1 /*
2 * QEMU m68k Macintosh VIA device support
3 *
4 * Copyright (c) 2011-2018 Laurent Vivier
5 * Copyright (c) 2018 Mark Cave-Ayland
6 *
7 * Some parts from hw/misc/macio/cuda.c
8 *
9 * Copyright (c) 2004-2007 Fabrice Bellard
10 * Copyright (c) 2007 Jocelyn Mayer
11 *
12 * some parts from linux-2.6.29, arch/m68k/include/asm/mac_via.h
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2 or later.
15 * See the COPYING file in the top-level directory.
16 */
17
18 #include "qemu/osdep.h"
19 #include "exec/address-spaces.h"
20 #include "migration/vmstate.h"
21 #include "hw/sysbus.h"
22 #include "hw/irq.h"
23 #include "qemu/timer.h"
24 #include "hw/misc/mac_via.h"
25 #include "hw/misc/mos6522.h"
26 #include "hw/input/adb.h"
27 #include "sysemu/runstate.h"
28 #include "qapi/error.h"
29 #include "qemu/cutils.h"
30 #include "hw/qdev-properties.h"
31 #include "hw/qdev-properties-system.h"
32 #include "sysemu/block-backend.h"
33 #include "sysemu/rtc.h"
34 #include "trace.h"
35 #include "qemu/log.h"
36
37 /*
38 * VIAs: There are two in every machine
39 */
40
41 /*
42 * Not all of these are true post MacII I think.
43 * CSA: probably the ones CHRP marks as 'unused' change purposes
44 * when the IWM becomes the SWIM.
45 * http://www.rs6000.ibm.com/resource/technology/chrpio/via5.mak.html
46 * ftp://ftp.austin.ibm.com/pub/technology/spec/chrp/inwork/CHRP_IORef_1.0.pdf
47 *
48 * also, http://developer.apple.com/technotes/hw/hw_09.html claims the
49 * following changes for IIfx:
50 * VIA1A_vSccWrReq not available and that VIA1A_vSync has moved to an IOP.
51 * Also, "All of the functionality of VIA2 has been moved to other chips".
52 */
53
54 #define VIA1A_vSccWrReq 0x80 /*
55 * SCC write. (input)
56 * [CHRP] SCC WREQ: Reflects the state of the
57 * Wait/Request pins from the SCC.
58 * [Macintosh Family Hardware]
59 * as CHRP on SE/30,II,IIx,IIcx,IIci.
60 * on IIfx, "0 means an active request"
61 */
62 #define VIA1A_vRev8 0x40 /*
63 * Revision 8 board ???
64 * [CHRP] En WaitReqB: Lets the WaitReq_L
65 * signal from port B of the SCC appear on
66 * the PA7 input pin. Output.
67 * [Macintosh Family] On the SE/30, this
68 * is the bit to flip screen buffers.
69 * 0=alternate, 1=main.
70 * on II,IIx,IIcx,IIci,IIfx this is a bit
71 * for Rev ID. 0=II,IIx, 1=IIcx,IIci,IIfx
72 */
73 #define VIA1A_vHeadSel 0x20 /*
74 * Head select for IWM.
75 * [CHRP] unused.
76 * [Macintosh Family] "Floppy disk
77 * state-control line SEL" on all but IIfx
78 */
79 #define VIA1A_vOverlay 0x10 /*
80 * [Macintosh Family] On SE/30,II,IIx,IIcx
81 * this bit enables the "Overlay" address
82 * map in the address decoders as it is on
83 * reset for mapping the ROM over the reset
84 * vector. 1=use overlay map.
85 * On the IIci,IIfx it is another bit of the
86 * CPU ID: 0=normal IIci, 1=IIci with parity
87 * feature or IIfx.
88 * [CHRP] En WaitReqA: Lets the WaitReq_L
89 * signal from port A of the SCC appear
90 * on the PA7 input pin (CHRP). Output.
91 * [MkLinux] "Drive Select"
92 * (with 0x20 being 'disk head select')
93 */
94 #define VIA1A_vSync 0x08 /*
95 * [CHRP] Sync Modem: modem clock select:
96 * 1: select the external serial clock to
97 * drive the SCC's /RTxCA pin.
98 * 0: Select the 3.6864MHz clock to drive
99 * the SCC cell.
100 * [Macintosh Family] Correct on all but IIfx
101 */
102
103 /*
104 * Macintosh Family Hardware sez: bits 0-2 of VIA1A are volume control
105 * on Macs which had the PWM sound hardware. Reserved on newer models.
106 * On IIci,IIfx, bits 1-2 are the rest of the CPU ID:
107 * bit 2: 1=IIci, 0=IIfx
108 * bit 1: 1 on both IIci and IIfx.
109 * MkLinux sez bit 0 is 'burnin flag' in this case.
110 * CHRP sez: VIA1A bits 0-2 and 5 are 'unused': if programmed as
111 * inputs, these bits will read 0.
112 */
113 #define VIA1A_vVolume 0x07 /* Audio volume mask for PWM */
114 #define VIA1A_CPUID0 0x02 /* CPU id bit 0 on RBV, others */
115 #define VIA1A_CPUID1 0x04 /* CPU id bit 0 on RBV, others */
116 #define VIA1A_CPUID2 0x10 /* CPU id bit 0 on RBV, others */
117 #define VIA1A_CPUID3 0x40 /* CPU id bit 0 on RBV, others */
118 #define VIA1A_CPUID_MASK (VIA1A_CPUID0 | VIA1A_CPUID1 | \
119 VIA1A_CPUID2 | VIA1A_CPUID3)
120 #define VIA1A_CPUID_Q800 (VIA1A_CPUID0 | VIA1A_CPUID2)
121
122 /*
123 * Info on VIA1B is from Macintosh Family Hardware & MkLinux.
124 * CHRP offers no info.
125 */
126 #define VIA1B_vSound 0x80 /*
127 * Sound enable (for compatibility with
128 * PWM hardware) 0=enabled.
129 * Also, on IIci w/parity, shows parity error
130 * 0=error, 1=OK.
131 */
132 #define VIA1B_vMystery 0x40 /*
133 * On IIci, parity enable. 0=enabled,1=disabled
134 * On SE/30, vertical sync interrupt enable.
135 * 0=enabled. This vSync interrupt shows up
136 * as a slot $E interrupt.
137 * On Quadra 800 this bit toggles A/UX mode which
138 * configures the glue logic to deliver some IRQs
139 * at different levels compared to a classic
140 * Mac.
141 */
142 #define VIA1B_vADBS2 0x20 /* ADB state input bit 1 (unused on IIfx) */
143 #define VIA1B_vADBS1 0x10 /* ADB state input bit 0 (unused on IIfx) */
144 #define VIA1B_vADBInt 0x08 /* ADB interrupt 0=interrupt (unused on IIfx)*/
145 #define VIA1B_vRTCEnb 0x04 /* Enable Real time clock. 0=enabled. */
146 #define VIA1B_vRTCClk 0x02 /* Real time clock serial-clock line. */
147 #define VIA1B_vRTCData 0x01 /* Real time clock serial-data line. */
148
149 /*
150 * VIA2 A register is the interrupt lines raised off the nubus
151 * slots.
152 * The below info is from 'Macintosh Family Hardware.'
153 * MkLinux calls the 'IIci internal video IRQ' below the 'RBV slot 0 irq.'
154 * It also notes that the slot $9 IRQ is the 'Ethernet IRQ' and
155 * defines the 'Video IRQ' as 0x40 for the 'EVR' VIA work-alike.
