hw/m68k/next-cube.c

   1 /*
   2  * NeXT Cube System Driver
   3  *
   4  * Copyright (c) 2011 Bryce Lanham
   5  *
   6  * This code is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published
   8  * by the Free Software Foundation; either version 2 of the License,
   9  * or (at your option) any later version.
  10  */
  11
  12 #include "qemu/osdep.h"
  13 #include "cpu.h"
  14 #include "exec/hwaddr.h"
  15 #include "exec/address-spaces.h"
  16 #include "sysemu/sysemu.h"
  17 #include "sysemu/qtest.h"
  18 #include "hw/irq.h"
  19 #include "hw/m68k/next-cube.h"
  20 #include "hw/boards.h"
  21 #include "hw/loader.h"
  22 #include "hw/scsi/esp.h"
  23 #include "hw/sysbus.h"
  24 #include "qom/object.h"
  25 #include "hw/char/escc.h" /* ZILOG 8530 Serial Emulation */
  26 #include "hw/block/fdc.h"
  27 #include "hw/qdev-properties.h"
  28 #include "qapi/error.h"
  29 #include "ui/console.h"
  30 #include "target/m68k/cpu.h"
  31
  32 /* #define DEBUG_NEXT */
  33 #ifdef DEBUG_NEXT
  34 #define DPRINTF(fmt, ...) \
  35     do { printf("NeXT: " fmt , ## __VA_ARGS__); } while (0)
  36 #else
  37 #define DPRINTF(fmt, ...) do { } while (0)
  38 #endif
  39
  40 #define TYPE_NEXT_MACHINE MACHINE_TYPE_NAME("next-cube")
  41 OBJECT_DECLARE_SIMPLE_TYPE(NeXTState, NEXT_MACHINE)
  42
  43 #define ENTRY       0x0100001e
  44 #define RAM_SIZE    0x4000000
  45 #define ROM_FILE    "Rev_2.5_v66.bin"
  46
  47 typedef struct next_dma {
  48     uint32_t csr;
  49
  50     uint32_t saved_next;
  51     uint32_t saved_limit;
  52     uint32_t saved_start;
  53     uint32_t saved_stop;
  54
  55     uint32_t next;
  56     uint32_t limit;
  57     uint32_t start;
  58     uint32_t stop;
  59
  60     uint32_t next_initbuf;
  61     uint32_t size;
  62 } next_dma;
  63
  64 typedef struct NextRtc {
  65     uint8_t ram[32];
  66     uint8_t command;
  67     uint8_t value;
  68     uint8_t status;
  69     uint8_t control;
  70     uint8_t retval;
  71 } NextRtc;
  72
  73 struct NeXTState {
  74     MachineState parent;
  75
  76     next_dma dma[10];
  77     qemu_irq *scsi_irq;
  78     qemu_irq scsi_dma;
  79     qemu_irq scsi_reset;
  80     qemu_irq *fd_irq;
  81
  82     NextRtc rtc;
  83 };
  84
  85 #define TYPE_NEXT_PC "next-pc"
  86 OBJECT_DECLARE_SIMPLE_TYPE(NeXTPC, NEXT_PC)
  87
  88 /* NeXT Peripheral Controller */
  89 struct NeXTPC {
  90     SysBusDevice parent_obj;
  91
  92     /* Temporary until all functionality has been moved into this device */
  93     NeXTState *ns;
  94
  95     M68kCPU *cpu;
  96
  97     MemoryRegion mmiomem;
  98     MemoryRegion scrmem;
  99
 100     uint32_t scr1;
 101     uint32_t scr2;
 102     uint8_t scsi_csr_1;
 103     uint8_t scsi_csr_2;
 104     uint32_t int_mask;
 105     uint32_t int_status;
 106 };
 107
 108 /* Thanks to NeXT forums for this */
 109 /*
 110 static const uint8_t rtc_ram3[32] = {
 111     0x94, 0x0f, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
 112     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x7B, 0x00,
 113     0x00, 0x00, 0x65, 0x6e, 0x00, 0x00, 0x00, 0x00,
 114     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x13
 115 };
 116 */
 117 static const uint8_t rtc_ram2[32] = {
 118     0x94, 0x0f, 0x40, 0x03, 0x00, 0x00, 0x00, 0x00,
 119     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x4b, 0x00,
 120     0x41, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
 121     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x7e,
 122 };
 123
 124 #define SCR2_RTCLK 0x2
 125 #define SCR2_RTDATA 0x4
 126 #define SCR2_TOBCD(x) (((x / 10) << 4) + (x % 10))
 127
 128 static void nextscr2_write(NeXTPC *s, uint32_t val, int size)
 129 {
 130     static int led;
 131     static int phase;
 132     static uint8_t old_scr2;
 133     uint8_t scr2_2;
 134     NextRtc *rtc = &s->ns->rtc;
 135
 136     if (size == 4) {
 137         scr2_2 = (val >> 8) & 0xFF;
 138     } else {
 139         scr2_2 = val & 0xFF;
 140     }
 141
 142     if (val & 0x1) {
 143         DPRINTF("fault!\n");
 144         led++;
 145         if (led == 10) {
 146             DPRINTF("LED flashing, possible fault!\n");
 147             led = 0;
 148         }
