Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180212' into staging

ppc patch queue 2018-02-12

Here's the accumulatead ppc and pseries related patches for the last
while.  Highlights are:
    * A number of Macintosh / CUDA cleanups from Mark Cave-Ayland
    * An important bug fix (missing "break;") for
      H_GET_CPU_CHARACTERISTICS
    * Yet another fix for SMT mode handling
    * Assorted other cleanups and fixes

# gpg: Signature made Mon 12 Feb 2018 03:39:30 GMT
# gpg:                using RSA key 6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.12-20180212:
  misc: introduce new mos6522 VIA device and enable it for ppc builds
  cuda: factor out timebase-derived counter value and load time
  cuda: set timer 1 frequency property to CUDA_TIMER_FREQ
  cuda: don't call cuda_update() when writing to ACR register
  cuda: minor cosmetic tidy-ups to get_next_irq_time()
  cuda: rename frequency property to tb_frequency
  cuda: introduce CUDAState parameter to get_counter()
  spapr: set vsmt to MAX(8, smp_threads)
  cuda: don't allow writes to port output pins
  cuda: do not use old_mmio accesses
  hw/ppc: rename functions in comments
  spapr: add missing break in h_get_cpu_characteristics()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

8 files changed, 569 insertions, 69 deletions

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index fce426eb75..f33b37a8e5 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -17,6 +17,9 @@ common-obj-$(CONFIG_INTEGRATOR_DEBUG) += arm_integrator_debug.o
 common-obj-$(CONFIG_A9SCU) += a9scu.o
 common-obj-$(CONFIG_ARM11SCU) += arm11scu.o
 
+# Mac devices
+common-obj-$(CONFIG_MOS6522) += mos6522.o
+
 # PKUnity SoC devices
 common-obj-$(CONFIG_PUV3) += puv3_pm.o
 
diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
index 008d8bd4d5..a185252144 100644
--- a/hw/misc/macio/cuda.c
+++ b/hw/misc/macio/cuda.c
@@ -145,21 +145,29 @@ static void cuda_update_irq(CUDAState *s)
     }
 }
 
-static uint64_t get_tb(uint64_t time, uint64_t freq)
+static uint64_t get_counter_value(CUDAState *s, CUDATimer *ti)
 {
-    return muldiv64(time, freq, NANOSECONDS_PER_SECOND);
+    /* Reverse of the tb calculation algorithm that Mac OS X uses on bootup */
+    uint64_t tb_diff = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
+                                s->tb_frequency, NANOSECONDS_PER_SECOND) -
+                           ti->load_time;
+
+    return (tb_diff * 0xBF401675E5DULL) / (s->tb_frequency << 24);
 }
 
-static unsigned int get_counter(CUDATimer *ti)
+static uint64_t get_counter_load_time(CUDAState *s, CUDATimer *ti)
+{
+    uint64_t load_time = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
+                                  s->tb_frequency, NANOSECONDS_PER_SECOND);
+    return load_time;
+}
+
+static unsigned int get_counter(CUDAState *s, CUDATimer *ti)
 {
     int64_t d;
     unsigned int counter;
-    uint64_t tb_diff;
-    uint64_t current_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 
-    /* Reverse of the tb calculation algorithm that Mac OS X uses on bootup. */
-    tb_diff = get_tb(current_time, ti->frequency) - ti->load_time;
-    d = (tb_diff * 0xBF401675E5DULL) / (ti->frequency << 24);
+    d = get_counter_value(s, ti);
 
     if (ti->index == 0) {
         /* the timer goes down from latch to -1 (period of latch + 2) */
@@ -178,42 +186,42 @@ static unsigned int get_counter(CUDATimer *ti)
 static void set_counter(CUDAState *s, CUDATimer *ti, unsigned int val)
 {
     CUDA_DPRINTF("T%d.counter=%d\n", 1 + ti->index, val);
-    ti->load_time = get_tb(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                           s->frequency);
+    ti->load_time = get_counter_load_time(s, ti);
     ti->counter_value = val;
     cuda_timer_update(s, ti, ti->load_time);
 }
 
-static int64_t get_next_irq_time(CUDATimer *s, int64_t current_time)
+static int64_t get_next_irq_time(CUDATimer *ti, int64_t current_time)
 {
     int64_t d, next_time;
     unsigned int counter;
 
