CS_CMD */
@@ -3126,13 +2184,13 @@ static void omap_uwire_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_uwire_readfn[] = {
+static CPUReadMemoryFunc * const omap_uwire_readfn[] = {
     omap_badwidth_read16,
     omap_uwire_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_uwire_writefn[] = {
+static CPUWriteMemoryFunc * const omap_uwire_writefn[] = {
     omap_badwidth_write16,
     omap_uwire_write,
     omap_badwidth_write16,
@@ -3153,23 +2211,22 @@ struct omap_uwire_s *omap_uwire_init(target_phys_addr_t base,
 {
     int iomemtype;
     struct omap_uwire_s *s = (struct omap_uwire_s *)
-            qemu_mallocz(sizeof(struct omap_uwire_s));
+            g_malloc0(sizeof(struct omap_uwire_s));
 
-    s->base = base;
     s->txirq = irq[0];
     s->rxirq = irq[1];
     s->txdrq = dma;
     omap_uwire_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_uwire_readfn,
-                    omap_uwire_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_uwire_readfn,
+                    omap_uwire_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
 
 void omap_uwire_attach(struct omap_uwire_s *s,
-                struct uwire_slave_s *slave, int chipselect)
+                uWireSlave *slave, int chipselect)
 {
     if (chipselect < 0 || chipselect > 3) {
         fprintf(stderr, "%s: Bad chipselect %i\n", __FUNCTION__, chipselect);
@@ -3226,13 +2283,13 @@ static void omap_pwl_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_pwl_readfn[] = {
+static CPUReadMemoryFunc * const omap_pwl_readfn[] = {
     omap_pwl_read,
     omap_badwidth_read8,
     omap_badwidth_read8,
 };
 
-static CPUWriteMemoryFunc *omap_pwl_writefn[] = {
+static CPUWriteMemoryFunc * const omap_pwl_writefn[] = {
     omap_pwl_write,
     omap_badwidth_write8,
     omap_badwidth_write8,
@@ -3262,8 +2319,8 @@ static void omap_pwl_init(target_phys_addr_t base, struct omap_mpu_state_s *s,
 
     omap_pwl_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_pwl_readfn,
-                    omap_pwl_writefn, s);
+    iomemtype = cpu_register_io_memory(omap_pwl_readfn,
+                    omap_pwl_writefn, s, DEVICE_NATIVE_ENDIAN);
     cpu_register_physical_memory(base, 0x800, iomemtype);
 
     omap_clk_adduser(clk, qemu_allocate_irqs(omap_pwl_clk_update, s, 1)[0]);
@@ -3330,13 +2387,13 @@ static void omap_pwt_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_pwt_readfn[] = {
+static CPUReadMemoryFunc * const omap_pwt_readfn[] = {
     omap_pwt_read,
     omap_badwidth_read8,
     omap_badwidth_read8,
 };
 
-static CPUWriteMemoryFunc *omap_pwt_writefn[] = {
+static CPUWriteMemoryFunc * const omap_pwt_writefn[] = {
     omap_pwt_write,
     omap_badwidth_write8,
     omap_badwidth_write8,
@@ -3357,14 +2414,13 @@ static void omap_pwt_init(target_phys_addr_t base, struct omap_mpu_state_s *s,
     s->pwt.clk = clk;
     omap_pwt_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_pwt_readfn,
-                    omap_pwt_writefn, s);
+    iomemtype = cpu_register_io_memory(omap_pwt_readfn,
+                    omap_pwt_writefn, s, DEVICE_NATIVE_ENDIAN);
     cpu_register_physical_memory(base, 0x800, iomemtype);
 }
 
 /* Real-time Clock module */
 struct omap_rtc_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq alarm;
     QEMUTimer *clk;
@@ -3392,21 +2448,11 @@ static void omap_rtc_interrupts_update(struct omap_rtc_s *s)
 
 static void omap_rtc_alarm_update(struct omap_rtc_s *s)
 {
-    s->alarm_ti = mktime(&s->alarm_tm);
+    s->alarm_ti = mktimegm(&s->alarm_tm);
     if (s->alarm_ti == -1)
         printf("%s: conversion failed\n", __FUNCTION__);
 }
 