 149     }
 150
 151     if (scr2_2 & 0x1) {
 152         /* DPRINTF("RTC %x phase %i\n", scr2_2, phase); */
 153         if (phase == -1) {
 154             phase = 0;
 155         }
 156         /* If we are in going down clock... do something */
 157         if (((old_scr2 & SCR2_RTCLK) != (scr2_2 & SCR2_RTCLK)) &&
 158                 ((scr2_2 & SCR2_RTCLK) == 0)) {
 159             if (phase < 8) {
 160                 rtc->command = (rtc->command << 1) |
 161                                ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 162             }
 163             if (phase >= 8 && phase < 16) {
 164                 rtc->value = (rtc->value << 1) |
 165                              ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 166
 167                 /* if we read RAM register, output RT_DATA bit */
 168                 if (rtc->command <= 0x1F) {
 169                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 170                     if (rtc->ram[rtc->command] & (0x80 >> (phase - 8))) {
 171                         scr2_2 |= SCR2_RTDATA;
 172                     }
 173
 174                     rtc->retval = (rtc->retval << 1) |
 175                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 176                 }
 177                 /* read the status 0x30 */
 178                 if (rtc->command == 0x30) {
 179                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 180                     /* for now status = 0x98 (new rtc + FTU) */
 181                     if (rtc->status & (0x80 >> (phase - 8))) {
 182                         scr2_2 |= SCR2_RTDATA;
 183                     }
 184
 185                     rtc->retval = (rtc->retval << 1) |
 186                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 187                 }
 188                 /* read the status 0x31 */
 189                 if (rtc->command == 0x31) {
 190                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 191                     if (rtc->control & (0x80 >> (phase - 8))) {
 192                         scr2_2 |= SCR2_RTDATA;
 193                     }
 194                     rtc->retval = (rtc->retval << 1) |
 195                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 196                 }
 197
 198                 if ((rtc->command >= 0x20) && (rtc->command <= 0x2F)) {
 199                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 200                     /* for now 0x00 */
 201                     time_t time_h = time(NULL);
 202                     struct tm *info = localtime(&time_h);
 203                     int ret = 0;
 204
 205                     switch (rtc->command) {
 206                     case 0x20:
 207                         ret = SCR2_TOBCD(info->tm_sec);
 208                         break;
 209                     case 0x21:
 210                         ret = SCR2_TOBCD(info->tm_min);
 211                         break;
 212                     case 0x22:
 213                         ret = SCR2_TOBCD(info->tm_hour);
 214                         break;
 215                     case 0x24:
 216                         ret = SCR2_TOBCD(info->tm_mday);
 217                         break;
 218                     case 0x25:
 219                         ret = SCR2_TOBCD((info->tm_mon + 1));
 220                         break;
 221                     case 0x26:
 222                         ret = SCR2_TOBCD((info->tm_year - 100));
 223                         break;
 224
 225                     }
 226
 227                     if (ret & (0x80 >> (phase - 8))) {
 228                         scr2_2 |= SCR2_RTDATA;
 229                     }
 230                     rtc->retval = (rtc->retval << 1) |
 231                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 232                 }
 233
 234             }
 235
 236             phase++;
 237             if (phase == 16) {
 238                 if (rtc->command >= 0x80 && rtc->command <= 0x9F) {
 239                     rtc->ram[rtc->command - 0x80] = rtc->value;
 240                 }
 241                 /* write to x30 register */
 242                 if (rtc->command == 0xB1) {
