xref: /qemu/hw/misc/macio/cuda.c (revision 1cdab104468d900c1ed0a2e689b944ec8e2d12d8)
1 /*
2  * QEMU PowerMac CUDA device support
3  *
4  * Copyright (c) 2004-2007 Fabrice Bellard
5  * Copyright (c) 2007 Jocelyn Mayer
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 #include "qemu/osdep.h"
26 #include "hw/hw.h"
27 #include "hw/ppc/mac.h"
28 #include "hw/input/adb.h"
29 #include "qemu/timer.h"
30 #include "sysemu/sysemu.h"
31 
32 /* XXX: implement all timer modes */
33 
34 /* debug CUDA */
35 //#define DEBUG_CUDA
36 
37 /* debug CUDA packets */
38 //#define DEBUG_CUDA_PACKET
39 
40 #ifdef DEBUG_CUDA
41 #define CUDA_DPRINTF(fmt, ...)                                  \
42     do { printf("CUDA: " fmt , ## __VA_ARGS__); } while (0)
43 #else
44 #define CUDA_DPRINTF(fmt, ...)
45 #endif
46 
47 /* Bits in B data register: all active low */
48 #define TREQ		0x08		/* Transfer request (input) */
49 #define TACK		0x10		/* Transfer acknowledge (output) */
50 #define TIP		0x20		/* Transfer in progress (output) */
51 
52 /* Bits in ACR */
53 #define SR_CTRL		0x1c		/* Shift register control bits */
54 #define SR_EXT		0x0c		/* Shift on external clock */
55 #define SR_OUT		0x10		/* Shift out if 1 */
56 
57 /* Bits in IFR and IER */
58 #define IER_SET		0x80		/* set bits in IER */
59 #define IER_CLR		0		/* clear bits in IER */
60 #define SR_INT		0x04		/* Shift register full/empty */
61 #define SR_DATA_INT	0x08
62 #define SR_CLOCK_INT	0x10
63 #define T1_INT          0x40            /* Timer 1 interrupt */
64 #define T2_INT          0x20            /* Timer 2 interrupt */
65 
66 /* Bits in ACR */
67 #define T1MODE          0xc0            /* Timer 1 mode */
68 #define T1MODE_CONT     0x40            /*  continuous interrupts */
69 
70 /* commands (1st byte) */
71 #define ADB_PACKET	0
72 #define CUDA_PACKET	1
73 #define ERROR_PACKET	2
74 #define TIMER_PACKET	3
75 #define POWER_PACKET	4
76 #define MACIIC_PACKET	5
77 #define PMU_PACKET	6
78 
79 
80 /* CUDA commands (2nd byte) */
81 #define CUDA_WARM_START			0x0
82 #define CUDA_AUTOPOLL			0x1
83 #define CUDA_GET_6805_ADDR		0x2
84 #define CUDA_GET_TIME			0x3
85 #define CUDA_GET_PRAM			0x7
86 #define CUDA_SET_6805_ADDR		0x8
87 #define CUDA_SET_TIME			0x9
88 #define CUDA_POWERDOWN			0xa
89 #define CUDA_POWERUP_TIME		0xb
90 #define CUDA_SET_PRAM			0xc
91 #define CUDA_MS_RESET			0xd
92 #define CUDA_SEND_DFAC			0xe
93 #define CUDA_BATTERY_SWAP_SENSE		0x10
94 #define CUDA_RESET_SYSTEM		0x11
95 #define CUDA_SET_IPL			0x12
96 #define CUDA_FILE_SERVER_FLAG		0x13
97 #define CUDA_SET_AUTO_RATE		0x14
98 #define CUDA_GET_AUTO_RATE		0x16
99 #define CUDA_SET_DEVICE_LIST		0x19
100 #define CUDA_GET_DEVICE_LIST		0x1a
101 #define CUDA_SET_ONE_SECOND_MODE	0x1b
102 #define CUDA_SET_POWER_MESSAGES		0x21
103 #define CUDA_GET_SET_IIC		0x22
104 #define CUDA_WAKEUP			0x23
105 #define CUDA_TIMER_TICKLE		0x24
106 #define CUDA_COMBINED_FORMAT_IIC	0x25
107 
108 #define CUDA_TIMER_FREQ (4700000 / 6)
109 #define CUDA_ADB_POLL_FREQ 50
110 
111 /* CUDA returns time_t's offset from Jan 1, 1904, not 1970 */
112 #define RTC_OFFSET                      2082844800
113 
114 /* CUDA registers */
115 #define CUDA_REG_B       0x00
116 #define CUDA_REG_A       0x01
117 #define CUDA_REG_DIRB    0x02
118 #define CUDA_REG_DIRA    0x03
119 #define CUDA_REG_T1CL    0x04
120 #define CUDA_REG_T1CH    0x05
121 #define CUDA_REG_T1LL    0x06
122 #define CUDA_REG_T1LH    0x07
123 #define CUDA_REG_T2CL    0x08
124 #define CUDA_REG_T2CH    0x09
125 #define CUDA_REG_SR      0x0a
