hw/misc/macio/pmu.c

   1 /*
   2  * QEMU PowerMac PMU device support
   3  *
   4  * Copyright (c) 2016 Benjamin Herrenschmidt, IBM Corp.
   5  * Copyright (c) 2018 Mark Cave-Ayland
   6  *
   7  * Based on the CUDA device by:
   8  *
   9  * Copyright (c) 2004-2007 Fabrice Bellard
  10  * Copyright (c) 2007 Jocelyn Mayer
  11  *
  12  * Permission is hereby granted, free of charge, to any person obtaining a copy
  13  * of this software and associated documentation files (the "Software"), to deal
  14  * in the Software without restriction, including without limitation the rights
  15  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  16  * copies of the Software, and to permit persons to whom the Software is
  17  * furnished to do so, subject to the following conditions:
  18  *
  19  * The above copyright notice and this permission notice shall be included in
  20  * all copies or substantial portions of the Software.
  21  *
  22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  25  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  26  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  27  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  28  * THE SOFTWARE.
  29  */
  30
  31 #include "qemu/osdep.h"
  32 #include "hw/hw.h"
  33 #include "hw/ppc/mac.h"
  34 #include "hw/input/adb.h"
  35 #include "hw/misc/mos6522.h"
  36 #include "hw/misc/macio/gpio.h"
  37 #include "hw/misc/macio/pmu.h"
  38 #include "qemu/timer.h"
  39 #include "sysemu/sysemu.h"
  40 #include "qemu/cutils.h"
  41 #include "qemu/log.h"
  42 #include "qemu/module.h"
  43 #include "trace.h"
  44
  45
  46 /* Bits in B data register: all active low */
  47 #define TACK    0x08    /* Transfer request (input) */
  48 #define TREQ    0x10    /* Transfer acknowledge (output) */
  49
  50 /* PMU returns time_t's offset from Jan 1, 1904, not 1970 */
  51 #define RTC_OFFSET                      2082844800
  52
  53 #define VIA_TIMER_FREQ (4700000 / 6)
  54
  55 static void via_update_irq(PMUState *s)
  56 {
  57     MOS6522PMUState *mps = MOS6522_PMU(&s->mos6522_pmu);
  58     MOS6522State *ms = MOS6522(mps);
  59
  60     bool new_state = !!(ms->ifr & ms->ier & (SR_INT | T1_INT | T2_INT));
  61
  62     if (new_state != s->via_irq_state) {
  63         s->via_irq_state = new_state;
  64         qemu_set_irq(s->via_irq, new_state);
  65     }
  66 }
  67
  68 static void via_set_sr_int(void *opaque)
  69 {
  70     PMUState *s = opaque;
  71     MOS6522PMUState *mps = MOS6522_PMU(&s->mos6522_pmu);
  72     MOS6522State *ms = MOS6522(mps);
  73     MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(ms);
  74
  75     mdc->set_sr_int(ms);
  76 }
  77
  78 static void pmu_update_extirq(PMUState *s)
  79 {
  80     if ((s->intbits & s->intmask) != 0) {
  81         macio_set_gpio(s->gpio, 1, false);
  82     } else {
  83         macio_set_gpio(s->gpio, 1, true);
  84     }
  85 }
  86
  87 static void pmu_adb_poll(void *opaque)
  88 {
  89     PMUState *s = opaque;
  90     int olen;
  91
  92     if (!(s->intbits & PMU_INT_ADB)) {
  93         olen = adb_poll(&s->adb_bus, s->adb_reply, s->adb_poll_mask);
  94         trace_pmu_adb_poll(olen);
  95
  96         if (olen > 0) {
  97             s->adb_reply_size = olen;
  98             s->intbits |= PMU_INT_ADB | PMU_INT_ADB_AUTO;
  99             pmu_update_extirq(s);
 100         }
 101     }
 102
 103     timer_mod(s->adb_poll_timer,
 104               qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 30);
 105 }
 106
 107 static void pmu_one_sec_timer(void *opaque)
 108 {
 109     PMUState *s = opaque;
 110
 111     trace_pmu_one_sec_timer();
 112
 113     s->intbits |= PMU_INT_TICK;
 114     pmu_update_extirq(s);
 115     s->one_sec_target += 1000;
 116
