xref: /openbmc/qemu/hw/audio/sb16.c (revision c5d60e5903e48dc0222a0be1711ccf902fe92ff0)
1 /*
2  * QEMU Soundblaster 16 emulation
3  *
4  * Copyright (c) 2003-2005 Vassili Karpov (malc)
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/audio/model.h"
27 #include "qemu/audio.h"
28 #include "hw/irq.h"
29 #include "hw/isa/isa.h"
30 #include "hw/qdev-properties.h"
31 #include "migration/vmstate.h"
32 #include "qemu/timer.h"
33 #include "qemu/error-report.h"
34 #include "qemu/host-utils.h"
35 #include "qemu/log.h"
36 #include "qemu/module.h"
37 #include "qapi/error.h"
38 #include "qom/object.h"
39 
40 #define DEBUG 0
41 /* #define DEBUG_SB16_MOST */
42 
43 #define ldebug(fmt, ...) do { \
44         if (DEBUG) { \
45             error_report("sb16: " fmt, ##__VA_ARGS__); \
46         } \
47     } while (0)
48 
49 static const char e3[] = "COPYRIGHT (C) CREATIVE TECHNOLOGY LTD, 1992.";
50 
51 #define TYPE_SB16 "sb16"
52 OBJECT_DECLARE_SIMPLE_TYPE(SB16State, SB16)
53 
54 struct SB16State {
55     ISADevice parent_obj;
56 
57     AudioBackend *audio_be;
58     qemu_irq pic;
59     uint32_t irq;
60     uint32_t dma;
61     uint32_t hdma;
62     uint32_t port;
63     uint32_t ver;
64     IsaDma *isa_dma;
65     IsaDma *isa_hdma;
66 
67     int in_index;
68     int out_data_len;
69     int fmt_stereo;
70     int fmt_signed;
71     int fmt_bits;
72     AudioFormat fmt;
73     int dma_auto;
74     int block_size;
75     int fifo;
76     int freq;
77     int time_const;
78     int speaker;
79     int needed_bytes;
80     int cmd;
81     int use_hdma;
82     int highspeed;
83     int can_write;
84 
85     int v2x6;
86 
87     uint8_t csp_param;
88     uint8_t csp_value;
89     uint8_t csp_mode;
90     uint8_t csp_regs[256];
91     uint8_t csp_index;
92     uint8_t csp_reg83[4];
93     int csp_reg83r;
94     int csp_reg83w;
95 
96     uint8_t in2_data[10];
97     uint8_t out_data[50];
98     uint8_t test_reg;
99     uint8_t last_read_byte;
100     int nzero;
101 
102     int left_till_irq;
103 
104     int dma_running;
105     int bytes_per_second;
106     int align;
107     int audio_free;
108     SWVoiceOut *voice;
109 
110     QEMUTimer *aux_ts;
111     /* mixer state */
112     int mixer_nreg;
113     uint8_t mixer_regs[256];
114     PortioList portio_list;
115 };
116 
117 #define SAMPLE_RATE_MIN 5000
118 #define SAMPLE_RATE_MAX 45000
119 
120 static void SB_audio_callback (void *opaque, int free);
121 
122 static int magic_of_irq (int irq)
123 {
124     switch (irq) {
125     case 5:
126         return 2;
127     case 7:
128         return 4;
129     case 9:
130         return 1;
131     case 10:
132         return 8;
133     default:
134         qemu_log_mask(LOG_GUEST_ERROR, "bad irq %d\n", irq);
135         return 2;
136     }
137 }
138 
139 static int irq_of_magic (int magic)
140 {
141     switch (magic) {
142     case 1:
143         return 9;
144     case 2:
145         return 5;
146     case 4:
147         return 7;
148     case 8:
149         return 10;
150     default:
151         qemu_log_mask(LOG_GUEST_ERROR, "bad irq magic %d\n", magic);
152         return -1;
153     }
154 }
155 
156 #if 0
157 static void log_dsp (SB16State *dsp)
158 {
159     ldebug("%s:%s:%d:%s:dmasize=%d:freq=%d:const=%d:speaker=%d",
160             dsp->fmt_stereo ? "Stereo" : "Mono",
161             dsp->fmt_signed ? "Signed" : "Unsigned",
162             dsp->fmt_bits,
163             dsp->dma_auto ? "Auto" : "Single",
164             dsp->block_size,
165             dsp->freq,
166             dsp->time_const,
167             dsp->speaker);
168 }
169 #endif
170 
171 static void speaker (SB16State *s, int on)
172 {
173     s->speaker = on;
174     /* AUD_enable (s->voice, on); */
175 }
176 
177 static void control (SB16State *s, int hold)
178 {
179     int dma = s->use_hdma ? s->hdma : s->dma;
180     IsaDma *isa_dma = s->use_hdma ? s->isa_hdma : s->isa_dma;
181     IsaDmaClass *k = ISADMA_GET_CLASS(isa_dma);
182     s->dma_running = hold;
183 
184     ldebug("hold %d high %d dma %d", hold, s->use_hdma, dma);