126 #define CUDA_REG_ACR     0x0b
127 #define CUDA_REG_PCR     0x0c
128 #define CUDA_REG_IFR     0x0d
129 #define CUDA_REG_IER     0x0e
130 #define CUDA_REG_ANH     0x0f
131 
132 static void cuda_update(CUDAState *s);
133 static void cuda_receive_packet_from_host(CUDAState *s,
134                                           const uint8_t *data, int len);
135 static void cuda_timer_update(CUDAState *s, CUDATimer *ti,
136                               int64_t current_time);
137 
138 static void cuda_update_irq(CUDAState *s)
139 {
140     if (s->ifr & s->ier & (SR_INT | T1_INT | T2_INT)) {
141         qemu_irq_raise(s->irq);
142     } else {
143         qemu_irq_lower(s->irq);
144     }
145 }
146 
147 static uint64_t get_tb(uint64_t time, uint64_t freq)
148 {
149     return muldiv64(time, freq, get_ticks_per_sec());
150 }
151 
152 static unsigned int get_counter(CUDATimer *ti)
153 {
154     int64_t d;
155     unsigned int counter;
156     uint64_t tb_diff;
157     uint64_t current_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
158 
159     /* Reverse of the tb calculation algorithm that Mac OS X uses on bootup. */
160     tb_diff = get_tb(current_time, ti->frequency) - ti->load_time;
161     d = (tb_diff * 0xBF401675E5DULL) / (ti->frequency << 24);
162 
163     if (ti->index == 0) {
164         /* the timer goes down from latch to -1 (period of latch + 2) */
165         if (d <= (ti->counter_value + 1)) {
166             counter = (ti->counter_value - d) & 0xffff;
167         } else {
168             counter = (d - (ti->counter_value + 1)) % (ti->latch + 2);
169             counter = (ti->latch - counter) & 0xffff;
170         }
171     } else {
172         counter = (ti->counter_value - d) & 0xffff;
173     }
174     return counter;
175 }
176 
177 static void set_counter(CUDAState *s, CUDATimer *ti, unsigned int val)
178 {
179     CUDA_DPRINTF("T%d.counter=%d\n", 1 + ti->index, val);
180     ti->load_time = get_tb(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
181                            s->frequency);
182     ti->counter_value = val;
183     cuda_timer_update(s, ti, ti->load_time);
184 }
185 
186 static int64_t get_next_irq_time(CUDATimer *s, int64_t current_time)
187 {
188     int64_t d, next_time;
189     unsigned int counter;
190 
191     /* current counter value */
192     d = muldiv64(current_time - s->load_time,
193                  CUDA_TIMER_FREQ, get_ticks_per_sec());
194     /* the timer goes down from latch to -1 (period of latch + 2) */
195     if (d <= (s->counter_value + 1)) {
196         counter = (s->counter_value - d) & 0xffff;
197     } else {
198         counter = (d - (s->counter_value + 1)) % (s->latch + 2);
199         counter = (s->latch - counter) & 0xffff;
200     }
201 
202     /* Note: we consider the irq is raised on 0 */
203     if (counter == 0xffff) {
204         next_time = d + s->latch + 1;
205     } else if (counter == 0) {
206         next_time = d + s->latch + 2;
207     } else {
208         next_time = d + counter;
209     }
210     CUDA_DPRINTF("latch=%d counter=%" PRId64 " delta_next=%" PRId64 "\n",
211                  s->latch, d, next_time - d);
212     next_time = muldiv64(next_time, get_ticks_per_sec(), CUDA_TIMER_FREQ) +
213         s->load_time;
214     if (next_time <= current_time)
215         next_time = current_time + 1;
216     return next_time;
217 }
218 
219 static void cuda_timer_update(CUDAState *s, CUDATimer *ti,
220                               int64_t current_time)
221 {
222     if (!ti->timer)
