qemu

FORK: QEMU emulator
git clone https://git.neptards.moe/neptards/qemu.git
Log | Files | Refs | Submodules | LICENSE

pmu.c (24605B)


      1 /*
      2  * QEMU PowerMac PMU device support
      3  *
      4  * Copyright (c) 2016 Benjamin Herrenschmidt, IBM Corp.
      5  * Copyright (c) 2018 Mark Cave-Ayland
      6  *
      7  * Based on the CUDA device by:
      8  *
      9  * Copyright (c) 2004-2007 Fabrice Bellard
     10  * Copyright (c) 2007 Jocelyn Mayer
     11  *
     12  * Permission is hereby granted, free of charge, to any person obtaining a copy
     13  * of this software and associated documentation files (the "Software"), to deal
     14  * in the Software without restriction, including without limitation the rights
     15  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     16  * copies of the Software, and to permit persons to whom the Software is
     17  * furnished to do so, subject to the following conditions:
     18  *
     19  * The above copyright notice and this permission notice shall be included in
     20  * all copies or substantial portions of the Software.
     21  *
     22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     25  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     26  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     27  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     28  * THE SOFTWARE.
     29  */
     30 
     31 #include "qemu/osdep.h"
     32 #include "hw/qdev-properties.h"
     33 #include "migration/vmstate.h"
     34 #include "hw/input/adb.h"
     35 #include "hw/irq.h"
     36 #include "hw/misc/mos6522.h"
     37 #include "hw/misc/macio/gpio.h"
     38 #include "hw/misc/macio/pmu.h"
     39 #include "qapi/error.h"
     40 #include "qemu/timer.h"
     41 #include "sysemu/runstate.h"
     42 #include "sysemu/rtc.h"
     43 #include "qapi/error.h"
     44 #include "qemu/cutils.h"
     45 #include "qemu/log.h"
     46 #include "qemu/module.h"
     47 #include "trace.h"
     48 
     49 
     50 /* Bits in B data register: all active low */
     51 #define TACK    0x08    /* Transfer request (input) */
     52 #define TREQ    0x10    /* Transfer acknowledge (output) */
     53 
     54 /* PMU returns time_t's offset from Jan 1, 1904, not 1970 */
     55 #define RTC_OFFSET                      2082844800
     56 
     57 #define VIA_TIMER_FREQ (4700000 / 6)
     58 
     59 static void via_set_sr_int(void *opaque)
     60 {
     61     PMUState *s = opaque;
     62     MOS6522PMUState *mps = MOS6522_PMU(&s->mos6522_pmu);
     63     MOS6522State *ms = MOS6522(mps);
     64     qemu_irq irq = qdev_get_gpio_in(DEVICE(ms), SR_INT_BIT);
     65 
     66     qemu_set_irq(irq, 1);
     67 }
     68 
     69 static void pmu_update_extirq(PMUState *s)
     70 {
     71     if ((s->intbits & s->intmask) != 0) {
     72         macio_set_gpio(s->gpio, 1, false);
     73     } else {
     74         macio_set_gpio(s->gpio, 1, true);
     75     }
     76 }
     77 
     78 static void pmu_adb_poll(void *opaque)
     79 {
     80     PMUState *s = opaque;
     81     ADBBusState *adb_bus = &s->adb_bus;
     82     int olen;
     83 
     84     if (!(s->intbits & PMU_INT_ADB)) {
     85         olen = adb_poll(adb_bus, s->adb_reply, adb_bus->autopoll_mask);
     86         trace_pmu_adb_poll(olen);
     87 
     88         if (olen > 0) {
     89             s->adb_reply_size = olen;
     90             s->intbits |= PMU_INT_ADB | PMU_INT_ADB_AUTO;
     91             pmu_update_extirq(s);
     92         }
     93     }
     94 }
     95 
     96 static void pmu_one_sec_timer(void *opaque)
     97 {
     98     PMUState *s = opaque;
     99 
    100     trace_pmu_one_sec_timer();
    101 
    102     s->intbits |= PMU_INT_TICK;
    103     pmu_update_extirq(s);