 243                     /* clear FTU */
 244                     if (rtc->value & 0x04) {
 245                         rtc->status = rtc->status & (~0x18);
 246                         s->int_status = s->int_status & (~0x04);
 247                     }
 248                 }
 249             }
 250         }
 251     } else {
 252         /* else end or abort */
 253         phase = -1;
 254         rtc->command = 0;
 255         rtc->value = 0;
 256     }
 257     s->scr2 = val & 0xFFFF00FF;
 258     s->scr2 |= scr2_2 << 8;
 259     old_scr2 = scr2_2;
 260 }
 261
 262 static uint32_t mmio_readb(NeXTPC *s, hwaddr addr)
 263 {
 264     switch (addr) {
 265     case 0xc000:
 266         return (s->scr1 >> 24) & 0xFF;
 267     case 0xc001:
 268         return (s->scr1 >> 16) & 0xFF;
 269     case 0xc002:
 270         return (s->scr1 >> 8)  & 0xFF;
 271     case 0xc003:
 272         return (s->scr1 >> 0)  & 0xFF;
 273
 274     case 0xd000:
 275         return (s->scr2 >> 24) & 0xFF;
 276     case 0xd001:
 277         return (s->scr2 >> 16) & 0xFF;
 278     case 0xd002:
 279         return (s->scr2 >> 8)  & 0xFF;
 280     case 0xd003:
 281         return (s->scr2 >> 0)  & 0xFF;
 282     case 0x14020:
 283         DPRINTF("MMIO Read 0x4020\n");
 284         return 0x7f;
 285
 286     default:
 287         DPRINTF("MMIO Read B @ %"HWADDR_PRIx"\n", addr);
 288         return 0x0;
 289     }
 290 }
 291
 292 static uint32_t mmio_readw(NeXTPC *s, hwaddr addr)
 293 {
 294     switch (addr) {
 295     default:
 296         DPRINTF("MMIO Read W @ %"HWADDR_PRIx"\n", addr);
 297         return 0x0;
 298     }
 299 }
 300
 301 static uint32_t mmio_readl(NeXTPC *s, hwaddr addr)
 302 {
 303     switch (addr) {
 304     case 0x7000:
 305         /* DPRINTF("Read INT status: %x\n", s->int_status); */
 306         return s->int_status;
 307
 308     case 0x7800:
 309         DPRINTF("MMIO Read INT mask: %x\n", s->int_mask);
 310         return s->int_mask;
 311
 312     case 0xc000:
 313         return s->scr1;
 314
 315     case 0xd000:
 316         return s->scr2;
 317
 318     default:
 319         DPRINTF("MMIO Read L @ %"HWADDR_PRIx"\n", addr);
 320         return 0x0;
 321     }
 322 }
 323
 324 static void mmio_writeb(NeXTPC *s, hwaddr addr, uint32_t val)
 325 {
 326     switch (addr) {
 327     case 0xd003:
 328         nextscr2_write(s, val, 1);
 329         break;
 330     default:
 331         DPRINTF("MMIO Write B @ %x with %x\n", (unsigned int)addr, val);
 332     }
 333
 334 }
 335
 336 static void mmio_writew(NeXTPC *s, hwaddr addr, uint32_t val)
 337 {
 338     DPRINTF("MMIO Write W\n");
 339 }
 340
 341 static void mmio_writel(NeXTPC *s, hwaddr addr, uint32_t val)
 342 {
 343     switch (addr) {
 344     case 0x7000:
 345         DPRINTF("INT Status old: %x new: %x\n", s->int_status, val);
 346         s->int_status = val;
 347         break;
 348     case 0x7800:
 349         DPRINTF("INT Mask old: %x new: %x\n", s->int_mask, val);
 350         s->int_mask  = val;
 351         break;
 352     case 0xc000:
 353         DPRINTF("SCR1 Write: %x\n", val);
 354         break;
 355     case 0xd000:
 356         nextscr2_write(s, val, 4);
 357         break;
 358
 359     default:
 360         DPRINTF("MMIO Write l @ %x with %x\n", (unsigned int)addr, val);
 361     }
 362 }
 363
 364 static uint64_t mmio_readfn(void *opaque, hwaddr addr, unsigned size)
 365 {
 366     NeXTPC *s = NEXT_PC(opaque);
 367
 368     switch (size) {
 369     case 1:
 370         return mmio_readb(s, addr);
 371     case 2:
 372         return mmio_readw(s, addr);
 373     case 4:
 374         return mmio_readl(s, addr);
 375     default:
 376         g_assert_not_reached();
 377     }
 378 }
 379
 380 static void mmio_writefn(void *opaque, hwaddr addr, uint64_t value,
 381                          unsigned size)
 382 {
 383     NeXTPC *s = NEXT_PC(opaque);
 384
 385     switch (size) {
 386     case 1:
 387         mmio_writeb(s, addr, value);
 388         break;
 389     case 2:
 390         mmio_writew(s, addr, value);
 391         break;
 392     case 4:
 393         mmio_writel(s, addr, value);
 394         break;
 395     default:
 396         g_assert_not_reached();
 397     }
 398 }
 399
 400 static const MemoryRegionOps mmio_ops = {
 401     .read = mmio_readfn,
 402     .write = mmio_writefn,
 403     .valid.min_access_size = 1,
 404     .valid.max_access_size = 4,
 405     .endianness = DEVICE_NATIVE_ENDIAN,
 406 };
 407
 408 static uint32_t scr_readb(NeXTPC *s, hwaddr addr)
 409 {
 410     switch (addr) {
 411     case 0x14108:
 412         DPRINTF("FD read @ %x\n", (unsigned int)addr);
 413         return 0x40 | 0x04 | 0x2 | 0x1;
 414     case 0x14020:
 415         DPRINTF("SCSI 4020  STATUS READ %X\n", s->scsi_csr_1);
 416         return s->scsi_csr_1;
 417
 418     case 0x14021:
 419         DPRINTF("SCSI 4021 STATUS READ %X\n", s->scsi_csr_2);
 420         return 0x40;
 421
 422     /*
 423      * These 4 registers are the hardware timer, not sure which register
 424      * is the latch instead of data, but no problems so far
 425      */
 426     case 0x1a000:
 427         return 0xff & (clock() >> 24);
 428     case 0x1a001:
 429         return 0xff & (clock() >> 16);
 430     case 0x1a002:
 431         return 0xff & (clock() >> 8);
 432     case 0x1a003:
 433         /* Hack: We need to have this change consistently to make it work */
 434         return 0xFF & clock();
 435
 436     default:
 437         DPRINTF("BMAP Read B @ %x\n", (unsigned int)addr);
 438         return 0;
 439     }
 440 }
 441
 442 static uint32_t scr_readw(NeXTPC *s, hwaddr addr)
 443 {
 444     DPRINTF("BMAP Read W @ %x\n", (unsigned int)addr);
 445     return 0;
 446 }
 447
 448 static uint32_t scr_readl(NeXTPC *s, hwaddr addr)
 449 {
 450     DPRINTF("BMAP Read L @ %x\n", (unsigned int)addr);
 451     return 0;
 452 }
 453
 454 #define SCSICSR_ENABLE  0x01
 455 #define SCSICSR_RESET   0x02  /* reset scsi dma */
 456 #define SCSICSR_FIFOFL  0x04
 457 #define SCSICSR_DMADIR  0x08  /* if set, scsi to mem */
 458 #define SCSICSR_CPUDMA  0x10  /* if set, dma enabled */
 459 #define SCSICSR_INTMASK 0x20  /* if set, interrupt enabled */
 460
 461 static void scr_writeb(NeXTPC *s, hwaddr addr, uint32_t value)
 462 {
 463     switch (addr) {
 464     case 0x14108:
 465         DPRINTF("FDCSR Write: %x\n", value);
 466
 467         if (value == 0x0) {
 468             /* qemu_irq_raise(s->fd_irq[0]); */
 469         }
 470         break;
 471     case 0x14020: /* SCSI Control Register */
 472         if (value & SCSICSR_FIFOFL) {
 473             DPRINTF("SCSICSR FIFO Flush\n");
 474             /* will have to add another irq to the esp if this is needed */
 475             /* esp_puflush_fifo(esp_g); */
 476             /* qemu_irq_pulse(s->scsi_dma); */
 477         }
 478
 479         if (value & SCSICSR_ENABLE) {
 480             DPRINTF("SCSICSR Enable\n");
 481             /*
 482              * qemu_irq_raise(s->scsi_dma);
 483              * s->scsi_csr_1 = 0xc0;
 484              * s->scsi_csr_1 |= 0x1;
 485              * qemu_irq_pulse(s->scsi_dma);
 486              */
 487         }
 488         /*
 489          * else
 490          *     s->scsi_csr_1 &= ~SCSICSR_ENABLE;
 491          */
 492
 493         if (value & SCSICSR_RESET) {
 494             DPRINTF("SCSICSR Reset\n");
 495             /* I think this should set DMADIR. CPUDMA and INTMASK to 0 */
 496             /* qemu_irq_raise(s->scsi_reset); */
 497             /* s->scsi_csr_1 &= ~(SCSICSR_INTMASK |0x80|0x1); */
 498
 499         }
 500         if (value & SCSICSR_DMADIR) {
 501             DPRINTF("SCSICSR DMAdir\n");
 502         }
 503         if (value & SCSICSR_CPUDMA) {
 504             DPRINTF("SCSICSR CPUDMA\n");
 505             /* qemu_irq_raise(s->scsi_dma); */
 506
 507             s->int_status |= 0x4000000;
 508         } else {
 509             s->int_status &= ~(0x4000000);
 510         }
 511         if (value & SCSICSR_INTMASK) {
 512             DPRINTF("SCSICSR INTMASK\n");
 513             /*
 514              * int_mask &= ~0x1000;
 515              * s->scsi_csr_1 |= value;
 516              * s->scsi_csr_1 &= ~SCSICSR_INTMASK;
 517              * if (s->scsi_queued) {
 518              *     s->scsi_queued = 0;
 519              *     next_irq(s, NEXT_SCSI_I, level);