223         return;
224     if (ti->index == 0 && (s->acr & T1MODE) != T1MODE_CONT) {
225         timer_del(ti->timer);
226     } else {
227         ti->next_irq_time = get_next_irq_time(ti, current_time);
228         timer_mod(ti->timer, ti->next_irq_time);
229     }
230 }
231 
232 static void cuda_timer1(void *opaque)
233 {
234     CUDAState *s = opaque;
235     CUDATimer *ti = &s->timers[0];
236 
237     cuda_timer_update(s, ti, ti->next_irq_time);
238     s->ifr |= T1_INT;
239     cuda_update_irq(s);
240 }
241 
242 static void cuda_timer2(void *opaque)
243 {
244     CUDAState *s = opaque;
245     CUDATimer *ti = &s->timers[1];
246 
247     cuda_timer_update(s, ti, ti->next_irq_time);
248     s->ifr |= T2_INT;
249     cuda_update_irq(s);
250 }
251 
252 static void cuda_set_sr_int(void *opaque)
253 {
254     CUDAState *s = opaque;
255 
256     CUDA_DPRINTF("CUDA: %s:%d\n", __func__, __LINE__);
257     s->ifr |= SR_INT;
258     cuda_update_irq(s);
259 }
260 
261 static void cuda_delay_set_sr_int(CUDAState *s)
262 {
263     int64_t expire;
264 
265     if (s->dirb == 0xff) {
266         /* Not in Mac OS, fire the IRQ directly */
267         cuda_set_sr_int(s);
268         return;
269     }
270 
271     CUDA_DPRINTF("CUDA: %s:%d\n", __func__, __LINE__);
272 
273     expire = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 300 * SCALE_US;
274     timer_mod(s->sr_delay_timer, expire);
275 }
276 
277 static uint32_t cuda_readb(void *opaque, hwaddr addr)
278 {
279     CUDAState *s = opaque;
280     uint32_t val;
281 
282     addr = (addr >> 9) & 0xf;
283     switch(addr) {
284     case CUDA_REG_B:
285         val = s->b;
286         break;
287     case CUDA_REG_A:
288         val = s->a;
289         break;
290     case CUDA_REG_DIRB:
291         val = s->dirb;
292         break;
293     case CUDA_REG_DIRA:
294         val = s->dira;
295         break;
296     case CUDA_REG_T1CL:
297         val = get_counter(&s->timers[0]) & 0xff;
298         s->ifr &= ~T1_INT;
299         cuda_update_irq(s);
300         break;
301     case CUDA_REG_T1CH:
302         val = get_counter(&s->timers[0]) >> 8;
303         cuda_update_irq(s);
304         break;
305     case CUDA_REG_T1LL:
306         val = s->timers[0].latch & 0xff;
307         break;
308     case CUDA_REG_T1LH:
309         /* XXX: check this */
310         val = (s->timers[0].latch >> 8) & 0xff;
311         break;
312     case CUDA_REG_T2CL:
313         val = get_counter(&s->timers[1]) & 0xff;
314         s->ifr &= ~T2_INT;
315         cuda_update_irq(s);
316         break;
317     case CUDA_REG_T2CH:
318         val = get_counter(&s->timers[1]) >> 8;
319         break;
320     case CUDA_REG_SR:
321         val = s->sr;
322         s->ifr &= ~(SR_INT | SR_CLOCK_INT | SR_DATA_INT);
323         cuda_update_irq(s);
324         break;
325     case CUDA_REG_ACR:
326         val = s->acr;
327         break;
328     case CUDA_REG_PCR:
329         val = s->pcr;
330         break;
331     case CUDA_REG_IFR:
332         val = s->ifr;
333         if (s->ifr & s->ier) {
334             val |= 0x80;
335         }
336         break;
337     case CUDA_REG_IER:
338         val = s->ier | 0x80;
339         break;
340     default:
341     case CUDA_REG_ANH:
342         val = s->anh;
343         break;
344     }
345     if (addr != CUDA_REG_IFR || val != 0) {
346         CUDA_DPRINTF("read: reg=0x%x val=%02x\n", (int)addr, val);
347     }
348 
349     return val;
350 }
351 
352 static void cuda_writeb(void *opaque, hwaddr addr, uint32_t val)
