xref: /openbmc/qemu/hw/misc/mac_via.c (revision 729cc683)
1 /*
2  * QEMU m68k Macintosh VIA device support
3  *
4  * Copyright (c) 2011-2018 Laurent Vivier
5  * Copyright (c) 2018 Mark Cave-Ayland
6  *
7  * Some parts from hw/misc/macio/cuda.c
8  *
9  * Copyright (c) 2004-2007 Fabrice Bellard
10  * Copyright (c) 2007 Jocelyn Mayer
11  *
12  * some parts from linux-2.6.29, arch/m68k/include/asm/mac_via.h
13  *
14  * This work is licensed under the terms of the GNU GPL, version 2 or later.
15  * See the COPYING file in the top-level directory.
16  */
17 
18 #include "qemu/osdep.h"
19 #include "qemu-common.h"
20 #include "migration/vmstate.h"
21 #include "hw/sysbus.h"
22 #include "hw/irq.h"
23 #include "qemu/timer.h"
24 #include "hw/misc/mac_via.h"
25 #include "hw/misc/mos6522.h"
26 #include "hw/input/adb.h"
27 #include "sysemu/runstate.h"
28 #include "qapi/error.h"
29 #include "qemu/cutils.h"
30 #include "hw/qdev-properties.h"
31 #include "hw/qdev-properties-system.h"
32 #include "sysemu/block-backend.h"
33 #include "trace.h"
34 #include "qemu/log.h"
35 
36 /*
37  * VIAs: There are two in every machine,
38  */
39 
40 #define VIA_SIZE (0x2000)
41 
42 /*
43  * Not all of these are true post MacII I think.
44  * CSA: probably the ones CHRP marks as 'unused' change purposes
45  * when the IWM becomes the SWIM.
46  * http://www.rs6000.ibm.com/resource/technology/chrpio/via5.mak.html
47  * ftp://ftp.austin.ibm.com/pub/technology/spec/chrp/inwork/CHRP_IORef_1.0.pdf
48  *
49  * also, http://developer.apple.com/technotes/hw/hw_09.html claims the
50  * following changes for IIfx:
51  * VIA1A_vSccWrReq not available and that VIA1A_vSync has moved to an IOP.
52  * Also, "All of the functionality of VIA2 has been moved to other chips".
53  */
54 
55 #define VIA1A_vSccWrReq 0x80   /*
56                                 * SCC write. (input)
57                                 * [CHRP] SCC WREQ: Reflects the state of the
58                                 * Wait/Request pins from the SCC.
59                                 * [Macintosh Family Hardware]
60                                 * as CHRP on SE/30,II,IIx,IIcx,IIci.
61                                 * on IIfx, "0 means an active request"
62                                 */
63 #define VIA1A_vRev8     0x40   /*
64                                 * Revision 8 board ???
65                                 * [CHRP] En WaitReqB: Lets the WaitReq_L
66                                 * signal from port B of the SCC appear on
67                                 * the PA7 input pin. Output.
68                                 * [Macintosh Family] On the SE/30, this
69                                 * is the bit to flip screen buffers.
70                                 * 0=alternate, 1=main.
71                                 * on II,IIx,IIcx,IIci,IIfx this is a bit
72                                 * for Rev ID. 0=II,IIx, 1=IIcx,IIci,IIfx
73                                 */
74 #define VIA1A_vHeadSel  0x20   /*
75                                 * Head select for IWM.
76                                 * [CHRP] unused.
77                                 * [Macintosh Family] "Floppy disk
78                                 * state-control line SEL" on all but IIfx
79                                 */
80 #define VIA1A_vOverlay  0x10   /*
81                                 * [Macintosh Family] On SE/30,II,IIx,IIcx
82                                 * this bit enables the "Overlay" address
83                                 * map in the address decoders as it is on
84                                 * reset for mapping the ROM over the reset
85                                 * vector. 1=use overlay map.
86                                 * On the IIci,IIfx it is another bit of the
87                                 * CPU ID: 0=normal IIci, 1=IIci with parity
88                                 * feature or IIfx.
89                                 * [CHRP] En WaitReqA: Lets the WaitReq_L
90                                 * signal from port A of the SCC appear
91                                 * on the PA7 input pin (CHRP). Output.
92                                 * [MkLinux] "Drive Select"
93                                 *  (with 0x20 being 'disk head select')
94                                 */
95 #define VIA1A_vSync     0x08   /*
96                                 * [CHRP] Sync Modem: modem clock select:
97                                 * 1: select the external serial clock to
98                                 *    drive the SCC's /RTxCA pin.
99                                 * 0: Select the 3.6864MHz clock to drive
100                                 *    the SCC cell.
101                                 * [Macintosh Family] Correct on all but IIfx
102                                 */
103 
104 /*
105  * Macintosh Family Hardware sez: bits 0-2 of VIA1A are volume control
106  * on Macs which had the PWM sound hardware.  Reserved on newer models.
107  * On IIci,IIfx, bits 1-2 are the rest of the CPU ID:
108  * bit 2: 1=IIci, 0=IIfx
109  * bit 1: 1 on both IIci and IIfx.
110  * MkLinux sez bit 0 is 'burnin flag' in this case.
111  * CHRP sez: VIA1A bits 0-2 and 5 are 'unused': if programmed as
112  * inputs, these bits will read 0.
113  */
114 #define VIA1A_vVolume   0x07    /* Audio volume mask for PWM */
115 #define VIA1A_CPUID0    0x02    /* CPU id bit 0 on RBV, others */
116 #define VIA1A_CPUID1    0x04    /* CPU id bit 0 on RBV, others */
117 #define VIA1A_CPUID2    0x10    /* CPU id bit 0 on RBV, others */
118 #define VIA1A_CPUID3    0x40    /* CPU id bit 0 on RBV, others */
119 
120 /*
121  * Info on VIA1B is from Macintosh Family Hardware & MkLinux.
122  * CHRP offers no info.
123  */
124 #define VIA1B_vSound   0x80    /*
125                                 * Sound enable (for compatibility with
126                                 * PWM hardware) 0=enabled.
127                                 * Also, on IIci w/parity, shows parity error
128                                 * 0=error, 1=OK.
129                                 */
130 #define VIA1B_vMystery 0x40    /*
131                                 * On IIci, parity enable. 0=enabled,1=disabled
132                                 * On SE/30, vertical sync interrupt enable.
133                                 * 0=enabled. This vSync interrupt shows up
134                                 * as a slot $E interrupt.
