hw/display/tc6393xb.c

   1 /*
   2  * Toshiba TC6393XB I/O Controller.
   3  * Found in Sharp Zaurus SL-6000 (tosa) or some
   4  * Toshiba e-Series PDAs.
   5  *
   6  * Most features are currently unsupported!!!
   7  *
   8  * This code is licensed under the GNU GPL v2.
   9  *
  10  * Contributions after 2012-01-13 are licensed under the terms of the
  11  * GNU GPL, version 2 or (at your option) any later version.
  12  */
  13 #include "hw/hw.h"
  14 #include "hw/devices.h"
  15 #include "hw/block/flash.h"
  16 #include "ui/console.h"
  17 #include "ui/pixel_ops.h"
  18 #include "sysemu/block-backend.h"
  19 #include "sysemu/blockdev.h"
  20
  21 #define IRQ_TC6393_NAND         0
  22 #define IRQ_TC6393_MMC          1
  23 #define IRQ_TC6393_OHCI         2
  24 #define IRQ_TC6393_SERIAL       3
  25 #define IRQ_TC6393_FB           4
  26
  27 #define TC6393XB_NR_IRQS        8
  28
  29 #define TC6393XB_GPIOS  16
  30
  31 #define SCR_REVID       0x08            /* b Revision ID        */
  32 #define SCR_ISR         0x50            /* b Interrupt Status   */
  33 #define SCR_IMR         0x52            /* b Interrupt Mask     */
  34 #define SCR_IRR         0x54            /* b Interrupt Routing  */
  35 #define SCR_GPER        0x60            /* w GP Enable          */
  36 #define SCR_GPI_SR(i)   (0x64 + (i))    /* b3 GPI Status        */
  37 #define SCR_GPI_IMR(i)  (0x68 + (i))    /* b3 GPI INT Mask      */
  38 #define SCR_GPI_EDER(i) (0x6c + (i))    /* b3 GPI Edge Detect Enable */
  39 #define SCR_GPI_LIR(i)  (0x70 + (i))    /* b3 GPI Level Invert  */
  40 #define SCR_GPO_DSR(i)  (0x78 + (i))    /* b3 GPO Data Set      */
  41 #define SCR_GPO_DOECR(i) (0x7c + (i))   /* b3 GPO Data OE Control */
  42 #define SCR_GP_IARCR(i) (0x80 + (i))    /* b3 GP Internal Active Register Control */
  43 #define SCR_GP_IARLCR(i) (0x84 + (i))   /* b3 GP INTERNAL Active Register Level Control */
  44 #define SCR_GPI_BCR(i)  (0x88 + (i))    /* b3 GPI Buffer Control */
  45 #define SCR_GPA_IARCR   0x8c            /* w GPa Internal Active Register Control */
  46 #define SCR_GPA_IARLCR  0x90            /* w GPa Internal Active Register Level Control */
  47 #define SCR_GPA_BCR     0x94            /* w GPa Buffer Control */
  48 #define SCR_CCR         0x98            /* w Clock Control      */
  49 #define SCR_PLL2CR      0x9a            /* w PLL2 Control       */
  50 #define SCR_PLL1CR      0x9c            /* l PLL1 Control       */
  51 #define SCR_DIARCR      0xa0            /* b Device Internal Active Register Control */
  52 #define SCR_DBOCR       0xa1            /* b Device Buffer Off Control */
  53 #define SCR_FER         0xe0            /* b Function Enable    */
  54 #define SCR_MCR         0xe4            /* w Mode Control       */
  55 #define SCR_CONFIG      0xfc            /* b Configuration Control */
  56 #define SCR_DEBUG       0xff            /* b Debug              */
  57
  58 #define NAND_CFG_COMMAND    0x04    /* w Command        */
  59 #define NAND_CFG_BASE       0x10    /* l Control Base Address */