    104     s->one_sec_target += 1000;
    105 
    106     timer_mod(s->one_sec_timer, s->one_sec_target);
    107 }
    108 
    109 static void pmu_cmd_int_ack(PMUState *s,
    110                             const uint8_t *in_data, uint8_t in_len,
    111                             uint8_t *out_data, uint8_t *out_len)
    112 {
    113     if (in_len != 0) {
    114         qemu_log_mask(LOG_GUEST_ERROR,
    115                       "PMU: INT_ACK command, invalid len: %d want: 0\n",
    116                       in_len);
    117         return;
    118     }
    119 
    120     /* Make appropriate reply packet */
    121     if (s->intbits & PMU_INT_ADB) {
    122         if (!s->adb_reply_size) {
    123             qemu_log_mask(LOG_GUEST_ERROR,
    124                           "Odd, PMU_INT_ADB set with no reply in buffer\n");
    125         }
    126 
    127         memcpy(out_data + 1, s->adb_reply, s->adb_reply_size);
    128         out_data[0] = s->intbits & (PMU_INT_ADB | PMU_INT_ADB_AUTO);
    129         *out_len = s->adb_reply_size + 1;
    130         s->intbits &= ~(PMU_INT_ADB | PMU_INT_ADB_AUTO);
    131         s->adb_reply_size = 0;
    132     } else {
    133         out_data[0] = s->intbits;
    134         s->intbits = 0;
    135         *out_len = 1;
    136     }
    137 
    138     pmu_update_extirq(s);
    139 }
    140 
    141 static void pmu_cmd_set_int_mask(PMUState *s,
    142                                  const uint8_t *in_data, uint8_t in_len,
    143                                  uint8_t *out_data, uint8_t *out_len)
    144 {
    145     if (in_len != 1) {
    146         qemu_log_mask(LOG_GUEST_ERROR,
    147                       "PMU: SET_INT_MASK command, invalid len: %d want: 1\n",
    148                       in_len);
    149         return;
    150     }
    151 
    152     trace_pmu_cmd_set_int_mask(s->intmask);
    153     s->intmask = in_data[0];
    154 
    155     pmu_update_extirq(s);
    156 }
    157 
    158 static void pmu_cmd_set_adb_autopoll(PMUState *s, uint16_t mask)
    159 {
    160     ADBBusState *adb_bus = &s->adb_bus;
    161 
    162     trace_pmu_cmd_set_adb_autopoll(mask);
    163 
    164     if (mask) {
    165         adb_set_autopoll_mask(adb_bus, mask);
    166         adb_set_autopoll_enabled(adb_bus, true);
    167     } else {
    168         adb_set_autopoll_enabled(adb_bus, false);
    169     }
    170 }
    171 
    172 static void pmu_cmd_adb(PMUState *s,
    173                         const uint8_t *in_data, uint8_t in_len,
    174                         uint8_t *out_data, uint8_t *out_len)
    175 {
    176     int len, adblen;
    177     uint8_t adb_cmd[255];
    178 
    179     if (in_len < 2) {
    180         qemu_log_mask(LOG_GUEST_ERROR,
    181                       "PMU: ADB PACKET, invalid len: %d want at least 2\n",
    182                       in_len);
    183         return;
    184     }
    185 
    186     *out_len = 0;
    187 
    188     if (!s->has_adb) {
    189         trace_pmu_cmd_adb_nobus();
    190         return;
    191     }
    192 
    193     /* Set autopoll is a special form of the command */
    194     if (in_data[0] == 0 && in_data[1] == 0x86) {
    195         uint16_t mask = in_data[2];
    196         mask = (mask << 8) | in_data[3];
    197         if (in_len != 4) {
    198             qemu_log_mask(LOG_GUEST_ERROR,
    199                           "PMU: ADB Autopoll requires 4 bytes, got %d\n",
    200                           in_len);
    201             return;
    202         }
    203 
    204         pmu_cmd_set_adb_autopoll(s, mask);
    205         return;
    206     }
    207 
    208     trace_pmu_cmd_adb_request(in_len, in_data[0], in_data[1], in_data[2],
    209                               in_data[3], in_data[4]);
