summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--block.c4
-rw-r--r--block/crypto.c12
-rw-r--r--block/mirror.c17
-rw-r--r--block/nfs.c6
-rw-r--r--block/replication.c2
-rw-r--r--block/sheepdog.c2
-rw-r--r--block/ssh.c2
-rw-r--r--blockdev.c12
-rw-r--r--crypto/block-luks.c21
-rw-r--r--default-configs/ppc-softmmu.mak1
-rw-r--r--default-configs/ppc64-softmmu.mak1
-rw-r--r--default-configs/ppcemb-softmmu.mak1
-rw-r--r--hw/block/fdc.c6
-rw-r--r--hw/display/cg3.c12
-rw-r--r--hw/display/sm501.c1784
-rw-r--r--hw/display/sm501_template.h90
-rw-r--r--hw/display/tcx.c298
-rw-r--r--hw/i386/pc.c4
-rw-r--r--hw/s390x/virtio-ccw.c4
-rw-r--r--hw/scsi/vhost-scsi.c6
-rw-r--r--hw/scsi/virtio-scsi.c11
-rw-r--r--hw/sh4/r2d.c11
-rw-r--r--hw/sparc/sun4m.c2
-rw-r--r--hw/usb/bus.c4
-rw-r--r--include/block/block.h2
-rw-r--r--include/block/block_int.h6
-rw-r--r--include/crypto/block.h12
-rw-r--r--include/hw/devices.h5
-rw-r--r--include/hw/pci/pci_ids.h3
-rw-r--r--include/hw/virtio/virtio-scsi.h8
-rw-r--r--include/qemu/sockets.h9
-rw-r--r--io/channel-socket.c2
-rw-r--r--migration/rdma.c12
-rw-r--r--net/socket.c2
-rw-r--r--pc-bios/openbios-ppcbin750840 -> 750840 bytes
-rw-r--r--pc-bios/openbios-sparc32bin382048 -> 382048 bytes
-rw-r--r--pc-bios/openbios-sparc64bin1593408 -> 1593408 bytes
-rw-r--r--qemu-img.c4
-rw-r--r--qga/commands-win32.c4
-rw-r--r--qga/vss-win32.c2
-rw-r--r--qga/vss-win32.h2
m---------roms/openbios0
-rw-r--r--tests/test-crypto-block.c12
-rw-r--r--tests/test-replication.c8
-rw-r--r--util/error.c1
-rw-r--r--util/qemu-sockets.c38
46 files changed, 1336 insertions, 1109 deletions
diff --git a/block.c b/block.c
index 1fbbb8d606..7eda9a42b3 100644
--- a/block.c
+++ b/block.c
@@ -4161,8 +4161,8 @@ bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
 
 void bdrv_img_create(const char *filename, const char *fmt,
                      const char *base_filename, const char *base_fmt,
-                     char *options, uint64_t img_size, int flags,
-                     Error **errp, bool quiet)
+                     char *options, uint64_t img_size, int flags, bool quiet,
+                     Error **errp)
 {
     QemuOptsList *create_opts = NULL;
     QemuOpts *opts = NULL;
diff --git a/block/crypto.c b/block/crypto.c
index 4a2038888d..34549b28a5 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -56,11 +56,11 @@ static int block_crypto_probe_generic(QCryptoBlockFormat format,
 
 
 static ssize_t block_crypto_read_func(QCryptoBlock *block,
+                                      void *opaque,
                                       size_t offset,
                                       uint8_t *buf,
                                       size_t buflen,
-                                      Error **errp,
-                                      void *opaque)
+                                      Error **errp)
 {
     BlockDriverState *bs = opaque;
     ssize_t ret;
@@ -83,11 +83,11 @@ struct BlockCryptoCreateData {
 
 
 static ssize_t block_crypto_write_func(QCryptoBlock *block,
+                                       void *opaque,
                                        size_t offset,
                                        const uint8_t *buf,
                                        size_t buflen,
-                                       Error **errp,
-                                       void *opaque)
+                                       Error **errp)
 {
     struct BlockCryptoCreateData *data = opaque;
     ssize_t ret;
@@ -102,9 +102,9 @@ static ssize_t block_crypto_write_func(QCryptoBlock *block,
 
 
 static ssize_t block_crypto_init_func(QCryptoBlock *block,
+                                      void *opaque,
                                       size_t headerlen,
-                                      Error **errp,
-                                      void *opaque)
+                                      Error **errp)
 {
     struct BlockCryptoCreateData *data = opaque;
     int ret;
diff --git a/block/mirror.c b/block/mirror.c
index 164438f422..9f5eb692fd 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -1112,10 +1112,11 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
                              BlockdevOnError on_target_error,
                              bool unmap,
                              BlockCompletionFunc *cb,
-                             void *opaque, Error **errp,
+                             void *opaque,
                              const BlockJobDriver *driver,
                              bool is_none_mode, BlockDriverState *base,
-                             bool auto_complete, const char *filter_node_name)
+                             bool auto_complete, const char *filter_node_name,
+                             Error **errp)
 {
     MirrorBlockJob *s;
     BlockDriverState *mirror_top_bs;
@@ -1280,17 +1281,17 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
     base = mode == MIRROR_SYNC_MODE_TOP ? backing_bs(bs) : NULL;
     mirror_start_job(job_id, bs, BLOCK_JOB_DEFAULT, target, replaces,
                      speed, granularity, buf_size, backing_mode,
-                     on_source_error, on_target_error, unmap, NULL, NULL, errp,
+                     on_source_error, on_target_error, unmap, NULL, NULL,
                      &mirror_job_driver, is_none_mode, base, false,
-                     filter_node_name);
+                     filter_node_name, errp);
 }
 
 void commit_active_start(const char *job_id, BlockDriverState *bs,
                          BlockDriverState *base, int creation_flags,
                          int64_t speed, BlockdevOnError on_error,
                          const char *filter_node_name,
-                         BlockCompletionFunc *cb, void *opaque, Error **errp,
-                         bool auto_complete)
+                         BlockCompletionFunc *cb, void *opaque,
+                         bool auto_complete, Error **errp)
 {
     int orig_base_flags;
     Error *local_err = NULL;
@@ -1303,9 +1304,9 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
 
     mirror_start_job(job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                      MIRROR_LEAVE_BACKING_CHAIN,
-                     on_error, on_error, true, cb, opaque, &local_err,
+                     on_error, on_error, true, cb, opaque,
                      &commit_active_job_driver, false, base, auto_complete,
-                     filter_node_name);
+                     filter_node_name, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
         goto error_restore_flags;
diff --git a/block/nfs.c b/block/nfs.c
index 0816678307..6541dec1fc 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -497,7 +497,7 @@ out:
 
 
 static int64_t nfs_client_open(NFSClient *client, QDict *options,
-                               int flags, Error **errp, int open_flags)
+                               int flags, int open_flags, Error **errp)
 {
     int ret = -EINVAL;
     QemuOpts *opts = NULL;
@@ -663,7 +663,7 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
 
     ret = nfs_client_open(client, options,
                           (flags & BDRV_O_RDWR) ? O_RDWR : O_RDONLY,
-                          errp, bs->open_flags);
+                          bs->open_flags, errp);
     if (ret < 0) {
         return ret;
     }
@@ -705,7 +705,7 @@ static int nfs_file_create(const char *url, QemuOpts *opts, Error **errp)
         goto out;
     }
 
-    ret = nfs_client_open(client, options, O_CREAT, errp, 0);
+    ret = nfs_client_open(client, options, O_CREAT, 0, errp);
     if (ret < 0) {
         goto out;
     }
diff --git a/block/replication.c b/block/replication.c
index bf3c395eb4..d300c15475 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -656,7 +656,7 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
         s->replication_state = BLOCK_REPLICATION_FAILOVER;
         commit_active_start(NULL, s->active_disk->bs, s->secondary_disk->bs,
                             BLOCK_JOB_INTERNAL, 0, BLOCKDEV_ON_ERROR_REPORT,
-                            NULL, replication_done, bs, errp, true);
+                            NULL, replication_done, bs, true, errp);
         break;
     default:
         aio_context_release(aio_context);
diff --git a/block/sheepdog.c b/block/sheepdog.c
index fb9203e9be..b2a5998188 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -595,7 +595,7 @@ static int connect_to_sdog(BDRVSheepdogState *s, Error **errp)
 {
     int fd;
 
-    fd = socket_connect(s->addr, errp, NULL, NULL);
+    fd = socket_connect(s->addr, NULL, NULL, errp);
 
     if (s->addr->type == SOCKET_ADDRESS_KIND_INET && fd >= 0) {
         int ret = socket_set_nodelay(fd);
diff --git a/block/ssh.c b/block/ssh.c
index 471ba8a260..df09f6c5ba 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -681,7 +681,7 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
     }
 
     /* Open the socket and connect. */
-    s->sock = inet_connect_saddr(s->inet, errp, NULL, NULL);
+    s->sock = inet_connect_saddr(s->inet, NULL, NULL, errp);
     if (s->sock < 0) {
         ret = -EIO;
         goto err;
diff --git a/blockdev.c b/blockdev.c
index 4927914ce3..64282065d8 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1728,7 +1728,7 @@ static void external_snapshot_prepare(BlkActionState *common,
             bdrv_img_create(new_image_file, format,
                             state->old_bs->filename,
                             state->old_bs->drv->format_name,
-                            NULL, size, flags, &local_err, false);
+                            NULL, size, flags, false, &local_err);
             if (local_err) {
                 error_propagate(errp, local_err);
                 return;
@@ -3142,7 +3142,7 @@ void qmp_block_commit(bool has_job_id, const char *job_id, const char *device,
         }
         commit_active_start(has_job_id ? job_id : NULL, bs, base_bs,
                             BLOCK_JOB_DEFAULT, speed, on_error,
-                            filter_node_name, NULL, NULL, &local_err, false);
+                            filter_node_name, NULL, NULL, false, &local_err);
     } else {
         BlockDriverState *overlay_bs = bdrv_find_overlay(bs, top_bs);
         if (bdrv_op_is_blocked(overlay_bs, BLOCK_OP_TYPE_COMMIT_TARGET, errp)) {
@@ -3237,10 +3237,10 @@ static BlockJob *do_drive_backup(DriveBackup *backup, BlockJobTxn *txn,
         if (source) {
             bdrv_img_create(backup->target, backup->format, source->filename,
                             source->drv->format_name, NULL,
-                            size, flags, &local_err, false);
+                            size, flags, false, &local_err);
         } else {
             bdrv_img_create(backup->target, backup->format, NULL, NULL, NULL,
-                            size, flags, &local_err, false);
+                            size, flags, false, &local_err);
         }
     }
 
@@ -3531,7 +3531,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
         /* create new image w/o backing file */
         assert(format);
         bdrv_img_create(arg->target, format,
-                        NULL, NULL, NULL, size, flags, &local_err, false);
+                        NULL, NULL, NULL, size, flags, false, &local_err);
     } else {
         switch (arg->mode) {
         case NEW_IMAGE_MODE_EXISTING:
@@ -3541,7 +3541,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
             bdrv_img_create(arg->target, format,
                             source->filename,
                             source->drv->format_name,
-                            NULL, size, flags, &local_err, false);
+                            NULL, size, flags, false, &local_err);
             break;
         default:
             abort();
diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index 4530f8241c..d5a31bbaeb 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -473,10 +473,10 @@ qcrypto_block_luks_load_key(QCryptoBlock *block,
      * then encrypted.
      */
     rv = readfunc(block,
+                  opaque,
                   slot->key_offset * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
                   splitkey, splitkeylen,
-                  errp,
-                  opaque);
+                  errp);
     if (rv < 0) {
         goto cleanup;
     }
@@ -676,11 +676,10 @@ qcrypto_block_luks_open(QCryptoBlock *block,
 
     /* Read the entire LUKS header, minus the key material from
      * the underlying device */
-    rv = readfunc(block, 0,
+    rv = readfunc(block, opaque, 0,
                   (uint8_t *)&luks->header,
                   sizeof(luks->header),
-                  errp,
-                  opaque);
+                  errp);
     if (rv < 0) {
         ret = rv;
         goto fail;
@@ -1246,7 +1245,7 @@ qcrypto_block_luks_create(QCryptoBlock *block,
         QCRYPTO_BLOCK_LUKS_SECTOR_SIZE;
 
     /* Reserve header space to match payload offset */
-    initfunc(block, block->payload_offset, &local_err, opaque);
+    initfunc(block, opaque, block->payload_offset, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
         goto error;
@@ -1268,11 +1267,10 @@ qcrypto_block_luks_create(QCryptoBlock *block,
 
 
     /* Write out the partition header and key slot headers */
-    writefunc(block, 0,
+    writefunc(block, opaque, 0,
               (const uint8_t *)&luks->header,
               sizeof(luks->header),
-              &local_err,
-              opaque);
+              &local_err);
 
     /* Delay checking local_err until we've byte-swapped */
 
@@ -1297,12 +1295,11 @@ qcrypto_block_luks_create(QCryptoBlock *block,
 
     /* Write out the master key material, starting at the
      * sector immediately following the partition header. */
-    if (writefunc(block,
+    if (writefunc(block, opaque,
                   luks->header.key_slots[0].key_offset *
                   QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
                   splitkey, splitkeylen,
-                  errp,
-                  opaque) != splitkeylen) {
+                  errp) != splitkeylen) {
         goto error;
     }
 
diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
index 09c1d45633..1f1cd85b12 100644
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -45,6 +45,7 @@ CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 CONFIG_PLATFORM_BUS=y
 CONFIG_ETSEC=y
 CONFIG_LIBDECNUMBER=y
+CONFIG_SM501=y
 # For PReP
 CONFIG_SERIAL_ISA=y
 CONFIG_MC146818RTC=y
diff --git a/default-configs/ppc64-softmmu.mak b/default-configs/ppc64-softmmu.mak
index 05c83356e1..f6ccb1bd86 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -47,6 +47,7 @@ CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 CONFIG_PLATFORM_BUS=y
 CONFIG_ETSEC=y
 CONFIG_LIBDECNUMBER=y
+CONFIG_SM501=y
 # For pSeries
 CONFIG_XICS=$(CONFIG_PSERIES)
 CONFIG_XICS_SPAPR=$(CONFIG_PSERIES)
diff --git a/default-configs/ppcemb-softmmu.mak b/default-configs/ppcemb-softmmu.mak
index 7f56004cda..94340de356 100644
--- a/default-configs/ppcemb-softmmu.mak
+++ b/default-configs/ppcemb-softmmu.mak
@@ -15,3 +15,4 @@ CONFIG_I8259=y
 CONFIG_XILINX=y
 CONFIG_XILINX_ETHLITE=y
 CONFIG_LIBDECNUMBER=y
+CONFIG_SM501=y
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index a328693d15..2e629b398b 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -2521,8 +2521,8 @@ static void fdctrl_result_timer(void *opaque)
 }
 
 /* Init functions */
-static void fdctrl_connect_drives(FDCtrl *fdctrl, Error **errp,
-                                  DeviceState *fdc_dev)
+static void fdctrl_connect_drives(FDCtrl *fdctrl, DeviceState *fdc_dev,
+                                  Error **errp)
 {
     unsigned int i;
     FDrive *drive;
@@ -2675,7 +2675,7 @@ static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
     }
 
     floppy_bus_create(fdctrl, &fdctrl->bus, dev);
-    fdctrl_connect_drives(fdctrl, errp, dev);
+    fdctrl_connect_drives(fdctrl, dev, errp);
 }
 
 static const MemoryRegionPortio fdc_portio_list[] = {
diff --git a/hw/display/cg3.c b/hw/display/cg3.c
index 1174220394..03d9197f71 100644
--- a/hw/display/cg3.c
+++ b/hw/display/cg3.c
@@ -26,7 +26,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "cpu.h"
 #include "qemu/error-report.h"
 #include "ui/console.h"
 #include "hw/sysbus.h"
@@ -114,8 +113,8 @@ static void cg3_update_display(void *opaque)
     for (y = 0; y < height; y++) {
         int update = s->full_update;
 
-        page = (y * width) & TARGET_PAGE_MASK;
-        update |= memory_region_get_dirty(&s->vram_mem, page, page + width,
+        page = y * width;
+        update |= memory_region_get_dirty(&s->vram_mem, page, width,
                                           DIRTY_MEMORY_VGA);
         if (update) {
             if (y_start < 0) {
@@ -148,8 +147,7 @@ static void cg3_update_display(void *opaque)
     }
     if (page_max >= page_min) {
         memory_region_reset_dirty(&s->vram_mem,
-                              page_min, page_max - page_min + TARGET_PAGE_SIZE,
-                              DIRTY_MEMORY_VGA);
+                              page_min, page_max - page_min, DIRTY_MEMORY_VGA);
     }
     /* vsync interrupt? */
     if (s->regs[0] & CG3_CR_ENABLE_INTS) {
@@ -305,8 +303,7 @@ static void cg3_realizefn(DeviceState *dev, Error **errp)
     vmstate_register_ram_global(&s->rom);
     fcode_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, CG3_ROM_FILE);
     if (fcode_filename) {
-        ret = load_image_targphys(fcode_filename, s->prom_addr,
-                                  FCODE_MAX_ROM_SIZE);
+        ret = load_image_mr(fcode_filename, &s->rom);
         g_free(fcode_filename);
         if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) {
             error_report("cg3: could not load prom '%s'", CG3_ROM_FILE);
@@ -371,7 +368,6 @@ static Property cg3_properties[] = {
     DEFINE_PROP_UINT16("width",        CG3State, width,     -1),
     DEFINE_PROP_UINT16("height",       CG3State, height,    -1),
     DEFINE_PROP_UINT16("depth",        CG3State, depth,     -1),
-    DEFINE_PROP_UINT64("prom-addr",    CG3State, prom_addr, -1),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 040a0b93f2..2094adbc9c 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -2,6 +2,7 @@
  * QEMU SM501 Device
  *
  * Copyright (c) 2008 Shin-ichiro KAWASAKI
+ * Copyright (c) 2016 BALATON Zoltan
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -23,6 +24,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -31,6 +33,7 @@
 #include "ui/console.h"
 #include "hw/devices.h"
 #include "hw/sysbus.h"
+#include "hw/pci/pci.h"
 #include "qemu/range.h"
 #include "ui/pixel_ops.h"
 #include "exec/address-spaces.h"
@@ -38,10 +41,13 @@
 /*
  * Status: 2010/05/07
  *   - Minimum implementation for Linux console : mmio regs and CRT layer.
- *   - 2D grapihcs acceleration partially supported : only fill rectangle.
+ *   - 2D graphics acceleration partially supported : only fill rectangle.
  *
- * TODO:
+ * Status: 2016/12/04
+ *   - Misc fixes: endianness, hardware cursor
  *   - Panel support
+ *
+ * TODO:
  *   - Touch panel support
  *   - USB support
  *   - UART support
@@ -49,395 +55,396 @@
  *   - Performance tuning
  */
 
-//#define DEBUG_SM501
-//#define DEBUG_BITBLT
+/*#define DEBUG_SM501*/
+/*#define DEBUG_BITBLT*/
 
 #ifdef DEBUG_SM501
 #define SM501_DPRINTF(fmt, ...) printf(fmt, ## __VA_ARGS__)
 #else
-#define SM501_DPRINTF(fmt, ...) do {} while(0)
+#define SM501_DPRINTF(fmt, ...) do {} while (0)
 #endif
 
-
 #define MMIO_BASE_OFFSET 0x3e00000
+#define MMIO_SIZE 0x200000
+#define DC_PALETTE_ENTRIES (0x400 * 3)
 
 /* SM501 register definitions taken from "linux/include/linux/sm501-regs.h" */
 
 /* System Configuration area */
 /* System config base */
-#define SM501_SYS_CONFIG		(0x000000)
+#define SM501_SYS_CONFIG                (0x000000)
 
 /* config 1 */
-#define SM501_SYSTEM_CONTROL 		(0x000000)
+#define SM501_SYSTEM_CONTROL            (0x000000)
 
-#define SM501_SYSCTRL_PANEL_TRISTATE	(1<<0)
-#define SM501_SYSCTRL_MEM_TRISTATE	(1<<1)
-#define SM501_SYSCTRL_CRT_TRISTATE	(1<<2)
+#define SM501_SYSCTRL_PANEL_TRISTATE    (1 << 0)
+#define SM501_SYSCTRL_MEM_TRISTATE      (1 << 1)
+#define SM501_SYSCTRL_CRT_TRISTATE      (1 << 2)
 
-#define SM501_SYSCTRL_PCI_SLAVE_BURST_MASK (3<<4)
-#define SM501_SYSCTRL_PCI_SLAVE_BURST_1	(0<<4)
-#define SM501_SYSCTRL_PCI_SLAVE_BURST_2	(1<<4)
-#define SM501_SYSCTRL_PCI_SLAVE_BURST_4	(2<<4)
-#define SM501_SYSCTRL_PCI_SLAVE_BURST_8	(3<<4)
+#define SM501_SYSCTRL_PCI_SLAVE_BURST_MASK (3 << 4)
+#define SM501_SYSCTRL_PCI_SLAVE_BURST_1 (0 << 4)
+#define SM501_SYSCTRL_PCI_SLAVE_BURST_2 (1 << 4)
+#define SM501_SYSCTRL_PCI_SLAVE_BURST_4 (2 << 4)
+#define SM501_SYSCTRL_PCI_SLAVE_BURST_8 (3 << 4)
 