 520              * }
 521              */
 522         } else {
 523             /* int_mask |= 0x1000; */
 524         }
 525         if (value & 0x80) {
 526             /* int_mask |= 0x1000; */
 527             /* s->scsi_csr_1 |= 0x80; */
 528         }
 529         DPRINTF("SCSICSR Write: %x\n", value);
 530         /* s->scsi_csr_1 = value; */
 531         return;
 532     /* Hardware timer latch - not implemented yet */
 533     case 0x1a000:
 534     default:
 535         DPRINTF("BMAP Write B @ %x with %x\n", (unsigned int)addr, value);
 536     }
 537 }
 538
 539 static void scr_writew(NeXTPC *s, hwaddr addr, uint32_t value)
 540 {
 541     DPRINTF("BMAP Write W @ %x with %x\n", (unsigned int)addr, value);
 542 }
 543
 544 static void scr_writel(NeXTPC *s, hwaddr addr, uint32_t value)
 545 {
 546     DPRINTF("BMAP Write L @ %x with %x\n", (unsigned int)addr, value);
 547 }
 548
 549 static uint64_t scr_readfn(void *opaque, hwaddr addr, unsigned size)
 550 {
 551     NeXTPC *s = NEXT_PC(opaque);
 552
 553     switch (size) {
 554     case 1:
 555         return scr_readb(s, addr);
 556     case 2:
 557         return scr_readw(s, addr);
 558     case 4:
 559         return scr_readl(s, addr);
 560     default:
 561         g_assert_not_reached();
 562     }
 563 }
 564
 565 static void scr_writefn(void *opaque, hwaddr addr, uint64_t value,
 566                         unsigned size)
 567 {
 568     NeXTPC *s = NEXT_PC(opaque);
 569
 570     switch (size) {
 571     case 1:
 572         scr_writeb(s, addr, value);
 573         break;
 574     case 2:
 575         scr_writew(s, addr, value);
 576         break;
 577     case 4:
 578         scr_writel(s, addr, value);
 579         break;
 580     default:
 581         g_assert_not_reached();
 582     }
 583 }
 584
 585 static const MemoryRegionOps scr_ops = {
 586     .read = scr_readfn,
 587     .write = scr_writefn,
 588     .valid.min_access_size = 1,
 589     .valid.max_access_size = 4,
 590     .endianness = DEVICE_NATIVE_ENDIAN,
 591 };
 592
 593 #define NEXTDMA_SCSI(x)      (0x10 + x)
 594 #define NEXTDMA_FD(x)        (0x10 + x)
 595 #define NEXTDMA_ENTX(x)      (0x110 + x)
 596 #define NEXTDMA_ENRX(x)      (0x150 + x)
 597 #define NEXTDMA_CSR          0x0
 598 #define NEXTDMA_NEXT         0x4000
 599 #define NEXTDMA_LIMIT        0x4004
 600 #define NEXTDMA_START        0x4008
 601 #define NEXTDMA_STOP         0x400c
 602 #define NEXTDMA_NEXT_INIT    0x4200
 603 #define NEXTDMA_SIZE         0x4204
 604
 605 static void dma_writel(void *opaque, hwaddr addr, uint64_t value,
 606                        unsigned int size)
 607 {
 608     NeXTState *next_state = NEXT_MACHINE(opaque);
 609
 610     switch (addr) {
 611     case NEXTDMA_ENRX(NEXTDMA_CSR):
 612         if (value & DMA_DEV2M) {
 613             next_state->dma[NEXTDMA_ENRX].csr |= DMA_DEV2M;
 614         }
 615
 616         if (value & DMA_SETENABLE) {
 617             /* DPRINTF("SCSI DMA ENABLE\n"); */
 618             next_state->dma[NEXTDMA_ENRX].csr |= DMA_ENABLE;
 619         }
 620         if (value & DMA_SETSUPDATE) {
 621             next_state->dma[NEXTDMA_ENRX].csr |= DMA_SUPDATE;
 622         }
 623         if (value & DMA_CLRCOMPLETE) {
 624             next_state->dma[NEXTDMA_ENRX].csr &= ~DMA_COMPLETE;
 625         }
 626
 627         if (value & DMA_RESET) {
 628             next_state->dma[NEXTDMA_ENRX].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
 629                                                   DMA_ENABLE | DMA_DEV2M);
 630         }
 631         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
 632         break;
 633     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
 634         next_state->dma[NEXTDMA_ENRX].next_initbuf = value;
 635         break;
 636     case NEXTDMA_ENRX(NEXTDMA_NEXT):
 637         next_state->dma[NEXTDMA_ENRX].next = value;
 638         break;
 639     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
 640         next_state->dma[NEXTDMA_ENRX].limit = value;
 641         break;
 642     case NEXTDMA_SCSI(NEXTDMA_CSR):
 643         if (value & DMA_DEV2M) {
 644             next_state->dma[NEXTDMA_SCSI].csr |= DMA_DEV2M;
