Use full 36-bit physical address space on SS10

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@2830 c046a42c-6fe2-441c-8c8c-71466251a162

13 files changed, 102 insertions, 89 deletions

diff --git a/hw/esp.c b/hw/esp.c
index 88d74c9a18..65feaea6ec 100644
--- a/hw/esp.c
+++ b/hw/esp.c
@@ -562,7 +562,8 @@ void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id)
     s->scsi_dev[id] = scsi_disk_init(bd, 0, esp_command_complete, s);
 }
 
-void *esp_init(BlockDriverState **bd, uint32_t espaddr, void *dma_opaque)
+void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
+               void *dma_opaque)
 {
     ESPState *s;
     int esp_io_memory;
diff --git a/hw/fdc.c b/hw/fdc.c
index d89b2263ed..ca2d320724 100644
--- a/hw/fdc.c
+++ b/hw/fdc.c
@@ -370,7 +370,7 @@ struct fdctrl_t {
     /* HW */
     qemu_irq irq;
     int dma_chann;
-    uint32_t io_base;
+    target_phys_addr_t io_base;
     /* Controller state */
     QEMUTimer *result_timer;
     uint8_t state;
@@ -464,13 +464,13 @@ static void fdctrl_write (void *opaque, uint32_t reg, uint32_t value)
 
 static uint32_t fdctrl_read_mem (void *opaque, target_phys_addr_t reg)
 {
-    return fdctrl_read(opaque, reg);
+    return fdctrl_read(opaque, (uint32_t)reg);
 }
 
 static void fdctrl_write_mem (void *opaque, 
                               target_phys_addr_t reg, uint32_t value)
 {
-    fdctrl_write(opaque, reg, value);
+    fdctrl_write(opaque, (uint32_t)reg, value);
 }
 
 static CPUReadMemoryFunc *fdctrl_mem_read[3] = {
@@ -579,7 +579,7 @@ static void fdctrl_external_reset(void *opaque)
 }
 
 fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped, 
-                       uint32_t io_base,
+                       target_phys_addr_t io_base,
                        BlockDriverState **fds)
 {
     fdctrl_t *fdctrl;
@@ -613,10 +613,14 @@ fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped,
         io_mem = cpu_register_io_memory(0, fdctrl_mem_read, fdctrl_mem_write, fdctrl);
         cpu_register_physical_memory(io_base, 0x08, io_mem);
     } else {
-        register_ioport_read(io_base + 0x01, 5, 1, &fdctrl_read, fdctrl);
-        register_ioport_read(io_base + 0x07, 1, 1, &fdctrl_read, fdctrl);
-        register_ioport_write(io_base + 0x01, 5, 1, &fdctrl_write, fdctrl);
-        register_ioport_write(io_base + 0x07, 1, 1, &fdctrl_write, fdctrl);
+        register_ioport_read((uint32_t)io_base + 0x01, 5, 1, &fdctrl_read,
+                             fdctrl);
+        register_ioport_read((uint32_t)io_base + 0x07, 1, 1, &fdctrl_read,
+                             fdctrl);
+        register_ioport_write((uint32_t)io_base + 0x01, 5, 1, &fdctrl_write,
+                              fdctrl);
+        register_ioport_write((uint32_t)io_base + 0x07, 1, 1, &fdctrl_write,
+                              fdctrl);
     }
     register_savevm("fdc", io_base, 1, fdc_save, fdc_load, fdctrl);
     qemu_register_reset(fdctrl_external_reset, fdctrl);
diff --git a/hw/iommu.c b/hw/iommu.c
index 5c2768cee3..082451f986 100644
--- a/hw/iommu.c
+++ b/hw/iommu.c
@@ -87,15 +87,15 @@ do { printf("IOMMU: " fmt , ##args); } while (0)
 #define PAGE_MASK	(PAGE_SIZE - 1)
 
 typedef struct IOMMUState {
-    uint32_t addr;
+    target_phys_addr_t addr;
     uint32_t regs[IOMMU_NREGS];
-    uint32_t iostart;
+    target_phys_addr_t iostart;
 } IOMMUState;
 