     /* current counter value */
-    d = muldiv64(current_time - s->load_time,
-                 CUDA_TIMER_FREQ, NANOSECONDS_PER_SECOND);
+    d = muldiv64(current_time - ti->load_time,
+                 ti->frequency, NANOSECONDS_PER_SECOND);
     /* the timer goes down from latch to -1 (period of latch + 2) */
-    if (d <= (s->counter_value + 1)) {
-        counter = (s->counter_value - d) & 0xffff;
+    if (d <= (ti->counter_value + 1)) {
+        counter = (ti->counter_value - d) & 0xffff;
     } else {
-        counter = (d - (s->counter_value + 1)) % (s->latch + 2);
-        counter = (s->latch - counter) & 0xffff;
+        counter = (d - (ti->counter_value + 1)) % (ti->latch + 2);
+        counter = (ti->latch - counter) & 0xffff;
     }
 
     /* Note: we consider the irq is raised on 0 */
     if (counter == 0xffff) {
-        next_time = d + s->latch + 1;
+        next_time = d + ti->latch + 1;
     } else if (counter == 0) {
-        next_time = d + s->latch + 2;
+        next_time = d + ti->latch + 2;
     } else {
         next_time = d + counter;
     }
     CUDA_DPRINTF("latch=%d counter=%" PRId64 " delta_next=%" PRId64 "\n",
-                 s->latch, d, next_time - d);
-    next_time = muldiv64(next_time, NANOSECONDS_PER_SECOND, CUDA_TIMER_FREQ) +
-        s->load_time;
-    if (next_time <= current_time)
+                 ti->latch, d, next_time - d);
+    next_time = muldiv64(next_time, NANOSECONDS_PER_SECOND, ti->frequency) +
+                         ti->load_time;
+    if (next_time <= current_time) {
         next_time = current_time + 1;
+    }
     return next_time;
 }
 
@@ -275,7 +283,7 @@ static void cuda_delay_set_sr_int(CUDAState *s)
     timer_mod(s->sr_delay_timer, expire);
 }
 
-static uint32_t cuda_readb(void *opaque, hwaddr addr)
+static uint64_t cuda_read(void *opaque, hwaddr addr, unsigned size)
 {
     CUDAState *s = opaque;
     uint32_t val;
@@ -295,12 +303,12 @@ static uint32_t cuda_readb(void *opaque, hwaddr addr)
         val = s->dira;
         break;
     case CUDA_REG_T1CL:
-        val = get_counter(&s->timers[0]) & 0xff;
+        val = get_counter(s, &s->timers[0]) & 0xff;
         s->ifr &= ~T1_INT;
         cuda_update_irq(s);
         break;
     case CUDA_REG_T1CH:
-        val = get_counter(&s->timers[0]) >> 8;
+        val = get_counter(s, &s->timers[0]) >> 8;
         cuda_update_irq(s);
         break;
     case CUDA_REG_T1LL:
@@ -311,12 +319,12 @@ static uint32_t cuda_readb(void *opaque, hwaddr addr)
         val = (s->timers[0].latch >> 8) & 0xff;
         break;
     case CUDA_REG_T2CL:
-        val = get_counter(&s->timers[1]) & 0xff;
+        val = get_counter(s, &s->timers[1]) & 0xff;
         s->ifr &= ~T2_INT;
         cuda_update_irq(s);
         break;
     case CUDA_REG_T2CH:
-        val = get_counter(&s->timers[1]) >> 8;
+        val = get_counter(s, &s->timers[1]) >> 8;
         break;
     case CUDA_REG_SR:
         val = s->sr;
@@ -350,7 +358,7 @@ static uint32_t cuda_readb(void *opaque, hwaddr addr)
     return val;
 }
 
-static void cuda_writeb(void *opaque, hwaddr addr, uint32_t val)
+static void cuda_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
 {
     CUDAState *s = opaque;
 