156 * Perhaps OSS uses vRAM1 and vRAM2 for ADB.
157 */
158
159 #define VIA2A_vRAM1 0x80 /* RAM size bit 1 (IIci: reserved) */
160 #define VIA2A_vRAM0 0x40 /* RAM size bit 0 (IIci: internal video IRQ) */
161 #define VIA2A_vIRQE 0x20 /* IRQ from slot $E */
162 #define VIA2A_vIRQD 0x10 /* IRQ from slot $D */
163 #define VIA2A_vIRQC 0x08 /* IRQ from slot $C */
164 #define VIA2A_vIRQB 0x04 /* IRQ from slot $B */
165 #define VIA2A_vIRQA 0x02 /* IRQ from slot $A */
166 #define VIA2A_vIRQ9 0x01 /* IRQ from slot $9 */
167
168 /*
169 * RAM size bits decoded as follows:
170 * bit1 bit0 size of ICs in bank A
171 * 0 0 256 kbit
172 * 0 1 1 Mbit
173 * 1 0 4 Mbit
174 * 1 1 16 Mbit
175 */
176
177 /*
178 * Register B has the fun stuff in it
179 */
180
181 #define VIA2B_vVBL 0x80 /*
182 * VBL output to VIA1 (60.15Hz) driven by
183 * timer T1.
184 * on IIci, parity test: 0=test mode.
185 * [MkLinux] RBV_PARODD: 1=odd,0=even.
186 */
187 #define VIA2B_vSndJck 0x40 /*
188 * External sound jack status.
189 * 0=plug is inserted. On SE/30, always 0
190 */
191 #define VIA2B_vTfr0 0x20 /* Transfer mode bit 0 ack from NuBus */
192 #define VIA2B_vTfr1 0x10 /* Transfer mode bit 1 ack from NuBus */
193 #define VIA2B_vMode32 0x08 /*
194 * 24/32bit switch - doubles as cache flush
195 * on II, AMU/PMMU control.
196 * if AMU, 0=24bit to 32bit translation
197 * if PMMU, 1=PMMU is accessing page table.
198 * on SE/30 tied low.
199 * on IIx,IIcx,IIfx, unused.
200 * on IIci/RBV, cache control. 0=flush cache.
201 */
202 #define VIA2B_vPower 0x04 /*
203 * Power off, 0=shut off power.
204 * on SE/30 this signal sent to PDS card.
205 */
206 #define VIA2B_vBusLk 0x02 /*
207 * Lock NuBus transactions, 0=locked.
208 * on SE/30 sent to PDS card.
209 */
210 #define VIA2B_vCDis 0x01 /*
211 * Cache control. On IIci, 1=disable cache card
212 * on others, 0=disable processor's instruction
213 * and data caches.
214 */
215
216 /* interrupt flags */
217
218 #define IRQ_SET 0x80
219
220 /* common */
221
222 #define VIA_IRQ_TIMER1 0x40
223 #define VIA_IRQ_TIMER2 0x20
224
225 /*
226 * Apple sez: http://developer.apple.com/technotes/ov/ov_04.html
227 * Another example of a valid function that has no ROM support is the use
228 * of the alternate video page for page-flipping animation. Since there
229 * is no ROM call to flip pages, it is necessary to go play with the
230 * right bit in the VIA chip (6522 Versatile Interface Adapter).
231 * [CSA: don't know which one this is, but it's one of 'em!]
232 */
233
234 /*
235 * 6522 registers - see databook.
236 * CSA: Assignments for VIA1 confirmed from CHRP spec.
237 */
238
239 /* partial address decode. 0xYYXX : XX part for RBV, YY part for VIA */
240 /* Note: 15 VIA regs, 8 RBV regs */
241
242 #define vBufB 0x0000 /* [VIA/RBV] Register B */
243 #define vBufAH 0x0200 /* [VIA only] Buffer A, with handshake. DON'T USE! */
244 #define vDirB 0x0400 /* [VIA only] Data Direction Register B. */
245 #define vDirA 0x0600 /* [VIA only] Data Direction Register A. */
246 #define vT1CL 0x0800 /* [VIA only] Timer one counter low. */
247 #define vT1CH 0x0a00 /* [VIA only] Timer one counter high. */
248 #define vT1LL 0x0c00 /* [VIA only] Timer one latches low. */
249 #define vT1LH 0x0e00 /* [VIA only] Timer one latches high. */
250 #define vT2CL 0x1000 /* [VIA only] Timer two counter low. */
251 #define vT2CH 0x1200 /* [VIA only] Timer two counter high. */
252 #define vSR 0x1400 /* [VIA only] Shift register. */
253 #define vACR 0x1600 /* [VIA only] Auxiliary control register. */
254 #define vPCR 0x1800 /* [VIA only] Peripheral control register. */
255 /*
256 * CHRP sez never ever to *write* this.
257 * Mac family says never to *change* this.
258 * In fact we need to initialize it once at start.
259 */
260 #define vIFR 0x1a00 /* [VIA/RBV] Interrupt flag register. */
261 #define vIER 0x1c00 /* [VIA/RBV] Interrupt enable register. */
262 #define vBufA 0x1e00 /* [VIA/RBV] register A (no handshake) */
263
264 /* from linux 2.6 drivers/macintosh/via-macii.c */
265
266 /* Bits in ACR */
267
268 #define VIA1ACR_vShiftCtrl 0x1c /* Shift register control bits */
269 #define VIA1ACR_vShiftExtClk 0x0c /* Shift on external clock */
270 #define VIA1ACR_vShiftOut 0x10 /* Shift out if 1 */
271
272 /*
273 * Apple Macintosh Family Hardware Refenece
274 * Table 19-10 ADB transaction states
275 */
276
277 #define ADB_STATE_NEW 0
278 #define ADB_STATE_EVEN 1
279 #define ADB_STATE_ODD 2
280 #define ADB_STATE_IDLE 3
281
282 #define VIA1B_vADB_StateMask (VIA1B_vADBS1 | VIA1B_vADBS2)
283 #define VIA1B_vADB_StateShift 4
284
285 #define VIA_TIMER_FREQ (783360)
286 #define VIA_ADB_POLL_FREQ 50 /* XXX: not real */
287
288 /*
289 * Guide to the Macintosh Family Hardware ch. 12 "Displays" p. 401 gives the
290 * precise 60Hz interrupt frequency as ~60.15Hz with a period of 16625.8 us
291 */
292 #define VIA_60HZ_TIMER_PERIOD_NS 16625800
293
294 /* VIA returns time offset from Jan 1, 1904, not 1970 */
295 #define RTC_OFFSET 2082844800
296
297 enum {
298 REG_0,
299 REG_1,
300 REG_2,
301 REG_3,
302 REG_TEST,
303 REG_WPROTECT,
304 REG_PRAM_ADDR,
305 REG_PRAM_ADDR_LAST = REG_PRAM_ADDR + 19,
306 REG_PRAM_SECT,
307 REG_PRAM_SECT_LAST = REG_PRAM_SECT + 7,
308 REG_INVALID,
309 REG_EMPTY = 0xff,
310 };
311
via1_sixty_hz_update(MOS6522Q800VIA1State * v1s)312 static void via1_sixty_hz_update(MOS6522Q800VIA1State *v1s)
313 {
314 /* 60 Hz irq */
315 v1s->next_sixty_hz = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
316 VIA_60HZ_TIMER_PERIOD_NS) /
317 VIA_60HZ_TIMER_PERIOD_NS * VIA_60HZ_TIMER_PERIOD_NS;
318 timer_mod(v1s->sixty_hz_timer, v1s->next_sixty_hz);
319 }
320
via1_one_second_update(MOS6522Q800VIA1State * v1s)321 static void via1_one_second_update(MOS6522Q800VIA1State *v1s)
322 {
323 v1s->next_second = (qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000) /
324 1000 * 1000;
325 timer_mod(v1s->one_second_timer, v1s->next_second);
326 }
327