    210 
    211     *out_len = 0;
    212 
    213     /* Check ADB len */
    214     adblen = in_data[2];
    215     if (adblen > (in_len - 3)) {
    216         qemu_log_mask(LOG_GUEST_ERROR,
    217                       "PMU: ADB len is %d > %d (in_len -3)...erroring\n",
    218                       adblen, in_len - 3);
    219         len = -1;
    220     } else if (adblen > 252) {
    221         qemu_log_mask(LOG_GUEST_ERROR, "PMU: ADB command too big!\n");
    222         len = -1;
    223     } else {
    224         /* Format command */
    225         adb_cmd[0] = in_data[0];
    226         memcpy(&adb_cmd[1], &in_data[3], in_len - 3);
    227         len = adb_request(&s->adb_bus, s->adb_reply + 2, adb_cmd, in_len - 2);
    228 
    229         trace_pmu_cmd_adb_reply(len);
    230     }
    231 
    232     if (len > 0) {
    233         /* XXX Check this */
    234         s->adb_reply_size = len + 2;
    235         s->adb_reply[0] = 0x01;
    236         s->adb_reply[1] = len;
    237     } else {
    238         /* XXX Check this */
    239         s->adb_reply_size = 1;
    240         s->adb_reply[0] = 0x00;
    241     }
    242 
    243     s->intbits |= PMU_INT_ADB;
    244     pmu_update_extirq(s);
    245 }
    246 
    247 static void pmu_cmd_adb_poll_off(PMUState *s,
    248                                  const uint8_t *in_data, uint8_t in_len,
    249                                  uint8_t *out_data, uint8_t *out_len)
    250 {
    251     ADBBusState *adb_bus = &s->adb_bus;
    252 
    253     if (in_len != 0) {
    254         qemu_log_mask(LOG_GUEST_ERROR,
    255                       "PMU: ADB POLL OFF command, invalid len: %d want: 0\n",
    256                       in_len);
    257         return;
    258     }
    259 
    260     if (s->has_adb) {
    261         adb_set_autopoll_enabled(adb_bus, false);
    262     }
    263 }
    264 
    265 static void pmu_cmd_shutdown(PMUState *s,
    266                              const uint8_t *in_data, uint8_t in_len,
    267                              uint8_t *out_data, uint8_t *out_len)
    268 {
    269     if (in_len != 4) {
    270         qemu_log_mask(LOG_GUEST_ERROR,
    271                       "PMU: SHUTDOWN command, invalid len: %d want: 4\n",
    272                       in_len);
    273         return;
    274     }
    275 
    276     *out_len = 1;
    277     out_data[0] = 0;
    278 
    279     if (in_data[0] != 'M' || in_data[1] != 'A' || in_data[2] != 'T' ||
    280         in_data[3] != 'T') {
    281 
    282         qemu_log_mask(LOG_GUEST_ERROR,
    283                       "PMU: SHUTDOWN command, Bad MATT signature\n");
    284         return;
    285     }
    286 
    287     qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
    288 }
    289 
    290 static void pmu_cmd_reset(PMUState *s,
    291                           const uint8_t *in_data, uint8_t in_len,
    292                           uint8_t *out_data, uint8_t *out_len)
    293 {
    294     if (in_len != 0) {
    295         qemu_log_mask(LOG_GUEST_ERROR,
    296                       "PMU: RESET command, invalid len: %d want: 0\n",
    297                       in_len);
    298         return;
    299     }
    300 
    301     qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
    302 }
    303 
    304 static void pmu_cmd_get_rtc(PMUState *s,
    305                             const uint8_t *in_data, uint8_t in_len,
    306                             uint8_t *out_data, uint8_t *out_len)
    307 {
    308     uint32_t ti;
    309 
    310     if (in_len != 0) {
    311         qemu_log_mask(LOG_GUEST_ERROR,
    312                       "PMU: GET_RTC command, invalid len: %d want: 0\n",
    313                       in_len);