@@ -359,11 +367,11 @@ static void cuda_writeb(void *opaque, hwaddr addr, uint32_t val)
 
     switch(addr) {
     case CUDA_REG_B:
-        s->b = val;
+        s->b = (s->b & ~s->dirb) | (val & s->dirb);
         cuda_update(s);
         break;
     case CUDA_REG_A:
-        s->a = val;
+        s->a = (s->a & ~s->dira) | (val & s->dira);
         break;
     case CUDA_REG_DIRB:
         s->dirb = val;
@@ -406,7 +414,6 @@ static void cuda_writeb(void *opaque, hwaddr addr, uint32_t val)
     case CUDA_REG_ACR:
         s->acr = val;
         cuda_timer_update(s, &s->timers[0], qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
-        cuda_update(s);
         break;
     case CUDA_REG_PCR:
         s->pcr = val;
@@ -780,38 +787,14 @@ static void cuda_receive_packet_from_host(CUDAState *s,
     }
 }
 
-static void cuda_writew (void *opaque, hwaddr addr, uint32_t value)
-{
-}
-
-static void cuda_writel (void *opaque, hwaddr addr, uint32_t value)
-{
-}
-
-static uint32_t cuda_readw (void *opaque, hwaddr addr)
-{
-    return 0;
-}
-
-static uint32_t cuda_readl (void *opaque, hwaddr addr)
-{
-    return 0;
-}
-
 static const MemoryRegionOps cuda_ops = {
-    .old_mmio = {
-        .write = {
-            cuda_writeb,
-            cuda_writew,
-            cuda_writel,
-        },
-        .read = {
-            cuda_readb,
-            cuda_readw,
-            cuda_readl,
-        },
+    .read = cuda_read,
+    .write = cuda_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 1,
     },
-    .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
 static bool cuda_timer_exist(void *opaque, int version_id)
@@ -903,7 +886,7 @@ static void cuda_realizefn(DeviceState *dev, Error **errp)
     struct tm tm;
 
     s->timers[0].timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, cuda_timer1, s);
-    s->timers[0].frequency = s->frequency;
+    s->timers[0].frequency = CUDA_TIMER_FREQ;
     s->timers[1].timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, cuda_timer2, s);
     s->timers[1].frequency = (SCALE_US * 6000) / 4700;
 
@@ -934,7 +917,7 @@ static void cuda_initfn(Object *obj)
 }
 
 static Property cuda_properties[] = {
-    DEFINE_PROP_UINT64("frequency", CUDAState, frequency, 0),
+    DEFINE_PROP_UINT64("timebase-frequency", CUDAState, tb_frequency, 0),
     DEFINE_PROP_END_OF_LIST()
 };
 
diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 44f91d1e7f..a639b09e00 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -451,7 +451,7 @@ void macio_init(PCIDevice *d,
     macio_state->escc_mem = escc_mem;
     /* Note: this code is strongly inspirated from the corresponding code
        in PearPC */
-    qdev_prop_set_uint64(DEVICE(&macio_state->cuda), "frequency",
+    qdev_prop_set_uint64(DEVICE(&macio_state->cuda), "timebase-frequency",
                          macio_state->frequency);
 
