cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

mac_via.c (41049B)


      1/*
      2 * QEMU m68k Macintosh VIA device support
      3 *
      4 * Copyright (c) 2011-2018 Laurent Vivier
      5 * Copyright (c) 2018 Mark Cave-Ayland
      6 *
      7 * Some parts from hw/misc/macio/cuda.c
      8 *
      9 * Copyright (c) 2004-2007 Fabrice Bellard
     10 * Copyright (c) 2007 Jocelyn Mayer
     11 *
     12 * some parts from linux-2.6.29, arch/m68k/include/asm/mac_via.h
     13 *
     14 * This work is licensed under the terms of the GNU GPL, version 2 or later.
     15 * See the COPYING file in the top-level directory.
     16 */
     17
     18#include "qemu/osdep.h"
     19#include "qemu-common.h"
     20#include "migration/vmstate.h"
     21#include "hw/sysbus.h"
     22#include "hw/irq.h"
     23#include "qemu/timer.h"
     24#include "hw/misc/mac_via.h"
     25#include "hw/misc/mos6522.h"
     26#include "hw/input/adb.h"
     27#include "sysemu/runstate.h"
     28#include "qapi/error.h"
     29#include "qemu/cutils.h"
     30#include "hw/qdev-properties.h"
     31#include "hw/qdev-properties-system.h"
     32#include "sysemu/block-backend.h"
     33#include "trace.h"
     34#include "qemu/log.h"
     35
     36/*
     37 * VIAs: There are two in every machine
     38 */
     39
     40/*
     41 * Not all of these are true post MacII I think.
     42 * CSA: probably the ones CHRP marks as 'unused' change purposes
     43 * when the IWM becomes the SWIM.
     44 * http://www.rs6000.ibm.com/resource/technology/chrpio/via5.mak.html
     45 * ftp://ftp.austin.ibm.com/pub/technology/spec/chrp/inwork/CHRP_IORef_1.0.pdf
     46 *
     47 * also, http://developer.apple.com/technotes/hw/hw_09.html claims the
     48 * following changes for IIfx:
     49 * VIA1A_vSccWrReq not available and that VIA1A_vSync has moved to an IOP.
     50 * Also, "All of the functionality of VIA2 has been moved to other chips".
     51 */
     52
     53#define VIA1A_vSccWrReq 0x80   /*
     54                                * SCC write. (input)
     55                                * [CHRP] SCC WREQ: Reflects the state of the
     56                                * Wait/Request pins from the SCC.
     57                                * [Macintosh Family Hardware]
     58                                * as CHRP on SE/30,II,IIx,IIcx,IIci.
     59                                * on IIfx, "0 means an active request"
     60                                */
     61#define VIA1A_vRev8     0x40   /*
     62                                * Revision 8 board ???
     63                                * [CHRP] En WaitReqB: Lets the WaitReq_L
     64                                * signal from port B of the SCC appear on
     65                                * the PA7 input pin. Output.
     66                                * [Macintosh Family] On the SE/30, this
     67                                * is the bit to flip screen buffers.
     68                                * 0=alternate, 1=main.
     69                                * on II,IIx,IIcx,IIci,IIfx this is a bit
     70                                * for Rev ID. 0=II,IIx, 1=IIcx,IIci,IIfx
     71                                */
     72#define VIA1A_vHeadSel  0x20   /*
     73                                * Head select for IWM.
     74                                * [CHRP] unused.
     75                                * [Macintosh Family] "Floppy disk
     76                                * state-control line SEL" on all but IIfx
     77                                */
     78#define VIA1A_vOverlay  0x10   /*
     79                                * [Macintosh Family] On SE/30,II,IIx,IIcx
     80                                * this bit enables the "Overlay" address
     81                                * map in the address decoders as it is on
     82                                * reset for mapping the ROM over the reset
     83                                * vector. 1=use overlay map.
     84                                * On the IIci,IIfx it is another bit of the
     85                                * CPU ID: 0=normal IIci, 1=IIci with parity
     86                                * feature or IIfx.
     87                                * [CHRP] En WaitReqA: Lets the WaitReq_L
     88                                * signal from port A of the SCC appear
     89                                * on the PA7 input pin (CHRP). Output.
     90                                * [MkLinux] "Drive Select"
     91                                *  (with 0x20 being 'disk head select')
     92                                */
     93#define VIA1A_vSync     0x08   /*
     94                                * [CHRP] Sync Modem: modem clock select:
     95                                * 1: select the external serial clock to
     96                                *    drive the SCC's /RTxCA pin.
     97                                * 0: Select the 3.6864MHz clock to drive
     98                                *    the SCC cell.
     99                                * [Macintosh Family] Correct on all but IIfx
    100                                */
    101
    102/*
    103 * Macintosh Family Hardware sez: bits 0-2 of VIA1A are volume control
    104 * on Macs which had the PWM sound hardware.  Reserved on newer models.
    105 * On IIci,IIfx, bits 1-2 are the rest of the CPU ID:
    106 * bit 2: 1=IIci, 0=IIfx
    107 * bit 1: 1 on both IIci and IIfx.
    108 * MkLinux sez bit 0 is 'burnin flag' in this case.
    109 * CHRP sez: VIA1A bits 0-2 and 5 are 'unused': if programmed as
    110 * inputs, these bits will read 0.
    111 */
    112#define VIA1A_vVolume   0x07    /* Audio volume mask for PWM */
    113#define VIA1A_CPUID0    0x02    /* CPU id bit 0 on RBV, others */
    114#define VIA1A_CPUID1    0x04    /* CPU id bit 0 on RBV, others */
    115#define VIA1A_CPUID2    0x10    /* CPU id bit 0 on RBV, others */
    116#define VIA1A_CPUID3    0x40    /* CPU id bit 0 on RBV, others */
    117
    118/*
    119 * Info on VIA1B is from Macintosh Family Hardware & MkLinux.
    120 * CHRP offers no info.
    121 */
    122#define VIA1B_vSound   0x80    /*
    123                                * Sound enable (for compatibility with
    124                                * PWM hardware) 0=enabled.
    125                                * Also, on IIci w/parity, shows parity error
    126                                * 0=error, 1=OK.
    127                                */
    128#define VIA1B_vMystery 0x40    /*
    129                                * On IIci, parity enable. 0=enabled,1=disabled
    130                                * On SE/30, vertical sync interrupt enable.
    131                                * 0=enabled. This vSync interrupt shows up
    132                                * as a slot $E interrupt.