 117     timer_mod(s->one_sec_timer, s->one_sec_target);
 118 }
 119
 120 static void pmu_cmd_int_ack(PMUState *s,
 121                             const uint8_t *in_data, uint8_t in_len,
 122                             uint8_t *out_data, uint8_t *out_len)
 123 {
 124     if (in_len != 0) {
 125         qemu_log_mask(LOG_GUEST_ERROR,
 126                       "PMU: INT_ACK command, invalid len: %d want: 0\n",
 127                       in_len);
 128         return;
 129     }
 130
 131     /* Make appropriate reply packet */
 132     if (s->intbits & PMU_INT_ADB) {
 133         if (!s->adb_reply_size) {
 134             qemu_log_mask(LOG_GUEST_ERROR,
 135                           "Odd, PMU_INT_ADB set with no reply in buffer\n");
 136         }
 137
 138         memcpy(out_data + 1, s->adb_reply, s->adb_reply_size);
 139         out_data[0] = s->intbits & (PMU_INT_ADB | PMU_INT_ADB_AUTO);
 140         *out_len = s->adb_reply_size + 1;
 141         s->intbits &= ~(PMU_INT_ADB | PMU_INT_ADB_AUTO);
 142         s->adb_reply_size = 0;
 143     } else {
 144         out_data[0] = s->intbits;
 145         s->intbits = 0;
 146         *out_len = 1;
 147     }
 148
 149     pmu_update_extirq(s);
 150 }
 151
 152 static void pmu_cmd_set_int_mask(PMUState *s,
 153                                  const uint8_t *in_data, uint8_t in_len,
 154                                  uint8_t *out_data, uint8_t *out_len)
 155 {
 156     if (in_len != 1) {
 157         qemu_log_mask(LOG_GUEST_ERROR,
 158                       "PMU: SET_INT_MASK command, invalid len: %d want: 1\n",
 159                       in_len);
 160         return;
 161     }
 162
 163     trace_pmu_cmd_set_int_mask(s->intmask);
 164     s->intmask = in_data[0];
 165
 166     pmu_update_extirq(s);
 167 }
 168
 169 static void pmu_cmd_set_adb_autopoll(PMUState *s, uint16_t mask)
 170 {
 171     trace_pmu_cmd_set_adb_autopoll(mask);
 172
 173     if (s->autopoll_mask == mask) {
 174         return;
 175     }
 176
 177     s->autopoll_mask = mask;
 178     if (mask) {
 179         timer_mod(s->adb_poll_timer,
 180                   qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 30);
 181     } else {
 182         timer_del(s->adb_poll_timer);
 183     }
 184 }
 185
 186 static void pmu_cmd_adb(PMUState *s,
 187                         const uint8_t *in_data, uint8_t in_len,
 188                         uint8_t *out_data, uint8_t *out_len)
 189 {
 190     int len, adblen;
 191     uint8_t adb_cmd[255];
 192
 193     if (in_len < 2) {
 194         qemu_log_mask(LOG_GUEST_ERROR,
 195                       "PMU: ADB PACKET, invalid len: %d want at least 2\n",
 196                       in_len);
 197         return;
 198     }
 199
 200     *out_len = 0;
 201
 202     if (!s->has_adb) {
 203         trace_pmu_cmd_adb_nobus();
 204         return;
 205     }
 206
 207     /* Set autopoll is a special form of the command */
 208     if (in_data[0] == 0 && in_data[1] == 0x86) {
 209         uint16_t mask = in_data[2];
 210         mask = (mask << 8) | in_data[3];
 211         if (in_len != 4) {
 212             qemu_log_mask(LOG_GUEST_ERROR,
 213                           "PMU: ADB Autopoll requires 4 bytes, got %d\n",
 214                           in_len);
 215             return;
 216         }
 217
 218         pmu_cmd_set_adb_autopoll(s, mask);
 219         return;
 220     }
 221
 222     trace_pmu_cmd_adb_request(in_len, in_data[0], in_data[1], in_data[2],
 223                               in_data[3], in_data[4]);
 224
 225     *out_len = 0;
 226
 227     /* Check ADB len */
 228     adblen = in_data[2];
 229     if (adblen > (in_len - 3)) {
 230         qemu_log_mask(LOG_GUEST_ERROR,
 231                       "PMU: ADB len is %d > %d (in_len -3)...erroring\n",