     qdev_init_nofail(DEVICE(d));
diff --git a/hw/misc/mos6522.c b/hw/misc/mos6522.c
new file mode 100644
index 0000000000..8ad9fc831e
--- /dev/null
+++ b/hw/misc/mos6522.c
@@ -0,0 +1,505 @@
+/*
+ * QEMU MOS6522 VIA emulation
+ *
+ * Copyright (c) 2004-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ * Copyright (c) 2018 Mark Cave-Ayland
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/input/adb.h"
+#include "hw/misc/mos6522.h"
+#include "qemu/timer.h"
+#include "sysemu/sysemu.h"
+#include "qemu/cutils.h"
+#include "qemu/log.h"
+#include "trace.h"
+
+/* XXX: implement all timer modes */
+
+static void mos6522_timer_update(MOS6522State *s, MOS6522Timer *ti,
+                                 int64_t current_time);
+
+static void mos6522_update_irq(MOS6522State *s)
+{
+    if (s->ifr & s->ier & (SR_INT | T1_INT | T2_INT)) {
+        qemu_irq_raise(s->irq);
+    } else {
+        qemu_irq_lower(s->irq);
+    }
+}
+
+static uint64_t get_counter_value(MOS6522State *s, MOS6522Timer *ti)
+{
+    MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(s);
+
+    if (ti->index == 0) {
+        return mdc->get_timer1_counter_value(s, ti);
+    } else {
+        return mdc->get_timer2_counter_value(s, ti);
+    }
+}
+
+static uint64_t get_load_time(MOS6522State *s, MOS6522Timer *ti)
+{
+    MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(s);
+
+    if (ti->index == 0) {
+        return mdc->get_timer1_load_time(s, ti);
+    } else {
+        return mdc->get_timer2_load_time(s, ti);
+    }
+}
+
+static unsigned int get_counter(MOS6522State *s, MOS6522Timer *ti)
+{
+    int64_t d;
+    unsigned int counter;
+
+    d = get_counter_value(s, ti);
+
+    if (ti->index == 0) {
+        /* the timer goes down from latch to -1 (period of latch + 2) */
+        if (d <= (ti->counter_value + 1)) {
+            counter = (ti->counter_value - d) & 0xffff;
+        } else {
+            counter = (d - (ti->counter_value + 1)) % (ti->latch + 2);
+            counter = (ti->latch - counter) & 0xffff;
+        }
+    } else {
+        counter = (ti->counter_value - d) & 0xffff;
+    }
+    return counter;
+}
+
+static void set_counter(MOS6522State *s, MOS6522Timer *ti, unsigned int val)
+{
+    trace_mos6522_set_counter(1 + ti->index, val);
+    ti->load_time = get_load_time(s, ti);
+    ti->counter_value = val;
+    mos6522_timer_update(s, ti, ti->load_time);
+}
+
+static int64_t get_next_irq_time(MOS6522State *s, MOS6522Timer *ti,
+                                 int64_t current_time)
+{
+    int64_t d, next_time;
+    unsigned int counter;
+
+    /* current counter value */
+    d = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - ti->load_time,
+                 ti->frequency, NANOSECONDS_PER_SECOND);
+
+    /* the timer goes down from latch to -1 (period of latch + 2) */
+    if (d <= (ti->counter_value + 1)) {
+        counter = (ti->counter_value - d) & 0xffff;
+    } else {
+        counter = (d - (ti->counter_value + 1)) % (ti->latch + 2);
+        counter = (ti->latch - counter) & 0xffff;
+    }
+
+    /* Note: we consider the irq is raised on 0 */
+    if (counter == 0xffff) {
+        next_time = d + ti->latch + 1;
+    } else if (counter == 0) {
+        next_time = d + ti->latch + 2;
+    } else {
+        next_time = d + counter;
+    }
+    trace_mos6522_get_next_irq_time(ti->latch, d, next_time - d);
+    next_time = muldiv64(next_time, NANOSECONDS_PER_SECOND, ti->frequency) +
+                         ti->load_time;
+    if (next_time <= current_time) {
+        next_time = current_time + 1;
+    }
+    return next_time;
+}
+
+static void mos6522_timer_update(MOS6522State *s, MOS6522Timer *ti,
+                                 int64_t current_time)
+{
+    if (!ti->timer) {
+        return;
+    }
+    if (ti->index == 0 && (s->acr & T1MODE) != T1MODE_CONT) {
+        timer_del(ti->timer);
+    } else {
+        ti->next_irq_time = get_next_irq_time(s, ti, current_time);
+        timer_mod(ti->timer, ti->next_irq_time);
+    }
+}
+
+static void mos6522_timer1(void *opaque)
+{
+    MOS6522State *s = opaque;
+    MOS6522Timer *ti = &s->timers[0];
+
+    mos6522_timer_update(s, ti, ti->next_irq_time);
+    s->ifr |= T1_INT;
+    mos6522_update_irq(s);
+}
+
+static void mos6522_timer2(void *opaque)
+{
+    MOS6522State *s = opaque;
+    MOS6522Timer *ti = &s->timers[1];
+
+    mos6522_timer_update(s, ti, ti->next_irq_time);
+    s->ifr |= T2_INT;
+    mos6522_update_irq(s);
+}
+
+static void mos6522_set_sr_int(MOS6522State *s)
+{
+    trace_mos6522_set_sr_int();
+    s->ifr |= SR_INT;
+    mos6522_update_irq(s);
+}
+
+static uint64_t mos6522_get_counter_value(MOS6522State *s, MOS6522Timer *ti)
+{
+    uint64_t d;
+
+    d = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - ti->load_time,
+                 ti->frequency, NANOSECONDS_PER_SECOND);
+
+    return d;
+}
+
