xref: /qemu/hw/misc/macio/pmu.c (revision 29b62a10)
1 /*
2  * QEMU PowerMac PMU device support
3  *
4  * Copyright (c) 2016 Benjamin Herrenschmidt, IBM Corp.
5  * Copyright (c) 2018 Mark Cave-Ayland
6  *
7  * Based on the CUDA device by:
8  *
9  * Copyright (c) 2004-2007 Fabrice Bellard
10  * Copyright (c) 2007 Jocelyn Mayer
11  *
12  * Permission is hereby granted, free of charge, to any person obtaining a copy
13  * of this software and associated documentation files (the "Software"), to deal
14  * in the Software without restriction, including without limitation the rights
15  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
16  * copies of the Software, and to permit persons to whom the Software is
17  * furnished to do so, subject to the following conditions:
18  *
19  * The above copyright notice and this permission notice shall be included in
20  * all copies or substantial portions of the Software.
21  *
22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
25  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
26  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
27  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
28  * THE SOFTWARE.
29  */
30 
31 #include "qemu/osdep.h"
32 #include "hw/qdev-properties.h"
33 #include "migration/vmstate.h"
34 #include "hw/input/adb.h"
35 #include "hw/irq.h"
36 #include "hw/misc/mos6522.h"
37 #include "hw/misc/macio/gpio.h"
38 #include "hw/misc/macio/pmu.h"
39 #include "qapi/error.h"
40 #include "qemu/timer.h"
41 #include "sysemu/runstate.h"
42 #include "sysemu/rtc.h"
43 #include "qapi/error.h"
44 #include "qemu/cutils.h"
45 #include "qemu/log.h"
46 #include "qemu/module.h"
47 #include "trace.h"
48 
49 
50 /* Bits in B data register: all active low */
51 #define TACK    0x08    /* Transfer request (input) */
52 #define TREQ    0x10    /* Transfer acknowledge (output) */
53 
54 /* PMU returns time_t's offset from Jan 1, 1904, not 1970 */
55 #define RTC_OFFSET                      2082844800
56 
57 #define VIA_TIMER_FREQ (4700000 / 6)
58 
59 static void via_set_sr_int(void *opaque)
60 {
61     PMUState *s = opaque;
62     MOS6522PMUState *mps = MOS6522_PMU(&s->mos6522_pmu);
63     MOS6522State *ms = MOS6522(mps);
64     qemu_irq irq = qdev_get_gpio_in(DEVICE(ms), SR_INT_BIT);
65 
66     qemu_set_irq(irq, 1);
67 }
68 
69 static void pmu_update_extirq(PMUState *s)
70 {
71     if ((s->intbits & s->intmask) != 0) {
72         macio_set_gpio(s->gpio, 1, false);
73     } else {
74         macio_set_gpio(s->gpio, 1, true);
75     }
76 }
77 
78 static void pmu_adb_poll(void *opaque)
79 {
80     PMUState *s = opaque;
81     ADBBusState *adb_bus = &s->adb_bus;
82     int olen;
83 
84     if (!(s->intbits & PMU_INT_ADB)) {
85         olen = adb_poll(adb_bus, s->adb_reply, adb_bus->autopoll_mask);
86         trace_pmu_adb_poll(olen);
87 
88         if (olen > 0) {
89             s->adb_reply_size = olen;
90             s->intbits |= PMU_INT_ADB | PMU_INT_ADB_AUTO;
91             pmu_update_extirq(s);
92         }
93     }
94 }
95 
96 static void pmu_one_sec_timer(void *opaque)
97 {
98     PMUState *s = opaque;
99 
100     trace_pmu_one_sec_timer();
101 
102     s->intbits |= PMU_INT_TICK;
103     pmu_update_extirq(s);
104     s->one_sec_target += 1000;
105 
106     timer_mod(s->one_sec_timer, s->one_sec_target);
107 }
108 
109 static void pmu_cmd_int_ack(PMUState *s,