185 
186     if (hold) {
187         k->hold_DREQ(isa_dma, dma);
188         AUD_set_active_out (s->voice, 1);
189     }
190     else {
191         k->release_DREQ(isa_dma, dma);
192         AUD_set_active_out (s->voice, 0);
193     }
194 }
195 
196 static void aux_timer (void *opaque)
197 {
198     SB16State *s = opaque;
199     s->can_write = 1;
200     qemu_irq_raise (s->pic);
201 }
202 
203 #define DMA8_AUTO 1
204 #define DMA8_HIGH 2
205 
206 static void continue_dma8 (SB16State *s)
207 {
208     if (s->freq > 0) {
209         struct audsettings as;
210 
211         s->audio_free = 0;
212 
213         as.freq = s->freq;
214         as.nchannels = 1 << s->fmt_stereo;
215         as.fmt = s->fmt;
216         as.endianness = 0;
217 
218         s->voice = AUD_open_out (
219             s->audio_be,
220             s->voice,
221             "sb16",
222             s,
223             SB_audio_callback,
224             &as
225             );
226     }
227 
228     control (s, 1);
229 }
230 
231 static inline int restrict_sampling_rate(int freq)
232 {
233     if (freq < SAMPLE_RATE_MIN) {
234         qemu_log_mask(LOG_GUEST_ERROR,
235                       "sampling range too low: %d, increasing to %u\n",
236                       freq, SAMPLE_RATE_MIN);
237         return SAMPLE_RATE_MIN;
238     } else if (freq > SAMPLE_RATE_MAX) {
239         qemu_log_mask(LOG_GUEST_ERROR,
240                       "sampling range too high: %d, decreasing to %u\n",
241                       freq, SAMPLE_RATE_MAX);
242         return SAMPLE_RATE_MAX;
243     } else {
244         return freq;
245     }
246 }
247 
248 static void dma_cmd8 (SB16State *s, int mask, int dma_len)
249 {
250     s->fmt = AUDIO_FORMAT_U8;
251     s->use_hdma = 0;
252     s->fmt_bits = 8;
253     s->fmt_signed = 0;
254     s->fmt_stereo = (s->mixer_regs[0x0e] & 2) != 0;
255     if (-1 == s->time_const) {
256         if (s->freq <= 0)
257             s->freq = 11025;
258     }
259     else {
260         int tmp = (256 - s->time_const);
261         s->freq = (1000000 + (tmp / 2)) / tmp;
262     }
263     s->freq = restrict_sampling_rate(s->freq);
264 
265     if (dma_len != -1) {
266         s->block_size = dma_len << s->fmt_stereo;
267     }
268     else {
269         /* This is apparently the only way to make both Act1/PL
270            and SecondReality/FC work
271 
272            Act1 sets block size via command 0x48 and it's an odd number
273            SR does the same with even number
274            Both use stereo, and Creatives own documentation states that
275            0x48 sets block size in bytes less one.. go figure */
276         s->block_size &= ~s->fmt_stereo;
277     }
278 
279     s->freq >>= s->fmt_stereo;
280     s->left_till_irq = s->block_size;
281     s->bytes_per_second = (s->freq << s->fmt_stereo);
282     /* s->highspeed = (mask & DMA8_HIGH) != 0; */
283     s->dma_auto = (mask & DMA8_AUTO) != 0;
284     s->align = (1 << s->fmt_stereo) - 1;
285 
286     if (s->block_size & s->align) {
287         qemu_log_mask(LOG_GUEST_ERROR, "warning: misaligned block size %d,"
288                       " alignment %d\n", s->block_size, s->align + 1);
289     }
290 
291     ldebug("freq %d, stereo %d, sign %d, bits %d, "
292             "dma %d, auto %d, fifo %d, high %d",
293             s->freq, s->fmt_stereo, s->fmt_signed, s->fmt_bits,
294             s->block_size, s->dma_auto, s->fifo, s->highspeed);
295 
296     continue_dma8 (s);
297     speaker (s, 1);
298 }
299 
300 static void dma_cmd (SB16State *s, uint8_t cmd, uint8_t d0, int dma_len)
301 {
302     s->use_hdma = cmd < 0xc0;
303     s->fifo = (cmd >> 1) & 1;
304     s->dma_auto = (cmd >> 2) & 1;
305     s->fmt_signed = (d0 >> 4) & 1;
306     s->fmt_stereo = (d0 >> 5) & 1;
307 
308     switch (cmd >> 4) {
309     case 11:
310         s->fmt_bits = 16;
311         break;
312 
313     case 12:
314         s->fmt_bits = 8;
315         break;
316     }
317 
318     if (-1 != s->time_const) {
319 #if 1
320         int tmp = 256 - s->time_const;
