hw/m68k/next-cube.c

   1 /*
   2  * NeXT Cube System Driver
   3  *
   4  * Copyright (c) 2011 Bryce Lanham
   5  *
   6  * This code is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published
   8  * by the Free Software Foundation; either version 2 of the License,
   9  * or (at your option) any later version.
  10  */
  11
  12 #include "qemu/osdep.h"
  13 #include "exec/hwaddr.h"
  14 #include "sysemu/sysemu.h"
  15 #include "sysemu/qtest.h"
  16 #include "hw/irq.h"
  17 #include "hw/m68k/next-cube.h"
  18 #include "hw/boards.h"
  19 #include "hw/loader.h"
  20 #include "hw/scsi/esp.h"
  21 #include "hw/sysbus.h"
  22 #include "qom/object.h"
  23 #include "hw/char/escc.h" /* ZILOG 8530 Serial Emulation */
  24 #include "hw/block/fdc.h"
  25 #include "hw/qdev-properties.h"
  26 #include "qapi/error.h"
  27 #include "qemu/error-report.h"
  28 #include "ui/console.h"
  29 #include "target/m68k/cpu.h"
  30 #include "migration/vmstate.h"
  31
  32 /* #define DEBUG_NEXT */
  33 #ifdef DEBUG_NEXT
  34 #define DPRINTF(fmt, ...) \
  35     do { printf("NeXT: " fmt , ## __VA_ARGS__); } while (0)
  36 #else
  37 #define DPRINTF(fmt, ...) do { } while (0)
  38 #endif
  39
  40 #define TYPE_NEXT_MACHINE MACHINE_TYPE_NAME("next-cube")
  41 OBJECT_DECLARE_SIMPLE_TYPE(NeXTState, NEXT_MACHINE)
  42
  43 #define ENTRY       0x0100001e
  44 #define RAM_SIZE    0x4000000
  45 #define ROM_FILE    "Rev_2.5_v66.bin"
  46
  47 typedef struct next_dma {
  48     uint32_t csr;
  49
  50     uint32_t saved_next;
  51     uint32_t saved_limit;
  52     uint32_t saved_start;
  53     uint32_t saved_stop;
  54
  55     uint32_t next;
  56     uint32_t limit;
  57     uint32_t start;
  58     uint32_t stop;
  59
  60     uint32_t next_initbuf;
  61     uint32_t size;
  62 } next_dma;
  63
  64 typedef struct NextRtc {
  65     uint8_t ram[32];
  66     uint8_t command;
  67     uint8_t value;
  68     uint8_t status;
  69     uint8_t control;
  70     uint8_t retval;
  71 } NextRtc;
  72
  73 struct NeXTState {
  74     MachineState parent;
  75
  76     next_dma dma[10];
  77 };
  78
  79 #define TYPE_NEXT_PC "next-pc"
  80 OBJECT_DECLARE_SIMPLE_TYPE(NeXTPC, NEXT_PC)
  81
  82 /* NeXT Peripheral Controller */
  83 struct NeXTPC {
  84     SysBusDevice parent_obj;
  85
  86     M68kCPU *cpu;
  87
  88     MemoryRegion mmiomem;
  89     MemoryRegion scrmem;
  90
  91     uint32_t scr1;
  92     uint32_t scr2;
  93     uint32_t int_mask;
  94     uint32_t int_status;
  95     uint8_t scsi_csr_1;
  96     uint8_t scsi_csr_2;
  97
  98     qemu_irq scsi_reset;
  99     qemu_irq scsi_dma;
 100
 101     NextRtc rtc;
 102 };
 103
 104 /* Thanks to NeXT forums for this */
 105 /*
 106 static const uint8_t rtc_ram3[32] = {
 107     0x94, 0x0f, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
 108     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x7B, 0x00,
 109     0x00, 0x00, 0x65, 0x6e, 0x00, 0x00, 0x00, 0x00,
 110     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x13
 111 };
 112 */
 113 static const uint8_t rtc_ram2[32] = {
 114     0x94, 0x0f, 0x40, 0x03, 0x00, 0x00, 0x00, 0x00,
 115     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x4b, 0x00,
 116     0x41, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
 117     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x7e,
 118 };
 119
 120 #define SCR2_RTCLK 0x2
 121 #define SCR2_RTDATA 0x4
 122 #define SCR2_TOBCD(x) (((x / 10) << 4) + (x % 10))
 123
 124 static void nextscr2_write(NeXTPC *s, uint32_t val, int size)
 125 {
 126     static int led;
 127     static int phase;
 128     static uint8_t old_scr2;
 129     uint8_t scr2_2;
 130     NextRtc *rtc = &s->rtc;
 131
 132     if (size == 4) {
 133         scr2_2 = (val >> 8) & 0xFF;
 134     } else {
 135         scr2_2 = val & 0xFF;
 136     }
 137
 138     if (val & 0x1) {
 139         DPRINTF("fault!\n");
 140         led++;
 141         if (led == 10) {
 142             DPRINTF("LED flashing, possible fault!\n");
 143             led = 0;
 144         }
 145     }
 146
 147     if (scr2_2 & 0x1) {
 148         /* DPRINTF("RTC %x phase %i\n", scr2_2, phase); */
 149         if (phase == -1) {
 150             phase = 0;
 151         }
 152         /* If we are in going down clock... do something */
 153         if (((old_scr2 & SCR2_RTCLK) != (scr2_2 & SCR2_RTCLK)) &&
 154                 ((scr2_2 & SCR2_RTCLK) == 0)) {
 155             if (phase < 8) {
 156                 rtc->command = (rtc->command << 1) |