353 {
354     CUDAState *s = opaque;
355 
356     addr = (addr >> 9) & 0xf;
357     CUDA_DPRINTF("write: reg=0x%x val=%02x\n", (int)addr, val);
358 
359     switch(addr) {
360     case CUDA_REG_B:
361         s->b = val;
362         cuda_update(s);
363         break;
364     case CUDA_REG_A:
365         s->a = val;
366         break;
367     case CUDA_REG_DIRB:
368         s->dirb = val;
369         break;
370     case CUDA_REG_DIRA:
371         s->dira = val;
372         break;
373     case CUDA_REG_T1CL:
374         s->timers[0].latch = (s->timers[0].latch & 0xff00) | val;
375         cuda_timer_update(s, &s->timers[0], qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
376         break;
377     case CUDA_REG_T1CH:
378         s->timers[0].latch = (s->timers[0].latch & 0xff) | (val << 8);
379         s->ifr &= ~T1_INT;
380         set_counter(s, &s->timers[0], s->timers[0].latch);
381         break;
382     case CUDA_REG_T1LL:
383         s->timers[0].latch = (s->timers[0].latch & 0xff00) | val;
384         cuda_timer_update(s, &s->timers[0], qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
385         break;
386     case CUDA_REG_T1LH:
387         s->timers[0].latch = (s->timers[0].latch & 0xff) | (val << 8);
388         s->ifr &= ~T1_INT;
389         cuda_timer_update(s, &s->timers[0], qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
390         break;
391     case CUDA_REG_T2CL:
392         s->timers[1].latch = (s->timers[1].latch & 0xff00) | val;
393         break;
394     case CUDA_REG_T2CH:
395         /* To ensure T2 generates an interrupt on zero crossing with the
396            common timer code, write the value directly from the latch to
397            the counter */
398         s->timers[1].latch = (s->timers[1].latch & 0xff) | (val << 8);
399         s->ifr &= ~T2_INT;
400         set_counter(s, &s->timers[1], s->timers[1].latch);
401         break;
402     case CUDA_REG_SR:
403         s->sr = val;
404         break;
405     case CUDA_REG_ACR:
406         s->acr = val;
407         cuda_timer_update(s, &s->timers[0], qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
408         cuda_update(s);
409         break;
410     case CUDA_REG_PCR:
411         s->pcr = val;
412         break;
413     case CUDA_REG_IFR:
414         /* reset bits */
415         s->ifr &= ~val;
416         cuda_update_irq(s);
417         break;
418     case CUDA_REG_IER:
419         if (val & IER_SET) {
420             /* set bits */
421             s->ier |= val & 0x7f;
422         } else {
423             /* reset bits */
424             s->ier &= ~val;
425         }
426         cuda_update_irq(s);
427         break;
428     default:
429     case CUDA_REG_ANH:
430         s->anh = val;
431         break;
432     }
433 }
434 
435 /* NOTE: TIP and TREQ are negated */
436 static void cuda_update(CUDAState *s)
437 {
438     int packet_received, len;
439 
440     packet_received = 0;
441     if (!(s->b & TIP)) {
442         /* transfer requested from host */
443 
444         if (s->acr & SR_OUT) {
445             /* data output */
446             if ((s->b & (TACK | TIP)) != (s->last_b & (TACK | TIP))) {
447                 if (s->data_out_index < sizeof(s->data_out)) {
448                     CUDA_DPRINTF("send: %02x\n", s->sr);
449                     s->data_out[s->data_out_index++] = s->sr;
450                     cuda_delay_set_sr_int(s);
451                 }
452             }
453         } else {
454             if (s->data_in_index < s->data_in_size) {