via1_sixty_hz(void * opaque)328 static void via1_sixty_hz(void *opaque)
329 {
330 MOS6522Q800VIA1State *v1s = opaque;
331 MOS6522State *s = MOS6522(v1s);
332 qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA1_IRQ_60HZ_BIT);
333
334 /* Negative edge trigger */
335 qemu_irq_lower(irq);
336 qemu_irq_raise(irq);
337
338 via1_sixty_hz_update(v1s);
339 }
340
via1_one_second(void * opaque)341 static void via1_one_second(void *opaque)
342 {
343 MOS6522Q800VIA1State *v1s = opaque;
344 MOS6522State *s = MOS6522(v1s);
345 qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA1_IRQ_ONE_SECOND_BIT);
346
347 /* Negative edge trigger */
348 qemu_irq_lower(irq);
349 qemu_irq_raise(irq);
350
351 via1_one_second_update(v1s);
352 }
353
354
pram_update(MOS6522Q800VIA1State * v1s)355 static void pram_update(MOS6522Q800VIA1State *v1s)
356 {
357 if (v1s->blk) {
358 if (blk_pwrite(v1s->blk, 0, sizeof(v1s->PRAM), v1s->PRAM, 0) < 0) {
359 qemu_log("pram_update: cannot write to file\n");
360 }
361 }
362 }
363
364 /*
365 * RTC Commands
366 *
367 * Command byte Register addressed by the command
368 *
369 * z00x0001 Seconds register 0 (lowest-order byte)
370 * z00x0101 Seconds register 1
371 * z00x1001 Seconds register 2
372 * z00x1101 Seconds register 3 (highest-order byte)
373 * 00110001 Test register (write-only)
374 * 00110101 Write-Protect Register (write-only)
375 * z010aa01 RAM address 100aa ($10-$13) (first 20 bytes only)
376 * z1aaaa01 RAM address 0aaaa ($00-$0F) (first 20 bytes only)
377 * z0111aaa Extended memory designator and sector number
378 *
379 * For a read request, z=1, for a write z=0
380 * The letter x indicates don't care
381 * The letter a indicates bits whose value depend on what parameter
382 * RAM byte you want to address
383 */
via1_rtc_compact_cmd(uint8_t value)384 static int via1_rtc_compact_cmd(uint8_t value)
385 {
386 uint8_t read = value & 0x80;
387
388 value &= 0x7f;
389
390 /* the last 2 bits of a command byte must always be 0b01 ... */
391 if ((value & 0x78) == 0x38) {
392 /* except for the extended memory designator */
393 return read | (REG_PRAM_SECT + (value & 0x07));
394 }
395 if ((value & 0x03) == 0x01) {
396 value >>= 2;
397 if ((value & 0x18) == 0) {
398 /* seconds registers */
399 return read | (REG_0 + (value & 0x03));
400 } else if ((value == 0x0c) && !read) {
401 return REG_TEST;
402 } else if ((value == 0x0d) && !read) {
403 return REG_WPROTECT;
404 } else if ((value & 0x1c) == 0x08) {
405 /* RAM address 0x10 to 0x13 */
406 return read | (REG_PRAM_ADDR + 0x10 + (value & 0x03));
407 } else if ((value & 0x10) == 0x10) {
408 /* RAM address 0x00 to 0x0f */
409 return read | (REG_PRAM_ADDR + (value & 0x0f));
410 }
411 }
412 return REG_INVALID;
413 }
414
via1_rtc_update(MOS6522Q800VIA1State * v1s)415 static void via1_rtc_update(MOS6522Q800VIA1State *v1s)
416 {
417 MOS6522State *s = MOS6522(v1s);
418 int cmd, sector, addr;
419 uint32_t time;
420
421 if (s->b & VIA1B_vRTCEnb) {
422 return;
423 }
424
425 if (s->dirb & VIA1B_vRTCData) {
426 /* send bits to the RTC */
427 if (!(v1s->last_b & VIA1B_vRTCClk) && (s->b & VIA1B_vRTCClk)) {
428 v1s->data_out <<= 1;
429 v1s->data_out |= s->b & VIA1B_vRTCData;
430 v1s->data_out_cnt++;
431 }
432 trace_via1_rtc_update_data_out(v1s->data_out_cnt, v1s->data_out);
433 } else {
434 trace_via1_rtc_update_data_in(v1s->data_in_cnt, v1s->data_in);
435 /* receive bits from the RTC */
436 if ((v1s->last_b & VIA1B_vRTCClk) &&
437 !(s->b & VIA1B_vRTCClk) &&
438 v1s->data_in_cnt) {
439 s->b = (s->b & ~VIA1B_vRTCData) |
440 ((v1s->data_in >> 7) & VIA1B_vRTCData);
441 v1s->data_in <<= 1;
442 v1s->data_in_cnt--;
443 }
444 return;
445 }
446
447 if (v1s->data_out_cnt != 8) {
448 return;
449 }
450
451 v1s->data_out_cnt = 0;
452
453 trace_via1_rtc_internal_status(v1s->cmd, v1s->alt, v1s->data_out);
454 /* first byte: it's a command */
455 if (v1s->cmd == REG_EMPTY) {
456
457 cmd = via1_rtc_compact_cmd(v1s->data_out);
458 trace_via1_rtc_internal_cmd(cmd);
459
460 if (cmd == REG_INVALID) {
461 trace_via1_rtc_cmd_invalid(v1s->data_out);
462 return;
463 }
464
465 if (cmd & 0x80) { /* this is a read command */
466 switch (cmd & 0x7f) {
467 case REG_0...REG_3: /* seconds registers */
468 /*
469 * register 0 is lowest-order byte
470 * register 3 is highest-order byte
471 */
472
473 time = v1s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
474 / NANOSECONDS_PER_SECOND);
475 trace_via1_rtc_internal_time(time);
476 v1s->data_in = (time >> ((cmd & 0x03) << 3)) & 0xff;
477 v1s->data_in_cnt = 8;
478 trace_via1_rtc_cmd_seconds_read((cmd & 0x7f) - REG_0,
479 v1s->data_in);
480 break;
481 case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
482 /* PRAM address 0x00 -> 0x13 */
483 v1s->data_in = v1s->PRAM[(cmd & 0x7f) - REG_PRAM_ADDR];
484 v1s->data_in_cnt = 8;
485 trace_via1_rtc_cmd_pram_read((cmd & 0x7f) - REG_PRAM_ADDR,
486 v1s->data_in);
487 break;
488 case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
489 /*
490 * extended memory designator and sector number
491 * the only two-byte read command
492 */
493 trace_via1_rtc_internal_set_cmd(cmd);
494 v1s->cmd = cmd;
495 break;
496 default:
497 g_assert_not_reached();
498 break;
499 }
500 return;
501 }
502
503 /* this is a write command, needs a parameter */
504 if (cmd == REG_WPROTECT || !v1s->wprotect) {
505 trace_via1_rtc_internal_set_cmd(cmd);
506 v1s->cmd = cmd;
507 } else {
508 trace_via1_rtc_internal_ignore_cmd(cmd);
509 }
510 return;
511 }
512
513 /* second byte: it's a parameter */
514 if (v1s->alt == REG_EMPTY) {
515 switch (v1s->cmd & 0x7f) {
516 case REG_0...REG_3: /* seconds register */
517 /* FIXME */
518 trace_via1_rtc_cmd_seconds_write(v1s->cmd - REG_0, v1s->data_out);
519 v1s->cmd = REG_EMPTY;
520 break;
521 case REG_TEST:
522 /* device control: nothing to do */
523 trace_via1_rtc_cmd_test_write(v1s->data_out);
524 v1s->cmd = REG_EMPTY;
525 break;
526 case REG_WPROTECT:
527 /* Write Protect register */