    314         return;
    315     }
    316 
    317     ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
    318                            / NANOSECONDS_PER_SECOND);
    319     out_data[0] = ti >> 24;
    320     out_data[1] = ti >> 16;
    321     out_data[2] = ti >> 8;
    322     out_data[3] = ti;
    323     *out_len = 4;
    324 }
    325 
    326 static void pmu_cmd_set_rtc(PMUState *s,
    327                             const uint8_t *in_data, uint8_t in_len,
    328                             uint8_t *out_data, uint8_t *out_len)
    329 {
    330     uint32_t ti;
    331 
    332     if (in_len != 4) {
    333         qemu_log_mask(LOG_GUEST_ERROR,
    334                       "PMU: SET_RTC command, invalid len: %d want: 4\n",
    335                       in_len);
    336         return;
    337     }
    338 
    339     ti = (((uint32_t)in_data[0]) << 24) + (((uint32_t)in_data[1]) << 16)
    340          + (((uint32_t)in_data[2]) << 8) + in_data[3];
    341 
    342     s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
    343                            / NANOSECONDS_PER_SECOND);
    344 }
    345 
    346 static void pmu_cmd_system_ready(PMUState *s,
    347                                  const uint8_t *in_data, uint8_t in_len,
    348                                  uint8_t *out_data, uint8_t *out_len)
    349 {
    350     /* Do nothing */
    351 }
    352 
    353 static void pmu_cmd_get_version(PMUState *s,
    354                                 const uint8_t *in_data, uint8_t in_len,
    355                                 uint8_t *out_data, uint8_t *out_len)
    356 {
    357     *out_len = 1;
    358     *out_data = 1; /* ??? Check what Apple does */
    359 }
    360 
    361 static void pmu_cmd_power_events(PMUState *s,
    362                                  const uint8_t *in_data, uint8_t in_len,
    363                                  uint8_t *out_data, uint8_t *out_len)
    364 {
    365     if (in_len < 1) {
    366         qemu_log_mask(LOG_GUEST_ERROR,
    367                       "PMU: POWER EVENTS command, invalid len %d, want at least 1\n",
    368                       in_len);
    369         return;
    370     }
    371 
    372     switch (in_data[0]) {
    373     /* Dummies for now */
    374     case PMU_PWR_GET_POWERUP_EVENTS:
    375         *out_len = 2;
    376         out_data[0] = 0;
    377         out_data[1] = 0;
    378         break;
    379     case PMU_PWR_SET_POWERUP_EVENTS:
    380     case PMU_PWR_CLR_POWERUP_EVENTS:
    381         break;
    382     case PMU_PWR_GET_WAKEUP_EVENTS:
    383         *out_len = 2;
    384         out_data[0] = 0;
    385         out_data[1] = 0;
    386         break;
    387     case PMU_PWR_SET_WAKEUP_EVENTS:
    388     case PMU_PWR_CLR_WAKEUP_EVENTS:
    389         break;
    390     default:
    391         qemu_log_mask(LOG_GUEST_ERROR,
    392                       "PMU: POWER EVENTS unknown subcommand 0x%02x\n",
    393                       in_data[0]);
    394     }
    395 }
    396 
    397 static void pmu_cmd_get_cover(PMUState *s,
    398                               const uint8_t *in_data, uint8_t in_len,
    399                               uint8_t *out_data, uint8_t *out_len)
    400 {
    401     /* Not 100% sure here, will have to check what a real Mac
    402      * returns other than byte 0 bit 0 is LID closed on laptops
    403      */
    404     *out_len = 1;
    405     *out_data = 0x00;
    406 }
    407 
    408 static void pmu_cmd_download_status(PMUState *s,
    409                                     const uint8_t *in_data, uint8_t in_len,
    410                                     uint8_t *out_data, uint8_t *out_len)
    411 {
    412     /* This has to do with PMU firmware updates as far as I can tell.