135                                 */
136 #define VIA1B_vADBS2   0x20    /* ADB state input bit 1 (unused on IIfx) */
137 #define VIA1B_vADBS1   0x10    /* ADB state input bit 0 (unused on IIfx) */
138 #define VIA1B_vADBInt  0x08    /* ADB interrupt 0=interrupt (unused on IIfx)*/
139 #define VIA1B_vRTCEnb  0x04    /* Enable Real time clock. 0=enabled. */
140 #define VIA1B_vRTCClk  0x02    /* Real time clock serial-clock line. */
141 #define VIA1B_vRTCData 0x01    /* Real time clock serial-data line. */
142 
143 /*
144  *    VIA2 A register is the interrupt lines raised off the nubus
145  *    slots.
146  *      The below info is from 'Macintosh Family Hardware.'
147  *      MkLinux calls the 'IIci internal video IRQ' below the 'RBV slot 0 irq.'
148  *      It also notes that the slot $9 IRQ is the 'Ethernet IRQ' and
149  *      defines the 'Video IRQ' as 0x40 for the 'EVR' VIA work-alike.
150  *      Perhaps OSS uses vRAM1 and vRAM2 for ADB.
151  */
152 
153 #define VIA2A_vRAM1    0x80    /* RAM size bit 1 (IIci: reserved) */
154 #define VIA2A_vRAM0    0x40    /* RAM size bit 0 (IIci: internal video IRQ) */
155 #define VIA2A_vIRQE    0x20    /* IRQ from slot $E */
156 #define VIA2A_vIRQD    0x10    /* IRQ from slot $D */
157 #define VIA2A_vIRQC    0x08    /* IRQ from slot $C */
158 #define VIA2A_vIRQB    0x04    /* IRQ from slot $B */
159 #define VIA2A_vIRQA    0x02    /* IRQ from slot $A */
160 #define VIA2A_vIRQ9    0x01    /* IRQ from slot $9 */
161 
162 /*
163  * RAM size bits decoded as follows:
164  * bit1 bit0  size of ICs in bank A
165  *  0    0    256 kbit
166  *  0    1    1 Mbit
167  *  1    0    4 Mbit
168  *  1    1   16 Mbit
169  */
170 
171 /*
172  *    Register B has the fun stuff in it
173  */
174 
175 #define VIA2B_vVBL    0x80    /*
176                                * VBL output to VIA1 (60.15Hz) driven by
177                                * timer T1.
178                                * on IIci, parity test: 0=test mode.
179                                * [MkLinux] RBV_PARODD: 1=odd,0=even.
180                                */
181 #define VIA2B_vSndJck 0x40    /*
182                                * External sound jack status.
183                                * 0=plug is inserted.  On SE/30, always 0
184                                */
185 #define VIA2B_vTfr0   0x20    /* Transfer mode bit 0 ack from NuBus */
186 #define VIA2B_vTfr1   0x10    /* Transfer mode bit 1 ack from NuBus */
187 #define VIA2B_vMode32 0x08    /*
188                                * 24/32bit switch - doubles as cache flush
189                                * on II, AMU/PMMU control.
190                                *   if AMU, 0=24bit to 32bit translation
191                                *   if PMMU, 1=PMMU is accessing page table.
192                                * on SE/30 tied low.
193                                * on IIx,IIcx,IIfx, unused.
194                                * on IIci/RBV, cache control. 0=flush cache.
195                                */
196 #define VIA2B_vPower  0x04   /*
197                               * Power off, 0=shut off power.
198                               * on SE/30 this signal sent to PDS card.
199                               */
200 #define VIA2B_vBusLk  0x02   /*
201                               * Lock NuBus transactions, 0=locked.
202                               * on SE/30 sent to PDS card.
203                               */
204 #define VIA2B_vCDis   0x01   /*
205                               * Cache control. On IIci, 1=disable cache card
206                               * on others, 0=disable processor's instruction
207                               * and data caches.
208                               */
209 
210 /* interrupt flags */
211 
212 #define IRQ_SET         0x80
213 
214 /* common */
215 
216 #define VIA_IRQ_TIMER1      0x40
217 #define VIA_IRQ_TIMER2      0x20
218 
219 /*
220  * Apple sez: http://developer.apple.com/technotes/ov/ov_04.html
221  * Another example of a valid function that has no ROM support is the use
222  * of the alternate video page for page-flipping animation. Since there
223  * is no ROM call to flip pages, it is necessary to go play with the
224  * right bit in the VIA chip (6522 Versatile Interface Adapter).
225  * [CSA: don't know which one this is, but it's one of 'em!]
226  */
227 
228 /*
229  *    6522 registers - see databook.
230  * CSA: Assignments for VIA1 confirmed from CHRP spec.
231  */
232 
233 /* partial address decode.  0xYYXX : XX part for RBV, YY part for VIA */
234 /* Note: 15 VIA regs, 8 RBV regs */
235 
236 #define vBufB    0x0000  /* [VIA/RBV]  Register B */
237 #define vBufAH   0x0200  /* [VIA only] Buffer A, with handshake. DON'T USE! */
238 #define vDirB    0x0400  /* [VIA only] Data Direction Register B. */
239 #define vDirA    0x0600  /* [VIA only] Data Direction Register A. */
240 #define vT1CL    0x0800  /* [VIA only] Timer one counter low. */
241 #define vT1CH    0x0a00  /* [VIA only] Timer one counter high. */
242 #define vT1LL    0x0c00  /* [VIA only] Timer one latches low. */
243 #define vT1LH    0x0e00  /* [VIA only] Timer one latches high. */
244 #define vT2CL    0x1000  /* [VIA only] Timer two counter low. */
245 #define vT2CH    0x1200  /* [VIA only] Timer two counter high. */
246 #define vSR      0x1400  /* [VIA only] Shift register. */
247 #define vACR     0x1600  /* [VIA only] Auxilary control register. */
248 #define vPCR     0x1800  /* [VIA only] Peripheral control register. */
249                          /*
250                           *           CHRP sez never ever to *write* this.
251                           *            Mac family says never to *change* this.
252                           * In fact we need to initialize it once at start.