528 trace_via1_rtc_cmd_wprotect_write(v1s->data_out);
529 v1s->wprotect = !!(v1s->data_out & 0x80);
530 v1s->cmd = REG_EMPTY;
531 break;
532 case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
533 /* PRAM address 0x00 -> 0x13 */
534 trace_via1_rtc_cmd_pram_write(v1s->cmd - REG_PRAM_ADDR,
535 v1s->data_out);
536 v1s->PRAM[v1s->cmd - REG_PRAM_ADDR] = v1s->data_out;
537 pram_update(v1s);
538 v1s->cmd = REG_EMPTY;
539 break;
540 case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
541 addr = (v1s->data_out >> 2) & 0x1f;
542 sector = (v1s->cmd & 0x7f) - REG_PRAM_SECT;
543 if (v1s->cmd & 0x80) {
544 /* it's a read */
545 v1s->data_in = v1s->PRAM[sector * 32 + addr];
546 v1s->data_in_cnt = 8;
547 trace_via1_rtc_cmd_pram_sect_read(sector, addr,
548 sector * 32 + addr,
549 v1s->data_in);
550 v1s->cmd = REG_EMPTY;
551 } else {
552 /* it's a write, we need one more parameter */
553 trace_via1_rtc_internal_set_alt(addr, sector, addr);
554 v1s->alt = addr;
555 }
556 break;
557 default:
558 g_assert_not_reached();
559 break;
560 }
561 return;
562 }
563
564 /* third byte: it's the data of a REG_PRAM_SECT write */
565 g_assert(REG_PRAM_SECT <= v1s->cmd && v1s->cmd <= REG_PRAM_SECT_LAST);
566 sector = v1s->cmd - REG_PRAM_SECT;
567 v1s->PRAM[sector * 32 + v1s->alt] = v1s->data_out;
568 pram_update(v1s);
569 trace_via1_rtc_cmd_pram_sect_write(sector, v1s->alt, sector * 32 + v1s->alt,
570 v1s->data_out);
571 v1s->alt = REG_EMPTY;
572 v1s->cmd = REG_EMPTY;
573 }
574
adb_via_poll(void * opaque)575 static void adb_via_poll(void *opaque)
576 {
577 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
578 MOS6522State *s = MOS6522(v1s);
579 ADBBusState *adb_bus = &v1s->adb_bus;
580 uint8_t obuf[9];
581 uint8_t *data = &s->sr;
582 int olen;
583
584 /*
585 * Setting vADBInt below indicates that an autopoll reply has been
586 * received, however we must block autopoll until the point where
587 * the entire reply has been read back to the host
588 */
589 adb_autopoll_block(adb_bus);
590
591 if (v1s->adb_data_in_size > 0 && v1s->adb_data_in_index == 0) {
592 /*
593 * For older Linux kernels that switch to IDLE mode after sending the
594 * ADB command, detect if there is an existing response and return that
595 * as a "fake" autopoll reply or bus timeout accordingly
596 */
597 *data = v1s->adb_data_out[0];
598 olen = v1s->adb_data_in_size;
599
600 s->b &= ~VIA1B_vADBInt;
601 qemu_irq_raise(v1s->adb_data_ready);
602 } else {
603 /*
604 * Otherwise poll as normal
605 */
606 v1s->adb_data_in_index = 0;
607 v1s->adb_data_out_index = 0;
608 olen = adb_poll(adb_bus, obuf, adb_bus->autopoll_mask);
609
610 if (olen > 0) {
611 /* Autopoll response */
612 *data = obuf[0];
613 olen--;
614 memcpy(v1s->adb_data_in, &obuf[1], olen);
615 v1s->adb_data_in_size = olen;
616
617 s->b &= ~VIA1B_vADBInt;
618 qemu_irq_raise(v1s->adb_data_ready);
619 } else {
620 *data = v1s->adb_autopoll_cmd;
621 obuf[0] = 0xff;
622 obuf[1] = 0xff;
623 olen = 2;
624
625 memcpy(v1s->adb_data_in, obuf, olen);
626 v1s->adb_data_in_size = olen;
627
628 s->b &= ~VIA1B_vADBInt;
629 qemu_irq_raise(v1s->adb_data_ready);
630 }
631 }
632
633 trace_via1_adb_poll(*data, (s->b & VIA1B_vADBInt) ? "+" : "-",
634 adb_bus->status, v1s->adb_data_in_index, olen);
635 }
636
adb_via_send_len(uint8_t data)637 static int adb_via_send_len(uint8_t data)
638 {
639 /* Determine the send length from the given ADB command */
640 uint8_t cmd = data & 0xc;
641 uint8_t reg = data & 0x3;
642
643 switch (cmd) {
644 case 0x8:
645 /* Listen command */
646 switch (reg) {
647 case 2:
648 /* Register 2 is only used for the keyboard */
649 return 3;
650 case 3:
651 /*
652 * Fortunately our devices only implement writes
653 * to register 3 which is fixed at 2 bytes
654 */
655 return 3;
656 default:
657 qemu_log_mask(LOG_UNIMP, "ADB unknown length for register %d\n",
658 reg);
659 return 1;
660 }
661 default:
662 /* Talk, BusReset */
663 return 1;
664 }
665 }
666
adb_via_send(MOS6522Q800VIA1State * v1s,int state,uint8_t data)667 static void adb_via_send(MOS6522Q800VIA1State *v1s, int state, uint8_t data)
668 {
669 MOS6522State *ms = MOS6522(v1s);
670 ADBBusState *adb_bus = &v1s->adb_bus;
671 uint16_t autopoll_mask;
672
673 switch (state) {
674 case ADB_STATE_NEW:
675 /*
676 * Command byte: vADBInt tells host autopoll data already present
677 * in VIA shift register and ADB transceiver
678 */
679 adb_autopoll_block(adb_bus);
680
681 if (adb_bus->status & ADB_STATUS_POLLREPLY) {
682 /* Tell the host the existing data is from autopoll */
683 ms->b &= ~VIA1B_vADBInt;
684 } else {
685 ms->b |= VIA1B_vADBInt;
686 v1s->adb_data_out_index = 0;
687 v1s->adb_data_out[v1s->adb_data_out_index++] = data;
688 }
689
690 trace_via1_adb_send(" NEW", data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
691 qemu_irq_raise(v1s->adb_data_ready);
692 break;
693
694 case ADB_STATE_EVEN:
695 case ADB_STATE_ODD:
696 ms->b |= VIA1B_vADBInt;
697 v1s->adb_data_out[v1s->adb_data_out_index++] = data;
698
699 trace_via1_adb_send(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
700 data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
701 qemu_irq_raise(v1s->adb_data_ready);
702 break;
703
704 case ADB_STATE_IDLE:
705 ms->b |= VIA1B_vADBInt;
706 adb_autopoll_unblock(adb_bus);
707
708 trace_via1_adb_send("IDLE", data,
709 (ms->b & VIA1B_vADBInt) ? "+" : "-");
710
711 return;
712 }
713
714 /* If the command is complete, execute it */
715 if (v1s->adb_data_out_index == adb_via_send_len(v1s->adb_data_out[0])) {
716 v1s->adb_data_in_size = adb_request(adb_bus, v1s->adb_data_in,
717 v1s->adb_data_out,
718 v1s->adb_data_out_index);
719 v1s->adb_data_in_index = 0;
720
721 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
722 /*
723 * Bus timeout (but allow first EVEN and ODD byte to indicate
724 * timeout via vADBInt and SRQ status)
725 */
726 v1s->adb_data_in[0] = 0xff;
727 v1s->adb_data_in[1] = 0xff;
728 v1s->adb_data_in_size = 2;