 645         }
 646         if (value & DMA_SETENABLE) {
 647             /* DPRINTF("SCSI DMA ENABLE\n"); */
 648             next_state->dma[NEXTDMA_SCSI].csr |= DMA_ENABLE;
 649         }
 650         if (value & DMA_SETSUPDATE) {
 651             next_state->dma[NEXTDMA_SCSI].csr |= DMA_SUPDATE;
 652         }
 653         if (value & DMA_CLRCOMPLETE) {
 654             next_state->dma[NEXTDMA_SCSI].csr &= ~DMA_COMPLETE;
 655         }
 656
 657         if (value & DMA_RESET) {
 658             next_state->dma[NEXTDMA_SCSI].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
 659                                                   DMA_ENABLE | DMA_DEV2M);
 660             /* DPRINTF("SCSI DMA RESET\n"); */
 661         }
 662         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
 663         break;
 664
 665     case NEXTDMA_SCSI(NEXTDMA_NEXT):
 666         next_state->dma[NEXTDMA_SCSI].next = value;
 667         break;
 668
 669     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
 670         next_state->dma[NEXTDMA_SCSI].limit = value;
 671         break;
 672
 673     case NEXTDMA_SCSI(NEXTDMA_START):
 674         next_state->dma[NEXTDMA_SCSI].start = value;
 675         break;
 676
 677     case NEXTDMA_SCSI(NEXTDMA_STOP):
 678         next_state->dma[NEXTDMA_SCSI].stop = value;
 679         break;
 680
 681     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
 682         next_state->dma[NEXTDMA_SCSI].next_initbuf = value;
 683         break;
 684
 685     default:
 686         DPRINTF("DMA write @ %x w/ %x\n", (unsigned)addr, (unsigned)value);
 687     }
 688 }
 689
 690 static uint64_t dma_readl(void *opaque, hwaddr addr, unsigned int size)
 691 {
 692     NeXTState *next_state = NEXT_MACHINE(opaque);
 693
 694     switch (addr) {
 695     case NEXTDMA_SCSI(NEXTDMA_CSR):
 696         DPRINTF("SCSI DMA CSR READ\n");
 697         return next_state->dma[NEXTDMA_SCSI].csr;
 698     case NEXTDMA_ENRX(NEXTDMA_CSR):
 699         return next_state->dma[NEXTDMA_ENRX].csr;
 700     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
 701         return next_state->dma[NEXTDMA_ENRX].next_initbuf;
 702     case NEXTDMA_ENRX(NEXTDMA_NEXT):
 703         return next_state->dma[NEXTDMA_ENRX].next;
 704     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
 705         return next_state->dma[NEXTDMA_ENRX].limit;
 706
 707     case NEXTDMA_SCSI(NEXTDMA_NEXT):
 708         return next_state->dma[NEXTDMA_SCSI].next;
 709     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
 710         return next_state->dma[NEXTDMA_SCSI].next_initbuf;
 711     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
 712         return next_state->dma[NEXTDMA_SCSI].limit;
 713     case NEXTDMA_SCSI(NEXTDMA_START):
 714         return next_state->dma[NEXTDMA_SCSI].start;
 715     case NEXTDMA_SCSI(NEXTDMA_STOP):
 716         return next_state->dma[NEXTDMA_SCSI].stop;
 717
 718     default:
 719         DPRINTF("DMA read @ %x\n", (unsigned int)addr);
 720         return 0;
 721     }
 722
 723     /*
 724      * once the csr's are done, subtract 0x3FEC from the addr, and that will
 725      * normalize the upper registers
 726      */
 727 }
 728
 729 static const MemoryRegionOps dma_ops = {
 730     .read = dma_readl,
 731     .write = dma_writel,
 732     .impl.min_access_size = 4,
 733     .valid.min_access_size = 4,
 734     .valid.max_access_size = 4,
 735     .endianness = DEVICE_NATIVE_ENDIAN,
 736 };
 737
 738 static void next_irq(void *opaque, int number, int level)
 739 {
 740     NeXTPC *s = NEXT_PC(opaque);
 741     M68kCPU *cpu = s->cpu;
 742     int shift = 0;
 743
 744     /* first switch sets interupt status */
 745     /* DPRINTF("IRQ %i\n",number); */
 746     switch (number) {
 747     /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
 748     case NEXT_FD_I:
 749         shift = 7;
 750         break;
 751     case NEXT_KBD_I:
 752         shift = 3;
 753         break;
 754     case NEXT_PWR_I:
 755         shift = 2;
 756         break;
 757     case NEXT_ENRX_I:
 758         shift = 9;
 759         break;
 760     case NEXT_ENTX_I:
 761         shift = 10;
 762         break;