253                           */
254 #define vIFR     0x1a00  /* [VIA/RBV]  Interrupt flag register. */
255 #define vIER     0x1c00  /* [VIA/RBV]  Interrupt enable register. */
256 #define vBufA    0x1e00  /* [VIA/RBV] register A (no handshake) */
257 
258 /* from linux 2.6 drivers/macintosh/via-macii.c */
259 
260 /* Bits in ACR */
261 
262 #define VIA1ACR_vShiftCtrl         0x1c        /* Shift register control bits */
263 #define VIA1ACR_vShiftExtClk       0x0c        /* Shift on external clock */
264 #define VIA1ACR_vShiftOut          0x10        /* Shift out if 1 */
265 
266 /*
267  * Apple Macintosh Family Hardware Refenece
268  * Table 19-10 ADB transaction states
269  */
270 
271 #define ADB_STATE_NEW       0
272 #define ADB_STATE_EVEN      1
273 #define ADB_STATE_ODD       2
274 #define ADB_STATE_IDLE      3
275 
276 #define VIA1B_vADB_StateMask    (VIA1B_vADBS1 | VIA1B_vADBS2)
277 #define VIA1B_vADB_StateShift   4
278 
279 #define VIA_TIMER_FREQ (783360)
280 #define VIA_ADB_POLL_FREQ 50 /* XXX: not real */
281 
282 /* VIA returns time offset from Jan 1, 1904, not 1970 */
283 #define RTC_OFFSET 2082844800
284 
285 enum {
286     REG_0,
287     REG_1,
288     REG_2,
289     REG_3,
290     REG_TEST,
291     REG_WPROTECT,
292     REG_PRAM_ADDR,
293     REG_PRAM_ADDR_LAST = REG_PRAM_ADDR + 19,
294     REG_PRAM_SECT,
295     REG_PRAM_SECT_LAST = REG_PRAM_SECT + 7,
296     REG_INVALID,
297     REG_EMPTY = 0xff,
298 };
299 
300 static void via1_VBL_update(MOS6522Q800VIA1State *v1s)
301 {
302     MOS6522State *s = MOS6522(v1s);
303 
304     /* 60 Hz irq */
305     v1s->next_VBL = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 16630) /
306                     16630 * 16630;
307 
308     if (s->ier & VIA1_IRQ_VBLANK) {
309         timer_mod(v1s->VBL_timer, v1s->next_VBL);
310     } else {
311         timer_del(v1s->VBL_timer);
312     }
313 }
314 
315 static void via1_one_second_update(MOS6522Q800VIA1State *v1s)
316 {
317     MOS6522State *s = MOS6522(v1s);
318 
319     v1s->next_second = (qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000) /
320                        1000 * 1000;
321     if (s->ier & VIA1_IRQ_ONE_SECOND) {
322         timer_mod(v1s->one_second_timer, v1s->next_second);
323     } else {
324         timer_del(v1s->one_second_timer);
325     }
326 }
327 
328 static void via1_VBL(void *opaque)
329 {
330     MOS6522Q800VIA1State *v1s = opaque;
331     MOS6522State *s = MOS6522(v1s);
332     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
333 
334     s->ifr |= VIA1_IRQ_VBLANK;
335     mdc->update_irq(s);
336 
337     via1_VBL_update(v1s);
338 }
339 
340 static void via1_one_second(void *opaque)
341 {
342     MOS6522Q800VIA1State *v1s = opaque;
343     MOS6522State *s = MOS6522(v1s);
344     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
345 
346     s->ifr |= VIA1_IRQ_ONE_SECOND;
347     mdc->update_irq(s);
348 
349     via1_one_second_update(v1s);
350 }
351 
352 static void via1_irq_request(void *opaque, int irq, int level)
353 {
354     MOS6522Q800VIA1State *v1s = opaque;
355     MOS6522State *s = MOS6522(v1s);
356     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
357 
358     if (level) {
359         s->ifr |= 1 << irq;
360     } else {
361         s->ifr &= ~(1 << irq);
362     }
363 
364     mdc->update_irq(s);
365 }
366 
367 static void via2_irq_request(void *opaque, int irq, int level)
368 {
369     MOS6522Q800VIA2State *v2s = opaque;
370     MOS6522State *s = MOS6522(v2s);
371     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
372 
373     if (level) {
374         s->ifr |= 1 << irq;
375     } else {
376         s->ifr &= ~(1 << irq);
377     }
378 
379     mdc->update_irq(s);
380 }
381 
382 
383 static void pram_update(MacVIAState *m)
384 {
385     if (m->blk) {
386         if (blk_pwrite(m->blk, 0, m->mos6522_via1.PRAM,
387                        sizeof(m->mos6522_via1.PRAM), 0) < 0) {
388             qemu_log("pram_update: cannot write to file\n");
389         }
390     }
391 }
392 
393 /*
394  * RTC Commands
395  *
396  * Command byte    Register addressed by the command
397  *
398  * z0000001        Seconds register 0 (lowest-order byte)
399  * z0000101        Seconds register 1
400  * z0001001        Seconds register 2
401  * z0001101        Seconds register 3 (highest-order byte)
402  * 00110001        Test register (write-only)
403  * 00110101        Write-Protect Register (write-only)
404  * z010aa01        RAM address 100aa ($10-$13) (first 20 bytes only)
405  * z1aaaa01        RAM address 0aaaa ($00-$0F) (first 20 bytes only)
406  * z0111aaa        Extended memory designator and sector number
407  *
408  * For a read request, z=1, for a write z=0
409  * The letter a indicates bits whose value depend on what parameter
410  * RAM byte you want to address
411  */
412 static int via1_rtc_compact_cmd(uint8_t value)
413 {
414     uint8_t read = value & 0x80;
415 
416     value &= 0x7f;
417 
418     /* the last 2 bits of a command byte must always be 0b01 ... */
419     if ((value & 0x78) == 0x38) {
420         /* except for the extended memory designator */
421         return read | (REG_PRAM_SECT + (value & 0x07));
422     }
423     if ((value & 0x03) == 0x01) {
424         value >>= 2;
425         if ((value & 0x1c) == 0) {
426             /* seconds registers */
427             return read | (REG_0 + (value & 0x03));
428         } else if ((value == 0x0c) && !read) {
429             return REG_TEST;
430         } else if ((value == 0x0d) && !read) {
431             return REG_WPROTECT;
432         } else if ((value & 0x1c) == 0x08) {
433             /* RAM address 0x10 to 0x13 */
434             return read | (REG_PRAM_ADDR + 0x10 + (value & 0x03));
435         } else if ((value & 0x43) == 0x41) {
436             /* RAM address 0x00 to 0x0f */
437             return read | (REG_PRAM_ADDR + (value & 0x0f));
438         }
439     }
440     return REG_INVALID;
441 }
442 
443 static void via1_rtc_update(MacVIAState *m)
444 {
445     MOS6522Q800VIA1State *v1s = &m->mos6522_via1;
446     MOS6522State *s = MOS6522(v1s);