110                             const uint8_t *in_data, uint8_t in_len,
111                             uint8_t *out_data, uint8_t *out_len)
112 {
113     if (in_len != 0) {
114         qemu_log_mask(LOG_GUEST_ERROR,
115                       "PMU: INT_ACK command, invalid len: %d want: 0\n",
116                       in_len);
117         return;
118     }
119 
120     /* Make appropriate reply packet */
121     if (s->intbits & PMU_INT_ADB) {
122         if (!s->adb_reply_size) {
123             qemu_log_mask(LOG_GUEST_ERROR,
124                           "Odd, PMU_INT_ADB set with no reply in buffer\n");
125         }
126 
127         memcpy(out_data + 1, s->adb_reply, s->adb_reply_size);
128         out_data[0] = s->intbits & (PMU_INT_ADB | PMU_INT_ADB_AUTO);
129         *out_len = s->adb_reply_size + 1;
130         s->intbits &= ~(PMU_INT_ADB | PMU_INT_ADB_AUTO);
131         s->adb_reply_size = 0;
132     } else {
133         out_data[0] = s->intbits;
134         s->intbits = 0;
135         *out_len = 1;
136     }
137 
138     pmu_update_extirq(s);
139 }
140 
141 static void pmu_cmd_set_int_mask(PMUState *s,
142                                  const uint8_t *in_data, uint8_t in_len,
143                                  uint8_t *out_data, uint8_t *out_len)
144 {
145     if (in_len != 1) {
146         qemu_log_mask(LOG_GUEST_ERROR,
147                       "PMU: SET_INT_MASK command, invalid len: %d want: 1\n",
148                       in_len);
149         return;
150     }
151 
152     trace_pmu_cmd_set_int_mask(s->intmask);
153     s->intmask = in_data[0];
154 
155     pmu_update_extirq(s);
156 }
157 
158 static void pmu_cmd_set_adb_autopoll(PMUState *s, uint16_t mask)
159 {
160     ADBBusState *adb_bus = &s->adb_bus;
161 
162     trace_pmu_cmd_set_adb_autopoll(mask);
163 
164     if (mask) {
165         adb_set_autopoll_mask(adb_bus, mask);
166         adb_set_autopoll_enabled(adb_bus, true);
167     } else {
168         adb_set_autopoll_enabled(adb_bus, false);
169     }
170 }
171 
172 static void pmu_cmd_adb(PMUState *s,
173                         const uint8_t *in_data, uint8_t in_len,
174                         uint8_t *out_data, uint8_t *out_len)
175 {
176     int len, adblen;
177     uint8_t adb_cmd[255];
178 
179     if (in_len < 2) {
180         qemu_log_mask(LOG_GUEST_ERROR,
181                       "PMU: ADB PACKET, invalid len: %d want at least 2\n",
182                       in_len);
183         return;
184     }
185 
186     *out_len = 0;
187 
188     if (!s->has_adb) {
189         trace_pmu_cmd_adb_nobus();
190         return;
191     }
192 
193     /* Set autopoll is a special form of the command */
194     if (in_data[0] == 0 && in_data[1] == 0x86) {
195         uint16_t mask = in_data[2];
196         mask = (mask << 8) | in_data[3];
197         if (in_len != 4) {
198             qemu_log_mask(LOG_GUEST_ERROR,
199                           "PMU: ADB Autopoll requires 4 bytes, got %d\n",
200                           in_len);
201             return;
202         }
203 
204         pmu_cmd_set_adb_autopoll(s, mask);
205         return;
206     }
207 
208     trace_pmu_cmd_adb_request(in_len, in_data[0], in_data[1], in_data[2],
209                               in_data[3], in_data[4]);
210 
211     *out_len = 0;
212 
213     /* Check ADB len */
214     adblen = in_data[2];
