hw/misc/macio/pmu.c

   1 /*
   2  * QEMU PowerMac PMU device support
   3  *
   4  * Copyright (c) 2016 Benjamin Herrenschmidt, IBM Corp.
   5  * Copyright (c) 2018 Mark Cave-Ayland
   6  *
   7  * Based on the CUDA device by:
   8  *
   9  * Copyright (c) 2004-2007 Fabrice Bellard
  10  * Copyright (c) 2007 Jocelyn Mayer
  11  *
  12  * Permission is hereby granted, free of charge, to any person obtaining a copy
  13  * of this software and associated documentation files (the "Software"), to deal
  14  * in the Software without restriction, including without limitation the rights
  15  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  16  * copies of the Software, and to permit persons to whom the Software is
  17  * furnished to do so, subject to the following conditions:
  18  *
  19  * The above copyright notice and this permission notice shall be included in
  20  * all copies or substantial portions of the Software.
  21  *
  22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  25  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  26  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  27  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  28  * THE SOFTWARE.
  29  */
  30
  31 #include "qemu/osdep.h"
  32 #include "qemu-common.h"
  33 #include "hw/hw.h"
  34 #include "hw/ppc/mac.h"
  35 #include "hw/input/adb.h"
  36 #include "hw/misc/mos6522.h"
  37 #include "hw/misc/macio/gpio.h"
  38 #include "hw/misc/macio/pmu.h"
  39 #include "qemu/timer.h"
  40 #include "sysemu/sysemu.h"
  41 #include "qemu/cutils.h"
  42 #include "qemu/log.h"
  43 #include "qemu/module.h"
  44 #include "trace.h"
  45
  46
  47 /* Bits in B data register: all active low */
  48 #define TACK    0x08    /* Transfer request (input) */
  49 #define TREQ    0x10    /* Transfer acknowledge (output) */
  50
  51 /* PMU returns time_t's offset from Jan 1, 1904, not 1970 */
  52 #define RTC_OFFSET                      2082844800
  53
  54 #define VIA_TIMER_FREQ (4700000 / 6)
  55
  56 static void via_update_irq(PMUState *s)
  57 {
  58     MOS6522PMUState *mps = MOS6522_PMU(&s->mos6522_pmu);
  59     MOS6522State *ms = MOS6522(mps);
  60
  61     bool new_state = !!(ms->ifr & ms->ier & (SR_INT | T1_INT | T2_INT));
  62
  63     if (new_state != s->via_irq_state) {
  64         s->via_irq_state = new_state;
  65         qemu_set_irq(s->via_irq, new_state);
  66     }
  67 }
  68
  69 static void via_set_sr_int(void *opaque)
  70 {
  71     PMUState *s = opaque;
  72     MOS6522PMUState *mps = MOS6522_PMU(&s->mos6522_pmu);
  73     MOS6522State *ms = MOS6522(mps);
  74     MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(ms);
  75
  76     mdc->set_sr_int(ms);
  77 }
  78
  79 static void pmu_update_extirq(PMUState *s)
  80 {
  81     if ((s->intbits & s->intmask) != 0) {
  82         macio_set_gpio(s->gpio, 1, false);
  83     } else {
  84         macio_set_gpio(s->gpio, 1, true);
  85     }
  86 }
  87
  88 static void pmu_adb_poll(void *opaque)
  89 {
  90     PMUState *s = opaque;
  91     int olen;
  92
  93     if (!(s->intbits & PMU_INT_ADB)) {
  94         olen = adb_poll(&s->adb_bus, s->adb_reply, s->adb_poll_mask);
  95         trace_pmu_adb_poll(olen);
  96
  97         if (olen > 0) {
  98             s->adb_reply_size = olen;
  99             s->intbits |= PMU_INT_ADB | PMU_INT_ADB_AUTO;
 100             pmu_update_extirq(s);
 101         }
 102     }
 103
 104     timer_mod(s->adb_poll_timer,
 105               qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 30);
 106 }
 107
 108 static void pmu_one_sec_timer(void *opaque)
 109 {
 110     PMUState *s = opaque;
 111
 112     trace_pmu_one_sec_timer();
 113
 114     s->intbits |= PMU_INT_TICK;
 115     pmu_update_extirq(s);
 116     s->one_sec_target += 1000;