    413      *
    414      * We return 0x62 which is what OpenPMU expects
    415      */
    416     *out_len = 1;
    417     *out_data = 0x62;
    418 }
    419 
    420 static void pmu_cmd_read_pmu_ram(PMUState *s,
    421                                  const uint8_t *in_data, uint8_t in_len,
    422                                  uint8_t *out_data, uint8_t *out_len)
    423 {
    424     if (in_len < 3) {
    425         qemu_log_mask(LOG_GUEST_ERROR,
    426                       "PMU: READ_PMU_RAM command, invalid len %d, expected 3\n",
    427                       in_len);
    428         return;
    429     }
    430 
    431     qemu_log_mask(LOG_GUEST_ERROR,
    432                   "PMU: Unsupported READ_PMU_RAM, args: %02x %02x %02x\n",
    433                   in_data[0], in_data[1], in_data[2]);
    434 
    435     *out_len = 0;
    436 }
    437 
    438 /* description of commands */
    439 typedef struct PMUCmdHandler {
    440     uint8_t command;
    441     const char *name;
    442     void (*handler)(PMUState *s,
    443                     const uint8_t *in_args, uint8_t in_len,
    444                     uint8_t *out_args, uint8_t *out_len);
    445 } PMUCmdHandler;
    446 
    447 static const PMUCmdHandler PMUCmdHandlers[] = {
    448     { PMU_INT_ACK, "INT ACK", pmu_cmd_int_ack },
    449     { PMU_SET_INTR_MASK, "SET INT MASK", pmu_cmd_set_int_mask },
    450     { PMU_ADB_CMD, "ADB COMMAND", pmu_cmd_adb },
    451     { PMU_ADB_POLL_OFF, "ADB POLL OFF", pmu_cmd_adb_poll_off },
    452     { PMU_RESET, "REBOOT", pmu_cmd_reset },
    453     { PMU_SHUTDOWN, "SHUTDOWN", pmu_cmd_shutdown },
    454     { PMU_READ_RTC, "GET RTC", pmu_cmd_get_rtc },
    455     { PMU_SET_RTC, "SET RTC", pmu_cmd_set_rtc },
    456     { PMU_SYSTEM_READY, "SYSTEM READY", pmu_cmd_system_ready },
    457     { PMU_GET_VERSION, "GET VERSION", pmu_cmd_get_version },
    458     { PMU_POWER_EVENTS, "POWER EVENTS", pmu_cmd_power_events },
    459     { PMU_GET_COVER, "GET_COVER", pmu_cmd_get_cover },
    460     { PMU_DOWNLOAD_STATUS, "DOWNLOAD STATUS", pmu_cmd_download_status },
    461     { PMU_READ_PMU_RAM, "READ PMGR RAM", pmu_cmd_read_pmu_ram },
    462 };
    463 
    464 static void pmu_dispatch_cmd(PMUState *s)
    465 {
    466     unsigned int i;
    467 
    468     /* No response by default */
    469     s->cmd_rsp_sz = 0;
    470 
    471     for (i = 0; i < ARRAY_SIZE(PMUCmdHandlers); i++) {
    472         const PMUCmdHandler *desc = &PMUCmdHandlers[i];
    473 
    474         if (desc->command != s->cmd) {
    475             continue;
    476         }
    477 
    478         trace_pmu_dispatch_cmd(desc->name);
    479         desc->handler(s, s->cmd_buf, s->cmd_buf_pos,
    480                       s->cmd_rsp, &s->cmd_rsp_sz);
    481 
    482         if (s->rsplen != -1 && s->rsplen != s->cmd_rsp_sz) {
    483             trace_pmu_debug_protocol_string("QEMU internal cmd resp mismatch!");
    484         } else {
    485             trace_pmu_debug_protocol_resp_size(s->cmd_rsp_sz);
    486         }
    487 
    488         return;
    489     }
    490 
    491     trace_pmu_dispatch_unknown_cmd(s->cmd);
    492 
    493     /* Manufacture fake response with 0's */
    494     if (s->rsplen == -1) {
    495         s->cmd_rsp_sz = 0;
    496     } else {
    497         s->cmd_rsp_sz = s->rsplen;
    498         memset(s->cmd_rsp, 0, s->rsplen);
    499     }
    500 }
    501 
    502 static void pmu_update(PMUState *s)
    503 {
    504     MOS6522PMUState *mps = &s->mos6522_pmu;
    505     MOS6522State *ms = MOS6522(mps);
    506     ADBBusState *adb_bus = &s->adb_bus;
    507 
    508     /* Only react to changes in reg B */
    509     if (ms->b == s->last_b) {
    510         return;
    511     }
    512     s->last_b = ms->b;
    513 
    514     /* Check the TREQ / TACK state */
    515     switch (ms->b & (TREQ | TACK)) {
    516     case TREQ:
    517         /* This is an ack release, handle it and bail out */
    518         ms->b |= TACK;
    519         s->last_b = ms->b;
    520 
    521         trace_pmu_debug_protocol_string("handshake: TREQ high, setting TACK");
    522         return;
    523     case TACK:
    524         /* This is a valid request, handle below */
    525         break;
    526     case TREQ | TACK:
    527         /* This is an idle state */
    528         return;
    529     default:
    530         /* Invalid state, log and ignore */
    531         trace_pmu_debug_protocol_error(ms->b);
    532         return;
    533     }
    534 
    535     /* If we wanted to handle commands asynchronously, this is where
    536      * we would delay the clearing of TACK until we are ready to send
    537      * the response
    538      */
    539 
    540     /* We have a request, handshake TACK so we don't stay in
    541      * an invalid state. If we were concurrent with the OS we
    542      * should only do this after we grabbed the SR but that isn't
    543      * a problem here.