 763     case NEXT_SCSI_I:
 764         shift = 12;
 765         break;
 766     case NEXT_CLK_I:
 767         shift = 5;
 768         break;
 769
 770     /* level 5 - scc (serial) */
 771     case NEXT_SCC_I:
 772         shift = 17;
 773         break;
 774
 775     /* level 6 - audio etherrx/tx dma */
 776     case NEXT_ENTX_DMA_I:
 777         shift = 28;
 778         break;
 779     case NEXT_ENRX_DMA_I:
 780         shift = 27;
 781         break;
 782     case NEXT_SCSI_DMA_I:
 783         shift = 26;
 784         break;
 785     case NEXT_SND_I:
 786         shift = 23;
 787         break;
 788     case NEXT_SCC_DMA_I:
 789         shift = 21;
 790         break;
 791
 792     }
 793     /*
 794      * this HAS to be wrong, the interrupt handlers in mach and together
 795      * int_status and int_mask and return if there is a hit
 796      */
 797     if (s->int_mask & (1 << shift)) {
 798         DPRINTF("%x interrupt masked @ %x\n", 1 << shift, cpu->env.pc);
 799         /* return; */
 800     }
 801
 802     /* second switch triggers the correct interrupt */
 803     if (level) {
 804         s->int_status |= 1 << shift;
 805
 806         switch (number) {
 807         /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
 808         case NEXT_FD_I:
 809         case NEXT_KBD_I:
 810         case NEXT_PWR_I:
 811         case NEXT_ENRX_I:
 812         case NEXT_ENTX_I:
 813         case NEXT_SCSI_I:
 814         case NEXT_CLK_I:
 815             m68k_set_irq_level(cpu, 3, 27);
 816             break;
 817
 818         /* level 5 - scc (serial) */
 819         case NEXT_SCC_I:
 820             m68k_set_irq_level(cpu, 5, 29);
 821             break;
 822
 823         /* level 6 - audio etherrx/tx dma */
 824         case NEXT_ENTX_DMA_I:
 825         case NEXT_ENRX_DMA_I:
 826         case NEXT_SCSI_DMA_I:
 827         case NEXT_SND_I:
 828         case NEXT_SCC_DMA_I:
 829             m68k_set_irq_level(cpu, 6, 30);
 830             break;
 831         }
 832     } else {
 833         s->int_status &= ~(1 << shift);
 834         cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
 835     }
 836 }
 837
 838 static void next_escc_init(DeviceState *pcdev)
 839 {
 840     DeviceState *dev;
 841     SysBusDevice *s;
 842
 843     dev = qdev_new(TYPE_ESCC);
 844     qdev_prop_set_uint32(dev, "disabled", 0);
 845     qdev_prop_set_uint32(dev, "frequency", 9600 * 384);
 846     qdev_prop_set_uint32(dev, "it_shift", 0);
 847     qdev_prop_set_bit(dev, "bit_swap", true);
 848     qdev_prop_set_chr(dev, "chrB", serial_hd(1));
 849     qdev_prop_set_chr(dev, "chrA", serial_hd(0));
 850     qdev_prop_set_uint32(dev, "chnBtype", escc_serial);
 851     qdev_prop_set_uint32(dev, "chnAtype", escc_serial);
 852
 853     s = SYS_BUS_DEVICE(dev);
 854     sysbus_realize_and_unref(s, &error_fatal);
 855     sysbus_connect_irq(s, 0, qdev_get_gpio_in(pcdev, NEXT_SCC_I));
 856     sysbus_connect_irq(s, 1, qdev_get_gpio_in(pcdev, NEXT_SCC_DMA_I));
 857     sysbus_mmio_map(s, 0, 0x2118000);
 858 }
 859
 860 static void next_pc_reset(DeviceState *dev)
 861 {
 862     NeXTPC *s = NEXT_PC(dev);
 863
 864     /* Set internal registers to initial values */
 865     /*     0x0000XX00 << vital bits */
 866     s->scr1 = 0x00011102;
 867     s->scr2 = 0x00ff0c80;
 868 }
 869
 870 static void next_pc_realize(DeviceState *dev, Error **errp)
 871 {
 872     NeXTPC *s = NEXT_PC(dev);
 873     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 874
 875     qdev_init_gpio_in(dev, next_irq, NEXT_NUM_IRQS);
 876
 877     memory_region_init_io(&s->mmiomem, OBJECT(s), &mmio_ops, s,
 878                           "next.mmio", 0xD0000);
 879     memory_region_init_io(&s->scrmem, OBJECT(s), &scr_ops, s,
 880                           "next.scr", 0x20000);
 881     sysbus_init_mmio(sbd, &s->mmiomem);
 882     sysbus_init_mmio(sbd, &s->scrmem);
 883 }
 884
 885 /*
 886  * If the m68k CPU implemented its inbound irq lines as GPIO lines
 887  * rather than via the m68k_set_irq_level() function we would not need
 888  * this cpu link property and could instead provide outbound IRQ lines
 889  * that the board could wire up to the CPU.