215     if (adblen > (in_len - 3)) {
216         qemu_log_mask(LOG_GUEST_ERROR,
217                       "PMU: ADB len is %d > %d (in_len -3)...erroring\n",
218                       adblen, in_len - 3);
219         len = -1;
220     } else if (adblen > 252) {
221         qemu_log_mask(LOG_GUEST_ERROR, "PMU: ADB command too big!\n");
222         len = -1;
223     } else {
224         /* Format command */
225         adb_cmd[0] = in_data[0];
226         memcpy(&adb_cmd[1], &in_data[3], in_len - 3);
227         len = adb_request(&s->adb_bus, s->adb_reply + 2, adb_cmd, in_len - 2);
228 
229         trace_pmu_cmd_adb_reply(len);
230     }
231 
232     if (len > 0) {
233         /* XXX Check this */
234         s->adb_reply_size = len + 2;
235         s->adb_reply[0] = 0x01;
236         s->adb_reply[1] = len;
237     } else {
238         /* XXX Check this */
239         s->adb_reply_size = 1;
240         s->adb_reply[0] = 0x00;
241     }
242 
243     s->intbits |= PMU_INT_ADB;
244     pmu_update_extirq(s);
245 }
246 
247 static void pmu_cmd_adb_poll_off(PMUState *s,
248                                  const uint8_t *in_data, uint8_t in_len,
249                                  uint8_t *out_data, uint8_t *out_len)
250 {
251     ADBBusState *adb_bus = &s->adb_bus;
252 
253     if (in_len != 0) {
254         qemu_log_mask(LOG_GUEST_ERROR,
255                       "PMU: ADB POLL OFF command, invalid len: %d want: 0\n",
256                       in_len);
257         return;
258     }
259 
260     if (s->has_adb) {
261         adb_set_autopoll_enabled(adb_bus, false);
262     }
263 }
264 
265 static void pmu_cmd_shutdown(PMUState *s,
266                              const uint8_t *in_data, uint8_t in_len,
267                              uint8_t *out_data, uint8_t *out_len)
268 {
269     if (in_len != 4) {
270         qemu_log_mask(LOG_GUEST_ERROR,
271                       "PMU: SHUTDOWN command, invalid len: %d want: 4\n",
272                       in_len);
273         return;
274     }
275 
276     *out_len = 1;
277     out_data[0] = 0;
278 
279     if (in_data[0] != 'M' || in_data[1] != 'A' || in_data[2] != 'T' ||
280         in_data[3] != 'T') {
281 
282         qemu_log_mask(LOG_GUEST_ERROR,
283                       "PMU: SHUTDOWN command, Bad MATT signature\n");
284         return;
285     }
286 
287     qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
288 }
289 
290 static void pmu_cmd_reset(PMUState *s,
291                           const uint8_t *in_data, uint8_t in_len,
292                           uint8_t *out_data, uint8_t *out_len)
293 {
294     if (in_len != 0) {
295         qemu_log_mask(LOG_GUEST_ERROR,
296                       "PMU: RESET command, invalid len: %d want: 0\n",
297                       in_len);
298         return;
299     }
300 
301     qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
302 }
303 
304 static void pmu_cmd_get_rtc(PMUState *s,
305                             const uint8_t *in_data, uint8_t in_len,
306                             uint8_t *out_data, uint8_t *out_len)
307 {
308     uint32_t ti;
309 
310     if (in_len != 0) {
311         qemu_log_mask(LOG_GUEST_ERROR,
312                       "PMU: GET_RTC command, invalid len: %d want: 0\n",
313                       in_len);
314         return;
315     }
316 