    544      */
    545 
    546     trace_pmu_debug_protocol_clear_treq(s->cmd_state);
    547 
    548     ms->b &= ~TACK;
    549     s->last_b = ms->b;
    550 
    551     /* Act according to state */
    552     switch (s->cmd_state) {
    553     case pmu_state_idle:
    554         if (!(ms->acr & SR_OUT)) {
    555             trace_pmu_debug_protocol_string("protocol error! "
    556                                             "state idle, ACR reading");
    557             break;
    558         }
    559 
    560         s->cmd = ms->sr;
    561         via_set_sr_int(s);
    562         s->cmdlen = pmu_data_len[s->cmd][0];
    563         s->rsplen = pmu_data_len[s->cmd][1];
    564         s->cmd_buf_pos = 0;
    565         s->cmd_rsp_pos = 0;
    566         s->cmd_state = pmu_state_cmd;
    567 
    568         adb_autopoll_block(adb_bus);
    569         trace_pmu_debug_protocol_cmd(s->cmd, s->cmdlen, s->rsplen);
    570         break;
    571 
    572     case pmu_state_cmd:
    573         if (!(ms->acr & SR_OUT)) {
    574             trace_pmu_debug_protocol_string("protocol error! "
    575                                             "state cmd, ACR reading");
    576             break;
    577         }
    578 
    579         if (s->cmdlen == -1) {
    580             trace_pmu_debug_protocol_cmdlen(ms->sr);
    581 
    582             s->cmdlen = ms->sr;
    583             if (s->cmdlen > sizeof(s->cmd_buf)) {
    584                 trace_pmu_debug_protocol_cmd_toobig(s->cmdlen);
    585             }
    586         } else if (s->cmd_buf_pos < sizeof(s->cmd_buf)) {
    587             s->cmd_buf[s->cmd_buf_pos++] = ms->sr;
    588         }
    589 
    590         via_set_sr_int(s);
    591         break;
    592 
    593     case pmu_state_rsp:
    594         if (ms->acr & SR_OUT) {
    595             trace_pmu_debug_protocol_string("protocol error! "
    596                                             "state resp, ACR writing");
    597             break;
    598         }
    599 
    600         if (s->rsplen == -1) {
    601             trace_pmu_debug_protocol_cmd_send_resp_size(s->cmd_rsp_sz);
    602 
    603             ms->sr = s->cmd_rsp_sz;
    604             s->rsplen = s->cmd_rsp_sz;
    605         } else if (s->cmd_rsp_pos < s->cmd_rsp_sz) {
    606             trace_pmu_debug_protocol_cmd_send_resp(s->cmd_rsp_pos, s->rsplen);
    607 
    608             ms->sr = s->cmd_rsp[s->cmd_rsp_pos++];
    609         }
    610 
    611         via_set_sr_int(s);
    612         break;
    613     }
    614 
    615     /* Check for state completion */
    616     if (s->cmd_state == pmu_state_cmd && s->cmdlen == s->cmd_buf_pos) {
    617         trace_pmu_debug_protocol_string("Command reception complete, "
    618                                         "dispatching...");
    619 
    620         pmu_dispatch_cmd(s);
    621         s->cmd_state = pmu_state_rsp;
    622     }
    623 
    624     if (s->cmd_state == pmu_state_rsp && s->rsplen == s->cmd_rsp_pos) {
    625         trace_pmu_debug_protocol_cmd_resp_complete(ms->ier);
    626 
    627         adb_autopoll_unblock(adb_bus);
    628         s->cmd_state = pmu_state_idle;
    629     }
    630 }
    631 
    632 static uint64_t mos6522_pmu_read(void *opaque, hwaddr addr, unsigned size)
    633 {
    634     PMUState *s = opaque;
    635     MOS6522PMUState *mps = &s->mos6522_pmu;
    636     MOS6522State *ms = MOS6522(mps);
    637 
    638     addr = (addr >> 9) & 0xf;
    639     return mos6522_read(ms, addr, size);
    640 }
    641 