-static inline uint8_t omap_rtc_bcd(int num)
-{
-    return ((num / 10) << 4) | (num % 10);
-}
-
-static inline int omap_rtc_bin(uint8_t num)
-{
-    return (num & 15) + 10 * (num >> 4);
-}
-
 static uint32_t omap_rtc_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_rtc_s *s = (struct omap_rtc_s *) opaque;
@@ -3415,51 +2461,51 @@ static uint32_t omap_rtc_read(void *opaque, target_phys_addr_t addr)
 
     switch (offset) {
     case 0x00: /* SECONDS_REG */
-        return omap_rtc_bcd(s->current_tm.tm_sec);
+        return to_bcd(s->current_tm.tm_sec);
 
     case 0x04: /* MINUTES_REG */
-        return omap_rtc_bcd(s->current_tm.tm_min);
+        return to_bcd(s->current_tm.tm_min);
 
     case 0x08: /* HOURS_REG */
         if (s->pm_am)
             return ((s->current_tm.tm_hour > 11) << 7) |
-                    omap_rtc_bcd(((s->current_tm.tm_hour - 1) % 12) + 1);
+                    to_bcd(((s->current_tm.tm_hour - 1) % 12) + 1);
         else
-            return omap_rtc_bcd(s->current_tm.tm_hour);
+            return to_bcd(s->current_tm.tm_hour);
 
     case 0x0c: /* DAYS_REG */
-        return omap_rtc_bcd(s->current_tm.tm_mday);
+        return to_bcd(s->current_tm.tm_mday);
 
     case 0x10: /* MONTHS_REG */
-        return omap_rtc_bcd(s->current_tm.tm_mon + 1);
+        return to_bcd(s->current_tm.tm_mon + 1);
 
     case 0x14: /* YEARS_REG */
-        return omap_rtc_bcd(s->current_tm.tm_year % 100);
+        return to_bcd(s->current_tm.tm_year % 100);
 
     case 0x18: /* WEEK_REG */
         return s->current_tm.tm_wday;
 
     case 0x20: /* ALARM_SECONDS_REG */
-        return omap_rtc_bcd(s->alarm_tm.tm_sec);
+        return to_bcd(s->alarm_tm.tm_sec);
 
     case 0x24: /* ALARM_MINUTES_REG */
-        return omap_rtc_bcd(s->alarm_tm.tm_min);
+        return to_bcd(s->alarm_tm.tm_min);
 
     case 0x28: /* ALARM_HOURS_REG */
         if (s->pm_am)
             return ((s->alarm_tm.tm_hour > 11) << 7) |
-                    omap_rtc_bcd(((s->alarm_tm.tm_hour - 1) % 12) + 1);
+                    to_bcd(((s->alarm_tm.tm_hour - 1) % 12) + 1);
         else
-            return omap_rtc_bcd(s->alarm_tm.tm_hour);
+            return to_bcd(s->alarm_tm.tm_hour);
 
     case 0x2c: /* ALARM_DAYS_REG */
-        return omap_rtc_bcd(s->alarm_tm.tm_mday);
+        return to_bcd(s->alarm_tm.tm_mday);
 
     case 0x30: /* ALARM_MONTHS_REG */
-        return omap_rtc_bcd(s->alarm_tm.tm_mon + 1);
+        return to_bcd(s->alarm_tm.tm_mon + 1);
 
     case 0x34: /* ALARM_YEARS_REG */
-        return omap_rtc_bcd(s->alarm_tm.tm_year % 100);
+        return to_bcd(s->alarm_tm.tm_year % 100);
 