  60 #define NAND_CFG_INTP       0x3d    /* b Interrupt Pin  */
  61 #define NAND_CFG_INTE       0x48    /* b Int Enable     */
  62 #define NAND_CFG_EC         0x4a    /* b Event Control  */
  63 #define NAND_CFG_ICC        0x4c    /* b Internal Clock Control */
  64 #define NAND_CFG_ECCC       0x5b    /* b ECC Control    */
  65 #define NAND_CFG_NFTC       0x60    /* b NAND Flash Transaction Control */
  66 #define NAND_CFG_NFM        0x61    /* b NAND Flash Monitor */
  67 #define NAND_CFG_NFPSC      0x62    /* b NAND Flash Power Supply Control */
  68 #define NAND_CFG_NFDC       0x63    /* b NAND Flash Detect Control */
  69
  70 #define NAND_DATA   0x00        /* l Data       */
  71 #define NAND_MODE   0x04        /* b Mode       */
  72 #define NAND_STATUS 0x05        /* b Status     */
  73 #define NAND_ISR    0x06        /* b Interrupt Status */
  74 #define NAND_IMR    0x07        /* b Interrupt Mask */
  75
  76 #define NAND_MODE_WP        0x80
  77 #define NAND_MODE_CE        0x10
  78 #define NAND_MODE_ALE       0x02
  79 #define NAND_MODE_CLE       0x01
  80 #define NAND_MODE_ECC_MASK  0x60
  81 #define NAND_MODE_ECC_EN    0x20
  82 #define NAND_MODE_ECC_READ  0x40
  83 #define NAND_MODE_ECC_RST   0x60
  84
  85 struct TC6393xbState {
  86     MemoryRegion iomem;
  87     qemu_irq irq;
  88     qemu_irq *sub_irqs;
  89     struct {
  90         uint8_t ISR;
  91         uint8_t IMR;
  92         uint8_t IRR;
  93         uint16_t GPER;
  94         uint8_t GPI_SR[3];
  95         uint8_t GPI_IMR[3];
  96         uint8_t GPI_EDER[3];
  97         uint8_t GPI_LIR[3];
  98         uint8_t GP_IARCR[3];
  99         uint8_t GP_IARLCR[3];
 100         uint8_t GPI_BCR[3];
 101         uint16_t GPA_IARCR;
 102         uint16_t GPA_IARLCR;
 103         uint16_t CCR;
 104         uint16_t PLL2CR;
 105         uint32_t PLL1CR;
 106         uint8_t DIARCR;
 107         uint8_t DBOCR;
 108         uint8_t FER;
 109         uint16_t MCR;
 110         uint8_t CONFIG;
 111         uint8_t DEBUG;
 112     } scr;
 113     uint32_t gpio_dir;
 114     uint32_t gpio_level;
 115     uint32_t prev_level;
 116     qemu_irq handler[TC6393XB_GPIOS];
 117     qemu_irq *gpio_in;
 118
 119     struct {
 120         uint8_t mode;
 121         uint8_t isr;
 122         uint8_t imr;
 123     } nand;
 124     int nand_enable;
 125     uint32_t nand_phys;
 126     DeviceState *flash;
 127     ECCState ecc;
 128
 129     QemuConsole *con;
 130     MemoryRegion vram;
 131     uint16_t *vram_ptr;
 132     uint32_t scr_width, scr_height; /* in pixels */
 133     qemu_irq l3v;
 134     unsigned blank : 1,
 135              blanked : 1;
 136 };
 137
 138 qemu_irq *tc6393xb_gpio_in_get(TC6393xbState *s)
 139 {
 140     return s->gpio_in;
 141 }
 142
 143 static void tc6393xb_gpio_set(void *opaque, int line, int level)
 144 {
 145 //    TC6393xbState *s = opaque;
 146
 147     if (line > TC6393XB_GPIOS) {
 148         printf("%s: No GPIO pin %i\n", __FUNCTION__, line);
 149         return;
 150     }
 151
 152     // FIXME: how does the chip reflect the GPIO input level change?