317     ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
318                            / NANOSECONDS_PER_SECOND);
319     out_data[0] = ti >> 24;
320     out_data[1] = ti >> 16;
321     out_data[2] = ti >> 8;
322     out_data[3] = ti;
323     *out_len = 4;
324 }
325 
326 static void pmu_cmd_set_rtc(PMUState *s,
327                             const uint8_t *in_data, uint8_t in_len,
328                             uint8_t *out_data, uint8_t *out_len)
329 {
330     uint32_t ti;
331 
332     if (in_len != 4) {
333         qemu_log_mask(LOG_GUEST_ERROR,
334                       "PMU: SET_RTC command, invalid len: %d want: 4\n",
335                       in_len);
336         return;
337     }
338 
339     ti = (((uint32_t)in_data[0]) << 24) + (((uint32_t)in_data[1]) << 16)
340          + (((uint32_t)in_data[2]) << 8) + in_data[3];
341 
342     s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
343                            / NANOSECONDS_PER_SECOND);
344 }
345 
346 static void pmu_cmd_system_ready(PMUState *s,
347                                  const uint8_t *in_data, uint8_t in_len,
348                                  uint8_t *out_data, uint8_t *out_len)
349 {
350     /* Do nothing */
351 }
352 
353 static void pmu_cmd_get_version(PMUState *s,
354                                 const uint8_t *in_data, uint8_t in_len,
355                                 uint8_t *out_data, uint8_t *out_len)
356 {
357     *out_len = 1;
358     *out_data = 1; /* ??? Check what Apple does */
359 }
360 
361 static void pmu_cmd_power_events(PMUState *s,
362                                  const uint8_t *in_data, uint8_t in_len,
363                                  uint8_t *out_data, uint8_t *out_len)
364 {
365     if (in_len < 1) {
366         qemu_log_mask(LOG_GUEST_ERROR,
367                       "PMU: POWER EVENTS command, invalid len %d, want at least 1\n",
368                       in_len);
369         return;
370     }
371 
372     switch (in_data[0]) {
373     /* Dummies for now */
374     case PMU_PWR_GET_POWERUP_EVENTS:
375         *out_len = 2;
376         out_data[0] = 0;
377         out_data[1] = 0;
378         break;
379     case PMU_PWR_SET_POWERUP_EVENTS:
380     case PMU_PWR_CLR_POWERUP_EVENTS:
381         break;
382     case PMU_PWR_GET_WAKEUP_EVENTS:
383         *out_len = 2;
384         out_data[0] = 0;
385         out_data[1] = 0;
386         break;
387     case PMU_PWR_SET_WAKEUP_EVENTS:
388     case PMU_PWR_CLR_WAKEUP_EVENTS:
389         break;
390     default:
391         qemu_log_mask(LOG_GUEST_ERROR,
392                       "PMU: POWER EVENTS unknown subcommand 0x%02x\n",
393                       in_data[0]);
394     }
395 }
396 
397 static void pmu_cmd_get_cover(PMUState *s,
398                               const uint8_t *in_data, uint8_t in_len,
399                               uint8_t *out_data, uint8_t *out_len)
400 {
401     /* Not 100% sure here, will have to check what a real Mac
402      * returns other than byte 0 bit 0 is LID closed on laptops
403      */
404     *out_len = 1;
405     *out_data = 0x00;
406 }
407 
408 static void pmu_cmd_download_status(PMUState *s,
409                                     const uint8_t *in_data, uint8_t in_len,
410                                     uint8_t *out_data, uint8_t *out_len)
411 {
412     /* This has to do with PMU firmware updates as far as I can tell.
