qemu

1
/*
2
 * QEMU m68k Macintosh VIA device support
3
 *
4
 * Copyright (c) 2011-2018 Laurent Vivier
5
 * Copyright (c) 2018 Mark Cave-Ayland
6
 *
7
 * Some parts from hw/misc/macio/cuda.c
8
 *
9
 * Copyright (c) 2004-2007 Fabrice Bellard
10
 * Copyright (c) 2007 Jocelyn Mayer
11
 *
12
 * some parts from linux-2.6.29, arch/m68k/include/asm/mac_via.h
13
 *
14
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
15
 * See the COPYING file in the top-level directory.
16
 */
17

18
#include "qemu/osdep.h"
19
#include "exec/address-spaces.h"
20
#include "migration/vmstate.h"
21
#include "hw/sysbus.h"
22
#include "hw/irq.h"
23
#include "qemu/timer.h"
24
#include "hw/misc/mac_via.h"
25
#include "hw/misc/mos6522.h"
26
#include "hw/input/adb.h"
27
#include "sysemu/runstate.h"
28
#include "qapi/error.h"
29
#include "qemu/cutils.h"
30
#include "hw/qdev-properties.h"
31
#include "hw/qdev-properties-system.h"
32
#include "sysemu/block-backend.h"
33
#include "sysemu/rtc.h"
34
#include "trace.h"
35
#include "qemu/log.h"
36

37
/*
38
 * VIAs: There are two in every machine
39
 */
40

41
/*
42
 * Not all of these are true post MacII I think.
43
 * CSA: probably the ones CHRP marks as 'unused' change purposes
44
 * when the IWM becomes the SWIM.
45
 * http://www.rs6000.ibm.com/resource/technology/chrpio/via5.mak.html
46
 * ftp://ftp.austin.ibm.com/pub/technology/spec/chrp/inwork/CHRP_IORef_1.0.pdf
47
 *
48
 * also, http://developer.apple.com/technotes/hw/hw_09.html claims the
49
 * following changes for IIfx:
50
 * VIA1A_vSccWrReq not available and that VIA1A_vSync has moved to an IOP.
51
 * Also, "All of the functionality of VIA2 has been moved to other chips".
52
 */
53

54
#define VIA1A_vSccWrReq 0x80   /*
55
                                * SCC write. (input)
56
                                * [CHRP] SCC WREQ: Reflects the state of the
57
                                * Wait/Request pins from the SCC.
58
                                * [Macintosh Family Hardware]
59
                                * as CHRP on SE/30,II,IIx,IIcx,IIci.
60
                                * on IIfx, "0 means an active request"
61
                                */
62
#define VIA1A_vRev8     0x40   /*
63
                                * Revision 8 board ???
64
                                * [CHRP] En WaitReqB: Lets the WaitReq_L
65
                                * signal from port B of the SCC appear on
66
                                * the PA7 input pin. Output.
67
                                * [Macintosh Family] On the SE/30, this
68
                                * is the bit to flip screen buffers.
69
                                * 0=alternate, 1=main.
70
                                * on II,IIx,IIcx,IIci,IIfx this is a bit
71
                                * for Rev ID. 0=II,IIx, 1=IIcx,IIci,IIfx
72
                                */
73
#define VIA1A_vHeadSel  0x20   /*
74
                                * Head select for IWM.
75
                                * [CHRP] unused.
76
                                * [Macintosh Family] "Floppy disk
77
                                * state-control line SEL" on all but IIfx
78
                                */
79
#define VIA1A_vOverlay  0x10   /*
80
                                * [Macintosh Family] On SE/30,II,IIx,IIcx
81
                                * this bit enables the "Overlay" address
82
                                * map in the address decoders as it is on
83
                                * reset for mapping the ROM over the reset
84
                                * vector. 1=use overlay map.
85
                                * On the IIci,IIfx it is another bit of the
86
                                * CPU ID: 0=normal IIci, 1=IIci with parity
87
                                * feature or IIfx.
88
                                * [CHRP] En WaitReqA: Lets the WaitReq_L
89
                                * signal from port A of the SCC appear
90
                                * on the PA7 input pin (CHRP). Output.
91
                                * [MkLinux] "Drive Select"
92
                                *  (with 0x20 being 'disk head select')
93
                                */
94
#define VIA1A_vSync     0x08   /*
95
                                * [CHRP] Sync Modem: modem clock select:
96
                                * 1: select the external serial clock to
97
                                *    drive the SCC's /RTxCA pin.
98
                                * 0: Select the 3.6864MHz clock to drive
99
                                *    the SCC cell.
100
                                * [Macintosh Family] Correct on all but IIfx
101
                                */
102

103
/*
104
 * Macintosh Family Hardware sez: bits 0-2 of VIA1A are volume control
105
 * on Macs which had the PWM sound hardware.  Reserved on newer models.
106
 * On IIci,IIfx, bits 1-2 are the rest of the CPU ID:
107
 * bit 2: 1=IIci, 0=IIfx
108
 * bit 1: 1 on both IIci and IIfx.
109
 * MkLinux sez bit 0 is 'burnin flag' in this case.
110
 * CHRP sez: VIA1A bits 0-2 and 5 are 'unused': if programmed as
111
 * inputs, these bits will read 0.
112
 */
113
#define VIA1A_vVolume   0x07    /* Audio volume mask for PWM */
114
#define VIA1A_CPUID0    0x02    /* CPU id bit 0 on RBV, others */
115
#define VIA1A_CPUID1    0x04    /* CPU id bit 0 on RBV, others */
116
#define VIA1A_CPUID2    0x10    /* CPU id bit 0 on RBV, others */
117
#define VIA1A_CPUID3    0x40    /* CPU id bit 0 on RBV, others */
118
#define VIA1A_CPUID_MASK (VIA1A_CPUID0 | VIA1A_CPUID1 | \
119
                          VIA1A_CPUID2 | VIA1A_CPUID3)
120
#define VIA1A_CPUID_Q800 (VIA1A_CPUID0 | VIA1A_CPUID2)
121

122
/*
123
 * Info on VIA1B is from Macintosh Family Hardware & MkLinux.
124
 * CHRP offers no info.
125
 */
126
#define VIA1B_vSound   0x80    /*
127
                                * Sound enable (for compatibility with
128
                                * PWM hardware) 0=enabled.
129
                                * Also, on IIci w/parity, shows parity error
130
                                * 0=error, 1=OK.
131
                                */
132
#define VIA1B_vMystery 0x40    /*
133
                                * On IIci, parity enable. 0=enabled,1=disabled
134
                                * On SE/30, vertical sync interrupt enable.
135
                                * 0=enabled. This vSync interrupt shows up
136
                                * as a slot $E interrupt.
137
                                * On Quadra 800 this bit toggles A/UX mode which
138
                                * configures the glue logic to deliver some IRQs
139
                                * at different levels compared to a classic
140
                                * Mac.
141
                                */
142
#define VIA1B_vADBS2   0x20    /* ADB state input bit 1 (unused on IIfx) */
143
#define VIA1B_vADBS1   0x10    /* ADB state input bit 0 (unused on IIfx) */
144
#define VIA1B_vADBInt  0x08    /* ADB interrupt 0=interrupt (unused on IIfx)*/
145
#define VIA1B_vRTCEnb  0x04    /* Enable Real time clock. 0=enabled. */
146
#define VIA1B_vRTCClk  0x02    /* Real time clock serial-clock line. */
147
#define VIA1B_vRTCData 0x01    /* Real time clock serial-data line. */
148