455                 /* data input */
456                 if ((s->b & (TACK | TIP)) != (s->last_b & (TACK | TIP))) {
457                     s->sr = s->data_in[s->data_in_index++];
458                     CUDA_DPRINTF("recv: %02x\n", s->sr);
459                     /* indicate end of transfer */
460                     if (s->data_in_index >= s->data_in_size) {
461                         s->b = (s->b | TREQ);
462                     }
463                     cuda_delay_set_sr_int(s);
464                 }
465             }
466         }
467     } else {
468         /* no transfer requested: handle sync case */
469         if ((s->last_b & TIP) && (s->b & TACK) != (s->last_b & TACK)) {
470             /* update TREQ state each time TACK change state */
471             if (s->b & TACK)
472                 s->b = (s->b | TREQ);
473             else
474                 s->b = (s->b & ~TREQ);
475             cuda_delay_set_sr_int(s);
476         } else {
477             if (!(s->last_b & TIP)) {
478                 /* handle end of host to cuda transfer */
479                 packet_received = (s->data_out_index > 0);
480                 /* always an IRQ at the end of transfer */
481                 cuda_delay_set_sr_int(s);
482             }
483             /* signal if there is data to read */
484             if (s->data_in_index < s->data_in_size) {
485                 s->b = (s->b & ~TREQ);
486             }
487         }
488     }
489 
490     s->last_acr = s->acr;
491     s->last_b = s->b;
492 
493     /* NOTE: cuda_receive_packet_from_host() can call cuda_update()
494        recursively */
495     if (packet_received) {
496         len = s->data_out_index;
497         s->data_out_index = 0;
498         cuda_receive_packet_from_host(s, s->data_out, len);
499     }
500 }
501 
502 static void cuda_send_packet_to_host(CUDAState *s,
503                                      const uint8_t *data, int len)
504 {
505 #ifdef DEBUG_CUDA_PACKET
506     {
507         int i;
508         printf("cuda_send_packet_to_host:\n");
509         for(i = 0; i < len; i++)
510             printf(" %02x", data[i]);
511         printf("\n");
512     }
513 #endif
514     memcpy(s->data_in, data, len);
515     s->data_in_size = len;
516     s->data_in_index = 0;
517     cuda_update(s);
518     cuda_delay_set_sr_int(s);
519 }
520 
521 static void cuda_adb_poll(void *opaque)
522 {
523     CUDAState *s = opaque;
524     uint8_t obuf[ADB_MAX_OUT_LEN + 2];
525     int olen;
526 
527     olen = adb_poll(&s->adb_bus, obuf + 2);
528     if (olen > 0) {
529         obuf[0] = ADB_PACKET;
530         obuf[1] = 0x40; /* polled data */
531         cuda_send_packet_to_host(s, obuf, olen + 2);
532     }
533     timer_mod(s->adb_poll_timer,
534                    qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
535                    (get_ticks_per_sec() / CUDA_ADB_POLL_FREQ));
536 }
537 
538 /* description of commands */
539 typedef struct CudaCommand {
540     uint8_t command;
541     const char *name;
542     bool (*handler)(CUDAState *s,
543                     const uint8_t *in_args, int in_len,
544                     uint8_t *out_args, int *out_len);
545 } CudaCommand;
546 
547 static bool cuda_cmd_autopoll(CUDAState *s,
548                               const uint8_t *in_data, int in_len,
549                               uint8_t *out_data, int *out_len)
550 {
551     int autopoll;
552 
553     if (in_len != 1) {
554         return false;
555     }
556 
557     autopoll = (in_data[0] != 0);