447     int cmd, sector, addr;
448     uint32_t time;
449 
450     if (s->b & VIA1B_vRTCEnb) {
451         return;
452     }
453 
454     if (s->dirb & VIA1B_vRTCData) {
455         /* send bits to the RTC */
456         if (!(v1s->last_b & VIA1B_vRTCClk) && (s->b & VIA1B_vRTCClk)) {
457             m->data_out <<= 1;
458             m->data_out |= s->b & VIA1B_vRTCData;
459             m->data_out_cnt++;
460         }
461         trace_via1_rtc_update_data_out(m->data_out_cnt, m->data_out);
462     } else {
463         trace_via1_rtc_update_data_in(m->data_in_cnt, m->data_in);
464         /* receive bits from the RTC */
465         if ((v1s->last_b & VIA1B_vRTCClk) &&
466             !(s->b & VIA1B_vRTCClk) &&
467             m->data_in_cnt) {
468             s->b = (s->b & ~VIA1B_vRTCData) |
469                    ((m->data_in >> 7) & VIA1B_vRTCData);
470             m->data_in <<= 1;
471             m->data_in_cnt--;
472         }
473         return;
474     }
475 
476     if (m->data_out_cnt != 8) {
477         return;
478     }
479 
480     m->data_out_cnt = 0;
481 
482     trace_via1_rtc_internal_status(m->cmd, m->alt, m->data_out);
483     /* first byte: it's a command */
484     if (m->cmd == REG_EMPTY) {
485 
486         cmd = via1_rtc_compact_cmd(m->data_out);
487         trace_via1_rtc_internal_cmd(cmd);
488 
489         if (cmd == REG_INVALID) {
490             trace_via1_rtc_cmd_invalid(m->data_out);
491             return;
492         }
493 
494         if (cmd & 0x80) { /* this is a read command */
495             switch (cmd & 0x7f) {
496             case REG_0...REG_3: /* seconds registers */
497                 /*
498                  * register 0 is lowest-order byte
499                  * register 3 is highest-order byte
500                  */
501 
502                 time = m->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
503                        / NANOSECONDS_PER_SECOND);
504                 trace_via1_rtc_internal_time(time);
505                 m->data_in = (time >> ((cmd & 0x03) << 3)) & 0xff;
506                 m->data_in_cnt = 8;
507                 trace_via1_rtc_cmd_seconds_read((cmd & 0x7f) - REG_0,
508                                                 m->data_in);
509                 break;
510             case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
511                 /* PRAM address 0x00 -> 0x13 */
512                 m->data_in = v1s->PRAM[(cmd & 0x7f) - REG_PRAM_ADDR];
513                 m->data_in_cnt = 8;
514                 trace_via1_rtc_cmd_pram_read((cmd & 0x7f) - REG_PRAM_ADDR,
515                                              m->data_in);
516                 break;
517             case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
518                 /*
519                  * extended memory designator and sector number
520                  * the only two-byte read command
521                  */
522                 trace_via1_rtc_internal_set_cmd(cmd);
523                 m->cmd = cmd;
524                 break;
525             default:
526                 g_assert_not_reached();
527                 break;
528             }
529             return;
530         }
531 
532         /* this is a write command, needs a parameter */
533         if (cmd == REG_WPROTECT || !m->wprotect) {
534             trace_via1_rtc_internal_set_cmd(cmd);
535             m->cmd = cmd;
536         } else {
537             trace_via1_rtc_internal_ignore_cmd(cmd);
538         }
539         return;
540     }
541 
542     /* second byte: it's a parameter */
543     if (m->alt == REG_EMPTY) {
544         switch (m->cmd & 0x7f) {
545         case REG_0...REG_3: /* seconds register */
546             /* FIXME */
547             trace_via1_rtc_cmd_seconds_write(m->cmd - REG_0, m->data_out);
548             m->cmd = REG_EMPTY;
549             break;
550         case REG_TEST:
551             /* device control: nothing to do */
552             trace_via1_rtc_cmd_test_write(m->data_out);
553             m->cmd = REG_EMPTY;
554             break;
555         case REG_WPROTECT:
556             /* Write Protect register */
557             trace_via1_rtc_cmd_wprotect_write(m->data_out);
558             m->wprotect = !!(m->data_out & 0x80);
559             m->cmd = REG_EMPTY;
560             break;
561         case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
562             /* PRAM address 0x00 -> 0x13 */
563             trace_via1_rtc_cmd_pram_write(m->cmd - REG_PRAM_ADDR, m->data_out);
564             v1s->PRAM[m->cmd - REG_PRAM_ADDR] = m->data_out;
565             pram_update(m);
566             m->cmd = REG_EMPTY;
567             break;
568         case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
569             addr = (m->data_out >> 2) & 0x1f;
570             sector = (m->cmd & 0x7f) - REG_PRAM_SECT;
571             if (m->cmd & 0x80) {
572                 /* it's a read */
573                 m->data_in = v1s->PRAM[sector * 32 + addr];
574                 m->data_in_cnt = 8;
575                 trace_via1_rtc_cmd_pram_sect_read(sector, addr,
576                                                   sector * 32 + addr,
577                                                   m->data_in);
578                 m->cmd = REG_EMPTY;
579             } else {
580                 /* it's a write, we need one more parameter */
581                 trace_via1_rtc_internal_set_alt(addr, sector, addr);
582                 m->alt = addr;
583             }
584             break;
585         default:
586             g_assert_not_reached();
587             break;
588         }
589         return;
590     }
591 
592     /* third byte: it's the data of a REG_PRAM_SECT write */
593     g_assert(REG_PRAM_SECT <= m->cmd && m->cmd <= REG_PRAM_SECT_LAST);
594     sector = m->cmd - REG_PRAM_SECT;
595     v1s->PRAM[sector * 32 + m->alt] = m->data_out;
596     pram_update(m);
597     trace_via1_rtc_cmd_pram_sect_write(sector, m->alt, sector * 32 + m->alt,
598                                        m->data_out);
599     m->alt = REG_EMPTY;