729 }
730
731 /*
732 * If last command is TALK, store it for use by autopoll and adjust
733 * the autopoll mask accordingly
734 */
735 if ((v1s->adb_data_out[0] & 0xc) == 0xc) {
736 v1s->adb_autopoll_cmd = v1s->adb_data_out[0];
737
738 autopoll_mask = 1 << (v1s->adb_autopoll_cmd >> 4);
739 adb_set_autopoll_mask(adb_bus, autopoll_mask);
740 }
741 }
742 }
743
adb_via_receive(MOS6522Q800VIA1State * v1s,int state,uint8_t * data)744 static void adb_via_receive(MOS6522Q800VIA1State *v1s, int state, uint8_t *data)
745 {
746 MOS6522State *ms = MOS6522(v1s);
747 ADBBusState *adb_bus = &v1s->adb_bus;
748 uint16_t pending;
749
750 switch (state) {
751 case ADB_STATE_NEW:
752 ms->b |= VIA1B_vADBInt;
753 return;
754
755 case ADB_STATE_IDLE:
756 ms->b |= VIA1B_vADBInt;
757 adb_autopoll_unblock(adb_bus);
758
759 trace_via1_adb_receive("IDLE", *data,
760 (ms->b & VIA1B_vADBInt) ? "+" : "-", adb_bus->status,
761 v1s->adb_data_in_index, v1s->adb_data_in_size);
762
763 break;
764
765 case ADB_STATE_EVEN:
766 case ADB_STATE_ODD:
767 switch (v1s->adb_data_in_index) {
768 case 0:
769 /* First EVEN byte: vADBInt indicates bus timeout */
770 *data = v1s->adb_data_in[v1s->adb_data_in_index];
771 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
772 ms->b &= ~VIA1B_vADBInt;
773 } else {
774 ms->b |= VIA1B_vADBInt;
775 }
776
777 trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
778 *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
779 adb_bus->status, v1s->adb_data_in_index,
780 v1s->adb_data_in_size);
781
782 v1s->adb_data_in_index++;
783 break;
784
785 case 1:
786 /* First ODD byte: vADBInt indicates SRQ */
787 *data = v1s->adb_data_in[v1s->adb_data_in_index];
788 pending = adb_bus->pending & ~(1 << (v1s->adb_autopoll_cmd >> 4));
789 if (pending) {
790 ms->b &= ~VIA1B_vADBInt;
791 } else {
792 ms->b |= VIA1B_vADBInt;
793 }
794
795 trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
796 *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
797 adb_bus->status, v1s->adb_data_in_index,
798 v1s->adb_data_in_size);
799
800 v1s->adb_data_in_index++;
801 break;
802
803 default:
804 /*
805 * Otherwise vADBInt indicates end of data. Note that Linux
806 * specifically checks for the sequence 0x0 0xff to confirm the
807 * end of the poll reply, so provide these extra bytes below to
808 * keep it happy
809 */
810 if (v1s->adb_data_in_index < v1s->adb_data_in_size) {
811 /* Next data byte */
812 *data = v1s->adb_data_in[v1s->adb_data_in_index];
813 ms->b |= VIA1B_vADBInt;
814 } else if (v1s->adb_data_in_index == v1s->adb_data_in_size) {
815 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
816 /* Bus timeout (no more data) */
817 *data = 0xff;
818 } else {
819 /* Return 0x0 after reply */
820 *data = 0;
821 }
822 ms->b &= ~VIA1B_vADBInt;
823 } else {
824 /* Bus timeout (no more data) */
825 *data = 0xff;
826 ms->b &= ~VIA1B_vADBInt;
827 adb_bus->status = 0;
828 adb_autopoll_unblock(adb_bus);
829 }
830
831 trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
832 *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
833 adb_bus->status, v1s->adb_data_in_index,
834 v1s->adb_data_in_size);
835
836 if (v1s->adb_data_in_index <= v1s->adb_data_in_size) {
837 v1s->adb_data_in_index++;
838 }
839 break;
840 }
841
842 qemu_irq_raise(v1s->adb_data_ready);
843 break;
844 }
845 }
846
via1_adb_update(MOS6522Q800VIA1State * v1s)847 static void via1_adb_update(MOS6522Q800VIA1State *v1s)
848 {
849 MOS6522State *s = MOS6522(v1s);
850 int oldstate, state;
851
852 oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
853 state = (s->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
854
855 if (state != oldstate) {
856 if (s->acr & VIA1ACR_vShiftOut) {
857 /* output mode */
858 adb_via_send(v1s, state, s->sr);
859 } else {
860 /* input mode */
861 adb_via_receive(v1s, state, &s->sr);
862 }
863 }
864 }
865
via1_auxmode_update(MOS6522Q800VIA1State * v1s)866 static void via1_auxmode_update(MOS6522Q800VIA1State *v1s)
867 {
868 MOS6522State *s = MOS6522(v1s);
869 int oldirq, irq;
870
871 oldirq = (v1s->last_b & VIA1B_vMystery) ? 1 : 0;
872 irq = (s->b & VIA1B_vMystery) ? 1 : 0;
873
874 /* Check to see if the A/UX mode bit has changed */
875 if (irq != oldirq) {
876 trace_via1_auxmode(irq);
877 qemu_set_irq(v1s->auxmode_irq, irq);
878
879 /*
880 * Clear the ADB interrupt. MacOS can leave VIA1B_vADBInt asserted
881 * (low) if a poll sequence doesn't complete before NetBSD disables
882 * interrupts upon boot. Fortunately NetBSD switches to the so-called
883 * "A/UX" interrupt mode after it initialises, so we can use this as
884 * a convenient place to clear the ADB interrupt for now.
885 */
886 s->b |= VIA1B_vADBInt;
887 }
888 }
889
890 /*
891 * Addresses and real values for TimeDBRA/TimeSCCB to allow timer calibration
892 * to succeed (NOTE: both values have been multiplied by 3 to cope with the
893 * speed of QEMU execution on a modern host
894 */
895 #define MACOS_TIMEDBRA 0xd00
896 #define MACOS_TIMESCCB 0xd02
897
898 #define MACOS_TIMEDBRA_VALUE (0x2a00 * 3)
899 #define MACOS_TIMESCCB_VALUE (0x079d * 3)
900
via1_is_toolbox_timer_calibrated(void)901 static bool via1_is_toolbox_timer_calibrated(void)
902 {
903 /*
904 * Indicate whether the MacOS toolbox has been calibrated by checking
905 * for the value of our magic constants
906 */
907 uint16_t timedbra = lduw_be_phys(&address_space_memory, MACOS_TIMEDBRA);
908 uint16_t timesccdb = lduw_be_phys(&address_space_memory, MACOS_TIMESCCB);
909
910 return (timedbra == MACOS_TIMEDBRA_VALUE &&
911 timesccdb == MACOS_TIMESCCB_VALUE);
912 }
913
via1_timer_calibration_hack(MOS6522Q800VIA1State * v1s,int addr,uint64_t val,int size)914 static void via1_timer_calibration_hack(MOS6522Q800VIA1State *v1s, int addr,
915 uint64_t val, int size)
916 {
917 /*
918 * Work around timer calibration to ensure we that we have non-zero and
919 * known good values for TIMEDRBA and TIMESCCDB.