 232                       adblen, in_len - 3);
 233         len = -1;
 234     } else if (adblen > 252) {
 235         qemu_log_mask(LOG_GUEST_ERROR, "PMU: ADB command too big!\n");
 236         len = -1;
 237     } else {
 238         /* Format command */
 239         adb_cmd[0] = in_data[0];
 240         memcpy(&adb_cmd[1], &in_data[3], in_len - 3);
 241         len = adb_request(&s->adb_bus, s->adb_reply + 2, adb_cmd, in_len - 2);
 242
 243         trace_pmu_cmd_adb_reply(len);
 244     }
 245
 246     if (len > 0) {
 247         /* XXX Check this */
 248         s->adb_reply_size = len + 2;
 249         s->adb_reply[0] = 0x01;
 250         s->adb_reply[1] = len;
 251     } else {
 252         /* XXX Check this */
 253         s->adb_reply_size = 1;
 254         s->adb_reply[0] = 0x00;
 255     }
 256
 257     s->intbits |= PMU_INT_ADB;
 258     pmu_update_extirq(s);
 259 }
 260
 261 static void pmu_cmd_adb_poll_off(PMUState *s,
 262                                  const uint8_t *in_data, uint8_t in_len,
 263                                  uint8_t *out_data, uint8_t *out_len)
 264 {
 265     if (in_len != 0) {
 266         qemu_log_mask(LOG_GUEST_ERROR,
 267                       "PMU: ADB POLL OFF command, invalid len: %d want: 0\n",
 268                       in_len);
 269         return;
 270     }
 271
 272     if (s->has_adb && s->autopoll_mask) {
 273         timer_del(s->adb_poll_timer);
 274         s->autopoll_mask = false;
 275     }
 276 }
 277
 278 static void pmu_cmd_shutdown(PMUState *s,
 279                              const uint8_t *in_data, uint8_t in_len,
 280                              uint8_t *out_data, uint8_t *out_len)
 281 {
 282     if (in_len != 4) {
 283         qemu_log_mask(LOG_GUEST_ERROR,
 284                       "PMU: SHUTDOWN command, invalid len: %d want: 4\n",
 285                       in_len);
 286         return;
 287     }
 288
 289     *out_len = 1;
 290     out_data[0] = 0;
 291
 292     if (in_data[0] != 'M' || in_data[1] != 'A' || in_data[2] != 'T' ||
 293         in_data[3] != 'T') {
 294
 295         qemu_log_mask(LOG_GUEST_ERROR,
 296                       "PMU: SHUTDOWN command, Bad MATT signature\n");
 297         return;
 298     }
 299
 300     qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 301 }
 302
 303 static void pmu_cmd_reset(PMUState *s,
 304                           const uint8_t *in_data, uint8_t in_len,
 305                           uint8_t *out_data, uint8_t *out_len)
 306 {
 307     if (in_len != 0) {
 308         qemu_log_mask(LOG_GUEST_ERROR,
 309                       "PMU: RESET command, invalid len: %d want: 0\n",
 310                       in_len);
 311         return;
 312     }
 313
 314     qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 315 }
 316
 317 static void pmu_cmd_get_rtc(PMUState *s,
 318                             const uint8_t *in_data, uint8_t in_len,
 319                             uint8_t *out_data, uint8_t *out_len)
 320 {
 321     uint32_t ti;
 322
 323     if (in_len != 0) {
 324         qemu_log_mask(LOG_GUEST_ERROR,
 325                       "PMU: GET_RTC command, invalid len: %d want: 0\n",
 326                       in_len);
 327         return;
 328     }
 329
 330     ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
 331                            / NANOSECONDS_PER_SECOND);
 332     out_data[0] = ti >> 24;
 333     out_data[1] = ti >> 16;
 334     out_data[2] = ti >> 8;
 335     out_data[3] = ti;
 336     *out_len = 4;
 337 }
 338
 339 static void pmu_cmd_set_rtc(PMUState *s,
 340                             const uint8_t *in_data, uint8_t in_len,
 341                             uint8_t *out_data, uint8_t *out_len)
 342 {
 343     uint32_t ti;
 344
 345     if (in_len != 4) {
