1 /* 2 * QEMU m68k Macintosh VIA device support 3 * 4 * Copyright (c) 2011-2018 Laurent Vivier 5 * Copyright (c) 2018 Mark Cave-Ayland 6 * 7 * Some parts from hw/misc/macio/cuda.c 8 * 9 * Copyright (c) 2004-2007 Fabrice Bellard 10 * Copyright (c) 2007 Jocelyn Mayer 11 * 12 * some parts from linux-2.6.29, arch/m68k/include/asm/mac_via.h 13 * 14 * This work is licensed under the terms of the GNU GPL, version 2 or later. 15 * See the COPYING file in the top-level directory. 16 */ 17 18 #include "qemu/osdep.h" 19 #include "exec/address-spaces.h" 20 #include "migration/vmstate.h" 21 #include "hw/sysbus.h" 22 #include "hw/irq.h" 23 #include "qemu/timer.h" 24 #include "hw/misc/mac_via.h" 25 #include "hw/misc/mos6522.h" 26 #include "hw/input/adb.h" 27 #include "sysemu/runstate.h" 28 #include "qapi/error.h" 29 #include "qemu/cutils.h" 30 #include "hw/qdev-properties.h" 31 #include "hw/qdev-properties-system.h" 32 #include "sysemu/block-backend.h" 33 #include "sysemu/rtc.h" 34 #include "trace.h" 35 #include "qemu/log.h" 36 37 /* 38 * VIAs: There are two in every machine 39 */ 40 41 /* 42 * Not all of these are true post MacII I think. 43 * CSA: probably the ones CHRP marks as 'unused' change purposes 44 * when the IWM becomes the SWIM. 45 * http://www.rs6000.ibm.com/resource/technology/chrpio/via5.mak.html 46 * ftp://ftp.austin.ibm.com/pub/technology/spec/chrp/inwork/CHRP_IORef_1.0.pdf 47 * 48 * also, http://developer.apple.com/technotes/hw/hw_09.html claims the 49 * following changes for IIfx: 50 * VIA1A_vSccWrReq not available and that VIA1A_vSync has moved to an IOP. 51 * Also, "All of the functionality of VIA2 has been moved to other chips". 52 */ 53 54 #define VIA1A_vSccWrReq 0x80 /* 55 * SCC write. (input) 56 * [CHRP] SCC WREQ: Reflects the state of the 57 * Wait/Request pins from the SCC. 58 * [Macintosh Family Hardware] 59 * as CHRP on SE/30,II,IIx,IIcx,IIci. 60 * on IIfx, "0 means an active request" 61 */ 62 #define VIA1A_vRev8 0x40 /* 63 * Revision 8 board ??? 64 * [CHRP] En WaitReqB: Lets the WaitReq_L 65 * signal from port B of the SCC appear on 66 * the PA7 input pin. Output. 67 * [Macintosh Family] On the SE/30, this 68 * is the bit to flip screen buffers. 69 * 0=alternate, 1=main. 70 * on II,IIx,IIcx,IIci,IIfx this is a bit 71 * for Rev ID. 0=II,IIx, 1=IIcx,IIci,IIfx 72 */ 73 #define VIA1A_vHeadSel 0x20 /* 74 * Head select for IWM. 75 * [CHRP] unused. 76 * [Macintosh Family] "Floppy disk 77 * state-control line SEL" on all but IIfx 78 */ 79 #define VIA1A_vOverlay 0x10 /* 80 * [Macintosh Family] On SE/30,II,IIx,IIcx 81 * this bit enables the "Overlay" address 82 * map in the address decoders as it is on 83 * reset for mapping the ROM over the reset 84 * vector. 1=use overlay map. 85 * On the IIci,IIfx it is another bit of the 86 * CPU ID: 0=normal IIci, 1=IIci with parity 87 * feature or IIfx. 88 * [CHRP] En WaitReqA: Lets the WaitReq_L 89 * signal from port A of the SCC appear 90 * on the PA7 input pin (CHRP). Output. 91 * [MkLinux] "Drive Select" 92 * (with 0x20 being 'disk head select') 93 */ 94 #define VIA1A_vSync 0x08 /* 95 * [CHRP] Sync Modem: modem clock select: 96 * 1: select the external serial clock to 97 * drive the SCC's /RTxCA pin. 98 * 0: Select the 3.6864MHz clock to drive 99 * the SCC cell. 100 * [Macintosh Family] Correct on all but IIfx 101 */ 102 103 /* 104 * Macintosh Family Hardware sez: bits 0-2 of VIA1A are volume control 105 * on Macs which had the PWM sound hardware. Reserved on newer models. 106 * On IIci,IIfx, bits 1-2 are the rest of the CPU ID: 107 * bit 2: 1=IIci, 0=IIfx 108 * bit 1: 1 on both IIci and IIfx. 109 * MkLinux sez bit 0 is 'burnin flag' in this case. 110 * CHRP sez: VIA1A bits 0-2 and 5 are 'unused': if programmed as 111 * inputs, these bits will read 0. 112 */ 113 #define VIA1A_vVolume 0x07 /* Audio volume mask for PWM */ 114 #define VIA1A_CPUID0 0x02 /* CPU id bit 0 on RBV, others */ 115 #define VIA1A_CPUID1 0x04 /* CPU id bit 0 on RBV, others */ 116 #define VIA1A_CPUID2 0x10 /* CPU id bit 0 on RBV, others */ 117 #define VIA1A_CPUID3 0x40 /* CPU id bit 0 on RBV, others */ 118 #define VIA1A_CPUID_MASK (VIA1A_CPUID0 | VIA1A_CPUID1 | \ 119 VIA1A_CPUID2 | VIA1A_CPUID3) 120 #define VIA1A_CPUID_Q800 (VIA1A_CPUID0 | VIA1A_CPUID2) 121 122 /* 123 * Info on VIA1B is from Macintosh Family Hardware & MkLinux. 124 * CHRP offers no info. 125 */ 126 #define VIA1B_vSound 0x80 /* 127 * Sound enable (for compatibility with 128 * PWM hardware) 0=enabled. 129 * Also, on IIci w/parity, shows parity error 130 * 0=error, 1=OK. 131 */ 132 #define VIA1B_vMystery 0x40 /* 133 * On IIci, parity enable. 0=enabled,1=disabled 134 * On SE/30, vertical sync interrupt enable. 135 * 0=enabled. This vSync interrupt shows up 136 * as a slot $E interrupt. 137 * On Quadra 800 this bit toggles A/UX mode which 138 * configures the glue logic to deliver some IRQs 139 * at different levels compared to a classic 140 * Mac. 141 */ 142 #define VIA1B_vADBS2 0x20 /* ADB state input bit 1 (unused on IIfx) */ 143 #define VIA1B_vADBS1 0x10 /* ADB state input bit 0 (unused on IIfx) */ 144 #define VIA1B_vADBInt 0x08 /* ADB interrupt 0=interrupt (unused on IIfx)*/ 145 #define VIA1B_vRTCEnb 0x04 /* Enable Real time clock. 0=enabled. */ 146 #define VIA1B_vRTCClk 0x02 /* Real time clock serial-clock line. */ 147 #define VIA1B_vRTCData 0x01 /* Real time clock serial-data line. */ 148 149 /* 150 * VIA2 A register is the interrupt lines raised off the nubus 151 * slots. 152 * The below info is from 'Macintosh Family Hardware.' 153 * MkLinux calls the 'IIci internal video IRQ' below the 'RBV slot 0 irq.' 154 * It also notes that the slot $9 IRQ is the 'Ethernet IRQ' and 155 * defines the 'Video IRQ' as 0x40 for the 'EVR' VIA work-alike. 