    133                                */
    134#define VIA1B_vADBS2   0x20    /* ADB state input bit 1 (unused on IIfx) */
    135#define VIA1B_vADBS1   0x10    /* ADB state input bit 0 (unused on IIfx) */
    136#define VIA1B_vADBInt  0x08    /* ADB interrupt 0=interrupt (unused on IIfx)*/
    137#define VIA1B_vRTCEnb  0x04    /* Enable Real time clock. 0=enabled. */
    138#define VIA1B_vRTCClk  0x02    /* Real time clock serial-clock line. */
    139#define VIA1B_vRTCData 0x01    /* Real time clock serial-data line. */
    140
    141/*
    142 *    VIA2 A register is the interrupt lines raised off the nubus
    143 *    slots.
    144 *      The below info is from 'Macintosh Family Hardware.'
    145 *      MkLinux calls the 'IIci internal video IRQ' below the 'RBV slot 0 irq.'
    146 *      It also notes that the slot $9 IRQ is the 'Ethernet IRQ' and
    147 *      defines the 'Video IRQ' as 0x40 for the 'EVR' VIA work-alike.
    148 *      Perhaps OSS uses vRAM1 and vRAM2 for ADB.
    149 */
    150
    151#define VIA2A_vRAM1    0x80    /* RAM size bit 1 (IIci: reserved) */
    152#define VIA2A_vRAM0    0x40    /* RAM size bit 0 (IIci: internal video IRQ) */
    153#define VIA2A_vIRQE    0x20    /* IRQ from slot $E */
    154#define VIA2A_vIRQD    0x10    /* IRQ from slot $D */
    155#define VIA2A_vIRQC    0x08    /* IRQ from slot $C */
    156#define VIA2A_vIRQB    0x04    /* IRQ from slot $B */
    157#define VIA2A_vIRQA    0x02    /* IRQ from slot $A */
    158#define VIA2A_vIRQ9    0x01    /* IRQ from slot $9 */
    159
    160/*
    161 * RAM size bits decoded as follows:
    162 * bit1 bit0  size of ICs in bank A
    163 *  0    0    256 kbit
    164 *  0    1    1 Mbit
    165 *  1    0    4 Mbit
    166 *  1    1   16 Mbit
    167 */
    168
    169/*
    170 *    Register B has the fun stuff in it
    171 */
    172
    173#define VIA2B_vVBL    0x80    /*
    174                               * VBL output to VIA1 (60.15Hz) driven by
    175                               * timer T1.
    176                               * on IIci, parity test: 0=test mode.
    177                               * [MkLinux] RBV_PARODD: 1=odd,0=even.
    178                               */
    179#define VIA2B_vSndJck 0x40    /*
    180                               * External sound jack status.
    181                               * 0=plug is inserted.  On SE/30, always 0
    182                               */
    183#define VIA2B_vTfr0   0x20    /* Transfer mode bit 0 ack from NuBus */
    184#define VIA2B_vTfr1   0x10    /* Transfer mode bit 1 ack from NuBus */
    185#define VIA2B_vMode32 0x08    /*
    186                               * 24/32bit switch - doubles as cache flush
    187                               * on II, AMU/PMMU control.
    188                               *   if AMU, 0=24bit to 32bit translation
    189                               *   if PMMU, 1=PMMU is accessing page table.
    190                               * on SE/30 tied low.
    191                               * on IIx,IIcx,IIfx, unused.
    192                               * on IIci/RBV, cache control. 0=flush cache.
    193                               */
    194#define VIA2B_vPower  0x04   /*
    195                              * Power off, 0=shut off power.
    196                              * on SE/30 this signal sent to PDS card.
    197                              */
    198#define VIA2B_vBusLk  0x02   /*
    199                              * Lock NuBus transactions, 0=locked.
    200                              * on SE/30 sent to PDS card.
    201                              */
    202#define VIA2B_vCDis   0x01   /*
    203                              * Cache control. On IIci, 1=disable cache card
    204                              * on others, 0=disable processor's instruction
    205                              * and data caches.
    206                              */
    207
    208/* interrupt flags */
    209
    210#define IRQ_SET         0x80
    211
    212/* common */
    213
    214#define VIA_IRQ_TIMER1      0x40
    215#define VIA_IRQ_TIMER2      0x20
    216
    217/*
    218 * Apple sez: http://developer.apple.com/technotes/ov/ov_04.html
    219 * Another example of a valid function that has no ROM support is the use
    220 * of the alternate video page for page-flipping animation. Since there
    221 * is no ROM call to flip pages, it is necessary to go play with the
    222 * right bit in the VIA chip (6522 Versatile Interface Adapter).
    223 * [CSA: don't know which one this is, but it's one of 'em!]
    224 */
    225
    226/*
    227 *    6522 registers - see databook.
    228 * CSA: Assignments for VIA1 confirmed from CHRP spec.
    229 */
    230
    231/* partial address decode.  0xYYXX : XX part for RBV, YY part for VIA */
    232/* Note: 15 VIA regs, 8 RBV regs */
    233
    234#define vBufB    0x0000  /* [VIA/RBV]  Register B */
    235#define vBufAH   0x0200  /* [VIA only] Buffer A, with handshake. DON'T USE! */
    236#define vDirB    0x0400  /* [VIA only] Data Direction Register B. */
    237#define vDirA    0x0600  /* [VIA only] Data Direction Register A. */
    238#define vT1CL    0x0800  /* [VIA only] Timer one counter low. */
    239#define vT1CH    0x0a00  /* [VIA only] Timer one counter high. */
    240#define vT1LL    0x0c00  /* [VIA only] Timer one latches low. */
    241#define vT1LH    0x0e00  /* [VIA only] Timer one latches high. */
    242#define vT2CL    0x1000  /* [VIA only] Timer two counter low. */
    243#define vT2CH    0x1200  /* [VIA only] Timer two counter high. */
    244#define vSR      0x1400  /* [VIA only] Shift register. */
    245#define vACR     0x1600  /* [VIA only] Auxilary control register. */
    246#define vPCR     0x1800  /* [VIA only] Peripheral control register. */
    247                         /*
    248                          *           CHRP sez never ever to *write* this.
    249                          *            Mac family says never to *change* this.
    250                          * In fact we need to initialize it once at start.