149
/*
150
 *    VIA2 A register is the interrupt lines raised off the nubus
151
 *    slots.
152
 *      The below info is from 'Macintosh Family Hardware.'
153
 *      MkLinux calls the 'IIci internal video IRQ' below the 'RBV slot 0 irq.'
154
 *      It also notes that the slot $9 IRQ is the 'Ethernet IRQ' and
155
 *      defines the 'Video IRQ' as 0x40 for the 'EVR' VIA work-alike.
156
 *      Perhaps OSS uses vRAM1 and vRAM2 for ADB.
157
 */
158

159
#define VIA2A_vRAM1    0x80    /* RAM size bit 1 (IIci: reserved) */
160
#define VIA2A_vRAM0    0x40    /* RAM size bit 0 (IIci: internal video IRQ) */
161
#define VIA2A_vIRQE    0x20    /* IRQ from slot $E */
162
#define VIA2A_vIRQD    0x10    /* IRQ from slot $D */
163
#define VIA2A_vIRQC    0x08    /* IRQ from slot $C */
164
#define VIA2A_vIRQB    0x04    /* IRQ from slot $B */
165
#define VIA2A_vIRQA    0x02    /* IRQ from slot $A */
166
#define VIA2A_vIRQ9    0x01    /* IRQ from slot $9 */
167

168
/*
169
 * RAM size bits decoded as follows:
170
 * bit1 bit0  size of ICs in bank A
171
 *  0    0    256 kbit
172
 *  0    1    1 Mbit
173
 *  1    0    4 Mbit
174
 *  1    1   16 Mbit
175
 */
176

177
/*
178
 *    Register B has the fun stuff in it
179
 */
180

181
#define VIA2B_vVBL    0x80    /*
182
                               * VBL output to VIA1 (60.15Hz) driven by
183
                               * timer T1.
184
                               * on IIci, parity test: 0=test mode.
185
                               * [MkLinux] RBV_PARODD: 1=odd,0=even.
186
                               */
187
#define VIA2B_vSndJck 0x40    /*
188
                               * External sound jack status.
189
                               * 0=plug is inserted.  On SE/30, always 0
190
                               */
191
#define VIA2B_vTfr0   0x20    /* Transfer mode bit 0 ack from NuBus */
192
#define VIA2B_vTfr1   0x10    /* Transfer mode bit 1 ack from NuBus */
193
#define VIA2B_vMode32 0x08    /*
194
                               * 24/32bit switch - doubles as cache flush
195
                               * on II, AMU/PMMU control.
196
                               *   if AMU, 0=24bit to 32bit translation
197
                               *   if PMMU, 1=PMMU is accessing page table.
198
                               * on SE/30 tied low.
199
                               * on IIx,IIcx,IIfx, unused.
200
                               * on IIci/RBV, cache control. 0=flush cache.
201
                               */
202
#define VIA2B_vPower  0x04   /*
203
                              * Power off, 0=shut off power.
204
                              * on SE/30 this signal sent to PDS card.
205
                              */
206
#define VIA2B_vBusLk  0x02   /*
207
                              * Lock NuBus transactions, 0=locked.
208
                              * on SE/30 sent to PDS card.
209
                              */
210
#define VIA2B_vCDis   0x01   /*
211
                              * Cache control. On IIci, 1=disable cache card
212
                              * on others, 0=disable processor's instruction
213
                              * and data caches.
214
                              */
215

216
/* interrupt flags */
217

218
#define IRQ_SET         0x80
219

220
/* common */
221

222
#define VIA_IRQ_TIMER1      0x40
223
#define VIA_IRQ_TIMER2      0x20
224

225
/*
226
 * Apple sez: http://developer.apple.com/technotes/ov/ov_04.html
227
 * Another example of a valid function that has no ROM support is the use
228
 * of the alternate video page for page-flipping animation. Since there
229
 * is no ROM call to flip pages, it is necessary to go play with the
230
 * right bit in the VIA chip (6522 Versatile Interface Adapter).
231
 * [CSA: don't know which one this is, but it's one of 'em!]
232
 */
233

234
/*
235
 *    6522 registers - see databook.
236
 * CSA: Assignments for VIA1 confirmed from CHRP spec.
237
 */
238

239
/* partial address decode.  0xYYXX : XX part for RBV, YY part for VIA */
240
/* Note: 15 VIA regs, 8 RBV regs */
241

242
#define vBufB    0x0000  /* [VIA/RBV]  Register B */
243
#define vBufAH   0x0200  /* [VIA only] Buffer A, with handshake. DON'T USE! */
244
#define vDirB    0x0400  /* [VIA only] Data Direction Register B. */
245
#define vDirA    0x0600  /* [VIA only] Data Direction Register A. */
246
#define vT1CL    0x0800  /* [VIA only] Timer one counter low. */
247
#define vT1CH    0x0a00  /* [VIA only] Timer one counter high. */
248
#define vT1LL    0x0c00  /* [VIA only] Timer one latches low. */
249
#define vT1LH    0x0e00  /* [VIA only] Timer one latches high. */
250
#define vT2CL    0x1000  /* [VIA only] Timer two counter low. */
251
#define vT2CH    0x1200  /* [VIA only] Timer two counter high. */
252
#define vSR      0x1400  /* [VIA only] Shift register. */
253
#define vACR     0x1600  /* [VIA only] Auxiliary control register. */
254
#define vPCR     0x1800  /* [VIA only] Peripheral control register. */
255
                         /*
256
                          *           CHRP sez never ever to *write* this.
257
                          *            Mac family says never to *change* this.
258
                          * In fact we need to initialize it once at start.
259
                          */
260
#define vIFR     0x1a00  /* [VIA/RBV]  Interrupt flag register. */
261
#define vIER     0x1c00  /* [VIA/RBV]  Interrupt enable register. */
262
#define vBufA    0x1e00  /* [VIA/RBV] register A (no handshake) */
263

264
/* from linux 2.6 drivers/macintosh/via-macii.c */
265

266
/* Bits in ACR */
267

268
#define VIA1ACR_vShiftCtrl         0x1c        /* Shift register control bits */
269
#define VIA1ACR_vShiftExtClk       0x0c        /* Shift on external clock */
270
#define VIA1ACR_vShiftOut          0x10        /* Shift out if 1 */
271

272
/*
273
 * Apple Macintosh Family Hardware Refenece
274
 * Table 19-10 ADB transaction states
275
 */
276

277
#define ADB_STATE_NEW       0
278
#define ADB_STATE_EVEN      1
279
#define ADB_STATE_ODD       2
280
#define ADB_STATE_IDLE      3
281

282
#define VIA1B_vADB_StateMask    (VIA1B_vADBS1 | VIA1B_vADBS2)
283
#define VIA1B_vADB_StateShift   4
284

285
#define VIA_TIMER_FREQ (783360)
286
#define VIA_ADB_POLL_FREQ 50 /* XXX: not real */
287

288
/*
289
 * Guide to the Macintosh Family Hardware ch. 12 "Displays" p. 401 gives the
290
 * precise 60Hz interrupt frequency as ~60.15Hz with a period of 16625.8 us
291
 */
292
#define VIA_60HZ_TIMER_PERIOD_NS   16625800
293

294
/* VIA returns time offset from Jan 1, 1904, not 1970 */
295
#define RTC_OFFSET 2082844800
296

297
enum {
298
    REG_0,
299
    REG_1,
300
    REG_2,
301
    REG_3,
302
    REG_TEST,
303
    REG_WPROTECT,
304
    REG_PRAM_ADDR,
305
    REG_PRAM_ADDR_LAST = REG_PRAM_ADDR + 19,
306
    REG_PRAM_SECT,
307
    REG_PRAM_SECT_LAST = REG_PRAM_SECT + 7,
308
    REG_INVALID,
309
    REG_EMPTY = 0xff,
310
};
311