 153 }
 154
 155 void tc6393xb_gpio_out_set(TC6393xbState *s, int line,
 156                     qemu_irq handler)
 157 {
 158     if (line >= TC6393XB_GPIOS) {
 159         fprintf(stderr, "TC6393xb: no GPIO pin %d\n", line);
 160         return;
 161     }
 162
 163     s->handler[line] = handler;
 164 }
 165
 166 static void tc6393xb_gpio_handler_update(TC6393xbState *s)
 167 {
 168     uint32_t level, diff;
 169     int bit;
 170
 171     level = s->gpio_level & s->gpio_dir;
 172
 173     for (diff = s->prev_level ^ level; diff; diff ^= 1 << bit) {
 174         bit = ffs(diff) - 1;
 175         qemu_set_irq(s->handler[bit], (level >> bit) & 1);
 176     }
 177
 178     s->prev_level = level;
 179 }
 180
 181 qemu_irq tc6393xb_l3v_get(TC6393xbState *s)
 182 {
 183     return s->l3v;
 184 }
 185
 186 static void tc6393xb_l3v(void *opaque, int line, int level)
 187 {
 188     TC6393xbState *s = opaque;
 189     s->blank = !level;
 190     fprintf(stderr, "L3V: %d\n", level);
 191 }
 192
 193 static void tc6393xb_sub_irq(void *opaque, int line, int level) {
 194     TC6393xbState *s = opaque;
 195     uint8_t isr = s->scr.ISR;
 196     if (level)
 197         isr |= 1 << line;
 198     else
 199         isr &= ~(1 << line);
 200     s->scr.ISR = isr;
 201     qemu_set_irq(s->irq, isr & s->scr.IMR);
 202 }
 203
 204 #define SCR_REG_B(N)                            \
 205     case SCR_ ##N: return s->scr.N
 206 #define SCR_REG_W(N)                            \
 207     case SCR_ ##N: return s->scr.N;             \
 208     case SCR_ ##N + 1: return s->scr.N >> 8;
 209 #define SCR_REG_L(N)                            \
 210     case SCR_ ##N: return s->scr.N;             \
 211     case SCR_ ##N + 1: return s->scr.N >> 8;    \
 212     case SCR_ ##N + 2: return s->scr.N >> 16;   \
 213     case SCR_ ##N + 3: return s->scr.N >> 24;
 214 #define SCR_REG_A(N)                            \
 215     case SCR_ ##N(0): return s->scr.N[0];       \
 216     case SCR_ ##N(1): return s->scr.N[1];       \
 217     case SCR_ ##N(2): return s->scr.N[2]
 218
 219 static uint32_t tc6393xb_scr_readb(TC6393xbState *s, hwaddr addr)
 220 {
 221     switch (addr) {
 222         case SCR_REVID:
 223             return 3;
 224         case SCR_REVID+1:
 225             return 0;
 226         SCR_REG_B(ISR);
 227         SCR_REG_B(IMR);
 228         SCR_REG_B(IRR);
 229         SCR_REG_W(GPER);
 230         SCR_REG_A(GPI_SR);
 231         SCR_REG_A(GPI_IMR);
 232         SCR_REG_A(GPI_EDER);
 233         SCR_REG_A(GPI_LIR);
 234         case SCR_GPO_DSR(0):
 235         case SCR_GPO_DSR(1):
 236         case SCR_GPO_DSR(2):
 237             return (s->gpio_level >> ((addr - SCR_GPO_DSR(0)) * 8)) & 0xff;
 238         case SCR_GPO_DOECR(0):
 239         case SCR_GPO_DOECR(1):
 240         case SCR_GPO_DOECR(2):
 241             return (s->gpio_dir >> ((addr - SCR_GPO_DOECR(0)) * 8)) & 0xff;
 242         SCR_REG_A(GP_IARCR);
 243         SCR_REG_A(GP_IARLCR);
 244         SCR_REG_A(GPI_BCR);
 245         SCR_REG_W(GPA_IARCR);
 246         SCR_REG_W(GPA_IARLCR);
 247         SCR_REG_W(CCR);
 248         SCR_REG_W(PLL2CR);
 249         SCR_REG_L(PLL1CR);