 static uint32_t iommu_mem_readw(void *opaque, target_phys_addr_t addr)
 {
     IOMMUState *s = opaque;
-    uint32_t saddr;
+    target_phys_addr_t saddr;
 
     saddr = (addr - s->addr) >> 2;
     switch (saddr) {
@@ -110,7 +110,7 @@ static uint32_t iommu_mem_readw(void *opaque, target_phys_addr_t addr)
 static void iommu_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     IOMMUState *s = opaque;
-    uint32_t saddr;
+    target_phys_addr_t saddr;
 
     saddr = (addr - s->addr) >> 2;
     DPRINTF("write reg[%d] = %x\n", saddr, val);
@@ -118,32 +118,32 @@ static void iommu_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val
     case IOMMU_CTRL:
 	switch (val & IOMMU_CTRL_RNGE) {
 	case IOMMU_RNGE_16MB:
-	    s->iostart = 0xff000000;
+	    s->iostart = 0xffffffffff000000ULL;
 	    break;
 	case IOMMU_RNGE_32MB:
-	    s->iostart = 0xfe000000;
+	    s->iostart = 0xfffffffffe000000ULL;
 	    break;
 	case IOMMU_RNGE_64MB:
-	    s->iostart = 0xfc000000;
+	    s->iostart = 0xfffffffffc000000ULL;
 	    break;
 	case IOMMU_RNGE_128MB:
-	    s->iostart = 0xf8000000;
+	    s->iostart = 0xfffffffff8000000ULL;
 	    break;
 	case IOMMU_RNGE_256MB:
-	    s->iostart = 0xf0000000;
+	    s->iostart = 0xfffffffff0000000ULL;
 	    break;
 	case IOMMU_RNGE_512MB:
-	    s->iostart = 0xe0000000;
+	    s->iostart = 0xffffffffe0000000ULL;
 	    break;
 	case IOMMU_RNGE_1GB:
-	    s->iostart = 0xc0000000;
+	    s->iostart = 0xffffffffc0000000ULL;
 	    break;
 	default:
 	case IOMMU_RNGE_2GB:
-	    s->iostart = 0x80000000;
+	    s->iostart = 0xffffffff80000000ULL;
 	    break;
 	}
-	DPRINTF("iostart = %x\n", s->iostart);
+	DPRINTF("iostart = %llx\n", s->iostart);
 	s->regs[saddr] = ((val & IOMMU_CTRL_MASK) | IOMMU_VERSION);
 	break;
     case IOMMU_BASE:
@@ -186,7 +186,7 @@ static CPUWriteMemoryFunc *iommu_mem_write[3] = {
     iommu_mem_writew,
 };
 
-static uint32_t iommu_page_get_flags(IOMMUState *s, uint32_t addr)
+static uint32_t iommu_page_get_flags(IOMMUState *s, target_phys_addr_t addr)
 {
     uint32_t iopte;
 
@@ -196,21 +196,27 @@ static uint32_t iommu_page_get_flags(IOMMUState *s, uint32_t addr)
     return ldl_phys(iopte);
 }
 
-static uint32_t iommu_translate_pa(IOMMUState *s, uint32_t addr, uint32_t pa)
+static target_phys_addr_t iommu_translate_pa(IOMMUState *s,
+                                             target_phys_addr_t addr,
+                                             uint32_t pte)
 {
     uint32_t tmppte;
+    target_phys_addr_t pa;
+
+    tmppte = pte;
+    pa = ((pte & IOPTE_PAGE) << 4) + (addr & PAGE_MASK);
+    DPRINTF("xlate dva " TARGET_FMT_plx " => pa " TARGET_FMT_plx
+            " (iopte = %x)\n", addr, pa, tmppte);
 