 157                                ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 158             }
 159             if (phase >= 8 && phase < 16) {
 160                 rtc->value = (rtc->value << 1) |
 161                              ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 162
 163                 /* if we read RAM register, output RT_DATA bit */
 164                 if (rtc->command <= 0x1F) {
 165                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 166                     if (rtc->ram[rtc->command] & (0x80 >> (phase - 8))) {
 167                         scr2_2 |= SCR2_RTDATA;
 168                     }
 169
 170                     rtc->retval = (rtc->retval << 1) |
 171                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 172                 }
 173                 /* read the status 0x30 */
 174                 if (rtc->command == 0x30) {
 175                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 176                     /* for now status = 0x98 (new rtc + FTU) */
 177                     if (rtc->status & (0x80 >> (phase - 8))) {
 178                         scr2_2 |= SCR2_RTDATA;
 179                     }
 180
 181                     rtc->retval = (rtc->retval << 1) |
 182                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 183                 }
 184                 /* read the status 0x31 */
 185                 if (rtc->command == 0x31) {
 186                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 187                     if (rtc->control & (0x80 >> (phase - 8))) {
 188                         scr2_2 |= SCR2_RTDATA;
 189                     }
 190                     rtc->retval = (rtc->retval << 1) |
 191                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 192                 }
 193
 194                 if ((rtc->command >= 0x20) && (rtc->command <= 0x2F)) {
 195                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
 196                     /* for now 0x00 */
 197                     time_t time_h = time(NULL);
 198                     struct tm *info = localtime(&time_h);
 199                     int ret = 0;
 200
 201                     switch (rtc->command) {
 202                     case 0x20:
 203                         ret = SCR2_TOBCD(info->tm_sec);
 204                         break;
 205                     case 0x21:
 206                         ret = SCR2_TOBCD(info->tm_min);
 207                         break;
 208                     case 0x22:
 209                         ret = SCR2_TOBCD(info->tm_hour);
 210                         break;
 211                     case 0x24:
 212                         ret = SCR2_TOBCD(info->tm_mday);
 213                         break;
 214                     case 0x25:
 215                         ret = SCR2_TOBCD((info->tm_mon + 1));
 216                         break;
 217                     case 0x26:
 218                         ret = SCR2_TOBCD((info->tm_year - 100));
 219                         break;
 220
 221                     }
 222
 223                     if (ret & (0x80 >> (phase - 8))) {
 224                         scr2_2 |= SCR2_RTDATA;
 225                     }
 226                     rtc->retval = (rtc->retval << 1) |
 227                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
 228                 }
 229
 230             }
 231
 232             phase++;
 233             if (phase == 16) {
 234                 if (rtc->command >= 0x80 && rtc->command <= 0x9F) {
 235                     rtc->ram[rtc->command - 0x80] = rtc->value;
 236                 }
 237                 /* write to x30 register */
 238                 if (rtc->command == 0xB1) {
 239                     /* clear FTU */
 240                     if (rtc->value & 0x04) {
 241                         rtc->status = rtc->status & (~0x18);
 242                         s->int_status = s->int_status & (~0x04);
 243                     }
 244                 }
 245             }
 246         }
 247     } else {
 248         /* else end or abort */
 249         phase = -1;
 250         rtc->command = 0;
 251         rtc->value = 0;
 252     }
 253     s->scr2 = val & 0xFFFF00FF;
 254     s->scr2 |= scr2_2 << 8;
 255     old_scr2 = scr2_2;
 256 }
 257
 258 static uint64_t next_mmio_read(void *opaque, hwaddr addr, unsigned size)
 259 {
 260     NeXTPC *s = NEXT_PC(opaque);
 261     uint64_t val;
 262
 263     switch (addr) {
 264     case 0x7000:
 265         /* DPRINTF("Read INT status: %x\n", s->int_status); */