     case 0x40: /* RTC_CTRL_REG */
         return (s->pm_am << 3) | (s->auto_comp << 2) |
@@ -3498,7 +2544,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         printf("RTC SEC_REG <-- %02x\n", value);
 #endif
         s->ti -= s->current_tm.tm_sec;
-        s->ti += omap_rtc_bin(value);
+        s->ti += from_bcd(value);
         return;
 
     case 0x04: /* MINUTES_REG */
@@ -3506,7 +2552,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         printf("RTC MIN_REG <-- %02x\n", value);
 #endif
         s->ti -= s->current_tm.tm_min * 60;
-        s->ti += omap_rtc_bin(value) * 60;
+        s->ti += from_bcd(value) * 60;
         return;
 
     case 0x08: /* HOURS_REG */
@@ -3515,10 +2561,10 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #endif
         s->ti -= s->current_tm.tm_hour * 3600;
         if (s->pm_am) {
-            s->ti += (omap_rtc_bin(value & 0x3f) & 12) * 3600;
+            s->ti += (from_bcd(value & 0x3f) & 12) * 3600;
             s->ti += ((value >> 7) & 1) * 43200;
         } else
-            s->ti += omap_rtc_bin(value & 0x3f) * 3600;
+            s->ti += from_bcd(value & 0x3f) * 3600;
         return;
 
     case 0x0c: /* DAYS_REG */
@@ -3526,7 +2572,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         printf("RTC DAY_REG <-- %02x\n", value);
 #endif
         s->ti -= s->current_tm.tm_mday * 86400;
-        s->ti += omap_rtc_bin(value) * 86400;
+        s->ti += from_bcd(value) * 86400;
         return;
 
     case 0x10: /* MONTHS_REG */
@@ -3534,9 +2580,9 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         printf("RTC MTH_REG <-- %02x\n", value);
 #endif
         memcpy(&new_tm, &s->current_tm, sizeof(new_tm));
-        new_tm.tm_mon = omap_rtc_bin(value);
-        ti[0] = mktime(&s->current_tm);
-        ti[1] = mktime(&new_tm);
+        new_tm.tm_mon = from_bcd(value);
+        ti[0] = mktimegm(&s->current_tm);
+        ti[1] = mktimegm(&new_tm);
 
         if (ti[0] != -1 && ti[1] != -1) {
             s->ti -= ti[0];
@@ -3544,7 +2590,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         } else {
             /* A less accurate version */
             s->ti -= s->current_tm.tm_mon * 2592000;
-            s->ti += omap_rtc_bin(value) * 2592000;
+            s->ti += from_bcd(value) * 2592000;
         }
         return;
 
@@ -3553,9 +2599,9 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         printf("RTC YRS_REG <-- %02x\n", value);
 #endif
         memcpy(&new_tm, &s->current_tm, sizeof(new_tm));
-        new_tm.tm_year += omap_rtc_bin(value) - (new_tm.tm_year % 100);
-        ti[0] = mktime(&s->current_tm);
-        ti[1] = mktime(&new_tm);
+        new_tm.tm_year += from_bcd(value) - (new_tm.tm_year % 100);
+        ti[0] = mktimegm(&s->current_tm);
+        ti[1] = mktimegm(&new_tm);
 
         if (ti[0] != -1 && ti[1] != -1) {
             s->ti -= ti[0];
@@ -3563,7 +2609,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
         } else {
             /* A less accurate version */
             s->ti -= (s->current_tm.tm_year % 100) * 31536000;
-            s->ti += omap_rtc_bin(value) * 31536000;
+            s->ti += from_bcd(value) * 31536000;
         }
         return;
 