413      *
414      * We return 0x62 which is what OpenPMU expects
415      */
416     *out_len = 1;
417     *out_data = 0x62;
418 }
419 
420 static void pmu_cmd_read_pmu_ram(PMUState *s,
421                                  const uint8_t *in_data, uint8_t in_len,
422                                  uint8_t *out_data, uint8_t *out_len)
423 {
424     if (in_len < 3) {
425         qemu_log_mask(LOG_GUEST_ERROR,
426                       "PMU: READ_PMU_RAM command, invalid len %d, expected 3\n",
427                       in_len);
428         return;
429     }
430 
431     qemu_log_mask(LOG_GUEST_ERROR,
432                   "PMU: Unsupported READ_PMU_RAM, args: %02x %02x %02x\n",
433                   in_data[0], in_data[1], in_data[2]);
434 
435     *out_len = 0;
436 }
437 
438 /* description of commands */
439 typedef struct PMUCmdHandler {
440     uint8_t command;
441     const char *name;
442     void (*handler)(PMUState *s,
443                     const uint8_t *in_args, uint8_t in_len,
444                     uint8_t *out_args, uint8_t *out_len);
445 } PMUCmdHandler;
446 
447 static const PMUCmdHandler PMUCmdHandlers[] = {
448     { PMU_INT_ACK, "INT ACK", pmu_cmd_int_ack },
449     { PMU_SET_INTR_MASK, "SET INT MASK", pmu_cmd_set_int_mask },
450     { PMU_ADB_CMD, "ADB COMMAND", pmu_cmd_adb },
451     { PMU_ADB_POLL_OFF, "ADB POLL OFF", pmu_cmd_adb_poll_off },
452     { PMU_RESET, "REBOOT", pmu_cmd_reset },
453     { PMU_SHUTDOWN, "SHUTDOWN", pmu_cmd_shutdown },
454     { PMU_READ_RTC, "GET RTC", pmu_cmd_get_rtc },
455     { PMU_SET_RTC, "SET RTC", pmu_cmd_set_rtc },
456     { PMU_SYSTEM_READY, "SYSTEM READY", pmu_cmd_system_ready },
457     { PMU_GET_VERSION, "GET VERSION", pmu_cmd_get_version },
458     { PMU_POWER_EVENTS, "POWER EVENTS", pmu_cmd_power_events },
459     { PMU_GET_COVER, "GET_COVER", pmu_cmd_get_cover },
460     { PMU_DOWNLOAD_STATUS, "DOWNLOAD STATUS", pmu_cmd_download_status },
461     { PMU_READ_PMU_RAM, "READ PMGR RAM", pmu_cmd_read_pmu_ram },
462 };
463 
464 static void pmu_dispatch_cmd(PMUState *s)
465 {
466     unsigned int i;
467 
468     /* No response by default */
469     s->cmd_rsp_sz = 0;
470 
471     for (i = 0; i < ARRAY_SIZE(PMUCmdHandlers); i++) {
472         const PMUCmdHandler *desc = &PMUCmdHandlers[i];
473 
474         if (desc->command != s->cmd) {
475             continue;
476         }
477 
478         trace_pmu_dispatch_cmd(desc->name);
479         desc->handler(s, s->cmd_buf, s->cmd_buf_pos,
480                       s->cmd_rsp, &s->cmd_rsp_sz);
481 
482         if (s->rsplen != -1 && s->rsplen != s->cmd_rsp_sz) {
483             trace_pmu_debug_protocol_string("QEMU internal cmd resp mismatch!");
484         } else {
485             trace_pmu_debug_protocol_resp_size(s->cmd_rsp_sz);
486         }
487 
488         return;
489     }
490 
491     trace_pmu_dispatch_unknown_cmd(s->cmd);
492 
493     /* Manufacture fake response with 0's */
494     if (s->rsplen == -1) {
495         s->cmd_rsp_sz = 0;
496     } else {
497         s->cmd_rsp_sz = s->rsplen;
498         memset(s->cmd_rsp, 0, s->rsplen);
499     }
500 }
501 
502 static void pmu_update(PMUState *s)
503 {
504     MOS6522PMUState *mps = &s->mos6522_pmu;
505     MOS6522State *ms = MOS6522(mps);
506     ADBBusState *adb_bus = &s->adb_bus;
507 
508     /* Only react to changes in reg B */
509     if (ms->b == s->last_b) {
510         return;
511     }
512     s->last_b = ms->b;
513 
514     /* Check the TREQ / TACK state */
515     switch (ms->b & (TREQ | TACK)) {
516     case TREQ:
517         /* This is an ack release, handle it and bail out */
518         ms->b |= TACK;
519         s->last_b = ms->b;
520 
521         trace_pmu_debug_protocol_string("handshake: TREQ high, setting TACK");
522         return;
523     case TACK:
524         /* This is a valid request, handle below */
525         break;
526     case TREQ | TACK:
527         /* This is an idle state */
528         return;
529     default:
530         /* Invalid state, log and ignore */
531         trace_pmu_debug_protocol_error(ms->b);
532         return;
533     }
534 
535     /* If we wanted to handle commands asynchronously, this is where
536      * we would delay the clearing of TACK until we are ready to send
537      * the response
538      */
539 
540     /* We have a request, handshake TACK so we don't stay in
541      * an invalid state. If we were concurrent with the OS we
542      * should only do this after we grabbed the SR but that isn't
543      * a problem here.