    251                          */
    252#define vIFR     0x1a00  /* [VIA/RBV]  Interrupt flag register. */
    253#define vIER     0x1c00  /* [VIA/RBV]  Interrupt enable register. */
    254#define vBufA    0x1e00  /* [VIA/RBV] register A (no handshake) */
    255
    256/* from linux 2.6 drivers/macintosh/via-macii.c */
    257
    258/* Bits in ACR */
    259
    260#define VIA1ACR_vShiftCtrl         0x1c        /* Shift register control bits */
    261#define VIA1ACR_vShiftExtClk       0x0c        /* Shift on external clock */
    262#define VIA1ACR_vShiftOut          0x10        /* Shift out if 1 */
    263
    264/*
    265 * Apple Macintosh Family Hardware Refenece
    266 * Table 19-10 ADB transaction states
    267 */
    268
    269#define ADB_STATE_NEW       0
    270#define ADB_STATE_EVEN      1
    271#define ADB_STATE_ODD       2
    272#define ADB_STATE_IDLE      3
    273
    274#define VIA1B_vADB_StateMask    (VIA1B_vADBS1 | VIA1B_vADBS2)
    275#define VIA1B_vADB_StateShift   4
    276
    277#define VIA_TIMER_FREQ (783360)
    278#define VIA_ADB_POLL_FREQ 50 /* XXX: not real */
    279
    280/*
    281 * Guide to the Macintosh Family Hardware ch. 12 "Displays" p. 401 gives the
    282 * precise 60Hz interrupt frequency as ~60.15Hz with a period of 16625.8 us
    283 */
    284#define VIA_60HZ_TIMER_PERIOD_NS   16625800
    285
    286/* VIA returns time offset from Jan 1, 1904, not 1970 */
    287#define RTC_OFFSET 2082844800
    288
    289enum {
    290    REG_0,
    291    REG_1,
    292    REG_2,
    293    REG_3,
    294    REG_TEST,
    295    REG_WPROTECT,
    296    REG_PRAM_ADDR,
    297    REG_PRAM_ADDR_LAST = REG_PRAM_ADDR + 19,
    298    REG_PRAM_SECT,
    299    REG_PRAM_SECT_LAST = REG_PRAM_SECT + 7,
    300    REG_INVALID,
    301    REG_EMPTY = 0xff,
    302};
    303
    304static void via1_sixty_hz_update(MOS6522Q800VIA1State *v1s)
    305{
    306    /* 60 Hz irq */
    307    v1s->next_sixty_hz = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
    308                          VIA_60HZ_TIMER_PERIOD_NS) /
    309                          VIA_60HZ_TIMER_PERIOD_NS * VIA_60HZ_TIMER_PERIOD_NS;
    310    timer_mod(v1s->sixty_hz_timer, v1s->next_sixty_hz);
    311}
    312
    313static void via1_one_second_update(MOS6522Q800VIA1State *v1s)
    314{
    315    v1s->next_second = (qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000) /
    316                       1000 * 1000;
    317    timer_mod(v1s->one_second_timer, v1s->next_second);
    318}
    319
    320static void via1_sixty_hz(void *opaque)
    321{
    322    MOS6522Q800VIA1State *v1s = opaque;
    323    MOS6522State *s = MOS6522(v1s);
    324    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
    325
    326    s->ifr |= VIA1_IRQ_60HZ;
    327    mdc->update_irq(s);
    328
    329    via1_sixty_hz_update(v1s);
    330}
    331
    332static void via1_one_second(void *opaque)
    333{
    334    MOS6522Q800VIA1State *v1s = opaque;
    335    MOS6522State *s = MOS6522(v1s);
    336    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
    337
    338    s->ifr |= VIA1_IRQ_ONE_SECOND;
    339    mdc->update_irq(s);
    340
    341    via1_one_second_update(v1s);
    342}
    343
    344static void via1_irq_request(void *opaque, int irq, int level)
    345{
    346    MOS6522Q800VIA1State *v1s = opaque;
    347    MOS6522State *s = MOS6522(v1s);
    348    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
    349
    350    if (level) {
    351        s->ifr |= 1 << irq;
    352    } else {
    353        s->ifr &= ~(1 << irq);
    354    }
    355
    356    mdc->update_irq(s);
    357}
    358
    359static void via2_irq_request(void *opaque, int irq, int level)
    360{
    361    MOS6522Q800VIA2State *v2s = opaque;
    362    MOS6522State *s = MOS6522(v2s);
    363    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
    364
    365    if (level) {
    366        s->ifr |= 1 << irq;
    367    } else {
    368        s->ifr &= ~(1 << irq);
    369    }
    370
    371    mdc->update_irq(s);
    372}
    373
    374
    375static void pram_update(MOS6522Q800VIA1State *v1s)
    376{
    377    if (v1s->blk) {
    378        if (blk_pwrite(v1s->blk, 0, v1s->PRAM, sizeof(v1s->PRAM), 0) < 0) {
    379            qemu_log("pram_update: cannot write to file\n");
    380        }
    381    }
    382}
    383
    384/*
    385 * RTC Commands
    386 *
    387 * Command byte    Register addressed by the command
    388 *
    389 * z0000001        Seconds register 0 (lowest-order byte)
    390 * z0000101        Seconds register 1
    391 * z0001001        Seconds register 2
    392 * z0001101        Seconds register 3 (highest-order byte)
    393 * 00110001        Test register (write-only)
    394 * 00110101        Write-Protect Register (write-only)
    395 * z010aa01        RAM address 100aa ($10-$13) (first 20 bytes only)
    396 * z1aaaa01        RAM address 0aaaa ($00-$0F) (first 20 bytes only)
    397 * z0111aaa        Extended memory designator and sector number
    398 *
    399 * For a read request, z=1, for a write z=0
    400 * The letter a indicates bits whose value depend on what parameter
    401 * RAM byte you want to address
    402 */
    403static int via1_rtc_compact_cmd(uint8_t value)
    404{
    405    uint8_t read = value & 0x80;
    406
    407    value &= 0x7f;
    408
    409    /* the last 2 bits of a command byte must always be 0b01 ... */
    410    if ((value & 0x78) == 0x38) {
    411        /* except for the extended memory designator */
    412        return read | (REG_PRAM_SECT + (value & 0x07));
    413    }
    414    if ((value & 0x03) == 0x01) {
    415        value >>= 2;
    416        if ((value & 0x1c) == 0) {
    417            /* seconds registers */
    418            return read | (REG_0 + (value & 0x03));
    419        } else if ((value == 0x0c) && !read) {
    420            return REG_TEST;
    421        } else if ((value == 0x0d) && !read) {
    422            return REG_WPROTECT;
    423        } else if ((value & 0x1c) == 0x08) {