558     if (autopoll != s->autopoll) {
559         s->autopoll = autopoll;
560         if (autopoll) {
561             timer_mod(s->adb_poll_timer,
562                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
563                       (get_ticks_per_sec() / CUDA_ADB_POLL_FREQ));
564         } else {
565             timer_del(s->adb_poll_timer);
566         }
567     }
568     return true;
569 }
570 
571 static const CudaCommand handlers[] = {
572     { CUDA_AUTOPOLL, "AUTOPOLL", cuda_cmd_autopoll },
573 };
574 
575 static void cuda_receive_packet(CUDAState *s,
576                                 const uint8_t *data, int len)
577 {
578     uint8_t obuf[16] = { CUDA_PACKET, 0, data[0] };
579     int i, out_len = 0;
580     uint32_t ti;
581 
582     for (i = 0; i < ARRAY_SIZE(handlers); i++) {
583         const CudaCommand *desc = &handlers[i];
584         if (desc->command == data[0]) {
585             CUDA_DPRINTF("handling command %s\n", desc->name);
586             out_len = 0;
587             if (desc->handler(s, data + 1, len - 1, obuf + 3, &out_len)) {
588                 cuda_send_packet_to_host(s, obuf, 3 + out_len);
589             } else {
590                 qemu_log_mask(LOG_GUEST_ERROR,
591                               "CUDA: %s: wrong parameters %d\n",
592                               desc->name, len);
593                 obuf[0] = ERROR_PACKET;
594                 obuf[1] = 0x5; /* bad parameters */
595                 obuf[2] = CUDA_PACKET;
596                 obuf[3] = data[0];
597                 cuda_send_packet_to_host(s, obuf, 4);
598             }
599             return;
600         }
601     }
602 
603     switch(data[0]) {
604     case CUDA_GET_6805_ADDR:
605         cuda_send_packet_to_host(s, obuf, 3);
606         return;
607     case CUDA_SET_TIME:
608         ti = (((uint32_t)data[1]) << 24) + (((uint32_t)data[2]) << 16) + (((uint32_t)data[3]) << 8) + data[4];
609         s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / get_ticks_per_sec());
610         cuda_send_packet_to_host(s, obuf, 3);
611         return;
612     case CUDA_GET_TIME:
613         ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / get_ticks_per_sec());
614         obuf[3] = ti >> 24;
615         obuf[4] = ti >> 16;
616         obuf[5] = ti >> 8;
617         obuf[6] = ti;
618         cuda_send_packet_to_host(s, obuf, 7);
619         return;
620     case CUDA_FILE_SERVER_FLAG:
621     case CUDA_SET_DEVICE_LIST:
622     case CUDA_SET_AUTO_RATE:
623     case CUDA_SET_POWER_MESSAGES:
624         cuda_send_packet_to_host(s, obuf, 3);
625         return;
626     case CUDA_POWERDOWN:
627         cuda_send_packet_to_host(s, obuf, 3);
628         qemu_system_shutdown_request();
629         return;
630     case CUDA_RESET_SYSTEM:
631         cuda_send_packet_to_host(s, obuf, 3);
632         qemu_system_reset_request();
633         return;
634     case CUDA_COMBINED_FORMAT_IIC:
635         obuf[0] = ERROR_PACKET;
636         obuf[1] = 0x5;
637         obuf[2] = CUDA_PACKET;
638         obuf[3] = data[0];
639         cuda_send_packet_to_host(s, obuf, 4);
640         return;
641     case CUDA_GET_SET_IIC:
642         if (len == 4) {
643             cuda_send_packet_to_host(s, obuf, 3);
644         } else {
645             obuf[0] = ERROR_PACKET;
646             obuf[1] = 0x2;
647             obuf[2] = CUDA_PACKET;
648             obuf[3] = data[0];
649             cuda_send_packet_to_host(s, obuf, 4);
650         }
651         return;