321         s->freq = (1000000 + (tmp / 2)) / tmp;
322 #else
323         /* s->freq = 1000000 / ((255 - s->time_const) << s->fmt_stereo); */
324         s->freq = 1000000 / ((255 - s->time_const));
325 #endif
326         s->time_const = -1;
327     }
328 
329     s->block_size = dma_len + 1;
330     s->block_size <<= (s->fmt_bits == 16);
331     if (!s->dma_auto) {
332         /* It is clear that for DOOM and auto-init this value
333            shouldn't take stereo into account, while Miles Sound Systems
334            setsound.exe with single transfer mode wouldn't work without it
335            wonders of SB16 yet again */
336         s->block_size <<= s->fmt_stereo;
337     }
338 
339     ldebug("freq %d, stereo %d, sign %d, bits %d, "
340             "dma %d, auto %d, fifo %d, high %d",
341             s->freq, s->fmt_stereo, s->fmt_signed, s->fmt_bits,
342             s->block_size, s->dma_auto, s->fifo, s->highspeed);
343 
344     if (16 == s->fmt_bits) {
345         if (s->fmt_signed) {
346             s->fmt = AUDIO_FORMAT_S16;
347         }
348         else {
349             s->fmt = AUDIO_FORMAT_U16;
350         }
351     }
352     else {
353         if (s->fmt_signed) {
354             s->fmt = AUDIO_FORMAT_S8;
355         }
356         else {
357             s->fmt = AUDIO_FORMAT_U8;
358         }
359     }
360 
361     s->left_till_irq = s->block_size;
362 
363     s->bytes_per_second = (s->freq << s->fmt_stereo) << (s->fmt_bits == 16);
364     s->highspeed = 0;
365     s->align = (1 << (s->fmt_stereo + (s->fmt_bits == 16))) - 1;
366     if (s->block_size & s->align) {
367         qemu_log_mask(LOG_GUEST_ERROR, "warning: misaligned block size %d,"
368                       " alignment %d\n", s->block_size, s->align + 1);
369     }
370 
371     if (s->freq) {
372         struct audsettings as;
373 
374         s->audio_free = 0;
375 
376         as.freq = s->freq;
377         as.nchannels = 1 << s->fmt_stereo;
378         as.fmt = s->fmt;
379         as.endianness = 0;
380 
381         s->voice = AUD_open_out (
382             s->audio_be,
383             s->voice,
384             "sb16",
385             s,
386             SB_audio_callback,
387             &as
388             );
389     }
390 
391     control (s, 1);
392     speaker (s, 1);
393 }
394 
395 static inline void dsp_out_data (SB16State *s, uint8_t val)
396 {
397     ldebug("outdata 0x%x", val);
398     if ((size_t) s->out_data_len < sizeof (s->out_data)) {
399         s->out_data[s->out_data_len++] = val;
400     }
401 }
402 
403 static inline uint8_t dsp_get_data (SB16State *s)
404 {
405     if (s->in_index) {
406         return s->in2_data[--s->in_index];
407     }
408     else {
409         warn_report("sb16: buffer underflow");
410         return 0;
411     }
412 }
413 
414 static void command (SB16State *s, uint8_t cmd)
415 {
416     ldebug("command 0x%x", cmd);
417 
418     if (cmd > 0xaf && cmd < 0xd0) {
419         if (cmd & 8) {
420             qemu_log_mask(LOG_UNIMP, "ADC not yet supported (command 0x%x)\n",
421                           cmd);
422         }
423 
424         switch (cmd >> 4) {
425         case 11:
426         case 12:
427             break;
428         default:
429             qemu_log_mask(LOG_GUEST_ERROR, "0x%x wrong bits\n", cmd);
430         }
431         s->needed_bytes = 3;
432     }
433     else {
434         s->needed_bytes = 0;
435 
436         switch (cmd) {
437         case 0x03:
438             dsp_out_data (s, 0x10); /* s->csp_param); */
439             goto warn;
440 
441         case 0x04:
442             s->needed_bytes = 1;
443             goto warn;
444 
445         case 0x05:
446             s->needed_bytes = 2;
447             goto warn;
448 
449         case 0x08:
450             /* __asm__ ("int3"); */
451             goto warn;
452 
453         case 0x0e:
454             s->needed_bytes = 2;
455             goto warn;
456 
457         case 0x09:
458             dsp_out_data (s, 0xf8);
459             goto warn;
460 
461         case 0x0f:
462             s->needed_bytes = 1;
463             goto warn;
464 
465         case 0x10:
466             s->needed_bytes = 1;
467             goto warn;
468 
469         case 0x14:
470             s->needed_bytes = 2;
471             s->block_size = 0;
472             break;
473 
474         case 0x1c:              /* Auto-Initialize DMA DAC, 8-bit */
475             dma_cmd8 (s, DMA8_AUTO, -1);
476             break;
477 
478         case 0x20:              /* Direct ADC, Juice/PL */
479             dsp_out_data (s, 0xff);
480             goto warn;
481 
482         case 0x35:
483             qemu_log_mask(LOG_UNIMP, "0x35 - MIDI command not implemented\n");
484             break;
485 
486         case 0x40:
487             s->freq = -1;
488             s->time_const = -1;
489             s->needed_bytes = 1;
490             break;
491 
492         case 0x41:
493             s->freq = -1;
494             s->time_const = -1;
495             s->needed_bytes = 2;
496             break;
497 
498         case 0x42:
499             s->freq = -1;
500             s->time_const = -1;
501             s->needed_bytes = 2;
502             goto warn;
503 
504         case 0x45:
505             dsp_out_data (s, 0xaa);
506             goto warn;
507 
508         case 0x47:                /* Continue Auto-Initialize DMA 16bit */
509             break;
510 
511         case 0x48:
512             s->needed_bytes = 2;
513             break;
514 
515         case 0x74:
516             s->needed_bytes = 2; /* DMA DAC, 4-bit ADPCM */
517             qemu_log_mask(LOG_UNIMP, "0x75 - DMA DAC, 4-bit ADPCM not"
518                           " implemented\n");
519             break;
520 
521         case 0x75:              /* DMA DAC, 4-bit ADPCM Reference */
522             s->needed_bytes = 2;
523             qemu_log_mask(LOG_UNIMP, "0x74 - DMA DAC, 4-bit ADPCM Reference not"
524                           " implemented\n");
525             break;
526 
527         case 0x76:              /* DMA DAC, 2.6-bit ADPCM */
528             s->needed_bytes = 2;
529             qemu_log_mask(LOG_UNIMP, "0x74 - DMA DAC, 2.6-bit ADPCM not"
530                           " implemented\n");
531             break;
532 
533         case 0x77:              /* DMA DAC, 2.6-bit ADPCM Reference */
534             s->needed_bytes = 2;
535             qemu_log_mask(LOG_UNIMP, "0x74 - DMA DAC, 2.6-bit ADPCM Reference"
536                           " not implemented\n");
537             break;
538 
539         case 0x7d:
540             qemu_log_mask(LOG_UNIMP, "0x7d - Autio-Initialize DMA DAC, 4-bit"
541                           " ADPCM Reference\n");
542             qemu_log_mask(LOG_UNIMP, "not implemented\n");
543             break;
544 
545         case 0x7f:
546             qemu_log_mask(LOG_UNIMP, "0x7d - Autio-Initialize DMA DAC, 2.6-bit"
547                           " ADPCM Reference\n");
548             qemu_log_mask(LOG_UNIMP, "not implemented\n");
549             break;
550 
551         case 0x80:
552             s->needed_bytes = 2;
553             break;
554 
555         case 0x90:
556         case 0x91:
557             dma_cmd8 (s, ((cmd & 1) == 0) | DMA8_HIGH, -1);
558             break;
559 
560         case 0xd0:              /* halt DMA operation. 8bit */
561             control (s, 0);
562             break;
563 
564         case 0xd1:              /* speaker on */
565             speaker (s, 1);
566             break;
567 
568         case 0xd3:              /* speaker off */
569             speaker (s, 0);
570             break;
571 
572         case 0xd4:              /* continue DMA operation. 8bit */
573             /* KQ6 (or maybe Sierras audblst.drv in general) resets
574                the frequency between halt/continue */
575             continue_dma8 (s);
576             break;
577 
578         case 0xd5:              /* halt DMA operation. 16bit */
579             control (s, 0);
580             break;
581 
582         case 0xd6:              /* continue DMA operation. 16bit */