-#define SM501_SYSCTRL_PCI_CLOCK_RUN_EN	(1<<6)
-#define SM501_SYSCTRL_PCI_RETRY_DISABLE	(1<<7)
-#define SM501_SYSCTRL_PCI_SUBSYS_LOCK	(1<<11)
-#define SM501_SYSCTRL_PCI_BURST_READ_EN	(1<<15)
+#define SM501_SYSCTRL_PCI_CLOCK_RUN_EN  (1 << 6)
+#define SM501_SYSCTRL_PCI_RETRY_DISABLE (1 << 7)
+#define SM501_SYSCTRL_PCI_SUBSYS_LOCK   (1 << 11)
+#define SM501_SYSCTRL_PCI_BURST_READ_EN (1 << 15)
 
 /* miscellaneous control */
 
-#define SM501_MISC_CONTROL		(0x000004)
+#define SM501_MISC_CONTROL              (0x000004)
 
-#define SM501_MISC_BUS_SH		(0x0)
-#define SM501_MISC_BUS_PCI		(0x1)
-#define SM501_MISC_BUS_XSCALE		(0x2)
-#define SM501_MISC_BUS_NEC		(0x6)
-#define SM501_MISC_BUS_MASK		(0x7)
+#define SM501_MISC_BUS_SH               (0x0)
+#define SM501_MISC_BUS_PCI              (0x1)
+#define SM501_MISC_BUS_XSCALE           (0x2)
+#define SM501_MISC_BUS_NEC              (0x6)
+#define SM501_MISC_BUS_MASK             (0x7)
 
-#define SM501_MISC_VR_62MB		(1<<3)
-#define SM501_MISC_CDR_RESET		(1<<7)
-#define SM501_MISC_USB_LB		(1<<8)
-#define SM501_MISC_USB_SLAVE		(1<<9)
-#define SM501_MISC_BL_1			(1<<10)
-#define SM501_MISC_MC			(1<<11)
-#define SM501_MISC_DAC_POWER		(1<<12)
-#define SM501_MISC_IRQ_INVERT		(1<<16)
-#define SM501_MISC_SH			(1<<17)
+#define SM501_MISC_VR_62MB              (1 << 3)
+#define SM501_MISC_CDR_RESET            (1 << 7)
+#define SM501_MISC_USB_LB               (1 << 8)
+#define SM501_MISC_USB_SLAVE            (1 << 9)
+#define SM501_MISC_BL_1                 (1 << 10)
+#define SM501_MISC_MC                   (1 << 11)
+#define SM501_MISC_DAC_POWER            (1 << 12)
+#define SM501_MISC_IRQ_INVERT           (1 << 16)
+#define SM501_MISC_SH                   (1 << 17)
 
-#define SM501_MISC_HOLD_EMPTY		(0<<18)
-#define SM501_MISC_HOLD_8		(1<<18)
-#define SM501_MISC_HOLD_16		(2<<18)
-#define SM501_MISC_HOLD_24		(3<<18)
-#define SM501_MISC_HOLD_32		(4<<18)
-#define SM501_MISC_HOLD_MASK		(7<<18)
+#define SM501_MISC_HOLD_EMPTY           (0 << 18)
+#define SM501_MISC_HOLD_8               (1 << 18)
+#define SM501_MISC_HOLD_16              (2 << 18)
+#define SM501_MISC_HOLD_24              (3 << 18)
+#define SM501_MISC_HOLD_32              (4 << 18)
+#define SM501_MISC_HOLD_MASK            (7 << 18)
 
-#define SM501_MISC_FREQ_12		(1<<24)
-#define SM501_MISC_PNL_24BIT		(1<<25)
-#define SM501_MISC_8051_LE		(1<<26)
+#define SM501_MISC_FREQ_12              (1 << 24)
+#define SM501_MISC_PNL_24BIT            (1 << 25)
+#define SM501_MISC_8051_LE              (1 << 26)
 
 
 
-#define SM501_GPIO31_0_CONTROL		(0x000008)
-#define SM501_GPIO63_32_CONTROL		(0x00000C)
-#define SM501_DRAM_CONTROL		(0x000010)
+#define SM501_GPIO31_0_CONTROL          (0x000008)
+#define SM501_GPIO63_32_CONTROL         (0x00000C)
+#define SM501_DRAM_CONTROL              (0x000010)
 
 /* command list */
-#define SM501_ARBTRTN_CONTROL		(0x000014)
+#define SM501_ARBTRTN_CONTROL           (0x000014)
 
 /* command list */
-#define SM501_COMMAND_LIST_STATUS	(0x000024)
+#define SM501_COMMAND_LIST_STATUS       (0x000024)
 
 /* interrupt debug */
-#define SM501_RAW_IRQ_STATUS		(0x000028)
-#define SM501_RAW_IRQ_CLEAR		(0x000028)
-#define SM501_IRQ_STATUS		(0x00002C)
-#define SM501_IRQ_MASK			(0x000030)
-#define SM501_DEBUG_CONTROL		(0x000034)
+#define SM501_RAW_IRQ_STATUS            (0x000028)
+#define SM501_RAW_IRQ_CLEAR             (0x000028)
+#define SM501_IRQ_STATUS                (0x00002C)
+#define SM501_IRQ_MASK                  (0x000030)
+#define SM501_DEBUG_CONTROL             (0x000034)
 
 /* power management */
-#define SM501_POWERMODE_P2X_SRC		(1<<29)
-#define SM501_POWERMODE_V2X_SRC		(1<<20)
-#define SM501_POWERMODE_M_SRC		(1<<12)
-#define SM501_POWERMODE_M1_SRC		(1<<4)
-
-#define SM501_CURRENT_GATE		(0x000038)
-#define SM501_CURRENT_CLOCK		(0x00003C)
-#define SM501_POWER_MODE_0_GATE		(0x000040)
-#define SM501_POWER_MODE_0_CLOCK	(0x000044)
-#define SM501_POWER_MODE_1_GATE		(0x000048)
-#define SM501_POWER_MODE_1_CLOCK	(0x00004C)
-#define SM501_SLEEP_MODE_GATE		(0x000050)
-#define SM501_POWER_MODE_CONTROL	(0x000054)
+#define SM501_POWERMODE_P2X_SRC         (1 << 29)
+#define SM501_POWERMODE_V2X_SRC         (1 << 20)
+#define SM501_POWERMODE_M_SRC           (1 << 12)
+#define SM501_POWERMODE_M1_SRC          (1 << 4)
+
+#define SM501_CURRENT_GATE              (0x000038)
+#define SM501_CURRENT_CLOCK             (0x00003C)
+#define SM501_POWER_MODE_0_GATE         (0x000040)
+#define SM501_POWER_MODE_0_CLOCK        (0x000044)
+#define SM501_POWER_MODE_1_GATE         (0x000048)
+#define SM501_POWER_MODE_1_CLOCK        (0x00004C)
+#define SM501_SLEEP_MODE_GATE           (0x000050)
+#define SM501_POWER_MODE_CONTROL        (0x000054)
 
 /* power gates for units within the 501 */
-#define SM501_GATE_HOST			(0)
-#define SM501_GATE_MEMORY		(1)
-#define SM501_GATE_DISPLAY		(2)
-#define SM501_GATE_2D_ENGINE		(3)
-#define SM501_GATE_CSC			(4)
-#define SM501_GATE_ZVPORT		(5)
-#define SM501_GATE_GPIO			(6)
-#define SM501_GATE_UART0		(7)
-#define SM501_GATE_UART1		(8)
-#define SM501_GATE_SSP			(10)
-#define SM501_GATE_USB_HOST		(11)
-#define SM501_GATE_USB_GADGET		(12)
-#define SM501_GATE_UCONTROLLER		(17)
-#define SM501_GATE_AC97			(18)
+#define SM501_GATE_HOST                 (0)
+#define SM501_GATE_MEMORY               (1)
+#define SM501_GATE_DISPLAY              (2)
+#define SM501_GATE_2D_ENGINE            (3)
+#define SM501_GATE_CSC                  (4)
+#define SM501_GATE_ZVPORT               (5)
+#define SM501_GATE_GPIO                 (6)
+#define SM501_GATE_UART0                (7)
+#define SM501_GATE_UART1                (8)
+#define SM501_GATE_SSP                  (10)
+#define SM501_GATE_USB_HOST             (11)
+#define SM501_GATE_USB_GADGET           (12)
+#define SM501_GATE_UCONTROLLER          (17)
+#define SM501_GATE_AC97                 (18)
 
 /* panel clock */
-#define SM501_CLOCK_P2XCLK		(24)
+#define SM501_CLOCK_P2XCLK              (24)
 /* crt clock */
-#define SM501_CLOCK_V2XCLK		(16)
+#define SM501_CLOCK_V2XCLK              (16)
 /* main clock */
-#define SM501_CLOCK_MCLK		(8)
+#define SM501_CLOCK_MCLK                (8)
 /* SDRAM controller clock */
-#define SM501_CLOCK_M1XCLK		(0)
+#define SM501_CLOCK_M1XCLK              (0)
 
 /* config 2 */
-#define SM501_PCI_MASTER_BASE		(0x000058)
-#define SM501_ENDIAN_CONTROL		(0x00005C)
-#define SM501_DEVICEID			(0x000060)
+#define SM501_PCI_MASTER_BASE           (0x000058)
+#define SM501_ENDIAN_CONTROL            (0x00005C)
+#define SM501_DEVICEID                  (0x000060)
 /* 0x050100A0 */
 
-#define SM501_DEVICEID_SM501		(0x05010000)
-#define SM501_DEVICEID_IDMASK		(0xffff0000)
-#define SM501_DEVICEID_REVMASK		(0x000000ff)
+#define SM501_DEVICEID_SM501            (0x05010000)
+#define SM501_DEVICEID_IDMASK           (0xffff0000)
+#define SM501_DEVICEID_REVMASK          (0x000000ff)
 
-#define SM501_PLLCLOCK_COUNT		(0x000064)
-#define SM501_MISC_TIMING		(0x000068)
-#define SM501_CURRENT_SDRAM_CLOCK	(0x00006C)
+#define SM501_PLLCLOCK_COUNT            (0x000064)
+#define SM501_MISC_TIMING               (0x000068)
+#define SM501_CURRENT_SDRAM_CLOCK       (0x00006C)
 
-#define SM501_PROGRAMMABLE_PLL_CONTROL	(0x000074)
+#define SM501_PROGRAMMABLE_PLL_CONTROL  (0x000074)
 
 /* GPIO base */
-#define SM501_GPIO			(0x010000)
-#define SM501_GPIO_DATA_LOW		(0x00)
-#define SM501_GPIO_DATA_HIGH		(0x04)
-#define SM501_GPIO_DDR_LOW		(0x08)
-#define SM501_GPIO_DDR_HIGH		(0x0C)
-#define SM501_GPIO_IRQ_SETUP		(0x10)
-#define SM501_GPIO_IRQ_STATUS		(0x14)
-#define SM501_GPIO_IRQ_RESET		(0x14)
+#define SM501_GPIO                      (0x010000)
+#define SM501_GPIO_DATA_LOW             (0x00)
+#define SM501_GPIO_DATA_HIGH            (0x04)
+#define SM501_GPIO_DDR_LOW              (0x08)
+#define SM501_GPIO_DDR_HIGH             (0x0C)
+#define SM501_GPIO_IRQ_SETUP            (0x10)
+#define SM501_GPIO_IRQ_STATUS           (0x14)
+#define SM501_GPIO_IRQ_RESET            (0x14)
 
 /* I2C controller base */
-#define SM501_I2C			(0x010040)
-#define SM501_I2C_BYTE_COUNT		(0x00)
-#define SM501_I2C_CONTROL		(0x01)
-#define SM501_I2C_STATUS		(0x02)
-#define SM501_I2C_RESET			(0x02)
-#define SM501_I2C_SLAVE_ADDRESS		(0x03)
-#define SM501_I2C_DATA			(0x04)
+#define SM501_I2C                       (0x010040)
+#define SM501_I2C_BYTE_COUNT            (0x00)
+#define SM501_I2C_CONTROL               (0x01)
+#define SM501_I2C_STATUS                (0x02)
+#define SM501_I2C_RESET                 (0x02)
+#define SM501_I2C_SLAVE_ADDRESS         (0x03)
+#define SM501_I2C_DATA                  (0x04)
 
 /* SSP base */
-#define SM501_SSP			(0x020000)
+#define SM501_SSP                       (0x020000)
 
 /* Uart 0 base */
-#define SM501_UART0			(0x030000)
+#define SM501_UART0                     (0x030000)
 
 /* Uart 1 base */
-#define SM501_UART1			(0x030020)
+#define SM501_UART1                     (0x030020)
 
 /* USB host port base */
-#define SM501_USB_HOST			(0x040000)
+#define SM501_USB_HOST                  (0x040000)
 
 /* USB slave/gadget base */
-#define SM501_USB_GADGET		(0x060000)
+#define SM501_USB_GADGET                (0x060000)
 
 /* USB slave/gadget data port base */
-#define SM501_USB_GADGET_DATA		(0x070000)
+#define SM501_USB_GADGET_DATA           (0x070000)
 
 /* Display controller/video engine base */
-#define SM501_DC			(0x080000)
+#define SM501_DC                        (0x080000)
 
 /* common defines for the SM501 address registers */
-#define SM501_ADDR_FLIP			(1<<31)
-#define SM501_ADDR_EXT			(1<<27)
-#define SM501_ADDR_CS1			(1<<26)
-#define SM501_ADDR_MASK			(0x3f << 26)
+#define SM501_ADDR_FLIP                 (1 << 31)
+#define SM501_ADDR_EXT                  (1 << 27)
+#define SM501_ADDR_CS1                  (1 << 26)
+#define SM501_ADDR_MASK                 (0x3f << 26)
 
-#define SM501_FIFO_MASK			(0x3 << 16)
-#define SM501_FIFO_1			(0x0 << 16)
-#define SM501_FIFO_3			(0x1 << 16)
-#define SM501_FIFO_7			(0x2 << 16)
-#define SM501_FIFO_11			(0x3 << 16)
+#define SM501_FIFO_MASK                 (0x3 << 16)
+#define SM501_FIFO_1                    (0x0 << 16)
+#define SM501_FIFO_3                    (0x1 << 16)
+#define SM501_FIFO_7                    (0x2 << 16)
+#define SM501_FIFO_11                   (0x3 << 16)
 