600     m->cmd = REG_EMPTY;
601 }
602 
603 static void adb_via_poll(void *opaque)
604 {
605     MacVIAState *m = opaque;
606     MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(&m->mos6522_via1);
607     MOS6522State *s = MOS6522(v1s);
608     ADBBusState *adb_bus = &m->adb_bus;
609     uint8_t obuf[9];
610     uint8_t *data = &s->sr;
611     int olen;
612     uint16_t pending;
613 
614     /*
615      * Setting vADBInt below indicates that an autopoll reply has been
616      * received, however we must block autopoll until the point where
617      * the entire reply has been read back to the host
618      */
619     adb_autopoll_block(adb_bus);
620 
621     m->adb_data_in_index = 0;
622     m->adb_data_out_index = 0;
623     olen = adb_poll(adb_bus, obuf, adb_bus->autopoll_mask);
624 
625     if (olen > 0) {
626         /* Autopoll response */
627         *data = obuf[0];
628         olen--;
629         memcpy(m->adb_data_in, &obuf[1], olen);
630         m->adb_data_in_size = olen;
631 
632         s->b &= ~VIA1B_vADBInt;
633         qemu_irq_raise(m->adb_data_ready);
634     } else if (olen < 0) {
635         /* Bus timeout (device does not exist) */
636         *data = 0xff;
637         s->b |= VIA1B_vADBInt;
638         adb_autopoll_unblock(adb_bus);
639     } else {
640         pending = adb_bus->pending & ~(1 << (m->adb_autopoll_cmd >> 4));
641 
642         if (pending) {
643             /*
644              * Bus timeout (device exists but another device has data). Block
645              * autopoll so the OS can read out the first EVEN and first ODD
646              * byte to determine bus timeout and SRQ status
647              */
648             *data = m->adb_autopoll_cmd;
649             s->b &= ~VIA1B_vADBInt;
650 
651             obuf[0] = 0xff;
652             obuf[1] = 0xff;
653             olen = 2;
654 
655             memcpy(m->adb_data_in, obuf, olen);
656             m->adb_data_in_size = olen;
657 
658             qemu_irq_raise(m->adb_data_ready);
659         } else {
660             /* Bus timeout (device exists but no other device has data) */
661             *data = 0;
662             s->b |= VIA1B_vADBInt;
663             adb_autopoll_unblock(adb_bus);
664         }
665     }
666 
667     trace_via1_adb_poll(*data, (s->b & VIA1B_vADBInt) ? "+" : "-",
668                         adb_bus->status, m->adb_data_in_index, olen);
669 }
670 
671 static int adb_via_send_len(uint8_t data)
672 {
673     /* Determine the send length from the given ADB command */
674     uint8_t cmd = data & 0xc;
675     uint8_t reg = data & 0x3;
676 
677     switch (cmd) {
678     case 0x8:
679         /* Listen command */
680         switch (reg) {
681         case 2:
682             /* Register 2 is only used for the keyboard */
683             return 3;
684         case 3:
685             /*
686              * Fortunately our devices only implement writes
687              * to register 3 which is fixed at 2 bytes
688              */
689             return 3;
690         default:
691             qemu_log_mask(LOG_UNIMP, "ADB unknown length for register %d\n",
692                           reg);
693             return 1;
694         }
695     default:
696         /* Talk, BusReset */
697         return 1;
698     }
699 }
700 
701 static void adb_via_send(MacVIAState *s, int state, uint8_t data)
702 {
703     MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(&s->mos6522_via1);
704     MOS6522State *ms = MOS6522(v1s);
705     ADBBusState *adb_bus = &s->adb_bus;
706     uint16_t autopoll_mask;
707 
708     switch (state) {
709     case ADB_STATE_NEW:
710         /*
711          * Command byte: vADBInt tells host autopoll data already present
712          * in VIA shift register and ADB transceiver
713          */
714         adb_autopoll_block(adb_bus);
715 
716         if (adb_bus->status & ADB_STATUS_POLLREPLY) {
717             /* Tell the host the existing data is from autopoll */
718             ms->b &= ~VIA1B_vADBInt;
719         } else {
720             ms->b |= VIA1B_vADBInt;
721             s->adb_data_out_index = 0;
722             s->adb_data_out[s->adb_data_out_index++] = data;
723         }
724 
725         trace_via1_adb_send(" NEW", data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
726         qemu_irq_raise(s->adb_data_ready);
727         break;
728 
729     case ADB_STATE_EVEN:
730     case ADB_STATE_ODD:
731         ms->b |= VIA1B_vADBInt;
732         s->adb_data_out[s->adb_data_out_index++] = data;
733 
734         trace_via1_adb_send(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
735                             data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
736         qemu_irq_raise(s->adb_data_ready);
737         break;
738 
739     case ADB_STATE_IDLE:
740         return;
741     }
742 
743     /* If the command is complete, execute it */
744     if (s->adb_data_out_index == adb_via_send_len(s->adb_data_out[0])) {
745         s->adb_data_in_size = adb_request(adb_bus, s->adb_data_in,
746                                           s->adb_data_out,
747                                           s->adb_data_out_index);
748         s->adb_data_in_index = 0;
749 
750         if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
751             /*
752              * Bus timeout (but allow first EVEN and ODD byte to indicate
753              * timeout via vADBInt and SRQ status)
754              */
755             s->adb_data_in[0] = 0xff;
756             s->adb_data_in[1] = 0xff;
757             s->adb_data_in_size = 2;
758         }
759 
760         /*
761          * If last command is TALK, store it for use by autopoll and adjust
762          * the autopoll mask accordingly
763          */
764         if ((s->adb_data_out[0] & 0xc) == 0xc) {
765             s->adb_autopoll_cmd = s->adb_data_out[0];
766 
767             autopoll_mask = 1 << (s->adb_autopoll_cmd >> 4);
768             adb_set_autopoll_mask(adb_bus, autopoll_mask);
769         }
770     }
771 }
772 
773 static void adb_via_receive(MacVIAState *s, int state, uint8_t *data)