-    tmppte = pa;
-    pa = ((pa & IOPTE_PAGE) << 4) + (addr & PAGE_MASK);
-    DPRINTF("xlate dva %x => pa %x (iopte = %x)\n", addr, pa, tmppte);
     return pa;
 }
 
 void sparc_iommu_memory_rw(void *opaque, target_phys_addr_t addr,
                            uint8_t *buf, int len, int is_write)
 {
-    int l, flags;
-    target_ulong page, phys_addr;
+    int l;
+    uint32_t flags;
+    target_phys_addr_t page, phys_addr;
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
@@ -239,10 +245,9 @@ static void iommu_save(QEMUFile *f, void *opaque)
     IOMMUState *s = opaque;
     int i;
     
-    qemu_put_be32s(f, &s->addr);
     for (i = 0; i < IOMMU_NREGS; i++)
 	qemu_put_be32s(f, &s->regs[i]);
-    qemu_put_be32s(f, &s->iostart);
+    qemu_put_be64s(f, &s->iostart);
 }
 
 static int iommu_load(QEMUFile *f, void *opaque, int version_id)
@@ -250,13 +255,12 @@ static int iommu_load(QEMUFile *f, void *opaque, int version_id)
     IOMMUState *s = opaque;
     int i;
     
-    if (version_id != 1)
+    if (version_id != 2)
         return -EINVAL;
 
-    qemu_get_be32s(f, &s->addr);
     for (i = 0; i < IOMMU_NREGS; i++)
 	qemu_put_be32s(f, &s->regs[i]);
-    qemu_get_be32s(f, &s->iostart);
+    qemu_get_be64s(f, &s->iostart);
 
     return 0;
 }
@@ -270,7 +274,7 @@ static void iommu_reset(void *opaque)
     s->regs[0] = IOMMU_VERSION;
 }
 
-void *iommu_init(uint32_t addr)
+void *iommu_init(target_phys_addr_t addr)
 {
     IOMMUState *s;
     int iommu_io_memory;
@@ -284,7 +288,7 @@ void *iommu_init(uint32_t addr)
     iommu_io_memory = cpu_register_io_memory(0, iommu_mem_read, iommu_mem_write, s);
     cpu_register_physical_memory(addr, IOMMU_NREGS * 4, iommu_io_memory);
     
-    register_savevm("iommu", addr, 1, iommu_save, iommu_load, s);
+    register_savevm("iommu", addr, 2, iommu_save, iommu_load, s);
     qemu_register_reset(iommu_reset, s);
     return s;
 }
diff --git a/hw/m48t59.c b/hw/m48t59.c
index e9fb0901b7..cda28c2f65 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -43,7 +43,7 @@ struct m48t59_t {
     /* Hardware parameters */
     qemu_irq IRQ;
     int mem_index;
-    uint32_t mem_base;
+    target_phys_addr_t mem_base;
     uint32_t io_base;
     uint16_t size;
     /* RTC management */
@@ -610,12 +610,12 @@ static void m48t59_reset(void *opaque)
 }
 
 /* Initialisation routine */
-m48t59_t *m48t59_init (qemu_irq IRQ, target_ulong mem_base,
+m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
                        uint32_t io_base, uint16_t size,
                        int type)
 {
     m48t59_t *s;
-    target_ulong save_base;
+    target_phys_addr_t save_base;
 
     s = qemu_mallocz(sizeof(m48t59_t));
     if (!s)
diff --git a/hw/m48t59.h b/hw/m48t59.h
index df383e91c3..cfe9b2af5e 100644
--- a/hw/m48t59.h
+++ b/hw/m48t59.h
@@ -6,7 +6,7 @@ typedef struct m48t59_t m48t59_t;
 void m48t59_write (m48t59_t *NVRAM, uint32_t addr, uint32_t val);
 uint32_t m48t59_read (m48t59_t *NVRAM, uint32_t addr);
 void m48t59_toggle_lock (m48t59_t *NVRAM, int lock);
-m48t59_t *m48t59_init (qemu_irq IRQ, target_ulong mem_base,
+m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
                        uint32_t io_base, uint16_t size,
                        int type);
 
diff --git a/hw/pcnet.c b/hw/pcnet.c
index f2130d7b40..12d973479c 100644
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -2018,7 +2018,8 @@ static CPUWriteMemoryFunc *lance_mem_write[3] = {
     (CPUWriteMemoryFunc *)&pcnet_ioport_writew,
 };
 