 /* common registers for panel and the crt */
-#define SM501_OFF_DC_H_TOT		(0x000)
-#define SM501_OFF_DC_V_TOT		(0x008)
-#define SM501_OFF_DC_H_SYNC		(0x004)
-#define SM501_OFF_DC_V_SYNC		(0x00C)
-
-#define SM501_DC_PANEL_CONTROL		(0x000)
-
-#define SM501_DC_PANEL_CONTROL_FPEN	(1<<27)
-#define SM501_DC_PANEL_CONTROL_BIAS	(1<<26)
-#define SM501_DC_PANEL_CONTROL_DATA	(1<<25)
-#define SM501_DC_PANEL_CONTROL_VDD	(1<<24)
-#define SM501_DC_PANEL_CONTROL_DP	(1<<23)
-
-#define SM501_DC_PANEL_CONTROL_TFT_888	(0<<21)
-#define SM501_DC_PANEL_CONTROL_TFT_333	(1<<21)
-#define SM501_DC_PANEL_CONTROL_TFT_444	(2<<21)
-
-#define SM501_DC_PANEL_CONTROL_DE	(1<<20)
-
-#define SM501_DC_PANEL_CONTROL_LCD_TFT	(0<<18)
-#define SM501_DC_PANEL_CONTROL_LCD_STN8	(1<<18)
-#define SM501_DC_PANEL_CONTROL_LCD_STN12 (2<<18)
-
-#define SM501_DC_PANEL_CONTROL_CP	(1<<14)
-#define SM501_DC_PANEL_CONTROL_VSP	(1<<13)
-#define SM501_DC_PANEL_CONTROL_HSP	(1<<12)
-#define SM501_DC_PANEL_CONTROL_CK	(1<<9)
-#define SM501_DC_PANEL_CONTROL_TE	(1<<8)
-#define SM501_DC_PANEL_CONTROL_VPD	(1<<7)
-#define SM501_DC_PANEL_CONTROL_VP	(1<<6)
-#define SM501_DC_PANEL_CONTROL_HPD	(1<<5)
-#define SM501_DC_PANEL_CONTROL_HP	(1<<4)
-#define SM501_DC_PANEL_CONTROL_GAMMA	(1<<3)
-#define SM501_DC_PANEL_CONTROL_EN	(1<<2)
-
-#define SM501_DC_PANEL_CONTROL_8BPP	(0<<0)
-#define SM501_DC_PANEL_CONTROL_16BPP	(1<<0)
-#define SM501_DC_PANEL_CONTROL_32BPP	(2<<0)
-
-
-#define SM501_DC_PANEL_PANNING_CONTROL	(0x004)
-#define SM501_DC_PANEL_COLOR_KEY	(0x008)
-#define SM501_DC_PANEL_FB_ADDR		(0x00C)
-#define SM501_DC_PANEL_FB_OFFSET	(0x010)
-#define SM501_DC_PANEL_FB_WIDTH		(0x014)
-#define SM501_DC_PANEL_FB_HEIGHT	(0x018)
-#define SM501_DC_PANEL_TL_LOC		(0x01C)
-#define SM501_DC_PANEL_BR_LOC		(0x020)
-#define SM501_DC_PANEL_H_TOT		(0x024)
-#define SM501_DC_PANEL_H_SYNC		(0x028)
-#define SM501_DC_PANEL_V_TOT		(0x02C)
-#define SM501_DC_PANEL_V_SYNC		(0x030)
-#define SM501_DC_PANEL_CUR_LINE		(0x034)
-
-#define SM501_DC_VIDEO_CONTROL		(0x040)
-#define SM501_DC_VIDEO_FB0_ADDR		(0x044)
-#define SM501_DC_VIDEO_FB_WIDTH		(0x048)
-#define SM501_DC_VIDEO_FB0_LAST_ADDR	(0x04C)
-#define SM501_DC_VIDEO_TL_LOC		(0x050)
-#define SM501_DC_VIDEO_BR_LOC		(0x054)
-#define SM501_DC_VIDEO_SCALE		(0x058)
-#define SM501_DC_VIDEO_INIT_SCALE	(0x05C)
-#define SM501_DC_VIDEO_YUV_CONSTANTS	(0x060)
-#define SM501_DC_VIDEO_FB1_ADDR		(0x064)
-#define SM501_DC_VIDEO_FB1_LAST_ADDR	(0x068)
-
-#define SM501_DC_VIDEO_ALPHA_CONTROL	(0x080)
-#define SM501_DC_VIDEO_ALPHA_FB_ADDR	(0x084)
-#define SM501_DC_VIDEO_ALPHA_FB_OFFSET	(0x088)
-#define SM501_DC_VIDEO_ALPHA_FB_LAST_ADDR	(0x08C)
-#define SM501_DC_VIDEO_ALPHA_TL_LOC	(0x090)
-#define SM501_DC_VIDEO_ALPHA_BR_LOC	(0x094)
-#define SM501_DC_VIDEO_ALPHA_SCALE	(0x098)
-#define SM501_DC_VIDEO_ALPHA_INIT_SCALE	(0x09C)
-#define SM501_DC_VIDEO_ALPHA_CHROMA_KEY	(0x0A0)
-#define SM501_DC_VIDEO_ALPHA_COLOR_LOOKUP	(0x0A4)
-
-#define SM501_DC_PANEL_HWC_BASE		(0x0F0)
-#define SM501_DC_PANEL_HWC_ADDR		(0x0F0)
-#define SM501_DC_PANEL_HWC_LOC		(0x0F4)
-#define SM501_DC_PANEL_HWC_COLOR_1_2	(0x0F8)
-#define SM501_DC_PANEL_HWC_COLOR_3	(0x0FC)
-
-#define SM501_HWC_EN			(1<<31)
-
-#define SM501_OFF_HWC_ADDR		(0x00)
-#define SM501_OFF_HWC_LOC		(0x04)
-#define SM501_OFF_HWC_COLOR_1_2		(0x08)
-#define SM501_OFF_HWC_COLOR_3		(0x0C)
-
-#define SM501_DC_ALPHA_CONTROL		(0x100)
-#define SM501_DC_ALPHA_FB_ADDR		(0x104)
-#define SM501_DC_ALPHA_FB_OFFSET	(0x108)
-#define SM501_DC_ALPHA_TL_LOC		(0x10C)
-#define SM501_DC_ALPHA_BR_LOC		(0x110)
-#define SM501_DC_ALPHA_CHROMA_KEY	(0x114)
-#define SM501_DC_ALPHA_COLOR_LOOKUP	(0x118)
-
-#define SM501_DC_CRT_CONTROL		(0x200)
-
-#define SM501_DC_CRT_CONTROL_TVP	(1<<15)
-#define SM501_DC_CRT_CONTROL_CP		(1<<14)
-#define SM501_DC_CRT_CONTROL_VSP	(1<<13)
-#define SM501_DC_CRT_CONTROL_HSP	(1<<12)
-#define SM501_DC_CRT_CONTROL_VS		(1<<11)
-#define SM501_DC_CRT_CONTROL_BLANK	(1<<10)
-#define SM501_DC_CRT_CONTROL_SEL	(1<<9)
-#define SM501_DC_CRT_CONTROL_TE		(1<<8)
+#define SM501_OFF_DC_H_TOT              (0x000)
+#define SM501_OFF_DC_V_TOT              (0x008)
+#define SM501_OFF_DC_H_SYNC             (0x004)
+#define SM501_OFF_DC_V_SYNC             (0x00C)
+
+#define SM501_DC_PANEL_CONTROL          (0x000)
+
+#define SM501_DC_PANEL_CONTROL_FPEN     (1 << 27)
+#define SM501_DC_PANEL_CONTROL_BIAS     (1 << 26)
+#define SM501_DC_PANEL_CONTROL_DATA     (1 << 25)
+#define SM501_DC_PANEL_CONTROL_VDD      (1 << 24)
+#define SM501_DC_PANEL_CONTROL_DP       (1 << 23)
+
+#define SM501_DC_PANEL_CONTROL_TFT_888  (0 << 21)
+#define SM501_DC_PANEL_CONTROL_TFT_333  (1 << 21)
+#define SM501_DC_PANEL_CONTROL_TFT_444  (2 << 21)
+
+#define SM501_DC_PANEL_CONTROL_DE       (1 << 20)
+
+#define SM501_DC_PANEL_CONTROL_LCD_TFT  (0 << 18)
+#define SM501_DC_PANEL_CONTROL_LCD_STN8 (1 << 18)
+#define SM501_DC_PANEL_CONTROL_LCD_STN12 (2 << 18)
+
+#define SM501_DC_PANEL_CONTROL_CP       (1 << 14)
+#define SM501_DC_PANEL_CONTROL_VSP      (1 << 13)
+#define SM501_DC_PANEL_CONTROL_HSP      (1 << 12)
+#define SM501_DC_PANEL_CONTROL_CK       (1 << 9)
+#define SM501_DC_PANEL_CONTROL_TE       (1 << 8)
+#define SM501_DC_PANEL_CONTROL_VPD      (1 << 7)
+#define SM501_DC_PANEL_CONTROL_VP       (1 << 6)
+#define SM501_DC_PANEL_CONTROL_HPD      (1 << 5)
+#define SM501_DC_PANEL_CONTROL_HP       (1 << 4)
+#define SM501_DC_PANEL_CONTROL_GAMMA    (1 << 3)
+#define SM501_DC_PANEL_CONTROL_EN       (1 << 2)
+
+#define SM501_DC_PANEL_CONTROL_8BPP     (0 << 0)
+#define SM501_DC_PANEL_CONTROL_16BPP    (1 << 0)
+#define SM501_DC_PANEL_CONTROL_32BPP    (2 << 0)
+
+
+#define SM501_DC_PANEL_PANNING_CONTROL  (0x004)
+#define SM501_DC_PANEL_COLOR_KEY        (0x008)
+#define SM501_DC_PANEL_FB_ADDR          (0x00C)
+#define SM501_DC_PANEL_FB_OFFSET        (0x010)
+#define SM501_DC_PANEL_FB_WIDTH         (0x014)
+#define SM501_DC_PANEL_FB_HEIGHT        (0x018)
+#define SM501_DC_PANEL_TL_LOC           (0x01C)
+#define SM501_DC_PANEL_BR_LOC           (0x020)
+#define SM501_DC_PANEL_H_TOT            (0x024)
+#define SM501_DC_PANEL_H_SYNC           (0x028)
+#define SM501_DC_PANEL_V_TOT            (0x02C)
+#define SM501_DC_PANEL_V_SYNC           (0x030)
+#define SM501_DC_PANEL_CUR_LINE         (0x034)
+
+#define SM501_DC_VIDEO_CONTROL          (0x040)
+#define SM501_DC_VIDEO_FB0_ADDR         (0x044)
+#define SM501_DC_VIDEO_FB_WIDTH         (0x048)
+#define SM501_DC_VIDEO_FB0_LAST_ADDR    (0x04C)
+#define SM501_DC_VIDEO_TL_LOC           (0x050)
+#define SM501_DC_VIDEO_BR_LOC           (0x054)
+#define SM501_DC_VIDEO_SCALE            (0x058)
+#define SM501_DC_VIDEO_INIT_SCALE       (0x05C)
+#define SM501_DC_VIDEO_YUV_CONSTANTS    (0x060)
+#define SM501_DC_VIDEO_FB1_ADDR         (0x064)
+#define SM501_DC_VIDEO_FB1_LAST_ADDR    (0x068)
+
+#define SM501_DC_VIDEO_ALPHA_CONTROL    (0x080)
+#define SM501_DC_VIDEO_ALPHA_FB_ADDR    (0x084)
+#define SM501_DC_VIDEO_ALPHA_FB_OFFSET  (0x088)
+#define SM501_DC_VIDEO_ALPHA_FB_LAST_ADDR (0x08C)
+#define SM501_DC_VIDEO_ALPHA_TL_LOC     (0x090)
+#define SM501_DC_VIDEO_ALPHA_BR_LOC     (0x094)
+#define SM501_DC_VIDEO_ALPHA_SCALE      (0x098)
+#define SM501_DC_VIDEO_ALPHA_INIT_SCALE (0x09C)
+#define SM501_DC_VIDEO_ALPHA_CHROMA_KEY (0x0A0)
+#define SM501_DC_VIDEO_ALPHA_COLOR_LOOKUP (0x0A4)
+
+#define SM501_DC_PANEL_HWC_BASE         (0x0F0)
+#define SM501_DC_PANEL_HWC_ADDR         (0x0F0)
+#define SM501_DC_PANEL_HWC_LOC          (0x0F4)
+#define SM501_DC_PANEL_HWC_COLOR_1_2    (0x0F8)
+#define SM501_DC_PANEL_HWC_COLOR_3      (0x0FC)
+
+#define SM501_HWC_EN                    (1 << 31)
+
+#define SM501_OFF_HWC_ADDR              (0x00)
+#define SM501_OFF_HWC_LOC               (0x04)
+#define SM501_OFF_HWC_COLOR_1_2         (0x08)
+#define SM501_OFF_HWC_COLOR_3           (0x0C)
+
+#define SM501_DC_ALPHA_CONTROL          (0x100)
+#define SM501_DC_ALPHA_FB_ADDR          (0x104)
+#define SM501_DC_ALPHA_FB_OFFSET        (0x108)
+#define SM501_DC_ALPHA_TL_LOC           (0x10C)
+#define SM501_DC_ALPHA_BR_LOC           (0x110)
+#define SM501_DC_ALPHA_CHROMA_KEY       (0x114)
+#define SM501_DC_ALPHA_COLOR_LOOKUP     (0x118)
+
+#define SM501_DC_CRT_CONTROL            (0x200)
+
+#define SM501_DC_CRT_CONTROL_TVP        (1 << 15)
+#define SM501_DC_CRT_CONTROL_CP         (1 << 14)
+#define SM501_DC_CRT_CONTROL_VSP        (1 << 13)
+#define SM501_DC_CRT_CONTROL_HSP        (1 << 12)
+#define SM501_DC_CRT_CONTROL_VS         (1 << 11)
+#define SM501_DC_CRT_CONTROL_BLANK      (1 << 10)
+#define SM501_DC_CRT_CONTROL_SEL        (1 << 9)
+#define SM501_DC_CRT_CONTROL_TE         (1 << 8)
 #define SM501_DC_CRT_CONTROL_PIXEL_MASK (0xF << 4)
-#define SM501_DC_CRT_CONTROL_GAMMA	(1<<3)
-#define SM501_DC_CRT_CONTROL_ENABLE	(1<<2)
+#define SM501_DC_CRT_CONTROL_GAMMA      (1 << 3)
+#define SM501_DC_CRT_CONTROL_ENABLE     (1 << 2)
 
-#define SM501_DC_CRT_CONTROL_8BPP	(0<<0)
-#define SM501_DC_CRT_CONTROL_16BPP	(1<<0)
-#define SM501_DC_CRT_CONTROL_32BPP	(2<<0)
+#define SM501_DC_CRT_CONTROL_8BPP       (0 << 0)
+#define SM501_DC_CRT_CONTROL_16BPP      (1 << 0)
+#define SM501_DC_CRT_CONTROL_32BPP      (2 << 0)
 
-#define SM501_DC_CRT_FB_ADDR		(0x204)
-#define SM501_DC_CRT_FB_OFFSET		(0x208)
-#define SM501_DC_CRT_H_TOT		(0x20C)
-#define SM501_DC_CRT_H_SYNC		(0x210)
-#define SM501_DC_CRT_V_TOT		(0x214)
-#define SM501_DC_CRT_V_SYNC		(0x218)
-#define SM501_DC_CRT_SIGNATURE_ANALYZER	(0x21C)
-#define SM501_DC_CRT_CUR_LINE		(0x220)
-#define SM501_DC_CRT_MONITOR_DETECT	(0x224)
+#define SM501_DC_CRT_FB_ADDR            (0x204)
+#define SM501_DC_CRT_FB_OFFSET          (0x208)
+#define SM501_DC_CRT_H_TOT              (0x20C)
+#define SM501_DC_CRT_H_SYNC             (0x210)
+#define SM501_DC_CRT_V_TOT              (0x214)
+#define SM501_DC_CRT_V_SYNC             (0x218)
+#define SM501_DC_CRT_SIGNATURE_ANALYZER (0x21C)
+#define SM501_DC_CRT_CUR_LINE           (0x220)
+#define SM501_DC_CRT_MONITOR_DETECT     (0x224)
 
-#define SM501_DC_CRT_HWC_BASE		(0x230)
-#define SM501_DC_CRT_HWC_ADDR		(0x230)
-#define SM501_DC_CRT_HWC_LOC		(0x234)
-#define SM501_DC_CRT_HWC_COLOR_1_2	(0x238)
-#define SM501_DC_CRT_HWC_COLOR_3	(0x23C)
+#define SM501_DC_CRT_HWC_BASE           (0x230)
+#define SM501_DC_CRT_HWC_ADDR           (0x230)
+#define SM501_DC_CRT_HWC_LOC            (0x234)
+#define SM501_DC_CRT_HWC_COLOR_1_2      (0x238)
+#define SM501_DC_CRT_HWC_COLOR_3        (0x23C)
 
-#define SM501_DC_PANEL_PALETTE		(0x400)
+#define SM501_DC_PANEL_PALETTE          (0x400)
 
-#define SM501_DC_VIDEO_PALETTE		(0x800)
+#define SM501_DC_VIDEO_PALETTE          (0x800)
 
-#define SM501_DC_CRT_PALETTE		(0xC00)
+#define SM501_DC_CRT_PALETTE            (0xC00)
 
 /* Zoom Video port base */
-#define SM501_ZVPORT			(0x090000)
+#define SM501_ZVPORT                    (0x090000)
 
 /* AC97/I2S base */
-#define SM501_AC97			(0x0A0000)
+#define SM501_AC97                      (0x0A0000)
 
 /* 8051 micro controller base */
-#define SM501_UCONTROLLER		(0x0B0000)
+#define SM501_UCONTROLLER               (0x0B0000)
 
 /* 8051 micro controller SRAM base */
-#define SM501_UCONTROLLER_SRAM		(0x0C0000)
+#define SM501_UCONTROLLER_SRAM          (0x0C0000)
 
 /* DMA base */
-#define SM501_DMA			(0x0D0000)
+#define SM501_DMA                       (0x0D0000)
 
 /* 2d engine base */
-#define SM501_2D_ENGINE			(0x100000)
-#define SM501_2D_SOURCE			(0x00)
-#define SM501_2D_DESTINATION		(0x04)
-#define SM501_2D_DIMENSION		(0x08)
-#define SM501_2D_CONTROL		(0x0C)
-#define SM501_2D_PITCH			(0x10)
-#define SM501_2D_FOREGROUND		(0x14)
-#define SM501_2D_BACKGROUND		(0x18)
-#define SM501_2D_STRETCH		(0x1C)
-#define SM501_2D_COLOR_COMPARE		(0x20)
-#define SM501_2D_COLOR_COMPARE_MASK 	(0x24)
-#define SM501_2D_MASK			(0x28)
-#define SM501_2D_CLIP_TL		(0x2C)
-#define SM501_2D_CLIP_BR		(0x30)
-#define SM501_2D_MONO_PATTERN_LOW	(0x34)
-#define SM501_2D_MONO_PATTERN_HIGH	(0x38)
-#define SM501_2D_WINDOW_WIDTH		(0x3C)
-#define SM501_2D_SOURCE_BASE		(0x40)
-#define SM501_2D_DESTINATION_BASE	(0x44)
-#define SM501_2D_ALPHA			(0x48)
-#define SM501_2D_WRAP			(0x4C)
-#define SM501_2D_STATUS			(0x50)
-
-#define SM501_CSC_Y_SOURCE_BASE		(0xC8)
-#define SM501_CSC_CONSTANTS		(0xCC)
-#define SM501_CSC_Y_SOURCE_X		(0xD0)
-#define SM501_CSC_Y_SOURCE_Y		(0xD4)
-#define SM501_CSC_U_SOURCE_BASE		(0xD8)
-#define SM501_CSC_V_SOURCE_BASE		(0xDC)
-#define SM501_CSC_SOURCE_DIMENSION	(0xE0)
-#define SM501_CSC_SOURCE_PITCH		(0xE4)
-#define SM501_CSC_DESTINATION		(0xE8)
-#define SM501_CSC_DESTINATION_DIMENSION	(0xEC)
-#define SM501_CSC_DESTINATION_PITCH	(0xF0)
-#define SM501_CSC_SCALE_FACTOR		(0xF4)
-#define SM501_CSC_DESTINATION_BASE	(0xF8)
-#define SM501_CSC_CONTROL		(0xFC)
+#define SM501_2D_ENGINE                 (0x100000)
+#define SM501_2D_SOURCE                 (0x00)
+#define SM501_2D_DESTINATION            (0x04)
+#define SM501_2D_DIMENSION              (0x08)
+#define SM501_2D_CONTROL                (0x0C)
+#define SM501_2D_PITCH                  (0x10)
+#define SM501_2D_FOREGROUND             (0x14)
+#define SM501_2D_BACKGROUND             (0x18)
+#define SM501_2D_STRETCH                (0x1C)
+#define SM501_2D_COLOR_COMPARE          (0x20)
+#define SM501_2D_COLOR_COMPARE_MASK     (0x24)
+#define SM501_2D_MASK                   (0x28)
+#define SM501_2D_CLIP_TL                (0x2C)
+#define SM501_2D_CLIP_BR                (0x30)
+#define SM501_2D_MONO_PATTERN_LOW       (0x34)
+#define SM501_2D_MONO_PATTERN_HIGH      (0x38)
+#define SM501_2D_WINDOW_WIDTH           (0x3C)
+#define SM501_2D_SOURCE_BASE            (0x40)
+#define SM501_2D_DESTINATION_BASE       (0x44)
+#define SM501_2D_ALPHA                  (0x48)
+#define SM501_2D_WRAP                   (0x4C)
+#define SM501_2D_STATUS                 (0x50)
+
+#define SM501_CSC_Y_SOURCE_BASE         (0xC8)
+#define SM501_CSC_CONSTANTS             (0xCC)
+#define SM501_CSC_Y_SOURCE_X            (0xD0)
+#define SM501_CSC_Y_SOURCE_Y            (0xD4)
+#define SM501_CSC_U_SOURCE_BASE         (0xD8)
+#define SM501_CSC_V_SOURCE_BASE         (0xDC)
+#define SM501_CSC_SOURCE_DIMENSION      (0xE0)
+#define SM501_CSC_SOURCE_PITCH          (0xE4)
+#define SM501_CSC_DESTINATION           (0xE8)
+#define SM501_CSC_DESTINATION_DIMENSION (0xEC)
+#define SM501_CSC_DESTINATION_PITCH     (0xF0)
+#define SM501_CSC_SCALE_FACTOR          (0xF4)
+#define SM501_CSC_DESTINATION_BASE      (0xF8)
+#define SM501_CSC_CONTROL               (0xFC)
 
 /* 2d engine data port base */
-#define SM501_2D_ENGINE_DATA		(0x110000)
+#define SM501_2D_ENGINE_DATA            (0x110000)
 
 /* end of register definitions */
 
@@ -446,12 +453,12 @@
 
 /* SM501 local memory size taken from "linux/drivers/mfd/sm501.c" */
 static const uint32_t sm501_mem_local_size[] = {
-	[0]	= 4*1024*1024,
-	[1]	= 8*1024*1024,
-	[2]	= 16*1024*1024,
-	[3]	= 32*1024*1024,
-	[4]	= 64*1024*1024,
-	[5]	= 2*1024*1024,
+    [0] = 4 * M_BYTE,
+    [1] = 8 * M_BYTE,
+    [2] = 16 * M_BYTE,
+    [3] = 32 * M_BYTE,
+    [4] = 64 * M_BYTE,
+    [5] = 2 * M_BYTE,
 };
 #define get_local_mem_size(s) sm501_mem_local_size[(s)->local_mem_size_index]
 
@@ -460,10 +467,13 @@ typedef struct SM501State {
     QemuConsole *con;
 
     /* status & internal resources */
-    hwaddr base;
     uint32_t local_mem_size_index;
-    uint8_t * local_mem;
+    uint8_t *local_mem;
     MemoryRegion local_mem_region;
+    MemoryRegion mmio_region;
+    MemoryRegion system_config_region;
+    MemoryRegion disp_ctrl_region;
+    MemoryRegion twoD_engine_region;
     uint32_t last_width;
     uint32_t last_height;
 
@@ -473,6 +483,7 @@ typedef struct SM501State {
     uint32_t gpio_31_0_control;
     uint32_t gpio_63_32_control;
     uint32_t dram_control;
+    uint32_t arbitration_control;
     uint32_t irq_mask;
     uint32_t misc_timing;
     uint32_t power_mode_control;
@@ -482,7 +493,7 @@ typedef struct SM501State {
     uint32_t uart0_mcr;
     uint32_t uart0_scr;
 
-    uint8_t dc_palette[0x400 * 3];
+    uint8_t dc_palette[DC_PALETTE_ENTRIES];
 
     uint32_t dc_panel_control;
     uint32_t dc_panel_panning_control;
@@ -502,6 +513,8 @@ typedef struct SM501State {
     uint32_t dc_panel_hwc_color_1_2;
     uint32_t dc_panel_hwc_color_3;
 
+    uint32_t dc_video_control;
+
     uint32_t dc_crt_control;
     uint32_t dc_crt_fb_addr;
     uint32_t dc_crt_fb_offset;
@@ -521,13 +534,20 @@ typedef struct SM501State {
     uint32_t twoD_control;
     uint32_t twoD_pitch;
     uint32_t twoD_foreground;
+    uint32_t twoD_background;
     uint32_t twoD_stretch;
+    uint32_t twoD_color_compare;
     uint32_t twoD_color_compare_mask;
     uint32_t twoD_mask;
+    uint32_t twoD_clip_tl;
+    uint32_t twoD_clip_br;
+    uint32_t twoD_mono_pattern_low;
+    uint32_t twoD_mono_pattern_high;
     uint32_t twoD_window_width;
     uint32_t twoD_source_base;
     uint32_t twoD_destination_base;
-
+    uint32_t twoD_alpha;
+    uint32_t twoD_wrap;
 } SM501State;
 
 static uint32_t get_local_mem_size_index(uint32_t size)
@@ -536,18 +556,36 @@ static uint32_t get_local_mem_size_index(uint32_t size)
     int i, index = 0;
 
     for (i = 0; i < ARRAY_SIZE(sm501_mem_local_size); i++) {
-	uint32_t new_size = sm501_mem_local_size[i];
-	if (new_size >= size) {
-	    if (norm_size == 0 || norm_size > new_size) {
-		norm_size = new_size;
-		index = i;
-	    }
-	}
+        uint32_t new_size = sm501_mem_local_size[i];
+        if (new_size >= size) {
+            if (norm_size == 0 || norm_size > new_size) {
+                norm_size = new_size;
+                index = i;
+            }
+        }
     }
 
     return index;
 }
 
+static inline int get_width(SM501State *s, int crt)
+{
+    int width = crt ? s->dc_crt_h_total : s->dc_panel_h_total;
+    return (width & 0x00000FFF) + 1;
+}
+
+static inline int get_height(SM501State *s, int crt)
+{
+    int height = crt ? s->dc_crt_v_total : s->dc_panel_v_total;
+    return (height & 0x00000FFF) + 1;
+}
+
+static inline int get_bpp(SM501State *s, int crt)
+{
+    int bpp = crt ? s->dc_crt_control : s->dc_panel_control;
+    return 1 << (bpp & 3);
+}
+
 /**
  * Check the availability of hardware cursor.
  * @param crt  0 for PANEL, 1 for CRT.
@@ -555,17 +593,17 @@ static uint32_t get_local_mem_size_index(uint32_t size)
 static inline int is_hwc_enabled(SM501State *state, int crt)
 {
     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
-    return addr & 0x80000000;
+    return addr & SM501_HWC_EN;
 }
 