 250         SCR_REG_B(DIARCR);
 251         SCR_REG_B(DBOCR);
 252         SCR_REG_B(FER);
 253         SCR_REG_W(MCR);
 254         SCR_REG_B(CONFIG);
 255         SCR_REG_B(DEBUG);
 256     }
 257     fprintf(stderr, "tc6393xb_scr: unhandled read at %08x\n", (uint32_t) addr);
 258     return 0;
 259 }
 260 #undef SCR_REG_B
 261 #undef SCR_REG_W
 262 #undef SCR_REG_L
 263 #undef SCR_REG_A
 264
 265 #define SCR_REG_B(N)                                \
 266     case SCR_ ##N: s->scr.N = value; return;
 267 #define SCR_REG_W(N)                                \
 268     case SCR_ ##N: s->scr.N = (s->scr.N & ~0xff) | (value & 0xff); return; \
 269     case SCR_ ##N + 1: s->scr.N = (s->scr.N & 0xff) | (value << 8); return
 270 #define SCR_REG_L(N)                                \
 271     case SCR_ ##N: s->scr.N = (s->scr.N & ~0xff) | (value & 0xff); return;   \
 272     case SCR_ ##N + 1: s->scr.N = (s->scr.N & ~(0xff << 8)) | (value & (0xff << 8)); return;     \
 273     case SCR_ ##N + 2: s->scr.N = (s->scr.N & ~(0xff << 16)) | (value & (0xff << 16)); return;   \
 274     case SCR_ ##N + 3: s->scr.N = (s->scr.N & ~(0xff << 24)) | (value & (0xff << 24)); return;
 275 #define SCR_REG_A(N)                                \
 276     case SCR_ ##N(0): s->scr.N[0] = value; return;   \
 277     case SCR_ ##N(1): s->scr.N[1] = value; return;   \
 278     case SCR_ ##N(2): s->scr.N[2] = value; return
 279
 280 static void tc6393xb_scr_writeb(TC6393xbState *s, hwaddr addr, uint32_t value)
 281 {
 282     switch (addr) {
 283         SCR_REG_B(ISR);
 284         SCR_REG_B(IMR);
 285         SCR_REG_B(IRR);
 286         SCR_REG_W(GPER);
 287         SCR_REG_A(GPI_SR);
 288         SCR_REG_A(GPI_IMR);
 289         SCR_REG_A(GPI_EDER);
 290         SCR_REG_A(GPI_LIR);
 291         case SCR_GPO_DSR(0):
 292         case SCR_GPO_DSR(1):
 293         case SCR_GPO_DSR(2):
 294             s->gpio_level = (s->gpio_level & ~(0xff << ((addr - SCR_GPO_DSR(0))*8))) | ((value & 0xff) << ((addr - SCR_GPO_DSR(0))*8));
 295             tc6393xb_gpio_handler_update(s);
 296             return;
 297         case SCR_GPO_DOECR(0):
 298         case SCR_GPO_DOECR(1):
 299         case SCR_GPO_DOECR(2):
 300             s->gpio_dir = (s->gpio_dir & ~(0xff << ((addr - SCR_GPO_DOECR(0))*8))) | ((value & 0xff) << ((addr - SCR_GPO_DOECR(0))*8));
 301             tc6393xb_gpio_handler_update(s);
 302             return;
 303         SCR_REG_A(GP_IARCR);
 304         SCR_REG_A(GP_IARLCR);
 305         SCR_REG_A(GPI_BCR);
 306         SCR_REG_W(GPA_IARCR);
 307         SCR_REG_W(GPA_IARLCR);
 308         SCR_REG_W(CCR);
 309         SCR_REG_W(PLL2CR);
 310         SCR_REG_L(PLL1CR);
 311         SCR_REG_B(DIARCR);
 312         SCR_REG_B(DBOCR);
 313         SCR_REG_B(FER);
 314         SCR_REG_W(MCR);
 315         SCR_REG_B(CONFIG);
 316         SCR_REG_B(DEBUG);
 317     }
 318     fprintf(stderr, "tc6393xb_scr: unhandled write at %08x: %02x\n",
 319                                         (uint32_t) addr, value & 0xff);
 320 }
 321 #undef SCR_REG_B
 322 #undef SCR_REG_W
 323 #undef SCR_REG_L
 324 #undef SCR_REG_A
 325
 326 static void tc6393xb_nand_irq(TC6393xbState *s) {
 327     qemu_set_irq(s->sub_irqs[IRQ_TC6393_NAND],
 328             (s->nand.imr & 0x80) && (s->nand.imr & s->nand.isr));
 329 }
 330
 331 static uint32_t tc6393xb_nand_cfg_readb(TC6393xbState *s, hwaddr addr) {
 332     switch (addr) {
 333         case NAND_CFG_COMMAND:
 334             return s->nand_enable ? 2 : 0;
 335         case NAND_CFG_BASE:
 336         case NAND_CFG_BASE + 1:
 337         case NAND_CFG_BASE + 2:
 338         case NAND_CFG_BASE + 3:
 339             return s->nand_phys >> (addr - NAND_CFG_BASE);
 340     }
 341     fprintf(stderr, "tc6393xb_nand_cfg: unhandled read at %08x\n", (uint32_t) addr);
 342     return 0;
 343 }
 344 static void tc6393xb_nand_cfg_writeb(TC6393xbState *s, hwaddr addr, uint32_t value) {
 345     switch (addr) {
 346         case NAND_CFG_COMMAND:
 347             s->nand_enable = (value & 0x2);
 348             return;
 349         case NAND_CFG_BASE:
 350         case NAND_CFG_BASE + 1:
 351         case NAND_CFG_BASE + 2:
 352         case NAND_CFG_BASE + 3:
 353             s->nand_phys &= ~(0xff << ((addr - NAND_CFG_BASE) * 8));
 354             s->nand_phys |= (value & 0xff) << ((addr - NAND_CFG_BASE) * 8);
 355             return;
 356     }
 357     fprintf(stderr, "tc6393xb_nand_cfg: unhandled write at %08x: %02x\n",
 358                                         (uint32_t) addr, value & 0xff);
 359 }
 360
 361 static uint32_t tc6393xb_nand_readb(TC6393xbState *s, hwaddr addr) {
 362     switch (addr) {
 363         case NAND_DATA + 0:
 364         case NAND_DATA + 1:
 365         case NAND_DATA + 2:
 366         case NAND_DATA + 3:
 367             return nand_getio(s->flash);
 368         case NAND_MODE:
 369             return s->nand.mode;
 370         case NAND_STATUS:
 371             return 0x14;
 372         case NAND_ISR:
 373             return s->nand.isr;
 374         case NAND_IMR:
 375             return s->nand.imr;
 376     }
 377     fprintf(stderr, "tc6393xb_nand: unhandled read at %08x\n", (uint32_t) addr);
 378     return 0;
 379 }
 380 static void tc6393xb_nand_writeb(TC6393xbState *s, hwaddr addr, uint32_t value) {
 381 //    fprintf(stderr, "tc6393xb_nand: write at %08x: %02x\n",
 382 //                                      (uint32_t) addr, value & 0xff);
 383     switch (addr) {
 384         case NAND_DATA + 0:
 385         case NAND_DATA + 1:
 386         case NAND_DATA + 2:
 387         case NAND_DATA + 3:
 388             nand_setio(s->flash, value);
 389             s->nand.isr |= 1;
 390             tc6393xb_nand_irq(s);
 391             return;
 392         case NAND_MODE:
 393             s->nand.mode = value;
 394             nand_setpins(s->flash,
 395                     value & NAND_MODE_CLE,
 396                     value & NAND_MODE_ALE,
 397                     !(value & NAND_MODE_CE),
 398                     value & NAND_MODE_WP,
 399                     0); // FIXME: gnd
 400             switch (value & NAND_MODE_ECC_MASK) {
 401                 case NAND_MODE_ECC_RST:
 402                     ecc_reset(&s->ecc);
 403                     break;
 404                 case NAND_MODE_ECC_READ:
 405                     // FIXME
 406                     break;
 407                 case NAND_MODE_ECC_EN:
 408                     ecc_reset(&s->ecc);
 409             }
 410             return;
 411         case NAND_ISR:
 412             s->nand.isr = value;
 413             tc6393xb_nand_irq(s);
 414             return;
 415         case NAND_IMR:
 416             s->nand.imr = value;
 417             tc6393xb_nand_irq(s);
 418             return;
 419     }
 420     fprintf(stderr, "tc6393xb_nand: unhandled write at %08x: %02x\n",
 421                                         (uint32_t) addr, value & 0xff);
 422 }
 423
 424 #define BITS 8
 425 #include "tc6393xb_template.h"
 426 #define BITS 15
 427 #include "tc6393xb_template.h"
 428 #define BITS 16
 429 #include "tc6393xb_template.h"
 430 #define BITS 24
 431 #include "tc6393xb_template.h"
 432 #define BITS 32
 433 #include "tc6393xb_template.h"
 434
 435 static void tc6393xb_draw_graphic(TC6393xbState *s, int full_update)
 436 {
 437     DisplaySurface *surface = qemu_console_surface(s->con);
 438
 439     switch (surface_bits_per_pixel(surface)) {
 440         case 8:
 441             tc6393xb_draw_graphic8(s);
 442             break;
 443         case 15:
 444             tc6393xb_draw_graphic15(s);
 445             break;
 446         case 16:
 447             tc6393xb_draw_graphic16(s);
 448             break;
 449         case 24:
 450             tc6393xb_draw_graphic24(s);
 451             break;
 452         case 32:
 453             tc6393xb_draw_graphic32(s);
 454             break;
 455         default:
 456             printf("tc6393xb: unknown depth %d\n",
 457                    surface_bits_per_pixel(surface));
 458             return;
 459     }
 460
 461     dpy_gfx_update(s->con, 0, 0, s->scr_width, s->scr_height);
 462 }
 463
 464 static void tc6393xb_draw_blank(TC6393xbState *s, int full_update)
 465 {
 466     DisplaySurface *surface = qemu_console_surface(s->con);
 467     int i, w;
 468     uint8_t *d;
 469
 470     if (!full_update)
 471         return;
 472
 473     w = s->scr_width * surface_bytes_per_pixel(surface);
 474     d = surface_data(surface);
 475     for(i = 0; i < s->scr_height; i++) {
 476         memset(d, 0, w);
 477         d += surface_stride(surface);
 478     }
 479
 480     dpy_gfx_update(s->con, 0, 0, s->scr_width, s->scr_height);
 481 }
 482
 483 static void tc6393xb_update_display(void *opaque)
 484 {
 485     TC6393xbState *s = opaque;
 486     DisplaySurface *surface = qemu_console_surface(s->con);
 487     int full_update;
 488
 489     if (s->scr_width == 0 || s->scr_height == 0)
 490         return;
 491
 492     full_update = 0;
 493     if (s->blanked != s->blank) {
 494         s->blanked = s->blank;
 495         full_update = 1;
 496     }
 497     if (s->scr_width != surface_width(surface) ||
 498         s->scr_height != surface_height(surface)) {
 499         qemu_console_resize(s->con, s->scr_width, s->scr_height);
 500         full_update = 1;
 501     }
 502     if (s->blanked)
 503         tc6393xb_draw_blank(s, full_update);
 504     else
 505         tc6393xb_draw_graphic(s, full_update);
 506 }
 507
 508
 509 static uint64_t tc6393xb_readb(void *opaque, hwaddr addr,
 510                                unsigned size)
 511 {
 512     TC6393xbState *s = opaque;
 513
 514     switch (addr >> 8) {
 515         case 0:
 516             return tc6393xb_scr_readb(s, addr & 0xff);
 517         case 1:
 518             return tc6393xb_nand_cfg_readb(s, addr & 0xff);
 519     };
 520
 521     if ((addr &~0xff) == s->nand_phys && s->nand_enable) {
 522 //        return tc6393xb_nand_readb(s, addr & 0xff);
 523         uint8_t d = tc6393xb_nand_readb(s, addr & 0xff);
 524 //        fprintf(stderr, "tc6393xb_nand: read at %08x: %02hhx\n", (uint32_t) addr, d);
 525         return d;
 526     }
 527
 528 //    fprintf(stderr, "tc6393xb: unhandled read at %08x\n", (uint32_t) addr);
 529     return 0;
 530 }
 531
 532 static void tc6393xb_writeb(void *opaque, hwaddr addr,
 533                             uint64_t value, unsigned size) {
 534     TC6393xbState *s = opaque;
 535
 536     switch (addr >> 8) {
 537         case 0:
 538             tc6393xb_scr_writeb(s, addr & 0xff, value);
 539             return;
 540         case 1:
 541             tc6393xb_nand_cfg_writeb(s, addr & 0xff, value);
 542             return;
 543     };
 544
 545     if ((addr &~0xff) == s->nand_phys && s->nand_enable)
 546         tc6393xb_nand_writeb(s, addr & 0xff, value);
 547     else
 548         fprintf(stderr, "tc6393xb: unhandled write at %08x: %02x\n",
 549                 (uint32_t) addr, (int)value & 0xff);
 550 }
 551
 552 static const GraphicHwOps tc6393xb_gfx_ops = {
 553     .gfx_update  = tc6393xb_update_display,
 554 };
 555
 556 TC6393xbState *tc6393xb_init(MemoryRegion *sysmem, uint32_t base, qemu_irq irq)
 557 {
 558     TC6393xbState *s;
 559     DriveInfo *nand;
 560     static const MemoryRegionOps tc6393xb_ops = {
 561         .read = tc6393xb_readb,
 562         .write = tc6393xb_writeb,
 563         .endianness = DEVICE_NATIVE_ENDIAN,
 564         .impl = {
 565             .min_access_size = 1,
 566             .max_access_size = 1,
 567         },
 568     };
 569
 570     s = (TC6393xbState *) g_malloc0(sizeof(TC6393xbState));
 571     s->irq = irq;
 572     s->gpio_in = qemu_allocate_irqs(tc6393xb_gpio_set, s, TC6393XB_GPIOS);
 573
 574     s->l3v = *qemu_allocate_irqs(tc6393xb_l3v, s, 1);
 575     s->blanked = 1;
 576
 577     s->sub_irqs = qemu_allocate_irqs(tc6393xb_sub_irq, s, TC6393XB_NR_IRQS);
 578
 579     nand = drive_get(IF_MTD, 0, 0);
 580     s->flash = nand_init(nand ? blk_by_legacy_dinfo(nand) : NULL,
 581                          NAND_MFR_TOSHIBA, 0x76);
 582
 583     memory_region_init_io(&s->iomem, NULL, &tc6393xb_ops, s, "tc6393xb", 0x10000);
 584     memory_region_add_subregion(sysmem, base, &s->iomem);
 585
 586     memory_region_init_ram(&s->vram, NULL, "tc6393xb.vram", 0x100000,
 587                            &error_abort);
 588     vmstate_register_ram_global(&s->vram);
 589     s->vram_ptr = memory_region_get_ram_ptr(&s->vram);
 590     memory_region_add_subregion(sysmem, base + 0x100000, &s->vram);
 591     s->scr_width = 480;
 592     s->scr_height = 640;
 593     s->con = graphic_console_init(NULL, 0, &tc6393xb_gfx_ops, s);
 594
 595     return s;
 596 }