156 * Perhaps OSS uses vRAM1 and vRAM2 for ADB. 157 */ 158 159 #define VIA2A_vRAM1 0x80 /* RAM size bit 1 (IIci: reserved) */ 160 #define VIA2A_vRAM0 0x40 /* RAM size bit 0 (IIci: internal video IRQ) */ 161 #define VIA2A_vIRQE 0x20 /* IRQ from slot $E */ 162 #define VIA2A_vIRQD 0x10 /* IRQ from slot $D */ 163 #define VIA2A_vIRQC 0x08 /* IRQ from slot $C */ 164 #define VIA2A_vIRQB 0x04 /* IRQ from slot $B */ 165 #define VIA2A_vIRQA 0x02 /* IRQ from slot $A */ 166 #define VIA2A_vIRQ9 0x01 /* IRQ from slot $9 */ 167 168 /* 169 * RAM size bits decoded as follows: 170 * bit1 bit0 size of ICs in bank A 171 * 0 0 256 kbit 172 * 0 1 1 Mbit 173 * 1 0 4 Mbit 174 * 1 1 16 Mbit 175 */ 176 177 /* 178 * Register B has the fun stuff in it 179 */ 180 181 #define VIA2B_vVBL 0x80 /* 182 * VBL output to VIA1 (60.15Hz) driven by 183 * timer T1. 184 * on IIci, parity test: 0=test mode. 185 * [MkLinux] RBV_PARODD: 1=odd,0=even. 186 */ 187 #define VIA2B_vSndJck 0x40 /* 188 * External sound jack status. 189 * 0=plug is inserted. On SE/30, always 0 190 */ 191 #define VIA2B_vTfr0 0x20 /* Transfer mode bit 0 ack from NuBus */ 192 #define VIA2B_vTfr1 0x10 /* Transfer mode bit 1 ack from NuBus */ 193 #define VIA2B_vMode32 0x08 /* 194 * 24/32bit switch - doubles as cache flush 195 * on II, AMU/PMMU control. 196 * if AMU, 0=24bit to 32bit translation 197 * if PMMU, 1=PMMU is accessing page table. 198 * on SE/30 tied low. 199 * on IIx,IIcx,IIfx, unused. 200 * on IIci/RBV, cache control. 0=flush cache. 201 */ 202 #define VIA2B_vPower 0x04 /* 203 * Power off, 0=shut off power. 204 * on SE/30 this signal sent to PDS card. 205 */ 206 #define VIA2B_vBusLk 0x02 /* 207 * Lock NuBus transactions, 0=locked. 208 * on SE/30 sent to PDS card. 209 */ 210 #define VIA2B_vCDis 0x01 /* 211 * Cache control. On IIci, 1=disable cache card 212 * on others, 0=disable processor's instruction 213 * and data caches. 214 */ 215 216 /* interrupt flags */ 217 218 #define IRQ_SET 0x80 219 220 /* common */ 221 222 #define VIA_IRQ_TIMER1 0x40 223 #define VIA_IRQ_TIMER2 0x20 224 225 /* 226 * Apple sez: http://developer.apple.com/technotes/ov/ov_04.html 227 * Another example of a valid function that has no ROM support is the use 228 * of the alternate video page for page-flipping animation. Since there 229 * is no ROM call to flip pages, it is necessary to go play with the 230 * right bit in the VIA chip (6522 Versatile Interface Adapter). 231 * [CSA: don't know which one this is, but it's one of 'em!] 232 */ 233 234 /* 235 * 6522 registers - see databook. 236 * CSA: Assignments for VIA1 confirmed from CHRP spec. 237 */ 238 239 /* partial address decode. 0xYYXX : XX part for RBV, YY part for VIA */ 240 /* Note: 15 VIA regs, 8 RBV regs */ 241 242 #define vBufB 0x0000 /* [VIA/RBV] Register B */ 243 #define vBufAH 0x0200 /* [VIA only] Buffer A, with handshake. DON'T USE! */ 244 #define vDirB 0x0400 /* [VIA only] Data Direction Register B. */ 245 #define vDirA 0x0600 /* [VIA only] Data Direction Register A. */ 246 #define vT1CL 0x0800 /* [VIA only] Timer one counter low. */ 247 #define vT1CH 0x0a00 /* [VIA only] Timer one counter high. */ 248 #define vT1LL 0x0c00 /* [VIA only] Timer one latches low. */ 249 #define vT1LH 0x0e00 /* [VIA only] Timer one latches high. */ 250 #define vT2CL 0x1000 /* [VIA only] Timer two counter low. */ 251 #define vT2CH 0x1200 /* [VIA only] Timer two counter high. */ 252 #define vSR 0x1400 /* [VIA only] Shift register. */ 253 #define vACR 0x1600 /* [VIA only] Auxiliary control register. */ 254 #define vPCR 0x1800 /* [VIA only] Peripheral control register. */ 255 /* 256 * CHRP sez never ever to *write* this. 257 * Mac family says never to *change* this. 258 * In fact we need to initialize it once at start. 259 */ 260 #define vIFR 0x1a00 /* [VIA/RBV] Interrupt flag register. */ 261 #define vIER 0x1c00 /* [VIA/RBV] Interrupt enable register. */ 262 #define vBufA 0x1e00 /* [VIA/RBV] register A (no handshake) */ 263 264 /* from linux 2.6 drivers/macintosh/via-macii.c */ 265 266 /* Bits in ACR */ 267 268 #define VIA1ACR_vShiftCtrl 0x1c /* Shift register control bits */ 269 #define VIA1ACR_vShiftExtClk 0x0c /* Shift on external clock */ 270 #define VIA1ACR_vShiftOut 0x10 /* Shift out if 1 */ 271 272 /* 273 * Apple Macintosh Family Hardware Refenece 274 * Table 19-10 ADB transaction states 275 */ 276 277 #define ADB_STATE_NEW 0 278 #define ADB_STATE_EVEN 1 279 #define ADB_STATE_ODD 2 280 #define ADB_STATE_IDLE 3 281 282 #define VIA1B_vADB_StateMask (VIA1B_vADBS1 | VIA1B_vADBS2) 283 #define VIA1B_vADB_StateShift 4 284 285 #define VIA_TIMER_FREQ (783360) 286 #define VIA_ADB_POLL_FREQ 50 /* XXX: not real */ 287 288 /* 289 * Guide to the Macintosh Family Hardware ch. 12 "Displays" p. 401 gives the 290 * precise 60Hz interrupt frequency as ~60.15Hz with a period of 16625.8 us 291 */ 292 #define VIA_60HZ_TIMER_PERIOD_NS 16625800 293 294 /* VIA returns time offset from Jan 1, 1904, not 1970 */ 295 #define RTC_OFFSET 2082844800 296 297 enum { 298 REG_0, 299 REG_1, 300 REG_2, 301 REG_3, 302 REG_TEST, 303 REG_WPROTECT, 304 REG_PRAM_ADDR, 305 REG_PRAM_ADDR_LAST = REG_PRAM_ADDR + 19, 306 REG_PRAM_SECT, 307 REG_PRAM_SECT_LAST = REG_PRAM_SECT + 7, 308 REG_INVALID, 309 REG_EMPTY = 0xff, 310 }; 311 312 static void via1_sixty_hz_update(MOS6522Q800VIA1State *v1s) 313 { 314 /* 60 Hz irq */ 315 v1s->next_sixty_hz = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 316 VIA_60HZ_TIMER_PERIOD_NS) / 317 VIA_60HZ_TIMER_PERIOD_NS * VIA_60HZ_TIMER_PERIOD_NS; 318 timer_mod(v1s->sixty_hz_timer, v1s->next_sixty_hz); 