 /**
  * Get the address which holds cursor pattern data.
  * @param crt  0 for PANEL, 1 for CRT.
  */
-static inline uint32_t get_hwc_address(SM501State *state, int crt)
+static inline uint8_t *get_hwc_address(SM501State *state, int crt)
 {
     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
-    return (addr & 0x03FFFFF0)/* >> 4*/;
+    return state->local_mem + (addr & 0x03FFFFF0);
 }
 
 /**
@@ -591,53 +629,51 @@ static inline uint32_t get_hwc_x(SM501State *state, int crt)
 }
 
 /**
- * Get the cursor position in x coordinate.
+ * Get the hardware cursor palette.
  * @param crt  0 for PANEL, 1 for CRT.
- * @param index  0, 1, 2 or 3 which specifies color of corsor dot.
+ * @param palette  pointer to a [3 * 3] array to store color values in
  */
-static inline uint16_t get_hwc_color(SM501State *state, int crt, int index)
+static inline void get_hwc_palette(SM501State *state, int crt, uint8_t *palette)
 {
-    uint32_t color_reg = 0;
-    uint16_t color_565 = 0;
-
-    if (index == 0) {
-        return 0;
-    }
-
-    switch (index) {
-    case 1:
-    case 2:
-        color_reg = crt ? state->dc_crt_hwc_color_1_2
-                        : state->dc_panel_hwc_color_1_2;
-        break;
-    case 3:
-        color_reg = crt ? state->dc_crt_hwc_color_3
-                        : state->dc_panel_hwc_color_3;
-        break;
-    default:
-        printf("invalid hw cursor color.\n");
-        abort();
-    }
+    int i;
+    uint32_t color_reg;
+    uint16_t rgb565;
+
+    for (i = 0; i < 3; i++) {
+        if (i + 1 == 3) {
+            color_reg = crt ? state->dc_crt_hwc_color_3
+                            : state->dc_panel_hwc_color_3;
+        } else {
+            color_reg = crt ? state->dc_crt_hwc_color_1_2
+                            : state->dc_panel_hwc_color_1_2;
+        }
 
-    switch (index) {
-    case 1:
-    case 3:
-        color_565 = (uint16_t)(color_reg & 0xFFFF);
-        break;
-    case 2:
-        color_565 = (uint16_t)((color_reg >> 16) & 0xFFFF);
-        break;
+        if (i + 1 == 2) {
+            rgb565 = (color_reg >> 16) & 0xFFFF;
+        } else {
+            rgb565 = color_reg & 0xFFFF;
+        }
+        palette[i * 3 + 0] = (rgb565 << 3) & 0xf8; /* red */
+        palette[i * 3 + 1] = (rgb565 >> 3) & 0xfc; /* green */
+        palette[i * 3 + 2] = (rgb565 >> 8) & 0xf8; /* blue */
     }
-    return color_565;
 }
 
-static int within_hwc_y_range(SM501State *state, int y, int crt)
+static inline void hwc_invalidate(SM501State *s, int crt)
 {
-    int hwc_y = get_hwc_y(state, crt);
-    return (hwc_y <= y && y < hwc_y + SM501_HWC_HEIGHT);
+    int w = get_width(s, crt);
+    int h = get_height(s, crt);
+    int bpp = get_bpp(s, crt);
+    int start = get_hwc_y(s, crt);
+    int end = MIN(h, start + SM501_HWC_HEIGHT) + 1;
+
+    start *= w * bpp;
+    end *= w * bpp;
+
+    memory_region_set_dirty(&s->local_mem_region, start, end - start);
 }
 
-static void sm501_2d_operation(SM501State * s)
+static void sm501_2d_operation(SM501State *s)
 {
     /* obtain operation parameters */
     int operation = (s->twoD_control >> 16) & 0x1f;
@@ -653,8 +689,8 @@ static void sm501_2d_operation(SM501State * s)
     int addressing = (s->twoD_stretch >> 16) & 0xF;
 
     /* get frame buffer info */
-    uint8_t * src = s->local_mem + (s->twoD_source_base & 0x03FFFFFF);
-    uint8_t * dst = s->local_mem + (s->twoD_destination_base & 0x03FFFFFF);
+    uint8_t *src = s->local_mem + (s->twoD_source_base & 0x03FFFFFF);
+    uint8_t *dst = s->local_mem + (s->twoD_destination_base & 0x03FFFFFF);
     int src_width = (s->dc_crt_h_total & 0x00000FFF) + 1;
     int dst_width = (s->dc_crt_h_total & 0x00000FFF) + 1;
 
@@ -671,20 +707,20 @@ static void sm501_2d_operation(SM501State * s)
 
     switch (operation) {
     case 0x00: /* copy area */
-#define COPY_AREA(_bpp, _pixel_type, rtl) {                                 \
-        int y, x, index_d, index_s;                                         \
-        for (y = 0; y < operation_height; y++) {                            \
-            for (x = 0; x < operation_width; x++) {                         \
-                if (rtl) {                                                  \
-                    index_s = ((src_y - y) * src_width + src_x - x) * _bpp; \
-                    index_d = ((dst_y - y) * dst_width + dst_x - x) * _bpp; \
-                } else {                                                    \
-                    index_s = ((src_y + y) * src_width + src_x + x) * _bpp; \
-                    index_d = ((dst_y + y) * dst_width + dst_x + x) * _bpp; \
-                }                                                           \
-                *(_pixel_type*)&dst[index_d] = *(_pixel_type*)&src[index_s];\
-            }                                                               \
-        }                                                                   \
+#define COPY_AREA(_bpp, _pixel_type, rtl) {                                   \
+        int y, x, index_d, index_s;                                           \
+        for (y = 0; y < operation_height; y++) {                              \
+            for (x = 0; x < operation_width; x++) {                           \
+                if (rtl) {                                                    \
+                    index_s = ((src_y - y) * src_width + src_x - x) * _bpp;   \
+                    index_d = ((dst_y - y) * dst_width + dst_x - x) * _bpp;   \
+                } else {                                                      \
+                    index_s = ((src_y + y) * src_width + src_x + x) * _bpp;   \
+                    index_d = ((dst_y + y) * dst_width + dst_x + x) * _bpp;   \
+                }                                                             \
+                *(_pixel_type *)&dst[index_d] = *(_pixel_type *)&src[index_s];\
+            }                                                                 \
+        }                                                                     \
     }
         switch (format_flags) {
         case 0:
@@ -705,7 +741,7 @@ static void sm501_2d_operation(SM501State * s)
         for (y = 0; y < operation_height; y++) {                            \
             for (x = 0; x < operation_width; x++) {                         \
                 int index = ((dst_y + y) * dst_width + dst_x + x) * _bpp;   \
-                *(_pixel_type*)&dst[index] = (_pixel_type)color;            \
+                *(_pixel_type *)&dst[index] = (_pixel_type)color;           \
             }                                                               \
         }                                                                   \
     }
@@ -733,50 +769,53 @@ static void sm501_2d_operation(SM501State * s)
 static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
                                          unsigned size)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     uint32_t ret = 0;
     SM501_DPRINTF("sm501 system config regs : read addr=%x\n", (int)addr);
 
-    switch(addr) {
+    switch (addr) {
     case SM501_SYSTEM_CONTROL:
-	ret = s->system_control;
-	break;
+        ret = s->system_control;
+        break;
     case SM501_MISC_CONTROL:
-	ret = s->misc_control;
-	break;
+        ret = s->misc_control;
+        break;
     case SM501_GPIO31_0_CONTROL:
-	ret = s->gpio_31_0_control;
-	break;
+        ret = s->gpio_31_0_control;
+        break;
     case SM501_GPIO63_32_CONTROL:
-	ret = s->gpio_63_32_control;
-	break;
+        ret = s->gpio_63_32_control;
+        break;
     case SM501_DEVICEID:
-	ret = 0x050100A0;
-	break;
+        ret = 0x050100A0;
+        break;
     case SM501_DRAM_CONTROL:
-	ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
-	break;
+        ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
+        break;
+    case SM501_ARBTRTN_CONTROL:
+        ret = s->arbitration_control;
+        break;
     case SM501_IRQ_MASK:
-	ret = s->irq_mask;
-	break;
+        ret = s->irq_mask;
+        break;
     case SM501_MISC_TIMING:
-	/* TODO : simulate gate control */
-	ret = s->misc_timing;
-	break;
+        /* TODO : simulate gate control */
+        ret = s->misc_timing;
+        break;
     case SM501_CURRENT_GATE:
-	/* TODO : simulate gate control */
-	ret = 0x00021807;
-	break;
+        /* TODO : simulate gate control */
+        ret = 0x00021807;
+        break;
     case SM501_CURRENT_CLOCK:
-	ret = 0x2A1A0A09;
-	break;
+        ret = 0x2A1A0A09;
+        break;
     case SM501_POWER_MODE_CONTROL:
-	ret = s->power_mode_control;
-	break;
+        ret = s->power_mode_control;
+        break;
 
     default:
-	printf("sm501 system config : not implemented register read."
-	       " addr=%x\n", (int)addr);
+        printf("sm501 system config : not implemented register read."
+               " addr=%x\n", (int)addr);
         abort();
     }
 
@@ -786,47 +825,50 @@ static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
 static void sm501_system_config_write(void *opaque, hwaddr addr,
                                       uint64_t value, unsigned size)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     SM501_DPRINTF("sm501 system config regs : write addr=%x, val=%x\n",
-		  (uint32_t)addr, (uint32_t)value);
+                  (uint32_t)addr, (uint32_t)value);
 
-    switch(addr) {
+    switch (addr) {
     case SM501_SYSTEM_CONTROL:
-	s->system_control = value & 0xE300B8F7;
-	break;
+        s->system_control = value & 0xE300B8F7;
+        break;
     case SM501_MISC_CONTROL:
-	s->misc_control = value & 0xFF7FFF20;
-	break;
+        s->misc_control = value & 0xFF7FFF20;
+        break;
     case SM501_GPIO31_0_CONTROL:
-	s->gpio_31_0_control = value;
-	break;
+        s->gpio_31_0_control = value;
+        break;
     case SM501_GPIO63_32_CONTROL:
-	s->gpio_63_32_control = value;
-	break;
+        s->gpio_63_32_control = value;
+        break;
     case SM501_DRAM_CONTROL:
-	s->local_mem_size_index = (value >> 13) & 0x7;
-	/* rODO : check validity of size change */
-	s->dram_control |=  value & 0x7FFFFFC3;
-	break;
+        s->local_mem_size_index = (value >> 13) & 0x7;
+        /* TODO : check validity of size change */
+        s->dram_control |=  value & 0x7FFFFFC3;
+        break;
+    case SM501_ARBTRTN_CONTROL:
+        s->arbitration_control =  value & 0x37777777;
+        break;
     case SM501_IRQ_MASK:
-	s->irq_mask = value;
-	break;
+        s->irq_mask = value;
+        break;
     case SM501_MISC_TIMING:
-	s->misc_timing = value & 0xF31F1FFF;
-	break;
+        s->misc_timing = value & 0xF31F1FFF;
+        break;
     case SM501_POWER_MODE_0_GATE:
     case SM501_POWER_MODE_1_GATE:
     case SM501_POWER_MODE_0_CLOCK:
     case SM501_POWER_MODE_1_CLOCK:
-	/* TODO : simulate gate & clock control */
-	break;
+        /* TODO : simulate gate & clock control */
+        break;
     case SM501_POWER_MODE_CONTROL:
-	s->power_mode_control = value & 0x00000003;
-	break;
+        s->power_mode_control = value & 0x00000003;
+        break;
 
     default:
-	printf("sm501 system config : not implemented register write."
-	       " addr=%x, val=%x\n", (int)addr, (uint32_t)value);
+        printf("sm501 system config : not implemented register write."
+               " addr=%x, val=%x\n", (int)addr, (uint32_t)value);
         abort();
     }
 }
@@ -838,124 +880,128 @@ static const MemoryRegionOps sm501_system_config_ops = {
         .min_access_size = 4,
         .max_access_size = 4,
     },
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
 static uint32_t sm501_palette_read(void *opaque, hwaddr addr)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     SM501_DPRINTF("sm501 palette read addr=%x\n", (int)addr);
 
     /* TODO : consider BYTE/WORD access */
     /* TODO : consider endian */
 
     assert(range_covers_byte(0, 0x400 * 3, addr));
-    return *(uint32_t*)&s->dc_palette[addr];
+    return *(uint32_t *)&s->dc_palette[addr];
 }
 
-static void sm501_palette_write(void *opaque,
-				hwaddr addr, uint32_t value)
+static void sm501_palette_write(void *opaque, hwaddr addr,
+                                uint32_t value)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     SM501_DPRINTF("sm501 palette write addr=%x, val=%x\n",
-		  (int)addr, value);
+                  (int)addr, value);
 
     /* TODO : consider BYTE/WORD access */
     /* TODO : consider endian */
 
     assert(range_covers_byte(0, 0x400 * 3, addr));
-    *(uint32_t*)&s->dc_palette[addr] = value;
+    *(uint32_t *)&s->dc_palette[addr] = value;
 }
 
 static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr addr,
                                      unsigned size)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     uint32_t ret = 0;
     SM501_DPRINTF("sm501 disp ctrl regs : read addr=%x\n", (int)addr);
 
-    switch(addr) {
+    switch (addr) {
 
     case SM501_DC_PANEL_CONTROL:
-	ret = s->dc_panel_control;
-	break;
+        ret = s->dc_panel_control;
+        break;
     case SM501_DC_PANEL_PANNING_CONTROL:
-	ret = s->dc_panel_panning_control;
-	break;
+        ret = s->dc_panel_panning_control;
+        break;
     case SM501_DC_PANEL_FB_ADDR:
-	ret = s->dc_panel_fb_addr;
-	break;
+        ret = s->dc_panel_fb_addr;
+        break;
     case SM501_DC_PANEL_FB_OFFSET:
-	ret = s->dc_panel_fb_offset;
-	break;
+        ret = s->dc_panel_fb_offset;
+        break;
     case SM501_DC_PANEL_FB_WIDTH:
-	ret = s->dc_panel_fb_width;
-	break;
+        ret = s->dc_panel_fb_width;
+        break;
     case SM501_DC_PANEL_FB_HEIGHT:
-	ret = s->dc_panel_fb_height;
-	break;
+        ret = s->dc_panel_fb_height;
+        break;
     case SM501_DC_PANEL_TL_LOC:
-	ret = s->dc_panel_tl_location;
-	break;
+        ret = s->dc_panel_tl_location;
+        break;
     case SM501_DC_PANEL_BR_LOC:
-	ret = s->dc_panel_br_location;
-	break;
+        ret = s->dc_panel_br_location;
+        break;
 
     case SM501_DC_PANEL_H_TOT:
-	ret = s->dc_panel_h_total;
-	break;
+        ret = s->dc_panel_h_total;
+        break;
     case SM501_DC_PANEL_H_SYNC:
-	ret = s->dc_panel_h_sync;
-	break;
+        ret = s->dc_panel_h_sync;
+        break;
     case SM501_DC_PANEL_V_TOT:
-	ret = s->dc_panel_v_total;
-	break;
+        ret = s->dc_panel_v_total;
+        break;
     case SM501_DC_PANEL_V_SYNC:
-	ret = s->dc_panel_v_sync;
-	break;
+        ret = s->dc_panel_v_sync;
+        break;
+
+    case SM501_DC_VIDEO_CONTROL:
+        ret = s->dc_video_control;
+        break;
 
     case SM501_DC_CRT_CONTROL:
-	ret = s->dc_crt_control;
-	break;
+        ret = s->dc_crt_control;
+        break;
     case SM501_DC_CRT_FB_ADDR:
-	ret = s->dc_crt_fb_addr;
-	break;
+        ret = s->dc_crt_fb_addr;
+        break;
     case SM501_DC_CRT_FB_OFFSET:
-	ret = s->dc_crt_fb_offset;
-	break;
+        ret = s->dc_crt_fb_offset;
+        break;
     case SM501_DC_CRT_H_TOT:
-	ret = s->dc_crt_h_total;
-	break;
+        ret = s->dc_crt_h_total;
+        break;
     case SM501_DC_CRT_H_SYNC:
-	ret = s->dc_crt_h_sync;
-	break;
+        ret = s->dc_crt_h_sync;
+        break;
     case SM501_DC_CRT_V_TOT:
-	ret = s->dc_crt_v_total;
-	break;
+        ret = s->dc_crt_v_total;
+        break;
     case SM501_DC_CRT_V_SYNC:
-	ret = s->dc_crt_v_sync;
-	break;
+        ret = s->dc_crt_v_sync;
+        break;
 
     case SM501_DC_CRT_HWC_ADDR:
-	ret = s->dc_crt_hwc_addr;
-	break;
+        ret = s->dc_crt_hwc_addr;
+        break;
     case SM501_DC_CRT_HWC_LOC:
-	ret = s->dc_crt_hwc_location;
-	break;
+        ret = s->dc_crt_hwc_location;
+        break;
     case SM501_DC_CRT_HWC_COLOR_1_2:
-	ret = s->dc_crt_hwc_color_1_2;
-	break;
+        ret = s->dc_crt_hwc_color_1_2;
+        break;
     case SM501_DC_CRT_HWC_COLOR_3:
-	ret = s->dc_crt_hwc_color_3;
-	break;
+        ret = s->dc_crt_hwc_color_3;
+        break;
 
-    case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400*3 - 4:
+    case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
         ret = sm501_palette_read(opaque, addr - SM501_DC_PANEL_PALETTE);
         break;
 
     default:
-	printf("sm501 disp ctrl : not implemented register read."
-	       " addr=%x\n", (int)addr);
+        printf("sm501 disp ctrl : not implemented register read."
+               " addr=%x\n", (int)addr);
         abort();
     }
 
@@ -965,104 +1011,124 @@ static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr addr,
 static void sm501_disp_ctrl_write(void *opaque, hwaddr addr,
                                   uint64_t value, unsigned size)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     SM501_DPRINTF("sm501 disp ctrl regs : write addr=%x, val=%x\n",
-		  (unsigned)addr, (unsigned)value);
+                  (unsigned)addr, (unsigned)value);
 