    424            /* RAM address 0x10 to 0x13 */
    425            return read | (REG_PRAM_ADDR + 0x10 + (value & 0x03));
    426        } else if ((value & 0x43) == 0x41) {
    427            /* RAM address 0x00 to 0x0f */
    428            return read | (REG_PRAM_ADDR + (value & 0x0f));
    429        }
    430    }
    431    return REG_INVALID;
    432}
    433
    434static void via1_rtc_update(MOS6522Q800VIA1State *v1s)
    435{
    436    MOS6522State *s = MOS6522(v1s);
    437    int cmd, sector, addr;
    438    uint32_t time;
    439
    440    if (s->b & VIA1B_vRTCEnb) {
    441        return;
    442    }
    443
    444    if (s->dirb & VIA1B_vRTCData) {
    445        /* send bits to the RTC */
    446        if (!(v1s->last_b & VIA1B_vRTCClk) && (s->b & VIA1B_vRTCClk)) {
    447            v1s->data_out <<= 1;
    448            v1s->data_out |= s->b & VIA1B_vRTCData;
    449            v1s->data_out_cnt++;
    450        }
    451        trace_via1_rtc_update_data_out(v1s->data_out_cnt, v1s->data_out);
    452    } else {
    453        trace_via1_rtc_update_data_in(v1s->data_in_cnt, v1s->data_in);
    454        /* receive bits from the RTC */
    455        if ((v1s->last_b & VIA1B_vRTCClk) &&
    456            !(s->b & VIA1B_vRTCClk) &&
    457            v1s->data_in_cnt) {
    458            s->b = (s->b & ~VIA1B_vRTCData) |
    459                   ((v1s->data_in >> 7) & VIA1B_vRTCData);
    460            v1s->data_in <<= 1;
    461            v1s->data_in_cnt--;
    462        }
    463        return;
    464    }
    465
    466    if (v1s->data_out_cnt != 8) {
    467        return;
    468    }
    469
    470    v1s->data_out_cnt = 0;
    471
    472    trace_via1_rtc_internal_status(v1s->cmd, v1s->alt, v1s->data_out);
    473    /* first byte: it's a command */
    474    if (v1s->cmd == REG_EMPTY) {
    475
    476        cmd = via1_rtc_compact_cmd(v1s->data_out);
    477        trace_via1_rtc_internal_cmd(cmd);
    478
    479        if (cmd == REG_INVALID) {
    480            trace_via1_rtc_cmd_invalid(v1s->data_out);
    481            return;
    482        }
    483
    484        if (cmd & 0x80) { /* this is a read command */
    485            switch (cmd & 0x7f) {
    486            case REG_0...REG_3: /* seconds registers */
    487                /*
    488                 * register 0 is lowest-order byte
    489                 * register 3 is highest-order byte
    490                 */
    491
    492                time = v1s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
    493                       / NANOSECONDS_PER_SECOND);
    494                trace_via1_rtc_internal_time(time);
    495                v1s->data_in = (time >> ((cmd & 0x03) << 3)) & 0xff;
    496                v1s->data_in_cnt = 8;
    497                trace_via1_rtc_cmd_seconds_read((cmd & 0x7f) - REG_0,
    498                                                v1s->data_in);
    499                break;
    500            case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
    501                /* PRAM address 0x00 -> 0x13 */
    502                v1s->data_in = v1s->PRAM[(cmd & 0x7f) - REG_PRAM_ADDR];
    503                v1s->data_in_cnt = 8;
    504                trace_via1_rtc_cmd_pram_read((cmd & 0x7f) - REG_PRAM_ADDR,
    505                                             v1s->data_in);
    506                break;
    507            case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
    508                /*
    509                 * extended memory designator and sector number
    510                 * the only two-byte read command
    511                 */
    512                trace_via1_rtc_internal_set_cmd(cmd);
    513                v1s->cmd = cmd;
    514                break;
    515            default:
    516                g_assert_not_reached();
    517                break;
    518            }
    519            return;
    520        }
    521
    522        /* this is a write command, needs a parameter */
    523        if (cmd == REG_WPROTECT || !v1s->wprotect) {
    524            trace_via1_rtc_internal_set_cmd(cmd);
    525            v1s->cmd = cmd;
    526        } else {
    527            trace_via1_rtc_internal_ignore_cmd(cmd);
    528        }
    529        return;
    530    }
    531
    532    /* second byte: it's a parameter */
    533    if (v1s->alt == REG_EMPTY) {
    534        switch (v1s->cmd & 0x7f) {
    535        case REG_0...REG_3: /* seconds register */
    536            /* FIXME */
    537            trace_via1_rtc_cmd_seconds_write(v1s->cmd - REG_0, v1s->data_out);
    538            v1s->cmd = REG_EMPTY;
    539            break;
    540        case REG_TEST:
    541            /* device control: nothing to do */
    542            trace_via1_rtc_cmd_test_write(v1s->data_out);
    543            v1s->cmd = REG_EMPTY;
    544            break;
    545        case REG_WPROTECT:
    546            /* Write Protect register */
    547            trace_via1_rtc_cmd_wprotect_write(v1s->data_out);
    548            v1s->wprotect = !!(v1s->data_out & 0x80);
    549            v1s->cmd = REG_EMPTY;
    550            break;
    551        case REG_PRAM_ADDR...REG_PRAM_ADDR_LAST:
    552            /* PRAM address 0x00 -> 0x13 */
    553            trace_via1_rtc_cmd_pram_write(v1s->cmd - REG_PRAM_ADDR,
    554                                          v1s->data_out);
    555            v1s->PRAM[v1s->cmd - REG_PRAM_ADDR] = v1s->data_out;
    556            pram_update(v1s);
    557            v1s->cmd = REG_EMPTY;
    558            break;
    559        case REG_PRAM_SECT...REG_PRAM_SECT_LAST:
    560            addr = (v1s->data_out >> 2) & 0x1f;
    561            sector = (v1s->cmd & 0x7f) - REG_PRAM_SECT;
    562            if (v1s->cmd & 0x80) {
    563                /* it's a read */
    564                v1s->data_in = v1s->PRAM[sector * 32 + addr];
    565                v1s->data_in_cnt = 8;
    566                trace_via1_rtc_cmd_pram_sect_read(sector, addr,