312
static void via1_sixty_hz_update(MOS6522Q800VIA1State *v1s)
313
{
314
    /* 60 Hz irq */
315
    v1s->next_sixty_hz = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
316
                          VIA_60HZ_TIMER_PERIOD_NS) /
317
                          VIA_60HZ_TIMER_PERIOD_NS * VIA_60HZ_TIMER_PERIOD_NS;
318
    timer_mod(v1s->sixty_hz_timer, v1s->next_sixty_hz);
319
}
320

321
static void via1_one_second_update(MOS6522Q800VIA1State *v1s)
322
{
323
    v1s->next_second = (qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000) /
324
                       1000 * 1000;
325
    timer_mod(v1s->one_second_timer, v1s->next_second);
326
}
327

328
static void via1_sixty_hz(void *opaque)
329
{
330
    MOS6522Q800VIA1State *v1s = opaque;
331
    MOS6522State *s = MOS6522(v1s);
332
    qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA1_IRQ_60HZ_BIT);
333

334
    /* Negative edge trigger */
335
    qemu_irq_lower(irq);
336
    qemu_irq_raise(irq);
337

338
    via1_sixty_hz_update(v1s);
339
}
340

341
static void via1_one_second(void *opaque)
342
{
343
    MOS6522Q800VIA1State *v1s = opaque;
344
    MOS6522State *s = MOS6522(v1s);
345
    qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA1_IRQ_ONE_SECOND_BIT);
346

347
    /* Negative edge trigger */
348
    qemu_irq_lower(irq);
349
    qemu_irq_raise(irq);
350

351
    via1_one_second_update(v1s);
352
}
353

354

355
static void pram_update(MOS6522Q800VIA1State *v1s)
356
{
357
    if (v1s->blk) {
358
        if (blk_pwrite(v1s->blk, 0, sizeof(v1s->PRAM), v1s->PRAM, 0) < 0) {
359
            qemu_log("pram_update: cannot write to file\n");
360
        }
361
    }
362
}
363

364
/*
365
 * RTC Commands
366
 *
367
 * Command byte    Register addressed by the command
368
 *
369
 * z00x0001        Seconds register 0 (lowest-order byte)
370
 * z00x0101        Seconds register 1
371
 * z00x1001        Seconds register 2
372
 * z00x1101        Seconds register 3 (highest-order byte)
373
 * 00110001        Test register (write-only)
374
 * 00110101        Write-Protect Register (write-only)
375
 * z010aa01        RAM address 100aa ($10-$13) (first 20 bytes only)
376
 * z1aaaa01        RAM address 0aaaa ($00-$0F) (first 20 bytes only)
377
 * z0111aaa        Extended memory designator and sector number
378
 *
379
 * For a read request, z=1, for a write z=0
380
 * The letter x indicates don't care
381
 * The letter a indicates bits whose value depend on what parameter
382
 * RAM byte you want to address
383
 */
384
static int via1_rtc_compact_cmd(uint8_t value)
385
{
386
    uint8_t read = value & 0x80;
387

388
    value &= 0x7f;
389

390
    /* the last 2 bits of a command byte must always be 0b01 ... */
391
    if ((value & 0x78) == 0x38) {
392
        /* except for the extended memory designator */
393
        return read | (REG_PRAM_SECT + (value & 0x07));
394
    }
395
    if ((value & 0x03) == 0x01) {
396
        value >>= 2;
397
        if ((value & 0x18) == 0) {
398
            /* seconds registers */
399
            return read | (REG_0 + (value & 0x03));
400
        } else if ((value == 0x0c) && !read) {
401
            return REG_TEST;
402
        } else if ((value == 0x0d) && !read) {
403
            return REG_WPROTECT;
404
        } else if ((value & 0x1c) == 0x08) {
405
            /* RAM address 0x10 to 0x13 */
406
            return read | (REG_PRAM_ADDR + 0x10 + (value & 0x03));
407
        } else if ((value & 0x10) == 0x10) {
408
            /* RAM address 0x00 to 0x0f */
409
            return read | (REG_PRAM_ADDR + (value & 0x0f));
410
        }
411
    }
412
    return REG_INVALID;
413
}
414

415
static void via1_rtc_update(MOS6522Q800VIA1State *v1s)
416
{
417
    MOS6522State *s = MOS6522(v1s);
418
    int cmd, sector, addr;
419
    uint32_t time;
420

421
    if (s->b & VIA1B_vRTCEnb) {
422
        return;
423
    }
424

425
    if (s->dirb & VIA1B_vRTCData) {
426
        /* send bits to the RTC */
427
        if (!(v1s->last_b & VIA1B_vRTCClk) && (s->b & VIA1B_vRTCClk)) {
428
            v1s->data_out <<= 1;
429
            v1s->data_out |= s->b & VIA1B_vRTCData;
430
            v1s->data_out_cnt++;
431
        }
432
        trace_via1_rtc_update_data_out(v1s->data_out_cnt, v1s->data_out);
433
    } else {
434
        trace_via1_rtc_update_data_in(v1s->data_in_cnt, v1s->data_in);
435
        /* receive bits from the RTC */
436
        if ((v1s->last_b & VIA1B_vRTCClk) &&
437
            !(s->b & VIA1B_vRTCClk) &&
438
            v1s->data_in_cnt) {
439
            s->b = (s->b & ~VIA1B_vRTCData) |
440
                   ((v1s->data_in >> 7) & VIA1B_vRTCData);
441
            v1s->data_in <<= 1;
442
            v1s->data_in_cnt--;
443
        }
444
        return;
445
    }
446

447
    if (v1s->data_out_cnt != 8) {
448
        return;
449
    }
450

451
    v1s->data_out_cnt = 0;
452

453
    trace_via1_rtc_internal_status(v1s->cmd, v1s->alt, v1s->data_out);
454
    /* first byte: it's a command */
455
    if (v1s->cmd == REG_EMPTY) {
456

457
        cmd = via1_rtc_compact_cmd(v1s->data_out);
458
        trace_via1_rtc_internal_cmd(cmd);
459

460
        if (cmd == REG_INVALID) {
461
            trace_via1_rtc_cmd_invalid(v1s->data_out);
462
            return;
463
        }
464

465
        if (cmd & 0x80) { /* this is a read command */
466
            switch (cmd & 0x7f) {
467
            case REG_0...REG_3: /* seconds registers */
468
                /*
469
                 * register 0 is lowest-order byte
470
                 * register 3 is highest-order byte
471
                 */
472

473
                time = v1s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
474
                       / NANOSECONDS_PER_SECOND);
475
                trace_via1_rtc_internal_time(time);
476
                v1s->data_in = (time >> ((cmd & 0x03) << 3)) & 0xff;
477
                v1s->data_in_cnt = 8;
478
                trace_via1_rtc_cmd_seconds_read((cmd & 0x7f) - REG_0,
479
                                                v1s->data_in);
480
                break;
481
            case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
482
                /* PRAM address 0x00 -> 0x13 */
483
                v1s->data_in = v1s->PRAM[(cmd & 0x7f) - REG_PRAM_ADDR];
484
                v1s->data_in_cnt = 8;
485
                trace_via1_rtc_cmd_pram_read((cmd & 0x7f) - REG_PRAM_ADDR,
486
                                             v1s->data_in);
487
                break;
488
            case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
489
                /*
490
                 * extended memory designator and sector number
491
                 * the only two-byte read command
492
                 */
493
                trace_via1_rtc_internal_set_cmd(cmd);
494
                v1s->cmd = cmd;
495
                break;
496
            default:
497
                g_assert_not_reached();
498
                break;
499
            }
500
            return;
501
        }
502