@@ -3574,7 +2620,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #ifdef ALMDEBUG
         printf("ALM SEC_REG <-- %02x\n", value);
 #endif
-        s->alarm_tm.tm_sec = omap_rtc_bin(value);
+        s->alarm_tm.tm_sec = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
@@ -3582,7 +2628,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #ifdef ALMDEBUG
         printf("ALM MIN_REG <-- %02x\n", value);
 #endif
-        s->alarm_tm.tm_min = omap_rtc_bin(value);
+        s->alarm_tm.tm_min = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
@@ -3592,10 +2638,10 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #endif
         if (s->pm_am)
             s->alarm_tm.tm_hour =
-                    ((omap_rtc_bin(value & 0x3f)) % 12) +
+                    ((from_bcd(value & 0x3f)) % 12) +
                     ((value >> 7) & 1) * 12;
         else
-            s->alarm_tm.tm_hour = omap_rtc_bin(value);
+            s->alarm_tm.tm_hour = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
@@ -3603,7 +2649,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #ifdef ALMDEBUG
         printf("ALM DAY_REG <-- %02x\n", value);
 #endif
-        s->alarm_tm.tm_mday = omap_rtc_bin(value);
+        s->alarm_tm.tm_mday = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
@@ -3611,7 +2657,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #ifdef ALMDEBUG
         printf("ALM MON_REG <-- %02x\n", value);
 #endif
-        s->alarm_tm.tm_mon = omap_rtc_bin(value);
+        s->alarm_tm.tm_mon = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
@@ -3619,7 +2665,7 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
 #ifdef ALMDEBUG
         printf("ALM YRS_REG <-- %02x\n", value);
 #endif
-        s->alarm_tm.tm_year = omap_rtc_bin(value);
+        s->alarm_tm.tm_year = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
@@ -3672,13 +2718,13 @@ static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_rtc_readfn[] = {
+static CPUReadMemoryFunc * const omap_rtc_readfn[] = {
     omap_rtc_read,
     omap_badwidth_read8,
     omap_badwidth_read8,
 };
 
-static CPUWriteMemoryFunc *omap_rtc_writefn[] = {
+static CPUWriteMemoryFunc * const omap_rtc_writefn[] = {
     omap_rtc_write,
     omap_badwidth_write8,
     omap_badwidth_write8,
@@ -3757,41 +2803,39 @@ static void omap_rtc_reset(struct omap_rtc_s *s)
     s->pm_am = 0;
     s->auto_comp = 0;
     s->round = 0;
-    s->tick = qemu_get_clock(rt_clock);
+    s->tick = qemu_get_clock_ms(rt_clock);
     memset(&s->alarm_tm, 0, sizeof(s->alarm_tm));
     s->alarm_tm.tm_mday = 0x01;
     s->status = 1 << 7;
     qemu_get_timedate(&tm, 0);
-    s->ti = mktime(&tm);
+    s->ti = mktimegm(&tm);
 
     omap_rtc_alarm_update(s);
     omap_rtc_tick(s);
 }
 
-struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
+static struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
                 qemu_irq *irq, omap_clk clk)
 {
     int iomemtype;
     struct omap_rtc_s *s = (struct omap_rtc_s *)
-            qemu_mallocz(sizeof(struct omap_rtc_s));
+            g_malloc0(sizeof(struct omap_rtc_s));
 
-    s->base = base;
     s->irq = irq[0];
     s->alarm = irq[1];
-    s->clk = qemu_new_timer(rt_clock, omap_rtc_tick, s);
+    s->clk = qemu_new_timer_ms(rt_clock, omap_rtc_tick, s);
 
     omap_rtc_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_rtc_readfn,
-                    omap_rtc_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_rtc_readfn,
+                    omap_rtc_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
 
 /* Multi-channel Buffered Serial Port interfaces */
 struct omap_mcbsp_s {
-    target_phys_addr_t base;
     qemu_irq txirq;
     qemu_irq rxirq;
     qemu_irq txdrq;
@@ -3810,7 +2854,7 @@ struct omap_mcbsp_s {
     int tx_req;
     int rx_req;
 