    642 static void mos6522_pmu_write(void *opaque, hwaddr addr, uint64_t val,
    643                               unsigned size)
    644 {
    645     PMUState *s = opaque;
    646     MOS6522PMUState *mps = &s->mos6522_pmu;
    647     MOS6522State *ms = MOS6522(mps);
    648 
    649     addr = (addr >> 9) & 0xf;
    650     mos6522_write(ms, addr, val, size);
    651 }
    652 
    653 static const MemoryRegionOps mos6522_pmu_ops = {
    654     .read = mos6522_pmu_read,
    655     .write = mos6522_pmu_write,
    656     .endianness = DEVICE_BIG_ENDIAN,
    657     .impl = {
    658         .min_access_size = 1,
    659         .max_access_size = 1,
    660     },
    661 };
    662 
    663 static bool pmu_adb_state_needed(void *opaque)
    664 {
    665     PMUState *s = opaque;
    666 
    667     return s->has_adb;
    668 }
    669 
    670 static const VMStateDescription vmstate_pmu_adb = {
    671     .name = "pmu/adb",
    672     .version_id = 1,
    673     .minimum_version_id = 1,
    674     .needed = pmu_adb_state_needed,
    675     .fields = (VMStateField[]) {
    676         VMSTATE_UINT8(adb_reply_size, PMUState),
    677         VMSTATE_BUFFER(adb_reply, PMUState),
    678         VMSTATE_END_OF_LIST()
    679     }
    680 };
    681 
    682 static const VMStateDescription vmstate_pmu = {
    683     .name = "pmu",
    684     .version_id = 1,
    685     .minimum_version_id = 1,
    686     .fields = (VMStateField[]) {
    687         VMSTATE_STRUCT(mos6522_pmu.parent_obj, PMUState, 0, vmstate_mos6522,
    688                        MOS6522State),
    689         VMSTATE_UINT8(last_b, PMUState),
    690         VMSTATE_UINT8(cmd, PMUState),
    691         VMSTATE_UINT32(cmdlen, PMUState),
    692         VMSTATE_UINT32(rsplen, PMUState),
    693         VMSTATE_UINT8(cmd_buf_pos, PMUState),
    694         VMSTATE_BUFFER(cmd_buf, PMUState),
    695         VMSTATE_UINT8(cmd_rsp_pos, PMUState),
    696         VMSTATE_UINT8(cmd_rsp_sz, PMUState),
    697         VMSTATE_BUFFER(cmd_rsp, PMUState),
    698         VMSTATE_UINT8(intbits, PMUState),
    699         VMSTATE_UINT8(intmask, PMUState),
    700         VMSTATE_UINT32(tick_offset, PMUState),
    701         VMSTATE_TIMER_PTR(one_sec_timer, PMUState),
    702         VMSTATE_INT64(one_sec_target, PMUState),
    703         VMSTATE_END_OF_LIST()
    704     },
    705     .subsections = (const VMStateDescription * []) {
    706         &vmstate_pmu_adb,
    707         NULL
    708     }
    709 };
    710 
    711 static void pmu_reset(DeviceState *dev)
    712 {
    713     PMUState *s = VIA_PMU(dev);
    714 
    715     /* OpenBIOS needs to do this? MacOS 9 needs it */
    716     s->intmask = PMU_INT_ADB | PMU_INT_TICK;
    717     s->intbits = 0;
    718 
    719     s->cmd_state = pmu_state_idle;
    720 }
    721 
    722 static void pmu_realize(DeviceState *dev, Error **errp)
    723 {
    724     PMUState *s = VIA_PMU(dev);
    725     SysBusDevice *sbd;
    726     ADBBusState *adb_bus = &s->adb_bus;
    727     struct tm tm;
    728 
    729     if (!sysbus_realize(SYS_BUS_DEVICE(&s->mos6522_pmu), errp)) {
    730         return;
    731     }
    732 
    733     /* Pass IRQ from 6522 */
    734     sbd = SYS_BUS_DEVICE(s);
    735     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(&s->mos6522_pmu));
    736 
    737     qemu_get_timedate(&tm, 0);
    738     s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
    739     s->one_sec_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, pmu_one_sec_timer, s);
    740     s->one_sec_target = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000;