920 *
921 * This works by attempting to detect the reset and calibration sequence
922 * of writes to VIA1
923 */
924 int old_timer_hack_state = v1s->timer_hack_state;
925
926 switch (v1s->timer_hack_state) {
927 case 0:
928 if (addr == VIA_REG_PCR && val == 0x22) {
929 /* VIA_REG_PCR: configure VIA1 edge triggering */
930 v1s->timer_hack_state = 1;
931 }
932 break;
933 case 1:
934 if (addr == VIA_REG_T2CL && val == 0xc) {
935 /* VIA_REG_T2CL: low byte of 1ms counter */
936 if (!via1_is_toolbox_timer_calibrated()) {
937 v1s->timer_hack_state = 2;
938 } else {
939 v1s->timer_hack_state = 0;
940 }
941 }
942 break;
943 case 2:
944 if (addr == VIA_REG_T2CH && val == 0x3) {
945 /*
946 * VIA_REG_T2CH: high byte of 1ms counter (very likely at the
947 * start of SETUPTIMEK)
948 */
949 if (!via1_is_toolbox_timer_calibrated()) {
950 v1s->timer_hack_state = 3;
951 } else {
952 v1s->timer_hack_state = 0;
953 }
954 }
955 break;
956 case 3:
957 if (addr == VIA_REG_IER && val == 0x20) {
958 /*
959 * VIA_REG_IER: update at end of SETUPTIMEK
960 *
961 * Timer calibration has finished: unfortunately the values in
962 * TIMEDBRA (0xd00) and TIMESCCDB (0xd02) are so far out they
963 * cause divide by zero errors.
964 *
965 * Update them with values obtained from a real Q800 but with
966 * a x3 scaling factor which seems to work well
967 */
968 stw_be_phys(&address_space_memory, MACOS_TIMEDBRA,
969 MACOS_TIMEDBRA_VALUE);
970 stw_be_phys(&address_space_memory, MACOS_TIMESCCB,
971 MACOS_TIMESCCB_VALUE);
972
973 v1s->timer_hack_state = 4;
974 }
975 break;
976 case 4:
977 /*
978 * This is the normal post-calibration timer state: we should
979 * generally remain here unless we detect the A/UX calibration
980 * loop, or a write to VIA_REG_PCR suggesting a reset
981 */
982 if (addr == VIA_REG_PCR && val == 0x22) {
983 /* Looks like there has been a reset? */
984 v1s->timer_hack_state = 1;
985 }
986
987 if (addr == VIA_REG_T2CL && val == 0xf0) {
988 /* VIA_REG_T2CL: low byte of counter (A/UX) */
989 v1s->timer_hack_state = 5;
990 }
991 break;
992 case 5:
993 if (addr == VIA_REG_T2CH && val == 0x3c) {
994 /*
995 * VIA_REG_T2CH: high byte of counter (A/UX). We are now extremely
996 * likely to be in the A/UX timer calibration routine, so move to
997 * the next state where we enable the calibration hack.
998 */
999 v1s->timer_hack_state = 6;
1000 } else if ((addr == VIA_REG_IER && val == 0x20) ||
1001 addr == VIA_REG_T2CH) {
1002 /* We're doing something else with the timer, not calibration */
1003 v1s->timer_hack_state = 0;
1004 }
1005 break;
1006 case 6:
1007 if ((addr == VIA_REG_IER && val == 0x20) || addr == VIA_REG_T2CH) {
1008 /* End of A/UX timer calibration routine, or another write */
1009 v1s->timer_hack_state = 7;
1010 } else {
1011 v1s->timer_hack_state = 0;
1012 }
1013 break;
1014 case 7:
1015 /*
1016 * This is the normal post-calibration timer state once both the
1017 * MacOS toolbox and A/UX have been calibrated, until we see a write
1018 * to VIA_REG_PCR to suggest a reset
1019 */
1020 if (addr == VIA_REG_PCR && val == 0x22) {
1021 /* Looks like there has been a reset? */
1022 v1s->timer_hack_state = 1;
1023 }
1024 break;
1025 default:
1026 g_assert_not_reached();
1027 }
1028
1029 if (old_timer_hack_state != v1s->timer_hack_state) {
1030 trace_via1_timer_hack_state(v1s->timer_hack_state);
1031 }
1032 }
1033
mos6522_q800_via1_read(void * opaque,hwaddr addr,unsigned size)1034 static uint64_t mos6522_q800_via1_read(void *opaque, hwaddr addr, unsigned size)
1035 {
1036 MOS6522Q800VIA1State *s = MOS6522_Q800_VIA1(opaque);
1037 MOS6522State *ms = MOS6522(s);
1038 uint64_t ret;
1039 int64_t now;
1040
1041 addr = (addr >> 9) & 0xf;
1042 ret = mos6522_read(ms, addr, size);
1043 switch (addr) {
1044 case VIA_REG_A:
1045 case VIA_REG_ANH:
1046 /* Quadra 800 Id */
1047 ret = (ret & ~VIA1A_CPUID_MASK) | VIA1A_CPUID_Q800;
1048 break;
1049 case VIA_REG_T2CH:
1050 if (s->timer_hack_state == 6) {
1051 /*
1052 * The A/UX timer calibration loop runs continuously until 2
1053 * consecutive iterations differ by at least 0x492 timer ticks.
1054 * Modern hosts execute the timer calibration loop so fast that
1055 * this situation never occurs causing a hang on boot. Use a
1056 * similar method to Shoebill which is to randomly add 0x500 to
1057 * the T2 counter value during calibration to enable it to
1058 * eventually succeed.
1059 */
1060 now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1061 if (now & 1) {
1062 ret += 0x5;
1063 }
1064 }
1065 break;
1066 }
1067 return ret;
1068 }
1069
mos6522_q800_via1_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1070 static void mos6522_q800_via1_write(void *opaque, hwaddr addr, uint64_t val,
1071 unsigned size)
1072 {
1073 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
1074 MOS6522State *ms = MOS6522(v1s);
1075 int oldstate, state;
1076 int oldsr = ms->sr;
1077
1078 addr = (addr >> 9) & 0xf;
1079
1080 via1_timer_calibration_hack(v1s, addr, val, size);
1081
1082 mos6522_write(ms, addr, val, size);
1083
1084 switch (addr) {
1085 case VIA_REG_B:
1086 via1_rtc_update(v1s);
1087 via1_adb_update(v1s);
1088 via1_auxmode_update(v1s);
1089
1090 v1s->last_b = ms->b;
1091 break;
1092
1093 case VIA_REG_SR:
1094 {
1095 /*
1096 * NetBSD assumes it can send its first ADB command after sending
1097 * the ADB_BUSRESET command in ADB_STATE_NEW without changing the
1098 * state back to ADB_STATE_IDLE first as detailed in the ADB
1099 * protocol.
1100 *
1101 * Add a workaround to detect this condition at the start of ADB
1102 * enumeration and send the next command written to SR after a
1103 * ADB_BUSRESET onto the bus regardless, even if we don't detect a
1104 * state transition to ADB_STATE_NEW.