544      */
545 
546     trace_pmu_debug_protocol_clear_treq(s->cmd_state);
547 
548     ms->b &= ~TACK;
549     s->last_b = ms->b;
550 
551     /* Act according to state */
552     switch (s->cmd_state) {
553     case pmu_state_idle:
554         if (!(ms->acr & SR_OUT)) {
555             trace_pmu_debug_protocol_string("protocol error! "
556                                             "state idle, ACR reading");
557             break;
558         }
559 
560         s->cmd = ms->sr;
561         via_set_sr_int(s);
562         s->cmdlen = pmu_data_len[s->cmd][0];
563         s->rsplen = pmu_data_len[s->cmd][1];
564         s->cmd_buf_pos = 0;
565         s->cmd_rsp_pos = 0;
566         s->cmd_state = pmu_state_cmd;
567 
568         adb_autopoll_block(adb_bus);
569         trace_pmu_debug_protocol_cmd(s->cmd, s->cmdlen, s->rsplen);
570         break;
571 
572     case pmu_state_cmd:
573         if (!(ms->acr & SR_OUT)) {
574             trace_pmu_debug_protocol_string("protocol error! "
575                                             "state cmd, ACR reading");
576             break;
577         }
578 
579         if (s->cmdlen == -1) {
580             trace_pmu_debug_protocol_cmdlen(ms->sr);
581 
582             s->cmdlen = ms->sr;
583             if (s->cmdlen > sizeof(s->cmd_buf)) {
584                 trace_pmu_debug_protocol_cmd_toobig(s->cmdlen);
585             }
586         } else if (s->cmd_buf_pos < sizeof(s->cmd_buf)) {
587             s->cmd_buf[s->cmd_buf_pos++] = ms->sr;
588         }
589 
590         via_set_sr_int(s);
591         break;
592 
593     case pmu_state_rsp:
594         if (ms->acr & SR_OUT) {
595             trace_pmu_debug_protocol_string("protocol error! "
596                                             "state resp, ACR writing");
597             break;
598         }
599 
600         if (s->rsplen == -1) {
601             trace_pmu_debug_protocol_cmd_send_resp_size(s->cmd_rsp_sz);
602 
603             ms->sr = s->cmd_rsp_sz;
604             s->rsplen = s->cmd_rsp_sz;
605         } else if (s->cmd_rsp_pos < s->cmd_rsp_sz) {
606             trace_pmu_debug_protocol_cmd_send_resp(s->cmd_rsp_pos, s->rsplen);
607 
608             ms->sr = s->cmd_rsp[s->cmd_rsp_pos++];
609         }
610 
611         via_set_sr_int(s);
612         break;
613     }
614 
615     /* Check for state completion */
616     if (s->cmd_state == pmu_state_cmd && s->cmdlen == s->cmd_buf_pos) {
617         trace_pmu_debug_protocol_string("Command reception complete, "
618                                         "dispatching...");
619 
620         pmu_dispatch_cmd(s);
621         s->cmd_state = pmu_state_rsp;
622     }
623 
624     if (s->cmd_state == pmu_state_rsp && s->rsplen == s->cmd_rsp_pos) {
625         trace_pmu_debug_protocol_cmd_resp_complete(ms->ier);
626 
627         adb_autopoll_unblock(adb_bus);
628         s->cmd_state = pmu_state_idle;
629     }
630 }
631 
632 static uint64_t mos6522_pmu_read(void *opaque, hwaddr addr, unsigned size)
633 {
634     PMUState *s = opaque;
635     MOS6522PMUState *mps = &s->mos6522_pmu;
636     MOS6522State *ms = MOS6522(mps);
637 
638     addr = (addr >> 9) & 0xf;
639     return mos6522_read(ms, addr, size);
640 }
641 
642 static void mos6522_pmu_write(void *opaque, hwaddr addr, uint64_t val,