503
        /* this is a write command, needs a parameter */
504
        if (cmd == REG_WPROTECT || !v1s->wprotect) {
505
            trace_via1_rtc_internal_set_cmd(cmd);
506
            v1s->cmd = cmd;
507
        } else {
508
            trace_via1_rtc_internal_ignore_cmd(cmd);
509
        }
510
        return;
511
    }
512

513
    /* second byte: it's a parameter */
514
    if (v1s->alt == REG_EMPTY) {
515
        switch (v1s->cmd & 0x7f) {
516
        case REG_0...REG_3: /* seconds register */
517
            /* FIXME */
518
            trace_via1_rtc_cmd_seconds_write(v1s->cmd - REG_0, v1s->data_out);
519
            v1s->cmd = REG_EMPTY;
520
            break;
521
        case REG_TEST:
522
            /* device control: nothing to do */
523
            trace_via1_rtc_cmd_test_write(v1s->data_out);
524
            v1s->cmd = REG_EMPTY;
525
            break;
526
        case REG_WPROTECT:
527
            /* Write Protect register */
528
            trace_via1_rtc_cmd_wprotect_write(v1s->data_out);
529
            v1s->wprotect = !!(v1s->data_out & 0x80);
530
            v1s->cmd = REG_EMPTY;
531
            break;
532
        case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
533
            /* PRAM address 0x00 -> 0x13 */
534
            trace_via1_rtc_cmd_pram_write(v1s->cmd - REG_PRAM_ADDR,
535
                                          v1s->data_out);
536
            v1s->PRAM[v1s->cmd - REG_PRAM_ADDR] = v1s->data_out;
537
            pram_update(v1s);
538
            v1s->cmd = REG_EMPTY;
539
            break;
540
        case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
541
            addr = (v1s->data_out >> 2) & 0x1f;
542
            sector = (v1s->cmd & 0x7f) - REG_PRAM_SECT;
543
            if (v1s->cmd & 0x80) {
544
                /* it's a read */
545
                v1s->data_in = v1s->PRAM[sector * 32 + addr];
546
                v1s->data_in_cnt = 8;
547
                trace_via1_rtc_cmd_pram_sect_read(sector, addr,
548
                                                  sector * 32 + addr,
549
                                                  v1s->data_in);
550
                v1s->cmd = REG_EMPTY;
551
            } else {
552
                /* it's a write, we need one more parameter */
553
                trace_via1_rtc_internal_set_alt(addr, sector, addr);
554
                v1s->alt = addr;
555
            }
556
            break;
557
        default:
558
            g_assert_not_reached();
559
            break;
560
        }
561
        return;
562
    }
563

564
    /* third byte: it's the data of a REG_PRAM_SECT write */
565
    g_assert(REG_PRAM_SECT <= v1s->cmd && v1s->cmd <= REG_PRAM_SECT_LAST);
566
    sector = v1s->cmd - REG_PRAM_SECT;
567
    v1s->PRAM[sector * 32 + v1s->alt] = v1s->data_out;
568
    pram_update(v1s);
569
    trace_via1_rtc_cmd_pram_sect_write(sector, v1s->alt, sector * 32 + v1s->alt,
570
                                       v1s->data_out);
571
    v1s->alt = REG_EMPTY;
572
    v1s->cmd = REG_EMPTY;
573
}
574

575
static void adb_via_poll(void *opaque)
576
{
577
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
578
    MOS6522State *s = MOS6522(v1s);
579
    ADBBusState *adb_bus = &v1s->adb_bus;
580
    uint8_t obuf[9];
581
    uint8_t *data = &s->sr;
582
    int olen;
583

584
    /*
585
     * Setting vADBInt below indicates that an autopoll reply has been
586
     * received, however we must block autopoll until the point where
587
     * the entire reply has been read back to the host
588
     */
589
    adb_autopoll_block(adb_bus);
590

591
    if (v1s->adb_data_in_size > 0 && v1s->adb_data_in_index == 0) {
592
        /*
593
         * For older Linux kernels that switch to IDLE mode after sending the
594
         * ADB command, detect if there is an existing response and return that
595
         * as a "fake" autopoll reply or bus timeout accordingly
596
         */
597
        *data = v1s->adb_data_out[0];
598
        olen = v1s->adb_data_in_size;
599

600
        s->b &= ~VIA1B_vADBInt;
601
        qemu_irq_raise(v1s->adb_data_ready);
602
    } else {
603
        /*
604
         * Otherwise poll as normal
605
         */
606
        v1s->adb_data_in_index = 0;
607
        v1s->adb_data_out_index = 0;
608
        olen = adb_poll(adb_bus, obuf, adb_bus->autopoll_mask);
609

610
        if (olen > 0) {
611
            /* Autopoll response */
612
            *data = obuf[0];
613
            olen--;
614
            memcpy(v1s->adb_data_in, &obuf[1], olen);
615
            v1s->adb_data_in_size = olen;
616

617
            s->b &= ~VIA1B_vADBInt;
618
            qemu_irq_raise(v1s->adb_data_ready);
619
        } else {
620
            *data = v1s->adb_autopoll_cmd;
621
            obuf[0] = 0xff;
622
            obuf[1] = 0xff;
623
            olen = 2;
624

625
            memcpy(v1s->adb_data_in, obuf, olen);
626
            v1s->adb_data_in_size = olen;
627

628
            s->b &= ~VIA1B_vADBInt;
629
            qemu_irq_raise(v1s->adb_data_ready);
630
        }
631
    }
632

633
    trace_via1_adb_poll(*data, (s->b & VIA1B_vADBInt) ? "+" : "-",
634
                        adb_bus->status, v1s->adb_data_in_index, olen);
635
}
636

637
static int adb_via_send_len(uint8_t data)
638
{
639
    /* Determine the send length from the given ADB command */
640
    uint8_t cmd = data & 0xc;
641
    uint8_t reg = data & 0x3;
642

643
    switch (cmd) {
644
    case 0x8:
645
        /* Listen command */
646
        switch (reg) {
647
        case 2:
648
            /* Register 2 is only used for the keyboard */
649
            return 3;
650
        case 3:
651
            /*
652
             * Fortunately our devices only implement writes
653
             * to register 3 which is fixed at 2 bytes
654
             */
655
            return 3;
656
        default:
657
            qemu_log_mask(LOG_UNIMP, "ADB unknown length for register %d\n",
658
                          reg);
659
            return 1;
660
        }
661
    default:
662
        /* Talk, BusReset */
663
        return 1;
664
    }
665
}
666

667
static void adb_via_send(MOS6522Q800VIA1State *v1s, int state, uint8_t data)
668
{
669
    MOS6522State *ms = MOS6522(v1s);
670
    ADBBusState *adb_bus = &v1s->adb_bus;
671
    uint16_t autopoll_mask;
672

673
    switch (state) {
674
    case ADB_STATE_NEW:
675
        /*
676
         * Command byte: vADBInt tells host autopoll data already present
677
         * in VIA shift register and ADB transceiver
678
         */
679
        adb_autopoll_block(adb_bus);
680

681
        if (adb_bus->status & ADB_STATUS_POLLREPLY) {
682
            /* Tell the host the existing data is from autopoll */
683
            ms->b &= ~VIA1B_vADBInt;
684
        } else {
685
            ms->b |= VIA1B_vADBInt;
686
            v1s->adb_data_out_index = 0;
687
            v1s->adb_data_out[v1s->adb_data_out_index++] = data;
688
        }
689

690
        trace_via1_adb_send(" NEW", data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
691
        qemu_irq_raise(v1s->adb_data_ready);
692
        break;
693

694
    case ADB_STATE_EVEN:
695
    case ADB_STATE_ODD:
696
        ms->b |= VIA1B_vADBInt;
697
        v1s->adb_data_out[v1s->adb_data_out_index++] = data;
698