    567                                                  sector * 32 + addr,
    568                                                  v1s->data_in);
    569                v1s->cmd = REG_EMPTY;
    570            } else {
    571                /* it's a write, we need one more parameter */
    572                trace_via1_rtc_internal_set_alt(addr, sector, addr);
    573                v1s->alt = addr;
    574            }
    575            break;
    576        default:
    577            g_assert_not_reached();
    578            break;
    579        }
    580        return;
    581    }
    582
    583    /* third byte: it's the data of a REG_PRAM_SECT write */
    584    g_assert(REG_PRAM_SECT <= v1s->cmd && v1s->cmd <= REG_PRAM_SECT_LAST);
    585    sector = v1s->cmd - REG_PRAM_SECT;
    586    v1s->PRAM[sector * 32 + v1s->alt] = v1s->data_out;
    587    pram_update(v1s);
    588    trace_via1_rtc_cmd_pram_sect_write(sector, v1s->alt, sector * 32 + v1s->alt,
    589                                       v1s->data_out);
    590    v1s->alt = REG_EMPTY;
    591    v1s->cmd = REG_EMPTY;
    592}
    593
    594static void adb_via_poll(void *opaque)
    595{
    596    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
    597    MOS6522State *s = MOS6522(v1s);
    598    ADBBusState *adb_bus = &v1s->adb_bus;
    599    uint8_t obuf[9];
    600    uint8_t *data = &s->sr;
    601    int olen;
    602
    603    /*
    604     * Setting vADBInt below indicates that an autopoll reply has been
    605     * received, however we must block autopoll until the point where
    606     * the entire reply has been read back to the host
    607     */
    608    adb_autopoll_block(adb_bus);
    609
    610    if (v1s->adb_data_in_size > 0 && v1s->adb_data_in_index == 0) {
    611        /*
    612         * For older Linux kernels that switch to IDLE mode after sending the
    613         * ADB command, detect if there is an existing response and return that
    614         * as a a "fake" autopoll reply or bus timeout accordingly
    615         */
    616        *data = v1s->adb_data_out[0];
    617        olen = v1s->adb_data_in_size;
    618
    619        s->b &= ~VIA1B_vADBInt;
    620        qemu_irq_raise(v1s->adb_data_ready);
    621    } else {
    622        /*
    623         * Otherwise poll as normal
    624         */
    625        v1s->adb_data_in_index = 0;
    626        v1s->adb_data_out_index = 0;
    627        olen = adb_poll(adb_bus, obuf, adb_bus->autopoll_mask);
    628
    629        if (olen > 0) {
    630            /* Autopoll response */
    631            *data = obuf[0];
    632            olen--;
    633            memcpy(v1s->adb_data_in, &obuf[1], olen);
    634            v1s->adb_data_in_size = olen;
    635
    636            s->b &= ~VIA1B_vADBInt;
    637            qemu_irq_raise(v1s->adb_data_ready);
    638        } else {
    639            *data = v1s->adb_autopoll_cmd;
    640            obuf[0] = 0xff;
    641            obuf[1] = 0xff;
    642            olen = 2;
    643
    644            memcpy(v1s->adb_data_in, obuf, olen);
    645            v1s->adb_data_in_size = olen;
    646
    647            s->b &= ~VIA1B_vADBInt;
    648            qemu_irq_raise(v1s->adb_data_ready);
    649        }
    650    }
    651
    652    trace_via1_adb_poll(*data, (s->b & VIA1B_vADBInt) ? "+" : "-",
    653                        adb_bus->status, v1s->adb_data_in_index, olen);
    654}
    655
    656static int adb_via_send_len(uint8_t data)
    657{
    658    /* Determine the send length from the given ADB command */
    659    uint8_t cmd = data & 0xc;
    660    uint8_t reg = data & 0x3;
    661
    662    switch (cmd) {
    663    case 0x8:
    664        /* Listen command */
    665        switch (reg) {
    666        case 2:
    667            /* Register 2 is only used for the keyboard */
    668            return 3;
    669        case 3:
    670            /*
    671             * Fortunately our devices only implement writes
    672             * to register 3 which is fixed at 2 bytes
    673             */
    674            return 3;
    675        default:
    676            qemu_log_mask(LOG_UNIMP, "ADB unknown length for register %d\n",
    677                          reg);
    678            return 1;
    679        }
    680    default:
    681        /* Talk, BusReset */
    682        return 1;
    683    }
    684}
    685
    686static void adb_via_send(MOS6522Q800VIA1State *v1s, int state, uint8_t data)
    687{
    688    MOS6522State *ms = MOS6522(v1s);
    689    ADBBusState *adb_bus = &v1s->adb_bus;
    690    uint16_t autopoll_mask;
    691
    692    switch (state) {
    693    case ADB_STATE_NEW:
    694        /*
    695         * Command byte: vADBInt tells host autopoll data already present
    696         * in VIA shift register and ADB transceiver
    697         */
    698        adb_autopoll_block(adb_bus);
    699
    700        if (adb_bus->status & ADB_STATUS_POLLREPLY) {
    701            /* Tell the host the existing data is from autopoll */
    702            ms->b &= ~VIA1B_vADBInt;
    703        } else {
    704            ms->b |= VIA1B_vADBInt;
    705            v1s->adb_data_out_index = 0;
    706            v1s->adb_data_out[v1s->adb_data_out_index++] = data;
    707        }
    708
    709        trace_via1_adb_send(" NEW", data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
    710        qemu_irq_raise(v1s->adb_data_ready);
    711        break;
    712
    713    case ADB_STATE_EVEN:
    714    case ADB_STATE_ODD:
    715        ms->b |= VIA1B_vADBInt;
    716        v1s->adb_data_out[v1s->adb_data_out_index++] = data;
    717
    718        trace_via1_adb_send(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
    719                            data, (ms->b & VIA1B_vADBInt) ? "+" : "-");
    720        qemu_irq_raise(v1s->adb_data_ready);
    721        break;
    722
    723    case ADB_STATE_IDLE:
    724        return;
    725    }
    726
    727    /* If the command is complete, execute it */