583             control (s, 1);
584             break;
585 
586         case 0xd9:              /* exit auto-init DMA after this block. 16bit */
587             s->dma_auto = 0;
588             break;
589 
590         case 0xda:              /* exit auto-init DMA after this block. 8bit */
591             s->dma_auto = 0;
592             break;
593 
594         case 0xe0:              /* DSP identification */
595             s->needed_bytes = 1;
596             break;
597 
598         case 0xe1:
599             dsp_out_data (s, s->ver & 0xff);
600             dsp_out_data (s, s->ver >> 8);
601             break;
602 
603         case 0xe2:
604             s->needed_bytes = 1;
605             goto warn;
606 
607         case 0xe3:
608             {
609                 int i;
610                 for (i = sizeof (e3) - 1; i >= 0; --i)
611                     dsp_out_data (s, e3[i]);
612             }
613             break;
614 
615         case 0xe4:              /* write test reg */
616             s->needed_bytes = 1;
617             break;
618 
619         case 0xe7:
620             qemu_log_mask(LOG_UNIMP, "Attempt to probe for ESS (0xe7)?\n");
621             break;
622 
623         case 0xe8:              /* read test reg */
624             dsp_out_data (s, s->test_reg);
625             break;
626 
627         case 0xf2:
628         case 0xf3:
629             dsp_out_data (s, 0xaa);
630             s->mixer_regs[0x82] |= (cmd == 0xf2) ? 1 : 2;
631             qemu_irq_raise (s->pic);
632             break;
633 
634         case 0xf9:
635             s->needed_bytes = 1;
636             goto warn;
637 
638         case 0xfa:
639             dsp_out_data (s, 0);
640             goto warn;
641 
642         case 0xfc:              /* FIXME */
643             dsp_out_data (s, 0);
644             goto warn;
645 
646         default:
647             qemu_log_mask(LOG_UNIMP, "Unrecognized command 0x%x\n", cmd);
648             break;
649         }
650     }
651 
652     if (!s->needed_bytes) {
653         ldebug("!needed_bytes");
654     }
655 
656  exit:
657     if (!s->needed_bytes) {
658         s->cmd = -1;
659     }
660     else {
661         s->cmd = cmd;
662     }
663     return;
664 
665  warn:
666     qemu_log_mask(LOG_UNIMP, "warning: command 0x%x,%d is not truly understood"
667                   " yet\n", cmd, s->needed_bytes);
668     goto exit;
669 
670 }
671 
672 static uint16_t dsp_get_lohi (SB16State *s)
673 {
674     uint8_t hi = dsp_get_data (s);
675     uint8_t lo = dsp_get_data (s);
676     return (hi << 8) | lo;
677 }
678 
679 static uint16_t dsp_get_hilo (SB16State *s)
680 {
681     uint8_t lo = dsp_get_data (s);
682     uint8_t hi = dsp_get_data (s);
683     return (hi << 8) | lo;
684 }
685 
686 static void complete (SB16State *s)
687 {
688     int d0, d1, d2;
689     ldebug("complete command 0x%x, in_index %d, needed_bytes %d",
690             s->cmd, s->in_index, s->needed_bytes);
691 
692     if (s->cmd > 0xaf && s->cmd < 0xd0) {
693         d2 = dsp_get_data (s);
694         d1 = dsp_get_data (s);
695         d0 = dsp_get_data (s);
696 
697         if (s->cmd & 8) {
698             warn_report("sb16: ADC params cmd = 0x%x d0 = %d, d1 = %d, d2 = %d",
699                    s->cmd, d0, d1, d2);
700         }
701         else {
702             ldebug("cmd = 0x%x d0 = %d, d1 = %d, d2 = %d",
703                     s->cmd, d0, d1, d2);
704             dma_cmd (s, s->cmd, d0, d1 + (d2 << 8));
705         }
706     }
707     else {
708         switch (s->cmd) {
709         case 0x04:
710             s->csp_mode = dsp_get_data (s);
711             s->csp_reg83r = 0;
712             s->csp_reg83w = 0;
713             ldebug("CSP command 0x04: mode=0x%x", s->csp_mode);
714             break;
715 
716         case 0x05:
717             s->csp_param = dsp_get_data (s);
718             s->csp_value = dsp_get_data (s);
719             ldebug("CSP command 0x05: param=0x%x value=0x%x",
720                     s->csp_param,
721                     s->csp_value);