699
        trace_via1_adb_send(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
700
                            data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
701
        qemu_irq_raise(v1s->adb_data_ready);
702
        break;
703

704
    case ADB_STATE_IDLE:
705
        ms->b |= VIA1B_vADBInt;
706
        adb_autopoll_unblock(adb_bus);
707

708
        trace_via1_adb_send("IDLE", data,
709
                            (ms->b & VIA1B_vADBInt) ? "+" : "-");
710

711
        return;
712
    }
713

714
    /* If the command is complete, execute it */
715
    if (v1s->adb_data_out_index == adb_via_send_len(v1s->adb_data_out[0])) {
716
        v1s->adb_data_in_size = adb_request(adb_bus, v1s->adb_data_in,
717
                                            v1s->adb_data_out,
718
                                            v1s->adb_data_out_index);
719
        v1s->adb_data_in_index = 0;
720

721
        if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
722
            /*
723
             * Bus timeout (but allow first EVEN and ODD byte to indicate
724
             * timeout via vADBInt and SRQ status)
725
             */
726
            v1s->adb_data_in[0] = 0xff;
727
            v1s->adb_data_in[1] = 0xff;
728
            v1s->adb_data_in_size = 2;
729
        }
730

731
        /*
732
         * If last command is TALK, store it for use by autopoll and adjust
733
         * the autopoll mask accordingly
734
         */
735
        if ((v1s->adb_data_out[0] & 0xc) == 0xc) {
736
            v1s->adb_autopoll_cmd = v1s->adb_data_out[0];
737

738
            autopoll_mask = 1 << (v1s->adb_autopoll_cmd >> 4);
739
            adb_set_autopoll_mask(adb_bus, autopoll_mask);
740
        }
741
    }
742
}
743

744
static void adb_via_receive(MOS6522Q800VIA1State *v1s, int state, uint8_t *data)
745
{
746
    MOS6522State *ms = MOS6522(v1s);
747
    ADBBusState *adb_bus = &v1s->adb_bus;
748
    uint16_t pending;
749

750
    switch (state) {
751
    case ADB_STATE_NEW:
752
        ms->b |= VIA1B_vADBInt;
753
        return;
754

755
    case ADB_STATE_IDLE:
756
        ms->b |= VIA1B_vADBInt;
757
        adb_autopoll_unblock(adb_bus);
758

759
        trace_via1_adb_receive("IDLE", *data,
760
                        (ms->b & VIA1B_vADBInt) ? "+" : "-", adb_bus->status,
761
                        v1s->adb_data_in_index, v1s->adb_data_in_size);
762

763
        break;
764

765
    case ADB_STATE_EVEN:
766
    case ADB_STATE_ODD:
767
        switch (v1s->adb_data_in_index) {
768
        case 0:
769
            /* First EVEN byte: vADBInt indicates bus timeout */
770
            *data = v1s->adb_data_in[v1s->adb_data_in_index];
771
            if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
772
                ms->b &= ~VIA1B_vADBInt;
773
            } else {
774
                ms->b |= VIA1B_vADBInt;
775
            }
776

777
            trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
778
                                   *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
779
                                   adb_bus->status, v1s->adb_data_in_index,
780
                                   v1s->adb_data_in_size);
781

782
            v1s->adb_data_in_index++;
783
            break;
784

785
        case 1:
786
            /* First ODD byte: vADBInt indicates SRQ */
787
            *data = v1s->adb_data_in[v1s->adb_data_in_index];
788
            pending = adb_bus->pending & ~(1 << (v1s->adb_autopoll_cmd >> 4));
789
            if (pending) {
790
                ms->b &= ~VIA1B_vADBInt;
791
            } else {
792
                ms->b |= VIA1B_vADBInt;
793
            }
794

795
            trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
796
                                   *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
797
                                   adb_bus->status, v1s->adb_data_in_index,
798
                                   v1s->adb_data_in_size);
799

800
            v1s->adb_data_in_index++;
801
            break;
802

803
        default:
804
            /*
805
             * Otherwise vADBInt indicates end of data. Note that Linux
806
             * specifically checks for the sequence 0x0 0xff to confirm the
807
             * end of the poll reply, so provide these extra bytes below to
808
             * keep it happy
809
             */
810
            if (v1s->adb_data_in_index < v1s->adb_data_in_size) {
811
                /* Next data byte */
812
                *data = v1s->adb_data_in[v1s->adb_data_in_index];
813
                ms->b |= VIA1B_vADBInt;
814
            } else if (v1s->adb_data_in_index == v1s->adb_data_in_size) {
815
                if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
816
                    /* Bus timeout (no more data) */
817
                    *data = 0xff;
818
                } else {
819
                    /* Return 0x0 after reply */
820
                    *data = 0;
821
                }
822
                ms->b &= ~VIA1B_vADBInt;
823
            } else {
824
                /* Bus timeout (no more data) */
825
                *data = 0xff;
826
                ms->b &= ~VIA1B_vADBInt;
827
                adb_bus->status = 0;
828
                adb_autopoll_unblock(adb_bus);
829
            }
830

831
            trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
832
                                   *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
833
                                   adb_bus->status, v1s->adb_data_in_index,
834
                                   v1s->adb_data_in_size);
835

836
            if (v1s->adb_data_in_index <= v1s->adb_data_in_size) {
837
                v1s->adb_data_in_index++;
838
            }
839
            break;
840
        }
841

842
        qemu_irq_raise(v1s->adb_data_ready);
843
        break;
844
    }
845
}
846

847
static void via1_adb_update(MOS6522Q800VIA1State *v1s)
848
{
849
    MOS6522State *s = MOS6522(v1s);
850
    int oldstate, state;
851

852
    oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
853
    state = (s->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
854

855
    if (state != oldstate) {
856
        if (s->acr & VIA1ACR_vShiftOut) {
857
            /* output mode */
858
            adb_via_send(v1s, state, s->sr);
859
        } else {
860
            /* input mode */
861
            adb_via_receive(v1s, state, &s->sr);
862
        }
863
    }
864
}
865

866
static void via1_auxmode_update(MOS6522Q800VIA1State *v1s)
867
{
868
    MOS6522State *s = MOS6522(v1s);
869
    int oldirq, irq;
870

871
    oldirq = (v1s->last_b & VIA1B_vMystery) ? 1 : 0;
872
    irq = (s->b & VIA1B_vMystery) ? 1 : 0;
873

874
    /* Check to see if the A/UX mode bit has changed */
875
    if (irq != oldirq) {
876
        trace_via1_auxmode(irq);
877
        qemu_set_irq(v1s->auxmode_irq, irq);
878

879
        /*
880
         * Clear the ADB interrupt. MacOS can leave VIA1B_vADBInt asserted
881
         * (low) if a poll sequence doesn't complete before NetBSD disables
882
         * interrupts upon boot. Fortunately NetBSD switches to the so-called
883
         * "A/UX" interrupt mode after it initialises, so we can use this as
884
         * a convenient place to clear the ADB interrupt for now.
885
         */
886
        s->b |= VIA1B_vADBInt;
887
    }
888
}
889

890
/*
891
 * Addresses and real values for TimeDBRA/TimeSCCB to allow timer calibration
892
 * to succeed (NOTE: both values have been multiplied by 3 to cope with the
893
 * speed of QEMU execution on a modern host
894
 */
895
#define MACOS_TIMEDBRA        0xd00
896
#define MACOS_TIMESCCB        0xd02
897

898
#define MACOS_TIMEDBRA_VALUE  (0x2a00 * 3)
899
#define MACOS_TIMESCCB_VALUE  (0x079d * 3)
900