319 } 320 321 static void via1_one_second_update(MOS6522Q800VIA1State *v1s) 322 { 323 v1s->next_second = (qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000) / 324 1000 * 1000; 325 timer_mod(v1s->one_second_timer, v1s->next_second); 326 } 327 328 static void via1_sixty_hz(void *opaque) 329 { 330 MOS6522Q800VIA1State *v1s = opaque; 331 MOS6522State *s = MOS6522(v1s); 332 qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA1_IRQ_60HZ_BIT); 333 334 /* Negative edge trigger */ 335 qemu_irq_lower(irq); 336 qemu_irq_raise(irq); 337 338 via1_sixty_hz_update(v1s); 339 } 340 341 static void via1_one_second(void *opaque) 342 { 343 MOS6522Q800VIA1State *v1s = opaque; 344 MOS6522State *s = MOS6522(v1s); 345 qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA1_IRQ_ONE_SECOND_BIT); 346 347 /* Negative edge trigger */ 348 qemu_irq_lower(irq); 349 qemu_irq_raise(irq); 350 351 via1_one_second_update(v1s); 352 } 353 354 355 static void pram_update(MOS6522Q800VIA1State *v1s) 356 { 357 if (v1s->blk) { 358 if (blk_pwrite(v1s->blk, 0, sizeof(v1s->PRAM), v1s->PRAM, 0) < 0) { 359 qemu_log("pram_update: cannot write to file\n"); 360 } 361 } 362 } 363 364 /* 365 * RTC Commands 366 * 367 * Command byte Register addressed by the command 368 * 369 * z00x0001 Seconds register 0 (lowest-order byte) 370 * z00x0101 Seconds register 1 371 * z00x1001 Seconds register 2 372 * z00x1101 Seconds register 3 (highest-order byte) 373 * 00110001 Test register (write-only) 374 * 00110101 Write-Protect Register (write-only) 375 * z010aa01 RAM address 100aa ($10-$13) (first 20 bytes only) 376 * z1aaaa01 RAM address 0aaaa ($00-$0F) (first 20 bytes only) 377 * z0111aaa Extended memory designator and sector number 378 * 379 * For a read request, z=1, for a write z=0 380 * The letter x indicates don't care 381 * The letter a indicates bits whose value depend on what parameter 382 * RAM byte you want to address 383 */ 384 static int via1_rtc_compact_cmd(uint8_t value) 385 { 386 uint8_t read = value & 0x80; 387 388 value &= 0x7f; 389 390 /* the last 2 bits of a command byte must always be 0b01 ... */ 391 if ((value & 0x78) == 0x38) { 392 /* except for the extended memory designator */ 393 return read | (REG_PRAM_SECT + (value & 0x07)); 394 } 395 if ((value & 0x03) == 0x01) { 396 value >>= 2; 397 if ((value & 0x18) == 0) { 398 /* seconds registers */ 399 return read | (REG_0 + (value & 0x03)); 400 } else if ((value == 0x0c) && !read) { 401 return REG_TEST; 402 } else if ((value == 0x0d) && !read) { 403 return REG_WPROTECT; 404 } else if ((value & 0x1c) == 0x08) { 405 /* RAM address 0x10 to 0x13 */ 406 return read | (REG_PRAM_ADDR + 0x10 + (value & 0x03)); 407 } else if ((value & 0x10) == 0x10) { 408 /* RAM address 0x00 to 0x0f */ 409 return read | (REG_PRAM_ADDR + (value & 0x0f)); 410 } 411 } 412 return REG_INVALID; 413 } 414 415 static void via1_rtc_update(MOS6522Q800VIA1State *v1s) 416 { 417 MOS6522State *s = MOS6522(v1s); 418 int cmd, sector, addr; 419 uint32_t time; 420 421 if (s->b & VIA1B_vRTCEnb) { 422 return; 423 } 424 425 if (s->dirb & VIA1B_vRTCData) { 426 /* send bits to the RTC */ 427 if (!(v1s->last_b & VIA1B_vRTCClk) && (s->b & VIA1B_vRTCClk)) { 428 v1s->data_out <<= 1; 429 v1s->data_out |= s->b & VIA1B_vRTCData; 430 v1s->data_out_cnt++; 431 } 432 trace_via1_rtc_update_data_out(v1s->data_out_cnt, v1s->data_out); 433 } else { 434 trace_via1_rtc_update_data_in(v1s->data_in_cnt, v1s->data_in); 435 /* receive bits from the RTC */ 436 if ((v1s->last_b & VIA1B_vRTCClk) && 437 !(s->b & VIA1B_vRTCClk) && 438 v1s->data_in_cnt) { 439 s->b = (s->b & ~VIA1B_vRTCData) | 440 ((v1s->data_in >> 7) & VIA1B_vRTCData); 441 v1s->data_in <<= 1; 442 v1s->data_in_cnt--; 443 } 444 return; 445 } 446 447 if (v1s->data_out_cnt != 8) { 448 return; 449 } 450 451 v1s->data_out_cnt = 0; 452 453 trace_via1_rtc_internal_status(v1s->cmd, v1s->alt, v1s->data_out); 454 /* first byte: it's a command */ 455 if (v1s->cmd == REG_EMPTY) { 456 457 cmd = via1_rtc_compact_cmd(v1s->data_out); 458 trace_via1_rtc_internal_cmd(cmd); 459 460 if (cmd == REG_INVALID) { 461 trace_via1_rtc_cmd_invalid(v1s->data_out); 462 return; 463 } 464 465 if (cmd & 0x80) { /* this is a read command */ 466 switch (cmd & 0x7f) { 467 case REG_0...REG_3: /* seconds registers */ 468 /* 469 * register 0 is lowest-order byte 470 * register 3 is highest-order byte 471 */ 472 473 time = v1s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) 474 / NANOSECONDS_PER_SECOND); 475 trace_via1_rtc_internal_time(time); 476 v1s->data_in = (time >> ((cmd & 0x03) << 3)) & 0xff; 477 v1s->data_in_cnt = 8; 478 trace_via1_rtc_cmd_seconds_read((cmd & 0x7f) - REG_0, 479 v1s->data_in); 480 break; 481 case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST: 482 /* PRAM address 0x00 -> 0x13 */ 483 v1s->data_in = v1s->PRAM[(cmd & 0x7f) - REG_PRAM_ADDR]; 484 v1s->data_in_cnt = 8; 485 trace_via1_rtc_cmd_pram_read((cmd & 0x7f) - REG_PRAM_ADDR, 486 v1s->data_in); 487 break; 488 case REG_PRAM_SECT...REG_PRAM_SECT_LAST: 489 /* 490 * extended memory designator and sector number 491 * the only two-byte read command 492 */ 493 trace_via1_rtc_internal_set_cmd(cmd); 494 v1s->cmd = cmd; 495 break; 496 default: 497 g_assert_not_reached(); 498 break; 499 } 500 return; 501 } 502 503 /* this is a write command, needs a parameter */ 504 if (cmd == REG_WPROTECT || !v1s->wprotect) { 505 trace_via1_rtc_internal_set_cmd(cmd); 506 v1s->cmd = cmd; 507 } else { 508 trace_via1_rtc_internal_ignore_cmd(cmd); 509 } 510 return; 511 } 512 513 /* second byte: it's a parameter */ 514 if (v1s->alt == REG_EMPTY) { 515 switch (v1s->cmd & 0x7f) { 516 case REG_0...REG_3: /* seconds register */ 517 /* FIXME */ 518 trace_via1_rtc_cmd_seconds_write(v1s->cmd - REG_0, v1s->data_out); 519 v1s->cmd = REG_EMPTY; 520 break; 521 case REG_TEST: 522 /* device control: nothing to do */ 523 trace_via1_rtc_cmd_test_write(v1s->data_out); 524 v1s->cmd = REG_EMPTY; 525 break; 526 case REG_WPROTECT: 527 /* Write Protect register */ 528 trace_via1_rtc_cmd_wprotect_write(v1s->data_out); 529 v1s->wprotect = !!