722             break;
723 
724         case 0x0e:
725             d0 = dsp_get_data (s);
726             d1 = dsp_get_data (s);
727             ldebug("write CSP register %d <- 0x%x", d1, d0);
728             if (d1 == 0x83) {
729                 ldebug("0x83[%d] <- 0x%x", s->csp_reg83r, d0);
730                 s->csp_reg83[s->csp_reg83r % 4] = d0;
731                 s->csp_reg83r += 1;
732             }
733             else {
734                 s->csp_regs[d1] = d0;
735             }
736             break;
737 
738         case 0x0f:
739             d0 = dsp_get_data (s);
740             ldebug("read CSP register 0x%x -> 0x%x, mode=0x%x",
741                     d0, s->csp_regs[d0], s->csp_mode);
742             if (d0 == 0x83) {
743                 ldebug("0x83[%d] -> 0x%x",
744                         s->csp_reg83w,
745                         s->csp_reg83[s->csp_reg83w % 4]);
746                 dsp_out_data (s, s->csp_reg83[s->csp_reg83w % 4]);
747                 s->csp_reg83w += 1;
748             }
749             else {
750                 dsp_out_data (s, s->csp_regs[d0]);
751             }
752             break;
753 
754         case 0x10:
755             d0 = dsp_get_data (s);
756             warn_report("sb16: cmd 0x10 d0=0x%x", d0);
757             break;
758 
759         case 0x14:
760             dma_cmd8 (s, 0, dsp_get_lohi (s) + 1);
761             break;
762 
763         case 0x40:
764             s->time_const = dsp_get_data (s);
765             ldebug("set time const %d", s->time_const);
766             break;
767 
768         case 0x41:
769         case 0x42:
770             /*
771              * 0x41 is documented as setting the output sample rate,
772              * and 0x42 the input sample rate, but in fact SB16 hardware
773              * seems to have only a single sample rate under the hood,
774              * and FT2 sets output freq with this (go figure).  Compare:
775              * http://homepages.cae.wisc.edu/~brodskye/sb16doc/sb16doc.html#SamplingRate
776              */
777             s->freq = restrict_sampling_rate(dsp_get_hilo(s));
778             ldebug("set freq %d", s->freq);
779             break;
780 
781         case 0x48:
782             s->block_size = dsp_get_lohi (s) + 1;
783             ldebug("set dma block len %d", s->block_size);
784             break;
785 
786         case 0x74:
787         case 0x75:
788         case 0x76:
789         case 0x77:
790             /* ADPCM stuff, ignore */
791             break;
792 
793         case 0x80:
794             {
795                 int freq, samples, bytes;
796                 int64_t ticks;
797 
798                 freq = s->freq > 0 ? s->freq : 11025;
799                 samples = dsp_get_lohi (s) + 1;
800                 bytes = samples << s->fmt_stereo << (s->fmt_bits == 16);
801                 ticks = muldiv64(bytes, NANOSECONDS_PER_SECOND, freq);
802                 if (ticks < NANOSECONDS_PER_SECOND / 1024) {
803                     qemu_irq_raise (s->pic);
804                 }
805                 else {
806                     if (s->aux_ts) {
807                         timer_mod (
808                             s->aux_ts,
809                             qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + ticks
810                             );
811                     }
812                 }
813                 ldebug("mix silence %d %d %" PRId64, samples, bytes, ticks);
814             }
815             break;
816 
817         case 0xe0:
818             d0 = dsp_get_data (s);
819             s->out_data_len = 0;
820             ldebug("E0 data = 0x%x", d0);
821             dsp_out_data (s, ~d0);
822             break;
823 
824         case 0xe2:
825 #if DEBUG
826             d0 = dsp_get_data (s);
827             warn_report("sb16: E2 = 0x%x", d0);
828 #endif
829             break;
830 
831         case 0xe4:
832             s->test_reg = dsp_get_data (s);
833             break;
834 
835         case 0xf9:
836             d0 = dsp_get_data (s);