-void *lance_init(NICInfo *nd, uint32_t leaddr, void *dma_opaque, qemu_irq irq)
+void *lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
+                 qemu_irq irq)
 {
     PCNetState *d;
     int lance_io_memory;
diff --git a/hw/slavio_intctl.c b/hw/slavio_intctl.c
index 0c1eb58359..94a6c965c4 100644
--- a/hw/slavio_intctl.c
+++ b/hw/slavio_intctl.c
@@ -371,7 +371,7 @@ void slavio_intctl_set_cpu(void *opaque, unsigned int cpu, CPUState *env)
     s->cpu_envs[cpu] = env;
 }
 
-void *slavio_intctl_init(uint32_t addr, uint32_t addrg,
+void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
                          const uint32_t *intbit_to_level,
                          qemu_irq **irq)
 {
diff --git a/hw/slavio_misc.c b/hw/slavio_misc.c
index 9e7629ebb2..1007238240 100644
--- a/hw/slavio_misc.c
+++ b/hw/slavio_misc.c
@@ -212,7 +212,8 @@ static int slavio_misc_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-void *slavio_misc_init(uint32_t base, qemu_irq irq)
+void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
+                       qemu_irq irq)
 {
     int slavio_misc_io_memory;
     MiscState *s;
@@ -235,7 +236,7 @@ void *slavio_misc_init(uint32_t base, qemu_irq irq)
     // System control
     cpu_register_physical_memory(base + 0x1f00000, MISC_MAXADDR, slavio_misc_io_memory);
     // Power management
-    cpu_register_physical_memory(base + 0xa000000, MISC_MAXADDR, slavio_misc_io_memory);
+    cpu_register_physical_memory(power_base, MISC_MAXADDR, slavio_misc_io_memory);
 
     s->irq = irq;
 
diff --git a/hw/slavio_serial.c b/hw/slavio_serial.c
index 0e3a622dbe..3da40eb6cf 100644
--- a/hw/slavio_serial.c
+++ b/hw/slavio_serial.c
@@ -587,8 +587,8 @@ static int slavio_serial_load(QEMUFile *f, void *opaque, int version_id)
 
 }
 
-SerialState *slavio_serial_init(int base, qemu_irq irq, CharDriverState *chr1,
-                                CharDriverState *chr2)
+SerialState *slavio_serial_init(target_phys_addr_t base, qemu_irq irq,
+                                CharDriverState *chr1, CharDriverState *chr2)
 {
     int slavio_serial_io_memory, i;
     SerialState *s;
@@ -704,7 +704,7 @@ static void sunmouse_event(void *opaque,
     put_queue(s, 0);
 }
 
-void slavio_serial_ms_kbd_init(int base, qemu_irq irq)
+void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq)
 {
     int slavio_serial_io_memory, i;
     SerialState *s;
diff --git a/hw/slavio_timer.c b/hw/slavio_timer.c
index 91148583a0..114770467a 100644
--- a/hw/slavio_timer.c
+++ b/hw/slavio_timer.c
@@ -264,8 +264,8 @@ static void slavio_timer_reset(void *opaque)
     slavio_timer_irq(s);
 }
 
-void slavio_timer_init(uint32_t addr, int irq, int mode, unsigned int cpu,
-                       void *intctl)
+void slavio_timer_init(target_phys_addr_t addr, int irq, int mode,
+                       unsigned int cpu, void *intctl)
 {
     int slavio_timer_io_memory;
     SLAVIO_TIMERState *s;
diff --git a/hw/sparc32_dma.c b/hw/sparc32_dma.c
index 8480c8dbe0..e1baee8b88 100644
--- a/hw/sparc32_dma.c
+++ b/hw/sparc32_dma.c
@@ -249,8 +249,8 @@ static int dma_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-void *sparc32_dma_init(uint32_t daddr, qemu_irq espirq, qemu_irq leirq,
-                       void *iommu)
+void *sparc32_dma_init(target_phys_addr_t daddr, qemu_irq espirq,
+                       qemu_irq leirq, void *iommu)
 {
     DMAState *s;
     int dma_io_memory;
diff --git a/hw/sun4m.c b/hw/sun4m.c
index ec195def4a..313e5b4aa1 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -48,11 +48,11 @@
 #define MAX_CPUS 16
 