652     default:
653         break;
654     }
655 
656     qemu_log_mask(LOG_GUEST_ERROR, "CUDA: unknown command 0x%02x\n", data[0]);
657     obuf[0] = ERROR_PACKET;
658     obuf[1] = 0x2; /* unknown command */
659     obuf[2] = CUDA_PACKET;
660     obuf[3] = data[0];
661     cuda_send_packet_to_host(s, obuf, 4);
662 }
663 
664 static void cuda_receive_packet_from_host(CUDAState *s,
665                                           const uint8_t *data, int len)
666 {
667 #ifdef DEBUG_CUDA_PACKET
668     {
669         int i;
670         printf("cuda_receive_packet_from_host:\n");
671         for(i = 0; i < len; i++)
672             printf(" %02x", data[i]);
673         printf("\n");
674     }
675 #endif
676     switch(data[0]) {
677     case ADB_PACKET:
678         {
679             uint8_t obuf[ADB_MAX_OUT_LEN + 3];
680             int olen;
681             olen = adb_request(&s->adb_bus, obuf + 2, data + 1, len - 1);
682             if (olen > 0) {
683                 obuf[0] = ADB_PACKET;
684                 obuf[1] = 0x00;
685                 cuda_send_packet_to_host(s, obuf, olen + 2);
686             } else {
687                 /* error */
688                 obuf[0] = ADB_PACKET;
689                 obuf[1] = -olen;
690                 obuf[2] = data[1];
691                 olen = 0;
692                 cuda_send_packet_to_host(s, obuf, olen + 3);
693             }
694         }
695         break;
696     case CUDA_PACKET:
697         cuda_receive_packet(s, data + 1, len - 1);
698         break;
699     }
700 }
701 
702 static void cuda_writew (void *opaque, hwaddr addr, uint32_t value)
703 {
704 }
705 
706 static void cuda_writel (void *opaque, hwaddr addr, uint32_t value)
707 {
708 }
709 
710 static uint32_t cuda_readw (void *opaque, hwaddr addr)
711 {
712     return 0;
713 }
714 
715 static uint32_t cuda_readl (void *opaque, hwaddr addr)
716 {
717     return 0;
718 }
719 
720 static const MemoryRegionOps cuda_ops = {
721     .old_mmio = {
722         .write = {
723             cuda_writeb,
724             cuda_writew,
725             cuda_writel,
726         },
727         .read = {
728             cuda_readb,
729             cuda_readw,
730             cuda_readl,
731         },
732     },
733     .endianness = DEVICE_NATIVE_ENDIAN,
734 };
735 
736 static bool cuda_timer_exist(void *opaque, int version_id)
737 {
738     CUDATimer *s = opaque;
739 
740     return s->timer != NULL;
741 }
742 
743 static const VMStateDescription vmstate_cuda_timer = {
744     .name = "cuda_timer",
745     .version_id = 0,
746     .minimum_version_id = 0,
747     .fields = (VMStateField[]) {
748         VMSTATE_UINT16(latch, CUDATimer),
749         VMSTATE_UINT16(counter_value, CUDATimer),
750         VMSTATE_INT64(load_time, CUDATimer),
751         VMSTATE_INT64(next_irq_time, CUDATimer),
752         VMSTATE_TIMER_PTR_TEST(timer, CUDATimer, cuda_timer_exist),
753         VMSTATE_END_OF_LIST()
754     }
755 };
756 
757 static const VMStateDescription vmstate_cuda = {
758     .name = "cuda",
759     .version_id = 3,
760     .minimum_version_id = 3,
761     .fields = (VMStateField[]) {
762         VMSTATE_UINT8(a, CUDAState),
763         VMSTATE_UINT8(b, CUDAState),
764         VMSTATE_UINT8(last_b, CUDAState),
765         VMSTATE_UINT8(dira, CUDAState),
766         VMSTATE_UINT8(dirb, CUDAState),
767         VMSTATE_UINT8(sr, CUDAState),
768         VMSTATE_UINT8(acr, CUDAState),
769         VMSTATE_UINT8(last_acr, CUDAState),
770         VMSTATE_UINT8(pcr, CUDAState),