 117
 118     timer_mod(s->one_sec_timer, s->one_sec_target);
 119 }
 120
 121 static void pmu_cmd_int_ack(PMUState *s,
 122                             const uint8_t *in_data, uint8_t in_len,
 123                             uint8_t *out_data, uint8_t *out_len)
 124 {
 125     if (in_len != 0) {
 126         qemu_log_mask(LOG_GUEST_ERROR,
 127                       "PMU: INT_ACK command, invalid len: %d want: 0\n",
 128                       in_len);
 129         return;
 130     }
 131
 132     /* Make appropriate reply packet */
 133     if (s->intbits & PMU_INT_ADB) {
 134         if (!s->adb_reply_size) {
 135             qemu_log_mask(LOG_GUEST_ERROR,
 136                           "Odd, PMU_INT_ADB set with no reply in buffer\n");
 137         }
 138
 139         memcpy(out_data + 1, s->adb_reply, s->adb_reply_size);
 140         out_data[0] = s->intbits & (PMU_INT_ADB | PMU_INT_ADB_AUTO);
 141         *out_len = s->adb_reply_size + 1;
 142         s->intbits &= ~(PMU_INT_ADB | PMU_INT_ADB_AUTO);
 143         s->adb_reply_size = 0;
 144     } else {
 145         out_data[0] = s->intbits;
 146         s->intbits = 0;
 147         *out_len = 1;
 148     }
 149
 150     pmu_update_extirq(s);
 151 }
 152
 153 static void pmu_cmd_set_int_mask(PMUState *s,
 154                                  const uint8_t *in_data, uint8_t in_len,
 155                                  uint8_t *out_data, uint8_t *out_len)
 156 {
 157     if (in_len != 1) {
 158         qemu_log_mask(LOG_GUEST_ERROR,
 159                       "PMU: SET_INT_MASK command, invalid len: %d want: 1\n",
 160                       in_len);
 161         return;
 162     }
 163
 164     trace_pmu_cmd_set_int_mask(s->intmask);
 165     s->intmask = in_data[0];
 166
 167     pmu_update_extirq(s);
 168 }
 169
 170 static void pmu_cmd_set_adb_autopoll(PMUState *s, uint16_t mask)
 171 {
 172     trace_pmu_cmd_set_adb_autopoll(mask);
 173
 174     if (s->autopoll_mask == mask) {
 175         return;
 176     }
 177
 178     s->autopoll_mask = mask;
 179     if (mask) {
 180         timer_mod(s->adb_poll_timer,
 181                   qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 30);
 182     } else {
 183         timer_del(s->adb_poll_timer);
 184     }
 185 }
 186
 187 static void pmu_cmd_adb(PMUState *s,
 188                         const uint8_t *in_data, uint8_t in_len,
 189                         uint8_t *out_data, uint8_t *out_len)
 190 {
 191     int len, adblen;
 192     uint8_t adb_cmd[255];
 193
 194     if (in_len < 2) {
 195         qemu_log_mask(LOG_GUEST_ERROR,
 196                       "PMU: ADB PACKET, invalid len: %d want at least 2\n",
 197                       in_len);
 198         return;
 199     }
 200
 201     *out_len = 0;
 202
 203     if (!s->has_adb) {
 204         trace_pmu_cmd_adb_nobus();
 205         return;
 206     }
 207
 208     /* Set autopoll is a special form of the command */
 209     if (in_data[0] == 0 && in_data[1] == 0x86) {
 210         uint16_t mask = in_data[2];
 211         mask = (mask << 8) | in_data[3];
 212         if (in_len != 4) {
 213             qemu_log_mask(LOG_GUEST_ERROR,
 214                           "PMU: ADB Autopoll requires 4 bytes, got %d\n",
 215                           in_len);
 216             return;
 217         }
 218
 219         pmu_cmd_set_adb_autopoll(s, mask);
 220         return;
 221     }
 222
 223     trace_pmu_cmd_adb_request(in_len, in_data[0], in_data[1], in_data[2],
 224                               in_data[3], in_data[4]);
 225
 226     *out_len = 0;
 227
 228     /* Check ADB len */
 229     adblen = in_data[2];
 230     if (adblen > (in_len - 3)) {
 231         qemu_log_mask(LOG_GUEST_ERROR,
 232                       "PMU: ADB len is %d > %d (in_len -3)...erroring\n",