-    struct i2s_codec_s *codec;
+    I2SCodec *codec;
     QEMUTimer *source_timer;
     QEMUTimer *sink_timer;
 };
@@ -3872,7 +2916,8 @@ static void omap_mcbsp_source_tick(void *opaque)
     s->rx_req = s->rx_rate << bps[(s->rcr[0] >> 5) & 7];
 
     omap_mcbsp_rx_newdata(s);
-    qemu_mod_timer(s->source_timer, qemu_get_clock(vm_clock) + ticks_per_sec);
+    qemu_mod_timer(s->source_timer, qemu_get_clock_ns(vm_clock) +
+                   get_ticks_per_sec());
 }
 
 static void omap_mcbsp_rx_start(struct omap_mcbsp_s *s)
@@ -3917,7 +2962,8 @@ static void omap_mcbsp_sink_tick(void *opaque)
     s->tx_req = s->tx_rate << bps[(s->xcr[0] >> 5) & 7];
 
     omap_mcbsp_tx_newdata(s);
-    qemu_mod_timer(s->sink_timer, qemu_get_clock(vm_clock) + ticks_per_sec);
+    qemu_mod_timer(s->sink_timer, qemu_get_clock_ns(vm_clock) +
+                   get_ticks_per_sec());
 }
 
 static void omap_mcbsp_tx_start(struct omap_mcbsp_s *s)
@@ -4257,13 +3303,13 @@ static void omap_mcbsp_writew(void *opaque, target_phys_addr_t addr,
     omap_badwidth_write16(opaque, addr, value);
 }
 
-static CPUReadMemoryFunc *omap_mcbsp_readfn[] = {
+static CPUReadMemoryFunc * const omap_mcbsp_readfn[] = {
     omap_badwidth_read16,
     omap_mcbsp_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_mcbsp_writefn[] = {
+static CPUWriteMemoryFunc * const omap_mcbsp_writefn[] = {
     omap_badwidth_write16,
     omap_mcbsp_writeh,
     omap_mcbsp_writew,
@@ -4293,20 +3339,19 @@ struct omap_mcbsp_s *omap_mcbsp_init(target_phys_addr_t base,
 {
     int iomemtype;
     struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)
-            qemu_mallocz(sizeof(struct omap_mcbsp_s));
+            g_malloc0(sizeof(struct omap_mcbsp_s));
 
-    s->base = base;
     s->txirq = irq[0];
     s->rxirq = irq[1];
     s->txdrq = dma[0];
     s->rxdrq = dma[1];
-    s->sink_timer = qemu_new_timer(vm_clock, omap_mcbsp_sink_tick, s);
-    s->source_timer = qemu_new_timer(vm_clock, omap_mcbsp_source_tick, s);
+    s->sink_timer = qemu_new_timer_ns(vm_clock, omap_mcbsp_sink_tick, s);
+    s->source_timer = qemu_new_timer_ns(vm_clock, omap_mcbsp_source_tick, s);
     omap_mcbsp_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_mcbsp_readfn,
-                    omap_mcbsp_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_mcbsp_readfn,
+                    omap_mcbsp_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
@@ -4331,7 +3376,7 @@ static void omap_mcbsp_i2s_start(void *opaque, int line, int level)
     }
 }
 
-void omap_mcbsp_i2s_attach(struct omap_mcbsp_s *s, struct i2s_codec_s *slave)
+void omap_mcbsp_i2s_attach(struct omap_mcbsp_s *s, I2SCodec *slave)
 {
     s->codec = slave;
     slave->rx_swallow = qemu_allocate_irqs(omap_mcbsp_i2s_swallow, s, 1)[0];
@@ -4340,7 +3385,6 @@ void omap_mcbsp_i2s_attach(struct omap_mcbsp_s *s, struct i2s_codec_s *slave)
 