(v1s->data_out & 0x80); 530 v1s->cmd = REG_EMPTY; 531 break; 532 case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST: 533 /* PRAM address 0x00 -> 0x13 */ 534 trace_via1_rtc_cmd_pram_write(v1s->cmd - REG_PRAM_ADDR, 535 v1s->data_out); 536 v1s->PRAM[v1s->cmd - REG_PRAM_ADDR] = v1s->data_out; 537 pram_update(v1s); 538 v1s->cmd = REG_EMPTY; 539 break; 540 case REG_PRAM_SECT...REG_PRAM_SECT_LAST: 541 addr = (v1s->data_out >> 2) & 0x1f; 542 sector = (v1s->cmd & 0x7f) - REG_PRAM_SECT; 543 if (v1s->cmd & 0x80) { 544 /* it's a read */ 545 v1s->data_in = v1s->PRAM[sector * 32 + addr]; 546 v1s->data_in_cnt = 8; 547 trace_via1_rtc_cmd_pram_sect_read(sector, addr, 548 sector * 32 + addr, 549 v1s->data_in); 550 v1s->cmd = REG_EMPTY; 551 } else { 552 /* it's a write, we need one more parameter */ 553 trace_via1_rtc_internal_set_alt(addr, sector, addr); 554 v1s->alt = addr; 555 } 556 break; 557 default: 558 g_assert_not_reached(); 559 break; 560 } 561 return; 562 } 563 564 /* third byte: it's the data of a REG_PRAM_SECT write */ 565 g_assert(REG_PRAM_SECT <= v1s->cmd && v1s->cmd <= REG_PRAM_SECT_LAST); 566 sector = v1s->cmd - REG_PRAM_SECT; 567 v1s->PRAM[sector * 32 + v1s->alt] = v1s->data_out; 568 pram_update(v1s); 569 trace_via1_rtc_cmd_pram_sect_write(sector, v1s->alt, sector * 32 + v1s->alt, 570 v1s->data_out); 571 v1s->alt = REG_EMPTY; 572 v1s->cmd = REG_EMPTY; 573 } 574 575 static void adb_via_poll(void *opaque) 576 { 577 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque); 578 MOS6522State *s = MOS6522(v1s); 579 ADBBusState *adb_bus = &v1s->adb_bus; 580 uint8_t obuf[9]; 581 uint8_t *data = &s->sr; 582 int olen; 583 584 /* 585 * Setting vADBInt below indicates that an autopoll reply has been 586 * received, however we must block autopoll until the point where 587 * the entire reply has been read back to the host 588 */ 589 adb_autopoll_block(adb_bus); 590 591 if (v1s->adb_data_in_size > 0 && v1s->adb_data_in_index == 0) { 592 /* 593 * For older Linux kernels that switch to IDLE mode after sending the 594 * ADB command, detect if there is an existing response and return that 595 * as a "fake" autopoll reply or bus timeout accordingly 596 */ 597 *data = v1s->adb_data_out[0]; 598 olen = v1s->adb_data_in_size; 599 600 s->b &= ~VIA1B_vADBInt; 601 qemu_irq_raise(v1s->adb_data_ready); 602 } else { 603 /* 604 * Otherwise poll as normal 605 */ 606 v1s->adb_data_in_index = 0; 607 v1s->adb_data_out_index = 0; 608 olen = adb_poll(adb_bus, obuf, adb_bus->autopoll_mask); 609 610 if (olen > 0) { 611 /* Autopoll response */ 612 *data = obuf[0]; 613 olen--; 614 memcpy(v1s->adb_data_in, &obuf[1], olen); 615 v1s->adb_data_in_size = olen; 616 617 s->b &= ~VIA1B_vADBInt; 618 qemu_irq_raise(v1s->adb_data_ready); 619 } else { 620 *data = v1s->adb_autopoll_cmd; 621 obuf[0] = 0xff; 622 obuf[1] = 0xff; 623 olen = 2; 624 625 memcpy(v1s->adb_data_in, obuf, olen); 626 v1s->adb_data_in_size = olen; 627 628 s->b &= ~VIA1B_vADBInt; 629 qemu_irq_raise(v1s->adb_data_ready); 630 } 631 } 632 633 trace_via1_adb_poll(*data, (s->b & VIA1B_vADBInt) ? "+" : "-", 634 adb_bus->status, v1s->adb_data_in_index, olen); 635 } 636 637 static int adb_via_send_len(uint8_t data) 638 { 639 /* Determine the send length from the given ADB command */ 640 uint8_t cmd = data & 0xc; 641 uint8_t reg = data & 0x3; 642 643 switch (cmd) { 644 case 0x8: 645 /* Listen command */ 646 switch (reg) { 647 case 2: 648 /* Register 2 is only used for the keyboard */ 649 return 3; 650 case 3: 651 /* 652 * Fortunately our devices only implement writes 653 * to register 3 which is fixed at 2 bytes 654 */ 655 return 3; 656 default: 657 qemu_log_mask(LOG_UNIMP, "ADB unknown length for register %d\n", 658 reg); 659 return 1; 660 } 661 default: 662 /* Talk, BusReset */ 663 return 1; 664 } 665 } 666 667 static void adb_via_send(MOS6522Q800VIA1State *v1s, int state, uint8_t data) 668 { 669 MOS6522State *ms = MOS6522(v1s); 670 ADBBusState *adb_bus = &v1s->adb_bus; 671 uint16_t autopoll_mask; 672 673 switch (state) { 674 case ADB_STATE_NEW: 675 /* 676 * Command byte: vADBInt tells host autopoll data already present 677 * in VIA shift register and ADB transceiver 678 */ 679 adb_autopoll_block(adb_bus); 680 681 if (adb_bus->status & ADB_STATUS_POLLREPLY) { 682 /* Tell the host the existing data is from autopoll */ 683 ms->b &= ~VIA1B_vADBInt; 684 } else { 685 ms->b |= VIA1B_vADBInt; 686 v1s->adb_data_out_index = 0; 687 v1s->adb_data_out[v1s->adb_data_out_index++] = data; 688 } 689 690 trace_via1_adb_send(" NEW", data, (ms->b & VIA1B_vADBInt) ? "+" : "-"); 691 qemu_irq_raise(v1s->adb_data_ready); 692 break; 693 694 case ADB_STATE_EVEN: 695 case ADB_STATE_ODD: 696 ms->b |= VIA1B_vADBInt; 697 v1s->adb_data_out[v1s->adb_data_out_index++] = data; 698 699 trace_via1_adb_send(state == ADB_STATE_EVEN ? "EVEN" : " ODD", 700 data, (ms->b & VIA1B_vADBInt) ? "+" : "-"); 701 qemu_irq_raise(v1s->adb_data_ready); 702 break; 703 704 case ADB_STATE_IDLE: 705 ms->b |= VIA1B_vADBInt; 706 adb_autopoll_unblock(adb_bus); 707 708 trace_via1_adb_send("IDLE", data, 709 (ms->b & VIA1B_vADBInt) ? "+" : "-"); 710 711 return; 712 } 713 714 /* If the command is complete, execute it */ 715 if (v1s->adb_data_out_index == adb_via_send_len(v1s->adb_data_out[0])) { 716 v1s->adb_data_in_size = adb_request(adb_bus, v1s->adb_data_in, 717 v1s->adb_data_out, 718 v1s->adb_data_out_index); 719 v1s->adb_data_in_index = 0; 720 721 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) { 722 /* 723 * Bus timeout (but allow first EVEN and ODD byte to indicate 724 * timeout via vADBInt and SRQ status) 725 */ 726 v1s->adb_data_in[0] = 0xff; 727 v1s->adb_data_in[1] = 0xff; 728 v1s->adb_data_in_size = 2; 729 } 730 731 /* 732 * If last command is TALK, store it for use by autopoll and adjust 733 * the autopoll mask accordingly 734 */ 735 if ((v1s->adb_data_out[0] & 0xc) == 0xc) { 736 v1s->adb_autopoll_cmd = v1s->adb_data_out[0]; 737 738 autopoll_mask = 1 << (v1s->adb_autopoll_cmd >> 4); 739 adb_set_autopoll_mask(adb_bus, autopoll_mask); 740 } 741 } 742 } 743 744 static void adb_via_receive(MOS6522Q800VIA1State *v1s, int state, uint8_t *data) 745 { 746 MOS6522State *ms = MOS6522(v1s); 747 ADBBusState *adb_bus = &v1s->adb_bus; 748 uint16_t pending; 749 750 switch (state) { 751 case ADB_STATE_NEW: 752 ms->b |= VIA1B_vADBInt; 753 return; 754 755 case ADB_STATE_IDLE: 756 ms->b |= VIA1B_vADBInt; 757 adb_autopoll_unblock(adb_bus); 758 759 trace_via1_adb_receive("IDLE", *data, 760 (ms->b & VIA1B_vADBInt) ? "+" : "-", adb_bus->status, 761 v1s->adb_data_in_index, v1s->adb_data_in_size); 762 763 break; 764 765 case ADB_STATE_EVEN: 766 case ADB_STATE_ODD: 767 switch (v1s->adb_data_in_index) { 768 case 0: 769 /* First EVEN byte: vADBInt indicates bus timeout */ 770 *data = v1s->adb_data_in[v1s->adb_data_in_index]; 771 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) { 772 ms->b &= ~VIA1B_vADBInt; 773 } else { 774 ms->b |= VIA1B_vADBInt; 775 } 776 777 trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD", 778 *data, (ms->b & VIA1B_vADBInt) ? "+" : "-", 779 adb_bus->status, v1s->adb_data_in_index, 780 v1s->adb_data_in_size); 781 782 v1s->adb_data_in_index++; 783 break; 784 785 case 1: 786 /* First ODD byte: vADBInt indicates SRQ */ 787 *data = v1s->adb_data_in[v1s->adb_data_in_index]; 788 pending = adb_bus->pending & ~(1 << (v1s->adb_autopoll_cmd >> 4)); 789 if (pending) { 790 ms->b &= ~VIA1B_vADBInt; 791 } else { 792 ms->b |= VIA1B_vADBInt; 793 } 794 795 trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD", 796 *data, (ms->b & VIA1B_vADBInt) ? "+" : "-", 797 adb_bus->status, v1s->adb_data_in_index, 798 v1s->adb_data_in_size); 799 800 v1s->adb_data_in_index++; 801 break; 802 803 default: 804 /* 805 * Otherwise vADBInt indicates end of data. Note that Linux 806 * specifically checks for the sequence 0x0 0xff to confirm the 807 * end of the poll reply, so provide these extra bytes below to 808 * keep it happy 809 */ 810 if (v1s->adb_data_in_index < v1s->adb_data_in_size) { 811 /* Next data byte */ 812 *data = v1s->adb_data_in[v1s->adb_data_in_index]; 813 ms->b |= VIA1B_vADBInt; 814 } else if (v1s->adb_data_in_index == v1s->adb_data_in_size) { 815 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) { 816 /* Bus timeout (no more data) */ 817 *data = 0xff; 818 } else { 819 /* Return 0x0 after reply */ 820 *data = 0; 821 } 822 ms->b &= ~VIA1B_vADBInt; 823 } else { 824 /* Bus timeout (no more data) */ 825 *data = 0xff; 826 ms->b &= ~VIA1B_vADBInt; 827 adb_bus->status = 0; 828 adb_autopoll_unblock(adb_bus); 829 } 830 831 trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD", 832 *data, (ms->b & VIA1B_vADBInt) ? "+" : "-", 833 adb_bus->status, v1s->adb_data_in_index, 834 v1s->adb_data_in_size); 835 836 if (v1s->adb_data_in_index <= v1s->adb_data_in_size) { 837 v1s->adb_data_in_index++; 838 } 839 break; 840 } 841 842 qemu_irq_raise(v1s->adb_data_ready); 843 break; 844 } 845 } 846 847 static void via1_adb_update(MOS6522Q800VIA1State *v1s) 848 { 849 MOS6522State *s = MOS6522(v1s); 850 int oldstate, state; 851 852 oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift; 853 state = (s->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift; 854 855 if (state != oldstate) { 856 if (s->acr & VIA1ACR_vShiftOut) { 857 /* output mode */ 858 adb_via_send(v1s, state, s->sr); 859 } else { 860 /* input mode */ 861 adb_via_receive(v1s, state, &s->sr); 862 } 863 } 864 } 865 866 static void via1_auxmode_update(MOS6522Q800VIA1State *v1s) 867 { 868 MOS6522State *s = MOS6522(v1s); 869 int oldirq, irq; 870 871 oldirq = (v1s->last_b & VIA1B_vMystery) ? 1 : 0; 872 irq = (s->b & VIA1B_vMystery) ? 1 : 0; 873 874 /* Check to see if the A/UX mode bit has changed */ 875 if (irq != oldirq) { 876 trace_via1_auxmode(irq); 877 qemu_set_irq(v1s->auxmode_irq, irq); 878 879 /* 880 * Clear the ADB interrupt. MacOS can leave VIA1B_vADBInt asserted 881 * (low) if a poll sequence doesn't complete before NetBSD disables 882 * interrupts upon boot. Fortunately NetBSD switches to the so-called 883 * "A/UX" interrupt mode after it initialises, so we can use this as 884 * a convenient place to clear the ADB interrupt for now. 885 */ 886 s->b |= VIA1B_vADBInt; 887 } 888 } 889 890 /* 891 * Addresses and real values for TimeDBRA/TimeSCCB to allow timer calibration 892 * to succeed (NOTE: both values have been multiplied by 3 to cope with the 893 * speed of QEMU execution on a modern host 894 */ 895 #define MACOS_TIMEDBRA 0xd00 896 #define MACOS_TIMESCCB 0xd02 897 898 #define MACOS_TIMEDBRA_VALUE (0x2a00 * 3) 899 #define MACOS_TIMESCCB_VALUE (0x079d * 3) 900 901 static bool via1_is_toolbox_timer_calibrated(void) 902 { 903 /* 904 * Indicate whether the MacOS toolbox has been calibrated by checking 905 * for the value of our magic constants 906 */ 907 uint16_t timedbra = lduw_be_phys(&address_space_memory, MACOS_TIMEDBRA); 908 uint16_t timesccdb = lduw_be_phys(&address_space_memory, MACOS_TIMESCCB); 909 910 return (timedbra == MACOS_TIMEDBRA_VALUE && 911 timesccdb == MACOS_TIMESCCB_VALUE); 912 } 913 914 static void via1_timer_calibration_hack(MOS6522Q800VIA1State *v1s, int addr, 915 uint64_t val, int size) 916 { 917 /* 918 * Work around timer calibration to ensure we that we have non-zero and 919 * known good values for TIMEDRBA and TIMESCCDB. 