643                               unsigned size)
644 {
645     PMUState *s = opaque;
646     MOS6522PMUState *mps = &s->mos6522_pmu;
647     MOS6522State *ms = MOS6522(mps);
648 
649     addr = (addr >> 9) & 0xf;
650     mos6522_write(ms, addr, val, size);
651 }
652 
653 static const MemoryRegionOps mos6522_pmu_ops = {
654     .read = mos6522_pmu_read,
655     .write = mos6522_pmu_write,
656     .endianness = DEVICE_BIG_ENDIAN,
657     .impl = {
658         .min_access_size = 1,
659         .max_access_size = 1,
660     },
661 };
662 
663 static bool pmu_adb_state_needed(void *opaque)
664 {
665     PMUState *s = opaque;
666 
667     return s->has_adb;
668 }
669 
670 static const VMStateDescription vmstate_pmu_adb = {
671     .name = "pmu/adb",
672     .version_id = 1,
673     .minimum_version_id = 1,
674     .needed = pmu_adb_state_needed,
675     .fields = (VMStateField[]) {
676         VMSTATE_UINT8(adb_reply_size, PMUState),
677         VMSTATE_BUFFER(adb_reply, PMUState),
678         VMSTATE_END_OF_LIST()
679     }
680 };
681 
682 static const VMStateDescription vmstate_pmu = {
683     .name = "pmu",
684     .version_id = 1,
685     .minimum_version_id = 1,
686     .fields = (VMStateField[]) {
687         VMSTATE_STRUCT(mos6522_pmu.parent_obj, PMUState, 0, vmstate_mos6522,
688                        MOS6522State),
689         VMSTATE_UINT8(last_b, PMUState),
690         VMSTATE_UINT8(cmd, PMUState),
691         VMSTATE_UINT32(cmdlen, PMUState),
692         VMSTATE_UINT32(rsplen, PMUState),
693         VMSTATE_UINT8(cmd_buf_pos, PMUState),
694         VMSTATE_BUFFER(cmd_buf, PMUState),
695         VMSTATE_UINT8(cmd_rsp_pos, PMUState),
696         VMSTATE_UINT8(cmd_rsp_sz, PMUState),
697         VMSTATE_BUFFER(cmd_rsp, PMUState),
698         VMSTATE_UINT8(intbits, PMUState),
699         VMSTATE_UINT8(intmask, PMUState),
700         VMSTATE_UINT32(tick_offset, PMUState),
701         VMSTATE_TIMER_PTR(one_sec_timer, PMUState),
702         VMSTATE_INT64(one_sec_target, PMUState),
703         VMSTATE_END_OF_LIST()
704     },
705     .subsections = (const VMStateDescription * []) {
706         &vmstate_pmu_adb,
707         NULL
708     }
709 };
710 
711 static void pmu_reset(DeviceState *dev)
712 {
713     PMUState *s = VIA_PMU(dev);
714 
715     /* OpenBIOS needs to do this? MacOS 9 needs it */
716     s->intmask = PMU_INT_ADB | PMU_INT_TICK;
717     s->intbits = 0;
718 
719     s->cmd_state = pmu_state_idle;
720 }
721 
722 static void pmu_realize(DeviceState *dev, Error **errp)
723 {
724     PMUState *s = VIA_PMU(dev);
725     SysBusDevice *sbd;
726     ADBBusState *adb_bus = &s->adb_bus;
727     struct tm tm;
728 
729     if (!sysbus_realize(SYS_BUS_DEVICE(&s->mos6522_pmu), errp)) {
730         return;
731     }
732 
733     /* Pass IRQ from 6522 */
734     sbd = SYS_BUS_DEVICE(s);
735     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(&s->mos6522_pmu));
736 
737     qemu_get_timedate(&tm, 0);
738     s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
739     s->one_sec_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, pmu_one_sec_timer, s);
740     s->one_sec_target = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000;
741     timer_mod(s->one_sec_timer, s->one_sec_target);