774 {
775     MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(&s->mos6522_via1);
776     MOS6522State *ms = MOS6522(v1s);
777     ADBBusState *adb_bus = &s->adb_bus;
778     uint16_t pending;
779 
780     switch (state) {
781     case ADB_STATE_NEW:
782         ms->b |= VIA1B_vADBInt;
783         return;
784 
785     case ADB_STATE_IDLE:
786         /*
787          * Since adb_request() will have already consumed the data from the
788          * device, we must detect this extra state change and re-inject the
789          * reponse as either a "fake" autopoll reply or bus timeout
790          * accordingly
791          */
792         if (s->adb_data_in_index == 0) {
793             if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
794                 *data = 0xff;
795                 ms->b |= VIA1B_vADBInt;
796                 qemu_irq_raise(s->adb_data_ready);
797             } else if (s->adb_data_in_size > 0) {
798                 adb_bus->status = ADB_STATUS_POLLREPLY;
799                 *data = s->adb_autopoll_cmd;
800                 ms->b &= ~VIA1B_vADBInt;
801                 qemu_irq_raise(s->adb_data_ready);
802             }
803         } else {
804             ms->b |= VIA1B_vADBInt;
805             adb_autopoll_unblock(adb_bus);
806         }
807 
808         trace_via1_adb_receive("IDLE", *data,
809                         (ms->b & VIA1B_vADBInt) ? "+" : "-", adb_bus->status,
810                         s->adb_data_in_index, s->adb_data_in_size);
811 
812         break;
813 
814     case ADB_STATE_EVEN:
815     case ADB_STATE_ODD:
816         switch (s->adb_data_in_index) {
817         case 0:
818             /* First EVEN byte: vADBInt indicates bus timeout */
819             trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
820                                    *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
821                                    adb_bus->status, s->adb_data_in_index,
822                                    s->adb_data_in_size);
823 
824             *data = s->adb_data_in[s->adb_data_in_index++];
825             if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
826                 ms->b &= ~VIA1B_vADBInt;
827             } else {
828                 ms->b |= VIA1B_vADBInt;
829             }
830             break;
831 
832         case 1:
833             /* First ODD byte: vADBInt indicates SRQ */
834             trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
835                                    *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
836                                    adb_bus->status, s->adb_data_in_index,
837                                    s->adb_data_in_size);
838 
839             *data = s->adb_data_in[s->adb_data_in_index++];
840             pending = adb_bus->pending & ~(1 << (s->adb_autopoll_cmd >> 4));
841             if (pending) {
842                 ms->b &= ~VIA1B_vADBInt;
843             } else {
844                 ms->b |= VIA1B_vADBInt;
845             }
846             break;
847 
848         default:
849             /*
850              * Otherwise vADBInt indicates end of data. Note that Linux
851              * specifically checks for the sequence 0x0 0xff to confirm the
852              * end of the poll reply, so provide these extra bytes below to
853              * keep it happy
854              */
855             trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
856                                    *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
857                                    adb_bus->status, s->adb_data_in_index,
858                                    s->adb_data_in_size);
859 
860             if (s->adb_data_in_index < s->adb_data_in_size) {
861                 /* Next data byte */
862                 *data = s->adb_data_in[s->adb_data_in_index++];
863                 ms->b |= VIA1B_vADBInt;
864             } else if (s->adb_data_in_index == s->adb_data_in_size) {
865                 if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
866                     /* Bus timeout (no more data) */
867                     *data = 0xff;
868                 } else {
869                     /* Return 0x0 after reply */
870                     *data = 0;
871                 }
872                 s->adb_data_in_index++;
873                 ms->b &= ~VIA1B_vADBInt;
874             } else {
875                 /* Bus timeout (no more data) */
876                 *data = 0xff;
877                 ms->b &= ~VIA1B_vADBInt;
878                 adb_bus->status = 0;
879                 adb_autopoll_unblock(adb_bus);
880             }
881             break;
882         }
883 
884         qemu_irq_raise(s->adb_data_ready);
885         break;
886     }
887 }
888 
889 static void via1_adb_update(MacVIAState *m)
890 {
891     MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(&m->mos6522_via1);
892     MOS6522State *s = MOS6522(v1s);
893     int oldstate, state;
894 
895     oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
896     state = (s->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
897 
898     if (state != oldstate) {
899         if (s->acr & VIA1ACR_vShiftOut) {
900             /* output mode */
901             adb_via_send(m, state, s->sr);
902         } else {
903             /* input mode */
904             adb_via_receive(m, state, &s->sr);
905         }
906     }
907 }
908 
909 static uint64_t mos6522_q800_via1_read(void *opaque, hwaddr addr, unsigned size)
910 {
911     MOS6522Q800VIA1State *s = MOS6522_Q800_VIA1(opaque);
912     MOS6522State *ms = MOS6522(s);
913     int64_t now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
914 
915     /*
916      * If IRQs are disabled, timers are disabled, but we need to update
917      * VIA1_IRQ_VBLANK and VIA1_IRQ_ONE_SECOND bits in the IFR
918      */
919 
920     if (now >= s->next_VBL) {
921         ms->ifr |= VIA1_IRQ_VBLANK;
922         via1_VBL_update(s);
923     }
924     if (now >= s->next_second) {
925         ms->ifr |= VIA1_IRQ_ONE_SECOND;
926         via1_one_second_update(s);