920 * 921 * This works by attempting to detect the reset and calibration sequence 922 * of writes to VIA1 923 */ 924 int old_timer_hack_state = v1s->timer_hack_state; 925 926 switch (v1s->timer_hack_state) { 927 case 0: 928 if (addr == VIA_REG_PCR && val == 0x22) { 929 /* VIA_REG_PCR: configure VIA1 edge triggering */ 930 v1s->timer_hack_state = 1; 931 } 932 break; 933 case 1: 934 if (addr == VIA_REG_T2CL && val == 0xc) { 935 /* VIA_REG_T2CL: low byte of 1ms counter */ 936 if (!via1_is_toolbox_timer_calibrated()) { 937 v1s->timer_hack_state = 2; 938 } else { 939 v1s->timer_hack_state = 0; 940 } 941 } 942 break; 943 case 2: 944 if (addr == VIA_REG_T2CH && val == 0x3) { 945 /* 946 * VIA_REG_T2CH: high byte of 1ms counter (very likely at the 947 * start of SETUPTIMEK) 948 */ 949 if (!via1_is_toolbox_timer_calibrated()) { 950 v1s->timer_hack_state = 3; 951 } else { 952 v1s->timer_hack_state = 0; 953 } 954 } 955 break; 956 case 3: 957 if (addr == VIA_REG_IER && val == 0x20) { 958 /* 959 * VIA_REG_IER: update at end of SETUPTIMEK 960 * 961 * Timer calibration has finished: unfortunately the values in 962 * TIMEDBRA (0xd00) and TIMESCCDB (0xd02) are so far out they 963 * cause divide by zero errors. 964 * 965 * Update them with values obtained from a real Q800 but with 966 * a x3 scaling factor which seems to work well 967 */ 968 stw_be_phys(&address_space_memory, MACOS_TIMEDBRA, 969 MACOS_TIMEDBRA_VALUE); 970 stw_be_phys(&address_space_memory, MACOS_TIMESCCB, 971 MACOS_TIMESCCB_VALUE); 972 973 v1s->timer_hack_state = 4; 974 } 975 break; 976 case 4: 977 /* 978 * This is the normal post-calibration timer state: we should 979 * generally remain here unless we detect the A/UX calibration 980 * loop, or a write to VIA_REG_PCR suggesting a reset 981 */ 982 if (addr == VIA_REG_PCR && val == 0x22) { 983 /* Looks like there has been a reset? */ 984 v1s->timer_hack_state = 1; 985 } 986 987 if (addr == VIA_REG_T2CL && val == 0xf0) { 988 /* VIA_REG_T2CL: low byte of counter (A/UX) */ 989 v1s->timer_hack_state = 5; 990 } 991 break; 992 case 5: 993 if (addr == VIA_REG_T2CH && val == 0x3c) { 994 /* 995 * VIA_REG_T2CH: high byte of counter (A/UX). We are now extremely 996 * likely to be in the A/UX timer calibration routine, so move to 997 * the next state where we enable the calibration hack. 998 */ 999 v1s->timer_hack_state = 6; 1000 } else if ((addr == VIA_REG_IER && val == 0x20) || 1001 addr == VIA_REG_T2CH) { 1002 /* We're doing something else with the timer, not calibration */ 1003 v1s->timer_hack_state = 0; 1004 } 1005 break; 1006 case 6: 1007 if ((addr == VIA_REG_IER && val == 0x20) || addr == VIA_REG_T2CH) { 1008 /* End of A/UX timer calibration routine, or another write */ 1009 v1s->timer_hack_state = 7; 1010 } else { 1011 v1s->timer_hack_state = 0; 1012 } 1013 break; 1014 case 7: 1015 /* 1016 * This is the normal post-calibration timer state once both the 1017 * MacOS toolbox and A/UX have been calibrated, until we see a write 1018 * to VIA_REG_PCR to suggest a reset 1019 */ 1020 if (addr == VIA_REG_PCR && val == 0x22) { 1021 /* Looks like there has been a reset? */ 1022 v1s->timer_hack_state = 1; 1023 } 1024 break; 1025 default: 1026 g_assert_not_reached(); 1027 } 1028 1029 if (old_timer_hack_state != v1s->timer_hack_state) { 1030 trace_via1_timer_hack_state(v1s->timer_hack_state); 1031 } 1032 } 1033 1034 static uint64_t mos6522_q800_via1_read(void *opaque, hwaddr addr, unsigned size) 1035 { 1036 MOS6522Q800VIA1State *s = MOS6522_Q800_VIA1(opaque); 1037 MOS6522State *ms = MOS6522(s); 1038 uint64_t ret; 1039 int64_t now; 1040 1041 addr = (addr >> 9) & 0xf; 1042 ret = mos6522_read(ms, addr, size); 1043 switch (addr) { 1044 case VIA_REG_A: 1045 case VIA_REG_ANH: 1046 /* Quadra 800 Id */ 1047 ret = (ret & ~VIA1A_CPUID_MASK) | VIA1A_CPUID_Q800; 1048 break; 1049 case VIA_REG_T2CH: 1050 if (s->timer_hack_state == 6) { 1051 /* 1052 * The A/UX timer calibration loop runs continuously until 2 1053 * consecutive iterations differ by at least 0x492 timer ticks. 1054 * Modern hosts execute the timer calibration loop so fast that 1055 * this situation never occurs causing a hang on boot. Use a 1056 * similar method to Shoebill which is to randomly add 0x500 to 1057 * the T2 counter value during calibration to enable it to 1058 * eventually succeed. 1059 */ 1060 now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 1061 if (now & 1) { 1062 ret += 0x5; 1063 } 1064 } 1065 break; 1066 } 1067 return ret; 1068 } 1069 1070 static void mos6522_q800_via1_write(void *opaque, hwaddr addr, uint64_t val, 1071 unsigned size) 1072 { 1073 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque); 1074 MOS6522State *ms = MOS6522(v1s); 1075 int oldstate, state; 1076 int oldsr = ms->sr; 1077 1078 addr = (addr >> 9) & 0xf; 1079 1080 via1_timer_calibration_hack(v1s, addr, val, size); 1081 1082 mos6522_write(ms, addr, val, size); 1083 1084 switch (addr) { 1085 case VIA_REG_B: 1086 via1_rtc_update(v1s); 1087 via1_adb_update(v1s); 1088 via1_auxmode_update(v1s); 1089 1090 v1s->last_b = ms->b; 1091 break; 1092 1093 case VIA_REG_SR: 1094 { 1095 /* 1096 * NetBSD assumes it can send its first ADB command after sending 1097 * the ADB_BUSRESET command in ADB_STATE_NEW without changing the 1098 * state back to ADB_STATE_IDLE first as detailed in the ADB 1099 * protocol. 