1105 *
1106 * Note that in my tests the NetBSD state machine takes one ADB
1107 * operation to recover which means the probe for an ADB device at
1108 * address 1 always fails. However since the first device is at
1109 * address 2 then this will work fine, without having to come up
1110 * with a more complicated and invasive solution.
1111 */
1112 oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >>
1113 VIA1B_vADB_StateShift;
1114 state = (ms->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
1115
1116 if (oldstate == ADB_STATE_NEW && state == ADB_STATE_NEW &&
1117 (ms->acr & VIA1ACR_vShiftOut) &&
1118 oldsr == 0 /* ADB_BUSRESET */) {
1119 trace_via1_adb_netbsd_enum_hack();
1120 adb_via_send(v1s, state, ms->sr);
1121 }
1122 }
1123 break;
1124 }
1125 }
1126
1127 static const MemoryRegionOps mos6522_q800_via1_ops = {
1128 .read = mos6522_q800_via1_read,
1129 .write = mos6522_q800_via1_write,
1130 .endianness = DEVICE_BIG_ENDIAN,
1131 .valid = {
1132 .min_access_size = 1,
1133 .max_access_size = 4,
1134 },
1135 };
1136
mos6522_q800_via2_read(void * opaque,hwaddr addr,unsigned size)1137 static uint64_t mos6522_q800_via2_read(void *opaque, hwaddr addr, unsigned size)
1138 {
1139 MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
1140 MOS6522State *ms = MOS6522(s);
1141 uint64_t val;
1142
1143 addr = (addr >> 9) & 0xf;
1144 val = mos6522_read(ms, addr, size);
1145
1146 switch (addr) {
1147 case VIA_REG_IFR:
1148 /*
1149 * On a Q800 an emulated VIA2 is integrated into the onboard logic. The
1150 * expectation of most OSs is that the DRQ bit is live, rather than
1151 * latched as it would be on a real VIA so do the same here.
1152 *
1153 * Note: DRQ is negative edge triggered
1154 */
1155 val &= ~VIA2_IRQ_SCSI_DATA;
1156 val |= (~ms->last_irq_levels & VIA2_IRQ_SCSI_DATA);
1157 break;
1158 }
1159
1160 return val;
1161 }
1162
mos6522_q800_via2_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1163 static void mos6522_q800_via2_write(void *opaque, hwaddr addr, uint64_t val,
1164 unsigned size)
1165 {
1166 MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
1167 MOS6522State *ms = MOS6522(s);
1168
1169 addr = (addr >> 9) & 0xf;
1170 mos6522_write(ms, addr, val, size);
1171 }
1172
1173 static const MemoryRegionOps mos6522_q800_via2_ops = {
1174 .read = mos6522_q800_via2_read,
1175 .write = mos6522_q800_via2_write,
1176 .endianness = DEVICE_BIG_ENDIAN,
1177 .valid = {
1178 .min_access_size = 1,
1179 .max_access_size = 4,
1180 },
1181 };
1182
via1_postload_update_cb(void * opaque,bool running,RunState state)1183 static void via1_postload_update_cb(void *opaque, bool running, RunState state)
1184 {
1185 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
1186
1187 qemu_del_vm_change_state_handler(v1s->vmstate);
1188 v1s->vmstate = NULL;
1189
1190 pram_update(v1s);
1191 }
1192
via1_post_load(void * opaque,int version_id)1193 static int via1_post_load(void *opaque, int version_id)
1194 {
1195 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
1196
1197 if (v1s->blk) {
1198 v1s->vmstate = qemu_add_vm_change_state_handler(
1199 via1_postload_update_cb, v1s);
1200 }
1201
1202 return 0;
1203 }
1204
1205 /* VIA 1 */
mos6522_q800_via1_reset_hold(Object * obj,ResetType type)1206 static void mos6522_q800_via1_reset_hold(Object *obj, ResetType type)
1207 {
1208 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj);
1209 MOS6522State *ms = MOS6522(v1s);
1210 MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
1211 ADBBusState *adb_bus = &v1s->adb_bus;
1212
1213 if (mdc->parent_phases.hold) {
1214 mdc->parent_phases.hold(obj, type);
1215 }
1216
1217 ms->timers[0].frequency = VIA_TIMER_FREQ;
1218 ms->timers[1].frequency = VIA_TIMER_FREQ;
1219
1220 ms->b = VIA1B_vADB_StateMask | VIA1B_vADBInt | VIA1B_vRTCEnb;
1221
1222 /* ADB/RTC */
1223 adb_set_autopoll_enabled(adb_bus, true);
1224 v1s->cmd = REG_EMPTY;
1225 v1s->alt = REG_EMPTY;
1226
1227 /* Timer calibration hack */
1228 v1s->timer_hack_state = 0;
1229 }
1230
mos6522_q800_via1_realize(DeviceState * dev,Error ** errp)1231 static void mos6522_q800_via1_realize(DeviceState *dev, Error **errp)
1232 {
1233 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(dev);
1234 ADBBusState *adb_bus = &v1s->adb_bus;
1235 struct tm tm;
1236 int ret;
1237
1238 v1s->one_second_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, via1_one_second,
1239 v1s);
1240 via1_one_second_update(v1s);
1241 v1s->sixty_hz_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, via1_sixty_hz,
1242 v1s);
1243 via1_sixty_hz_update(v1s);
1244
1245 qemu_get_timedate(&tm, 0);
1246 v1s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
1247
1248 adb_register_autopoll_callback(adb_bus, adb_via_poll, v1s);
1249 v1s->adb_data_ready = qdev_get_gpio_in(dev, VIA1_IRQ_ADB_READY_BIT);
1250
1251 if (v1s->blk) {
1252 int64_t len = blk_getlength(v1s->blk);
1253 if (len < 0) {
1254 error_setg_errno(errp, -len,
1255 "could not get length of backing image");
1256 return;
1257 }
1258 ret = blk_set_perm(v1s->blk,
1259 BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
1260 BLK_PERM_ALL, errp);
1261 if (ret < 0) {
1262 return;
1263 }
1264
1265 ret = blk_pread(v1s->blk, 0, sizeof(v1s->PRAM), v1s->PRAM, 0);
1266 if (ret < 0) {
1267 error_setg(errp, "can't read PRAM contents");
1268 return;
1269 }
1270 }
1271 }
1272
mos6522_q800_via1_init(Object * obj)1273 static void mos6522_q800_via1_init(Object *obj)
1274 {
1275 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj);
1276 SysBusDevice *sbd = SYS_BUS_DEVICE(v1s);
1277
1278 memory_region_init_io(&v1s->via_mem, obj, &mos6522_q800_via1_ops, v1s,
1279 "via1", VIA_SIZE);
1280 sysbus_init_mmio(sbd, &v1s->via_mem);
1281
1282 /* ADB */
1283 qbus_init((BusState *)&v1s->adb_bus, sizeof(v1s->adb_bus),
1284 TYPE_ADB_BUS, DEVICE(v1s), "adb.0");
1285
1286 /* A/UX mode */