-    switch(addr) {
+    switch (addr) {
     case SM501_DC_PANEL_CONTROL:
-	s->dc_panel_control = value & 0x0FFF73FF;
-	break;
+        s->dc_panel_control = value & 0x0FFF73FF;
+        break;
     case SM501_DC_PANEL_PANNING_CONTROL:
-	s->dc_panel_panning_control = value & 0xFF3FFF3F;
-	break;
+        s->dc_panel_panning_control = value & 0xFF3FFF3F;
+        break;
     case SM501_DC_PANEL_FB_ADDR:
-	s->dc_panel_fb_addr = value & 0x8FFFFFF0;
-	break;
+        s->dc_panel_fb_addr = value & 0x8FFFFFF0;
+        break;
     case SM501_DC_PANEL_FB_OFFSET:
-	s->dc_panel_fb_offset = value & 0x3FF03FF0;
-	break;
+        s->dc_panel_fb_offset = value & 0x3FF03FF0;
+        break;
     case SM501_DC_PANEL_FB_WIDTH:
-	s->dc_panel_fb_width = value & 0x0FFF0FFF;
-	break;
+        s->dc_panel_fb_width = value & 0x0FFF0FFF;
+        break;
     case SM501_DC_PANEL_FB_HEIGHT:
-	s->dc_panel_fb_height = value & 0x0FFF0FFF;
-	break;
+        s->dc_panel_fb_height = value & 0x0FFF0FFF;
+        break;
     case SM501_DC_PANEL_TL_LOC:
-	s->dc_panel_tl_location = value & 0x07FF07FF;
-	break;
+        s->dc_panel_tl_location = value & 0x07FF07FF;
+        break;
     case SM501_DC_PANEL_BR_LOC:
-	s->dc_panel_br_location = value & 0x07FF07FF;
-	break;
+        s->dc_panel_br_location = value & 0x07FF07FF;
+        break;
 
     case SM501_DC_PANEL_H_TOT:
-	s->dc_panel_h_total = value & 0x0FFF0FFF;
-	break;
+        s->dc_panel_h_total = value & 0x0FFF0FFF;
+        break;
     case SM501_DC_PANEL_H_SYNC:
-	s->dc_panel_h_sync = value & 0x00FF0FFF;
-	break;
+        s->dc_panel_h_sync = value & 0x00FF0FFF;
+        break;
     case SM501_DC_PANEL_V_TOT:
-	s->dc_panel_v_total = value & 0x0FFF0FFF;
-	break;
+        s->dc_panel_v_total = value & 0x0FFF0FFF;
+        break;
     case SM501_DC_PANEL_V_SYNC:
-	s->dc_panel_v_sync = value & 0x003F0FFF;
-	break;
+        s->dc_panel_v_sync = value & 0x003F0FFF;
+        break;
 
     case SM501_DC_PANEL_HWC_ADDR:
-	s->dc_panel_hwc_addr = value & 0x8FFFFFF0;
-	break;
+        value &= 0x8FFFFFF0;
+        if (value != s->dc_panel_hwc_addr) {
+            hwc_invalidate(s, 0);
+            s->dc_panel_hwc_addr = value;
+        }
+        break;
     case SM501_DC_PANEL_HWC_LOC:
-	s->dc_panel_hwc_location = value & 0x0FFF0FFF;
-	break;
+        value &= 0x0FFF0FFF;
+        if (value != s->dc_panel_hwc_location) {
+            hwc_invalidate(s, 0);
+            s->dc_panel_hwc_location = value;
+        }
+        break;
     case SM501_DC_PANEL_HWC_COLOR_1_2:
-	s->dc_panel_hwc_color_1_2 = value;
-	break;
+        s->dc_panel_hwc_color_1_2 = value;
+        break;
     case SM501_DC_PANEL_HWC_COLOR_3:
-	s->dc_panel_hwc_color_3 = value & 0x0000FFFF;
-	break;
+        s->dc_panel_hwc_color_3 = value & 0x0000FFFF;
+        break;
+
+    case SM501_DC_VIDEO_CONTROL:
+        s->dc_video_control = value & 0x00037FFF;
+        break;
 
     case SM501_DC_CRT_CONTROL:
-	s->dc_crt_control = value & 0x0003FFFF;
-	break;
+        s->dc_crt_control = value & 0x0003FFFF;
+        break;
     case SM501_DC_CRT_FB_ADDR:
-	s->dc_crt_fb_addr = value & 0x8FFFFFF0;
-	break;
+        s->dc_crt_fb_addr = value & 0x8FFFFFF0;
+        break;
     case SM501_DC_CRT_FB_OFFSET:
-	s->dc_crt_fb_offset = value & 0x3FF03FF0;
-	break;
+        s->dc_crt_fb_offset = value & 0x3FF03FF0;
+        break;
     case SM501_DC_CRT_H_TOT:
-	s->dc_crt_h_total = value & 0x0FFF0FFF;
-	break;
+        s->dc_crt_h_total = value & 0x0FFF0FFF;
+        break;
     case SM501_DC_CRT_H_SYNC:
-	s->dc_crt_h_sync = value & 0x00FF0FFF;
-	break;
+        s->dc_crt_h_sync = value & 0x00FF0FFF;
+        break;
     case SM501_DC_CRT_V_TOT:
-	s->dc_crt_v_total = value & 0x0FFF0FFF;
-	break;
+        s->dc_crt_v_total = value & 0x0FFF0FFF;
+        break;
     case SM501_DC_CRT_V_SYNC:
-	s->dc_crt_v_sync = value & 0x003F0FFF;
-	break;
+        s->dc_crt_v_sync = value & 0x003F0FFF;
+        break;
 
     case SM501_DC_CRT_HWC_ADDR:
-	s->dc_crt_hwc_addr = value & 0x8FFFFFF0;
-	break;
+        value &= 0x8FFFFFF0;
+        if (value != s->dc_crt_hwc_addr) {
+            hwc_invalidate(s, 1);
+            s->dc_crt_hwc_addr = value;
+        }
+        break;
     case SM501_DC_CRT_HWC_LOC:
-	s->dc_crt_hwc_location = value & 0x0FFF0FFF;
-	break;
+        value &= 0x0FFF0FFF;
+        if (value != s->dc_crt_hwc_location) {
+            hwc_invalidate(s, 1);
+            s->dc_crt_hwc_location = value;
+        }
+        break;
     case SM501_DC_CRT_HWC_COLOR_1_2:
-	s->dc_crt_hwc_color_1_2 = value;
-	break;
+        s->dc_crt_hwc_color_1_2 = value;
+        break;
     case SM501_DC_CRT_HWC_COLOR_3:
-	s->dc_crt_hwc_color_3 = value & 0x0000FFFF;
-	break;
+        s->dc_crt_hwc_color_3 = value & 0x0000FFFF;
+        break;
 
-    case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400*3 - 4:
+    case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
         sm501_palette_write(opaque, addr - SM501_DC_PANEL_PALETTE, value);
         break;
 
     default:
-	printf("sm501 disp ctrl : not implemented register write."
-	       " addr=%x, val=%x\n", (int)addr, (unsigned)value);
+        printf("sm501 disp ctrl : not implemented register write."
+               " addr=%x, val=%x\n", (int)addr, (unsigned)value);
         abort();
     }
 }
@@ -1074,20 +1140,80 @@ static const MemoryRegionOps sm501_disp_ctrl_ops = {
         .min_access_size = 4,
         .max_access_size = 4,
     },
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
 static uint64_t sm501_2d_engine_read(void *opaque, hwaddr addr,
                                      unsigned size)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     uint32_t ret = 0;
     SM501_DPRINTF("sm501 2d engine regs : read addr=%x\n", (int)addr);
 
-    switch(addr) {
+    switch (addr) {
+    case SM501_2D_SOURCE:
+        ret = s->twoD_source;
+        break;
+    case SM501_2D_DESTINATION:
+        ret = s->twoD_destination;
+        break;
+    case SM501_2D_DIMENSION:
+        ret = s->twoD_dimension;
+        break;
+    case SM501_2D_CONTROL:
+        ret = s->twoD_control;
+        break;
+    case SM501_2D_PITCH:
+        ret = s->twoD_pitch;
+        break;
+    case SM501_2D_FOREGROUND:
+        ret = s->twoD_foreground;
+        break;
+    case SM501_2D_BACKGROUND:
+        ret = s->twoD_background;
+        break;
+    case SM501_2D_STRETCH:
+        ret = s->twoD_stretch;
+        break;
+    case SM501_2D_COLOR_COMPARE:
+        ret = s->twoD_color_compare;
+        break;
+    case SM501_2D_COLOR_COMPARE_MASK:
+        ret = s->twoD_color_compare_mask;
+        break;
+    case SM501_2D_MASK:
+        ret = s->twoD_mask;
+        break;
+    case SM501_2D_CLIP_TL:
+        ret = s->twoD_clip_tl;
+        break;
+    case SM501_2D_CLIP_BR:
+        ret = s->twoD_clip_br;
+        break;
+    case SM501_2D_MONO_PATTERN_LOW:
+        ret = s->twoD_mono_pattern_low;
+        break;
+    case SM501_2D_MONO_PATTERN_HIGH:
+        ret = s->twoD_mono_pattern_high;
+        break;
+    case SM501_2D_WINDOW_WIDTH:
+        ret = s->twoD_window_width;
+        break;
     case SM501_2D_SOURCE_BASE:
         ret = s->twoD_source_base;
         break;
+    case SM501_2D_DESTINATION_BASE:
+        ret = s->twoD_destination_base;
+        break;
+    case SM501_2D_ALPHA:
+        ret = s->twoD_alpha;
+        break;
+    case SM501_2D_WRAP:
+        ret = s->twoD_wrap;
+        break;
+    case SM501_2D_STATUS:
+        ret = 0; /* Should return interrupt status */
+        break;
     default:
         printf("sm501 disp ctrl : not implemented register read."
                " addr=%x\n", (int)addr);
@@ -1100,11 +1226,11 @@ static uint64_t sm501_2d_engine_read(void *opaque, hwaddr addr,
 static void sm501_2d_engine_write(void *opaque, hwaddr addr,
                                   uint64_t value, unsigned size)
 {
-    SM501State * s = (SM501State *)opaque;
+    SM501State *s = (SM501State *)opaque;
     SM501_DPRINTF("sm501 2d engine regs : write addr=%x, val=%x\n",
                   (unsigned)addr, (unsigned)value);
 
-    switch(addr) {
+    switch (addr) {
     case SM501_2D_SOURCE:
         s->twoD_source = value;
         break;
@@ -1130,15 +1256,33 @@ static void sm501_2d_engine_write(void *opaque, hwaddr addr,
     case SM501_2D_FOREGROUND:
         s->twoD_foreground = value;
         break;
+    case SM501_2D_BACKGROUND:
+        s->twoD_background = value;
+        break;
     case SM501_2D_STRETCH:
         s->twoD_stretch = value;
         break;
+    case SM501_2D_COLOR_COMPARE:
+        s->twoD_color_compare = value;
+        break;
     case SM501_2D_COLOR_COMPARE_MASK:
         s->twoD_color_compare_mask = value;
         break;
     case SM501_2D_MASK:
         s->twoD_mask = value;
         break;
+    case SM501_2D_CLIP_TL:
+        s->twoD_clip_tl = value;
+        break;
+    case SM501_2D_CLIP_BR:
+        s->twoD_clip_br = value;
+        break;
+    case SM501_2D_MONO_PATTERN_LOW:
+        s->twoD_mono_pattern_low = value;
+        break;
+    case SM501_2D_MONO_PATTERN_HIGH:
+        s->twoD_mono_pattern_high = value;
+        break;
     case SM501_2D_WINDOW_WIDTH:
         s->twoD_window_width = value;
         break;
@@ -1148,6 +1292,15 @@ static void sm501_2d_engine_write(void *opaque, hwaddr addr,
     case SM501_2D_DESTINATION_BASE:
         s->twoD_destination_base = value;
         break;
+    case SM501_2D_ALPHA:
+        s->twoD_alpha = value;
+        break;
+    case SM501_2D_WRAP:
+        s->twoD_wrap = value;
+        break;
+    case SM501_2D_STATUS:
+        /* ignored, writing 0 should clear interrupt status */
+        break;
     default:
         printf("sm501 2d engine : not implemented register write."
                " addr=%x, val=%x\n", (int)addr, (unsigned)value);
@@ -1162,16 +1315,17 @@ static const MemoryRegionOps sm501_2d_engine_ops = {
         .min_access_size = 4,
         .max_access_size = 4,
     },
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
 /* draw line functions for all console modes */
 
 typedef void draw_line_func(uint8_t *d, const uint8_t *s,
-			    int width, const uint32_t *pal);
+                            int width, const uint32_t *pal);
 
-typedef void draw_hwc_line_func(SM501State * s, int crt, uint8_t * palette,
-                                int c_y, uint8_t *d, int width);
+typedef void draw_hwc_line_func(uint8_t *d, const uint8_t *s,
+                                int width, const uint8_t *palette,
+                                int c_x, int c_y);
 
 #define DEPTH 8
 #include "sm501_template.h"
@@ -1197,7 +1351,7 @@ typedef void draw_hwc_line_func(SM501State * s, int crt, uint8_t * palette,
 #define DEPTH 32
 #include "sm501_template.h"
 
-static draw_line_func * draw_line8_funcs[] = {
+static draw_line_func *draw_line8_funcs[] = {
     draw_line8_8,
     draw_line8_15,
     draw_line8_16,
@@ -1207,7 +1361,7 @@ static draw_line_func * draw_line8_funcs[] = {
     draw_line8_16bgr,
 };
 
-static draw_line_func * draw_line16_funcs[] = {
+static draw_line_func *draw_line16_funcs[] = {
     draw_line16_8,
     draw_line16_15,
     draw_line16_16,
@@ -1217,7 +1371,7 @@ static draw_line_func * draw_line16_funcs[] = {
     draw_line16_16bgr,
 };
 
-static draw_line_func * draw_line32_funcs[] = {
+static draw_line_func *draw_line32_funcs[] = {
     draw_line32_8,
     draw_line32_15,
     draw_line32_16,
@@ -1227,7 +1381,7 @@ static draw_line_func * draw_line32_funcs[] = {
     draw_line32_16bgr,
 };
 
-static draw_hwc_line_func * draw_hwc_line_funcs[] = {
+static draw_hwc_line_func *draw_hwc_line_funcs[] = {
     draw_hwc_line_8,
     draw_hwc_line_15,
     draw_hwc_line_16,
@@ -1242,7 +1396,7 @@ static inline int get_depth_index(DisplaySurface *surface)
     switch (surface_bits_per_pixel(surface)) {
     default:
     case 8:
-	return 0;
+        return 0;
     case 15:
         return 1;
     case 16:
@@ -1256,203 +1410,459 @@ static inline int get_depth_index(DisplaySurface *surface)
     }
 }
 
-static void sm501_draw_crt(SM501State * s)
+static void sm501_update_display(void *opaque)
 {
+    SM501State *s = (SM501State *)opaque;
     DisplaySurface *surface = qemu_console_surface(s->con);
-    int y;
-    int width = (s->dc_crt_h_total & 0x00000FFF) + 1;
-    int height = (s->dc_crt_v_total & 0x00000FFF) + 1;
-
-    uint8_t  * src = s->local_mem;
-    int src_bpp = 0;
+    int y, c_x = 0, c_y = 0;
+    int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
+    int width = get_width(s, crt);
+    int height = get_height(s, crt);
+    int src_bpp = get_bpp(s, crt);
     int dst_bpp = surface_bytes_per_pixel(surface);
-    uint32_t * palette = (uint32_t *)&s->dc_palette[SM501_DC_CRT_PALETTE
-						    - SM501_DC_PANEL_PALETTE];
-    uint8_t hwc_palette[3 * 3];
-    int ds_depth_index = get_depth_index(surface);
-    draw_line_func * draw_line = NULL;
-    draw_hwc_line_func * draw_hwc_line = NULL;
+    int dst_depth_index = get_depth_index(surface);
+    draw_line_func *draw_line = NULL;
+    draw_hwc_line_func *draw_hwc_line = NULL;
     int full_update = 0;
     int y_start = -1;
     ram_addr_t page_min = ~0l;
     ram_addr_t page_max = 0l;
-    ram_addr_t offset = 0;
+    ram_addr_t offset;
+    uint32_t *palette;
+    uint8_t hwc_palette[3 * 3];
+    uint8_t *hwc_src = NULL;
+
+    if (!((crt ? s->dc_crt_control : s->dc_panel_control)
+          & SM501_DC_CRT_CONTROL_ENABLE)) {
+        return;
+    }
+
+    palette = (uint32_t *)(crt ? &s->dc_palette[SM501_DC_CRT_PALETTE -
+                                                SM501_DC_PANEL_PALETTE]
+                               : &s->dc_palette[0]);
 
     /* choose draw_line function */
-    switch (s->dc_crt_control & 3) {
-    case SM501_DC_CRT_CONTROL_8BPP:
-	src_bpp = 1;
-	draw_line = draw_line8_funcs[ds_depth_index];
-	break;
-    case SM501_DC_CRT_CONTROL_16BPP:
-	src_bpp = 2;
-	draw_line = draw_line16_funcs[ds_depth_index];
-	break;
-    case SM501_DC_CRT_CONTROL_32BPP:
-	src_bpp = 4;
-	draw_line = draw_line32_funcs[ds_depth_index];
-	break;
+    switch (src_bpp) {
+    case 1:
+        draw_line = draw_line8_funcs[dst_depth_index];
+        break;
+    case 2:
+        draw_line = draw_line16_funcs[dst_depth_index];
+        break;
+    case 4:
+        draw_line = draw_line32_funcs[dst_depth_index];
+        break;
     default:
-	printf("sm501 draw crt : invalid DC_CRT_CONTROL=%x.\n",
-	       s->dc_crt_control);
+        printf("sm501 update display : invalid control register value.\n");
         abort();
-	break;
+        break;
     }
 
     /* set up to draw hardware cursor */
-    if (is_hwc_enabled(s, 1)) {
-        int i;
-
-        /* get cursor palette */
-        for (i = 0; i < 3; i++) {
-            uint16_t rgb565 = get_hwc_color(s, 1, i + 1);
-            hwc_palette[i * 3 + 0] = (rgb565 & 0xf800) >> 8; /* red */
-            hwc_palette[i * 3 + 1] = (rgb565 & 0x07e0) >> 3; /* green */
-            hwc_palette[i * 3 + 2] = (rgb565 & 0x001f) << 3; /* blue */
-        }
-
+    if (is_hwc_enabled(s, crt)) {
         /* choose cursor draw line function */
-        draw_hwc_line = draw_hwc_line_funcs[ds_depth_index];
+        draw_hwc_line = draw_hwc_line_funcs[dst_depth_index];
+        hwc_src = get_hwc_address(s, crt);
+        c_x = get_hwc_x(s, crt);
+        c_y = get_hwc_y(s, crt);
+        get_hwc_palette(s, crt, hwc_palette);
     }
 
     /* adjust console size */
     if (s->last_width != width || s->last_height != height) {
         qemu_console_resize(s->con, width, height);
         surface = qemu_console_surface(s->con);
-	s->last_width = width;
-	s->last_height = height;
-	full_update = 1;
+        s->last_width = width;
+        s->last_height = height;
+        full_update = 1;
     }
 
     /* draw each line according to conditions */
     memory_region_sync_dirty_bitmap(&s->local_mem_region);
-    for (y = 0; y < height; y++) {
-	int update_hwc = draw_hwc_line ? within_hwc_y_range(s, y, 1) : 0;
-	int update = full_update || update_hwc;
+    for (y = 0, offset = 0; y < height; y++, offset += width * src_bpp) {
+        int update, update_hwc;
         ram_addr_t page0 = offset;
         ram_addr_t page1 = offset + width * src_bpp - 1;
 
-	/* check dirty flags for each line */
-        update = memory_region_get_dirty(&s->local_mem_region, page0,
-                                         page1 - page0, DIRTY_MEMORY_VGA);
+        /* check if hardware cursor is enabled and we're within its range */
+        update_hwc = draw_hwc_line && c_y <= y && y < c_y + SM501_HWC_HEIGHT;
+        update = full_update || update_hwc;
+        /* check dirty flags for each line */
+        update |= memory_region_get_dirty(&s->local_mem_region, page0,
+                                          page1 - page0, DIRTY_MEMORY_VGA);
 
-	/* draw line and change status */
-	if (update) {
+        /* draw line and change status */
+        if (update) {
             uint8_t *d = surface_data(surface);
             d +=  y * width * dst_bpp;
 
             /* draw graphics layer */
-            draw_line(d, src, width, palette);
+            draw_line(d, s->local_mem + offset, width, palette);
 
-            /* draw haredware cursor */
+            /* draw hardware cursor */
             if (update_hwc) {
-                draw_hwc_line(s, 1, hwc_palette, y - get_hwc_y(s, 1), d, width);
+                draw_hwc_line(d, hwc_src, width, hwc_palette, c_x, y - c_y);
             }
 
-	    if (y_start < 0)
-		y_start = y;
-	    if (page0 < page_min)
-		page_min = page0;
-	    if (page1 > page_max)
-		page_max = page1;
-	} else {
-	    if (y_start >= 0) {
-		/* flush to display */
+            if (y_start < 0) {
+                y_start = y;
+            }
+            if (page0 < page_min) {
+                page_min = page0;
+            }
+            if (page1 > page_max) {
+                page_max = page1;
+            }
+        } else {
+            if (y_start >= 0) {
+                /* flush to display */
                 dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
-		y_start = -1;
-	    }
-	}
-
-	src += width * src_bpp;
-	offset += width * src_bpp;
+                y_start = -1;
+            }
+        }
     }
 
     /* complete flush to display */
-    if (y_start >= 0)
+    if (y_start >= 0) {
         dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
+    }
 
     /* clear dirty flags */
     if (page_min != ~0l) {
-	memory_region_reset_dirty(&s->local_mem_region,
+        memory_region_reset_dirty(&s->local_mem_region,
                                   page_min, page_max + TARGET_PAGE_SIZE,
                                   DIRTY_MEMORY_VGA);
     }
 }
 
-static void sm501_update_display(void *opaque)
-{
-    SM501State * s = (SM501State *)opaque;
-
-    if (s->dc_crt_control & SM501_DC_CRT_CONTROL_ENABLE)
-	sm501_draw_crt(s);
-}
-
 static const GraphicHwOps sm501_ops = {
     .gfx_update  = sm501_update_display,
 };
 
-void sm501_init(MemoryRegion *address_space_mem, uint32_t base,
-                uint32_t local_mem_bytes, qemu_irq irq, Chardev *chr)
+static void sm501_reset(SM501State *s)
 {
-    SM501State * s;
-    DeviceState *dev;
-    MemoryRegion *sm501_system_config = g_new(MemoryRegion, 1);
-    MemoryRegion *sm501_disp_ctrl = g_new(MemoryRegion, 1);
-    MemoryRegion *sm501_2d_engine = g_new(MemoryRegion, 1);
-
-    /* allocate management data region */
-    s = (SM501State *)g_malloc0(sizeof(SM501State));
-    s->base = base;
-    s->local_mem_size_index
-	= get_local_mem_size_index(local_mem_bytes);
-    SM501_DPRINTF("local mem size=%x. index=%d\n", get_local_mem_size(s),
-		  s->local_mem_size_index);
-    s->system_control = 0x00100000;
-    s->misc_control = 0x00001000; /* assumes SH, active=low */
-    s->dc_panel_control = 0x00010000;
+    s->system_control = 0x00100000; /* 2D engine FIFO empty */
+    /* Bits 17 (SH), 7 (CDR), 6:5 (Test), 2:0 (Bus) are all supposed
+     * to be determined at reset by GPIO lines which set config bits.
+     * We hardwire them:
+     *  SH = 0 : Hitachi Ready Polarity == Active Low
+     *  CDR = 0 : do not reset clock divider
+     *  TEST = 0 : Normal mode (not testing the silicon)
+     *  BUS = 0 : Hitachi SH3/SH4
+     */
+    s->misc_control = SM501_MISC_DAC_POWER;
+    s->gpio_31_0_control = 0;
+    s->gpio_63_32_control = 0;
+    s->dram_control = 0;
+    s->arbitration_control = 0x05146732;
+    s->irq_mask = 0;
+    s->misc_timing = 0;
+    s->power_mode_control = 0;
+    s->dc_panel_control = 0x00010000; /* FIFO level 3 */
+    s->dc_video_control = 0;
     s->dc_crt_control = 0x00010000;
+    s->twoD_source = 0;
+    s->twoD_destination = 0;
+    s->twoD_dimension = 0;
+    s->twoD_control = 0;
+    s->twoD_pitch = 0;
+    s->twoD_foreground = 0;
+    s->twoD_background = 0;
+    s->twoD_stretch = 0;
+    s->twoD_color_compare = 0;
+    s->twoD_color_compare_mask = 0;
+    s->twoD_mask = 0;
+    s->twoD_clip_tl = 0;
+    s->twoD_clip_br = 0;
+    s->twoD_mono_pattern_low = 0;
+    s->twoD_mono_pattern_high = 0;
+    s->twoD_window_width = 0;
+    s->twoD_source_base = 0;
+    s->twoD_destination_base = 0;
+    s->twoD_alpha = 0;
+    s->twoD_wrap = 0;
+}
+
+static void sm501_init(SM501State *s, DeviceState *dev,
+                       uint32_t local_mem_bytes)
+{
+    s->local_mem_size_index = get_local_mem_size_index(local_mem_bytes);
+    SM501_DPRINTF("sm501 local mem size=%x. index=%d\n", get_local_mem_size(s),
+                  s->local_mem_size_index);
 