 346         qemu_log_mask(LOG_GUEST_ERROR,
 347                       "PMU: SET_RTC command, invalid len: %d want: 4\n",
 348                       in_len);
 349         return;
 350     }
 351
 352     ti = (((uint32_t)in_data[0]) << 24) + (((uint32_t)in_data[1]) << 16)
 353          + (((uint32_t)in_data[2]) << 8) + in_data[3];
 354
 355     s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
 356                            / NANOSECONDS_PER_SECOND);
 357 }
 358
 359 static void pmu_cmd_system_ready(PMUState *s,
 360                                  const uint8_t *in_data, uint8_t in_len,
 361                                  uint8_t *out_data, uint8_t *out_len)
 362 {
 363     /* Do nothing */
 364 }
 365
 366 static void pmu_cmd_get_version(PMUState *s,
 367                                 const uint8_t *in_data, uint8_t in_len,
 368                                 uint8_t *out_data, uint8_t *out_len)
 369 {
 370     *out_len = 1;
 371     *out_data = 1; /* ??? Check what Apple does */
 372 }
 373
 374 static void pmu_cmd_power_events(PMUState *s,
 375                                  const uint8_t *in_data, uint8_t in_len,
 376                                  uint8_t *out_data, uint8_t *out_len)
 377 {
 378     if (in_len < 1) {
 379         qemu_log_mask(LOG_GUEST_ERROR,
 380                       "PMU: POWER EVENTS command, invalid len %d, want at least 1\n",
 381                       in_len);
 382         return;
 383     }
 384
 385     switch (in_data[0]) {
 386     /* Dummies for now */
 387     case PMU_PWR_GET_POWERUP_EVENTS:
 388         *out_len = 2;
 389         out_data[0] = 0;
 390         out_data[1] = 0;
 391         break;
 392     case PMU_PWR_SET_POWERUP_EVENTS:
 393     case PMU_PWR_CLR_POWERUP_EVENTS:
 394         break;
 395     case PMU_PWR_GET_WAKEUP_EVENTS:
 396         *out_len = 2;
 397         out_data[0] = 0;
 398         out_data[1] = 0;
 399         break;
 400     case PMU_PWR_SET_WAKEUP_EVENTS:
 401     case PMU_PWR_CLR_WAKEUP_EVENTS:
 402         break;
 403     default:
 404         qemu_log_mask(LOG_GUEST_ERROR,
 405                       "PMU: POWER EVENTS unknown subcommand 0x%02x\n",
 406                       in_data[0]);
 407     }
 408 }
 409
 410 static void pmu_cmd_get_cover(PMUState *s,
 411                               const uint8_t *in_data, uint8_t in_len,
 412                               uint8_t *out_data, uint8_t *out_len)
 413 {
 414     /* Not 100% sure here, will have to check what a real Mac
 415      * returns other than byte 0 bit 0 is LID closed on laptops
 416      */
 417     *out_len = 1;
 418     *out_data = 0x00;
 419 }
 420
 421 static void pmu_cmd_download_status(PMUState *s,
 422                                     const uint8_t *in_data, uint8_t in_len,
 423                                     uint8_t *out_data, uint8_t *out_len)
 424 {
 425     /* This has to do with PMU firmware updates as far as I can tell.
 426      *
 427      * We return 0x62 which is what OpenPMU expects
 428      */
 429     *out_len = 1;
 430     *out_data = 0x62;
 431 }
 432
 433 static void pmu_cmd_read_pmu_ram(PMUState *s,
 434                                  const uint8_t *in_data, uint8_t in_len,
 435                                  uint8_t *out_data, uint8_t *out_len)
 436 {
 437     if (in_len < 3) {
 438         qemu_log_mask(LOG_GUEST_ERROR,
 439                       "PMU: READ_PMU_RAM command, invalid len %d, expected 3\n",
 440                       in_len);
 441         return;
 442     }
 443
 444     qemu_log_mask(LOG_GUEST_ERROR,
 445                   "PMU: Unsupported READ_PMU_RAM, args: %02x %02x %02x\n",
 446                   in_data[0], in_data[1], in_data[2]);
 447
 448     *out_len = 0;
 449 }
 450