901
static bool via1_is_toolbox_timer_calibrated(void)
902
{
903
    /*
904
     * Indicate whether the MacOS toolbox has been calibrated by checking
905
     * for the value of our magic constants
906
     */
907
    uint16_t timedbra = lduw_be_phys(&address_space_memory, MACOS_TIMEDBRA);
908
    uint16_t timesccdb = lduw_be_phys(&address_space_memory, MACOS_TIMESCCB);
909

910
    return (timedbra == MACOS_TIMEDBRA_VALUE &&
911
            timesccdb == MACOS_TIMESCCB_VALUE);
912
}
913

914
static void via1_timer_calibration_hack(MOS6522Q800VIA1State *v1s, int addr,
915
                                        uint64_t val, int size)
916
{
917
    /*
918
     * Work around timer calibration to ensure we that we have non-zero and
919
     * known good values for TIMEDRBA and TIMESCCDB.
920
     *
921
     * This works by attempting to detect the reset and calibration sequence
922
     * of writes to VIA1
923
     */
924
    int old_timer_hack_state = v1s->timer_hack_state;
925

926
    switch (v1s->timer_hack_state) {
927
    case 0:
928
        if (addr == VIA_REG_PCR && val == 0x22) {
929
            /* VIA_REG_PCR: configure VIA1 edge triggering */
930
            v1s->timer_hack_state = 1;
931
        }
932
        break;
933
    case 1:
934
        if (addr == VIA_REG_T2CL && val == 0xc) {
935
            /* VIA_REG_T2CL: low byte of 1ms counter */
936
            if (!via1_is_toolbox_timer_calibrated()) {
937
                v1s->timer_hack_state = 2;
938
            } else {
939
                v1s->timer_hack_state = 0;
940
            }
941
        }
942
        break;
943
    case 2:
944
        if (addr == VIA_REG_T2CH && val == 0x3) {
945
            /*
946
             * VIA_REG_T2CH: high byte of 1ms counter (very likely at the
947
             * start of SETUPTIMEK)
948
             */
949
            if (!via1_is_toolbox_timer_calibrated()) {
950
                v1s->timer_hack_state = 3;
951
            } else {
952
                v1s->timer_hack_state = 0;
953
            }
954
        }
955
        break;
956
    case 3:
957
        if (addr == VIA_REG_IER && val == 0x20) {
958
            /*
959
             * VIA_REG_IER: update at end of SETUPTIMEK
960
             *
961
             * Timer calibration has finished: unfortunately the values in
962
             * TIMEDBRA (0xd00) and TIMESCCDB (0xd02) are so far out they
963
             * cause divide by zero errors.
964
             *
965
             * Update them with values obtained from a real Q800 but with
966
             * a x3 scaling factor which seems to work well
967
             */
968
            stw_be_phys(&address_space_memory, MACOS_TIMEDBRA,
969
                        MACOS_TIMEDBRA_VALUE);
970
            stw_be_phys(&address_space_memory, MACOS_TIMESCCB,
971
                        MACOS_TIMESCCB_VALUE);
972

973
            v1s->timer_hack_state = 4;
974
        }
975
        break;
976
    case 4:
977
        /*
978
         * This is the normal post-calibration timer state: we should
979
         * generally remain here unless we detect the A/UX calibration
980
         * loop, or a write to VIA_REG_PCR suggesting a reset
981
         */
982
        if (addr == VIA_REG_PCR && val == 0x22) {
983
            /* Looks like there has been a reset? */
984
            v1s->timer_hack_state = 1;
985
        }
986

987
        if (addr == VIA_REG_T2CL && val == 0xf0) {
988
            /* VIA_REG_T2CL: low byte of counter (A/UX) */
989
            v1s->timer_hack_state = 5;
990
        }
991
        break;
992
    case 5:
993
        if (addr == VIA_REG_T2CH && val == 0x3c) {
994
            /*
995
             * VIA_REG_T2CH: high byte of counter (A/UX). We are now extremely
996
             * likely to be in the A/UX timer calibration routine, so move to
997
             * the next state where we enable the calibration hack.
998
             */
999
            v1s->timer_hack_state = 6;
1000
        } else if ((addr == VIA_REG_IER && val == 0x20) ||
1001
                   addr == VIA_REG_T2CH) {
1002
            /* We're doing something else with the timer, not calibration */
1003
            v1s->timer_hack_state = 0;
1004
        }
1005
        break;
1006
    case 6:
1007
        if ((addr == VIA_REG_IER && val == 0x20) || addr == VIA_REG_T2CH) {
1008
            /* End of A/UX timer calibration routine, or another write */
1009
            v1s->timer_hack_state = 7;
1010
        } else {
1011
            v1s->timer_hack_state = 0;
1012
        }
1013
        break;
1014
    case 7:
1015
        /*
1016
         * This is the normal post-calibration timer state once both the
1017
         * MacOS toolbox and A/UX have been calibrated, until we see a write
1018
         * to VIA_REG_PCR to suggest a reset
1019
         */
1020
        if (addr == VIA_REG_PCR && val == 0x22) {
1021
            /* Looks like there has been a reset? */
1022
            v1s->timer_hack_state = 1;
1023
        }
1024
        break;
1025
    default:
1026
        g_assert_not_reached();
1027
    }
1028

1029
    if (old_timer_hack_state != v1s->timer_hack_state) {
1030
        trace_via1_timer_hack_state(v1s->timer_hack_state);
1031
    }
1032
}
1033

1034
static uint64_t mos6522_q800_via1_read(void *opaque, hwaddr addr, unsigned size)
1035
{
1036
    MOS6522Q800VIA1State *s = MOS6522_Q800_VIA1(opaque);
1037
    MOS6522State *ms = MOS6522(s);
1038
    uint64_t ret;
1039
    int64_t now;
1040

1041
    addr = (addr >> 9) & 0xf;
1042
    ret = mos6522_read(ms, addr, size);
1043
    switch (addr) {
1044
    case VIA_REG_A:
1045
    case VIA_REG_ANH:
1046
        /* Quadra 800 Id */
1047
        ret = (ret & ~VIA1A_CPUID_MASK) | VIA1A_CPUID_Q800;
1048
        break;
1049
    case VIA_REG_T2CH:
1050
        if (s->timer_hack_state == 6) {
1051
            /*
1052
             * The A/UX timer calibration loop runs continuously until 2
1053
             * consecutive iterations differ by at least 0x492 timer ticks.
1054
             * Modern hosts execute the timer calibration loop so fast that
1055
             * this situation never occurs causing a hang on boot. Use a
1056
             * similar method to Shoebill which is to randomly add 0x500 to
1057
             * the T2 counter value during calibration to enable it to
1058
             * eventually succeed.
1059
             */
1060
            now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1061
            if (now & 1) {
1062
                ret += 0x5;
1063
            }
1064
        }
1065
        break;
1066
    }
1067
    return ret;
1068
}
1069

1070
static void mos6522_q800_via1_write(void *opaque, hwaddr addr, uint64_t val,
1071
                                    unsigned size)
1072
{
1073
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
1074
    MOS6522State *ms = MOS6522(v1s);
1075
    int oldstate, state;
1076
    int oldsr = ms->sr;
1077

1078
    addr = (addr >> 9) & 0xf;
1079

1080
    via1_timer_calibration_hack(v1s, addr, val, size);
1081

1082
    mos6522_write(ms, addr, val, size);
1083

1084
    switch (addr) {
1085
    case VIA_REG_B:
1086
        via1_rtc_update(v1s);
1087
        via1_adb_update(v1s);
1088
        via1_auxmode_update(v1s);
1089