-    /* allocate local memory */
-    memory_region_init_ram(&s->local_mem_region, NULL, "sm501.local",
-                           local_mem_bytes, &error_fatal);
+    /* local memory */
+    memory_region_init_ram(&s->local_mem_region, OBJECT(dev), "sm501.local",
+                           get_local_mem_size(s), &error_fatal);
     vmstate_register_ram_global(&s->local_mem_region);
     memory_region_set_log(&s->local_mem_region, true, DIRTY_MEMORY_VGA);
     s->local_mem = memory_region_get_ram_ptr(&s->local_mem_region);
-    memory_region_add_subregion(address_space_mem, base, &s->local_mem_region);
 
-    /* map mmio */
-    memory_region_init_io(sm501_system_config, NULL, &sm501_system_config_ops, s,
+    /* mmio */
+    memory_region_init(&s->mmio_region, OBJECT(dev), "sm501.mmio", MMIO_SIZE);
+    memory_region_init_io(&s->system_config_region, OBJECT(dev),
+                          &sm501_system_config_ops, s,
                           "sm501-system-config", 0x6c);
-    memory_region_add_subregion(address_space_mem, base + MMIO_BASE_OFFSET,
-                                sm501_system_config);
-    memory_region_init_io(sm501_disp_ctrl, NULL, &sm501_disp_ctrl_ops, s,
+    memory_region_add_subregion(&s->mmio_region, SM501_SYS_CONFIG,
+                                &s->system_config_region);
+    memory_region_init_io(&s->disp_ctrl_region, OBJECT(dev),
+                          &sm501_disp_ctrl_ops, s,
                           "sm501-disp-ctrl", 0x1000);
-    memory_region_add_subregion(address_space_mem,
-                                base + MMIO_BASE_OFFSET + SM501_DC,
-                                sm501_disp_ctrl);
-    memory_region_init_io(sm501_2d_engine, NULL, &sm501_2d_engine_ops, s,
+    memory_region_add_subregion(&s->mmio_region, SM501_DC,
+                                &s->disp_ctrl_region);
+    memory_region_init_io(&s->twoD_engine_region, OBJECT(dev),
+                          &sm501_2d_engine_ops, s,
                           "sm501-2d-engine", 0x54);
-    memory_region_add_subregion(address_space_mem,
-                                base + MMIO_BASE_OFFSET + SM501_2D_ENGINE,
-                                sm501_2d_engine);
+    memory_region_add_subregion(&s->mmio_region, SM501_2D_ENGINE,
+                                &s->twoD_engine_region);
+
+    /* create qemu graphic console */
+    s->con = graphic_console_init(DEVICE(dev), 0, &sm501_ops, s);
+}
+
+static const VMStateDescription vmstate_sm501_state = {
+    .name = "sm501-state",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(local_mem_size_index, SM501State),
+        VMSTATE_UINT32(system_control, SM501State),
+        VMSTATE_UINT32(misc_control, SM501State),
+        VMSTATE_UINT32(gpio_31_0_control, SM501State),
+        VMSTATE_UINT32(gpio_63_32_control, SM501State),
+        VMSTATE_UINT32(dram_control, SM501State),
+        VMSTATE_UINT32(arbitration_control, SM501State),
+        VMSTATE_UINT32(irq_mask, SM501State),
+        VMSTATE_UINT32(misc_timing, SM501State),
+        VMSTATE_UINT32(power_mode_control, SM501State),
+        VMSTATE_UINT32(uart0_ier, SM501State),
+        VMSTATE_UINT32(uart0_lcr, SM501State),
+        VMSTATE_UINT32(uart0_mcr, SM501State),
+        VMSTATE_UINT32(uart0_scr, SM501State),
+        VMSTATE_UINT8_ARRAY(dc_palette, SM501State, DC_PALETTE_ENTRIES),
+        VMSTATE_UINT32(dc_panel_control, SM501State),
+        VMSTATE_UINT32(dc_panel_panning_control, SM501State),
+        VMSTATE_UINT32(dc_panel_fb_addr, SM501State),
+        VMSTATE_UINT32(dc_panel_fb_offset, SM501State),
+        VMSTATE_UINT32(dc_panel_fb_width, SM501State),
+        VMSTATE_UINT32(dc_panel_fb_height, SM501State),
+        VMSTATE_UINT32(dc_panel_tl_location, SM501State),
+        VMSTATE_UINT32(dc_panel_br_location, SM501State),
+        VMSTATE_UINT32(dc_panel_h_total, SM501State),
+        VMSTATE_UINT32(dc_panel_h_sync, SM501State),
+        VMSTATE_UINT32(dc_panel_v_total, SM501State),
+        VMSTATE_UINT32(dc_panel_v_sync, SM501State),
+        VMSTATE_UINT32(dc_panel_hwc_addr, SM501State),
+        VMSTATE_UINT32(dc_panel_hwc_location, SM501State),
+        VMSTATE_UINT32(dc_panel_hwc_color_1_2, SM501State),
+        VMSTATE_UINT32(dc_panel_hwc_color_3, SM501State),
+        VMSTATE_UINT32(dc_video_control, SM501State),
+        VMSTATE_UINT32(dc_crt_control, SM501State),
+        VMSTATE_UINT32(dc_crt_fb_addr, SM501State),
+        VMSTATE_UINT32(dc_crt_fb_offset, SM501State),
+        VMSTATE_UINT32(dc_crt_h_total, SM501State),
+        VMSTATE_UINT32(dc_crt_h_sync, SM501State),
+        VMSTATE_UINT32(dc_crt_v_total, SM501State),
+        VMSTATE_UINT32(dc_crt_v_sync, SM501State),
+        VMSTATE_UINT32(dc_crt_hwc_addr, SM501State),
+        VMSTATE_UINT32(dc_crt_hwc_location, SM501State),
+        VMSTATE_UINT32(dc_crt_hwc_color_1_2, SM501State),
+        VMSTATE_UINT32(dc_crt_hwc_color_3, SM501State),
+        VMSTATE_UINT32(twoD_source, SM501State),
+        VMSTATE_UINT32(twoD_destination, SM501State),
+        VMSTATE_UINT32(twoD_dimension, SM501State),
+        VMSTATE_UINT32(twoD_control, SM501State),
+        VMSTATE_UINT32(twoD_pitch, SM501State),
+        VMSTATE_UINT32(twoD_foreground, SM501State),
+        VMSTATE_UINT32(twoD_background, SM501State),
+        VMSTATE_UINT32(twoD_stretch, SM501State),
+        VMSTATE_UINT32(twoD_color_compare, SM501State),
+        VMSTATE_UINT32(twoD_color_compare_mask, SM501State),
+        VMSTATE_UINT32(twoD_mask, SM501State),
+        VMSTATE_UINT32(twoD_clip_tl, SM501State),
+        VMSTATE_UINT32(twoD_clip_br, SM501State),
+        VMSTATE_UINT32(twoD_mono_pattern_low, SM501State),
+        VMSTATE_UINT32(twoD_mono_pattern_high, SM501State),
+        VMSTATE_UINT32(twoD_window_width, SM501State),
+        VMSTATE_UINT32(twoD_source_base, SM501State),
+        VMSTATE_UINT32(twoD_destination_base, SM501State),
+        VMSTATE_UINT32(twoD_alpha, SM501State),
+        VMSTATE_UINT32(twoD_wrap, SM501State),
+        VMSTATE_END_OF_LIST()
+     }
+};
+
+#define TYPE_SYSBUS_SM501 "sysbus-sm501"
+#define SYSBUS_SM501(obj) \
+    OBJECT_CHECK(SM501SysBusState, (obj), TYPE_SYSBUS_SM501)
+
+typedef struct {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+    SM501State state;
+    uint32_t vram_size;
+    uint32_t base;
+    void *chr_state;
+} SM501SysBusState;
+
+static void sm501_realize_sysbus(DeviceState *dev, Error **errp)
+{
+    SM501SysBusState *s = SYSBUS_SM501(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    DeviceState *usb_dev;
+
+    sm501_init(&s->state, dev, s->vram_size);
+    if (get_local_mem_size(&s->state) != s->vram_size) {
+        error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
+                   get_local_mem_size(&s->state));
+        return;
+    }
+    sysbus_init_mmio(sbd, &s->state.local_mem_region);
+    sysbus_init_mmio(sbd, &s->state.mmio_region);
 
     /* bridge to usb host emulation module */
-    dev = qdev_create(NULL, "sysbus-ohci");
-    qdev_prop_set_uint32(dev, "num-ports", 2);
-    qdev_prop_set_uint64(dev, "dma-offset", base);
-    qdev_init_nofail(dev);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
-                    base + MMIO_BASE_OFFSET + SM501_USB_HOST);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq);
+    usb_dev = qdev_create(NULL, "sysbus-ohci");
+    qdev_prop_set_uint32(usb_dev, "num-ports", 2);
+    qdev_prop_set_uint64(usb_dev, "dma-offset", s->base);
+    qdev_init_nofail(usb_dev);
+    memory_region_add_subregion(&s->state.mmio_region, SM501_USB_HOST,
+                       sysbus_mmio_get_region(SYS_BUS_DEVICE(usb_dev), 0));
+    sysbus_pass_irq(sbd, SYS_BUS_DEVICE(usb_dev));
 
     /* bridge to serial emulation module */
-    if (chr) {
-        serial_mm_init(address_space_mem,
-                       base + MMIO_BASE_OFFSET + SM501_UART0, 2,
+    if (s->chr_state) {
+        serial_mm_init(&s->state.mmio_region, SM501_UART0, 2,
                        NULL, /* TODO : chain irq to IRL */
-                       115200, chr, DEVICE_NATIVE_ENDIAN);
+                       115200, s->chr_state, DEVICE_LITTLE_ENDIAN);
     }
+}
 
-    /* create qemu graphic console */
-    s->con = graphic_console_init(DEVICE(dev), 0, &sm501_ops, s);
+static Property sm501_sysbus_properties[] = {
+    DEFINE_PROP_UINT32("vram-size", SM501SysBusState, vram_size, 0),
+    DEFINE_PROP_UINT32("base", SM501SysBusState, base, 0),
+    DEFINE_PROP_PTR("chr-state", SM501SysBusState, chr_state),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sm501_reset_sysbus(DeviceState *dev)
+{
+    SM501SysBusState *s = SYSBUS_SM501(dev);
+    sm501_reset(&s->state);
 }
+
+static const VMStateDescription vmstate_sm501_sysbus = {
+    .name = TYPE_SYSBUS_SM501,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT(state, SM501SysBusState, 1,
+                       vmstate_sm501_state, SM501State),
+        VMSTATE_END_OF_LIST()
+     }
+};
+
+static void sm501_sysbus_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = sm501_realize_sysbus;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
+    dc->desc = "SM501 Multimedia Companion";
+    dc->props = sm501_sysbus_properties;
+    dc->reset = sm501_reset_sysbus;
+    dc->vmsd = &vmstate_sm501_sysbus;
+    /* Note: pointer property "chr-state" may remain null, thus
+     * no need for dc->cannot_instantiate_with_device_add_yet = true;
+     */
+}
+
+static const TypeInfo sm501_sysbus_info = {
+    .name          = TYPE_SYSBUS_SM501,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SM501SysBusState),
+    .class_init    = sm501_sysbus_class_init,
+};
+
+#define TYPE_PCI_SM501 "sm501"
+#define PCI_SM501(obj) OBJECT_CHECK(SM501PCIState, (obj), TYPE_PCI_SM501)
+
+typedef struct {
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+    SM501State state;
+    uint32_t vram_size;
+} SM501PCIState;
+
+static void sm501_realize_pci(PCIDevice *dev, Error **errp)
+{
+    SM501PCIState *s = PCI_SM501(dev);
+
+    sm501_init(&s->state, DEVICE(dev), s->vram_size);
+    if (get_local_mem_size(&s->state) != s->vram_size) {
+        error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
+                   get_local_mem_size(&s->state));
+        return;
+    }
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
+                     &s->state.local_mem_region);
+    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY,
+                     &s->state.mmio_region);
+}
+
+static Property sm501_pci_properties[] = {
+    DEFINE_PROP_UINT32("vram-size", SM501PCIState, vram_size, 64 * M_BYTE),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sm501_reset_pci(DeviceState *dev)
+{
+    SM501PCIState *s = PCI_SM501(dev);
+    sm501_reset(&s->state);
+    /* Bits 2:0 of misc_control register is 001 for PCI */
+    s->state.misc_control |= 1;
+}
+
+static const VMStateDescription vmstate_sm501_pci = {
+    .name = TYPE_PCI_SM501,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(parent_obj, SM501PCIState),
+        VMSTATE_STRUCT(state, SM501PCIState, 1,
+                       vmstate_sm501_state, SM501State),
+        VMSTATE_END_OF_LIST()
+     }
+};
+
+static void sm501_pci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->realize = sm501_realize_pci;
+    k->vendor_id = PCI_VENDOR_ID_SILICON_MOTION;
+    k->device_id = PCI_DEVICE_ID_SM501;
+    k->class_id = PCI_CLASS_DISPLAY_OTHER;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
+    dc->desc = "SM501 Display Controller";
+    dc->props = sm501_pci_properties;
+    dc->reset = sm501_reset_pci;
+    dc->hotpluggable = false;
+    dc->vmsd = &vmstate_sm501_pci;
+}
+
+static const TypeInfo sm501_pci_info = {
+    .name          = TYPE_PCI_SM501,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(SM501PCIState),
+    .class_init    = sm501_pci_class_init,
+};
+
+static void sm501_register_types(void)
+{
+    type_register_static(&sm501_sysbus_info);
+    type_register_static(&sm501_pci_info);
+}
+
+type_init(sm501_register_types)
diff --git a/hw/display/sm501_template.h b/hw/display/sm501_template.h
index f33e499be4..a60abad019 100644
--- a/hw/display/sm501_template.h
+++ b/hw/display/sm501_template.h
@@ -47,81 +47,67 @@ static void glue(draw_line8_, PIXEL_NAME)(
 {
     uint8_t v, r, g, b;
     do {
-	v = ldub_p(s);
-	r = (pal[v] >> 16) & 0xff;
-	g = (pal[v] >>  8) & 0xff;
-	b = (pal[v] >>  0) & 0xff;
-	((PIXEL_TYPE *) d)[0] = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
-	s ++;
-	d += BPP;
-    } while (-- width != 0);
+        v = ldub_p(s);
+        r = (pal[v] >> 16) & 0xff;
+        g = (pal[v] >>  8) & 0xff;
+        b = (pal[v] >>  0) & 0xff;
+        *(PIXEL_TYPE *)d = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
+        s++;
+        d += BPP;
+    } while (--width != 0);
 }
 
 static void glue(draw_line16_, PIXEL_NAME)(
-		 uint8_t *d, const uint8_t *s, int width, const uint32_t *pal)
+                 uint8_t *d, const uint8_t *s, int width, const uint32_t *pal)
 {
     uint16_t rgb565;
     uint8_t r, g, b;
 
     do {
-	rgb565 = lduw_p(s);
-	r = ((rgb565 >> 11) & 0x1f) << 3;
-	g = ((rgb565 >>  5) & 0x3f) << 2;
-	b = ((rgb565 >>  0) & 0x1f) << 3;
-	((PIXEL_TYPE *) d)[0] = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
-	s += 2;
-	d += BPP;
-    } while (-- width != 0);
+        rgb565 = lduw_le_p(s);
+        r = (rgb565 >> 8) & 0xf8;
+        g = (rgb565 >> 3) & 0xfc;
+        b = (rgb565 << 3) & 0xf8;
+        *(PIXEL_TYPE *)d = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
+        s += 2;
+        d += BPP;
+    } while (--width != 0);
 }
 
 static void glue(draw_line32_, PIXEL_NAME)(
-		 uint8_t *d, const uint8_t *s, int width, const uint32_t *pal)
+                 uint8_t *d, const uint8_t *s, int width, const uint32_t *pal)
 {
     uint8_t r, g, b;
 
     do {
-	ldub_p(s);
-#if defined(TARGET_WORDS_BIGENDIAN)
-        r = s[1];
-        g = s[2];
-        b = s[3];
-#else
-        b = s[0];
-        g = s[1];
         r = s[2];
-#endif
-	((PIXEL_TYPE *) d)[0] = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
-	s += 4;
-	d += BPP;
-    } while (-- width != 0);
+        g = s[1];
+        b = s[0];
+        *(PIXEL_TYPE *)d = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
+        s += 4;
+        d += BPP;
+    } while (--width != 0);
 }
 
 /**
  * Draw hardware cursor image on the given line.
  */
-static void glue(draw_hwc_line_, PIXEL_NAME)(SM501State * s, int crt,
-                         uint8_t * palette, int c_y, uint8_t *d, int width)
+static void glue(draw_hwc_line_, PIXEL_NAME)(uint8_t *d, const uint8_t *s,
+                 int width, const uint8_t *palette, int c_x, int c_y)
 {
-    int x, i;
-    uint8_t bitset = 0;
-
-    /* get hardware cursor pattern */
-    uint32_t cursor_addr = get_hwc_address(s, crt);
-    assert(0 <= c_y && c_y < SM501_HWC_HEIGHT);
-    cursor_addr += 64 * c_y / 4;  /* 4 pixels per byte */
-    cursor_addr += s->base;
+    int i;
+    uint8_t r, g, b, v, bitset = 0;
 
     /* get cursor position */
-    x = get_hwc_x(s, crt);
-    d += x * BPP;
-
-    for (i = 0; i < SM501_HWC_WIDTH && x + i < width; i++) {
-        uint8_t v;
+    assert(0 <= c_y && c_y < SM501_HWC_HEIGHT);
+    s += SM501_HWC_WIDTH * c_y / 4;  /* 4 pixels per byte */
+    d += c_x * BPP;
 
+    for (i = 0; i < SM501_HWC_WIDTH && c_x + i < width; i++) {
         /* get pixel value */
         if (i % 4 == 0) {
-            bitset = ldub_phys(&address_space_memory, cursor_addr);
-            cursor_addr++;
+            bitset = ldub_p(s);
+            s++;
         }
         v = bitset & 3;
         bitset >>= 2;
@@ -129,10 +115,10 @@ static void glue(draw_hwc_line_, PIXEL_NAME)(SM501State * s, int crt,
         /* write pixel */
         if (v) {
             v--;
-            uint8_t r = palette[v * 3 + 0];
-            uint8_t g = palette[v * 3 + 1];
-            uint8_t b = palette[v * 3 + 2];
-            ((PIXEL_TYPE *) d)[0] = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
+            r = palette[v * 3 + 0];
+            g = palette[v * 3 + 1];
+            b = palette[v * 3 + 2];
+            *(PIXEL_TYPE *)d = glue(rgb_to_pixel, PIXEL_NAME)(r, g, b);
         }
         d += BPP;
     }
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 8e26aae801..5a1115cc65 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -25,7 +25,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "cpu.h" /* FIXME shouldn't use TARGET_PAGE_SIZE */
 #include "ui/console.h"
 #include "ui/pixel_ops.h"
 #include "hw/loader.h"
@@ -93,41 +92,46 @@ typedef struct TCXState {
     uint16_t cursy;
 } TCXState;
 
-static void tcx_set_dirty(TCXState *s)
+static void tcx_set_dirty(TCXState *s, ram_addr_t addr, int len)
 {
-    memory_region_set_dirty(&s->vram_mem, 0, MAXX * MAXY);
+    memory_region_set_dirty(&s->vram_mem, addr, len);
+
+    if (s->depth == 24) {
+        memory_region_set_dirty(&s->vram_mem, s->vram24_offset + addr * 4,
+                                len * 4);
+        memory_region_set_dirty(&s->vram_mem, s->cplane_offset + addr * 4,
+                                len * 4);
+    }
 }
 
-static inline int tcx24_check_dirty(TCXState *s, ram_addr_t page,
-                                    ram_addr_t page24, ram_addr_t cpage)
+static int tcx_check_dirty(TCXState *s, ram_addr_t addr, int len)
 {
     int ret;
 