927     }
928 
929     addr = (addr >> 9) & 0xf;
930     return mos6522_read(ms, addr, size);
931 }
932 
933 static void mos6522_q800_via1_write(void *opaque, hwaddr addr, uint64_t val,
934                                     unsigned size)
935 {
936     MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
937     MacVIAState *m = container_of(v1s, MacVIAState, mos6522_via1);
938     MOS6522State *ms = MOS6522(v1s);
939 
940     addr = (addr >> 9) & 0xf;
941     mos6522_write(ms, addr, val, size);
942 
943     switch (addr) {
944     case VIA_REG_B:
945         via1_rtc_update(m);
946         via1_adb_update(m);
947 
948         v1s->last_b = ms->b;
949         break;
950     }
951 
952     via1_one_second_update(v1s);
953     via1_VBL_update(v1s);
954 }
955 
956 static const MemoryRegionOps mos6522_q800_via1_ops = {
957     .read = mos6522_q800_via1_read,
958     .write = mos6522_q800_via1_write,
959     .endianness = DEVICE_BIG_ENDIAN,
960     .valid = {
961         .min_access_size = 1,
962         .max_access_size = 1,
963     },
964 };
965 
966 static uint64_t mos6522_q800_via2_read(void *opaque, hwaddr addr, unsigned size)
967 {
968     MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
969     MOS6522State *ms = MOS6522(s);
970 
971     addr = (addr >> 9) & 0xf;
972     return mos6522_read(ms, addr, size);
973 }
974 
975 static void mos6522_q800_via2_write(void *opaque, hwaddr addr, uint64_t val,
976                                     unsigned size)
977 {
978     MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
979     MOS6522State *ms = MOS6522(s);
980 
981     addr = (addr >> 9) & 0xf;
982     mos6522_write(ms, addr, val, size);
983 }
984 
985 static const MemoryRegionOps mos6522_q800_via2_ops = {
986     .read = mos6522_q800_via2_read,
987     .write = mos6522_q800_via2_write,
988     .endianness = DEVICE_BIG_ENDIAN,
989     .valid = {
990         .min_access_size = 1,
991         .max_access_size = 1,
992     },
993 };
994 
995 static void mac_via_reset(DeviceState *dev)
996 {
997     MacVIAState *m = MAC_VIA(dev);
998     MOS6522Q800VIA1State *v1s = &m->mos6522_via1;
999     ADBBusState *adb_bus = &m->adb_bus;
1000 
1001     adb_set_autopoll_enabled(adb_bus, true);
1002 
1003     timer_del(v1s->VBL_timer);
1004     v1s->next_VBL = 0;
1005     timer_del(v1s->one_second_timer);
1006     v1s->next_second = 0;
1007 
1008     m->cmd = REG_EMPTY;
1009     m->alt = REG_EMPTY;
1010 }
1011 
1012 static void mac_via_realize(DeviceState *dev, Error **errp)
1013 {
1014     MacVIAState *m = MAC_VIA(dev);
1015     MOS6522State *ms;
1016     ADBBusState *adb_bus = &m->adb_bus;
1017     struct tm tm;
1018     int ret;
1019 
1020     /* Init VIAs 1 and 2 */
1021     object_initialize_child(OBJECT(dev), "via1", &m->mos6522_via1,
1022                             TYPE_MOS6522_Q800_VIA1);
1023 
1024     object_initialize_child(OBJECT(dev), "via2", &m->mos6522_via2,
1025                             TYPE_MOS6522_Q800_VIA2);
1026 
1027     /* Pass through mos6522 output IRQs */
1028     ms = MOS6522(&m->mos6522_via1);
1029     object_property_add_alias(OBJECT(dev), "irq[0]", OBJECT(ms),
1030                               SYSBUS_DEVICE_GPIO_IRQ "[0]");
1031     ms = MOS6522(&m->mos6522_via2);
1032     object_property_add_alias(OBJECT(dev), "irq[1]", OBJECT(ms),
1033                               SYSBUS_DEVICE_GPIO_IRQ "[0]");
1034 
1035     sysbus_realize(SYS_BUS_DEVICE(&m->mos6522_via1), &error_abort);
1036     sysbus_realize(SYS_BUS_DEVICE(&m->mos6522_via2), &error_abort);
1037 
1038     /* Pass through mos6522 input IRQs */
1039     qdev_pass_gpios(DEVICE(&m->mos6522_via1), dev, "via1-irq");
1040     qdev_pass_gpios(DEVICE(&m->mos6522_via2), dev, "via2-irq");
1041 
1042     /* VIA 1 */
1043     m->mos6522_via1.one_second_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
1044                                                      via1_one_second,
1045                                                      &m->mos6522_via1);
1046     m->mos6522_via1.VBL_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, via1_VBL,
1047                                               &m->mos6522_via1);
1048 
1049     qemu_get_timedate(&tm, 0);
1050     m->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
1051 
1052     adb_register_autopoll_callback(adb_bus, adb_via_poll, m);
1053     m->adb_data_ready = qdev_get_gpio_in_named(dev, "via1-irq",
1054                                                VIA1_IRQ_ADB_READY_BIT);
1055 
1056     if (m->blk) {
1057         int64_t len = blk_getlength(m->blk);
1058         if (len < 0) {
1059             error_setg_errno(errp, -len,
1060                              "could not get length of backing image");
1061             return;
1062         }
1063         ret = blk_set_perm(m->blk,
1064                            BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
1065                            BLK_PERM_ALL, errp);
1066         if (ret < 0) {
1067             return;
1068         }
1069 
1070         len = blk_pread(m->blk, 0, m->mos6522_via1.PRAM,
1071                         sizeof(m->mos6522_via1.PRAM));
1072         if (len != sizeof(m->mos6522_via1.PRAM)) {
1073             error_setg(errp, "can't read PRAM contents");
1074             return;
1075         }
1076     }
1077 }
1078 
1079 static void mac_via_init(Object *obj)
1080 {
1081     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1082     MacVIAState *m = MAC_VIA(obj);
1083 
1084     /* MMIO */
1085     memory_region_init(&m->mmio, obj, "mac-via", 2 * VIA_SIZE);
1086     sysbus_init_mmio(sbd, &m->mmio);
1087 
1088     memory_region_init_io(&m->via1mem, obj, &mos6522_q800_via1_ops,
1089                           &m->mos6522_via1, "via1", VIA_SIZE);
1090     memory_region_add_subregion(&m->mmio, 0x0, &m->via1mem);
1091 
1092     memory_region_init_io(&m->via2mem, obj, &mos6522_q800_via2_ops,
1093                           &m->mos6522_via2, "via2", VIA_SIZE);
1094     memory_region_add_subregion(&m->mmio, VIA_SIZE, &m->via2mem);
1095 
1096     /* ADB */