 233                       adblen, in_len - 3);
 234         len = -1;
 235     } else if (adblen > 252) {
 236         qemu_log_mask(LOG_GUEST_ERROR, "PMU: ADB command too big!\n");
 237         len = -1;
 238     } else {
 239         /* Format command */
 240         adb_cmd[0] = in_data[0];
 241         memcpy(&adb_cmd[1], &in_data[3], in_len - 3);
 242         len = adb_request(&s->adb_bus, s->adb_reply + 2, adb_cmd, in_len - 2);
 243
 244         trace_pmu_cmd_adb_reply(len);
 245     }
 246
 247     if (len > 0) {
 248         /* XXX Check this */
 249         s->adb_reply_size = len + 2;
 250         s->adb_reply[0] = 0x01;
 251         s->adb_reply[1] = len;
 252     } else {
 253         /* XXX Check this */
 254         s->adb_reply_size = 1;
 255         s->adb_reply[0] = 0x00;
 256     }
 257
 258     s->intbits |= PMU_INT_ADB;
 259     pmu_update_extirq(s);
 260 }
 261
 262 static void pmu_cmd_adb_poll_off(PMUState *s,
 263                                  const uint8_t *in_data, uint8_t in_len,
 264                                  uint8_t *out_data, uint8_t *out_len)
 265 {
 266     if (in_len != 0) {
 267         qemu_log_mask(LOG_GUEST_ERROR,
 268                       "PMU: ADB POLL OFF command, invalid len: %d want: 0\n",
 269                       in_len);
 270         return;
 271     }
 272
 273     if (s->has_adb && s->autopoll_mask) {
 274         timer_del(s->adb_poll_timer);
 275         s->autopoll_mask = false;
 276     }
 277 }
 278
 279 static void pmu_cmd_shutdown(PMUState *s,
 280                              const uint8_t *in_data, uint8_t in_len,
 281                              uint8_t *out_data, uint8_t *out_len)
 282 {
 283     if (in_len != 4) {
 284         qemu_log_mask(LOG_GUEST_ERROR,
 285                       "PMU: SHUTDOWN command, invalid len: %d want: 4\n",
 286                       in_len);
 287         return;
 288     }
 289
 290     *out_len = 1;
 291     out_data[0] = 0;
 292
 293     if (in_data[0] != 'M' || in_data[1] != 'A' || in_data[2] != 'T' ||
 294         in_data[3] != 'T') {
 295
 296         qemu_log_mask(LOG_GUEST_ERROR,
 297                       "PMU: SHUTDOWN command, Bad MATT signature\n");
 298         return;
 299     }
 300
 301     qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 302 }
 303
 304 static void pmu_cmd_reset(PMUState *s,
 305                           const uint8_t *in_data, uint8_t in_len,
 306                           uint8_t *out_data, uint8_t *out_len)
 307 {
 308     if (in_len != 0) {
 309         qemu_log_mask(LOG_GUEST_ERROR,
 310                       "PMU: RESET command, invalid len: %d want: 0\n",
 311                       in_len);
 312         return;
 313     }
 314
 315     qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 316 }
 317
 318 static void pmu_cmd_get_rtc(PMUState *s,
 319                             const uint8_t *in_data, uint8_t in_len,
 320                             uint8_t *out_data, uint8_t *out_len)
 321 {
 322     uint32_t ti;
 323
 324     if (in_len != 0) {
 325         qemu_log_mask(LOG_GUEST_ERROR,
 326                       "PMU: GET_RTC command, invalid len: %d want: 0\n",
 327                       in_len);
 328         return;
 329     }
 330
 331     ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
 332                            / NANOSECONDS_PER_SECOND);
 333     out_data[0] = ti >> 24;
 334     out_data[1] = ti >> 16;
 335     out_data[2] = ti >> 8;
 336     out_data[3] = ti;
 337     *out_len = 4;
 338 }
 339
 340 static void pmu_cmd_set_rtc(PMUState *s,
 341                             const uint8_t *in_data, uint8_t in_len,
 342                             uint8_t *out_data, uint8_t *out_len)
 343 {
 344     uint32_t ti;
 345