 266         val = s->int_status;
 267         break;
 268
 269     case 0x7800:
 270         DPRINTF("MMIO Read INT mask: %x\n", s->int_mask);
 271         val = s->int_mask;
 272         break;
 273
 274     case 0xc000 ... 0xc003:
 275         val = extract32(s->scr1, (4 - (addr - 0xc000) - size) << 3,
 276                         size << 3);
 277         break;
 278
 279     case 0xd000 ... 0xd003:
 280         val = extract32(s->scr2, (4 - (addr - 0xd000) - size) << 3,
 281                         size << 3);
 282         break;
 283
 284     case 0x14020:
 285         val = 0x7f;
 286         break;
 287
 288     default:
 289         val = 0;
 290         DPRINTF("MMIO Read @ 0x%"HWADDR_PRIx" size %d\n", addr, size);
 291         break;
 292     }
 293
 294     return val;
 295 }
 296
 297 static void next_mmio_write(void *opaque, hwaddr addr, uint64_t val,
 298                             unsigned size)
 299 {
 300     NeXTPC *s = NEXT_PC(opaque);
 301
 302     switch (addr) {
 303     case 0x7000:
 304         DPRINTF("INT Status old: %x new: %x\n", s->int_status,
 305                 (unsigned int)val);
 306         s->int_status = val;
 307         break;
 308
 309     case 0x7800:
 310         DPRINTF("INT Mask old: %x new: %x\n", s->int_mask, (unsigned int)val);
 311         s->int_mask  = val;
 312         break;
 313
 314     case 0xc000 ... 0xc003:
 315         DPRINTF("SCR1 Write: %x\n", (unsigned int)val);
 316         s->scr1 = deposit32(s->scr1, (4 - (addr - 0xc000) - size) << 3,
 317                             size << 3, val);
 318         break;
 319
 320     case 0xd000 ... 0xd003:
 321         nextscr2_write(s, val, size);
 322         break;
 323
 324     default:
 325         DPRINTF("MMIO Write @ 0x%"HWADDR_PRIx " with 0x%x size %u\n", addr,
 326                 (unsigned int)val, size);
 327     }
 328 }
 329
 330 static const MemoryRegionOps next_mmio_ops = {
 331     .read = next_mmio_read,
 332     .write = next_mmio_write,
 333     .valid.min_access_size = 1,
 334     .valid.max_access_size = 4,
 335     .endianness = DEVICE_BIG_ENDIAN,
 336 };
 337
 338 #define SCSICSR_ENABLE  0x01
 339 #define SCSICSR_RESET   0x02  /* reset scsi dma */
 340 #define SCSICSR_FIFOFL  0x04
 341 #define SCSICSR_DMADIR  0x08  /* if set, scsi to mem */
 342 #define SCSICSR_CPUDMA  0x10  /* if set, dma enabled */
 343 #define SCSICSR_INTMASK 0x20  /* if set, interrupt enabled */
 344
 345 static uint64_t next_scr_readfn(void *opaque, hwaddr addr, unsigned size)
 346 {
 347     NeXTPC *s = NEXT_PC(opaque);
 348     uint64_t val;
 349
 350     switch (addr) {
 351     case 0x14108:
 352         DPRINTF("FD read @ %x\n", (unsigned int)addr);
 353         val = 0x40 | 0x04 | 0x2 | 0x1;
 354         break;
 355
 356     case 0x14020:
 357         DPRINTF("SCSI 4020  STATUS READ %X\n", s->scsi_csr_1);
 358         val = s->scsi_csr_1;
 359         break;
 360
 361     case 0x14021:
 362         DPRINTF("SCSI 4021 STATUS READ %X\n", s->scsi_csr_2);
 363         val = 0x40;
 364         break;
 365
 366     /*
 367      * These 4 registers are the hardware timer, not sure which register
 368      * is the latch instead of data, but no problems so far.
 369      *
 370      * Hack: We need to have the LSB change consistently to make it work
 371      */
 372     case 0x1a000 ... 0x1a003:
 373         val = extract32(clock(), (4 - (addr - 0x1a000) - size) << 3,
 374                         size << 3);
 375         break;
 376
 377     /* For now return dummy byte to allow the Ethernet test to timeout */
 378     case 0x6000:
 379         val = 0xff;
 380         break;
 381
 382     default:
 383         DPRINTF("BMAP Read @ 0x%x size %u\n", (unsigned int)addr, size);
 384         val = 0;
 385         break;
 386     }
 387
 388     return val;
 389 }
 390
 391 static void next_scr_writefn(void *opaque, hwaddr addr, uint64_t val,
 392                              unsigned size)
 393 {
 394     NeXTPC *s = NEXT_PC(opaque);
 395
 396     switch (addr) {
 397     case 0x14108:
 398         DPRINTF("FDCSR Write: %x\n", value);
 399         if (val == 0x0) {
 400             /* qemu_irq_raise(s->fd_irq[0]); */
 401         }
 402         break;
 403
 404     case 0x14020: /* SCSI Control Register */
 405         if (val & SCSICSR_FIFOFL) {
 406             DPRINTF("SCSICSR FIFO Flush\n");
 407             /* will have to add another irq to the esp if this is needed */
 408             /* esp_puflush_fifo(esp_g); */
 409         }
 410