1097     qbus_create_inplace((BusState *)&m->adb_bus, sizeof(m->adb_bus),
1098                         TYPE_ADB_BUS, DEVICE(obj), "adb.0");
1099 }
1100 
1101 static void postload_update_cb(void *opaque, int running, RunState state)
1102 {
1103     MacVIAState *m = MAC_VIA(opaque);
1104 
1105     qemu_del_vm_change_state_handler(m->vmstate);
1106     m->vmstate = NULL;
1107 
1108     pram_update(m);
1109 }
1110 
1111 static int mac_via_post_load(void *opaque, int version_id)
1112 {
1113     MacVIAState *m = MAC_VIA(opaque);
1114 
1115     if (m->blk) {
1116         m->vmstate = qemu_add_vm_change_state_handler(postload_update_cb,
1117                                                       m);
1118     }
1119 
1120     return 0;
1121 }
1122 
1123 static const VMStateDescription vmstate_mac_via = {
1124     .name = "mac-via",
1125     .version_id = 2,
1126     .minimum_version_id = 2,
1127     .post_load = mac_via_post_load,
1128     .fields = (VMStateField[]) {
1129         /* VIAs */
1130         VMSTATE_STRUCT(mos6522_via1.parent_obj, MacVIAState, 0, vmstate_mos6522,
1131                        MOS6522State),
1132         VMSTATE_UINT8(mos6522_via1.last_b, MacVIAState),
1133         VMSTATE_BUFFER(mos6522_via1.PRAM, MacVIAState),
1134         VMSTATE_TIMER_PTR(mos6522_via1.one_second_timer, MacVIAState),
1135         VMSTATE_INT64(mos6522_via1.next_second, MacVIAState),
1136         VMSTATE_TIMER_PTR(mos6522_via1.VBL_timer, MacVIAState),
1137         VMSTATE_INT64(mos6522_via1.next_VBL, MacVIAState),
1138         VMSTATE_STRUCT(mos6522_via2.parent_obj, MacVIAState, 0, vmstate_mos6522,
1139                        MOS6522State),
1140         /* RTC */
1141         VMSTATE_UINT32(tick_offset, MacVIAState),
1142         VMSTATE_UINT8(data_out, MacVIAState),
1143         VMSTATE_INT32(data_out_cnt, MacVIAState),
1144         VMSTATE_UINT8(data_in, MacVIAState),
1145         VMSTATE_UINT8(data_in_cnt, MacVIAState),
1146         VMSTATE_UINT8(cmd, MacVIAState),
1147         VMSTATE_INT32(wprotect, MacVIAState),
1148         VMSTATE_INT32(alt, MacVIAState),
1149         /* ADB */
1150         VMSTATE_INT32(adb_data_in_size, MacVIAState),
1151         VMSTATE_INT32(adb_data_in_index, MacVIAState),
1152         VMSTATE_INT32(adb_data_out_index, MacVIAState),
1153         VMSTATE_BUFFER(adb_data_in, MacVIAState),
1154         VMSTATE_BUFFER(adb_data_out, MacVIAState),
1155         VMSTATE_UINT8(adb_autopoll_cmd, MacVIAState),
1156         VMSTATE_END_OF_LIST()
1157     }
1158 };
1159 
1160 static Property mac_via_properties[] = {
1161     DEFINE_PROP_DRIVE("drive", MacVIAState, blk),
1162     DEFINE_PROP_END_OF_LIST(),
1163 };
1164 
1165 static void mac_via_class_init(ObjectClass *oc, void *data)
1166 {
1167     DeviceClass *dc = DEVICE_CLASS(oc);
1168 
1169     dc->realize = mac_via_realize;
1170     dc->reset = mac_via_reset;
1171     dc->vmsd = &vmstate_mac_via;
1172     device_class_set_props(dc, mac_via_properties);
1173 }
1174 
1175 static TypeInfo mac_via_info = {
1176     .name = TYPE_MAC_VIA,
1177     .parent = TYPE_SYS_BUS_DEVICE,
1178     .instance_size = sizeof(MacVIAState),
1179     .instance_init = mac_via_init,
1180     .class_init = mac_via_class_init,
1181 };
1182 
1183 /* VIA 1 */
1184 static void mos6522_q800_via1_reset(DeviceState *dev)
1185 {
1186     MOS6522State *ms = MOS6522(dev);
1187     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
1188 
1189     mdc->parent_reset(dev);
1190 
1191     ms->timers[0].frequency = VIA_TIMER_FREQ;
1192     ms->timers[1].frequency = VIA_TIMER_FREQ;
1193 
1194     ms->b = VIA1B_vADB_StateMask | VIA1B_vADBInt | VIA1B_vRTCEnb;
1195 }
1196 
1197 static void mos6522_q800_via1_init(Object *obj)
1198 {
1199     qdev_init_gpio_in_named(DEVICE(obj), via1_irq_request, "via1-irq",
1200                             VIA1_IRQ_NB);
1201 }
1202 
1203 static void mos6522_q800_via1_class_init(ObjectClass *oc, void *data)
1204 {
1205     DeviceClass *dc = DEVICE_CLASS(oc);
1206 
1207     dc->reset = mos6522_q800_via1_reset;
1208 }
1209 
1210 static const TypeInfo mos6522_q800_via1_type_info = {
1211     .name = TYPE_MOS6522_Q800_VIA1,
1212     .parent = TYPE_MOS6522,
1213     .instance_size = sizeof(MOS6522Q800VIA1State),
1214     .instance_init = mos6522_q800_via1_init,
1215     .class_init = mos6522_q800_via1_class_init,
1216 };
1217 
1218 /* VIA 2 */
1219 static void mos6522_q800_via2_portB_write(MOS6522State *s)
1220 {
1221     if (s->dirb & VIA2B_vPower && (s->b & VIA2B_vPower) == 0) {
1222         /* shutdown */
1223         qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
1224     }
1225 }
1226 
1227 static void mos6522_q800_via2_reset(DeviceState *dev)
1228 {
1229     MOS6522State *ms = MOS6522(dev);
1230     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
1231 
1232     mdc->parent_reset(dev);
1233 
1234     ms->timers[0].frequency = VIA_TIMER_FREQ;
1235     ms->timers[1].frequency = VIA_TIMER_FREQ;
1236 
1237     ms->dirb = 0;
1238     ms->b = 0;
1239 }
1240 
1241 static void mos6522_q800_via2_init(Object *obj)
1242 {
1243     qdev_init_gpio_in_named(DEVICE(obj), via2_irq_request, "via2-irq",
1244                             VIA2_IRQ_NB);
1245 }
1246 
1247 static void mos6522_q800_via2_class_init(ObjectClass *oc, void *data)
1248 {
1249     DeviceClass *dc = DEVICE_CLASS(oc);
1250     MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
1251 
1252     dc->reset = mos6522_q800_via2_reset;
1253     mdc->portB_write = mos6522_q800_via2_portB_write;
1254 }
1255 
1256 static const TypeInfo mos6522_q800_via2_type_info = {
1257     .name = TYPE_MOS6522_Q800_VIA2,
1258     .parent = TYPE_MOS6522,
1259     .instance_size = sizeof(MOS6522Q800VIA2State),
1260     .instance_init = mos6522_q800_via2_init,
1261     .class_init = mos6522_q800_via2_class_init,
1262 };
1263 
1264 static void mac_via_register_types(void)
1265 {
1266     type_register_static(&mos6522_q800_via1_type_info);
1267     type_register_static(&mos6522_q800_via2_type_info);
1268     type_register_static(&mac_via_info);
1269 }
1270 
1271 type_init(mac_via_register_types);
1272