1090
        v1s->last_b = ms->b;
1091
        break;
1092

1093
    case VIA_REG_SR:
1094
        {
1095
            /*
1096
             * NetBSD assumes it can send its first ADB command after sending
1097
             * the ADB_BUSRESET command in ADB_STATE_NEW without changing the
1098
             * state back to ADB_STATE_IDLE first as detailed in the ADB
1099
             * protocol.
1100
             *
1101
             * Add a workaround to detect this condition at the start of ADB
1102
             * enumeration and send the next command written to SR after a
1103
             * ADB_BUSRESET onto the bus regardless, even if we don't detect a
1104
             * state transition to ADB_STATE_NEW.
1105
             *
1106
             * Note that in my tests the NetBSD state machine takes one ADB
1107
             * operation to recover which means the probe for an ADB device at
1108
             * address 1 always fails. However since the first device is at
1109
             * address 2 then this will work fine, without having to come up
1110
             * with a more complicated and invasive solution.
1111
             */
1112
            oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >>
1113
                       VIA1B_vADB_StateShift;
1114
            state = (ms->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
1115

1116
            if (oldstate == ADB_STATE_NEW && state == ADB_STATE_NEW &&
1117
                    (ms->acr & VIA1ACR_vShiftOut) &&
1118
                    oldsr == 0 /* ADB_BUSRESET */) {
1119
                trace_via1_adb_netbsd_enum_hack();
1120
                adb_via_send(v1s, state, ms->sr);
1121
            }
1122
        }
1123
        break;
1124
    }
1125
}
1126

1127
static const MemoryRegionOps mos6522_q800_via1_ops = {
1128
    .read = mos6522_q800_via1_read,
1129
    .write = mos6522_q800_via1_write,
1130
    .endianness = DEVICE_BIG_ENDIAN,
1131
    .valid = {
1132
        .min_access_size = 1,
1133
        .max_access_size = 4,
1134
    },
1135
};
1136

1137
static uint64_t mos6522_q800_via2_read(void *opaque, hwaddr addr, unsigned size)
1138
{
1139
    MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
1140
    MOS6522State *ms = MOS6522(s);
1141
    uint64_t val;
1142

1143
    addr = (addr >> 9) & 0xf;
1144
    val = mos6522_read(ms, addr, size);
1145

1146
    switch (addr) {
1147
    case VIA_REG_IFR:
1148
        /*
1149
         * On a Q800 an emulated VIA2 is integrated into the onboard logic. The
1150
         * expectation of most OSs is that the DRQ bit is live, rather than
1151
         * latched as it would be on a real VIA so do the same here.
1152
         *
1153
         * Note: DRQ is negative edge triggered
1154
         */
1155
        val &= ~VIA2_IRQ_SCSI_DATA;
1156
        val |= (~ms->last_irq_levels & VIA2_IRQ_SCSI_DATA);
1157
        break;
1158
    }
1159

1160
    return val;
1161
}
1162

1163
static void mos6522_q800_via2_write(void *opaque, hwaddr addr, uint64_t val,
1164
                                    unsigned size)
1165
{
1166
    MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
1167
    MOS6522State *ms = MOS6522(s);
1168

1169
    addr = (addr >> 9) & 0xf;
1170
    mos6522_write(ms, addr, val, size);
1171
}
1172

1173
static const MemoryRegionOps mos6522_q800_via2_ops = {
1174
    .read = mos6522_q800_via2_read,
1175
    .write = mos6522_q800_via2_write,
1176
    .endianness = DEVICE_BIG_ENDIAN,
1177
    .valid = {
1178
        .min_access_size = 1,
1179
        .max_access_size = 4,
1180
    },
1181
};
1182

1183
static void via1_postload_update_cb(void *opaque, bool running, RunState state)
1184
{
1185
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
1186

1187
    qemu_del_vm_change_state_handler(v1s->vmstate);
1188
    v1s->vmstate = NULL;
1189

1190
    pram_update(v1s);
1191
}
1192

1193
static int via1_post_load(void *opaque, int version_id)
1194
{
1195
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
1196

1197
    if (v1s->blk) {
1198
        v1s->vmstate = qemu_add_vm_change_state_handler(
1199
                           via1_postload_update_cb, v1s);
1200
    }
1201

1202
    return 0;
1203
}
1204

1205
/* VIA 1 */
1206
static void mos6522_q800_via1_reset_hold(Object *obj, ResetType type)
1207
{
1208
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj);
1209
    MOS6522State *ms = MOS6522(v1s);
1210
    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
1211
    ADBBusState *adb_bus = &v1s->adb_bus;
1212

1213
    if (mdc->parent_phases.hold) {
1214
        mdc->parent_phases.hold(obj, type);
1215
    }
1216

1217
    ms->timers[0].frequency = VIA_TIMER_FREQ;
1218
    ms->timers[1].frequency = VIA_TIMER_FREQ;
1219

1220
    ms->b = VIA1B_vADB_StateMask | VIA1B_vADBInt | VIA1B_vRTCEnb;
1221

1222
    /* ADB/RTC */
1223
    adb_set_autopoll_enabled(adb_bus, true);
1224
    v1s->cmd = REG_EMPTY;
1225
    v1s->alt = REG_EMPTY;
1226

1227
    /* Timer calibration hack */
1228
    v1s->timer_hack_state = 0;
1229
}
1230

1231
static void mos6522_q800_via1_realize(DeviceState *dev, Error **errp)
1232
{
1233
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(dev);
1234
    ADBBusState *adb_bus = &v1s->adb_bus;
1235
    struct tm tm;
1236
    int ret;
1237

1238
    v1s->one_second_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, via1_one_second,
1239
                                         v1s);
1240
    via1_one_second_update(v1s);
1241
    v1s->sixty_hz_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, via1_sixty_hz,
1242
                                       v1s);
1243
    via1_sixty_hz_update(v1s);
1244

1245
    qemu_get_timedate(&tm, 0);
1246
    v1s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
1247

1248
    adb_register_autopoll_callback(adb_bus, adb_via_poll, v1s);
1249
    v1s->adb_data_ready = qdev_get_gpio_in(dev, VIA1_IRQ_ADB_READY_BIT);
1250

1251
    if (v1s->blk) {
1252
        int64_t len = blk_getlength(v1s->blk);
1253
        if (len < 0) {
1254
            error_setg_errno(errp, -len,
1255
                             "could not get length of backing image");
1256
            return;
1257
        }
1258
        ret = blk_set_perm(v1s->blk,
1259
                           BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
1260
                           BLK_PERM_ALL, errp);
1261
        if (ret < 0) {
1262
            return;
1263
        }
1264

1265
        ret = blk_pread(v1s->blk, 0, sizeof(v1s->PRAM), v1s->PRAM, 0);
1266
        if (ret < 0) {
1267
            error_setg(errp, "can't read PRAM contents");
1268
            return;
1269
        }
1270
    }
1271
}
1272

1273
static void mos6522_q800_via1_init(Object *obj)
1274
{
1275
    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj);
1276
    SysBusDevice *sbd = SYS_BUS_DEVICE(v1s);
1277

1278
    memory_region_init_io(&v1s->via_mem, obj, &mos6522_q800_via1_ops, v1s,
1279
                          "via1", VIA_SIZE);
1280
    sysbus_init_mmio(sbd, &v1s->via_mem);
1281

1282
    /* ADB */
1283
    qbus_init((BusState *)&v1s->adb_bus, sizeof(v1s->adb_bus),
1284
              TYPE_ADB_BUS, DEVICE(v1s), "adb.0");
1285

1286
    /* A/UX mode */
1287
    qdev_init_gpio_out(DEVICE(obj), &v1s->auxmode_irq, 1);
1288
}
1289