 346     if (in_len != 4) {
 347         qemu_log_mask(LOG_GUEST_ERROR,
 348                       "PMU: SET_RTC command, invalid len: %d want: 4\n",
 349                       in_len);
 350         return;
 351     }
 352
 353     ti = (((uint32_t)in_data[0]) << 24) + (((uint32_t)in_data[1]) << 16)
 354          + (((uint32_t)in_data[2]) << 8) + in_data[3];
 355
 356     s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
 357                            / NANOSECONDS_PER_SECOND);
 358 }
 359
 360 static void pmu_cmd_system_ready(PMUState *s,
 361                                  const uint8_t *in_data, uint8_t in_len,
 362                                  uint8_t *out_data, uint8_t *out_len)
 363 {
 364     /* Do nothing */
 365 }
 366
 367 static void pmu_cmd_get_version(PMUState *s,
 368                                 const uint8_t *in_data, uint8_t in_len,
 369                                 uint8_t *out_data, uint8_t *out_len)
 370 {
 371     *out_len = 1;
 372     *out_data = 1; /* ??? Check what Apple does */
 373 }
 374
 375 static void pmu_cmd_power_events(PMUState *s,
 376                                  const uint8_t *in_data, uint8_t in_len,
 377                                  uint8_t *out_data, uint8_t *out_len)
 378 {
 379     if (in_len < 1) {
 380         qemu_log_mask(LOG_GUEST_ERROR,
 381                       "PMU: POWER EVENTS command, invalid len %d, want at least 1\n",
 382                       in_len);
 383         return;
 384     }
 385
 386     switch (in_data[0]) {
 387     /* Dummies for now */
 388     case PMU_PWR_GET_POWERUP_EVENTS:
 389         *out_len = 2;
 390         out_data[0] = 0;
 391         out_data[1] = 0;
 392         break;
 393     case PMU_PWR_SET_POWERUP_EVENTS:
 394     case PMU_PWR_CLR_POWERUP_EVENTS:
 395         break;
 396     case PMU_PWR_GET_WAKEUP_EVENTS:
 397         *out_len = 2;
 398         out_data[0] = 0;
 399         out_data[1] = 0;
 400         break;
 401     case PMU_PWR_SET_WAKEUP_EVENTS:
 402     case PMU_PWR_CLR_WAKEUP_EVENTS:
 403         break;
 404     default:
 405         qemu_log_mask(LOG_GUEST_ERROR,
 406                       "PMU: POWER EVENTS unknown subcommand 0x%02x\n",
 407                       in_data[0]);
 408     }
 409 }
 410
 411 static void pmu_cmd_get_cover(PMUState *s,
 412                               const uint8_t *in_data, uint8_t in_len,
 413                               uint8_t *out_data, uint8_t *out_len)
 414 {
 415     /* Not 100% sure here, will have to check what a real Mac
 416      * returns other than byte 0 bit 0 is LID closed on laptops
 417      */
 418     *out_len = 1;
 419     *out_data = 0x00;
 420 }
 421
 422 static void pmu_cmd_download_status(PMUState *s,
 423                                     const uint8_t *in_data, uint8_t in_len,
 424                                     uint8_t *out_data, uint8_t *out_len)
 425 {
 426     /* This has to do with PMU firmware updates as far as I can tell.
 427      *
 428      * We return 0x62 which is what OpenPMU expects
 429      */
 430     *out_len = 1;
 431     *out_data = 0x62;
 432 }
 433
 434 static void pmu_cmd_read_pmu_ram(PMUState *s,
 435                                  const uint8_t *in_data, uint8_t in_len,
 436                                  uint8_t *out_data, uint8_t *out_len)
 437 {
 438     if (in_len < 3) {
 439         qemu_log_mask(LOG_GUEST_ERROR,
 440                       "PMU: READ_PMU_RAM command, invalid len %d, expected 3\n",
 441                       in_len);
 442         return;
 443     }
 444
 445     qemu_log_mask(LOG_GUEST_ERROR,
 446                   "PMU: Unsupported READ_PMU_RAM, args: %02x %02x %02x\n",
 447                   in_data[0], in_data[1], in_data[2]);
 448
 449     *out_len = 0;
 450 }
 451