 /* LED Pulse Generators */
 struct omap_lpg_s {
-    target_phys_addr_t base;
     QEMUTimer *tm;
 
     uint8_t control;
@@ -4356,9 +3400,9 @@ static void omap_lpg_tick(void *opaque)
     struct omap_lpg_s *s = opaque;
 
     if (s->cycle)
-        qemu_mod_timer(s->tm, qemu_get_clock(rt_clock) + s->period - s->on);
+        qemu_mod_timer(s->tm, qemu_get_clock_ms(rt_clock) + s->period - s->on);
     else
-        qemu_mod_timer(s->tm, qemu_get_clock(rt_clock) + s->on);
+        qemu_mod_timer(s->tm, qemu_get_clock_ms(rt_clock) + s->on);
 
     s->cycle = !s->cycle;
     printf("%s: LED is %s\n", __FUNCTION__, s->cycle ? "on" : "off");
@@ -4447,13 +3491,13 @@ static void omap_lpg_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-static CPUReadMemoryFunc *omap_lpg_readfn[] = {
+static CPUReadMemoryFunc * const omap_lpg_readfn[] = {
     omap_lpg_read,
     omap_badwidth_read8,
     omap_badwidth_read8,
 };
 
-static CPUWriteMemoryFunc *omap_lpg_writefn[] = {
+static CPUWriteMemoryFunc * const omap_lpg_writefn[] = {
     omap_lpg_write,
     omap_badwidth_write8,
     omap_badwidth_write8,
@@ -4467,20 +3511,19 @@ static void omap_lpg_clk_update(void *opaque, int line, int on)
     omap_lpg_update(s);
 }
 
-struct omap_lpg_s *omap_lpg_init(target_phys_addr_t base, omap_clk clk)
+static struct omap_lpg_s *omap_lpg_init(target_phys_addr_t base, omap_clk clk)
 {
     int iomemtype;
     struct omap_lpg_s *s = (struct omap_lpg_s *)
-            qemu_mallocz(sizeof(struct omap_lpg_s));
+            g_malloc0(sizeof(struct omap_lpg_s));
 
-    s->base = base;
-    s->tm = qemu_new_timer(rt_clock, omap_lpg_tick, s);
+    s->tm = qemu_new_timer_ms(rt_clock, omap_lpg_tick, s);
 
     omap_lpg_reset(s);
 
-    iomemtype = cpu_register_io_memory(0, omap_lpg_readfn,
-                    omap_lpg_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    iomemtype = cpu_register_io_memory(omap_lpg_readfn,
+                    omap_lpg_writefn, s, DEVICE_NATIVE_ENDIAN);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);
 
@@ -4497,13 +3540,13 @@ static uint32_t omap_mpui_io_read(void *opaque, target_phys_addr_t addr)
     return 0;
 }
 
-static CPUReadMemoryFunc *omap_mpui_io_readfn[] = {
+static CPUReadMemoryFunc * const omap_mpui_io_readfn[] = {
     omap_badwidth_read16,
     omap_mpui_io_read,
     omap_badwidth_read16,
 };
 
-static CPUWriteMemoryFunc *omap_mpui_io_writefn[] = {
+static CPUWriteMemoryFunc * const omap_mpui_io_writefn[] = {
     omap_badwidth_write16,
     omap_badwidth_write16,
     omap_badwidth_write16,
@@ -4511,8 +3554,8 @@ static CPUWriteMemoryFunc *omap_mpui_io_writefn[] = {
 
 static void omap_setup_mpui_io(struct omap_mpu_state_s *mpu)
 {
-    int iomemtype = cpu_register_io_memory(0, omap_mpui_io_readfn,
-                    omap_mpui_io_writefn, mpu);
+    int iomemtype = cpu_register_io_memory(omap_mpui_io_readfn,
+                    omap_mpui_io_writefn, mpu, DEVICE_NATIVE_ENDIAN);
     cpu_register_physical_memory(OMAP_MPUI_BASE, 0x7fff, iomemtype);
 }
 