+static uint64_t mos6522_get_load_time(MOS6522State *s, MOS6522Timer *ti)
+{
+    uint64_t load_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+
+    return load_time;
+}
+
+static void mos6522_portA_write(MOS6522State *s)
+{
+    qemu_log_mask(LOG_UNIMP, "portA_write unimplemented");
+}
+
+static void mos6522_portB_write(MOS6522State *s)
+{
+    qemu_log_mask(LOG_UNIMP, "portB_write unimplemented");
+}
+
+uint64_t mos6522_read(void *opaque, hwaddr addr, unsigned size)
+{
+    MOS6522State *s = opaque;
+    uint32_t val;
+
+    switch (addr) {
+    case VIA_REG_B:
+        val = s->b;
+        break;
+    case VIA_REG_A:
+        val = s->a;
+        break;
+    case VIA_REG_DIRB:
+        val = s->dirb;
+        break;
+    case VIA_REG_DIRA:
+        val = s->dira;
+        break;
+    case VIA_REG_T1CL:
+        val = get_counter(s, &s->timers[0]) & 0xff;
+        s->ifr &= ~T1_INT;
+        mos6522_update_irq(s);
+        break;
+    case VIA_REG_T1CH:
+        val = get_counter(s, &s->timers[0]) >> 8;
+        mos6522_update_irq(s);
+        break;
+    case VIA_REG_T1LL:
+        val = s->timers[0].latch & 0xff;
+        break;
+    case VIA_REG_T1LH:
+        /* XXX: check this */
+        val = (s->timers[0].latch >> 8) & 0xff;
+        break;
+    case VIA_REG_T2CL:
+        val = get_counter(s, &s->timers[1]) & 0xff;
+        s->ifr &= ~T2_INT;
+        mos6522_update_irq(s);
+        break;
+    case VIA_REG_T2CH:
+        val = get_counter(s, &s->timers[1]) >> 8;
+        break;
+    case VIA_REG_SR:
+        val = s->sr;
+        s->ifr &= ~(SR_INT | CB1_INT | CB2_INT);
+        mos6522_update_irq(s);
+        break;
+    case VIA_REG_ACR:
+        val = s->acr;
+        break;
+    case VIA_REG_PCR:
+        val = s->pcr;
+        break;
+    case VIA_REG_IFR:
+        val = s->ifr;
+        if (s->ifr & s->ier) {
+            val |= 0x80;
+        }
+        break;
+    case VIA_REG_IER:
+        val = s->ier | 0x80;
+        break;
+    default:
+    case VIA_REG_ANH:
+        val = s->anh;
+        break;
+    }
+
+    if (addr != VIA_REG_IFR || val != 0) {
+        trace_mos6522_read(addr, val);
+    }
+
+    return val;
+}
+
+void mos6522_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    MOS6522State *s = opaque;
+    MOS6522DeviceClass *mdc = MOS6522_DEVICE_GET_CLASS(s);
+
+    trace_mos6522_write(addr, val);
+
+    switch (addr) {
+    case VIA_REG_B:
+        s->b = (s->b & ~s->dirb) | (val & s->dirb);
+        mdc->portB_write(s);
+        break;
+    case VIA_REG_A:
+        s->a = (s->a & ~s->dira) | (val & s->dira);
+        mdc->portA_write(s);
+        break;
+    case VIA_REG_DIRB:
+        s->dirb = val;
+        break;
+    case VIA_REG_DIRA:
+        s->dira = val;
+        break;
+    case VIA_REG_T1CL:
+        s->timers[0].latch = (s->timers[0].latch & 0xff00) | val;
+        mos6522_timer_update(s, &s->timers[0],
+                             qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+        break;
+    case VIA_REG_T1CH:
+        s->timers[0].latch = (s->timers[0].latch & 0xff) | (val << 8);
+        s->ifr &= ~T1_INT;
+        set_counter(s, &s->timers[0], s->timers[0].latch);
+        break;
+    case VIA_REG_T1LL:
+        s->timers[0].latch = (s->timers[0].latch & 0xff00) | val;
+        mos6522_timer_update(s, &s->timers[0],
+                             qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+        break;
+    case VIA_REG_T1LH:
+        s->timers[0].latch = (s->timers[0].latch & 0xff) | (val << 8);
+        s->ifr &= ~T1_INT;
+        mos6522_timer_update(s, &s->timers[0],
+                             qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+        break;
+    case VIA_REG_T2CL:
+        s->timers[1].latch = (s->timers[1].latch & 0xff00) | val;
+        break;
+    case VIA_REG_T2CH:
+        /* To ensure T2 generates an interrupt on zero crossing with the
+           common timer code, write the value directly from the latch to
+           the counter */
+        s->timers[1].latch = (s->timers[1].latch & 0xff) | (val << 8);
+        s->ifr &= ~T2_INT;
+        set_counter(s, &s->timers[1], s->timers[1].latch);
+        break;
+    case VIA_REG_SR:
+        s->sr = val;
+        break;
+    case VIA_REG_ACR:
+        s->acr = val;
+        mos6522_timer_update(s, &s->timers[0],
+                             qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+        break;
+    case VIA_REG_PCR:
+        s->pcr = val;
+        break;
+    case VIA_REG_IFR:
+        /* reset bits */
+        s->ifr &= ~val;
+        mos6522_update_irq(s);
+        break;
+    case VIA_REG_IER:
+        if (val & IER_SET) {
+            /* set bits */
+            s->ier |= val & 0x7f;
+        } else {
+            /* reset bits */
+            s->ier &= ~val;
+        }
+        mos6522_update_irq(s);