 451 /* description of commands */
 452 typedef struct PMUCmdHandler {
 453     uint8_t command;
 454     const char *name;
 455     void (*handler)(PMUState *s,
 456                     const uint8_t *in_args, uint8_t in_len,
 457                     uint8_t *out_args, uint8_t *out_len);
 458 } PMUCmdHandler;
 459
 460 static const PMUCmdHandler PMUCmdHandlers[] = {
 461     { PMU_INT_ACK, "INT ACK", pmu_cmd_int_ack },
 462     { PMU_SET_INTR_MASK, "SET INT MASK", pmu_cmd_set_int_mask },
 463     { PMU_ADB_CMD, "ADB COMMAND", pmu_cmd_adb },
 464     { PMU_ADB_POLL_OFF, "ADB POLL OFF", pmu_cmd_adb_poll_off },
 465     { PMU_RESET, "REBOOT", pmu_cmd_reset },
 466     { PMU_SHUTDOWN, "SHUTDOWN", pmu_cmd_shutdown },
 467     { PMU_READ_RTC, "GET RTC", pmu_cmd_get_rtc },
 468     { PMU_SET_RTC, "SET RTC", pmu_cmd_set_rtc },
 469     { PMU_SYSTEM_READY, "SYSTEM READY", pmu_cmd_system_ready },
 470     { PMU_GET_VERSION, "GET VERSION", pmu_cmd_get_version },
 471     { PMU_POWER_EVENTS, "POWER EVENTS", pmu_cmd_power_events },
 472     { PMU_GET_COVER, "GET_COVER", pmu_cmd_get_cover },
 473     { PMU_DOWNLOAD_STATUS, "DOWNLOAD STATUS", pmu_cmd_download_status },
 474     { PMU_READ_PMU_RAM, "READ PMGR RAM", pmu_cmd_read_pmu_ram },
 475 };
 476
 477 static void pmu_dispatch_cmd(PMUState *s)
 478 {
 479     unsigned int i;
 480
 481     /* No response by default */
 482     s->cmd_rsp_sz = 0;
 483
 484     for (i = 0; i < ARRAY_SIZE(PMUCmdHandlers); i++) {
 485         const PMUCmdHandler *desc = &PMUCmdHandlers[i];
 486
 487         if (desc->command != s->cmd) {
 488             continue;
 489         }
 490
 491         trace_pmu_dispatch_cmd(desc->name);
 492         desc->handler(s, s->cmd_buf, s->cmd_buf_pos,
 493                       s->cmd_rsp, &s->cmd_rsp_sz);
 494
 495         if (s->rsplen != -1 && s->rsplen != s->cmd_rsp_sz) {
 496             trace_pmu_debug_protocol_string("QEMU internal cmd resp mismatch!");
 497         } else {
 498             trace_pmu_debug_protocol_resp_size(s->cmd_rsp_sz);
 499         }
 500
 501         return;
 502     }
 503
 504     trace_pmu_dispatch_unknown_cmd(s->cmd);
 505
 506     /* Manufacture fake response with 0's */
 507     if (s->rsplen == -1) {
 508         s->cmd_rsp_sz = 0;
 509     } else {
 510         s->cmd_rsp_sz = s->rsplen;
 511         memset(s->cmd_rsp, 0, s->rsplen);
 512     }
 513 }
 514
 515 static void pmu_update(PMUState *s)
 516 {
 517     MOS6522PMUState *mps = &s->mos6522_pmu;
 518     MOS6522State *ms = MOS6522(mps);
 519
 520     /* Only react to changes in reg B */
 521     if (ms->b == s->last_b) {
 522         return;
 523     }
 524     s->last_b = ms->b;
 525
 526     /* Check the TREQ / TACK state */
 527     switch (ms->b & (TREQ | TACK)) {
 528     case TREQ:
 529         /* This is an ack release, handle it and bail out */
 530         ms->b |= TACK;
 531         s->last_b = ms->b;
 532
 533         trace_pmu_debug_protocol_string("handshake: TREQ high, setting TACK");
 534         return;
 535     case TACK:
 536         /* This is a valid request, handle below */
 537         break;
 538     case TREQ | TACK:
 539         /* This is an idle state */
 540         return;
 541     default:
 542         /* Invalid state, log and ignore */
 543         trace_pmu_debug_protocol_error(ms->b);
 544         return;
 545     }
 546
 547     /* If we wanted to handle commands asynchronously, this is where
 548      * we would delay the clearing of TACK until we are ready to send
 549      * the response
 550      */
 551
 552     /* We have a request, handshake TACK so we don't stay in
 553      * an invalid state. If we were concurrent with the OS we
 554      * should only do this after we grabbed the SR but that isn't
 555      * a problem here.