@@ -4543,7 +3586,6 @@ static void omap1_mpu_reset(void *opaque)
     omap_uart_reset(mpu->uart[2]);
     omap_mmc_reset(mpu->mmc);
     omap_mpuio_reset(mpu->mpuio);
-    omap_gpio_reset(mpu->gpio);
     omap_uwire_reset(mpu->microwire);
     omap_pwl_reset(mpu);
     omap_pwt_reset(mpu);
@@ -4630,49 +3672,50 @@ static const struct dma_irq_map omap1_dma_irq_map[] = {
 static int omap_validate_emiff_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
-    return addr >= OMAP_EMIFF_BASE && addr < OMAP_EMIFF_BASE + s->sdram_size;
+    return range_covers_byte(OMAP_EMIFF_BASE, s->sdram_size, addr);
 }
 
 static int omap_validate_emifs_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
-    return addr >= OMAP_EMIFS_BASE && addr < OMAP_EMIFF_BASE;
+    return range_covers_byte(OMAP_EMIFS_BASE, OMAP_EMIFF_BASE - OMAP_EMIFS_BASE,
+                             addr);
 }
 
 static int omap_validate_imif_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
-    return addr >= OMAP_IMIF_BASE && addr < OMAP_IMIF_BASE + s->sram_size;
+    return range_covers_byte(OMAP_IMIF_BASE, s->sram_size, addr);
 }
 
 static int omap_validate_tipb_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
-    return addr >= 0xfffb0000 && addr < 0xffff0000;
+    return range_covers_byte(0xfffb0000, 0xffff0000 - 0xfffb0000, addr);
 }
 
 static int omap_validate_local_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
-    return addr >= OMAP_LOCALBUS_BASE && addr < OMAP_LOCALBUS_BASE + 0x1000000;
+    return range_covers_byte(OMAP_LOCALBUS_BASE, 0x1000000, addr);
 }
 
 static int omap_validate_tipb_mpui_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
-    return addr >= 0xe1010000 && addr < 0xe1020004;
+    return range_covers_byte(0xe1010000, 0xe1020004 - 0xe1010000, addr);
 }
 
 struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
-                DisplayState *ds, const char *core)
+                const char *core)
 {
     int i;
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_state_s));
+            g_malloc0(sizeof(struct omap_mpu_state_s));
     ram_addr_t imif_base, emiff_base;
     qemu_irq *cpu_irq;
     qemu_irq dma_irqs[6];
-    int sdindex;
+    DriveInfo *dinfo;
 
     if (!core)
         core = "ti925t";
@@ -4694,9 +3737,11 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
 
     /* Memory-mapped stuff */
     cpu_register_physical_memory(OMAP_EMIFF_BASE, s->sdram_size,
-                    (emiff_base = qemu_ram_alloc(s->sdram_size)) | IO_MEM_RAM);
+                    (emiff_base = qemu_ram_alloc(NULL, "omap1.dram",
+                                                 s->sdram_size)) | IO_MEM_RAM);
     cpu_register_physical_memory(OMAP_IMIF_BASE, s->sram_size,
-                    (imif_base = qemu_ram_alloc(s->sram_size)) | IO_MEM_RAM);
+                    (imif_base = qemu_ram_alloc(NULL, "omap1.sram",
+                                                s->sram_size)) | IO_MEM_RAM);
 
     omap_clkm_init(0xfffece00, 0xe1008000, s);
 
@@ -4705,8 +3750,8 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
                     cpu_irq[ARM_PIC_CPU_IRQ], cpu_irq[ARM_PIC_CPU_FIQ],
                     omap_findclk(s, "arminth_ck"));
     s->ih[1] = omap_inth_init(0xfffe0000, 0x800, 1, &s->irq[1],
-                    s->ih[0]->pins[OMAP_INT_15XX_IH2_IRQ], NULL,
-                    omap_findclk(s, "arminth_ck"));
+                    omap_inth_get_pin(s->ih[0], OMAP_INT_15XX_IH2_IRQ),
+                   NULL, omap_findclk(s, "arminth_ck"));
 
     for (i = 0; i < 6; i ++)
         dma_irqs[i] =
@@ -4746,7 +3791,7 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
                     omap_findclk(s, "clk32-kHz"));
 