 struct hwdef {
-    target_ulong iommu_base, slavio_base;
-    target_ulong intctl_base, counter_base, nvram_base, ms_kb_base, serial_base;
-    target_ulong fd_base;
-    target_ulong dma_base, esp_base, le_base;
-    target_ulong tcx_base, cs_base;
+    target_phys_addr_t iommu_base, slavio_base;
+    target_phys_addr_t intctl_base, counter_base, nvram_base, ms_kb_base;
+    target_phys_addr_t serial_base, fd_base;
+    target_phys_addr_t dma_base, esp_base, le_base;
+    target_phys_addr_t tcx_base, cs_base, power_base;
     long vram_size, nvram_size;
     // IRQ numbers are not PIL ones, but master interrupt controller register
     // bit numbers
@@ -289,7 +289,7 @@ static void sun4m_hw_init(const struct hwdef *hwdef, int ram_size,
 
     iommu = iommu_init(hwdef->iommu_base);
     slavio_intctl = slavio_intctl_init(hwdef->intctl_base,
-                                       hwdef->intctl_base + 0x10000,
+                                       hwdef->intctl_base + 0x10000ULL,
                                        &hwdef->intbit_to_level[0],
                                        &slavio_irq);
     for(i = 0; i < smp_cpus; i++) {
@@ -317,10 +317,11 @@ static void sun4m_hw_init(const struct hwdef *hwdef, int ram_size,
     nvram = m48t59_init(slavio_irq[0], hwdef->nvram_base, 0,
                         hwdef->nvram_size, 8);
     for (i = 0; i < MAX_CPUS; i++) {
-        slavio_timer_init(hwdef->counter_base + i * TARGET_PAGE_SIZE,
+        slavio_timer_init(hwdef->counter_base +
+                          (target_phys_addr_t)(i * TARGET_PAGE_SIZE),
                           hwdef->clock_irq, 0, i, slavio_intctl);
     }
-    slavio_timer_init(hwdef->counter_base + 0x10000, hwdef->clock1_irq, 2,
+    slavio_timer_init(hwdef->counter_base + 0x10000ULL, hwdef->clock1_irq, 2,
                       (unsigned int)-1, slavio_intctl);
     slavio_serial_ms_kbd_init(hwdef->ms_kb_base, slavio_irq[hwdef->ms_kb_irq]);
     // Slavio TTYA (base+4, Linux ttyS0) is the first Qemu serial device
@@ -336,9 +337,9 @@ static void sun4m_hw_init(const struct hwdef *hwdef, int ram_size,
         }
     }
 