837             ldebug("command 0xf9 with 0x%x", d0);
838             switch (d0) {
839             case 0x0e:
840                 dsp_out_data (s, 0xff);
841                 break;
842 
843             case 0x0f:
844                 dsp_out_data (s, 0x07);
845                 break;
846 
847             case 0x37:
848                 dsp_out_data (s, 0x38);
849                 break;
850 
851             default:
852                 dsp_out_data (s, 0x00);
853                 break;
854             }
855             break;
856 
857         default:
858             qemu_log_mask(LOG_UNIMP, "complete: unrecognized command 0x%x\n",
859                           s->cmd);
860             return;
861         }
862     }
863 
864     ldebug("");
865     s->cmd = -1;
866 }
867 
868 static void legacy_reset (SB16State *s)
869 {
870     struct audsettings as;
871 
872     s->freq = 11025;
873     s->fmt_signed = 0;
874     s->fmt_bits = 8;
875     s->fmt_stereo = 0;
876 
877     as.freq = s->freq;
878     as.nchannels = 1;
879     as.fmt = AUDIO_FORMAT_U8;
880     as.endianness = 0;
881 
882     s->voice = AUD_open_out (
883         s->audio_be,
884         s->voice,
885         "sb16",
886         s,
887         SB_audio_callback,
888         &as
889         );
890 
891     /* Not sure about that... */
892     /* AUD_set_active_out (s->voice, 1); */
893 }
894 
895 static void reset (SB16State *s)
896 {
897     qemu_irq_lower (s->pic);
898     if (s->dma_auto) {
899         qemu_irq_raise (s->pic);
900         qemu_irq_lower (s->pic);
901     }
902 
903     s->mixer_regs[0x82] = 0;
904     s->dma_auto = 0;
905     s->in_index = 0;
906     s->out_data_len = 0;
907     s->left_till_irq = 0;
908     s->needed_bytes = 0;
909     s->block_size = -1;
910     s->nzero = 0;
911     s->highspeed = 0;
912     s->v2x6 = 0;
913     s->cmd = -1;
914 
915     dsp_out_data (s, 0xaa);
916     speaker (s, 0);
917     control (s, 0);
918     legacy_reset (s);
919 }
920 
921 static void dsp_write(void *opaque, uint32_t nport, uint32_t val)
922 {
923     SB16State *s = opaque;
924     int iport;
925 
926     iport = nport - s->port;
927 
928     ldebug("write 0x%x <- 0x%x", nport, val);
929     switch (iport) {
930     case 0x06:
931         switch (val) {
932         case 0x00:
933             if (s->v2x6 == 1) {
934                 reset (s);
935             }
936             s->v2x6 = 0;
937             break;
938 
939         case 0x01:
940         case 0x03:              /* FreeBSD kludge */
941             s->v2x6 = 1;
942             break;
943 
944         case 0xc6:
945             s->v2x6 = 0;        /* Prince of Persia, csp.sys, diagnose.exe */
946             break;
947 
948         case 0xb8:              /* Panic */
949             reset (s);
950             break;
951 
952         case 0x39:
953             dsp_out_data (s, 0x38);
954             reset (s);
955             s->v2x6 = 0x39;
956             break;
957 
958         default:
959             s->v2x6 = val;
960             break;
961         }
962         break;
963 
964     case 0x0c:                  /* write data or command | write status */
965 /*         if (s->highspeed) */
966 /*             break; */
967 
968         if (s->needed_bytes == 0) {
969             command (s, val);
970 #if 0
971             if (0 == s->needed_bytes) {
972                 log_dsp (s);
973             }
974 #endif
975         }
976         else {
977             if (s->in_index == sizeof (s->in2_data)) {
978                 warn_report("sb16: in data overrun");
979             }
980             else {
981                 s->in2_data[s->in_index++] = val;
982                 if (s->in_index == s->needed_bytes) {
983                     s->needed_bytes = 0;
984                     complete (s);
985 #if 0
986                     log_dsp (s);
987 #endif
988                 }
989             }
990         }
991         break;
992 
993     default:
994         ldebug("(nport=0x%x, val=0x%x)", nport, val);
995         break;
996     }
997 }
998 