    728    if (v1s->adb_data_out_index == adb_via_send_len(v1s->adb_data_out[0])) {
    729        v1s->adb_data_in_size = adb_request(adb_bus, v1s->adb_data_in,
    730                                            v1s->adb_data_out,
    731                                            v1s->adb_data_out_index);
    732        v1s->adb_data_in_index = 0;
    733
    734        if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
    735            /*
    736             * Bus timeout (but allow first EVEN and ODD byte to indicate
    737             * timeout via vADBInt and SRQ status)
    738             */
    739            v1s->adb_data_in[0] = 0xff;
    740            v1s->adb_data_in[1] = 0xff;
    741            v1s->adb_data_in_size = 2;
    742        }
    743
    744        /*
    745         * If last command is TALK, store it for use by autopoll and adjust
    746         * the autopoll mask accordingly
    747         */
    748        if ((v1s->adb_data_out[0] & 0xc) == 0xc) {
    749            v1s->adb_autopoll_cmd = v1s->adb_data_out[0];
    750
    751            autopoll_mask = 1 << (v1s->adb_autopoll_cmd >> 4);
    752            adb_set_autopoll_mask(adb_bus, autopoll_mask);
    753        }
    754    }
    755}
    756
    757static void adb_via_receive(MOS6522Q800VIA1State *v1s, int state, uint8_t *data)
    758{
    759    MOS6522State *ms = MOS6522(v1s);
    760    ADBBusState *adb_bus = &v1s->adb_bus;
    761    uint16_t pending;
    762
    763    switch (state) {
    764    case ADB_STATE_NEW:
    765        ms->b |= VIA1B_vADBInt;
    766        return;
    767
    768    case ADB_STATE_IDLE:
    769        ms->b |= VIA1B_vADBInt;
    770        adb_autopoll_unblock(adb_bus);
    771
    772        trace_via1_adb_receive("IDLE", *data,
    773                        (ms->b & VIA1B_vADBInt) ? "+" : "-", adb_bus->status,
    774                        v1s->adb_data_in_index, v1s->adb_data_in_size);
    775
    776        break;
    777
    778    case ADB_STATE_EVEN:
    779    case ADB_STATE_ODD:
    780        switch (v1s->adb_data_in_index) {
    781        case 0:
    782            /* First EVEN byte: vADBInt indicates bus timeout */
    783            *data = v1s->adb_data_in[v1s->adb_data_in_index];
    784            if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
    785                ms->b &= ~VIA1B_vADBInt;
    786            } else {
    787                ms->b |= VIA1B_vADBInt;
    788            }
    789
    790            trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
    791                                   *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
    792                                   adb_bus->status, v1s->adb_data_in_index,
    793                                   v1s->adb_data_in_size);
    794
    795            v1s->adb_data_in_index++;
    796            break;
    797
    798        case 1:
    799            /* First ODD byte: vADBInt indicates SRQ */
    800            *data = v1s->adb_data_in[v1s->adb_data_in_index];
    801            pending = adb_bus->pending & ~(1 << (v1s->adb_autopoll_cmd >> 4));
    802            if (pending) {
    803                ms->b &= ~VIA1B_vADBInt;
    804            } else {
    805                ms->b |= VIA1B_vADBInt;
    806            }
    807
    808            trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
    809                                   *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
    810                                   adb_bus->status, v1s->adb_data_in_index,
    811                                   v1s->adb_data_in_size);
    812
    813            v1s->adb_data_in_index++;
    814            break;
    815
    816        default:
    817            /*
    818             * Otherwise vADBInt indicates end of data. Note that Linux
    819             * specifically checks for the sequence 0x0 0xff to confirm the
    820             * end of the poll reply, so provide these extra bytes below to
    821             * keep it happy
    822             */
    823            if (v1s->adb_data_in_index < v1s->adb_data_in_size) {
    824                /* Next data byte */
    825                *data = v1s->adb_data_in[v1s->adb_data_in_index];
    826                ms->b |= VIA1B_vADBInt;
    827            } else if (v1s->adb_data_in_index == v1s->adb_data_in_size) {
    828                if (adb_bus->status & ADB_STATUS_BUSTIMEOUT) {
    829                    /* Bus timeout (no more data) */
    830                    *data = 0xff;
    831                } else {
    832                    /* Return 0x0 after reply */
    833                    *data = 0;
    834                }
    835                ms->b &= ~VIA1B_vADBInt;
    836            } else {
    837                /* Bus timeout (no more data) */
    838                *data = 0xff;
    839                ms->b &= ~VIA1B_vADBInt;
    840                adb_bus->status = 0;
    841                adb_autopoll_unblock(adb_bus);
    842            }
    843
    844            trace_via1_adb_receive(state == ADB_STATE_EVEN ? "EVEN" : " ODD",
    845                                   *data, (ms->b & VIA1B_vADBInt) ? "+" : "-",
    846                                   adb_bus->status, v1s->adb_data_in_index,
    847                                   v1s->adb_data_in_size);
    848
    849            if (v1s->adb_data_in_index <= v1s->adb_data_in_size) {
    850                v1s->adb_data_in_index++;
    851            }
    852            break;
    853        }
    854
    855        qemu_irq_raise(v1s->adb_data_ready);
    856        break;
    857    }
    858}
    859
    860static void via1_adb_update(MOS6522Q800VIA1State *v1s)
    861{
    862    MOS6522State *s = MOS6522(v1s);
    863    int oldstate, state;
    864
    865    oldstate = (v1s->last_b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
    866    state = (s->b & VIA1B_vADB_StateMask) >> VIA1B_vADB_StateShift;
    867
    868    if (state != oldstate) {
    869        if (s->acr & VIA1ACR_vShiftOut) {