742 
743     if (s->has_adb) {
744         qbus_init(&s->adb_bus, sizeof(s->adb_bus), TYPE_ADB_BUS,
745                   dev, "adb.0");
746         adb_register_autopoll_callback(adb_bus, pmu_adb_poll, s);
747     }
748 }
749 
750 static void pmu_init(Object *obj)
751 {
752     SysBusDevice *d = SYS_BUS_DEVICE(obj);
753     PMUState *s = VIA_PMU(obj);
754 
755     object_property_add_link(obj, "gpio", TYPE_MACIO_GPIO,
756                              (Object **) &s->gpio,
757                              qdev_prop_allow_set_link_before_realize,
758                              0);
759 
760     object_initialize_child(obj, "mos6522-pmu", &s->mos6522_pmu,
761                             TYPE_MOS6522_PMU);
762 
763     memory_region_init_io(&s->mem, obj, &mos6522_pmu_ops, s, "via-pmu",
764                           0x2000);
765     sysbus_init_mmio(d, &s->mem);
766 }
767 
768 static Property pmu_properties[] = {
769     DEFINE_PROP_BOOL("has-adb", PMUState, has_adb, true),
770     DEFINE_PROP_END_OF_LIST()
771 };
772 
773 static void pmu_class_init(ObjectClass *oc, void *data)
774 {
775     DeviceClass *dc = DEVICE_CLASS(oc);
776 
777     dc->realize = pmu_realize;
778     dc->reset = pmu_reset;
779     dc->vmsd = &vmstate_pmu;
780     device_class_set_props(dc, pmu_properties);
781     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
782 }
783 
784 static const TypeInfo pmu_type_info = {
785     .name = TYPE_VIA_PMU,
786     .parent = TYPE_SYS_BUS_DEVICE,
787     .instance_size = sizeof(PMUState),
788     .instance_init = pmu_init,
789     .class_init = pmu_class_init,
790 };
791 
792 static void mos6522_pmu_portB_write(MOS6522State *s)
793 {
794     MOS6522PMUState *mps = container_of(s, MOS6522PMUState, parent_obj);
795     PMUState *ps = container_of(mps, PMUState, mos6522_pmu);
796 
797     pmu_update(ps);
798 }
799 
800 static void mos6522_pmu_reset_hold(Object *obj)
801 {
802     MOS6522State *ms = MOS6522(obj);
803     MOS6522PMUState *mps = container_of(ms, MOS6522PMUState, parent_obj);
804     PMUState *s = container_of(mps, PMUState, mos6522_pmu);
805     MOS6522DeviceClass *mdc = MOS6522_GET_CLASS(ms);
806 
807     if (mdc->parent_phases.hold) {
808         mdc->parent_phases.hold(obj);
809     }
810 
811     ms->timers[0].frequency = VIA_TIMER_FREQ;
812     ms->timers[1].frequency = (SCALE_US * 6000) / 4700;
813 
814     s->last_b = ms->b = TACK | TREQ;
815 }
816 
817 static void mos6522_pmu_class_init(ObjectClass *oc, void *data)
818 {
819     ResettableClass *rc = RESETTABLE_CLASS(oc);
820     MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
821 
822     resettable_class_set_parent_phases(rc, NULL, mos6522_pmu_reset_hold,
823                                        NULL, &mdc->parent_phases);
824     mdc->portB_write = mos6522_pmu_portB_write;
825 }
826 
827 static const TypeInfo mos6522_pmu_type_info = {
828     .name = TYPE_MOS6522_PMU,
829     .parent = TYPE_MOS6522,
830     .instance_size = sizeof(MOS6522PMUState),
831     .class_init = mos6522_pmu_class_init,
832 };
833 
834 static void pmu_register_types(void)
835 {
836     type_register_static(&pmu_type_info);
837     type_register_static(&mos6522_pmu_type_info);
838 }
839 
840 type_init(pmu_register_types)
841