     s->lcd = omap_lcdc_init(0xfffec000, s->irq[0][OMAP_INT_LCD_CTRL],
-                    omap_dma_get_lcdch(s->dma), ds, imif_base, emiff_base,
+                    omap_dma_get_lcdch(s->dma), imif_base, emiff_base,
                     omap_findclk(s, "lcd_ck"));
 
     omap_ulpd_pm_init(0xfffe0800, s);
@@ -4768,28 +3813,31 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
                     omap_findclk(s, "uart1_ck"),
                     omap_findclk(s, "uart1_ck"),
                     s->drq[OMAP_DMA_UART1_TX], s->drq[OMAP_DMA_UART1_RX],
+                    "uart1",
                     serial_hds[0]);
     s->uart[1] = omap_uart_init(0xfffb0800, s->irq[1][OMAP_INT_UART2],
                     omap_findclk(s, "uart2_ck"),
                     omap_findclk(s, "uart2_ck"),
                     s->drq[OMAP_DMA_UART2_TX], s->drq[OMAP_DMA_UART2_RX],
-                    serial_hds[0] ? serial_hds[1] : 0);
-    s->uart[2] = omap_uart_init(0xe1019800, s->irq[0][OMAP_INT_UART3],
+                    "uart2",
+                    serial_hds[0] ? serial_hds[1] : NULL);
+    s->uart[2] = omap_uart_init(0xfffb9800, s->irq[0][OMAP_INT_UART3],
                     omap_findclk(s, "uart3_ck"),
                     omap_findclk(s, "uart3_ck"),
                     s->drq[OMAP_DMA_UART3_TX], s->drq[OMAP_DMA_UART3_RX],
-                    serial_hds[0] && serial_hds[1] ? serial_hds[2] : 0);
+                    "uart3",
+                    serial_hds[0] && serial_hds[1] ? serial_hds[2] : NULL);
 
     omap_dpll_init(&s->dpll[0], 0xfffecf00, omap_findclk(s, "dpll1"));
     omap_dpll_init(&s->dpll[1], 0xfffed000, omap_findclk(s, "dpll2"));
     omap_dpll_init(&s->dpll[2], 0xfffed100, omap_findclk(s, "dpll3"));
 
-    sdindex = drive_get_index(IF_SD, 0, 0);
-    if (sdindex == -1) {
+    dinfo = drive_get(IF_SD, 0, 0);
+    if (!dinfo) {
         fprintf(stderr, "qemu: missing SecureDigital device\n");
         exit(1);
     }
-    s->mmc = omap_mmc_init(0xfffb7800, drives_table[sdindex].bdrv,
+    s->mmc = omap_mmc_init(0xfffb7800, dinfo->bdrv,
                     s->irq[1][OMAP_INT_OQN], &s->drq[OMAP_DMA_MMC_TX],
                     omap_findclk(s, "mmc_ck"));
 
@@ -4797,8 +3845,12 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
                     s->irq[1][OMAP_INT_KEYBOARD], s->irq[1][OMAP_INT_MPUIO],
                     s->wakeup, omap_findclk(s, "clk32-kHz"));
 
-    s->gpio = omap_gpio_init(0xfffce000, s->irq[0][OMAP_INT_GPIO_BANK1],
-                    omap_findclk(s, "arm_gpio_ck"));
+    s->gpio = qdev_create(NULL, "omap-gpio");
+    qdev_prop_set_int32(s->gpio, "mpu_model", s->mpu_model);
+    qdev_init_nofail(s->gpio);
+    sysbus_connect_irq(sysbus_from_qdev(s->gpio), 0,
+                    s->irq[0][OMAP_INT_GPIO_BANK1]);
+    sysbus_mmio_map(sysbus_from_qdev(s->gpio), 0, 0xfffce000);
 
     s->microwire = omap_uwire_init(0xfffb3000, &s->irq[1][OMAP_INT_uWireTX],
                     s->drq[OMAP_DMA_UWIRE_TX], omap_findclk(s, "mpuper_ck"));