 411         if (val & SCSICSR_ENABLE) {
 412             DPRINTF("SCSICSR Enable\n");
 413             /*
 414              * qemu_irq_raise(s->scsi_dma);
 415              * s->scsi_csr_1 = 0xc0;
 416              * s->scsi_csr_1 |= 0x1;
 417              * qemu_irq_pulse(s->scsi_dma);
 418              */
 419         }
 420         /*
 421          * else
 422          *     s->scsi_csr_1 &= ~SCSICSR_ENABLE;
 423          */
 424
 425         if (val & SCSICSR_RESET) {
 426             DPRINTF("SCSICSR Reset\n");
 427             /* I think this should set DMADIR. CPUDMA and INTMASK to 0 */
 428             qemu_irq_raise(s->scsi_reset);
 429             s->scsi_csr_1 &= ~(SCSICSR_INTMASK | 0x80 | 0x1);
 430             qemu_irq_lower(s->scsi_reset);
 431         }
 432         if (val & SCSICSR_DMADIR) {
 433             DPRINTF("SCSICSR DMAdir\n");
 434         }
 435         if (val & SCSICSR_CPUDMA) {
 436             DPRINTF("SCSICSR CPUDMA\n");
 437             /* qemu_irq_raise(s->scsi_dma); */
 438             s->int_status |= 0x4000000;
 439         } else {
 440             /* fprintf(stderr,"SCSICSR CPUDMA disabled\n"); */
 441             s->int_status &= ~(0x4000000);
 442             /* qemu_irq_lower(s->scsi_dma); */
 443         }
 444         if (val & SCSICSR_INTMASK) {
 445             DPRINTF("SCSICSR INTMASK\n");
 446             /*
 447              * int_mask &= ~0x1000;
 448              * s->scsi_csr_1 |= val;
 449              * s->scsi_csr_1 &= ~SCSICSR_INTMASK;
 450              * if (s->scsi_queued) {
 451              *     s->scsi_queued = 0;
 452              *     next_irq(s, NEXT_SCSI_I, level);
 453              * }
 454              */
 455         } else {
 456             /* int_mask |= 0x1000; */
 457         }
 458         if (val & 0x80) {
 459             /* int_mask |= 0x1000; */
 460             /* s->scsi_csr_1 |= 0x80; */
 461         }
 462         DPRINTF("SCSICSR Write: %x\n", val);
 463         /* s->scsi_csr_1 = val; */
 464         break;
 465
 466     /* Hardware timer latch - not implemented yet */
 467     case 0x1a000:
 468     default:
 469         DPRINTF("BMAP Write @ 0x%x with 0x%x size %u\n", (unsigned int)addr,
 470                 val, size);
 471     }
 472 }
 473
 474 static const MemoryRegionOps next_scr_ops = {
 475     .read = next_scr_readfn,
 476     .write = next_scr_writefn,
 477     .valid.min_access_size = 1,
 478     .valid.max_access_size = 4,
 479     .endianness = DEVICE_BIG_ENDIAN,
 480 };
 481
 482 #define NEXTDMA_SCSI(x)      (0x10 + x)
 483 #define NEXTDMA_FD(x)        (0x10 + x)
 484 #define NEXTDMA_ENTX(x)      (0x110 + x)
 485 #define NEXTDMA_ENRX(x)      (0x150 + x)
 486 #define NEXTDMA_CSR          0x0
 487 #define NEXTDMA_NEXT         0x4000
 488 #define NEXTDMA_LIMIT        0x4004
 489 #define NEXTDMA_START        0x4008
 490 #define NEXTDMA_STOP         0x400c
 491 #define NEXTDMA_NEXT_INIT    0x4200
 492 #define NEXTDMA_SIZE         0x4204
 493
 494 static void dma_writel(void *opaque, hwaddr addr, uint64_t value,
 495                        unsigned int size)
 496 {
 497     NeXTState *next_state = NEXT_MACHINE(opaque);
 498
 499     switch (addr) {
 500     case NEXTDMA_ENRX(NEXTDMA_CSR):
 501         if (value & DMA_DEV2M) {
 502             next_state->dma[NEXTDMA_ENRX].csr |= DMA_DEV2M;
 503         }
 504
 505         if (value & DMA_SETENABLE) {
 506             /* DPRINTF("SCSI DMA ENABLE\n"); */
 507             next_state->dma[NEXTDMA_ENRX].csr |= DMA_ENABLE;
 508         }
 509         if (value & DMA_SETSUPDATE) {
 510             next_state->dma[NEXTDMA_ENRX].csr |= DMA_SUPDATE;
 511         }
 512         if (value & DMA_CLRCOMPLETE) {
 513             next_state->dma[NEXTDMA_ENRX].csr &= ~DMA_COMPLETE;
 514         }
 515
 516         if (value & DMA_RESET) {
 517             next_state->dma[NEXTDMA_ENRX].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
 518                                                   DMA_ENABLE | DMA_DEV2M);
 519         }
 520         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
 521         break;
 522     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
 523         next_state->dma[NEXTDMA_ENRX].next_initbuf = value;
 524         break;
 525     case NEXTDMA_ENRX(NEXTDMA_NEXT):
 526         next_state->dma[NEXTDMA_ENRX].next = value;
 527         break;
 528     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
 529         next_state->dma[NEXTDMA_ENRX].limit = value;
 530         break;