1100 * 1101 * Add a workaround to detect this condition at the start of ADB 1102 * enumeration and send the next command written to SR after a 1103 * ADB_BUSRESET onto the bus regardless, even if we don't detect a 1104 * state transition to ADB_STATE_NEW. 1105 * 1106 * Note that in my tests the NetBSD state machine takes one ADB 1107 * operation to recover which means the probe for an ADB device at 1108 * address 1 always fails. However since the first device is at 1109 * address 2 then this will work fine, without having to come up 1110 * with a more complicated and invasive solution. 1111 */ 1112 oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >> 1113 VIA1B_vADB_StateShift; 1114 state = (ms->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift; 1115 1116 if (oldstate == ADB_STATE_NEW && state == ADB_STATE_NEW && 1117 (ms->acr & VIA1ACR_vShiftOut) && 1118 oldsr == 0 /* ADB_BUSRESET */) { 1119 trace_via1_adb_netbsd_enum_hack(); 1120 adb_via_send(v1s, state, ms->sr); 1121 } 1122 } 1123 break; 1124 } 1125 } 1126 1127 static const MemoryRegionOps mos6522_q800_via1_ops = { 1128 .read = mos6522_q800_via1_read, 1129 .write = mos6522_q800_via1_write, 1130 .endianness = DEVICE_BIG_ENDIAN, 1131 .valid = { 1132 .min_access_size = 1, 1133 .max_access_size = 4, 1134 }, 1135 }; 1136 1137 static uint64_t mos6522_q800_via2_read(void *opaque, hwaddr addr, unsigned size) 1138 { 1139 MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque); 1140 MOS6522State *ms = MOS6522(s); 1141 uint64_t val; 1142 1143 addr = (addr >> 9) & 0xf; 1144 val = mos6522_read(ms, addr, size); 1145 1146 switch (addr) { 1147 case VIA_REG_IFR: 1148 /* 1149 * On a Q800 an emulated VIA2 is integrated into the onboard logic. The 1150 * expectation of most OSs is that the DRQ bit is live, rather than 1151 * latched as it would be on a real VIA so do the same here. 1152 * 1153 * Note: DRQ is negative edge triggered 1154 */ 1155 val &= ~VIA2_IRQ_SCSI_DATA; 1156 val |= (~ms->last_irq_levels & VIA2_IRQ_SCSI_DATA); 1157 break; 1158 } 1159 1160 return val; 1161 } 1162 1163 static void mos6522_q800_via2_write(void *opaque, hwaddr addr, uint64_t val, 1164 unsigned size) 1165 { 1166 MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque); 1167 MOS6522State *ms = MOS6522(s); 1168 1169 addr = (addr >> 9) & 0xf; 1170 mos6522_write(ms, addr, val, size); 1171 } 1172 1173 static const MemoryRegionOps mos6522_q800_via2_ops = { 1174 .read = mos6522_q800_via2_read, 1175 .write = mos6522_q800_via2_write, 1176 .endianness = DEVICE_BIG_ENDIAN, 1177 .valid = { 1178 .min_access_size = 1, 1179 .max_access_size = 4, 1180 }, 1181 }; 1182 1183 static void via1_postload_update_cb(void *opaque, bool running, RunState state) 1184 { 1185 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque); 1186 1187 qemu_del_vm_change_state_handler(v1s->vmstate); 1188 v1s->vmstate = NULL; 1189 1190 pram_update(v1s); 1191 } 1192 1193 static int via1_post_load(void *opaque, int version_id) 1194 { 1195 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque); 1196 1197 if (v1s->blk) { 1198 v1s->vmstate = qemu_add_vm_change_state_handler( 1199 via1_postload_update_cb, v1s); 1200 } 1201 1202 return 0; 1203 } 1204 1205 /* VIA 1 */ 1206 static void mos6522_q800_via1_reset_hold(Object *obj) 1207 { 1208 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj); 1209 MOS6522State *ms = MOS6522(v1s); 1210 MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms); 1211 ADBBusState *adb_bus = &v1s->adb_bus; 1212 1213 if (mdc->parent_phases.hold) { 1214 mdc->parent_phases.hold(obj); 1215 } 1216 1217 ms->timers[0].frequency = VIA_TIMER_FREQ; 1218 ms->timers[1].frequency = VIA_TIMER_FREQ; 1219 1220 ms->b = VIA1B_vADB_StateMask | VIA1B_vADBInt | VIA1B_vRTCEnb; 1221 1222 /* ADB/RTC */ 1223 adb_set_autopoll_enabled(adb_bus, true); 1224 v1s->cmd = REG_EMPTY; 1225 v1s->alt = REG_EMPTY; 1226 1227 /* Timer calibration hack */ 1228 v1s->timer_hack_state = 0; 1229 } 1230 1231 static void mos6522_q800_via1_realize(DeviceState *dev, Error **errp) 1232 { 1233 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(dev); 1234 ADBBusState *adb_bus = &v1s->adb_bus; 1235 struct tm tm; 1236 int ret; 1237 1238 v1s->one_second_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, via1_one_second, 1239 v1s); 1240 via1_one_second_update(v1s); 1241 v1s->sixty_hz_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, via1_sixty_hz, 1242 v1s); 1243 via1_sixty_hz_update(v1s); 1244 1245 qemu_get_timedate(&tm, 0); 1246 v1s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET; 1247 1248 adb_register_autopoll_callback(adb_bus, adb_via_poll, v1s); 1249 v1s->adb_data_ready = qdev_get_gpio_in(dev, VIA1_IRQ_ADB_READY_BIT); 1250 1251 if (v1s->blk) { 1252 int64_t len = blk_getlength(v1s->blk); 1253 if (len < 0) { 1254 error_setg_errno(errp, -len, 1255 "could not get length of backing image"); 1256 return; 1257 } 1258 ret = blk_set_perm(v1s->blk, 1259 BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE, 1260 BLK_PERM_ALL, errp); 1261 if (ret < 0) { 1262 return; 1263 } 1264 1265 ret = blk_pread(v1s->blk, 0, sizeof(v1s->PRAM), v1s->PRAM, 0); 1266 if (ret < 0) { 1267 error_setg(errp, "can't read PRAM contents"); 1268 return; 1269 } 1270 } 1271 } 1272 1273 static void mos6522_q800_via1_init(Object *obj) 1274 { 1275 MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj); 1276 SysBusDevice *sbd = SYS_BUS_DEVICE(v1s); 1277 1278 memory_region_init_io(&v1s->via_mem, obj, &mos6522_q800_via1_ops, v1s, 1279 "via1", VIA_SIZE); 1280 sysbus_init_mmio(sbd, &v1s->via_mem); 