    741     timer_mod(s->one_sec_timer, s->one_sec_target);
    742 
    743     if (s->has_adb) {
    744         qbus_init(&s->adb_bus, sizeof(s->adb_bus), TYPE_ADB_BUS,
    745                   dev, "adb.0");
    746         adb_register_autopoll_callback(adb_bus, pmu_adb_poll, s);
    747     }
    748 }
    749 
    750 static void pmu_init(Object *obj)
    751 {
    752     SysBusDevice *d = SYS_BUS_DEVICE(obj);
    753     PMUState *s = VIA_PMU(obj);
    754 
    755     object_property_add_link(obj, "gpio", TYPE_MACIO_GPIO,
    756                              (Object **) &s->gpio,
    757                              qdev_prop_allow_set_link_before_realize,
    758                              0);
    759 
    760     object_initialize_child(obj, "mos6522-pmu", &s->mos6522_pmu,
    761                             TYPE_MOS6522_PMU);
    762 
    763     memory_region_init_io(&s->mem, obj, &mos6522_pmu_ops, s, "via-pmu",
    764                           0x2000);
    765     sysbus_init_mmio(d, &s->mem);
    766 }
    767 
    768 static Property pmu_properties[] = {
    769     DEFINE_PROP_BOOL("has-adb", PMUState, has_adb, true),
    770     DEFINE_PROP_END_OF_LIST()
    771 };
    772 
    773 static void pmu_class_init(ObjectClass *oc, void *data)
    774 {
    775     DeviceClass *dc = DEVICE_CLASS(oc);
    776 
    777     dc->realize = pmu_realize;
    778     dc->reset = pmu_reset;
    779     dc->vmsd = &vmstate_pmu;
    780     device_class_set_props(dc, pmu_properties);
    781     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
    782 }
    783 
    784 static const TypeInfo pmu_type_info = {
    785     .name = TYPE_VIA_PMU,
    786     .parent = TYPE_SYS_BUS_DEVICE,
    787     .instance_size = sizeof(PMUState),
    788     .instance_init = pmu_init,
    789     .class_init = pmu_class_init,
    790 };
    791 
    792 static void mos6522_pmu_portB_write(MOS6522State *s)
    793 {
    794     MOS6522PMUState *mps = container_of(s, MOS6522PMUState, parent_obj);
    795     PMUState *ps = container_of(mps, PMUState, mos6522_pmu);
    796 
    797     pmu_update(ps);
    798 }
    799 
    800 static void mos6522_pmu_reset(DeviceState *dev)
    801 {
    802     MOS6522State *ms = MOS6522(dev);
    803     MOS6522PMUState *mps = container_of(ms, MOS6522PMUState, parent_obj);
    804     PMUState *s = container_of(mps, PMUState, mos6522_pmu);
    805     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
    806 
    807     mdc->parent_reset(dev);
    808 
    809     ms->timers[0].frequency = VIA_TIMER_FREQ;
    810     ms->timers[1].frequency = (SCALE_US * 6000) / 4700;
    811 
    812     s->last_b = ms->b = TACK | TREQ;
    813 }
    814 
    815 static void mos6522_pmu_class_init(ObjectClass *oc, void *data)
    816 {
    817     DeviceClass *dc = DEVICE_CLASS(oc);
    818     MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
    819 
    820     device_class_set_parent_reset(dc, mos6522_pmu_reset,
    821                                   &mdc->parent_reset);
    822     mdc->portB_write = mos6522_pmu_portB_write;
    823 }
    824 
    825 static const TypeInfo mos6522_pmu_type_info = {
    826     .name = TYPE_MOS6522_PMU,
    827     .parent = TYPE_MOS6522,
    828     .instance_size = sizeof(MOS6522PMUState),
    829     .class_init = mos6522_pmu_class_init,
    830 };
    831 
    832 static void pmu_register_types(void)
    833 {
    834     type_register_static(&pmu_type_info);
    835     type_register_static(&mos6522_pmu_type_info);
    836 }
    837 
    838 type_init(pmu_register_types)