 890  */
 891 static Property next_pc_properties[] = {
 892     DEFINE_PROP_LINK("cpu", NeXTPC, cpu, TYPE_M68K_CPU, M68kCPU *),
 893     DEFINE_PROP_END_OF_LIST(),
 894 };
 895
 896 static void next_pc_class_init(ObjectClass *klass, void *data)
 897 {
 898     DeviceClass *dc = DEVICE_CLASS(klass);
 899
 900     dc->desc = "NeXT Peripheral Controller";
 901     dc->realize = next_pc_realize;
 902     dc->reset = next_pc_reset;
 903     device_class_set_props(dc, next_pc_properties);
 904     /* We will add the VMState in a later commit */
 905 }
 906
 907 static const TypeInfo next_pc_info = {
 908     .name = TYPE_NEXT_PC,
 909     .parent = TYPE_SYS_BUS_DEVICE,
 910     .instance_size = sizeof(NeXTPC),
 911     .class_init = next_pc_class_init,
 912 };
 913
 914 static void next_cube_init(MachineState *machine)
 915 {
 916     M68kCPU *cpu;
 917     CPUM68KState *env;
 918     MemoryRegion *rom = g_new(MemoryRegion, 1);
 919     MemoryRegion *dmamem = g_new(MemoryRegion, 1);
 920     MemoryRegion *bmapm1 = g_new(MemoryRegion, 1);
 921     MemoryRegion *bmapm2 = g_new(MemoryRegion, 1);
 922     MemoryRegion *sysmem = get_system_memory();
 923     const char *bios_name = machine->firmware ?: ROM_FILE;
 924     NeXTState *ns = NEXT_MACHINE(machine);
 925     DeviceState *dev;
 926     DeviceState *pcdev;
 927
 928     /* Initialize the cpu core */
 929     cpu = M68K_CPU(cpu_create(machine->cpu_type));
 930     if (!cpu) {
 931         error_report("Unable to find m68k CPU definition");
 932         exit(1);
 933     }
 934     env = &cpu->env;
 935
 936     /* Initialize CPU registers.  */
 937     env->vbr = 0;
 938     env->sr  = 0x2700;
 939
 940     /* Peripheral Controller */
 941     pcdev = qdev_new(TYPE_NEXT_PC);
 942     object_property_set_link(OBJECT(pcdev), "cpu", OBJECT(cpu), &error_abort);
 943     sysbus_realize_and_unref(SYS_BUS_DEVICE(pcdev), &error_fatal);
 944     /* Temporary while we refactor this code */
 945     NEXT_PC(pcdev)->ns = ns;
 946
 947     ns->rtc.status = 0x90;
 948
 949     /* Load RTC RAM - TODO: provide possibility to load contents from file */
 950     memcpy(ns->rtc.ram, rtc_ram2, 32);
 951
 952     /* 64MB RAM starting at 0x04000000  */
 953     memory_region_add_subregion(sysmem, 0x04000000, machine->ram);
 954
 955     /* Framebuffer */
 956     dev = qdev_new(TYPE_NEXTFB);
 957     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 958     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x0B000000);
 959
 960     /* MMIO */
 961     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 0, 0x02000000);
 962
 963     /* BMAP IO - acts as a catch-all for now */
 964     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 1, 0x02100000);
 965
 966     /* BMAP memory */
 967     memory_region_init_ram_shared_nomigrate(bmapm1, NULL, "next.bmapmem", 64,
 968                                             true, &error_fatal);
 969     memory_region_add_subregion(sysmem, 0x020c0000, bmapm1);
 970     /* The Rev_2.5_v66.bin firmware accesses it at 0x820c0020, too */
 971     memory_region_init_alias(bmapm2, NULL, "next.bmapmem2", bmapm1, 0x0, 64);
 972     memory_region_add_subregion(sysmem, 0x820c0000, bmapm2);
 973
 974     /* KBD */
 975     dev = qdev_new(TYPE_NEXTKBD);
 976     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 977     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x0200e000);
 978
 979     /* Load ROM here */
 980     /* still not sure if the rom should also be mapped at 0x0*/
 981     memory_region_init_rom(rom, NULL, "next.rom", 0x20000, &error_fatal);
 982     memory_region_add_subregion(sysmem, 0x01000000, rom);
 983     if (load_image_targphys(bios_name, 0x01000000, 0x20000) < 8) {
 984         if (!qtest_enabled()) {
 985             error_report("Failed to load firmware '%s'.", bios_name);
 986         }
 987     } else {
 988         uint8_t *ptr;
 989         /* Initial PC is always at offset 4 in firmware binaries */
 990         ptr = rom_ptr(0x01000004, 4);
 991         g_assert(ptr != NULL);
 992         env->pc = ldl_p(ptr);
 993         if (env->pc >= 0x01020000) {
 994             error_report("'%s' does not seem to be a valid firmware image.",
 995                          bios_name);
 996             exit(1);
 997         }
 998     }
 999
1000     /* Serial */
1001     next_escc_init(pcdev);
1002
1003     /* TODO: */
1004     /* Network */
1005     /* SCSI */
1006
1007     /* DMA */
1008     memory_region_init_io(dmamem, NULL, &dma_ops, machine, "next.dma", 0x5000);
1009     memory_region_add_subregion(sysmem, 0x02000000, dmamem);
1010 }
1011
1012 static void next_machine_class_init(ObjectClass *oc, void *data)
1013 {
1014     MachineClass *mc = MACHINE_CLASS(oc);
1015
1016     mc->desc = "NeXT Cube";
1017     mc->init = next_cube_init;
1018     mc->default_ram_size = RAM_SIZE;
1019     mc->default_ram_id = "next.ram";
1020     mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68040");
1021 }
1022
1023 static const TypeInfo next_typeinfo = {
1024     .name = TYPE_NEXT_MACHINE,
1025     .parent = TYPE_MACHINE,
1026     .class_init = next_machine_class_init,
1027     .instance_size = sizeof(NeXTState),
1028 };
1029
1030 static void next_register_type(void)
1031 {
1032     type_register_static(&next_typeinfo);
1033     type_register_static(&next_pc_info);
1034 }
1035
1036 type_init(next_register_type)