1290
static const VMStateDescription vmstate_q800_via1 = {
1291
    .name = "q800-via1",
1292
    .version_id = 0,
1293
    .minimum_version_id = 0,
1294
    .post_load = via1_post_load,
1295
    .fields = (const VMStateField[]) {
1296
        VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA1State, 0, vmstate_mos6522,
1297
                       MOS6522State),
1298
        VMSTATE_UINT8(last_b, MOS6522Q800VIA1State),
1299
        /* RTC */
1300
        VMSTATE_BUFFER(PRAM, MOS6522Q800VIA1State),
1301
        VMSTATE_UINT32(tick_offset, MOS6522Q800VIA1State),
1302
        VMSTATE_UINT8(data_out, MOS6522Q800VIA1State),
1303
        VMSTATE_INT32(data_out_cnt, MOS6522Q800VIA1State),
1304
        VMSTATE_UINT8(data_in, MOS6522Q800VIA1State),
1305
        VMSTATE_UINT8(data_in_cnt, MOS6522Q800VIA1State),
1306
        VMSTATE_UINT8(cmd, MOS6522Q800VIA1State),
1307
        VMSTATE_INT32(wprotect, MOS6522Q800VIA1State),
1308
        VMSTATE_INT32(alt, MOS6522Q800VIA1State),
1309
        /* ADB */
1310
        VMSTATE_INT32(adb_data_in_size, MOS6522Q800VIA1State),
1311
        VMSTATE_INT32(adb_data_in_index, MOS6522Q800VIA1State),
1312
        VMSTATE_INT32(adb_data_out_index, MOS6522Q800VIA1State),
1313
        VMSTATE_BUFFER(adb_data_in, MOS6522Q800VIA1State),
1314
        VMSTATE_BUFFER(adb_data_out, MOS6522Q800VIA1State),
1315
        VMSTATE_UINT8(adb_autopoll_cmd, MOS6522Q800VIA1State),
1316
        /* Timers */
1317
        VMSTATE_TIMER_PTR(one_second_timer, MOS6522Q800VIA1State),
1318
        VMSTATE_INT64(next_second, MOS6522Q800VIA1State),
1319
        VMSTATE_TIMER_PTR(sixty_hz_timer, MOS6522Q800VIA1State),
1320
        VMSTATE_INT64(next_sixty_hz, MOS6522Q800VIA1State),
1321
        /* Timer hack */
1322
        VMSTATE_INT32(timer_hack_state, MOS6522Q800VIA1State),
1323
        VMSTATE_END_OF_LIST()
1324
    }
1325
};
1326

1327
static Property mos6522_q800_via1_properties[] = {
1328
    DEFINE_PROP_DRIVE("drive", MOS6522Q800VIA1State, blk),
1329
    DEFINE_PROP_END_OF_LIST(),
1330
};
1331

1332
static void mos6522_q800_via1_class_init(ObjectClass *oc, void *data)
1333
{
1334
    DeviceClass *dc = DEVICE_CLASS(oc);
1335
    ResettableClass *rc = RESETTABLE_CLASS(oc);
1336
    MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
1337

1338
    dc->realize = mos6522_q800_via1_realize;
1339
    resettable_class_set_parent_phases(rc, NULL, mos6522_q800_via1_reset_hold,
1340
                                       NULL, &mdc->parent_phases);
1341
    dc->vmsd = &vmstate_q800_via1;
1342
    device_class_set_props(dc, mos6522_q800_via1_properties);
1343
}
1344

1345
static const TypeInfo mos6522_q800_via1_type_info = {
1346
    .name = TYPE_MOS6522_Q800_VIA1,
1347
    .parent = TYPE_MOS6522,
1348
    .instance_size = sizeof(MOS6522Q800VIA1State),
1349
    .instance_init = mos6522_q800_via1_init,
1350
    .class_init = mos6522_q800_via1_class_init,
1351
};
1352

1353
/* VIA 2 */
1354
static void mos6522_q800_via2_portB_write(MOS6522State *s)
1355
{
1356
    if (s->dirb & VIA2B_vPower && (s->b & VIA2B_vPower) == 0) {
1357
        /* shutdown */
1358
        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
1359
    }
1360
}
1361

1362
static void mos6522_q800_via2_reset_hold(Object *obj, ResetType type)
1363
{
1364
    MOS6522State *ms = MOS6522(obj);
1365
    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
1366

1367
    if (mdc->parent_phases.hold) {
1368
        mdc->parent_phases.hold(obj, type);
1369
    }
1370

1371
    ms->timers[0].frequency = VIA_TIMER_FREQ;
1372
    ms->timers[1].frequency = VIA_TIMER_FREQ;
1373

1374
    ms->dirb = 0;
1375
    ms->b = 0;
1376
    ms->dira = 0;
1377
    ms->a = 0x7f;
1378
}
1379

1380
static void via2_nubus_irq_request(void *opaque, int n, int level)
1381
{
1382
    MOS6522Q800VIA2State *v2s = opaque;
1383
    MOS6522State *s = MOS6522(v2s);
1384
    qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA2_IRQ_NUBUS_BIT);
1385

1386
    if (level) {
1387
        /* Port A nubus IRQ inputs are active LOW */
1388
        s->a &= ~(1 << n);
1389
    } else {
1390
        s->a |= (1 << n);
1391
    }
1392

1393
    /* Negative edge trigger */
1394
    qemu_set_irq(irq, !level);
1395
}
1396

1397
static void mos6522_q800_via2_init(Object *obj)
1398
{
1399
    MOS6522Q800VIA2State *v2s = MOS6522_Q800_VIA2(obj);
1400
    SysBusDevice *sbd = SYS_BUS_DEVICE(v2s);
1401

1402
    memory_region_init_io(&v2s->via_mem, obj, &mos6522_q800_via2_ops, v2s,
1403
                          "via2", VIA_SIZE);
1404
    sysbus_init_mmio(sbd, &v2s->via_mem);
1405

1406
    qdev_init_gpio_in_named(DEVICE(obj), via2_nubus_irq_request, "nubus-irq",
1407
                            VIA2_NUBUS_IRQ_NB);
1408
}
1409

1410
static const VMStateDescription vmstate_q800_via2 = {
1411
    .name = "q800-via2",
1412
    .version_id = 0,
1413
    .minimum_version_id = 0,
1414
    .fields = (const VMStateField[]) {
1415
        VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA2State, 0, vmstate_mos6522,
1416
                       MOS6522State),
1417
        VMSTATE_END_OF_LIST()
1418
    }
1419
};
1420

1421
static void mos6522_q800_via2_class_init(ObjectClass *oc, void *data)
1422
{
1423
    DeviceClass *dc = DEVICE_CLASS(oc);
1424
    ResettableClass *rc = RESETTABLE_CLASS(oc);
1425
    MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
1426

1427
    resettable_class_set_parent_phases(rc, NULL, mos6522_q800_via2_reset_hold,
1428
                                       NULL, &mdc->parent_phases);
1429
    dc->vmsd = &vmstate_q800_via2;
1430
    mdc->portB_write = mos6522_q800_via2_portB_write;
1431
}
1432

1433
static const TypeInfo mos6522_q800_via2_type_info = {
1434
    .name = TYPE_MOS6522_Q800_VIA2,
1435
    .parent = TYPE_MOS6522,
1436
    .instance_size = sizeof(MOS6522Q800VIA2State),
1437
    .instance_init = mos6522_q800_via2_init,
1438
    .class_init = mos6522_q800_via2_class_init,
1439
};
1440

1441
static void mac_via_register_types(void)
1442
{
1443
    type_register_static(&mos6522_q800_via1_type_info);
1444
    type_register_static(&mos6522_q800_via2_type_info);
1445
}
1446

1447
type_init(mac_via_register_types);
1448