 452 /* description of commands */
 453 typedef struct PMUCmdHandler {
 454     uint8_t command;
 455     const char *name;
 456     void (*handler)(PMUState *s,
 457                     const uint8_t *in_args, uint8_t in_len,
 458                     uint8_t *out_args, uint8_t *out_len);
 459 } PMUCmdHandler;
 460
 461 static const PMUCmdHandler PMUCmdHandlers[] = {
 462     { PMU_INT_ACK, "INT ACK", pmu_cmd_int_ack },
 463     { PMU_SET_INTR_MASK, "SET INT MASK", pmu_cmd_set_int_mask },
 464     { PMU_ADB_CMD, "ADB COMMAND", pmu_cmd_adb },
 465     { PMU_ADB_POLL_OFF, "ADB POLL OFF", pmu_cmd_adb_poll_off },
 466     { PMU_RESET, "REBOOT", pmu_cmd_reset },
 467     { PMU_SHUTDOWN, "SHUTDOWN", pmu_cmd_shutdown },
 468     { PMU_READ_RTC, "GET RTC", pmu_cmd_get_rtc },
 469     { PMU_SET_RTC, "SET RTC", pmu_cmd_set_rtc },
 470     { PMU_SYSTEM_READY, "SYSTEM READY", pmu_cmd_system_ready },
 471     { PMU_GET_VERSION, "GET VERSION", pmu_cmd_get_version },
 472     { PMU_POWER_EVENTS, "POWER EVENTS", pmu_cmd_power_events },
 473     { PMU_GET_COVER, "GET_COVER", pmu_cmd_get_cover },
 474     { PMU_DOWNLOAD_STATUS, "DOWNLOAD STATUS", pmu_cmd_download_status },
 475     { PMU_READ_PMU_RAM, "READ PMGR RAM", pmu_cmd_read_pmu_ram },
 476 };
 477
 478 static void pmu_dispatch_cmd(PMUState *s)
 479 {
 480     unsigned int i;
 481
 482     /* No response by default */
 483     s->cmd_rsp_sz = 0;
 484
 485     for (i = 0; i < ARRAY_SIZE(PMUCmdHandlers); i++) {
 486         const PMUCmdHandler *desc = &PMUCmdHandlers[i];
 487
 488         if (desc->command != s->cmd) {
 489             continue;
 490         }
 491
 492         trace_pmu_dispatch_cmd(desc->name);
 493         desc->handler(s, s->cmd_buf, s->cmd_buf_pos,
 494                       s->cmd_rsp, &s->cmd_rsp_sz);
 495
 496         if (s->rsplen != -1 && s->rsplen != s->cmd_rsp_sz) {
 497             trace_pmu_debug_protocol_string("QEMU internal cmd resp mismatch!");
 498         } else {
 499             trace_pmu_debug_protocol_resp_size(s->cmd_rsp_sz);
 500         }
 501
 502         return;
 503     }
 504
 505     trace_pmu_dispatch_unknown_cmd(s->cmd);
 506
 507     /* Manufacture fake response with 0's */
 508     if (s->rsplen == -1) {
 509         s->cmd_rsp_sz = 0;
 510     } else {
 511         s->cmd_rsp_sz = s->rsplen;
 512         memset(s->cmd_rsp, 0, s->rsplen);
 513     }
 514 }
 515
 516 static void pmu_update(PMUState *s)
 517 {
 518     MOS6522PMUState *mps = &s->mos6522_pmu;
 519     MOS6522State *ms = MOS6522(mps);
 520
 521     /* Only react to changes in reg B */
 522     if (ms->b == s->last_b) {
 523         return;
 524     }
 525     s->last_b = ms->b;
 526
 527     /* Check the TREQ / TACK state */
 528     switch (ms->b & (TREQ | TACK)) {
 529     case TREQ:
 530         /* This is an ack release, handle it and bail out */
 531         ms->b |= TACK;
 532         s->last_b = ms->b;
 533
 534         trace_pmu_debug_protocol_string("handshake: TREQ high, setting TACK");
 535         return;
 536     case TACK:
 537         /* This is a valid request, handle below */
 538         break;
 539     case TREQ | TACK:
 540         /* This is an idle state */
 541         return;
 542     default:
 543         /* Invalid state, log and ignore */
 544         trace_pmu_debug_protocol_error(ms->b);
 545         return;
 546     }
 547
 548     /* If we wanted to handle commands asynchronously, this is where
 549      * we would delay the clearing of TACK until we are ready to send
 550      * the response
 551      */
 552
 553     /* We have a request, handshake TACK so we don't stay in
 554      * an invalid state. If we were concurrent with the OS we
 555      * should only do this after we grabbed the SR but that isn't
 556      * a problem here.