1281 1282 /* ADB */ 1283 qbus_init((BusState *)&v1s->adb_bus, sizeof(v1s->adb_bus), 1284 TYPE_ADB_BUS, DEVICE(v1s), "adb.0"); 1285 1286 /* A/UX mode */ 1287 qdev_init_gpio_out(DEVICE(obj), &v1s->auxmode_irq, 1); 1288 } 1289 1290 static const VMStateDescription vmstate_q800_via1 = { 1291 .name = "q800-via1", 1292 .version_id = 0, 1293 .minimum_version_id = 0, 1294 .post_load = via1_post_load, 1295 .fields = (const VMStateField[]) { 1296 VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA1State, 0, vmstate_mos6522, 1297 MOS6522State), 1298 VMSTATE_UINT8(last_b, MOS6522Q800VIA1State), 1299 /* RTC */ 1300 VMSTATE_BUFFER(PRAM, MOS6522Q800VIA1State), 1301 VMSTATE_UINT32(tick_offset, MOS6522Q800VIA1State), 1302 VMSTATE_UINT8(data_out, MOS6522Q800VIA1State), 1303 VMSTATE_INT32(data_out_cnt, MOS6522Q800VIA1State), 1304 VMSTATE_UINT8(data_in, MOS6522Q800VIA1State), 1305 VMSTATE_UINT8(data_in_cnt, MOS6522Q800VIA1State), 1306 VMSTATE_UINT8(cmd, MOS6522Q800VIA1State), 1307 VMSTATE_INT32(wprotect, MOS6522Q800VIA1State), 1308 VMSTATE_INT32(alt, MOS6522Q800VIA1State), 1309 /* ADB */ 1310 VMSTATE_INT32(adb_data_in_size, MOS6522Q800VIA1State), 1311 VMSTATE_INT32(adb_data_in_index, MOS6522Q800VIA1State), 1312 VMSTATE_INT32(adb_data_out_index, MOS6522Q800VIA1State), 1313 VMSTATE_BUFFER(adb_data_in, MOS6522Q800VIA1State), 1314 VMSTATE_BUFFER(adb_data_out, MOS6522Q800VIA1State), 1315 VMSTATE_UINT8(adb_autopoll_cmd, MOS6522Q800VIA1State), 1316 /* Timers */ 1317 VMSTATE_TIMER_PTR(one_second_timer, MOS6522Q800VIA1State), 1318 VMSTATE_INT64(next_second, MOS6522Q800VIA1State), 1319 VMSTATE_TIMER_PTR(sixty_hz_timer, MOS6522Q800VIA1State), 1320 VMSTATE_INT64(next_sixty_hz, MOS6522Q800VIA1State), 1321 /* Timer hack */ 1322 VMSTATE_INT32(timer_hack_state, MOS6522Q800VIA1State), 1323 VMSTATE_END_OF_LIST() 1324 } 1325 }; 1326 1327 static Property mos6522_q800_via1_properties[] = { 1328 DEFINE_PROP_DRIVE("drive", MOS6522Q800VIA1State, blk), 1329 DEFINE_PROP_END_OF_LIST(), 1330 }; 1331 1332 static void mos6522_q800_via1_class_init(ObjectClass *oc, void *data) 1333 { 1334 DeviceClass *dc = DEVICE_CLASS(oc); 1335 ResettableClass *rc = RESETTABLE_CLASS(oc); 1336 MOS6522DeviceClass *mdc = MOS6522_CLASS(oc); 1337 1338 dc->realize = mos6522_q800_via1_realize; 1339 resettable_class_set_parent_phases(rc, NULL, mos6522_q800_via1_reset_hold, 1340 NULL, &mdc->parent_phases); 1341 dc->vmsd = &vmstate_q800_via1; 1342 device_class_set_props(dc, mos6522_q800_via1_properties); 1343 } 1344 1345 static const TypeInfo mos6522_q800_via1_type_info = { 1346 .name = TYPE_MOS6522_Q800_VIA1, 1347 .parent = TYPE_MOS6522, 1348 .instance_size = sizeof(MOS6522Q800VIA1State), 1349 .instance_init = mos6522_q800_via1_init, 1350 .class_init = mos6522_q800_via1_class_init, 1351 }; 1352 1353 /* VIA 2 */ 1354 static void mos6522_q800_via2_portB_write(MOS6522State *s) 1355 { 1356 if (s->dirb & VIA2B_vPower && (s->b & VIA2B_vPower) == 0) { 1357 /* shutdown */ 1358 qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN); 1359 } 1360 } 1361 1362 static void mos6522_q800_via2_reset_hold(Object *obj) 1363 { 1364 MOS6522State *ms = MOS6522(obj); 1365 MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms); 1366 1367 if (mdc->parent_phases.hold) { 1368 mdc->parent_phases.hold(obj); 1369 } 1370 1371 ms->timers[0].frequency = VIA_TIMER_FREQ; 1372 ms->timers[1].frequency = VIA_TIMER_FREQ; 1373 1374 ms->dirb = 0; 1375 ms->b = 0; 1376 ms->dira = 0; 1377 ms->a = 0x7f; 1378 } 1379 1380 static void via2_nubus_irq_request(void *opaque, int n, int level) 1381 { 1382 MOS6522Q800VIA2State *v2s = opaque; 1383 MOS6522State *s = MOS6522(v2s); 1384 qemu_irq irq = qdev_get_gpio_in(DEVICE(s), VIA2_IRQ_NUBUS_BIT); 1385 1386 if (level) { 1387 /* Port A nubus IRQ inputs are active LOW */ 1388 s->a &= ~(1 << n); 1389 } else { 1390 s->a |= (1 << n); 1391 } 1392 1393 /* Negative edge trigger */ 1394 qemu_set_irq(irq, !level); 1395 } 1396 1397 static void mos6522_q800_via2_init(Object *obj) 1398 { 1399 MOS6522Q800VIA2State *v2s = MOS6522_Q800_VIA2(obj); 1400 SysBusDevice *sbd = SYS_BUS_DEVICE(v2s); 1401 1402 memory_region_init_io(&v2s->via_mem, obj, &mos6522_q800_via2_ops, v2s, 1403 "via2", VIA_SIZE); 1404 sysbus_init_mmio(sbd, &v2s->via_mem); 1405 1406 qdev_init_gpio_in_named(DEVICE(obj), via2_nubus_irq_request, "nubus-irq", 1407 VIA2_NUBUS_IRQ_NB); 1408 } 1409 1410 static const VMStateDescription vmstate_q800_via2 = { 1411 .name = "q800-via2", 1412 .version_id = 0, 1413 .minimum_version_id = 0, 1414 .fields = (const VMStateField[]) { 1415 VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA2State, 0, vmstate_mos6522, 1416 MOS6522State), 1417 VMSTATE_END_OF_LIST() 1418 } 1419 }; 1420 1421 static void mos6522_q800_via2_class_init(ObjectClass *oc, void *data) 1422 { 1423 DeviceClass *dc = DEVICE_CLASS(oc); 1424 ResettableClass *rc = RESETTABLE_CLASS(oc); 1425 MOS6522DeviceClass *mdc = MOS6522_CLASS(oc); 1426 1427 resettable_class_set_parent_phases(rc, NULL, mos6522_q800_via2_reset_hold, 1428 NULL, &mdc->parent_phases); 1429 dc->vmsd = &vmstate_q800_via2; 1430 mdc->portB_write = mos6522_q800_via2_portB_write; 1431 } 1432 1433 static const TypeInfo mos6522_q800_via2_type_info = { 1434 .name = TYPE_MOS6522_Q800_VIA2, 1435 .parent = TYPE_MOS6522, 1436 .instance_size = sizeof(MOS6522Q800VIA2State), 1437 .instance_init = mos6522_q800_via2_init, 1438 .class_init = mos6522_q800_via2_class_init, 1439 }; 1440 1441 static void mac_via_register_types(void) 1442 { 1443 type_register_static(&mos6522_q800_via1_type_info); 1444 type_register_static(&mos6522_q800_via2_type_info); 1445 } 1446 1447 type_init(mac_via_register_types); 1448