 531     case NEXTDMA_SCSI(NEXTDMA_CSR):
 532         if (value & DMA_DEV2M) {
 533             next_state->dma[NEXTDMA_SCSI].csr |= DMA_DEV2M;
 534         }
 535         if (value & DMA_SETENABLE) {
 536             /* DPRINTF("SCSI DMA ENABLE\n"); */
 537             next_state->dma[NEXTDMA_SCSI].csr |= DMA_ENABLE;
 538         }
 539         if (value & DMA_SETSUPDATE) {
 540             next_state->dma[NEXTDMA_SCSI].csr |= DMA_SUPDATE;
 541         }
 542         if (value & DMA_CLRCOMPLETE) {
 543             next_state->dma[NEXTDMA_SCSI].csr &= ~DMA_COMPLETE;
 544         }
 545
 546         if (value & DMA_RESET) {
 547             next_state->dma[NEXTDMA_SCSI].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
 548                                                   DMA_ENABLE | DMA_DEV2M);
 549             /* DPRINTF("SCSI DMA RESET\n"); */
 550         }
 551         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
 552         break;
 553
 554     case NEXTDMA_SCSI(NEXTDMA_NEXT):
 555         next_state->dma[NEXTDMA_SCSI].next = value;
 556         break;
 557
 558     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
 559         next_state->dma[NEXTDMA_SCSI].limit = value;
 560         break;
 561
 562     case NEXTDMA_SCSI(NEXTDMA_START):
 563         next_state->dma[NEXTDMA_SCSI].start = value;
 564         break;
 565
 566     case NEXTDMA_SCSI(NEXTDMA_STOP):
 567         next_state->dma[NEXTDMA_SCSI].stop = value;
 568         break;
 569
 570     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
 571         next_state->dma[NEXTDMA_SCSI].next_initbuf = value;
 572         break;
 573
 574     default:
 575         DPRINTF("DMA write @ %x w/ %x\n", (unsigned)addr, (unsigned)value);
 576     }
 577 }
 578
 579 static uint64_t dma_readl(void *opaque, hwaddr addr, unsigned int size)
 580 {
 581     NeXTState *next_state = NEXT_MACHINE(opaque);
 582
 583     switch (addr) {
 584     case NEXTDMA_SCSI(NEXTDMA_CSR):
 585         DPRINTF("SCSI DMA CSR READ\n");
 586         return next_state->dma[NEXTDMA_SCSI].csr;
 587     case NEXTDMA_ENRX(NEXTDMA_CSR):
 588         return next_state->dma[NEXTDMA_ENRX].csr;
 589     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
 590         return next_state->dma[NEXTDMA_ENRX].next_initbuf;
 591     case NEXTDMA_ENRX(NEXTDMA_NEXT):
 592         return next_state->dma[NEXTDMA_ENRX].next;
 593     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
 594         return next_state->dma[NEXTDMA_ENRX].limit;
 595
 596     case NEXTDMA_SCSI(NEXTDMA_NEXT):
 597         return next_state->dma[NEXTDMA_SCSI].next;
 598     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
 599         return next_state->dma[NEXTDMA_SCSI].next_initbuf;
 600     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
 601         return next_state->dma[NEXTDMA_SCSI].limit;
 602     case NEXTDMA_SCSI(NEXTDMA_START):
 603         return next_state->dma[NEXTDMA_SCSI].start;
 604     case NEXTDMA_SCSI(NEXTDMA_STOP):
 605         return next_state->dma[NEXTDMA_SCSI].stop;
 606
 607     default:
 608         DPRINTF("DMA read @ %x\n", (unsigned int)addr);
 609         return 0;
 610     }
 611
 612     /*
 613      * once the csr's are done, subtract 0x3FEC from the addr, and that will
 614      * normalize the upper registers
 615      */
 616 }
 617
 618 static const MemoryRegionOps dma_ops = {
 619     .read = dma_readl,
 620     .write = dma_writel,
 621     .impl.min_access_size = 4,
 622     .valid.min_access_size = 4,
 623     .valid.max_access_size = 4,
 624     .endianness = DEVICE_NATIVE_ENDIAN,
 625 };
 626
 627 static void next_irq(void *opaque, int number, int level)
 628 {
 629     NeXTPC *s = NEXT_PC(opaque);
 630     M68kCPU *cpu = s->cpu;
 631     int shift = 0;
 632
 633     /* first switch sets interrupt status */
 634     /* DPRINTF("IRQ %i\n",number); */
 635     switch (number) {
 636     /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
 637     case NEXT_FD_I:
 638         shift = 7;
 639         break;
 640     case NEXT_KBD_I:
 641         shift = 3;
 642         break;
 643     case NEXT_PWR_I:
 644         shift = 2;
 645         break;
 646     case NEXT_ENRX_I:
 647         shift = 9;
 648         break;
 649     case NEXT_ENTX_I:
 650         shift = 10;
 651         break;
 652     case NEXT_SCSI_I:
 653         shift = 12;
 654         break;
 655     case NEXT_CLK_I:
 656         shift = 5;
 657         break;
 658
 659     /* level 5 - scc (serial) */
 660     case NEXT_SCC_I:
 661         shift = 17;
 662         break;
 663
 664     /* level 6 - audio etherrx/tx dma */
 665     case NEXT_ENTX_DMA_I:
 666         shift = 28;
 667         break;
 668     case NEXT_ENRX_DMA_I:
 669         shift = 27;
 670         break;
 671     case NEXT_SCSI_DMA_I:
 672         shift = 26;
 673         break;
 674     case NEXT_SND_I:
 675         shift = 23;
 676         break;
 677     case NEXT_SCC_DMA_I:
 678         shift = 21;
 679         break;
 680
 681     }
 682     /*
 683      * this HAS to be wrong, the interrupt handlers in mach and together
 684      * int_status and int_mask and return if there is a hit
 685      */
 686     if (s->int_mask & (1 << shift)) {
 687         DPRINTF("%x interrupt masked @ %x\n", 1 << shift, cpu->env.pc);
 688         /* return; */
 689     }
 690
 691     /* second switch triggers the correct interrupt */
 692     if (level) {
 693         s->int_status |= 1 << shift;
 694
 695         switch (number) {
 696         /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
 697         case NEXT_FD_I:
 698         case NEXT_KBD_I:
 699         case NEXT_PWR_I:
 700         case NEXT_ENRX_I:
 701         case NEXT_ENTX_I:
 702         case NEXT_SCSI_I:
 703         case NEXT_CLK_I:
 704             m68k_set_irq_level(cpu, 3, 27);
 705             break;
 706
 707         /* level 5 - scc (serial) */
 708         case NEXT_SCC_I:
 709             m68k_set_irq_level(cpu, 5, 29);
 710             break;
 711
 712         /* level 6 - audio etherrx/tx dma */
 713         case NEXT_ENTX_DMA_I:
 714         case NEXT_ENRX_DMA_I:
 715         case NEXT_SCSI_DMA_I:
 716         case NEXT_SND_I:
 717         case NEXT_SCC_DMA_I:
 718             m68k_set_irq_level(cpu, 6, 30);
 719             break;
 720         }
 721     } else {
 722         s->int_status &= ~(1 << shift);
 723         cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
 724     }
 725 }
 726
 727 static void nextdma_write(void *opaque, uint8_t *buf, int size, int type)
 728 {
 729     uint32_t base_addr;
 730     int irq = 0;
 731     uint8_t align = 16;
 732     NeXTState *next_state = NEXT_MACHINE(qdev_get_machine());
 733
 734     if (type == NEXTDMA_ENRX || type == NEXTDMA_ENTX) {
 735         align = 32;
 736     }
 737     /* Most DMA is supposedly 16 byte aligned */
 738     if ((size % align) != 0) {
 739         size -= size % align;
 740         size += align;
 741     }
 742
 743     /*
 744      * prom sets the dma start using initbuf while the bootloader uses next
 745      * so we check to see if initbuf is 0
 746      */
 747     if (next_state->dma[type].next_initbuf == 0) {
 748         base_addr = next_state->dma[type].next;
 749     } else {
 750         base_addr = next_state->dma[type].next_initbuf;
 751     }
 752
 753     cpu_physical_memory_write(base_addr, buf, size);
 754
 755     next_state->dma[type].next_initbuf = 0;
 756
 757     /* saved limit is checked to calculate packet size by both, rom and netbsd */
 758     next_state->dma[type].saved_limit = (next_state->dma[type].next + size);
 759     next_state->dma[type].saved_next  = (next_state->dma[type].next);
 760
 761     /*
 762      * 32 bytes under savedbase seems to be some kind of register
 763      * of which the purpose is unknown as of yet
 764      */
 765     /* stl_phys(s->rx_dma.base-32,0xFFFFFFFF); */
 766
 767     if (!(next_state->dma[type].csr & DMA_SUPDATE)) {
 768         next_state->dma[type].next  = next_state->dma[type].start;
 769         next_state->dma[type].limit = next_state->dma[type].stop;
 770     }
 771
 772     /* Set dma registers and raise an irq */
 773     next_state->dma[type].csr |= DMA_COMPLETE; /* DON'T CHANGE THIS! */
 774
 775     switch (type) {
 776     case NEXTDMA_SCSI:
 777         irq = NEXT_SCSI_DMA_I;
 778         break;
 779     }
 780
 781     next_irq(opaque, irq, 1);
 782     next_irq(opaque, irq, 0);
 783 }
 784
 785 static void nextscsi_read(void *opaque, uint8_t *buf, int len)
 786 {
 787     DPRINTF("SCSI READ: %x\n", len);
 788     abort();
 789 }
 790
 791 static void nextscsi_write(void *opaque, uint8_t *buf, int size)
 792 {
 793     DPRINTF("SCSI WRITE: %i\n", size);
 794     nextdma_write(opaque, buf, size, NEXTDMA_SCSI);
 795 }
 796
 797 static void next_scsi_init(DeviceState *pcdev, M68kCPU *cpu)
 798 {
 799     struct NeXTPC *next_pc = NEXT_PC(pcdev);
 800     DeviceState *dev;
 801     SysBusDevice *sysbusdev;
 802     SysBusESPState *sysbus_esp;
 803     ESPState *esp;
 804
 805     dev = qdev_new(TYPE_SYSBUS_ESP);
 806     sysbus_esp = SYSBUS_ESP(dev);
 807     esp = &sysbus_esp->esp;
 808     esp->dma_memory_read = nextscsi_read;
 809     esp->dma_memory_write = nextscsi_write;
 810     esp->dma_opaque = pcdev;
 811     sysbus_esp->it_shift = 0;
 812     esp->dma_enabled = 1;
 813     sysbusdev = SYS_BUS_DEVICE(dev);
 814     sysbus_realize_and_unref(sysbusdev, &error_fatal);
 815     sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(pcdev, NEXT_SCSI_I));
 816     sysbus_mmio_map(sysbusdev, 0, 0x2114000);
 817
 818     next_pc->scsi_reset = qdev_get_gpio_in(dev, 0);
 819     next_pc->scsi_dma = qdev_get_gpio_in(dev, 1);
 820
 821     scsi_bus_legacy_handle_cmdline(&esp->bus);
 822 }
 823
 824 static void next_escc_init(DeviceState *pcdev)
 825 {
 826     DeviceState *dev;
 827     SysBusDevice *s;
 828
 829     dev = qdev_new(TYPE_ESCC);
 830     qdev_prop_set_uint32(dev, "disabled", 0);
 831     qdev_prop_set_uint32(dev, "frequency", 9600 * 384);
 832     qdev_prop_set_uint32(dev, "it_shift", 0);
 833     qdev_prop_set_bit(dev, "bit_swap", true);
 834     qdev_prop_set_chr(dev, "chrB", serial_hd(1));
 835     qdev_prop_set_chr(dev, "chrA", serial_hd(0));
 836     qdev_prop_set_uint32(dev, "chnBtype", escc_serial);
 837     qdev_prop_set_uint32(dev, "chnAtype", escc_serial);
 838
 839     s = SYS_BUS_DEVICE(dev);
 840     sysbus_realize_and_unref(s, &error_fatal);
 841     sysbus_connect_irq(s, 0, qdev_get_gpio_in(pcdev, NEXT_SCC_I));
 842     sysbus_connect_irq(s, 1, qdev_get_gpio_in(pcdev, NEXT_SCC_DMA_I));
 843     sysbus_mmio_map(s, 0, 0x2118000);
 844 }
 845
 846 static void next_pc_reset(DeviceState *dev)
 847 {
 848     NeXTPC *s = NEXT_PC(dev);
 849
 850     /* Set internal registers to initial values */
 851     /*     0x0000XX00 << vital bits */
 852     s->scr1 = 0x00011102;
 853     s->scr2 = 0x00ff0c80;
 854
 855     s->rtc.status = 0x90;
 856
 857     /* Load RTC RAM - TODO: provide possibility to load contents from file */
 858     memcpy(s->rtc.ram, rtc_ram2, 32);
 859 }
 860
 861 static void next_pc_realize(DeviceState *dev, Error **errp)
 862 {
 863     NeXTPC *s = NEXT_PC(dev);
 864     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 865
 866     qdev_init_gpio_in(dev, next_irq, NEXT_NUM_IRQS);
 867
 868     memory_region_init_io(&s->mmiomem, OBJECT(s), &next_mmio_ops, s,
 869                           "next.mmio", 0xd0000);
 870     memory_region_init_io(&s->scrmem, OBJECT(s), &next_scr_ops, s,
 871                           "next.scr", 0x20000);
 872     sysbus_init_mmio(sbd, &s->mmiomem);
 873     sysbus_init_mmio(sbd, &s->scrmem);
 874 }
 875
 876 /*
 877  * If the m68k CPU implemented its inbound irq lines as GPIO lines
 878  * rather than via the m68k_set_irq_level() function we would not need
 879  * this cpu link property and could instead provide outbound IRQ lines
 880  * that the board could wire up to the CPU.
 881  */
 882 static Property next_pc_properties[] = {
 883     DEFINE_PROP_LINK("cpu", NeXTPC, cpu, TYPE_M68K_CPU, M68kCPU *),
 884     DEFINE_PROP_END_OF_LIST(),
 885 };
 886
 887 static const VMStateDescription next_rtc_vmstate = {
 888     .name = "next-rtc",
 889     .version_id = 1,
 890     .minimum_version_id = 1,
 891     .fields = (VMStateField[]) {
 892         VMSTATE_UINT8_ARRAY(ram, NextRtc, 32),
 893         VMSTATE_UINT8(command, NextRtc),
 894         VMSTATE_UINT8(value, NextRtc),
 895         VMSTATE_UINT8(status, NextRtc),
 896         VMSTATE_UINT8(control, NextRtc),
 897         VMSTATE_UINT8(retval, NextRtc),
 898         VMSTATE_END_OF_LIST()
 899     },
 900 };
 901
 902 static const VMStateDescription next_pc_vmstate = {
 903     .name = "next-pc",
 904     .version_id = 1,
 905     .minimum_version_id = 1,
 906     .fields = (VMStateField[]) {
 907         VMSTATE_UINT32(scr1, NeXTPC),
 908         VMSTATE_UINT32(scr2, NeXTPC),
 909         VMSTATE_UINT32(int_mask, NeXTPC),
 910         VMSTATE_UINT32(int_status, NeXTPC),
 911         VMSTATE_UINT8(scsi_csr_1, NeXTPC),
 912         VMSTATE_UINT8(scsi_csr_2, NeXTPC),
 913         VMSTATE_STRUCT(rtc, NeXTPC, 0, next_rtc_vmstate, NextRtc),
 914         VMSTATE_END_OF_LIST()
 915     },
 916 };
 917
 918 static void next_pc_class_init(ObjectClass *klass, void *data)
 919 {
 920     DeviceClass *dc = DEVICE_CLASS(klass);
 921
 922     dc->desc = "NeXT Peripheral Controller";
 923     dc->realize = next_pc_realize;
 924     dc->reset = next_pc_reset;
 925     device_class_set_props(dc, next_pc_properties);
 926     dc->vmsd = &next_pc_vmstate;
 927 }
 928
 929 static const TypeInfo next_pc_info = {
 930     .name = TYPE_NEXT_PC,
 931     .parent = TYPE_SYS_BUS_DEVICE,
 932     .instance_size = sizeof(NeXTPC),
 933     .class_init = next_pc_class_init,
 934 };
 935
 936 static void next_cube_init(MachineState *machine)
 937 {
 938     M68kCPU *cpu;
 939     CPUM68KState *env;
 940     MemoryRegion *rom = g_new(MemoryRegion, 1);
 941     MemoryRegion *rom2 = g_new(MemoryRegion, 1);
 942     MemoryRegion *dmamem = g_new(MemoryRegion, 1);
 943     MemoryRegion *bmapm1 = g_new(MemoryRegion, 1);
 944     MemoryRegion *bmapm2 = g_new(MemoryRegion, 1);
 945     MemoryRegion *sysmem = get_system_memory();
 946     const char *bios_name = machine->firmware ?: ROM_FILE;
 947     DeviceState *pcdev;
 948
 949     /* Initialize the cpu core */
 950     cpu = M68K_CPU(cpu_create(machine->cpu_type));
 951     if (!cpu) {
 952         error_report("Unable to find m68k CPU definition");
 953         exit(1);
 954     }
 955     env = &cpu->env;
 956
 957     /* Initialize CPU registers.  */
 958     env->vbr = 0;
 959     env->sr  = 0x2700;
 960
 961     /* Peripheral Controller */
 962     pcdev = qdev_new(TYPE_NEXT_PC);
 963     object_property_set_link(OBJECT(pcdev), "cpu", OBJECT(cpu), &error_abort);
 964     sysbus_realize_and_unref(SYS_BUS_DEVICE(pcdev), &error_fatal);
 965
 966     /* 64MB RAM starting at 0x04000000  */
 967     memory_region_add_subregion(sysmem, 0x04000000, machine->ram);
 968
 969     /* Framebuffer */
 970     sysbus_create_simple(TYPE_NEXTFB, 0x0B000000, NULL);
 971
 972     /* MMIO */
 973     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 0, 0x02000000);
 974
 975     /* BMAP IO - acts as a catch-all for now */
 976     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 1, 0x02100000);
 977
 978     /* BMAP memory */
 979     memory_region_init_ram_flags_nomigrate(bmapm1, NULL, "next.bmapmem", 64,
 980                                            RAM_SHARED, &error_fatal);
 981     memory_region_add_subregion(sysmem, 0x020c0000, bmapm1);
 982     /* The Rev_2.5_v66.bin firmware accesses it at 0x820c0020, too */
 983     memory_region_init_alias(bmapm2, NULL, "next.bmapmem2", bmapm1, 0x0, 64);
 984     memory_region_add_subregion(sysmem, 0x820c0000, bmapm2);
 985
 986     /* KBD */
 987     sysbus_create_simple(TYPE_NEXTKBD, 0x0200e000, NULL);
 988
 989     /* Load ROM here */
 990     memory_region_init_rom(rom, NULL, "next.rom", 0x20000, &error_fatal);
 991     memory_region_add_subregion(sysmem, 0x01000000, rom);
 992     memory_region_init_alias(rom2, NULL, "next.rom2", rom, 0x0, 0x20000);
 993     memory_region_add_subregion(sysmem, 0x0, rom2);
 994     if (load_image_targphys(bios_name, 0x01000000, 0x20000) < 8) {
 995         if (!qtest_enabled()) {
 996             error_report("Failed to load firmware '%s'.", bios_name);
 997         }
 998     } else {
 999         uint8_t *ptr;
1000         /* Initial PC is always at offset 4 in firmware binaries */
1001         ptr = rom_ptr(0x01000004, 4);
1002         g_assert(ptr != NULL);
1003         env->pc = ldl_p(ptr);
1004         if (env->pc >= 0x01020000) {
1005             error_report("'%s' does not seem to be a valid firmware image.",
1006                          bios_name);
1007             exit(1);
1008         }
1009     }
1010
1011     /* Serial */
1012     next_escc_init(pcdev);
1013
1014     /* TODO: */
1015     /* Network */
1016     /* SCSI */
1017     next_scsi_init(pcdev, cpu);
1018
1019     /* DMA */
1020     memory_region_init_io(dmamem, NULL, &dma_ops, machine, "next.dma", 0x5000);
1021     memory_region_add_subregion(sysmem, 0x02000000, dmamem);
1022 }
1023
1024 static void next_machine_class_init(ObjectClass *oc, void *data)
1025 {
1026     MachineClass *mc = MACHINE_CLASS(oc);
1027
1028     mc->desc = "NeXT Cube";
1029     mc->init = next_cube_init;
1030     mc->block_default_type = IF_SCSI;
1031     mc->default_ram_size = RAM_SIZE;
1032     mc->default_ram_id = "next.ram";
1033     mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68040");
1034 }
1035
1036 static const TypeInfo next_typeinfo = {
1037     .name = TYPE_NEXT_MACHINE,
1038     .parent = TYPE_MACHINE,
1039     .class_init = next_machine_class_init,
1040     .instance_size = sizeof(NeXTState),
1041 };
1042
1043 static void next_register_type(void)
1044 {
1045     type_register_static(&next_typeinfo);
1046     type_register_static(&next_pc_info);
1047 }
1048
1049 type_init(next_register_type)