771         VMSTATE_UINT8(ifr, CUDAState),
772         VMSTATE_UINT8(ier, CUDAState),
773         VMSTATE_UINT8(anh, CUDAState),
774         VMSTATE_INT32(data_in_size, CUDAState),
775         VMSTATE_INT32(data_in_index, CUDAState),
776         VMSTATE_INT32(data_out_index, CUDAState),
777         VMSTATE_UINT8(autopoll, CUDAState),
778         VMSTATE_BUFFER(data_in, CUDAState),
779         VMSTATE_BUFFER(data_out, CUDAState),
780         VMSTATE_UINT32(tick_offset, CUDAState),
781         VMSTATE_STRUCT_ARRAY(timers, CUDAState, 2, 1,
782                              vmstate_cuda_timer, CUDATimer),
783         VMSTATE_TIMER_PTR(adb_poll_timer, CUDAState),
784         VMSTATE_TIMER_PTR(sr_delay_timer, CUDAState),
785         VMSTATE_END_OF_LIST()
786     }
787 };
788 
789 static void cuda_reset(DeviceState *dev)
790 {
791     CUDAState *s = CUDA(dev);
792 
793     s->b = 0;
794     s->a = 0;
795     s->dirb = 0xff;
796     s->dira = 0;
797     s->sr = 0;
798     s->acr = 0;
799     s->pcr = 0;
800     s->ifr = 0;
801     s->ier = 0;
802     //    s->ier = T1_INT | SR_INT;
803     s->anh = 0;
804     s->data_in_size = 0;
805     s->data_in_index = 0;
806     s->data_out_index = 0;
807     s->autopoll = 0;
808 
809     s->timers[0].latch = 0xffff;
810     set_counter(s, &s->timers[0], 0xffff);
811 
812     s->timers[1].latch = 0xffff;
813 
814     s->sr_delay_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, cuda_set_sr_int, s);
815 }
816 
817 static void cuda_realizefn(DeviceState *dev, Error **errp)
818 {
819     CUDAState *s = CUDA(dev);
820     struct tm tm;
821 
822     s->timers[0].timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, cuda_timer1, s);
823     s->timers[0].frequency = s->frequency;
824     s->timers[1].timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, cuda_timer2, s);
825     s->timers[1].frequency = (SCALE_US * 6000) / 4700;
826 
827     qemu_get_timedate(&tm, 0);
828     s->tick_offset = (uint32_t)mktimegm(&tm) + RTC_OFFSET;
829 
830     s->adb_poll_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, cuda_adb_poll, s);
831 }
832 
833 static void cuda_initfn(Object *obj)
834 {
835     SysBusDevice *d = SYS_BUS_DEVICE(obj);
836     CUDAState *s = CUDA(obj);
837     int i;
838 
839     memory_region_init_io(&s->mem, obj, &cuda_ops, s, "cuda", 0x2000);
840     sysbus_init_mmio(d, &s->mem);
841     sysbus_init_irq(d, &s->irq);
842 
843     for (i = 0; i < ARRAY_SIZE(s->timers); i++) {
844         s->timers[i].index = i;
845     }
846 
847     qbus_create_inplace(&s->adb_bus, sizeof(s->adb_bus), TYPE_ADB_BUS,
848                         DEVICE(obj), "adb.0");
849 }
850 
851 static Property cuda_properties[] = {
852     DEFINE_PROP_UINT64("frequency", CUDAState, frequency, 0),
853     DEFINE_PROP_END_OF_LIST()
854 };
855 
856 static void cuda_class_init(ObjectClass *oc, void *data)
857 {
858     DeviceClass *dc = DEVICE_CLASS(oc);
859 
860     dc->realize = cuda_realizefn;
861     dc->reset = cuda_reset;
862     dc->vmsd = &vmstate_cuda;
863     dc->props = cuda_properties;
864     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
865 }
866 
867 static const TypeInfo cuda_type_info = {
868     .name = TYPE_CUDA,
869     .parent = TYPE_SYS_BUS_DEVICE,
870     .instance_size = sizeof(CUDAState),
871     .instance_init = cuda_initfn,
872     .class_init = cuda_class_init,
873 };
874 
875 static void cuda_register_types(void)
876 {
877     type_register_static(&cuda_type_info);
878 }
879 
880 type_init(cuda_register_types)
881