 557      */
 558
 559     trace_pmu_debug_protocol_clear_treq(s->cmd_state);
 560
 561     ms->b &= ~TACK;
 562     s->last_b = ms->b;
 563
 564     /* Act according to state */
 565     switch (s->cmd_state) {
 566     case pmu_state_idle:
 567         if (!(ms->acr & SR_OUT)) {
 568             trace_pmu_debug_protocol_string("protocol error! "
 569                                             "state idle, ACR reading");
 570             break;
 571         }
 572
 573         s->cmd = ms->sr;
 574         via_set_sr_int(s);
 575         s->cmdlen = pmu_data_len[s->cmd][0];
 576         s->rsplen = pmu_data_len[s->cmd][1];
 577         s->cmd_buf_pos = 0;
 578         s->cmd_rsp_pos = 0;
 579         s->cmd_state = pmu_state_cmd;
 580
 581         trace_pmu_debug_protocol_cmd(s->cmd, s->cmdlen, s->rsplen);
 582         break;
 583
 584     case pmu_state_cmd:
 585         if (!(ms->acr & SR_OUT)) {
 586             trace_pmu_debug_protocol_string("protocol error! "
 587                                             "state cmd, ACR reading");
 588             break;
 589         }
 590
 591         if (s->cmdlen == -1) {
 592             trace_pmu_debug_protocol_cmdlen(ms->sr);
 593
 594             s->cmdlen = ms->sr;
 595             if (s->cmdlen > sizeof(s->cmd_buf)) {
 596                 trace_pmu_debug_protocol_cmd_toobig(s->cmdlen);
 597             }
 598         } else if (s->cmd_buf_pos < sizeof(s->cmd_buf)) {
 599             s->cmd_buf[s->cmd_buf_pos++] = ms->sr;
 600         }
 601
 602         via_set_sr_int(s);
 603         break;
 604
 605     case pmu_state_rsp:
 606         if (ms->acr & SR_OUT) {
 607             trace_pmu_debug_protocol_string("protocol error! "
 608                                             "state resp, ACR writing");
 609             break;
 610         }
 611
 612         if (s->rsplen == -1) {
 613             trace_pmu_debug_protocol_cmd_send_resp_size(s->cmd_rsp_sz);
 614
 615             ms->sr = s->cmd_rsp_sz;
 616             s->rsplen = s->cmd_rsp_sz;
 617         } else if (s->cmd_rsp_pos < s->cmd_rsp_sz) {
 618             trace_pmu_debug_protocol_cmd_send_resp(s->cmd_rsp_pos, s->rsplen);
 619
 620             ms->sr = s->cmd_rsp[s->cmd_rsp_pos++];
 621         }
 622
 623         via_set_sr_int(s);
 624         break;
 625     }
 626
 627     /* Check for state completion */
 628     if (s->cmd_state == pmu_state_cmd && s->cmdlen == s->cmd_buf_pos) {
 629         trace_pmu_debug_protocol_string("Command reception complete, "
 630                                         "dispatching...");
 631
 632         pmu_dispatch_cmd(s);
 633         s->cmd_state = pmu_state_rsp;
 634     }
 635
 636     if (s->cmd_state == pmu_state_rsp && s->rsplen == s->cmd_rsp_pos) {
 637         trace_pmu_debug_protocol_cmd_resp_complete(ms->ier);
 638
 639         s->cmd_state = pmu_state_idle;
 640     }
 641 }
 642
 643 static uint64_t mos6522_pmu_read(void *opaque, hwaddr addr, unsigned size)
 644 {
 645     PMUState *s = opaque;
 646     MOS6522PMUState *mps = &s->mos6522_pmu;
 647     MOS6522State *ms = MOS6522(mps);
 648
 649     addr = (addr >> 9) & 0xf;
 650     return mos6522_read(ms, addr, size);
 651 }
 652
 653 static void mos6522_pmu_write(void *opaque, hwaddr addr, uint64_t val,
 654                               unsigned size)
 655 {
 656     PMUState *s = opaque;
 657     MOS6522PMUState *mps = &s->mos6522_pmu;
 658     MOS6522State *ms = MOS6522(mps);
 659
 660     addr = (addr >> 9) & 0xf;
 661     mos6522_write(ms, addr, val, size);
 662 }
 663