+        break;
+    default:
+    case VIA_REG_ANH:
+        s->anh = val;
+        break;
+    }
+}
+
+static const MemoryRegionOps mos6522_ops = {
+    .read = mos6522_read,
+    .write = mos6522_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
+static bool mos6522_timer_exist(void *opaque, int version_id)
+{
+    MOS6522Timer *s = opaque;
+
+    return s->timer != NULL;
+}
+
+static const VMStateDescription vmstate_mos6522_timer = {
+    .name = "mos6522_timer",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT16(latch, MOS6522Timer),
+        VMSTATE_UINT16(counter_value, MOS6522Timer),
+        VMSTATE_INT64(load_time, MOS6522Timer),
+        VMSTATE_INT64(next_irq_time, MOS6522Timer),
+        VMSTATE_TIMER_PTR_TEST(timer, MOS6522Timer, mos6522_timer_exist),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_mos6522 = {
+    .name = "mos6522",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(a, MOS6522State),
+        VMSTATE_UINT8(b, MOS6522State),
+        VMSTATE_UINT8(dira, MOS6522State),
+        VMSTATE_UINT8(dirb, MOS6522State),
+        VMSTATE_UINT8(sr, MOS6522State),
+        VMSTATE_UINT8(acr, MOS6522State),
+        VMSTATE_UINT8(pcr, MOS6522State),
+        VMSTATE_UINT8(ifr, MOS6522State),
+        VMSTATE_UINT8(ier, MOS6522State),
+        VMSTATE_UINT8(anh, MOS6522State),
+        VMSTATE_STRUCT_ARRAY(timers, MOS6522State, 2, 1,
+                             vmstate_mos6522_timer, MOS6522Timer),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void mos6522_reset(DeviceState *dev)
+{
+    MOS6522State *s = MOS6522(dev);
+
+    s->b = 0;
+    s->a = 0;
+    s->dirb = 0xff;
+    s->dira = 0;
+    s->sr = 0;
+    s->acr = 0;
+    s->pcr = 0;
+    s->ifr = 0;
+    s->ier = 0;
+    /* s->ier = T1_INT | SR_INT; */
+    s->anh = 0;
+
+    s->timers[0].latch = 0xffff;
+    set_counter(s, &s->timers[0], 0xffff);
+
+    s->timers[1].latch = 0xffff;
+}
+
+static void mos6522_realize(DeviceState *dev, Error **errp)
+{
+    MOS6522State *s = MOS6522(dev);
+
+    s->timers[0].frequency = s->frequency;
+    s->timers[1].frequency = s->frequency;
+}
+
+static void mos6522_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    MOS6522State *s = MOS6522(obj);
+    int i;
+
+    memory_region_init_io(&s->mem, obj, &mos6522_ops, s, "mos6522", 0x10);
+    sysbus_init_mmio(sbd, &s->mem);
+    sysbus_init_irq(sbd, &s->irq);
+
+    for (i = 0; i < ARRAY_SIZE(s->timers); i++) {
+        s->timers[i].index = i;
+    }
+
+    s->timers[0].timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, mos6522_timer1, s);
+    s->timers[1].timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, mos6522_timer2, s);
+}
+
+static Property mos6522_properties[] = {
+    DEFINE_PROP_UINT64("frequency", MOS6522State, frequency, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void mos6522_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    MOS6522DeviceClass *mdc = MOS6522_DEVICE_CLASS(oc);
+
+    dc->realize = mos6522_realize;
+    dc->reset = mos6522_reset;
+    dc->vmsd = &vmstate_mos6522;
+    dc->props = mos6522_properties;
+    mdc->parent_realize = dc->realize;
+    mdc->set_sr_int = mos6522_set_sr_int;
+    mdc->portB_write = mos6522_portB_write;
+    mdc->portA_write = mos6522_portA_write;
+    mdc->get_timer1_counter_value = mos6522_get_counter_value;
+    mdc->get_timer2_counter_value = mos6522_get_counter_value;
+    mdc->get_timer1_load_time = mos6522_get_load_time;
+    mdc->get_timer2_load_time = mos6522_get_load_time;
+}
+
+static const TypeInfo mos6522_type_info = {
+    .name = TYPE_MOS6522,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(MOS6522State),
+    .instance_init = mos6522_init,
+    .abstract = true,
+    .class_size = sizeof(MOS6522DeviceClass),
+    .class_init = mos6522_class_init,
+};
+
+static void mos6522_register_types(void)
+{
+    type_register_static(&mos6522_type_info);
+}
+
+type_init(mos6522_register_types)
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index e6070f280d..b340d4e81c 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -70,3 +70,10 @@ msf2_sysreg_write_pll_status(void) "Invalid write to read only PLL status regist
 #hw/misc/imx7_gpr.c
 imx7_gpr_read(uint64_t offset) "addr 0x%08" HWADDR_PRIx
 imx7_gpr_write(uint64_t offset, uint64_t value) "addr 0x%08" HWADDR_PRIx "value 0x%08" HWADDR_PRIx
+
+# hw/misc/mos6522.c
+mos6522_set_counter(int index, unsigned int val) "T%d.counter=%d"
+mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d counter=0x%"PRId64 " delta_next=0x%"PRId64
+mos6522_set_sr_int(void) "set sr_int"
+mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
+mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
diff --git a/hw/ppc/mac.h b/hw/ppc/mac.h
index b501af1653..fa78115c95 100644
--- a/hw/ppc/mac.h
+++ b/hw/ppc/mac.h
@@ -99,7 +99,7 @@ typedef struct CUDAState {
     CUDATimer timers[2];
 
