diff --git a/hw/g364fb.c b/hw/g364fb.c
index 3c8fb98..10c53fc 100644
--- a/hw/g364fb.c
+++ b/hw/g364fb.c
@@ -17,10 +17,9 @@
  * with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "hw.h"
-#include "mips.h"
 #include "console.h"
 #include "pixel_ops.h"
+#include "sysbus.h"
 
 //#define DEBUG_G364
 
@@ -33,11 +32,14 @@ do { printf("g364: " fmt , ## __VA_ARGS__); } while (0)
 #define BADF(fmt, ...) \
 do { fprintf(stderr, "g364 ERROR: " fmt , ## __VA_ARGS__);} while (0)
 
+#define VRAM_BASE 0x40000000
+
 typedef struct G364State {
+    DeviceState qdev;
     /* hardware */
     uint8_t *vram;
     ram_addr_t vram_offset;
-    int vram_size;
+    uint32_t vram_size;
     qemu_irq irq;
     /* registers */
     uint8_t color_palette[256][3];
@@ -279,9 +281,8 @@ static inline void g364fb_invalidate_display(void *opaque)
     }
 }
 
-static void g364fb_reset(void *opaque)
+static void g364fb_reset(G364State *s)
 {
-    G364State *s = opaque;
     qemu_irq_lower(s->irq);
 
     memset(s->color_palette, 0, sizeof(s->color_palette));
@@ -292,7 +293,7 @@ static void g364fb_reset(void *opaque)
     s->top_of_screen = 0;
     s->width = s->height = 0;
     memset(s->vram, 0, s->vram_size);
-    g364fb_invalidate_display(opaque);
+    g364fb_invalidate_display(s);
 }
 
 static void g364fb_screen_dump(void *opaque, const char *filename)
@@ -534,28 +535,9 @@ static CPUWriteMemoryFunc * const g364fb_ctrl_write[3] = {
     g364fb_ctrl_writel,
 };
 
-static int g364fb_load(QEMUFile *f, void *opaque, int version_id)
+static int g364fb_post_load(void *opaque, int version_id)
 {
     G364State *s = opaque;
-    unsigned int i, vram_size;
-
-    if (version_id != 1)
-        return -EINVAL;
-
-    vram_size = qemu_get_be32(f);
-    if (vram_size < s->vram_size)
-        return -EINVAL;
-    qemu_get_buffer(f, s->vram, s->vram_size);
-    for (i = 0; i < 256; i++)
-        qemu_get_buffer(f, s->color_palette[i], 3);
-    for (i = 0; i < 3; i++)
-        qemu_get_buffer(f, s->cursor_palette[i], 3);
-    qemu_get_buffer(f, (uint8_t *)s->cursor, sizeof(s->cursor));
-    s->cursor_position = qemu_get_be32(f);
-    s->ctla = qemu_get_be32(f);
-    s->top_of_screen = qemu_get_be32(f);
-    s->width = qemu_get_be32(f);
-    s->height = qemu_get_be32(f);
 
     /* force refresh */
     g364fb_update_depth(s);
@@ -564,51 +546,75 @@ static int g364fb_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-static void g364fb_save(QEMUFile *f, void *opaque)
-{
-    G364State *s = opaque;
-    int i;
+static const VMStateDescription vmstate_g364fb = {
+    .name = "g364fb",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .minimum_version_id_old = 0,
+    .post_load = g364fb_post_load,
+    .fields = (VMStateField []) {
+        /* FIXME: vram? */
+        VMSTATE_BUFFER_UNSAFE(color_palette, G364State, 0, 256 * 3),
+        VMSTATE_BUFFER_UNSAFE(cursor_palette, G364State, 0, 9),
+        VMSTATE_UINT16_ARRAY(cursor, G364State, 512),
+        VMSTATE_UINT32(cursor_position, G364State),
+        VMSTATE_UINT32(ctla, G364State),
+        VMSTATE_UINT32(top_of_screen, G364State),
+        VMSTATE_UINT32(width, G364State),
+        VMSTATE_UINT32(height, G364State),
+        VMSTATE_END_OF_LIST()
+    }
+};
 
-    qemu_put_be32(f, s->vram_size);
-    qemu_put_buffer(f, s->vram, s->vram_size);
-    for (i = 0; i < 256; i++)
-        qemu_put_buffer(f, s->color_palette[i], 3);
-    for (i = 0; i < 3; i++)
-        qemu_put_buffer(f, s->cursor_palette[i], 3);
-    qemu_put_buffer(f, (uint8_t *)s->cursor, sizeof(s->cursor));
-    qemu_put_be32(f, s->cursor_position);
-    qemu_put_be32(f, s->ctla);
-    qemu_put_be32(f, s->top_of_screen);
-    qemu_put_be32(f, s->width);
-    qemu_put_be32(f, s->height);
-}
+typedef struct {
+    SysBusDevice busdev;
+    G364State g364;
+} SysBusG364State;
 
-int g364fb_mm_init(target_phys_addr_t vram_base,
-                   target_phys_addr_t ctrl_base, int it_shift,
-                   qemu_irq irq)
+static int g364fb_sysbus_initfn(SysBusDevice *dev)
 {
-    G364State *s;
+    G364State *s = &FROM_SYSBUS(SysBusG364State, dev)->g364;
     int io_ctrl;
 
-    s = qemu_mallocz(sizeof(G364State));
-
-    s->vram_size = 8 * 1024 * 1024;
     s->vram_offset = qemu_ram_alloc(NULL, "g364fb.vram", s->vram_size);
     s->vram = qemu_get_ram_ptr(s->vram_offset);
-    s->irq = irq;
-
-    qemu_register_reset(g364fb_reset, s);
-    register_savevm(NULL, "g364fb", 0, 1, g364fb_save, g364fb_load, s);
-    g364fb_reset(s);
+    sysbus_init_irq(dev, &s->irq);
 
     s->ds = graphic_console_init(g364fb_update_display,
                                  g364fb_invalidate_display,
                                  g364fb_screen_dump, NULL, s);
 
-    cpu_register_physical_memory(vram_base, s->vram_size, s->vram_offset);
+    cpu_register_physical_memory(VRAM_BASE, s->vram_size, s->vram_offset);
 
     io_ctrl = cpu_register_io_memory(g364fb_ctrl_read, g364fb_ctrl_write, s);
-    cpu_register_physical_memory(ctrl_base, 0x200000, io_ctrl);
+    sysbus_init_mmio(dev, 0x200000, io_ctrl);
+
+    g364fb_post_load(s, 0);
 
     return 0;
 }
+
+static void g364fb_sysbus_reset(DeviceState *d)
+{
+    G364State *s = &container_of(d, SysBusG364State, busdev.qdev)->g364;
+    g364fb_reset(s);
+}
+
+static SysBusDeviceInfo g364fb_sysbus_info = {
+    .qdev.name  = "g364",
+    .qdev.size  = sizeof(SysBusG364State),
+    .qdev.vmsd  = &vmstate_g364fb,
+    .qdev.reset = g364fb_sysbus_reset,
+    .init       = g364fb_sysbus_initfn,
+    .qdev.props = (Property[]) {
+        DEFINE_PROP_HEX32("vram_size", SysBusG364State, g364.vram_size, 8 * 1024 * 1024),
+        DEFINE_PROP_END_OF_LIST(),
+    },
+};
+
+static void g364fb_register(void)
+{
+    sysbus_register_withprop(&g364fb_sysbus_info);
+}
+
+device_init(g364fb_register)
diff --git a/hw/mips.h b/hw/mips.h
index 285f7dc..75b7c3d 100644
--- a/hw/mips.h
+++ b/hw/mips.h
@@ -8,11 +8,6 @@ PCIBus *pci_gt64120_init(qemu_irq *pic);
 /* bonito.c */
 PCIBus *bonito_init(qemu_irq *pic);
 
-/* g364fb.c */
-int g364fb_mm_init(target_phys_addr_t vram_base,
-                   target_phys_addr_t ctrl_base, int it_shift,
-                   qemu_irq irq);
-
 /* mipsnet.c */
 void mipsnet_init(int base, qemu_irq irq, NICInfo *nd);
 
diff --git a/hw/mips_jazz.c b/hw/mips_jazz.c
index 98567d2..f24b5eb 100644
--- a/hw/mips_jazz.c
+++ b/hw/mips_jazz.c
@@ -215,7 +215,7 @@ void mips_jazz_init (ram_addr_t ram_size,
     /* Video card */
     switch (jazz_model) {
     case JAZZ_MAGNUM:
-        g364fb_mm_init(0x40000000, 0x60000000, 0, rc4030[3]);
+        sysbus_create_simple("g364", 0x60000000, rc4030[3]);
         break;
     case JAZZ_PICA61:
         sysbus_create_simple("sysbus-vga", 0x60000000, NULL);