-    slavio_misc = slavio_misc_init(hwdef->slavio_base, 
+    slavio_misc = slavio_misc_init(hwdef->slavio_base, hwdef->power_base,
                                    slavio_irq[hwdef->me_irq]);
-    if (hwdef->cs_base != (target_ulong)-1)
+    if (hwdef->cs_base != (target_phys_addr_t)-1)
         cs_init(hwdef->cs_base, hwdef->cs_irq, slavio_intctl);
     sparc32_dma_set_reset_data(dma, main_esp, main_lance);
 }
@@ -424,6 +425,7 @@ static const struct hwdef hwdefs[] = {
         .dma_base     = 0x78400000,
         .esp_base     = 0x78800000,
         .le_base      = 0x78c00000,
+        .power_base   = 0x7a000000,
         .vram_size    = 0x00100000,
         .nvram_size   = 0x2000,
         .esp_irq = 18,
@@ -443,19 +445,20 @@ static const struct hwdef hwdefs[] = {
     },
     /* SS-10 */
     {
-        .iommu_base   = 0xe0000000, // XXX Actually at 0xfe0000000ULL (36 bits)
-        .tcx_base     = 0x20000000, // 0xe20000000ULL,
+        .iommu_base   = 0xfe0000000ULL,
+        .tcx_base     = 0xe20000000ULL,
         .cs_base      = -1,
-        .slavio_base  = 0xf0000000, // 0xff0000000ULL,
-        .ms_kb_base   = 0xf1000000, // 0xff1000000ULL,
-        .serial_base  = 0xf1100000, // 0xff1100000ULL,
-        .nvram_base   = 0xf1200000, // 0xff1200000ULL,
-        .fd_base      = 0xf1700000, // 0xff1700000ULL,
-        .counter_base = 0xf1300000, // 0xff1300000ULL,
-        .intctl_base  = 0xf1400000, // 0xff1400000ULL,
-        .dma_base     = 0xf0400000, // 0xef0400000ULL,
-        .esp_base     = 0xf0800000, // 0xef0800000ULL,
-        .le_base      = 0xf0c00000, // 0xef0c00000ULL,
+        .slavio_base  = 0xff0000000ULL,
+        .ms_kb_base   = 0xff1000000ULL,
+        .serial_base  = 0xff1100000ULL,
+        .nvram_base   = 0xff1200000ULL,
+        .fd_base      = 0xff1700000ULL,
+        .counter_base = 0xff1300000ULL,
+        .intctl_base  = 0xff1400000ULL,
+        .dma_base     = 0xef0400000ULL,
+        .esp_base     = 0xef0800000ULL,
+        .le_base      = 0xef0c00000ULL,
+        .power_base   = 0xefa000000ULL,
         .vram_size    = 0x00100000,
         .nvram_size   = 0x2000,
         .esp_irq = 18,
@@ -480,9 +483,10 @@ static void sun4m_common_init(int ram_size, int boot_device, DisplayState *ds,
                               const char *initrd_filename, const char *cpu_model,
                               unsigned int machine, int max_ram)
 {
-    if (ram_size > max_ram) {
+    if ((unsigned int)ram_size > (unsigned int)max_ram) {
         fprintf(stderr, "qemu: Too much memory for this machine: %d, maximum %d\n",
-                ram_size / (1024 * 1024), max_ram / (1024 * 1024));
+                (unsigned int)ram_size / (1024 * 1024),
+                (unsigned int)max_ram / (1024 * 1024));
         exit(1);
     }
     sun4m_hw_init(&hwdefs[machine], ram_size, ds, cpu_model);
@@ -515,7 +519,7 @@ static void ss10_init(int ram_size, int vga_ram_size, int boot_device,
         cpu_model = "TI SuperSparc II";
     sun4m_common_init(ram_size, boot_device, ds, kernel_filename,
                       kernel_cmdline, initrd_filename, cpu_model,
-                      1, 0x20000000); // XXX tcx overlap, actually first 4GB ok
+                      1, PROM_ADDR); // XXX prom overlap, actually first 4GB ok
 }
 
 QEMUMachine ss5_machine = {
diff --git a/hw/tcx.c b/hw/tcx.c
index 326f458651..80d60baae1 100644
--- a/hw/tcx.c
+++ b/hw/tcx.c
@@ -31,7 +31,7 @@
 #define TCX_TEC_NREGS    0x1000
 
 typedef struct TCXState {
-    uint32_t addr;
+    target_phys_addr_t addr;
     DisplayState *ds;
     uint8_t *vram;
     uint32_t *vram24, *cplane;
@@ -359,7 +359,6 @@ static void tcx_save(QEMUFile *f, void *opaque)
 {
     TCXState *s = opaque;
     
-    qemu_put_be32s(f, (uint32_t *)&s->addr);
     qemu_put_be32s(f, (uint32_t *)&s->vram);
     qemu_put_be32s(f, (uint32_t *)&s->vram24);
     qemu_put_be32s(f, (uint32_t *)&s->cplane);
@@ -377,10 +376,9 @@ static int tcx_load(QEMUFile *f, void *opaque, int version_id)
 {
     TCXState *s = opaque;
     
