1 /* 2 * QEMU JAZZ RC4030 chipset 3 * 4 * Copyright (c) 2007-2013 Hervé Poussineau 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/hw.h" 27 #include "hw/mips/mips.h" 28 #include "hw/sysbus.h" 29 #include "qemu/timer.h" 30 #include "qemu/log.h" 31 #include "exec/address-spaces.h" 32 #include "trace.h" 33 34 /********************************************************/ 35 /* rc4030 emulation */ 36 37 typedef struct dma_pagetable_entry { 38 int32_t frame; 39 int32_t owner; 40 } QEMU_PACKED dma_pagetable_entry; 41 42 #define DMA_PAGESIZE 4096 43 #define DMA_REG_ENABLE 1 44 #define DMA_REG_COUNT 2 45 #define DMA_REG_ADDRESS 3 46 47 #define DMA_FLAG_ENABLE 0x0001 48 #define DMA_FLAG_MEM_TO_DEV 0x0002 49 #define DMA_FLAG_TC_INTR 0x0100 50 #define DMA_FLAG_MEM_INTR 0x0200 51 #define DMA_FLAG_ADDR_INTR 0x0400 52 53 #define TYPE_RC4030 "rc4030" 54 #define RC4030(obj) \ 55 OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030) 56 57 typedef struct rc4030State 58 { 59 SysBusDevice parent; 60 61 uint32_t config; /* 0x0000: RC4030 config register */ 62 uint32_t revision; /* 0x0008: RC4030 Revision register */ 63 uint32_t invalid_address_register; /* 0x0010: Invalid Address register */ 64 65 /* DMA */ 66 uint32_t dma_regs[8][4]; 67 uint32_t dma_tl_base; /* 0x0018: DMA transl. table base */ 68 uint32_t dma_tl_limit; /* 0x0020: DMA transl. table limit */ 69 70 /* cache */ 71 uint32_t cache_maint; /* 0x0030: Cache Maintenance */ 72 uint32_t remote_failed_address; /* 0x0038: Remote Failed Address */ 73 uint32_t memory_failed_address; /* 0x0040: Memory Failed Address */ 74 uint32_t cache_ptag; /* 0x0048: I/O Cache Physical Tag */ 75 uint32_t cache_ltag; /* 0x0050: I/O Cache Logical Tag */ 76 uint32_t cache_bmask; /* 0x0058: I/O Cache Byte Mask */ 77 78 uint32_t nmi_interrupt; /* 0x0200: interrupt source */ 79 uint32_t memory_refresh_rate; /* 0x0210: memory refresh rate */ 80 uint32_t nvram_protect; /* 0x0220: NV ram protect register */ 81 uint32_t rem_speed[16]; 82 uint32_t imr_jazz; /* Local bus int enable mask */ 83 uint32_t isr_jazz; /* Local bus int source */ 84 85 /* timer */ 86 QEMUTimer *periodic_timer; 87 uint32_t itr; /* Interval timer reload */ 88 89 qemu_irq timer_irq; 90 qemu_irq jazz_bus_irq; 91 92 /* whole DMA memory region, root of DMA address space */ 93 MemoryRegion dma_mr; 94 AddressSpace dma_as; 95 96 MemoryRegion iomem_chipset; 97 MemoryRegion iomem_jazzio; 98 } rc4030State; 99 100 static void set_next_tick(rc4030State *s) 101 { 102 uint32_t tm_hz; 103 qemu_irq_lower(s->timer_irq); 104 105 tm_hz = 1000 / (s->itr + 1); 106 107 timer_mod(s->periodic_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 108 NANOSECONDS_PER_SECOND / tm_hz); 109 } 110 111 /* called for accesses to rc4030 */ 112 static uint64_t rc4030_read(void *opaque, hwaddr addr, unsigned int size) 113 { 114 rc4030State *s = opaque; 115 uint32_t val; 116 117 addr &= 0x3fff; 118 switch (addr & ~0x3) { 119 /* Global config register */ 120 case 0x0000: 121 val = s->config; 122 break; 123 /* Revision register */ 124 case 0x0008: 125 val = s->revision; 126 break; 127 /* Invalid Address register */ 128 case 0x0010: 129 val = s->invalid_address_register; 130 break; 131 /* DMA transl. table base */ 132 case 0x0018: 133 val = s->dma_tl_base; 134 break; 135 /* DMA transl. table limit */ 136 case 0x0020: 137 val = s->dma_tl_limit; 138 break; 139 /* Remote Failed Address */ 140 case 0x0038: 141 val = s->remote_failed_address; 142 break; 143 /* Memory Failed Address */ 144 case 0x0040: 145 val = s->memory_failed_address; 146 break; 147 /* I/O Cache Byte Mask */ 148 case 0x0058: 149 val = s->cache_bmask; 150 /* HACK */ 151 if (s->cache_bmask == (uint32_t)-1) 152 s->cache_bmask = 0; 153 break; 154 /* Remote Speed Registers */ 155 case 0x0070: 156 case 0x0078: 157 case 0x0080: 158 case 0x0088: 159 case 0x0090: 160 case 0x0098: 161 case 0x00a0: 162 case 0x00a8: 163 case 0x00b0: 164 case 0x00b8: 165 case 0x00c0: 166 case 0x00c8: 167 case 0x00d0: 168 case 0x00d8: 169 case 0x00e0: 170 case 0x00e8: 171 val = s->rem_speed[(addr - 0x0070) >> 3]; 172 break; 173 /* DMA channel base address */ 174 case 0x0100: 175 case 0x0108: 176 case 0x0110: 177 case 0x0118: 178 case 0x0120: 179 case 0x0128: 180 case 0x0130: 181 case 0x0138: 182 case 0x0140: 183 case 0x0148: 184 case 0x0150: 185 case 0x0158: 186 case 0x0160: 187 case 0x0168: 188 case 0x0170: 189 case 0x0178: 190 case 0x0180: 191 case 0x0188: 192 case 0x0190: 193 case 0x0198: 194 case 0x01a0: 195 case 0x01a8: 196 case 0x01b0: 197 case 0x01b8: 198 case 0x01c0: 199 case 0x01c8: 200 case 0x01d0: 201 case 0x01d8: 202 case 0x01e0: 203 case 0x01e8: 204 case 0x01f0: 205 case 0x01f8: 206 { 207 int entry = (addr - 0x0100) >> 5; 208 int idx = (addr & 0x1f) >> 3; 209 val = s->dma_regs[entry][idx]; 210 } 211 break; 212 /* Interrupt source */ 213 case 0x0200: 214 val = s->nmi_interrupt; 215 break; 216 /* Error type */ 217 case 0x0208: 218 val = 0; 219 break; 220 /* Memory refresh rate */ 221 case 0x0210: 222 val = s->memory_refresh_rate; 223 break; 224 /* NV ram protect register */ 225 case 0x0220: 226 val = s->nvram_protect; 227 break; 228 /* Interval timer count */ 229 case 0x0230: 230 val = 0; 231 qemu_irq_lower(s->timer_irq); 232 break; 233 /* EISA interrupt */ 234 case 0x0238: 235 val = 7; /* FIXME: should be read from EISA controller */ 236 break; 237 default: 238 qemu_log_mask(LOG_GUEST_ERROR, 239 "rc4030: invalid read at 0x%x", (int)addr); 240 val = 0; 241 break; 242 } 243 244 if ((addr & ~3) != 0x230) { 245 trace_rc4030_read(addr, val); 246 } 247 248 return val; 249 } 250 251 static void rc4030_write(void *opaque, hwaddr addr, uint64_t data, 252 unsigned int size) 253 { 254 rc4030State *s = opaque; 255 uint32_t val = data; 256 addr &= 0x3fff; 257 258 trace_rc4030_write(addr, val); 259 260 switch (addr & ~0x3) { 261 /* Global config register */ 262 case 0x0000: 263 s->config = val; 264 break; 265 /* DMA transl. table base */ 266 case 0x0018: 267 s->dma_tl_base = val; 268 break; 269 /* DMA transl. table limit */ 270 case 0x0020: 271 s->dma_tl_limit = val; 272 break; 273 /* DMA transl. table invalidated */ 274 case 0x0028: 275 break; 276 /* Cache Maintenance */ 277 case 0x0030: 278 s->cache_maint = val; 279 break; 280 /* I/O Cache Physical Tag */ 281 case 0x0048: 282 s->cache_ptag = val; 283 break; 284 /* I/O Cache Logical Tag */ 285 case 0x0050: 286 s->cache_ltag = val; 287 break; 288 /* I/O Cache Byte Mask */ 289 case 0x0058: 290 s->cache_bmask |= val; /* HACK */ 291 break; 292 /* I/O Cache Buffer Window */ 293 case 0x0060: 294 /* HACK */ 295 if (s->cache_ltag == 0x80000001 && s->cache_bmask == 0xf0f0f0f) { 296 hwaddr dest = s->cache_ptag & ~0x1; 297 dest += (s->cache_maint & 0x3) << 3; 298 cpu_physical_memory_write(dest, &val, 4); 299 } 300 break; 301 /* Remote Speed Registers */ 302 case 0x0070: 303 case 0x0078: 304 case 0x0080: 305 case 0x0088: 306 case 0x0090: 307 case 0x0098: 308 case 0x00a0: 309 case 0x00a8: 310 case 0x00b0: 311 case 0x00b8: 312 case 0x00c0: 313 case 0x00c8: 314 case 0x00d0: 315 case 0x00d8: 316 case 0x00e0: 317 case 0x00e8: 318 s->rem_speed[(addr - 0x0070) >> 3] = val; 319 break; 320 /* DMA channel base address */ 321 case 0x0100: 322 case 0x0108: 323 case 0x0110: 324 case 0x0118: 325 case 0x0120: 326 case 0x0128: 327 case 0x0130: 328 case 0x0138: 329 case 0x0140: 330 case 0x0148: 331 case 0x0150: 332 case 0x0158: 333 case 0x0160: 334 case 0x0168: 335 case 0x0170: 336 case 0x0178: 337 case 0x0180: 338 case 0x0188: 339 case 0x0190: 340 case 0x0198: 341 case 0x01a0: 342 case 0x01a8: 343 case 0x01b0: 344 case 0x01b8: 345 case 0x01c0: 346 case 0x01c8: 347 case 0x01d0: 348 case 0x01d8: 349 case 0x01e0: 350 case 0x01e8: 351 case 0x01f0: 352 case 0x01f8: 353 { 354 int entry = (addr - 0x0100) >> 5; 355 int idx = (addr & 0x1f) >> 3; 356 s->dma_regs[entry][idx] = val; 357 } 358 break; 359 /* Memory refresh rate */ 360 case 0x0210: 361 s->memory_refresh_rate = val; 362 break; 363 /* Interval timer reload */ 364 case 0x0228: 365 s->itr = val & 0x01FF; 366 qemu_irq_lower(s->timer_irq); 367 set_next_tick(s); 368 break; 369 /* EISA interrupt */ 370 case 0x0238: 371 break; 372 default: 373 qemu_log_mask(LOG_GUEST_ERROR, 374 "rc4030: invalid write of 0x%02x at 0x%x", 375 val, (int)addr); 376 break; 377 } 378 } 379 380 static const MemoryRegionOps rc4030_ops = { 381 .read = rc4030_read, 382 .write = rc4030_write, 383 .impl.min_access_size = 4, 384 .impl.max_access_size = 4, 385 .endianness = DEVICE_NATIVE_ENDIAN, 386 }; 387 388 static void update_jazz_irq(rc4030State *s) 389 { 390 uint16_t pending; 391 392 pending = s->isr_jazz & s->imr_jazz; 393 394 if (pending != 0) 395 qemu_irq_raise(s->jazz_bus_irq); 396 else 397 qemu_irq_lower(s->jazz_bus_irq); 398 } 399 400 static void rc4030_irq_jazz_request(void *opaque, int irq, int level) 401 { 402 rc4030State *s = opaque; 403 404 if (level) { 405 s->isr_jazz |= 1 << irq; 406 } else { 407 s->isr_jazz &= ~(1 << irq); 408 } 409 410 update_jazz_irq(s); 411 } 412 413 static void rc4030_periodic_timer(void *opaque) 414 { 415 rc4030State *s = opaque; 416 417 set_next_tick(s); 418 qemu_irq_raise(s->timer_irq); 419 } 420 421 static uint64_t jazzio_read(void *opaque, hwaddr addr, unsigned int size) 422 { 423 rc4030State *s = opaque; 424 uint32_t val; 425 uint32_t irq; 426 addr &= 0xfff; 427 428 switch (addr) { 429 /* Local bus int source */ 430 case 0x00: { 431 uint32_t pending = s->isr_jazz & s->imr_jazz; 432 val = 0; 433 irq = 0; 434 while (pending) { 435 if (pending & 1) { 436 val = (irq + 1) << 2; 437 break; 438 } 439 irq++; 440 pending >>= 1; 441 } 442 break; 443 } 444 /* Local bus int enable mask */ 445 case 0x02: 446 val = s->imr_jazz; 447 break; 448 default: 449 qemu_log_mask(LOG_GUEST_ERROR, 450 "rc4030/jazzio: invalid read at 0x%x", (int)addr); 451 val = 0; 452 break; 453 } 454 455 trace_jazzio_read(addr, val); 456 457 return val; 458 } 459 460 static void jazzio_write(void *opaque, hwaddr addr, uint64_t data, 461 unsigned int size) 462 { 463 rc4030State *s = opaque; 464 uint32_t val = data; 465 addr &= 0xfff; 466 467 trace_jazzio_write(addr, val); 468 469 switch (addr) { 470 /* Local bus int enable mask */ 471 case 0x02: 472 s->imr_jazz = val; 473 update_jazz_irq(s); 474 break; 475 default: 476 qemu_log_mask(LOG_GUEST_ERROR, 477 "rc4030/jazzio: invalid write of 0x%02x at 0x%x", 478 val, (int)addr); 479 break; 480 } 481 } 482 483 static const MemoryRegionOps jazzio_ops = { 484 .read = jazzio_read, 485 .write = jazzio_write, 486 .impl.min_access_size = 2, 487 .impl.max_access_size = 2, 488 .endianness = DEVICE_NATIVE_ENDIAN, 489 }; 490 491 static IOMMUTLBEntry rc4030_dma_translate(MemoryRegion *iommu, hwaddr addr, 492 bool is_write) 493 { 494 rc4030State *s = container_of(iommu, rc4030State, dma_mr); 495 IOMMUTLBEntry ret = { 496 .target_as = &address_space_memory, 497 .iova = addr & ~(DMA_PAGESIZE - 1), 498 .translated_addr = 0, 499 .addr_mask = DMA_PAGESIZE - 1, 500 .perm = IOMMU_NONE, 501 }; 502 uint64_t i, entry_address; 503 dma_pagetable_entry entry; 504 505 i = addr / DMA_PAGESIZE; 506 if (i < s->dma_tl_limit / sizeof(entry)) { 507 entry_address = (s->dma_tl_base & 0x7fffffff) + i * sizeof(entry); 508 if (address_space_read(ret.target_as, entry_address, 509 MEMTXATTRS_UNSPECIFIED, (unsigned char *)&entry, 510 sizeof(entry)) == MEMTX_OK) { 511 ret.translated_addr = entry.frame & ~(DMA_PAGESIZE - 1); 512 ret.perm = IOMMU_RW; 513 } 514 } 515 516 return ret; 517 } 518 519 static const MemoryRegionIOMMUOps rc4030_dma_ops = { 520 .translate = rc4030_dma_translate, 521 }; 522 523 static void rc4030_reset(DeviceState *dev) 524 { 525 rc4030State *s = RC4030(dev); 526 int i; 527 528 s->config = 0x410; /* some boards seem to accept 0x104 too */ 529 s->revision = 1; 530 s->invalid_address_register = 0; 531 532 memset(s->dma_regs, 0, sizeof(s->dma_regs)); 533 534 s->remote_failed_address = s->memory_failed_address = 0; 535 s->cache_maint = 0; 536 s->cache_ptag = s->cache_ltag = 0; 537 s->cache_bmask = 0; 538 539 s->memory_refresh_rate = 0x18186; 540 s->nvram_protect = 7; 541 for (i = 0; i < 15; i++) 542 s->rem_speed[i] = 7; 543 s->imr_jazz = 0x10; /* XXX: required by firmware, but why? */ 544 s->isr_jazz = 0; 545 546 s->itr = 0; 547 548 qemu_irq_lower(s->timer_irq); 549 qemu_irq_lower(s->jazz_bus_irq); 550 } 551 552 static int rc4030_post_load(void *opaque, int version_id) 553 { 554 rc4030State* s = opaque; 555 556 set_next_tick(s); 557 update_jazz_irq(s); 558 559 return 0; 560 } 561 562 static const VMStateDescription vmstate_rc4030 = { 563 .name = "rc4030", 564 .version_id = 3, 565 .post_load = rc4030_post_load, 566 .fields = (VMStateField []) { 567 VMSTATE_UINT32(config, rc4030State), 568 VMSTATE_UINT32(invalid_address_register, rc4030State), 569 VMSTATE_UINT32_2DARRAY(dma_regs, rc4030State, 8, 4), 570 VMSTATE_UINT32(dma_tl_base, rc4030State), 571 VMSTATE_UINT32(dma_tl_limit, rc4030State), 572 VMSTATE_UINT32(cache_maint, rc4030State), 573 VMSTATE_UINT32(remote_failed_address, rc4030State), 574 VMSTATE_UINT32(memory_failed_address, rc4030State), 575 VMSTATE_UINT32(cache_ptag, rc4030State), 576 VMSTATE_UINT32(cache_ltag, rc4030State), 577 VMSTATE_UINT32(cache_bmask, rc4030State), 578 VMSTATE_UINT32(memory_refresh_rate, rc4030State), 579 VMSTATE_UINT32(nvram_protect, rc4030State), 580 VMSTATE_UINT32_ARRAY(rem_speed, rc4030State, 16), 581 VMSTATE_UINT32(imr_jazz, rc4030State), 582 VMSTATE_UINT32(isr_jazz, rc4030State), 583 VMSTATE_UINT32(itr, rc4030State), 584 VMSTATE_END_OF_LIST() 585 } 586 }; 587 588 static void rc4030_do_dma(void *opaque, int n, uint8_t *buf, int len, int is_write) 589 { 590 rc4030State *s = opaque; 591 hwaddr dma_addr; 592 int dev_to_mem; 593 594 s->dma_regs[n][DMA_REG_ENABLE] &= ~(DMA_FLAG_TC_INTR | DMA_FLAG_MEM_INTR | DMA_FLAG_ADDR_INTR); 595 596 /* Check DMA channel consistency */ 597 dev_to_mem = (s->dma_regs[n][DMA_REG_ENABLE] & DMA_FLAG_MEM_TO_DEV) ? 0 : 1; 598 if (!(s->dma_regs[n][DMA_REG_ENABLE] & DMA_FLAG_ENABLE) || 599 (is_write != dev_to_mem)) { 600 s->dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_MEM_INTR; 601 s->nmi_interrupt |= 1 << n; 602 return; 603 } 604 605 /* Get start address and len */ 606 if (len > s->dma_regs[n][DMA_REG_COUNT]) 607 len = s->dma_regs[n][DMA_REG_COUNT]; 608 dma_addr = s->dma_regs[n][DMA_REG_ADDRESS]; 609 610 /* Read/write data at right place */ 611 address_space_rw(&s->dma_as, dma_addr, MEMTXATTRS_UNSPECIFIED, 612 buf, len, is_write); 613 614 s->dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_TC_INTR; 615 s->dma_regs[n][DMA_REG_COUNT] -= len; 616 } 617 618 struct rc4030DMAState { 619 void *opaque; 620 int n; 621 }; 622 623 void rc4030_dma_read(void *dma, uint8_t *buf, int len) 624 { 625 rc4030_dma s = dma; 626 rc4030_do_dma(s->opaque, s->n, buf, len, 0); 627 } 628 629 void rc4030_dma_write(void *dma, uint8_t *buf, int len) 630 { 631 rc4030_dma s = dma; 632 rc4030_do_dma(s->opaque, s->n, buf, len, 1); 633 } 634 635 static rc4030_dma *rc4030_allocate_dmas(void *opaque, int n) 636 { 637 rc4030_dma *s; 638 struct rc4030DMAState *p; 639 int i; 640 641 s = (rc4030_dma *)g_malloc0(sizeof(rc4030_dma) * n); 642 p = (struct rc4030DMAState *)g_malloc0(sizeof(struct rc4030DMAState) * n); 643 for (i = 0; i < n; i++) { 644 p->opaque = opaque; 645 p->n = i; 646 s[i] = p; 647 p++; 648 } 649 return s; 650 } 651 652 static void rc4030_initfn(Object *obj) 653 { 654 DeviceState *dev = DEVICE(obj); 655 rc4030State *s = RC4030(obj); 656 SysBusDevice *sysbus = SYS_BUS_DEVICE(obj); 657 658 qdev_init_gpio_in(dev, rc4030_irq_jazz_request, 16); 659 660 sysbus_init_irq(sysbus, &s->timer_irq); 661 sysbus_init_irq(sysbus, &s->jazz_bus_irq); 662 663 sysbus_init_mmio(sysbus, &s->iomem_chipset); 664 sysbus_init_mmio(sysbus, &s->iomem_jazzio); 665 } 666 667 static void rc4030_realize(DeviceState *dev, Error **errp) 668 { 669 rc4030State *s = RC4030(dev); 670 Object *o = OBJECT(dev); 671 672 s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, 673 rc4030_periodic_timer, s); 674 675 memory_region_init_io(&s->iomem_chipset, NULL, &rc4030_ops, s, 676 "rc4030.chipset", 0x300); 677 memory_region_init_io(&s->iomem_jazzio, NULL, &jazzio_ops, s, 678 "rc4030.jazzio", 0x00001000); 679 680 memory_region_init_iommu(&s->dma_mr, o, &rc4030_dma_ops, 681 "rc4030.dma", UINT32_MAX); 682 address_space_init(&s->dma_as, &s->dma_mr, "rc4030-dma"); 683 } 684 685 static void rc4030_unrealize(DeviceState *dev, Error **errp) 686 { 687 rc4030State *s = RC4030(dev); 688 689 timer_free(s->periodic_timer); 690 691 address_space_destroy(&s->dma_as); 692 object_unparent(OBJECT(&s->dma_mr)); 693 } 694 695 static void rc4030_class_init(ObjectClass *klass, void *class_data) 696 { 697 DeviceClass *dc = DEVICE_CLASS(klass); 698 699 dc->realize = rc4030_realize; 700 dc->unrealize = rc4030_unrealize; 701 dc->reset = rc4030_reset; 702 dc->vmsd = &vmstate_rc4030; 703 } 704 705 static const TypeInfo rc4030_info = { 706 .name = TYPE_RC4030, 707 .parent = TYPE_SYS_BUS_DEVICE, 708 .instance_size = sizeof(rc4030State), 709 .instance_init = rc4030_initfn, 710 .class_init = rc4030_class_init, 711 }; 712 713 static void rc4030_register_types(void) 714 { 715 type_register_static(&rc4030_info); 716 } 717 718 type_init(rc4030_register_types) 719 720 DeviceState *rc4030_init(rc4030_dma **dmas, MemoryRegion **dma_mr) 721 { 722 DeviceState *dev; 723 724 dev = qdev_create(NULL, TYPE_RC4030); 725 qdev_init_nofail(dev); 726 727 *dmas = rc4030_allocate_dmas(dev, 4); 728 *dma_mr = &RC4030(dev)->dma_mr; 729 return dev; 730 } 731