 664 static const MemoryRegionOps mos6522_pmu_ops = {
 665     .read = mos6522_pmu_read,
 666     .write = mos6522_pmu_write,
 667     .endianness = DEVICE_BIG_ENDIAN,
 668     .impl = {
 669         .min_access_size = 1,
 670         .max_access_size = 1,
 671     },
 672 };
 673
 674 static bool pmu_adb_state_needed(void *opaque)
 675 {
 676     PMUState *s = opaque;
 677
 678     return s->has_adb;
 679 }
 680
 681 static const VMStateDescription vmstate_pmu_adb = {
 682     .name = "pmu/adb",
 683     .version_id = 0,
 684     .minimum_version_id = 0,
 685     .needed = pmu_adb_state_needed,
 686     .fields = (VMStateField[]) {
 687         VMSTATE_UINT16(adb_poll_mask, PMUState),
 688         VMSTATE_TIMER_PTR(adb_poll_timer, PMUState),
 689         VMSTATE_UINT8(adb_reply_size, PMUState),
 690         VMSTATE_BUFFER(adb_reply, PMUState),
 691         VMSTATE_END_OF_LIST()
 692     }
 693 };
 694
 695 static const VMStateDescription vmstate_pmu = {
 696     .name = "pmu",
 697     .version_id = 0,
 698     .minimum_version_id = 0,
 699     .fields = (VMStateField[]) {
 700         VMSTATE_STRUCT(mos6522_pmu.parent_obj, PMUState, 0, vmstate_mos6522,
 701                        MOS6522State),
 702         VMSTATE_UINT8(last_b, PMUState),
 703         VMSTATE_UINT8(cmd, PMUState),
 704         VMSTATE_UINT32(cmdlen, PMUState),
 705         VMSTATE_UINT32(rsplen, PMUState),
 706         VMSTATE_UINT8(cmd_buf_pos, PMUState),
 707         VMSTATE_BUFFER(cmd_buf, PMUState),
 708         VMSTATE_UINT8(cmd_rsp_pos, PMUState),
 709         VMSTATE_UINT8(cmd_rsp_sz, PMUState),
 710         VMSTATE_BUFFER(cmd_rsp, PMUState),
 711         VMSTATE_UINT8(intbits, PMUState),
 712         VMSTATE_UINT8(intmask, PMUState),
 713         VMSTATE_UINT8(autopoll_rate_ms, PMUState),
 714         VMSTATE_UINT8(autopoll_mask, PMUState),
 715         VMSTATE_UINT32(tick_offset, PMUState),
 716         VMSTATE_TIMER_PTR(one_sec_timer, PMUState),
 717         VMSTATE_INT64(one_sec_target, PMUState),
 718         VMSTATE_END_OF_LIST()
 719     },
 720     .subsections = (const VMStateDescription * []) {
 721         &vmstate_pmu_adb,
 722     }
 723 };
 724
 725 static void pmu_reset(DeviceState *dev)
 726 {
 727     PMUState *s = VIA_PMU(dev);
 728
 729     /* OpenBIOS needs to do this? MacOS 9 needs it */
 730     s->intmask = PMU_INT_ADB | PMU_INT_TICK;
 731     s->intbits = 0;
 732
 733     s->cmd_state = pmu_state_idle;
 734     s->autopoll_mask = 0;
 735 }
 736
 737 static void pmu_realize(DeviceState *dev, Error **errp)
 738 {
 739     PMUState *s = VIA_PMU(dev);
 740     SysBusDevice *sbd;
 741     MOS6522State *ms;
 742     DeviceState *d;
 743     struct tm tm;
 744
 745     /* Pass IRQ from 6522 */
 746     d = DEVICE(&s->mos6522_pmu);
 747     ms = MOS6522(d);
 748     sbd = SYS_BUS_DEVICE(s);
 749     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(ms));
 750
 751     qemu_get_timedate(&tm, 0);
 752     s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
 753     s->one_sec_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, pmu_one_sec_timer, s);
 754     s->one_sec_target = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000;
 755     timer_mod(s->one_sec_timer, s->one_sec_target);
 756
 757     if (s->has_adb) {
 758         qbus_create_inplace(&s->adb_bus, sizeof(s->adb_bus), TYPE_ADB_BUS,
 759                             DEVICE(dev), "adb.0");
 760         s->adb_poll_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, pmu_adb_poll, s);
 761         s->adb_poll_mask = 0xffff;
 762         s->autopoll_rate_ms = 20;