-    if (version_id != 2)
+    if (version_id != 3)
         return -EINVAL;
 
-    qemu_get_be32s(f, (uint32_t *)&s->addr);
     qemu_get_be32s(f, (uint32_t *)&s->vram);
     qemu_get_be32s(f, (uint32_t *)&s->vram24);
     qemu_get_be32s(f, (uint32_t *)&s->cplane);
@@ -492,7 +490,7 @@ static CPUWriteMemoryFunc *tcx_dummy_write[3] = {
     tcx_dummy_writel,
 };
 
-void tcx_init(DisplayState *ds, uint32_t addr, uint8_t *vram_base,
+void tcx_init(DisplayState *ds, target_phys_addr_t addr, uint8_t *vram_base,
               unsigned long vram_offset, int vram_size, int width, int height,
               int depth)
 {
@@ -513,23 +511,23 @@ void tcx_init(DisplayState *ds, uint32_t addr, uint8_t *vram_base,
     // 8-bit plane
     s->vram = vram_base;
     size = vram_size;
-    cpu_register_physical_memory(addr + 0x00800000, size, vram_offset);
+    cpu_register_physical_memory(addr + 0x00800000ULL, size, vram_offset);
     vram_offset += size;
     vram_base += size;
 
     io_memory = cpu_register_io_memory(0, tcx_dac_read, tcx_dac_write, s);
-    cpu_register_physical_memory(addr + 0x00200000, TCX_DAC_NREGS, io_memory);
+    cpu_register_physical_memory(addr + 0x00200000ULL, TCX_DAC_NREGS, io_memory);
 
     dummy_memory = cpu_register_io_memory(0, tcx_dummy_read, tcx_dummy_write,
                                           s);
-    cpu_register_physical_memory(addr + 0x00700000, TCX_TEC_NREGS,
+    cpu_register_physical_memory(addr + 0x00700000ULL, TCX_TEC_NREGS,
                                  dummy_memory);
     if (depth == 24) {
         // 24-bit plane
         size = vram_size * 4;
         s->vram24 = (uint32_t *)vram_base;
         s->vram24_offset = vram_offset;
-        cpu_register_physical_memory(addr + 0x02000000, size, vram_offset);
+        cpu_register_physical_memory(addr + 0x02000000ULL, size, vram_offset);
         vram_offset += size;
         vram_base += size;
 
@@ -537,20 +535,20 @@ void tcx_init(DisplayState *ds, uint32_t addr, uint8_t *vram_base,
         size = vram_size * 4;
         s->cplane = (uint32_t *)vram_base;
         s->cplane_offset = vram_offset;
-        cpu_register_physical_memory(addr + 0x0a000000, size, vram_offset);
+        cpu_register_physical_memory(addr + 0x0a000000ULL, size, vram_offset);
         graphic_console_init(s->ds, tcx24_update_display,
                              tcx24_invalidate_display, tcx24_screen_dump, s);
     } else {
-        cpu_register_physical_memory(addr + 0x00300000, TCX_THC_NREGS_8,
+        cpu_register_physical_memory(addr + 0x00300000ULL, TCX_THC_NREGS_8,
                                      dummy_memory);
         graphic_console_init(s->ds, tcx_update_display, tcx_invalidate_display,
                              tcx_screen_dump, s);
     }
     // NetBSD writes here even with 8-bit display
-    cpu_register_physical_memory(addr + 0x00301000, TCX_THC_NREGS_24,
+    cpu_register_physical_memory(addr + 0x00301000ULL, TCX_THC_NREGS_24,
                                  dummy_memory);
 
-    register_savevm("tcx", addr, 1, tcx_save, tcx_load, s);
+    register_savevm("tcx", addr, 3, tcx_save, tcx_load, s);
     qemu_register_reset(tcx_reset, s);
     tcx_reset(s);
     dpy_resize(s->ds, width, height);