-    ret = memory_region_get_dirty(&s->vram_mem, page, TARGET_PAGE_SIZE,
-                                  DIRTY_MEMORY_VGA);
-    ret |= memory_region_get_dirty(&s->vram_mem, page24, TARGET_PAGE_SIZE * 4,
-                                   DIRTY_MEMORY_VGA);
-    ret |= memory_region_get_dirty(&s->vram_mem, cpage, TARGET_PAGE_SIZE * 4,
-                                   DIRTY_MEMORY_VGA);
+    ret = memory_region_get_dirty(&s->vram_mem, addr, len, DIRTY_MEMORY_VGA);
+
+    if (s->depth == 24) {
+        ret |= memory_region_get_dirty(&s->vram_mem,
+                                       s->vram24_offset + addr * 4, len * 4,
+                                       DIRTY_MEMORY_VGA);
+        ret |= memory_region_get_dirty(&s->vram_mem,
+                                       s->cplane_offset + addr * 4, len * 4,
+                                       DIRTY_MEMORY_VGA);
+    }
+
     return ret;
 }
 
-static inline void tcx24_reset_dirty(TCXState *ts, ram_addr_t page_min,
-                               ram_addr_t page_max, ram_addr_t page24,
-                              ram_addr_t cpage)
+static void tcx_reset_dirty(TCXState *s, ram_addr_t addr, int len)
 {
-    memory_region_reset_dirty(&ts->vram_mem,
-                              page_min,
-                              (page_max - page_min) + TARGET_PAGE_SIZE,
-                              DIRTY_MEMORY_VGA);
-    memory_region_reset_dirty(&ts->vram_mem,
-                              page24 + page_min * 4,
-                              (page_max - page_min) * 4 + TARGET_PAGE_SIZE,
-                              DIRTY_MEMORY_VGA);
-    memory_region_reset_dirty(&ts->vram_mem,
-                              cpage + page_min * 4,
-                              (page_max - page_min) * 4 + TARGET_PAGE_SIZE,
-                              DIRTY_MEMORY_VGA);
+    memory_region_reset_dirty(&s->vram_mem, addr, len, DIRTY_MEMORY_VGA);
+
+    if (s->depth == 24) {
+        memory_region_reset_dirty(&s->vram_mem, s->vram24_offset + addr * 4,
+                                  len * 4, DIRTY_MEMORY_VGA);
+        memory_region_reset_dirty(&s->vram_mem, s->cplane_offset + addr * 4,
+                                  len * 4, DIRTY_MEMORY_VGA);
+    }
 }
 
 static void update_palette_entries(TCXState *s, int start, int end)
@@ -136,27 +140,14 @@ static void update_palette_entries(TCXState *s, int start, int end)
     int i;
 
     for (i = start; i < end; i++) {
-        switch (surface_bits_per_pixel(surface)) {
-        default:
-        case 8:
-            s->palette[i] = rgb_to_pixel8(s->r[i], s->g[i], s->b[i]);
-            break;
-        case 15:
-            s->palette[i] = rgb_to_pixel15(s->r[i], s->g[i], s->b[i]);
-            break;
-        case 16:
-            s->palette[i] = rgb_to_pixel16(s->r[i], s->g[i], s->b[i]);
-            break;
-        case 32:
-            if (is_surface_bgr(surface)) {
-                s->palette[i] = rgb_to_pixel32bgr(s->r[i], s->g[i], s->b[i]);
-            } else {
-                s->palette[i] = rgb_to_pixel32(s->r[i], s->g[i], s->b[i]);
-            }
-            break;
+        if (is_surface_bgr(surface)) {
+            s->palette[i] = rgb_to_pixel32bgr(s->r[i], s->g[i], s->b[i]);
+        } else {
+            s->palette[i] = rgb_to_pixel32(s->r[i], s->g[i], s->b[i]);
         }
+        break;
     }
-    tcx_set_dirty(s);
+    tcx_set_dirty(s, 0, memory_region_size(&s->vram_mem));
 }
 
 static void tcx_draw_line32(TCXState *s1, uint8_t *d,
@@ -172,31 +163,6 @@ static void tcx_draw_line32(TCXState *s1, uint8_t *d,
     }
 }
 
-static void tcx_draw_line16(TCXState *s1, uint8_t *d,
-                            const uint8_t *s, int width)
-{
-    int x;
-    uint8_t val;
-    uint16_t *p = (uint16_t *)d;
-
-    for (x = 0; x < width; x++) {
-        val = *s++;
-        *p++ = s1->palette[val];
-    }
-}
-
-static void tcx_draw_line8(TCXState *s1, uint8_t *d,
-                           const uint8_t *s, int width)
-{
-    int x;
-    uint8_t val;
-
-    for(x = 0; x < width; x++) {
-        val = *s++;
-        *d++ = s1->palette[val];
-    }
-}
-
 static void tcx_draw_cursor32(TCXState *s1, uint8_t *d,
                               int y, int width)
 {
@@ -223,57 +189,6 @@ static void tcx_draw_cursor32(TCXState *s1, uint8_t *d,
     }
 }
 
-static void tcx_draw_cursor16(TCXState *s1, uint8_t *d,
-                              int y, int width)
-{
-    int x, len;
-    uint32_t mask, bits;
-    uint16_t *p = (uint16_t *)d;
-
-    y = y - s1->cursy;
-    mask = s1->cursmask[y];
-    bits = s1->cursbits[y];
-    len = MIN(width - s1->cursx, 32);
-    p = &p[s1->cursx];
-    for (x = 0; x < len; x++) {
-        if (mask & 0x80000000) {
-            if (bits & 0x80000000) {
-                *p = s1->palette[259];
-            } else {
-                *p = s1->palette[258];
-            }
-        }
-        p++;
-        mask <<= 1;
-        bits <<= 1;
-    }
-}
-
-static void tcx_draw_cursor8(TCXState *s1, uint8_t *d,
-                              int y, int width)
-{
-    int x, len;
-    uint32_t mask, bits;
-
-    y = y - s1->cursy;
-    mask = s1->cursmask[y];
-    bits = s1->cursbits[y];
-    len = MIN(width - s1->cursx, 32);
-    d = &d[s1->cursx];
-    for (x = 0; x < len; x++) {
-        if (mask & 0x80000000) {
-            if (bits & 0x80000000) {
-                *d = s1->palette[259];
-            } else {
-                *d = s1->palette[258];
-            }
-        }
-        d++;
-        mask <<= 1;
-        bits <<= 1;
-    }
-}
-
 /*
   XXX Could be much more optimal:
   * detect if line/page/whole screen is in 24 bit mode
@@ -322,10 +237,8 @@ static void tcx_update_display(void *opaque)
     ram_addr_t page, page_min, page_max;
     int y, y_start, dd, ds;
     uint8_t *d, *s;
-    void (*f)(TCXState *s1, uint8_t *dst, const uint8_t *src, int width);
-    void (*fc)(TCXState *s1, uint8_t *dst, int y, int width);
 
-    if (surface_bits_per_pixel(surface) == 0) {
+    if (surface_bits_per_pixel(surface) != 32) {
         return;
     }
 
@@ -338,29 +251,9 @@ static void tcx_update_display(void *opaque)
     dd = surface_stride(surface);
     ds = 1024;
 
-    switch (surface_bits_per_pixel(surface)) {
-    case 32:
-        f = tcx_draw_line32;
-        fc = tcx_draw_cursor32;
-        break;
-    case 15:
-    case 16:
-        f = tcx_draw_line16;
-        fc = tcx_draw_cursor16;
-        break;
-    default:
-    case 8:
-        f = tcx_draw_line8;
-        fc = tcx_draw_cursor8;
-        break;
-    case 0:
-        return;
-    }
-
     memory_region_sync_dirty_bitmap(&ts->vram_mem);
-    for (y = 0; y < ts->height; page += TARGET_PAGE_SIZE) {
-        if (memory_region_get_dirty(&ts->vram_mem, page, TARGET_PAGE_SIZE,
-                                    DIRTY_MEMORY_VGA)) {
+    for (y = 0; y < ts->height; y++, page += ds) {
+        if (tcx_check_dirty(ts, page, ds)) {
             if (y_start < 0)
                 y_start = y;
             if (page < page_min)
@@ -368,37 +261,10 @@ static void tcx_update_display(void *opaque)
             if (page > page_max)
                 page_max = page;
 
-            f(ts, d, s, ts->width);
-            if (y >= ts->cursy && y < ts->cursy + 32 && ts->cursx < ts->width) {
-                fc(ts, d, y, ts->width);
-            }
-            d += dd;
-            s += ds;
-            y++;
-
-            f(ts, d, s, ts->width);
-            if (y >= ts->cursy && y < ts->cursy + 32 && ts->cursx < ts->width) {
-                fc(ts, d, y, ts->width);
-            }
-            d += dd;
-            s += ds;
-            y++;
-
-            f(ts, d, s, ts->width);
-            if (y >= ts->cursy && y < ts->cursy + 32 && ts->cursx < ts->width) {
-                fc(ts, d, y, ts->width);
-            }
-            d += dd;
-            s += ds;
-            y++;
-
-            f(ts, d, s, ts->width);
+            tcx_draw_line32(ts, d, s, ts->width);
             if (y >= ts->cursy && y < ts->cursy + 32 && ts->cursx < ts->width) {
-                fc(ts, d, y, ts->width);
+                tcx_draw_cursor32(ts, d, y, ts->width);
             }
-            d += dd;
-            s += ds;
-            y++;
         } else {
             if (y_start >= 0) {
                 /* flush to display */
@@ -406,10 +272,9 @@ static void tcx_update_display(void *opaque)
                                ts->width, y - y_start);
                 y_start = -1;
             }
-            d += dd * 4;
-            s += ds * 4;
-            y += 4;
         }
+        s += ds;
+        d += dd;
     }
     if (y_start >= 0) {
         /* flush to display */
@@ -418,10 +283,7 @@ static void tcx_update_display(void *opaque)
     }
     /* reset modified pages */
     if (page_max >= page_min) {
-        memory_region_reset_dirty(&ts->vram_mem,
-                                  page_min,
-                                  (page_max - page_min) + TARGET_PAGE_SIZE,
-                                  DIRTY_MEMORY_VGA);
+        tcx_reset_dirty(ts, page_min, page_max - page_min);
     }
 }
 
@@ -429,7 +291,7 @@ static void tcx24_update_display(void *opaque)
 {
     TCXState *ts = opaque;
     DisplaySurface *surface = qemu_console_surface(ts->con);
-    ram_addr_t page, page_min, page_max, cpage, page24;
+    ram_addr_t page, page_min, page_max;
     int y, y_start, dd, ds;
     uint8_t *d, *s;
     uint32_t *cptr, *s24;
@@ -439,8 +301,6 @@ static void tcx24_update_display(void *opaque)
     }
 
     page = 0;
-    page24 = ts->vram24_offset;
-    cpage = ts->cplane_offset;
     y_start = -1;
     page_min = -1;
     page_max = 0;
@@ -452,9 +312,8 @@ static void tcx24_update_display(void *opaque)
     ds = 1024;
 
     memory_region_sync_dirty_bitmap(&ts->vram_mem);
-    for (y = 0; y < ts->height; page += TARGET_PAGE_SIZE,
-            page24 += TARGET_PAGE_SIZE, cpage += TARGET_PAGE_SIZE) {
-        if (tcx24_check_dirty(ts, page, page24, cpage)) {
+    for (y = 0; y < ts->height; y++, page += ds) {
+        if (tcx_check_dirty(ts, page, ds)) {
             if (y_start < 0)
                 y_start = y;
             if (page < page_min)
@@ -465,38 +324,6 @@ static void tcx24_update_display(void *opaque)
             if (y >= ts->cursy && y < ts->cursy+32 && ts->cursx < ts->width) {
                 tcx_draw_cursor32(ts, d, y, ts->width);
             }
-            d += dd;
-            s += ds;
-            cptr += ds;
-            s24 += ds;
-            y++;
-            tcx24_draw_line32(ts, d, s, ts->width, cptr, s24);
-            if (y >= ts->cursy && y < ts->cursy+32 && ts->cursx < ts->width) {
-                tcx_draw_cursor32(ts, d, y, ts->width);
-            }
-            d += dd;
-            s += ds;
-            cptr += ds;
-            s24 += ds;
-            y++;
-            tcx24_draw_line32(ts, d, s, ts->width, cptr, s24);
-            if (y >= ts->cursy && y < ts->cursy+32 && ts->cursx < ts->width) {
-                tcx_draw_cursor32(ts, d, y, ts->width);
-            }
-            d += dd;
-            s += ds;
-            cptr += ds;
-            s24 += ds;
-            y++;
-            tcx24_draw_line32(ts, d, s, ts->width, cptr, s24);
-            if (y >= ts->cursy && y < ts->cursy+32 && ts->cursx < ts->width) {
-                tcx_draw_cursor32(ts, d, y, ts->width);
-            }
-            d += dd;
-            s += ds;
-            cptr += ds;
-            s24 += ds;
-            y++;
         } else {
             if (y_start >= 0) {
                 /* flush to display */
@@ -504,12 +331,11 @@ static void tcx24_update_display(void *opaque)
                                ts->width, y - y_start);
                 y_start = -1;
             }
-            d += dd * 4;
-            s += ds * 4;
-            cptr += ds * 4;
-            s24 += ds * 4;
-            y += 4;
         }
+        d += dd;
+        s += ds;
+        cptr += ds;
+        s24 += ds;
     }
     if (y_start >= 0) {
         /* flush to display */
@@ -518,7 +344,7 @@ static void tcx24_update_display(void *opaque)
     }
     /* reset modified pages */
     if (page_max >= page_min) {
-        tcx24_reset_dirty(ts, page_min, page_max, page24, cpage);
+        tcx_reset_dirty(ts, page_min, page_max - page_min);
     }
 }
 
@@ -526,7 +352,7 @@ static void tcx_invalidate_display(void *opaque)
 {
     TCXState *s = opaque;
 
-    tcx_set_dirty(s);
+    tcx_set_dirty(s, 0, memory_region_size(&s->vram_mem));
     qemu_console_resize(s->con, s->width, s->height);
 }
 
@@ -534,7 +360,7 @@ static void tcx24_invalidate_display(void *opaque)
 {
     TCXState *s = opaque;
 
-    tcx_set_dirty(s);
+    tcx_set_dirty(s, 0, memory_region_size(&s->vram_mem));
     qemu_console_resize(s->con, s->width, s->height);
 }
 
@@ -543,7 +369,7 @@ static int vmstate_tcx_post_load(void *opaque, int version_id)
     TCXState *s = opaque;
 
     update_palette_entries(s, 0, 256);
-    tcx_set_dirty(s);
+    tcx_set_dirty(s, 0, memory_region_size(&s->vram_mem));
     return 0;
 }
 
@@ -699,7 +525,7 @@ static void tcx_stip_writel(void *opaque, hwaddr addr,
                 val <<= 1;
             }
         }
-        memory_region_set_dirty(&s->vram_mem, addr, 32);
+        tcx_set_dirty(s, addr, 32);
     }
 }
 
@@ -732,7 +558,7 @@ static void tcx_rstip_writel(void *opaque, hwaddr addr,
                 val <<= 1;
             }
         }
-        memory_region_set_dirty(&s->vram_mem, addr, 32);
+        tcx_set_dirty(s, addr, 32);
     }
 }
 
@@ -790,7 +616,7 @@ static void tcx_blit_writel(void *opaque, hwaddr addr,
                 memcpy(&s->vram24[addr], &s->vram24[adsr], len * 4);
             }
         }
-        memory_region_set_dirty(&s->vram_mem, addr, len);
+        tcx_set_dirty(s, addr, len);
     }
 }
 
@@ -824,7 +650,7 @@ static void tcx_rblit_writel(void *opaque, hwaddr addr,
                 memcpy(&s->cplane[addr], &s->cplane[adsr], len * 4);
             }
         }
-        memory_region_set_dirty(&s->vram_mem, addr, len);
+        tcx_set_dirty(s, addr, len);
     }
 }
 
@@ -861,7 +687,7 @@ static void tcx_invalidate_cursor_position(TCXState *s)
     start = ymin * 1024;
     end   = ymax * 1024;
 
-    memory_region_set_dirty(&s->vram_mem, start, end-start);
+    tcx_set_dirty(s, start, end - start);
 }
 
 static uint64_t tcx_thc_readl(void *opaque, hwaddr addr,
@@ -1017,8 +843,7 @@ static void tcx_realizefn(DeviceState *dev, Error **errp)
     vmstate_register_ram_global(&s->rom);
     fcode_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, TCX_ROM_FILE);
     if (fcode_filename) {
-        ret = load_image_targphys(fcode_filename, s->prom_addr,
-                                  FCODE_MAX_ROM_SIZE);
+        ret = load_image_mr(fcode_filename, &s->rom);
         g_free(fcode_filename);
         if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) {
             error_report("tcx: could not load prom '%s'", TCX_ROM_FILE);
@@ -1076,7 +901,6 @@ static Property tcx_properties[] = {
     DEFINE_PROP_UINT16("width",    TCXState, width,     -1),
     DEFINE_PROP_UINT16("height",   TCXState, height,    -1),
     DEFINE_PROP_UINT16("depth",    TCXState, depth,     -1),
-    DEFINE_PROP_UINT64("prom_addr", TCXState, prom_addr, -1),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index d24388e05f..f3b372a18f 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1104,9 +1104,7 @@ static void pc_new_cpu(const char *typename, int64_t apic_id, Error **errp)
     object_property_set_bool(cpu, true, "realized", &local_err);
 
     object_unref(cpu);
-    if (local_err) {
-        error_propagate(errp, local_err);
-    }
+    error_propagate(errp, local_err);
 }
 
 void pc_hot_add_cpu(const int64_t id, Error **errp)
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index f376381b9c..e7167e3d05 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1761,9 +1761,7 @@ static void vhost_vsock_ccw_realize(VirtioCcwDevice *ccw_dev, Error **errp)
 
     qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus));
     object_property_set_bool(OBJECT(vdev), true, "realized", &err);
-    if (err) {
-        error_propagate(errp, err);
-    }
+    error_propagate(errp, err);
 }
 
 static void vhost_vsock_ccw_class_init(ObjectClass *klass, void *data)
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index c491ece1f2..f53bc179da 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -233,9 +233,11 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    virtio_scsi_common_realize(dev, &err, vhost_dummy_handle_output,
+    virtio_scsi_common_realize(dev,
                                vhost_dummy_handle_output,
-                               vhost_dummy_handle_output);
+                               vhost_dummy_handle_output,
+                               vhost_dummy_handle_output,
+                               &err);
     if (err != NULL) {
         error_propagate(errp, err);
         goto close_fd;
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index bd62d08251..46a3e3f280 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -841,10 +841,11 @@ static struct SCSIBusInfo virtio_scsi_scsi_info = {
     .load_request = virtio_scsi_load_request,
 };
 
-void virtio_scsi_common_realize(DeviceState *dev, Error **errp,
+void virtio_scsi_common_realize(DeviceState *dev,
                                 VirtIOHandleOutput ctrl,
                                 VirtIOHandleOutput evt,
-                                VirtIOHandleOutput cmd)
+                                VirtIOHandleOutput cmd,
+                                Error **errp)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
@@ -878,9 +879,11 @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
     VirtIOSCSI *s = VIRTIO_SCSI(dev);
     Error *err = NULL;
 
-    virtio_scsi_common_realize(dev, &err, virtio_scsi_handle_ctrl,
+    virtio_scsi_common_realize(dev,
+                               virtio_scsi_handle_ctrl,
                                virtio_scsi_handle_event,
-                               virtio_scsi_handle_cmd);
+                               virtio_scsi_handle_cmd,
+                               &err);
     if (err != NULL) {
         error_propagate(errp, err);
         return;
diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 6d06968f8b..8f520cec1c 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -277,8 +277,15 @@ static void r2d_init(MachineState *machine)
     sysbus_connect_irq(busdev, 2, irq[PCI_INTC]);
     sysbus_connect_irq(busdev, 3, irq[PCI_INTD]);
 
-    sm501_init(address_space_mem, 0x10000000, SM501_VRAM_SIZE,
-               irq[SM501], serial_hds[2]);
+    dev = qdev_create(NULL, "sysbus-sm501");
+    busdev = SYS_BUS_DEVICE(dev);
+    qdev_prop_set_uint32(dev, "vram-size", SM501_VRAM_SIZE);
+    qdev_prop_set_uint32(dev, "base", 0x10000000);
+    qdev_prop_set_ptr(dev, "chr-state", serial_hds[2]);
+    qdev_init_nofail(dev);
+    sysbus_mmio_map(busdev, 0, 0x10000000);
+    sysbus_mmio_map(busdev, 1, 0x13e00000);
+    sysbus_connect_irq(busdev, 0, irq[SM501]);
 