    870            /* output mode */
    871            adb_via_send(v1s, state, s->sr);
    872        } else {
    873            /* input mode */
    874            adb_via_receive(v1s, state, &s->sr);
    875        }
    876    }
    877}
    878
    879static uint64_t mos6522_q800_via1_read(void *opaque, hwaddr addr, unsigned size)
    880{
    881    MOS6522Q800VIA1State *s = MOS6522_Q800_VIA1(opaque);
    882    MOS6522State *ms = MOS6522(s);
    883
    884    addr = (addr >> 9) & 0xf;
    885    return mos6522_read(ms, addr, size);
    886}
    887
    888static void mos6522_q800_via1_write(void *opaque, hwaddr addr, uint64_t val,
    889                                    unsigned size)
    890{
    891    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
    892    MOS6522State *ms = MOS6522(v1s);
    893
    894    addr = (addr >> 9) & 0xf;
    895    mos6522_write(ms, addr, val, size);
    896
    897    switch (addr) {
    898    case VIA_REG_B:
    899        via1_rtc_update(v1s);
    900        via1_adb_update(v1s);
    901
    902        v1s->last_b = ms->b;
    903        break;
    904    }
    905}
    906
    907static const MemoryRegionOps mos6522_q800_via1_ops = {
    908    .read = mos6522_q800_via1_read,
    909    .write = mos6522_q800_via1_write,
    910    .endianness = DEVICE_BIG_ENDIAN,
    911    .valid = {
    912        .min_access_size = 1,
    913        .max_access_size = 4,
    914    },
    915};
    916
    917static uint64_t mos6522_q800_via2_read(void *opaque, hwaddr addr, unsigned size)
    918{
    919    MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
    920    MOS6522State *ms = MOS6522(s);
    921
    922    addr = (addr >> 9) & 0xf;
    923    return mos6522_read(ms, addr, size);
    924}
    925
    926static void mos6522_q800_via2_write(void *opaque, hwaddr addr, uint64_t val,
    927                                    unsigned size)
    928{
    929    MOS6522Q800VIA2State *s = MOS6522_Q800_VIA2(opaque);
    930    MOS6522State *ms = MOS6522(s);
    931
    932    addr = (addr >> 9) & 0xf;
    933    mos6522_write(ms, addr, val, size);
    934}
    935
    936static const MemoryRegionOps mos6522_q800_via2_ops = {
    937    .read = mos6522_q800_via2_read,
    938    .write = mos6522_q800_via2_write,
    939    .endianness = DEVICE_BIG_ENDIAN,
    940    .valid = {
    941        .min_access_size = 1,
    942        .max_access_size = 4,
    943    },
    944};
    945
    946static void via1_postload_update_cb(void *opaque, bool running, RunState state)
    947{
    948    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
    949
    950    qemu_del_vm_change_state_handler(v1s->vmstate);
    951    v1s->vmstate = NULL;
    952
    953    pram_update(v1s);
    954}
    955
    956static int via1_post_load(void *opaque, int version_id)
    957{
    958    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(opaque);
    959
    960    if (v1s->blk) {
    961        v1s->vmstate = qemu_add_vm_change_state_handler(
    962                           via1_postload_update_cb, v1s);
    963    }
    964
    965    return 0;
    966}
    967
    968/* VIA 1 */
    969static void mos6522_q800_via1_reset(DeviceState *dev)
    970{
    971    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(dev);
    972    MOS6522State *ms = MOS6522(v1s);
    973    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
    974    ADBBusState *adb_bus = &v1s->adb_bus;
    975
    976    mdc->parent_reset(dev);
    977
    978    ms->timers[0].frequency = VIA_TIMER_FREQ;
    979    ms->timers[1].frequency = VIA_TIMER_FREQ;
    980
    981    ms->b = VIA1B_vADB_StateMask | VIA1B_vADBInt | VIA1B_vRTCEnb;
    982
    983    /* ADB/RTC */
    984    adb_set_autopoll_enabled(adb_bus, true);
    985    v1s->cmd = REG_EMPTY;
    986    v1s->alt = REG_EMPTY;
    987}
    988
    989static void mos6522_q800_via1_realize(DeviceState *dev, Error **errp)
    990{
    991    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(dev);
    992    ADBBusState *adb_bus = &v1s->adb_bus;
    993    struct tm tm;
    994    int ret;
    995
    996    v1s->one_second_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, via1_one_second,
    997                                         v1s);
    998    via1_one_second_update(v1s);
    999    v1s->sixty_hz_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, via1_sixty_hz,
   1000                                       v1s);
   1001    via1_sixty_hz_update(v1s);
   1002
   1003    qemu_get_timedate(&tm, 0);
   1004    v1s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
   1005
   1006    adb_register_autopoll_callback(adb_bus, adb_via_poll, v1s);
   1007    v1s->adb_data_ready = qdev_get_gpio_in(dev, VIA1_IRQ_ADB_READY_BIT);
   1008
   1009    if (v1s->blk) {
   1010        int64_t len = blk_getlength(v1s->blk);
   1011        if (len < 0) {
   1012            error_setg_errno(errp, -len,
   1013                             "could not get length of backing image");
   1014            return;
   1015        }
   1016        ret = blk_set_perm(v1s->blk,
   1017                           BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
   1018                           BLK_PERM_ALL, errp);
   1019        if (ret < 0) {
   1020            return;
   1021        }
   1022
   1023        len = blk_pread(v1s->blk, 0, v1s->PRAM, sizeof(v1s->PRAM));
   1024        if (len != sizeof(v1s->PRAM)) {
   1025            error_setg(errp, "can't read PRAM contents");
   1026            return;
   1027        }
   1028    }
   1029}
   1030
   1031static void mos6522_q800_via1_init(Object *obj)
   1032{
   1033    MOS6522Q800VIA1State *v1s = MOS6522_Q800_VIA1(obj);
   1034    SysBusDevice *sbd = SYS_BUS_DEVICE(v1s);
   1035
   1036    memory_region_init_io(&v1s->via_mem, obj, &mos6522_q800_via1_ops, v1s,
   1037                          "via1", VIA_SIZE);
   1038    sysbus_init_mmio(sbd, &v1s->via_mem);
   1039
   1040    /* ADB */
   1041    qbus_init((BusState *)&v1s->adb_bus, sizeof(v1s->adb_bus),
   1042              TYPE_ADB_BUS, DEVICE(v1s), "adb.0");