     uint32_t tick_offset;
-    uint64_t frequency;
+    uint64_t tb_frequency;
 
     uint8_t last_b;
     uint8_t last_acr;
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 659be6b746..9f29434819 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -464,7 +464,8 @@ static int spapr_populate_memory(sPAPRMachineState *spapr, void *fdt)
             }
         }
         if (!mem_start) {
-            /* ppc_spapr_init() checks for rma_size <= node0_size already */
+            /* spapr_machine_init() checks for rma_size <= node0_size
+             * already */
             spapr_populate_memory_node(fdt, i, 0, spapr->rma_size);
             mem_start += spapr->rma_size;
             node_size -= spapr->rma_size;
@@ -2309,7 +2310,7 @@ static void spapr_set_vsmt_mode(sPAPRMachineState *spapr, Error **errp)
          * the value that we'd get with KVM on POWER8, the
          * overwhelmingly common case in production systems.
          */
-        spapr->vsmt = 8;
+        spapr->vsmt = MAX(8, smp_threads);
     }
 
     /* KVM: If necessary, set the SMT mode: */
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 4d0e6eb0cf..76422cfac1 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1635,7 +1635,7 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
     spapr->cas_legacy_guest_workaround = !spapr_ovec_test(ov1_guest,
                                                           OV1_PPC_3_00);
     if (!spapr->cas_reboot) {
-        /* If ppc_spapr_reset() did not set up a HPT but one is necessary
+        /* If spapr_machine_reset() did not set up a HPT but one is necessary
          * (because the guest isn't going to use radix) then set it up here. */
         if ((spapr->patb_entry & PATBE1_GR) && !guest_radix) {
             /* legacy hash or new hash: */
@@ -1697,6 +1697,7 @@ static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
     switch (safe_indirect_branch) {
     case SPAPR_CAP_FIXED:
         characteristics |= H_CPU_CHAR_BCCTRL_SERIALISED;
+        break;
     default: /* broken */
         assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
         break;