 763     }
 764 }
 765
 766 static void pmu_init(Object *obj)
 767 {
 768     SysBusDevice *d = SYS_BUS_DEVICE(obj);
 769     PMUState *s = VIA_PMU(obj);
 770
 771     object_property_add_link(obj, "gpio", TYPE_MACIO_GPIO,
 772                              (Object **) &s->gpio,
 773                              qdev_prop_allow_set_link_before_realize,
 774                              0, NULL);
 775
 776     sysbus_init_child_obj(obj, "mos6522-pmu", &s->mos6522_pmu,
 777                           sizeof(s->mos6522_pmu), TYPE_MOS6522_PMU);
 778
 779     memory_region_init_io(&s->mem, obj, &mos6522_pmu_ops, s, "via-pmu",
 780                           0x2000);
 781     sysbus_init_mmio(d, &s->mem);
 782 }
 783
 784 static Property pmu_properties[] = {
 785     DEFINE_PROP_BOOL("has-adb", PMUState, has_adb, true),
 786     DEFINE_PROP_END_OF_LIST()
 787 };
 788
 789 static void pmu_class_init(ObjectClass *oc, void *data)
 790 {
 791     DeviceClass *dc = DEVICE_CLASS(oc);
 792
 793     dc->realize = pmu_realize;
 794     dc->reset = pmu_reset;
 795     dc->vmsd = &vmstate_pmu;
 796     dc->props = pmu_properties;
 797     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 798 }
 799
 800 static const TypeInfo pmu_type_info = {
 801     .name = TYPE_VIA_PMU,
 802     .parent = TYPE_SYS_BUS_DEVICE,
 803     .instance_size = sizeof(PMUState),
 804     .instance_init = pmu_init,
 805     .class_init = pmu_class_init,
 806 };
 807
 808 static void mos6522_pmu_portB_write(MOS6522State *s)
 809 {
 810     MOS6522PMUState *mps = container_of(s, MOS6522PMUState, parent_obj);
 811     PMUState *ps = container_of(mps, PMUState, mos6522_pmu);
 812
 813     if ((s->pcr & 0xe0) == 0x20 || (s->pcr & 0xe0) == 0x60) {
 814         s->ifr &= ~CB2_INT;
 815     }
 816     s->ifr &= ~CB1_INT;
 817
 818     via_update_irq(ps);
 819     pmu_update(ps);
 820 }
 821
 822 static void mos6522_pmu_portA_write(MOS6522State *s)
 823 {
 824     MOS6522PMUState *mps = container_of(s, MOS6522PMUState, parent_obj);
 825     PMUState *ps = container_of(mps, PMUState, mos6522_pmu);
 826
 827     if ((s->pcr & 0x0e) == 0x02 || (s->pcr & 0x0e) == 0x06) {
 828         s->ifr &= ~CA2_INT;
 829     }
 830     s->ifr &= ~CA1_INT;
 831
 832     via_update_irq(ps);
 833 }
 834
 835 static void mos6522_pmu_reset(DeviceState *dev)
 836 {
 837     MOS6522State *ms = MOS6522(dev);
 838     MOS6522PMUState *mps = container_of(ms, MOS6522PMUState, parent_obj);
 839     PMUState *s = container_of(mps, PMUState, mos6522_pmu);
 840     MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(ms);
 841
 842     mdc->parent_reset(dev);
 843
 844     ms->timers[0].frequency = VIA_TIMER_FREQ;
 845     ms->timers[1].frequency = (SCALE_US * 6000) / 4700;
 846
 847     s->last_b = ms->b = TACK | TREQ;
 848 }
 849
 850 static void mos6522_pmu_class_init(ObjectClass *oc, void *data)
 851 {
 852     DeviceClass *dc = DEVICE_CLASS(oc);
 853     MOS6522DeviceClass *mdc = MOS6522_DEVICE_CLASS(oc);
 854
 855     dc->reset = mos6522_pmu_reset;
 856     mdc->portB_write = mos6522_pmu_portB_write;
 857     mdc->portA_write = mos6522_pmu_portA_write;
 858 }
 859
 860 static const TypeInfo mos6522_pmu_type_info = {
 861     .name = TYPE_MOS6522_PMU,
 862     .parent = TYPE_MOS6522,
 863     .instance_size = sizeof(MOS6522PMUState),
 864     .class_init = mos6522_pmu_class_init,
 865 };
 866
 867 static void pmu_register_types(void)
 868 {
 869     type_register_static(&pmu_type_info);
 870     type_register_static(&mos6522_pmu_type_info);
 871 }
 872
 873 type_init(pmu_register_types)