 556      */
 557
 558     trace_pmu_debug_protocol_clear_treq(s->cmd_state);
 559
 560     ms->b &= ~TACK;
 561     s->last_b = ms->b;
 562
 563     /* Act according to state */
 564     switch (s->cmd_state) {
 565     case pmu_state_idle:
 566         if (!(ms->acr & SR_OUT)) {
 567             trace_pmu_debug_protocol_string("protocol error! "
 568                                             "state idle, ACR reading");
 569             break;
 570         }
 571
 572         s->cmd = ms->sr;
 573         via_set_sr_int(s);
 574         s->cmdlen = pmu_data_len[s->cmd][0];
 575         s->rsplen = pmu_data_len[s->cmd][1];
 576         s->cmd_buf_pos = 0;
 577         s->cmd_rsp_pos = 0;
 578         s->cmd_state = pmu_state_cmd;
 579
 580         trace_pmu_debug_protocol_cmd(s->cmd, s->cmdlen, s->rsplen);
 581         break;
 582
 583     case pmu_state_cmd:
 584         if (!(ms->acr & SR_OUT)) {
 585             trace_pmu_debug_protocol_string("protocol error! "
 586                                             "state cmd, ACR reading");
 587             break;
 588         }
 589
 590         if (s->cmdlen == -1) {
 591             trace_pmu_debug_protocol_cmdlen(ms->sr);
 592
 593             s->cmdlen = ms->sr;
 594             if (s->cmdlen > sizeof(s->cmd_buf)) {
 595                 trace_pmu_debug_protocol_cmd_toobig(s->cmdlen);
 596             }
 597         } else if (s->cmd_buf_pos < sizeof(s->cmd_buf)) {
 598             s->cmd_buf[s->cmd_buf_pos++] = ms->sr;
 599         }
 600
 601         via_set_sr_int(s);
 602         break;
 603
 604     case pmu_state_rsp:
 605         if (ms->acr & SR_OUT) {
 606             trace_pmu_debug_protocol_string("protocol error! "
 607                                             "state resp, ACR writing");
 608             break;
 609         }
 610
 611         if (s->rsplen == -1) {
 612             trace_pmu_debug_protocol_cmd_send_resp_size(s->cmd_rsp_sz);
 613
 614             ms->sr = s->cmd_rsp_sz;
 615             s->rsplen = s->cmd_rsp_sz;
 616         } else if (s->cmd_rsp_pos < s->cmd_rsp_sz) {
 617             trace_pmu_debug_protocol_cmd_send_resp(s->cmd_rsp_pos, s->rsplen);
 618
 619             ms->sr = s->cmd_rsp[s->cmd_rsp_pos++];
 620         }
 621
 622         via_set_sr_int(s);
 623         break;
 624     }
 625
 626     /* Check for state completion */
 627     if (s->cmd_state == pmu_state_cmd && s->cmdlen == s->cmd_buf_pos) {
 628         trace_pmu_debug_protocol_string("Command reception complete, "
 629                                         "dispatching...");
 630
 631         pmu_dispatch_cmd(s);
 632         s->cmd_state = pmu_state_rsp;
 633     }
 634
 635     if (s->cmd_state == pmu_state_rsp && s->rsplen == s->cmd_rsp_pos) {
 636         trace_pmu_debug_protocol_cmd_resp_complete(ms->ier);
 637
 638         s->cmd_state = pmu_state_idle;
 639     }
 640 }
 641
 642 static uint64_t mos6522_pmu_read(void *opaque, hwaddr addr, unsigned size)
 643 {
 644     PMUState *s = opaque;
 645     MOS6522PMUState *mps = &s->mos6522_pmu;
 646     MOS6522State *ms = MOS6522(mps);
 647
 648     addr = (addr >> 9) & 0xf;
 649     return mos6522_read(ms, addr, size);
 650 }
 651
 652 static void mos6522_pmu_write(void *opaque, hwaddr addr, uint64_t val,
 653                               unsigned size)
 654 {
 655     PMUState *s = opaque;
 656     MOS6522PMUState *mps = &s->mos6522_pmu;
 657     MOS6522State *ms = MOS6522(mps);
 658
 659     addr = (addr >> 9) & 0xf;
 660     mos6522_write(ms, addr, val, size);
 661 }
 662