     /* onboard CF (True IDE mode, Master only). */
     dinfo = drive_get(IF_IDE, 0, 0);
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 873cd7df9a..5f022cc08d 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -491,7 +491,6 @@ static void tcx_init(hwaddr addr, qemu_irq irq, int vram_size, int width,
     qdev_prop_set_uint16(dev, "width", width);
     qdev_prop_set_uint16(dev, "height", height);
     qdev_prop_set_uint16(dev, "depth", depth);
-    qdev_prop_set_uint64(dev, "prom_addr", addr);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -544,7 +543,6 @@ static void cg3_init(hwaddr addr, qemu_irq irq, int vram_size, int width,
     qdev_prop_set_uint16(dev, "width", width);
     qdev_prop_set_uint16(dev, "height", height);
     qdev_prop_set_uint16(dev, "depth", depth);
-    qdev_prop_set_uint64(dev, "prom-addr", addr);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index 24f1608b4b..5939b273b9 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -762,9 +762,7 @@ static void usb_set_attached(Object *obj, bool value, Error **errp)
 
     if (value) {
         usb_device_attach(dev, &err);
-        if (err) {
-            error_propagate(errp, err);
-        }
+        error_propagate(errp, err);
     } else {
         usb_device_detach(dev);
     }
diff --git a/include/block/block.h b/include/block/block.h
index 5ddc0cf21b..466de49b48 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -509,7 +509,7 @@ int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
 void bdrv_img_create(const char *filename, const char *fmt,
                      const char *base_filename, const char *base_fmt,
                      char *options, uint64_t img_size, int flags,
-                     Error **errp, bool quiet);
+                     bool quiet, Error **errp);
 
 /* Returns the alignment in bytes that is required so that no bounce buffer
  * is required throughout the stack */
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 59400bd848..4f8cd29ae4 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -805,16 +805,16 @@ void commit_start(const char *job_id, BlockDriverState *bs,
  * a node name should be autogenerated.
  * @cb: Completion function for the job.
  * @opaque: Opaque pointer value passed to @cb.
- * @errp: Error object.
  * @auto_complete: Auto complete the job.
+ * @errp: Error object.
  *
  */
 void commit_active_start(const char *job_id, BlockDriverState *bs,
                          BlockDriverState *base, int creation_flags,
                          int64_t speed, BlockdevOnError on_error,
                          const char *filter_node_name,
-                         BlockCompletionFunc *cb, void *opaque, Error **errp,
-                         bool auto_complete);
+                         BlockCompletionFunc *cb, void *opaque,
+                         bool auto_complete, Error **errp);
 /*
  * mirror_start:
  * @job_id: The id of the newly-created job, or %NULL to use the
diff --git a/include/crypto/block.h b/include/crypto/block.h
index b6971de921..4a053a3ffa 100644
--- a/include/crypto/block.h
+++ b/include/crypto/block.h
@@ -30,23 +30,23 @@ typedef struct QCryptoBlock QCryptoBlock;
  * and QCryptoBlockOpenOptions in qapi/crypto.json */
 
 typedef ssize_t (*QCryptoBlockReadFunc)(QCryptoBlock *block,
+                                        void *opaque,
                                         size_t offset,
                                         uint8_t *buf,
                                         size_t buflen,
-                                        Error **errp,
-                                        void *opaque);
+                                        Error **errp);
 
 typedef ssize_t (*QCryptoBlockInitFunc)(QCryptoBlock *block,
+                                        void *opaque,
                                         size_t headerlen,
-                                        Error **errp,
-                                        void *opaque);
+                                        Error **errp);
 
 typedef ssize_t (*QCryptoBlockWriteFunc)(QCryptoBlock *block,
+                                         void *opaque,
                                          size_t offset,
                                          const uint8_t *buf,
                                          size_t buflen,
-                                         Error **errp,
-                                         void *opaque);
+                                         Error **errp);
 
 /**
  * qcrypto_block_has_format:
diff --git a/include/hw/devices.h b/include/hw/devices.h
index 7475b714de..861ddea8af 100644
--- a/include/hw/devices.h
+++ b/include/hw/devices.h
@@ -62,9 +62,4 @@ void tc6393xb_gpio_out_set(TC6393xbState *s, int line,
 qemu_irq *tc6393xb_gpio_in_get(TC6393xbState *s);
 qemu_irq tc6393xb_l3v_get(TC6393xbState *s);
 
-/* sm501.c */
-void sm501_init(struct MemoryRegion *address_space_mem, uint32_t base,
-                uint32_t local_mem_bytes, qemu_irq irq,
-                Chardev *chr);
-
 #endif
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index d22ad8dd3b..3752ddc93a 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -207,6 +207,9 @@
 
 #define PCI_VENDOR_ID_MARVELL            0x11ab
 
+#define PCI_VENDOR_ID_SILICON_MOTION     0x126f
+#define PCI_DEVICE_ID_SM501              0x0501
+
 #define PCI_VENDOR_ID_ENSONIQ            0x1274
 #define PCI_DEVICE_ID_ENSONIQ_ES1370     0x5000
 
diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index 8ae0acaa1f..8c8453cf19 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -135,9 +135,11 @@ static inline void virtio_scsi_release(VirtIOSCSI *s)
     }
 }
 
-void virtio_scsi_common_realize(DeviceState *dev, Error **errp,
-                                VirtIOHandleOutput ctrl, VirtIOHandleOutput evt,
-                                VirtIOHandleOutput cmd);
+void virtio_scsi_common_realize(DeviceState *dev,
+                                VirtIOHandleOutput ctrl,
+                                VirtIOHandleOutput evt,
+                                VirtIOHandleOutput cmd,
+                                Error **errp);
 
 void virtio_scsi_common_unrealize(DeviceState *dev, Error **errp);
 bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq);
diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index 7842f6d150..af285321b8 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -36,8 +36,9 @@ int inet_ai_family_from_address(InetSocketAddress *addr,
                                 Error **errp);
 InetSocketAddress *inet_parse(const char *str, Error **errp);
 int inet_connect(const char *str, Error **errp);
-int inet_connect_saddr(InetSocketAddress *saddr, Error **errp,
-                       NonBlockingConnectHandler *callback, void *opaque);
+int inet_connect_saddr(InetSocketAddress *saddr,
+                       NonBlockingConnectHandler *callback, void *opaque,
+                       Error **errp);
 
 NetworkAddressFamily inet_netfamily(int family);
 
@@ -45,8 +46,8 @@ int unix_listen(const char *path, char *ostr, int olen, Error **errp);
 int unix_connect(const char *path, Error **errp);
 
 SocketAddress *socket_parse(const char *str, Error **errp);
-int socket_connect(SocketAddress *addr, Error **errp,
-                   NonBlockingConnectHandler *callback, void *opaque);
+int socket_connect(SocketAddress *addr, NonBlockingConnectHandler *callback,
+                   void *opaque, Error **errp);
 int socket_listen(SocketAddress *addr, Error **errp);
 void socket_listen_cleanup(int fd, Error **errp);
 int socket_dgram(SocketAddress *remote, SocketAddress *local, Error **errp);
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 64b36f58be..53386b7ba3 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -140,7 +140,7 @@ int qio_channel_socket_connect_sync(QIOChannelSocket *ioc,
     int fd;
 
     trace_qio_channel_socket_connect_sync(ioc, addr);
-    fd = socket_connect(addr, errp, NULL, NULL);
+    fd = socket_connect(addr, NULL, NULL, errp);
     if (fd < 0) {
         trace_qio_channel_socket_connect_fail(ioc);
         return -1;
diff --git a/migration/rdma.c b/migration/rdma.c
index 674ccab12e..fe0a4b5a83 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -809,7 +809,7 @@ static void qemu_rdma_dump_gid(const char *who, struct rdma_cm_id *id)
  *
  * Patches are being reviewed on linux-rdma.
  */
-static int qemu_rdma_broken_ipv6_kernel(Error **errp, struct ibv_context *verbs)
+static int qemu_rdma_broken_ipv6_kernel(struct ibv_context *verbs, Error **errp)
 {
     struct ibv_port_attr port_attr;
 
@@ -950,7 +950,7 @@ static int qemu_rdma_resolve_host(RDMAContext *rdma, Error **errp)
                 RDMA_RESOLVE_TIMEOUT_MS);
         if (!ret) {
             if (e->ai_family == AF_INET6) {
-                ret = qemu_rdma_broken_ipv6_kernel(errp, rdma->cm_id->verbs);
+                ret = qemu_rdma_broken_ipv6_kernel(rdma->cm_id->verbs, errp);
                 if (ret) {
                     continue;
                 }
@@ -2277,7 +2277,7 @@ static void qemu_rdma_cleanup(RDMAContext *rdma)
 }
 
 
-static int qemu_rdma_source_init(RDMAContext *rdma, Error **errp, bool pin_all)
+static int qemu_rdma_source_init(RDMAContext *rdma, bool pin_all, Error **errp)
 {
     int ret, idx;
     Error *local_err = NULL, **temp = &local_err;
@@ -2469,7 +2469,7 @@ static int qemu_rdma_dest_init(RDMAContext *rdma, Error **errp)
             continue;
         }
         if (e->ai_family == AF_INET6) {
-            ret = qemu_rdma_broken_ipv6_kernel(errp, listen_id->verbs);
+            ret = qemu_rdma_broken_ipv6_kernel(listen_id->verbs, errp);
             if (ret) {
                 continue;
             }
@@ -3676,8 +3676,8 @@ void rdma_start_outgoing_migration(void *opaque,
         goto err;
     }
 
-    ret = qemu_rdma_source_init(rdma, errp,
-        s->enabled_capabilities[MIGRATION_CAPABILITY_RDMA_PIN_ALL]);
+    ret = qemu_rdma_source_init(rdma,
+        s->enabled_capabilities[MIGRATION_CAPABILITY_RDMA_PIN_ALL], errp);
 
     if (ret) {
         goto err;
diff --git a/net/socket.c b/net/socket.c
index fe3547b018..b8c931e762 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -578,7 +578,7 @@ static int net_socket_connect_init(NetClientState *peer,
         goto err;
     }
 
-    fd = socket_connect(c->saddr, &local_error, net_socket_connected, c);
+    fd = socket_connect(c->saddr, net_socket_connected, c, &local_error);
     if (fd < 0) {
         goto err;
     }
diff --git a/pc-bios/openbios-ppc b/pc-bios/openbios-ppc
index cfe0aee7e5..ed9a51e738 100644
--- a/pc-bios/openbios-ppc
+++ b/pc-bios/openbios-ppc
Binary files differdiff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
index d6244b9ebd..1cf43dbe1d 100644
--- a/pc-bios/openbios-sparc32
+++ b/pc-bios/openbios-sparc32
Binary files differdiff --git a/pc-bios/openbios-sparc64 b/pc-bios/openbios-sparc64
index 74f67f2724..281d20d604 100644
--- a/pc-bios/openbios-sparc64
+++ b/pc-bios/openbios-sparc64
Binary files differdiff --git a/qemu-img.c b/qemu-img.c
index b220cf71d7..bbe15741f1 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -516,7 +516,7 @@ static int img_create(int argc, char **argv)
     }
 
     bdrv_img_create(filename, fmt, base_filename, base_fmt,
-                    options, img_size, 0, &local_err, quiet);
+                    options, img_size, 0, quiet, &local_err);
     if (local_err) {
         error_reportf_err(local_err, "%s: ", filename);
         goto fail;
@@ -984,7 +984,7 @@ static int img_commit(int argc, char **argv)
     aio_context_acquire(aio_context);
     commit_active_start("commit", bs, base_bs, BLOCK_JOB_DEFAULT, 0,
                         BLOCKDEV_ON_ERROR_REPORT, NULL, common_block_job_cb,
-                        &cbi, &local_err, false);
+                        &cbi, false, &local_err);
     aio_context_release(aio_context);
     if (local_err) {
         goto done;
diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index 19d72b2411..04026eedbf 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -768,7 +768,7 @@ int64_t qmp_guest_fsfreeze_freeze(Error **errp)
     /* cannot risk guest agent blocking itself on a write in this state */
     ga_set_frozen(ga_state);
 
-    qga_vss_fsfreeze(&i, &local_err, true);
+    qga_vss_fsfreeze(&i, true, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
         goto error;
@@ -807,7 +807,7 @@ int64_t qmp_guest_fsfreeze_thaw(Error **errp)
         return 0;
     }
 
-    qga_vss_fsfreeze(&i, errp, false);
+    qga_vss_fsfreeze(&i, false, errp);
 
     ga_unset_frozen(ga_state);
     return i;
diff --git a/qga/vss-win32.c b/qga/vss-win32.c
index 9a0e46356a..a80933c98b 100644
--- a/qga/vss-win32.c
+++ b/qga/vss-win32.c
@@ -145,7 +145,7 @@ void ga_uninstall_vss_provider(void)
 }
 
 /* Call VSS requester and freeze/thaw filesystems and applications */
-void qga_vss_fsfreeze(int *nr_volume, Error **errp, bool freeze)
+void qga_vss_fsfreeze(int *nr_volume, bool freeze, Error **errp)
 {
     const char *func_name = freeze ? "requester_freeze" : "requester_thaw";
     QGAVSSRequesterFunc func;
diff --git a/qga/vss-win32.h b/qga/vss-win32.h
index 4d1d15081e..51d303a8f6 100644
--- a/qga/vss-win32.h
+++ b/qga/vss-win32.h
@@ -21,6 +21,6 @@ bool vss_initialized(void);
 int ga_install_vss_provider(void);
 void ga_uninstall_vss_provider(void);
 
-void qga_vss_fsfreeze(int *nr_volume, Error **errp, bool freeze);
+void qga_vss_fsfreeze(int *nr_volume, bool freeze, Error **errp);
 
 #endif
diff --git a/roms/openbios b/roms/openbios
-Subproject f233c3f72cfa79c1123a7ccef08d2f7e228da6d
+Subproject 04898e8ce4c2f7bd94c7eeff9d26f2ff23aae8d
diff --git a/tests/test-crypto-block.c b/tests/test-crypto-block.c
index 1957a86743..85e6603d59 100644
--- a/tests/test-crypto-block.c
+++ b/tests/test-crypto-block.c
@@ -187,11 +187,11 @@ static struct QCryptoBlockTestData {
 
 
 static ssize_t test_block_read_func(QCryptoBlock *block,
+                                    void *opaque,
                                     size_t offset,
                                     uint8_t *buf,
                                     size_t buflen,
-                                    Error **errp,
-                                    void *opaque)
+                                    Error **errp)
 {
     Buffer *header = opaque;
 
@@ -204,9 +204,9 @@ static ssize_t test_block_read_func(QCryptoBlock *block,
 
 
 static ssize_t test_block_init_func(QCryptoBlock *block,
+                                    void *opaque,
                                     size_t headerlen,
-                                    Error **errp,
-                                    void *opaque)
+                                    Error **errp)
 {
     Buffer *header = opaque;
 
@@ -219,11 +219,11 @@ static ssize_t test_block_init_func(QCryptoBlock *block,
 
 
 static ssize_t test_block_write_func(QCryptoBlock *block,
+                                     void *opaque,
                                      size_t offset,
                                      const uint8_t *buf,
                                      size_t buflen,
-                                     Error **errp,
-                                     void *opaque)
+                                     Error **errp)
 {
     Buffer *header = opaque;
 
diff --git a/tests/test-replication.c b/tests/test-replication.c
index fac2da3f58..3016c6f2e0 100644
--- a/tests/test-replication.c
+++ b/tests/test-replication.c
@@ -144,18 +144,18 @@ static void prepare_imgs(void)
 
     /* Primary */
     bdrv_img_create(p_local_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
-                    BDRV_O_RDWR, &local_err, true);
+                    BDRV_O_RDWR, true, &local_err);
     g_assert(!local_err);
 
     /* Secondary */
     bdrv_img_create(s_local_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
-                    BDRV_O_RDWR, &local_err, true);
+                    BDRV_O_RDWR, true, &local_err);
     g_assert(!local_err);
     bdrv_img_create(s_active_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
-                    BDRV_O_RDWR, &local_err, true);
+                    BDRV_O_RDWR, true, &local_err);
     g_assert(!local_err);
     bdrv_img_create(s_hidden_disk, "qcow2", NULL, NULL, NULL, IMG_SIZE,
-                    BDRV_O_RDWR, &local_err, true);
+                    BDRV_O_RDWR, true, &local_err);
     g_assert(!local_err);
 }
 
diff --git a/util/error.c b/util/error.c
index 9c40b1f458..020b86b9f0 100644
--- a/util/error.c
+++ b/util/error.c
@@ -134,6 +134,7 @@ void error_vprepend(Error **errp, const char *fmt, va_list ap)
     newmsg = g_string_new(NULL);
     g_string_vprintf(newmsg, fmt, ap);
     g_string_append(newmsg, (*errp)->msg);
+    g_free((*errp)->msg);
     (*errp)->msg = g_string_free(newmsg, 0);
 }
 
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 21442c30dc..8188d9a8d7 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -427,8 +427,9 @@ static struct addrinfo *inet_parse_connect_saddr(InetSocketAddress *saddr,
  * function succeeds, callback will be called when the connection
  * completes, with the file descriptor on success, or -1 on error.
  */
-int inet_connect_saddr(InetSocketAddress *saddr, Error **errp,
-                       NonBlockingConnectHandler *callback, void *opaque)
+int inet_connect_saddr(InetSocketAddress *saddr,
+                       NonBlockingConnectHandler *callback, void *opaque,
+                       Error **errp)
 {
     Error *local_err = NULL;
     struct addrinfo *res, *e;
@@ -659,7 +660,7 @@ int inet_connect(const char *str, Error **errp)
 
     addr = inet_parse(str, errp);
     if (addr != NULL) {
-        sock = inet_connect_saddr(addr, errp, NULL, NULL);
+        sock = inet_connect_saddr(addr, NULL, NULL, errp);
         qapi_free_InetSocketAddress(addr);
     }
     return sock;
@@ -727,9 +728,10 @@ static int vsock_connect_addr(const struct sockaddr_vm *svm, bool *in_progress,
     return sock;
 }
 
-static int vsock_connect_saddr(VsockSocketAddress *vaddr, Error **errp,
+static int vsock_connect_saddr(VsockSocketAddress *vaddr,
                                NonBlockingConnectHandler *callback,
-                               void *opaque)
+                               void *opaque,
+                               Error **errp)
 {
     struct sockaddr_vm svm;
     int sock = -1;
@@ -818,9 +820,9 @@ static void vsock_unsupported(Error **errp)
     error_setg(errp, "socket family AF_VSOCK unsupported");
 }
 
-static int vsock_connect_saddr(VsockSocketAddress *vaddr, Error **errp,
+static int vsock_connect_saddr(VsockSocketAddress *vaddr,
                                NonBlockingConnectHandler *callback,
-                               void *opaque)
+                               void *opaque, Error **errp)
 {
     vsock_unsupported(errp);
     return -1;
@@ -910,8 +912,9 @@ err:
     return -1;
 }
 
-static int unix_connect_saddr(UnixSocketAddress *saddr, Error **errp,
-                              NonBlockingConnectHandler *callback, void *opaque)
+static int unix_connect_saddr(UnixSocketAddress *saddr,
+                              NonBlockingConnectHandler *callback, void *opaque,
+                              Error **errp)
 {
     struct sockaddr_un un;
     ConnectState *connect_state = NULL;
@@ -978,8 +981,9 @@ static int unix_listen_saddr(UnixSocketAddress *saddr,
     return -1;
 }
 
-static int unix_connect_saddr(UnixSocketAddress *saddr, Error **errp,
-                              NonBlockingConnectHandler *callback, void *opaque)
+static int unix_connect_saddr(UnixSocketAddress *saddr,
+                              NonBlockingConnectHandler *callback, void *opaque,
+                              Error **errp)
 {
     error_setg(errp, "unix sockets are not available on windows");
     errno = ENOTSUP;
@@ -1025,7 +1029,7 @@ int unix_connect(const char *path, Error **errp)
 
     saddr = g_new0(UnixSocketAddress, 1);
     saddr->path = g_strdup(path);
-    sock = unix_connect_saddr(saddr, errp, NULL, NULL);
+    sock = unix_connect_saddr(saddr, NULL, NULL, errp);
     qapi_free_UnixSocketAddress(saddr);
     return sock;
 }
@@ -1074,18 +1078,18 @@ fail:
     return NULL;
 }
 
-int socket_connect(SocketAddress *addr, Error **errp,
-                   NonBlockingConnectHandler *callback, void *opaque)
+int socket_connect(SocketAddress *addr, NonBlockingConnectHandler *callback,
+                   void *opaque, Error **errp)
 {
     int fd;
 
     switch (addr->type) {
     case SOCKET_ADDRESS_KIND_INET:
-        fd = inet_connect_saddr(addr->u.inet.data, errp, callback, opaque);
+        fd = inet_connect_saddr(addr->u.inet.data, callback, opaque, errp);
         break;
 
     case SOCKET_ADDRESS_KIND_UNIX:
-        fd = unix_connect_saddr(addr->u.q_unix.data, errp, callback, opaque);
+        fd = unix_connect_saddr(addr->u.q_unix.data, callback, opaque, errp);
         break;
 
     case SOCKET_ADDRESS_KIND_FD:
@@ -1097,7 +1101,7 @@ int socket_connect(SocketAddress *addr, Error **errp,
         break;
 
     case SOCKET_ADDRESS_KIND_VSOCK:
-        fd = vsock_connect_saddr(addr->u.vsock.data, errp, callback, opaque);
+        fd = vsock_connect_saddr(addr->u.vsock.data, callback, opaque, errp);
         break;
 
     default: