9 files changed, 553 insertions, 135 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 87237a6f3c..73c0a10006 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -315,6 +315,7 @@ M: Andreas Färber <andreas.faerber@web.de>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc_prep.c
+F: hw/prep_pci.[hc]
 
 SH4 Machines
 ------------
diff --git a/Makefile.objs b/Makefile.objs
index f94c881667..0b55f34bae 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -216,6 +216,7 @@ hw-obj-$(CONFIG_FDC) += fdc.o
 hw-obj-$(CONFIG_ACPI) += acpi.o acpi_piix4.o
 hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
 hw-obj-$(CONFIG_DMA) += dma.o
+hw-obj-$(CONFIG_I82374) += i82374.o
 hw-obj-$(CONFIG_HPET) += hpet.o
 hw-obj-$(CONFIG_APPLESMC) += applesmc.o
 hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o ccid-card-passthru.o
@@ -225,6 +226,7 @@ hw-obj-$(CONFIG_I8259) += i8259.o
 
 # PPC devices
 hw-obj-$(CONFIG_PREP_PCI) += prep_pci.o
+hw-obj-$(CONFIG_I82378) += i82378.o
 # Mac shared devices
 hw-obj-$(CONFIG_MACIO) += macio.o
 hw-obj-$(CONFIG_CUDA) += cuda.o
diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
index 3277291c75..1a768fc519 100644
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -12,9 +12,12 @@ CONFIG_I8254=y
 CONFIG_PCKBD=y
 CONFIG_FDC=y
 CONFIG_DMA=y
+CONFIG_I82374=y
 CONFIG_OPENPIC=y
 CONFIG_PREP_PCI=y
+CONFIG_I82378=y
 CONFIG_MACIO=y
+CONFIG_PCSPK=y
 CONFIG_CUDA=y
 CONFIG_ADB=y
 CONFIG_MAC_NVRAM=y
diff --git a/hw/i82374.c b/hw/i82374.c
new file mode 100644
index 0000000000..616d1fc662
--- /dev/null
+++ b/hw/i82374.c
@@ -0,0 +1,154 @@
+/*
+ * QEMU Intel 82374 emulation (Enhanced DMA controller)
+ *
+ * Copyright (c) 2010 Hervé Poussineau
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "isa.h"
+
+//#define DEBUG_I82374
+
+#ifdef DEBUG_I82374
+#define DPRINTF(fmt, ...) \
+do { fprintf(stderr, "i82374: " fmt , ## __VA_ARGS__); } while (0)
+#else
+#define DPRINTF(fmt, ...) \
+do {} while (0)
+#endif
+#define BADF(fmt, ...) \
+do { fprintf(stderr, "i82374 ERROR: " fmt , ## __VA_ARGS__); } while (0)
+
+typedef struct I82374State {
+    uint8_t commands[8];
+} I82374State;
+
+static const VMStateDescription vmstate_i82374 = {
+    .name = "i82374",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8_ARRAY(commands, I82374State, 8),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static uint32_t i82374_read_isr(void *opaque, uint32_t nport)
+{
+    uint32_t val = 0;
+
+    BADF("%s: %08x\n", __func__, nport);
+
+    DPRINTF("%s: %08x=%08x\n", __func__, nport, val);
+    return val;
+}
+
+static void i82374_write_command(void *opaque, uint32_t nport, uint32_t data)
+{
+    DPRINTF("%s: %08x=%08x\n", __func__, nport, data);
+
+    if (data != 0x42) {
+        /* Not Stop S/G command */
+        BADF("%s: %08x=%08x\n", __func__, nport, data);
+    }
+}
+
+static uint32_t i82374_read_status(void *opaque, uint32_t nport)
+{
+    uint32_t val = 0;
+
+    BADF("%s: %08x\n", __func__, nport);
+
+    DPRINTF("%s: %08x=%08x\n", __func__, nport, val);
+    return val;
+}
+
+static void i82374_write_descriptor(void *opaque, uint32_t nport, uint32_t data)
+{
+    DPRINTF("%s: %08x=%08x\n", __func__, nport, data);
+
+    BADF("%s: %08x=%08x\n", __func__, nport, data);
+}
+
+static uint32_t i82374_read_descriptor(void *opaque, uint32_t nport)
+{
+    uint32_t val = 0;
+
+    BADF("%s: %08x\n", __func__, nport);
+
+    DPRINTF("%s: %08x=%08x\n", __func__, nport, val);
+    return val;
+}
+
+static void i82374_init(I82374State *s)
+{
+    DMA_init(1, NULL);
+    memset(s->commands, 0, sizeof(s->commands));
+}
+
+typedef struct ISAi82374State {
+    ISADevice dev;
+    uint32_t iobase;
+    I82374State state;
+} ISAi82374State;
+
+static const VMStateDescription vmstate_isa_i82374 = {
+    .name = "isa-i82374",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT(state, ISAi82374State, 0, vmstate_i82374, I82374State),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static int i82374_isa_init(ISADevice *dev)
+{
+    ISAi82374State *isa = DO_UPCAST(ISAi82374State, dev, dev);
+    I82374State *s = &isa->state;
+
+    register_ioport_read(isa->iobase + 0x0A, 1, 1, i82374_read_isr, s);
+    register_ioport_write(isa->iobase + 0x10, 8, 1, i82374_write_command, s);
+    register_ioport_read(isa->iobase + 0x18, 8, 1, i82374_read_status, s);
+    register_ioport_write(isa->iobase + 0x20, 0x20, 1, i82374_write_descriptor, s);
+    register_ioport_read(isa->iobase + 0x20, 0x20, 1, i82374_read_descriptor, s);
+
+    i82374_init(s);
+
+    return 0;
+}
+
+static ISADeviceInfo i82374_isa_info = {
+    .qdev.name  = "i82374",
+    .qdev.size  = sizeof(ISAi82374State),
+    .qdev.vmsd  = &vmstate_isa_i82374,
+    .init       = i82374_isa_init,
+    .qdev.props = (Property[]) {
+        DEFINE_PROP_HEX32("iobase", ISAi82374State, iobase, 0x400),
+        DEFINE_PROP_END_OF_LIST()
+    },
+};
+
+static void i82374_register_devices(void)
+{
+    isa_qdev_register(&i82374_isa_info);
+}
+
+device_init(i82374_register_devices)
diff --git a/hw/i82378.c b/hw/i82378.c
new file mode 100644
index 0000000000..95ae274f26
--- /dev/null
+++ b/hw/i82378.c
@@ -0,0 +1,264 @@
+/*
+ * QEMU Intel i82378 emulation (PCI to ISA bridge)
+ *
+ * Copyright (c) 2010-2011 Hervé Poussineau
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "pci.h"
+#include "pc.h"
+
+//#define DEBUG_I82378
+
+#ifdef DEBUG_I82378
+#define DPRINTF(fmt, ...) \
+do { fprintf(stderr, "i82378: " fmt , ## __VA_ARGS__); } while (0)
+#else
+#define DPRINTF(fmt, ...) \
+do {} while (0)
+#endif
+
+#define BADF(fmt, ...) \
+do { fprintf(stderr, "i82378 ERROR: " fmt , ## __VA_ARGS__); } while (0)
+
+typedef struct I82378State {
+    qemu_irq out[2];
+    qemu_irq *i8259;
+    MemoryRegion io;
+    MemoryRegion mem;
+} I82378State;
+
+typedef struct PCIi82378State {
+    PCIDevice pci_dev;
+    uint32_t isa_io_base;
+    uint32_t isa_mem_base;
+    I82378State state;
+} PCIi82378State;
+
+static const VMStateDescription vmstate_pci_i82378 = {
+    .name = "pci-i82378",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(pci_dev, PCIi82378State),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void i82378_io_write(void *opaque, target_phys_addr_t addr,
+                            uint64_t value, unsigned int size)
+{
+    switch (size) {
+    case 1:
+        DPRINTF("%s: " TARGET_FMT_plx "=%02" PRIx64 "\n", __func__,
+                addr, value);
+        cpu_outb(addr, value);
+        break;
+    case 2:
+        DPRINTF("%s: " TARGET_FMT_plx "=%04" PRIx64 "\n", __func__,
+                addr, value);
+        cpu_outw(addr, value);
+        break;
+    case 4:
+        DPRINTF("%s: " TARGET_FMT_plx "=%08" PRIx64 "\n", __func__,
+                addr, value);
+        cpu_outl(addr, value);
+        break;
+    default:
+        abort();
+    }
+}
+
+static uint64_t i82378_io_read(void *opaque, target_phys_addr_t addr,
+                               unsigned int size)
+{
+    DPRINTF("%s: " TARGET_FMT_plx "\n", __func__, addr);
+    switch (size) {
+    case 1:
+        return cpu_inb(addr);
+    case 2:
+        return cpu_inw(addr);
+    case 4:
+        return cpu_inl(addr);
+    default:
+        abort();
+    }
+}
+
+static const MemoryRegionOps i82378_io_ops = {
+    .read = i82378_io_read,
+    .write = i82378_io_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void i82378_mem_write(void *opaque, target_phys_addr_t addr,
+                             uint64_t value, unsigned int size)
+{
+    switch (size) {
+    case 1:
+        DPRINTF("%s: " TARGET_FMT_plx "=%02" PRIx64 "\n", __func__,
+                addr, value);
+        cpu_outb(addr, value);
+        break;
+    case 2:
+        DPRINTF("%s: " TARGET_FMT_plx "=%04" PRIx64 "\n", __func__,
+                addr, value);
+        cpu_outw(addr, value);
+        break;
+    case 4:
+        DPRINTF("%s: " TARGET_FMT_plx "=%08" PRIx64 "\n", __func__,
+                addr, value);
+        cpu_outl(addr, value);
+        break;
+    default:
+        abort();
+    }
+}
+
+static uint64_t i82378_mem_read(void *opaque, target_phys_addr_t addr,
+                                unsigned int size)
+{
+    DPRINTF("%s: " TARGET_FMT_plx "\n", __func__, addr);
+    switch (size) {
+    case 1:
+        return cpu_inb(addr);
+    case 2:
+        return cpu_inw(addr);
+    case 4:
+        return cpu_inl(addr);
+    default:
+        abort();
+    }
+}
+
+static const MemoryRegionOps i82378_mem_ops = {
+    .read = i82378_mem_read,
+    .write = i82378_mem_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void i82378_request_out0_irq(void *opaque, int irq, int level)
+{
+    I82378State *s = opaque;
+    qemu_set_irq(s->out[0], level);
+}
+
+static void i82378_request_pic_irq(void *opaque, int irq, int level)
+{
+    DeviceState *dev = opaque;
+    PCIDevice *pci = DO_UPCAST(PCIDevice, qdev, dev);
+    PCIi82378State *s = DO_UPCAST(PCIi82378State, pci_dev, pci);
+
+    qemu_set_irq(s->state.i8259[irq], level);
+}
+
+static void i82378_init(DeviceState *dev, I82378State *s)
+{
+    ISABus *isabus = DO_UPCAST(ISABus, qbus, qdev_get_child_bus(dev, "isa.0"));
+    ISADevice *pit;
+    qemu_irq *out0_irq;
+
+    /* This device has:
+       2 82C59 (irq)
+       1 82C54 (pit)
+       2 82C37 (dma)
+       NMI
+       Utility Bus Support Registers
+
+       All devices accept byte access only, except timer
+     */
+
+    qdev_init_gpio_out(dev, s->out, 2);
+    qdev_init_gpio_in(dev, i82378_request_pic_irq, 16);
+
+    /* Workaround the fact that i8259 is not qdev'ified... */
+    out0_irq = qemu_allocate_irqs(i82378_request_out0_irq, s, 1);
+
+    /* 2 82C59 (irq) */
+    s->i8259 = i8259_init(isabus, *out0_irq);
+    isa_bus_irqs(isabus, s->i8259);
+
+    /* 1 82C54 (pit) */
+    pit = pit_init(isabus, 0x40, 0);
+
+    /* speaker */
+    pcspk_init(pit);
+
+    /* 2 82C37 (dma) */
+    DMA_init(1, &s->out[1]);
+    isa_create_simple(isabus, "i82374");
+
+    /* timer */
+    isa_create_simple(isabus, "mc146818rtc");
+}
+
+static int pci_i82378_init(PCIDevice *dev)
+{
+    PCIi82378State *pci = DO_UPCAST(PCIi82378State, pci_dev, dev);
+    I82378State *s = &pci->state;
+    uint8_t *pci_conf;
+
+    pci_conf = dev->config;
+    pci_set_word(pci_conf + PCI_COMMAND,
+                 PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+    pci_set_word(pci_conf + PCI_STATUS,
+                 PCI_STATUS_DEVSEL_MEDIUM);
+
+    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin 0 */
+
+    memory_region_init_io(&s->io, &i82378_io_ops, s, "i82378-io", 0x00010000);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io);
+
+    memory_region_init_io(&s->mem, &i82378_mem_ops, s, "i82378-mem", 0x01000000);
+    memory_region_set_coalescing(&s->mem);
+    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
+
+    /* Make I/O address read only */
+    pci_set_word(dev->wmask + PCI_COMMAND, PCI_COMMAND_SPECIAL);
+    pci_set_long(dev->wmask + PCI_BASE_ADDRESS_0, 0);
+    pci_set_long(pci_conf + PCI_BASE_ADDRESS_0, pci->isa_io_base);
+
+    isa_mem_base = pci->isa_mem_base;
+    isa_bus_new(&dev->qdev, pci_address_space_io(dev));
+
+    i82378_init(&dev->qdev, s);
+
+    return 0;
+}
+
+static PCIDeviceInfo pci_i82378_info = {
+    .init = pci_i82378_init,
+    .qdev.name = "i82378",
+    .qdev.size = sizeof(PCIi82378State),
+    .qdev.vmsd = &vmstate_pci_i82378,
+    .vendor_id = PCI_VENDOR_ID_INTEL,
+    .device_id = PCI_DEVICE_ID_INTEL_82378,
+    .revision = 0x03,
+    .class_id = PCI_CLASS_BRIDGE_ISA,
+    .subsystem_vendor_id = 0x0,
+    .subsystem_id = 0x0,
+    .qdev.props = (Property[]) {
+        DEFINE_PROP_HEX32("iobase", PCIi82378State, isa_io_base, 0x80000000),
+        DEFINE_PROP_HEX32("membase", PCIi82378State, isa_mem_base, 0xc0000000),
+        DEFINE_PROP_END_OF_LIST()
+    },
+};
+
+static void i82378_register_devices(void)
+{
+    pci_qdev_register(&pci_i82378_info);
+}
+
+device_init(i82378_register_devices)
diff --git a/hw/pci_ids.h b/hw/pci_ids.h
index 85e5372006..e8235a7d05 100644
--- a/hw/pci_ids.h
+++ b/hw/pci_ids.h
@@ -98,6 +98,7 @@
 #define PCI_DEVICE_ID_MPC8533E           0x0030
 
 #define PCI_VENDOR_ID_INTEL              0x8086
+#define PCI_DEVICE_ID_INTEL_82378        0x0484
 #define PCI_DEVICE_ID_INTEL_82441        0x1237
 #define PCI_DEVICE_ID_INTEL_82801AA_5    0x2415
 #define PCI_DEVICE_ID_INTEL_82801D       0x24CD
diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 47dab3f184..438a75df80 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -29,7 +29,7 @@
 #include "sysemu.h"
 #include "isa.h"
 #include "pci.h"
-#include "prep_pci.h"
+#include "pci_host.h"
 #include "usb-ohci.h"
 #include "ppc.h"
 #include "boards.h"
@@ -83,37 +83,9 @@ static const int ide_irq[2] = { 13, 13 };
 static uint32_t ne2000_io[NE2000_NB_MAX] = { 0x300, 0x320, 0x340, 0x360, 0x280, 0x380 };
 static int ne2000_irq[NE2000_NB_MAX] = { 9, 10, 11, 3, 4, 5 };
 
-//static ISADevice *pit;
-
 /* ISA IO ports bridge */
 #define PPC_IO_BASE 0x80000000
 
-#if 0
-/* Speaker port 0x61 */
-static int speaker_data_on;
-static int dummy_refresh_clock;
-#endif
-
-static void speaker_ioport_write (void *opaque, uint32_t addr, uint32_t val)
-{
-#if 0
-    speaker_data_on = (val >> 1) & 1;
-    pit_set_gate(pit, 2, val & 1);
-#endif
-}
-
-static uint32_t speaker_ioport_read (void *opaque, uint32_t addr)
-{
-#if 0
-    int out;
-    out = pit_get_out(pit, 2, qemu_get_clock_ns(vm_clock));
-    dummy_refresh_clock ^= 1;
-    return (speaker_data_on << 1) | pit_get_gate(pit, 2) | (out << 5) |
-        (dummy_refresh_clock << 4);
-#endif
-    return 0;
-}
-
 /* PCI intack register */
 /* Read-only register (?) */
 static void PPC_intack_write (void *opaque, target_phys_addr_t addr,
@@ -522,9 +494,12 @@ static void ppc_prep_init (ram_addr_t ram_size,
     MemoryRegion *bios = g_new(MemoryRegion, 1);
     uint32_t kernel_base, initrd_base;
     long kernel_size, initrd_size;
+    DeviceState *dev;
+    SysBusDevice *sys;
+    PCIHostState *pcihost;
     PCIBus *pci_bus;
+    PCIDevice *pci;
     ISABus *isa_bus;
-    qemu_irq *i8259;
     qemu_irq *cpu_exit_irq;
     int ppc_boot_device;
     DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
@@ -560,6 +535,8 @@ static void ppc_prep_init (ram_addr_t ram_size,
 
     /* allocate and load BIOS */
     memory_region_init_ram(bios, "ppc_prep.bios", BIOS_SIZE);
+    memory_region_set_readonly(bios, true);
+    memory_region_add_subregion(sysmem, (uint32_t)(-BIOS_SIZE), bios);
     vmstate_register_ram_global(bios);
     if (bios_name == NULL)
         bios_name = BIOS_FILENAME;
@@ -573,8 +550,6 @@ static void ppc_prep_init (ram_addr_t ram_size,
         target_phys_addr_t bios_addr;
         bios_size = (bios_size + 0xfff) & ~0xfff;
         bios_addr = (uint32_t)(-bios_size);
-        memory_region_set_readonly(bios, true);
-        memory_region_add_subregion(sysmem, bios_addr, bios);
         bios_size = load_image_targphys(filename, bios_addr, bios_size);
     }
     if (bios_size < 0 || bios_size > BIOS_SIZE) {
@@ -626,16 +601,34 @@ static void ppc_prep_init (ram_addr_t ram_size,
         }
     }
 
-    isa_mem_base = 0xc0000000;
     if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) {
         hw_error("Only 6xx bus is supported on PREP machine\n");
     }
-    /* Hmm, prep has no pci-isa bridge ??? */
-    isa_bus = isa_bus_new(NULL, get_system_io());
-    i8259 = i8259_init(isa_bus, first_cpu->irq_inputs[PPC6xx_INPUT_INT]);
-    pci_bus = pci_prep_init(i8259, get_system_memory(), get_system_io());
-    isa_bus_irqs(isa_bus, i8259);
-    //    pci_bus = i440fx_init();
+
+    dev = qdev_create(NULL, "raven-pcihost");
+    sys = sysbus_from_qdev(dev);
+    pcihost = DO_UPCAST(PCIHostState, busdev, sys);
+    pcihost->address_space = get_system_memory();
+    qdev_init_nofail(dev);
+    qdev_property_add_child(qdev_get_root(), "raven", dev, NULL);
+    pci_bus = (PCIBus *)qdev_get_child_bus(dev, "pci.0");
+    if (pci_bus == NULL) {
+        fprintf(stderr, "Couldn't create PCI host controller.\n");
+        exit(1);
+    }
+
+    /* PCI -> ISA bridge */
+    pci = pci_create_simple(pci_bus, PCI_DEVFN(1, 0), "i82378");
+    cpu_exit_irq = qemu_allocate_irqs(cpu_request_exit, NULL, 1);
+    qdev_connect_gpio_out(&pci->qdev, 0,
+                          first_cpu->irq_inputs[PPC6xx_INPUT_INT]);
+    qdev_connect_gpio_out(&pci->qdev, 1, *cpu_exit_irq);
+    sysbus_connect_irq(&pcihost->busdev, 0, qdev_get_gpio_in(&pci->qdev, 9));
+    sysbus_connect_irq(&pcihost->busdev, 1, qdev_get_gpio_in(&pci->qdev, 11));
+    sysbus_connect_irq(&pcihost->busdev, 2, qdev_get_gpio_in(&pci->qdev, 9));
+    sysbus_connect_irq(&pcihost->busdev, 3, qdev_get_gpio_in(&pci->qdev, 11));
+    isa_bus = DO_UPCAST(ISABus, qbus, qdev_get_child_bus(&pci->qdev, "isa.0"));
+
     /* Register 8 MB of ISA IO space (needed for non-contiguous map) */
     memory_region_init_io(PPC_io_memory, &PPC_prep_io_ops, sysctrl,
                           "ppc-io", 0x00800000);
@@ -643,9 +636,6 @@ static void ppc_prep_init (ram_addr_t ram_size,
 
     /* init basic PC hardware */
     pci_vga_init(pci_bus);
-    //    openpic = openpic_init(0x00000000, 0xF0000000, 1);
-    //    pit = pit_init(0x40, 0);
-    rtc_init(isa_bus, 2000, NULL);
 
     if (serial_hds[0])
         serial_isa_init(isa_bus, 0, serial_hds[0]);
@@ -672,9 +662,6 @@ static void ppc_prep_init (ram_addr_t ram_size,
     }
     isa_create_simple(isa_bus, "i8042");
 
-    cpu_exit_irq = qemu_allocate_irqs(cpu_request_exit, NULL, 1);
-    DMA_init(1, cpu_exit_irq);
-
     //    SB16_init();
 
     for(i = 0; i < MAX_FD; i++) {
@@ -682,9 +669,6 @@ static void ppc_prep_init (ram_addr_t ram_size,
     }
     fdctrl_init_isa(isa_bus, fd);
 
-    /* Register speaker port */
-    register_ioport_read(0x61, 1, 1, speaker_ioport_read, NULL);
-    register_ioport_write(0x61, 1, 1, speaker_ioport_write, NULL);
     /* Register fake IO ports for PREP */
     sysctrl->reset_irq = first_cpu->irq_inputs[PPC6xx_INPUT_HRESET];
     register_ioport_read(0x398, 2, 1, &PREP_io_read, sysctrl);
@@ -707,7 +691,7 @@ static void ppc_prep_init (ram_addr_t ram_size,
         usb_ohci_init_pci(pci_bus, -1);
     }
 
-    m48t59 = m48t59_init(i8259[8], 0, 0x0074, NVRAM_SIZE, 59);
+    m48t59 = m48t59_init_isa(isa_bus, 0x0074, NVRAM_SIZE, 59);
     if (m48t59 == NULL)
         return;
     sysctrl->nvram = m48t59;
diff --git a/hw/prep_pci.c b/hw/prep_pci.c
index ea9fb6902c..4961eede8c 100644
--- a/hw/prep_pci.c
+++ b/hw/prep_pci.c
@@ -25,9 +25,16 @@
 #include "hw.h"
 #include "pci.h"
 #include "pci_host.h"
-#include "prep_pci.h"
+#include "exec-memory.h"
 
-typedef PCIHostState PREPPCIState;
+typedef struct PRePPCIState {
+    PCIHostState host_state;
+    qemu_irq irq[4];
+} PREPPCIState;
+
+typedef struct RavenPCIState {
+    PCIDevice dev;
+} RavenPCIState;
 
 static inline uint32_t PPC_PCIIO_config(target_phys_addr_t addr)
 {
@@ -40,58 +47,24 @@ static inline uint32_t PPC_PCIIO_config(target_phys_addr_t addr)
     return (addr & 0x7ff) |  (i << 11);
 }
 
-static void PPC_PCIIO_writeb (void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-    PREPPCIState *s = opaque;
-    pci_data_write(s->bus, PPC_PCIIO_config(addr), val, 1);
-}
-
-static void PPC_PCIIO_writew (void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-    PREPPCIState *s = opaque;
-    val = bswap16(val);
-    pci_data_write(s->bus, PPC_PCIIO_config(addr), val, 2);
-}
-
-static void PPC_PCIIO_writel (void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-    PREPPCIState *s = opaque;
-    val = bswap32(val);
-    pci_data_write(s->bus, PPC_PCIIO_config(addr), val, 4);
-}
-
-static uint32_t PPC_PCIIO_readb (void *opaque, target_phys_addr_t addr)
-{
-    PREPPCIState *s = opaque;
-    uint32_t val;
-    val = pci_data_read(s->bus, PPC_PCIIO_config(addr), 1);
-    return val;
-}
-
-static uint32_t PPC_PCIIO_readw (void *opaque, target_phys_addr_t addr)
+static void ppc_pci_io_write(void *opaque, target_phys_addr_t addr,
+                             uint64_t val, unsigned int size)
 {
     PREPPCIState *s = opaque;
-    uint32_t val;
-    val = pci_data_read(s->bus, PPC_PCIIO_config(addr), 2);
-    val = bswap16(val);
-    return val;
+    pci_data_write(s->host_state.bus, PPC_PCIIO_config(addr), val, size);
 }
 
-static uint32_t PPC_PCIIO_readl (void *opaque, target_phys_addr_t addr)
+static uint64_t ppc_pci_io_read(void *opaque, target_phys_addr_t addr,
+                                unsigned int size)
 {
     PREPPCIState *s = opaque;
-    uint32_t val;
-    val = pci_data_read(s->bus, PPC_PCIIO_config(addr), 4);
-    val = bswap32(val);
-    return val;
+    return pci_data_read(s->host_state.bus, PPC_PCIIO_config(addr), size);
 }
 
 static const MemoryRegionOps PPC_PCIIO_ops = {
-    .old_mmio = {
-        .read = { PPC_PCIIO_readb, PPC_PCIIO_readw, PPC_PCIIO_readl, },
-        .write = { PPC_PCIIO_writeb, PPC_PCIIO_writew, PPC_PCIIO_writel, },
-    },
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .read = ppc_pci_io_read,
+    .write = ppc_pci_io_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
 static int prep_map_irq(PCIDevice *pci_dev, int irq_num)
@@ -103,46 +76,93 @@ static void prep_set_irq(void *opaque, int irq_num, int level)
 {
     qemu_irq *pic = opaque;
 
-    qemu_set_irq(pic[(irq_num & 1) ? 11 : 9] , level);
+    qemu_set_irq(pic[irq_num] , level);
 }
 
-PCIBus *pci_prep_init(qemu_irq *pic,
-                      MemoryRegion *address_space_mem,
-                      MemoryRegion *address_space_io)
+static int raven_pcihost_init(SysBusDevice *dev)
 {
-    PREPPCIState *s;
-    PCIDevice *d;
+    PCIHostState *h = FROM_SYSBUS(PCIHostState, dev);
+    PREPPCIState *s = DO_UPCAST(PREPPCIState, host_state, h);
+    MemoryRegion *address_space_mem = get_system_memory();
+    MemoryRegion *address_space_io = get_system_io();
+    PCIBus *bus;
+    int i;
 
-    s = g_malloc0(sizeof(PREPPCIState));
-    s->bus = pci_register_bus(NULL, "pci",
-                              prep_set_irq, prep_map_irq, pic,
-                              address_space_mem,
-                              address_space_io,
-                              0, 4);
+    for (i = 0; i < 4; i++) {
+        sysbus_init_irq(dev, &s->irq[i]);
+    }
 
-    memory_region_init_io(&s->conf_mem, &pci_host_conf_be_ops, s,
+    bus = pci_register_bus(&h->busdev.qdev, NULL,
+                           prep_set_irq, prep_map_irq, s->irq,
+                           address_space_mem, address_space_io, 0, 4);
+    h->bus = bus;
+
+    memory_region_init_io(&h->conf_mem, &pci_host_conf_be_ops, s,
                           "pci-conf-idx", 1);
-    memory_region_add_subregion(address_space_io, 0xcf8, &s->conf_mem);
-    sysbus_init_ioports(&s->busdev, 0xcf8, 1);
+    sysbus_add_io(dev, 0xcf8, &h->conf_mem);
+    sysbus_init_ioports(&h->busdev, 0xcf8, 1);
 
-    memory_region_init_io(&s->data_mem, &pci_host_data_be_ops, s,
+    memory_region_init_io(&h->data_mem, &pci_host_data_be_ops, s,
                           "pci-conf-data", 1);
-    memory_region_add_subregion(address_space_io, 0xcfc, &s->data_mem);
-    sysbus_init_ioports(&s->busdev, 0xcfc, 1);
-
-    memory_region_init_io(&s->mmcfg, &PPC_PCIIO_ops, s, "pciio", 0x00400000);
-    memory_region_add_subregion(address_space_mem, 0x80800000, &s->mmcfg);
-
-    /* PCI host bridge */
-    d = pci_register_device(s->bus, "PREP Host Bridge - Motorola Raven",
-                            sizeof(PCIDevice), 0, NULL, NULL);
-    pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_MOTOROLA);
-    pci_config_set_device_id(d->config, PCI_DEVICE_ID_MOTOROLA_RAVEN);
-    d->config[0x08] = 0x00; // revision
-    pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST);
+    sysbus_add_io(dev, 0xcfc, &h->data_mem);
+    sysbus_init_ioports(&h->busdev, 0xcfc, 1);
+
+    memory_region_init_io(&h->mmcfg, &PPC_PCIIO_ops, s, "pciio", 0x00400000);
+    memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
+
+    pci_create_simple(bus, 0, "raven");
+
+    return 0;
+}
+
+static int raven_init(PCIDevice *d)
+{
     d->config[0x0C] = 0x08; // cache_line_size
     d->config[0x0D] = 0x10; // latency_timer
     d->config[0x34] = 0x00; // capabilities_pointer
 
-    return s->bus;
+    return 0;
 }
+
+static const VMStateDescription vmstate_raven = {
+    .name = "raven",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, RavenPCIState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static PCIDeviceInfo raven_info = {
+    .qdev.name = "raven",
+    .qdev.desc = "PReP Host Bridge - Motorola Raven",
+    .qdev.size = sizeof(RavenPCIState),
+    .qdev.vmsd = &vmstate_raven,
+    .qdev.no_user = 1,
+    .no_hotplug = 1,
+    .init = raven_init,
+    .vendor_id = PCI_VENDOR_ID_MOTOROLA,
+    .device_id = PCI_DEVICE_ID_MOTOROLA_RAVEN,
+    .revision = 0x00,
+    .class_id = PCI_CLASS_BRIDGE_HOST,
+    .qdev.props = (Property[]) {
+        DEFINE_PROP_END_OF_LIST()
+    },
+};
+
+static SysBusDeviceInfo raven_pcihost_info = {
+    .qdev.name = "raven-pcihost",
+    .qdev.fw_name = "pci",
+    .qdev.size = sizeof(PREPPCIState),
+    .qdev.no_user = 1,
+    .init = raven_pcihost_init,
+};
+
+static void raven_register_devices(void)
+{
+    sysbus_register_withprop(&raven_pcihost_info);
+    pci_qdev_register(&raven_info);
+}
+
+device_init(raven_register_devices)
diff --git a/hw/prep_pci.h b/hw/prep_pci.h
deleted file mode 100644
index b6b481a517..0000000000
--- a/hw/prep_pci.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef QEMU_PREP_PCI_H
-#define QEMU_PREP_PCI_H
-
-#include "qemu-common.h"
-#include "memory.h"
-
-PCIBus *pci_prep_init(qemu_irq *pic,
-                      MemoryRegion *address_space_mem,
-                      MemoryRegion *address_space_io);
-
-#endif