 663 static const MemoryRegionOps mos6522_pmu_ops = {
 664     .read = mos6522_pmu_read,
 665     .write = mos6522_pmu_write,
 666     .endianness = DEVICE_BIG_ENDIAN,
 667     .impl = {
 668         .min_access_size = 1,
 669         .max_access_size = 1,
 670     },
 671 };
 672
 673 static bool pmu_adb_state_needed(void *opaque)
 674 {
 675     PMUState *s = opaque;
 676
 677     return s->has_adb;
 678 }
 679
 680 static const VMStateDescription vmstate_pmu_adb = {
 681     .name = "pmu/adb",
 682     .version_id = 0,
 683     .minimum_version_id = 0,
 684     .needed = pmu_adb_state_needed,
 685     .fields = (VMStateField[]) {
 686         VMSTATE_UINT16(adb_poll_mask, PMUState),
 687         VMSTATE_TIMER_PTR(adb_poll_timer, PMUState),
 688         VMSTATE_UINT8(adb_reply_size, PMUState),
 689         VMSTATE_BUFFER(adb_reply, PMUState),
 690         VMSTATE_END_OF_LIST()
 691     }
 692 };
 693
 694 static const VMStateDescription vmstate_pmu = {
 695     .name = "pmu",
 696     .version_id = 0,
 697     .minimum_version_id = 0,
 698     .fields = (VMStateField[]) {
 699         VMSTATE_STRUCT(mos6522_pmu.parent_obj, PMUState, 0, vmstate_mos6522,
 700                        MOS6522State),
 701         VMSTATE_UINT8(last_b, PMUState),
 702         VMSTATE_UINT8(cmd, PMUState),
 703         VMSTATE_UINT32(cmdlen, PMUState),
 704         VMSTATE_UINT32(rsplen, PMUState),
 705         VMSTATE_UINT8(cmd_buf_pos, PMUState),
 706         VMSTATE_BUFFER(cmd_buf, PMUState),
 707         VMSTATE_UINT8(cmd_rsp_pos, PMUState),
 708         VMSTATE_UINT8(cmd_rsp_sz, PMUState),
 709         VMSTATE_BUFFER(cmd_rsp, PMUState),
 710         VMSTATE_UINT8(intbits, PMUState),
 711         VMSTATE_UINT8(intmask, PMUState),
 712         VMSTATE_UINT8(autopoll_rate_ms, PMUState),
 713         VMSTATE_UINT8(autopoll_mask, PMUState),
 714         VMSTATE_UINT32(tick_offset, PMUState),
 715         VMSTATE_TIMER_PTR(one_sec_timer, PMUState),
 716         VMSTATE_INT64(one_sec_target, PMUState),
 717         VMSTATE_END_OF_LIST()
 718     },
 719     .subsections = (const VMStateDescription * []) {
 720         &vmstate_pmu_adb,
 721     }
 722 };
 723
 724 static void pmu_reset(DeviceState *dev)
 725 {
 726     PMUState *s = VIA_PMU(dev);
 727
 728     /* OpenBIOS needs to do this? MacOS 9 needs it */
 729     s->intmask = PMU_INT_ADB | PMU_INT_TICK;
 730     s->intbits = 0;
 731
 732     s->cmd_state = pmu_state_idle;
 733     s->autopoll_mask = 0;
 734 }
 735
 736 static void pmu_realize(DeviceState *dev, Error **errp)
 737 {
 738     PMUState *s = VIA_PMU(dev);
 739     SysBusDevice *sbd;
 740     MOS6522State *ms;
 741     DeviceState *d;
 742     struct tm tm;
 743
 744     /* Pass IRQ from 6522 */
 745     d = DEVICE(&s->mos6522_pmu);
 746     ms = MOS6522(d);
 747     sbd = SYS_BUS_DEVICE(s);
 748     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(ms));
 749
 750     qemu_get_timedate(&tm, 0);
 751     s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
 752     s->one_sec_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, pmu_one_sec_timer, s);
 753     s->one_sec_target = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000;
 754     timer_mod(s->one_sec_timer, s->one_sec_target);
 755
 756     if (s->has_adb) {
 757         qbus_create_inplace(&s->adb_bus, sizeof(s->adb_bus), TYPE_ADB_BUS,
 758                             DEVICE(dev), "adb.0");
 759         s->adb_poll_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, pmu_adb_poll, s);
 760         s->adb_poll_mask = 0xffff;
 761         s->autopoll_rate_ms = 20;
 762     }
 763 }
 764
 765 static void pmu_init(Object *obj)
 766 {
 767     SysBusDevice *d = SYS_BUS_DEVICE(obj);
 768     PMUState *s = VIA_PMU(obj);
 769
 770     object_property_add_link(obj, "gpio", TYPE_MACIO_GPIO,
 771                              (Object **) &s->gpio,
 772                              qdev_prop_allow_set_link_before_realize,
 773                              0, NULL);
 774
 775     sysbus_init_child_obj(obj, "mos6522-pmu", &s->mos6522_pmu,
 776                           sizeof(s->mos6522_pmu), TYPE_MOS6522_PMU);
 777
 778     memory_region_init_io(&s->mem, obj, &mos6522_pmu_ops, s, "via-pmu",
 779                           0x2000);
 780     sysbus_init_mmio(d, &s->mem);
 781 }
 782
 783 static Property pmu_properties[] = {
 784     DEFINE_PROP_BOOL("has-adb", PMUState, has_adb, true),
 785     DEFINE_PROP_END_OF_LIST()
 786 };
 787
 788 static void pmu_class_init(ObjectClass *oc, void *data)
 789 {
 790     DeviceClass *dc = DEVICE_CLASS(oc);
 791
 792     dc->realize = pmu_realize;
 793     dc->reset = pmu_reset;
 794     dc->vmsd = &vmstate_pmu;
 795     dc->props = pmu_properties;
 796     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 797 }
 798
 799 static const TypeInfo pmu_type_info = {
 800     .name = TYPE_VIA_PMU,
 801     .parent = TYPE_SYS_BUS_DEVICE,
 802     .instance_size = sizeof(PMUState),
 803     .instance_init = pmu_init,
 804     .class_init = pmu_class_init,
 805 };
 806
 807 static void mos6522_pmu_portB_write(MOS6522State *s)
 808 {
 809     MOS6522PMUState *mps = container_of(s, MOS6522PMUState, parent_obj);
 810     PMUState *ps = container_of(mps, PMUState, mos6522_pmu);
 811
 812     if ((s->pcr & 0xe0) == 0x20 || (s->pcr & 0xe0) == 0x60) {
 813         s->ifr &= ~CB2_INT;
 814     }
 815     s->ifr &= ~CB1_INT;
 816
 817     via_update_irq(ps);
 818     pmu_update(ps);
 819 }
 820
 821 static void mos6522_pmu_portA_write(MOS6522State *s)
 822 {
 823     MOS6522PMUState *mps = container_of(s, MOS6522PMUState, parent_obj);
 824     PMUState *ps = container_of(mps, PMUState, mos6522_pmu);
 825
 826     if ((s->pcr & 0x0e) == 0x02 || (s->pcr & 0x0e) == 0x06) {
 827         s->ifr &= ~CA2_INT;
 828     }
 829     s->ifr &= ~CA1_INT;
 830
 831     via_update_irq(ps);
 832 }
 833
 834 static void mos6522_pmu_reset(DeviceState *dev)
 835 {
 836     MOS6522State *ms = MOS6522(dev);
 837     MOS6522PMUState *mps = container_of(ms, MOS6522PMUState, parent_obj);
 838     PMUState *s = container_of(mps, PMUState, mos6522_pmu);
 839     MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(ms);
 840
 841     mdc->parent_reset(dev);
 842
 843     ms->timers[0].frequency = VIA_TIMER_FREQ;
 844     ms->timers[1].frequency = (SCALE_US * 6000) / 4700;
 845
 846     s->last_b = ms->b = TACK | TREQ;
 847 }
 848
 849 static void mos6522_pmu_class_init(ObjectClass *oc, void *data)
 850 {
 851     DeviceClass *dc = DEVICE_CLASS(oc);
 852     MOS6522DeviceClass *mdc = MOS6522_DEVICE_CLASS(oc);
 853
 854     dc->reset = mos6522_pmu_reset;
 855     mdc->portB_write = mos6522_pmu_portB_write;
 856     mdc->portA_write = mos6522_pmu_portA_write;
 857 }
 858
 859 static const TypeInfo mos6522_pmu_type_info = {
 860     .name = TYPE_MOS6522_PMU,
 861     .parent = TYPE_MOS6522,
 862     .instance_size = sizeof(MOS6522PMUState),
 863     .class_init = mos6522_pmu_class_init,
 864 };
 865
 866 static void pmu_register_types(void)
 867 {
 868     type_register_static(&pmu_type_info);
 869     type_register_static(&mos6522_pmu_type_info);
 870 }
 871
 872 type_init(pmu_register_types)