1287 qdev_init_gpio_out(DEVICE(obj), &v1s->auxmode_irq, 1);
1288 }
1289
1290 static const VMStateDescription vmstate_q800_via1 = {
1291 .name = "q800-via1",
1292 .version_id = 0,
1293 .minimum_version_id = 0,
1294 .post_load = via1_post_load,
1295 .fields = (const VMStateField[]) {
1296 VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA1State, 0, vmstate_mos6522,
1297 MOS6522State),
1298 VMSTATE_UINT8(last_b, MOS6522Q800VIA1State),
1299 /* RTC */
1300 VMSTATE_BUFFER(PRAM, MOS6522Q800VIA1State),
1301 VMSTATE_UINT32(tick_offset, MOS6522Q800VIA1State),
1302 VMSTATE_UINT8(data_out, MOS6522Q800VIA1State),
1303 VMSTATE_INT32(data_out_cnt, MOS6522Q800VIA1State),
1304 VMSTATE_UINT8(data_in, MOS6522Q800VIA1State),
1305 VMSTATE_UINT8(data_in_cnt, MOS6522Q800VIA1State),
1306 VMSTATE_UINT8(cmd, MOS6522Q800VIA1State),
1307 VMSTATE_INT32(wprotect, MOS6522Q800VIA1State),
1308 VMSTATE_INT32(alt, MOS6522Q800VIA1State),
1309 /* ADB */
1310 VMSTATE_INT32(adb_data_in_size, MOS6522Q800VIA1State),
1311 VMSTATE_INT32(adb_data_in_index, MOS6522Q800VIA1State),
1312 VMSTATE_INT32(adb_data_out_index, MOS6522Q800VIA1State),
1313 VMSTATE_BUFFER(adb_data_in, MOS6522Q800VIA1State),
1314 VMSTATE_BUFFER(adb_data_out, MOS6522Q800VIA1State),
1315 VMSTATE_UINT8(adb_autopoll_cmd, MOS6522Q800VIA1State),
1316 /* Timers */
1317 VMSTATE_TIMER_PTR(one_second_timer, MOS6522Q800VIA1State),
1318 VMSTATE_INT64(next_second, MOS6522Q800VIA1State),
1319 VMSTATE_TIMER_PTR(sixty_hz_timer, MOS6522Q800VIA1State),
1320 VMSTATE_INT64(next_sixty_hz, MOS6522Q800VIA1State),
1321 /* Timer hack */
1322 VMSTATE_INT32(timer_hack_state, MOS6522Q800VIA1State),
1323 VMSTATE_END_OF_LIST()
1324 }
1325 };
1326
1327 static Property mos6522_q800_via1_properties[] = {
1328 DEFINE_PROP_DRIVE("drive", MOS6522Q800VIA1State, blk),
1329 DEFINE_PROP_END_OF_LIST(),
1330 };
1331
mos6522_q800_via1_class_init(ObjectClass * oc,void * data)1332 static void mos6522_q800_via1_class_init(ObjectClass *oc, void *data)
1333 {
1334 DeviceClass *dc = DEVICE_CLASS(oc);
1335 ResettableClass *rc = RESETTABLE_CLASS(oc);
1336 MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
1337
1338 dc->realize = mos6522_q800_via1_realize;
1339 resettable_class_set_parent_phases(rc, NULL, mos6522_q800_via1_reset_hold,
1340 NULL, &mdc->parent_phases);
1341 dc->vmsd = &vmstate_q800_via1;
1342 device_class_set_props(dc, mos6522_q800_via1_properties);
1343 }
1344
1345 static const TypeInfo mos6522_q800_via1_type_info = {
1346 .name = TYPE_MOS6522_Q800_VIA1,
1347 .parent = TYPE_MOS6522,
1348 .instance_size = sizeof(MOS6522Q800VIA1State),
1349 .instance_init = mos6522_q800_via1_init,
1350 .class_init = mos6522_q800_via1_class_init,
1351 };
1352
1353 /* VIA 2 */
mos6522_q800_via2_portB_write(MOS6522State * s)1354 static void mos6522_q800_via2_portB_write(MOS6522State *s)
1355 {
1356 if (s->dirb & VIA2B_vPower && (s->b & VIA2B_vPower) == 0) {
1357 /* shutdown */
1358 qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
1359 }
1360 }
1361
mos6522_q800_via2_reset_hold(Object * obj,ResetType type)1362 static void mos6522_q800_via2_reset_hold(Object *obj, ResetType type)
1363 {
1364 MOS6522State *ms = MOS6522(obj);
1365 MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
1366
1367 if (mdc->parent_phases.hold) {
1368 mdc->parent_phases.hold(obj, type);
1369 }
1370
1371 ms->timers[0].frequency = VIA_TIMER_FREQ;
1372 ms->timers[1].frequency = VIA_TIMER_FREQ;
1373
1374 ms->dirb = 0;
1375 ms->b = 0;
1376 ms->dira = 0;
1377 ms->a = 0x7f;
1378 }
1379
via2_nubus_irq_request(void * opaque,int n,int level)1380 static void via2_nubus_irq_request(void *opaque, int n, int level)
1381 {
1382 MOS6522Q800VIA2State *v2s = opaque;
1383 MOS6522State *s = MOS6522(v2s);
1384 qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA2_IRQ_NUBUS_BIT);
1385
1386 if (level) {
1387 /* Port A nubus IRQ inputs are active LOW */
1388 s->a &= ~(1 << n);
1389 } else {
1390 s->a |= (1 << n);
1391 }
1392
1393 /* Negative edge trigger */
1394 qemu_set_irq(irq, !level);
1395 }
1396
mos6522_q800_via2_init(Object * obj)1397 static void mos6522_q800_via2_init(Object *obj)
1398 {
1399 MOS6522Q800VIA2State *v2s = MOS6522_Q800_VIA2(obj);
1400 SysBusDevice *sbd = SYS_BUS_DEVICE(v2s);
1401
1402 memory_region_init_io(&v2s->via_mem, obj, &mos6522_q800_via2_ops, v2s,
1403 "via2", VIA_SIZE);
1404 sysbus_init_mmio(sbd, &v2s->via_mem);
1405
1406 qdev_init_gpio_in_named(DEVICE(obj), via2_nubus_irq_request, "nubus-irq",
1407 VIA2_NUBUS_IRQ_NB);
1408 }
1409
1410 static const VMStateDescription vmstate_q800_via2 = {
1411 .name = "q800-via2",
1412 .version_id = 0,
1413 .minimum_version_id = 0,
1414 .fields = (const VMStateField[]) {
1415 VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA2State, 0, vmstate_mos6522,
1416 MOS6522State),
1417 VMSTATE_END_OF_LIST()
1418 }
1419 };
1420
mos6522_q800_via2_class_init(ObjectClass * oc,void * data)1421 static void mos6522_q800_via2_class_init(ObjectClass *oc, void *data)
1422 {
1423 DeviceClass *dc = DEVICE_CLASS(oc);
1424 ResettableClass *rc = RESETTABLE_CLASS(oc);
1425 MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
1426
1427 resettable_class_set_parent_phases(rc, NULL, mos6522_q800_via2_reset_hold,
1428 NULL, &mdc->parent_phases);
1429 dc->vmsd = &vmstate_q800_via2;
1430 mdc->portB_write = mos6522_q800_via2_portB_write;
1431 }
1432
1433 static const TypeInfo mos6522_q800_via2_type_info = {
1434 .name = TYPE_MOS6522_Q800_VIA2,
1435 .parent = TYPE_MOS6522,
1436 .instance_size = sizeof(MOS6522Q800VIA2State),
1437 .instance_init = mos6522_q800_via2_init,
1438 .class_init = mos6522_q800_via2_class_init,
1439 };
1440
mac_via_register_types(void)1441 static void mac_via_register_types(void)
1442 {
1443 type_register_static(&mos6522_q800_via1_type_info);
1444 type_register_static(&mos6522_q800_via2_type_info);
1445 }
1446
1447 type_init(mac_via_register_types);
1448