   1043
   1044    qdev_init_gpio_in(DEVICE(obj), via1_irq_request, VIA1_IRQ_NB);
   1045}
   1046
   1047static const VMStateDescription vmstate_q800_via1 = {
   1048    .name = "q800-via1",
   1049    .version_id = 0,
   1050    .minimum_version_id = 0,
   1051    .post_load = via1_post_load,
   1052    .fields = (VMStateField[]) {
   1053        VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA1State, 0, vmstate_mos6522,
   1054                       MOS6522State),
   1055        VMSTATE_UINT8(last_b, MOS6522Q800VIA1State),
   1056        /* RTC */
   1057        VMSTATE_BUFFER(PRAM, MOS6522Q800VIA1State),
   1058        VMSTATE_UINT32(tick_offset, MOS6522Q800VIA1State),
   1059        VMSTATE_UINT8(data_out, MOS6522Q800VIA1State),
   1060        VMSTATE_INT32(data_out_cnt, MOS6522Q800VIA1State),
   1061        VMSTATE_UINT8(data_in, MOS6522Q800VIA1State),
   1062        VMSTATE_UINT8(data_in_cnt, MOS6522Q800VIA1State),
   1063        VMSTATE_UINT8(cmd, MOS6522Q800VIA1State),
   1064        VMSTATE_INT32(wprotect, MOS6522Q800VIA1State),
   1065        VMSTATE_INT32(alt, MOS6522Q800VIA1State),
   1066        /* ADB */
   1067        VMSTATE_INT32(adb_data_in_size, MOS6522Q800VIA1State),
   1068        VMSTATE_INT32(adb_data_in_index, MOS6522Q800VIA1State),
   1069        VMSTATE_INT32(adb_data_out_index, MOS6522Q800VIA1State),
   1070        VMSTATE_BUFFER(adb_data_in, MOS6522Q800VIA1State),
   1071        VMSTATE_BUFFER(adb_data_out, MOS6522Q800VIA1State),
   1072        VMSTATE_UINT8(adb_autopoll_cmd, MOS6522Q800VIA1State),
   1073        /* Timers */
   1074        VMSTATE_TIMER_PTR(one_second_timer, MOS6522Q800VIA1State),
   1075        VMSTATE_INT64(next_second, MOS6522Q800VIA1State),
   1076        VMSTATE_TIMER_PTR(sixty_hz_timer, MOS6522Q800VIA1State),
   1077        VMSTATE_INT64(next_sixty_hz, MOS6522Q800VIA1State),
   1078        VMSTATE_END_OF_LIST()
   1079    }
   1080};
   1081
   1082static Property mos6522_q800_via1_properties[] = {
   1083    DEFINE_PROP_DRIVE("drive", MOS6522Q800VIA1State, blk),
   1084    DEFINE_PROP_END_OF_LIST(),
   1085};
   1086
   1087static void mos6522_q800_via1_class_init(ObjectClass *oc, void *data)
   1088{
   1089    DeviceClass *dc = DEVICE_CLASS(oc);
   1090
   1091    dc->realize = mos6522_q800_via1_realize;
   1092    dc->reset = mos6522_q800_via1_reset;
   1093    dc->vmsd = &vmstate_q800_via1;
   1094    device_class_set_props(dc, mos6522_q800_via1_properties);
   1095}
   1096
   1097static const TypeInfo mos6522_q800_via1_type_info = {
   1098    .name = TYPE_MOS6522_Q800_VIA1,
   1099    .parent = TYPE_MOS6522,
   1100    .instance_size = sizeof(MOS6522Q800VIA1State),
   1101    .instance_init = mos6522_q800_via1_init,
   1102    .class_init = mos6522_q800_via1_class_init,
   1103};
   1104
   1105/* VIA 2 */
   1106static void mos6522_q800_via2_portB_write(MOS6522State *s)
   1107{
   1108    if (s->dirb & VIA2B_vPower && (s->b & VIA2B_vPower) == 0) {
   1109        /* shutdown */
   1110        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
   1111    }
   1112}
   1113
   1114static void mos6522_q800_via2_reset(DeviceState *dev)
   1115{
   1116    MOS6522State *ms = MOS6522(dev);
   1117    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
   1118
   1119    mdc->parent_reset(dev);
   1120
   1121    ms->timers[0].frequency = VIA_TIMER_FREQ;
   1122    ms->timers[1].frequency = VIA_TIMER_FREQ;
   1123
   1124    ms->dirb = 0;
   1125    ms->b = 0;
   1126    ms->dira = 0;
   1127    ms->a = 0x7f;
   1128}
   1129
   1130static void via2_nubus_irq_request(void *opaque, int irq, int level)
   1131{
   1132    MOS6522Q800VIA2State *v2s = opaque;
   1133    MOS6522State *s = MOS6522(v2s);
   1134    MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(s);
   1135
   1136    if (level) {
   1137        /* Port A nubus IRQ inputs are active LOW */
   1138        s->a &= ~(1 << irq);
   1139        s->ifr |= 1 << VIA2_IRQ_NUBUS_BIT;
   1140    } else {
   1141        s->a |= (1 << irq);
   1142        s->ifr &= ~(1 << VIA2_IRQ_NUBUS_BIT);
   1143    }
   1144
   1145    mdc->update_irq(s);
   1146}
   1147
   1148static void mos6522_q800_via2_init(Object *obj)
   1149{
   1150    MOS6522Q800VIA2State *v2s = MOS6522_Q800_VIA2(obj);
   1151    SysBusDevice *sbd = SYS_BUS_DEVICE(v2s);
   1152
   1153    memory_region_init_io(&v2s->via_mem, obj, &mos6522_q800_via2_ops, v2s,
   1154                          "via2", VIA_SIZE);
   1155    sysbus_init_mmio(sbd, &v2s->via_mem);
   1156
   1157    qdev_init_gpio_in(DEVICE(obj), via2_irq_request, VIA2_IRQ_NB);
   1158
   1159    qdev_init_gpio_in_named(DEVICE(obj), via2_nubus_irq_request, "nubus-irq",
   1160                            VIA2_NUBUS_IRQ_NB);
   1161}
   1162
   1163static const VMStateDescription vmstate_q800_via2 = {
   1164    .name = "q800-via2",
   1165    .version_id = 0,
   1166    .minimum_version_id = 0,
   1167    .fields = (VMStateField[]) {
   1168        VMSTATE_STRUCT(parent_obj, MOS6522Q800VIA2State, 0, vmstate_mos6522,
   1169                       MOS6522State),
   1170        VMSTATE_END_OF_LIST()
   1171    }
   1172};
   1173
   1174static void mos6522_q800_via2_class_init(ObjectClass *oc, void *data)
   1175{
   1176    DeviceClass *dc = DEVICE_CLASS(oc);
   1177    MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
   1178
   1179    dc->reset = mos6522_q800_via2_reset;
   1180    dc->vmsd = &vmstate_q800_via2;
   1181    mdc->portB_write = mos6522_q800_via2_portB_write;
   1182}
   1183
   1184static const TypeInfo mos6522_q800_via2_type_info = {
   1185    .name = TYPE_MOS6522_Q800_VIA2,
   1186    .parent = TYPE_MOS6522,
   1187    .instance_size = sizeof(MOS6522Q800VIA2State),
   1188    .instance_init = mos6522_q800_via2_init,
   1189    .class_init = mos6522_q800_via2_class_init,
   1190};
   1191
   1192static void mac_via_register_types(void)
   1193{
   1194    type_register_static(&mos6522_q800_via1_type_info);
   1195    type_register_static(&mos6522_q800_via2_type_info);
   1196}
   1197
   1198type_init(mac_via_register_types);