999 static uint32_t dsp_read(void *opaque, uint32_t nport)
1000 {
1001     SB16State *s = opaque;
1002     int iport, retval, ack = 0;
1003 
1004     iport = nport - s->port;
1005 
1006     switch (iport) {
1007     case 0x06:                  /* reset */
1008         retval = 0xff;
1009         break;
1010 
1011     case 0x0a:                  /* read data */
1012         if (s->out_data_len) {
1013             retval = s->out_data[--s->out_data_len];
1014             s->last_read_byte = retval;
1015         }
1016         else {
1017             if (s->cmd != -1) {
1018                 warn_report("sb16: empty output buffer for command 0x%x",
1019                        s->cmd);
1020             }
1021             retval = s->last_read_byte;
1022             /* goto error; */
1023         }
1024         break;
1025 
1026     case 0x0c:                  /* 0 can write */
1027         retval = s->can_write ? 0 : 0x80;
1028         break;
1029 
1030     case 0x0d:                  /* timer interrupt clear */
1031         /* warn_report("sb16: timer interrupt clear"); */
1032         retval = 0;
1033         break;
1034 
1035     case 0x0e:                  /* data available status | irq 8 ack */
1036         retval = (!s->out_data_len || s->highspeed) ? 0 : 0x80;
1037         if (s->mixer_regs[0x82] & 1) {
1038             ack = 1;
1039             s->mixer_regs[0x82] &= ~1;
1040             qemu_irq_lower (s->pic);
1041         }
1042         break;
1043 
1044     case 0x0f:                  /* irq 16 ack */
1045         retval = 0xff;
1046         if (s->mixer_regs[0x82] & 2) {
1047             ack = 1;
1048             s->mixer_regs[0x82] &= ~2;
1049             qemu_irq_lower (s->pic);
1050         }
1051         break;
1052 
1053     default:
1054         goto error;
1055     }
1056 
1057     if (!ack) {
1058         ldebug("read 0x%x -> 0x%x", nport, retval);
1059     }
1060 
1061     return retval;
1062 
1063  error:
1064     warn_report("sb16: dsp_read 0x%x error", nport);
1065     return 0xff;
1066 }
1067 
1068 static void reset_mixer (SB16State *s)
1069 {
1070     int i;
1071 
1072     memset (s->mixer_regs, 0xff, 0x7f);
1073     memset (s->mixer_regs + 0x83, 0xff, sizeof (s->mixer_regs) - 0x83);
1074 
1075     s->mixer_regs[0x02] = 4;    /* master volume 3bits */
1076     s->mixer_regs[0x06] = 4;    /* MIDI volume 3bits */
1077     s->mixer_regs[0x08] = 0;    /* CD volume 3bits */
1078     s->mixer_regs[0x0a] = 0;    /* voice volume 2bits */
1079 
1080     /* d5=input filt, d3=lowpass filt, d1,d2=input source */
1081     s->mixer_regs[0x0c] = 0;
1082 
1083     /* d5=output filt, d1=stereo switch */
1084     s->mixer_regs[0x0e] = 0;
1085 
1086     /* voice volume L d5,d7, R d1,d3 */
1087     s->mixer_regs[0x04] = (4 << 5) | (4 << 1);
1088     /* master ... */
1089     s->mixer_regs[0x22] = (4 << 5) | (4 << 1);
1090     /* MIDI ... */
1091     s->mixer_regs[0x26] = (4 << 5) | (4 << 1);
1092 
1093     for (i = 0x30; i < 0x48; i++) {
1094         s->mixer_regs[i] = 0x20;
1095     }
1096 }
1097 
1098 static void mixer_write_indexb(void *opaque, uint32_t nport, uint32_t val)
1099 {
1100     SB16State *s = opaque;
1101     (void) nport;
1102     s->mixer_nreg = val;
1103 }
1104 
1105 static void mixer_write_datab(void *opaque, uint32_t nport, uint32_t val)
1106 {
1107     SB16State *s = opaque;
1108 
1109     (void) nport;
1110     ldebug("mixer_write [0x%x] <- 0x%x", s->mixer_nreg, val);
1111 
1112     switch (s->mixer_nreg) {
1113     case 0x00:
1114         reset_mixer (s);
1115         break;
1116 
1117     case 0x80:
1118         {
1119             int irq = irq_of_magic (val);
1120             ldebug("setting irq to %d (val=0x%x)", irq, val);
1121             if (irq > 0) {
1122                 s->irq = irq;
1123             }
1124         }
1125         break;
1126 
1127     case 0x81:
1128         {
1129             int dma, hdma;
1130 
1131             dma = ctz32 (val & 0xf);
1132             hdma = ctz32 (val & 0xf0);
1133             if (dma != s->dma || hdma != s->hdma) {
1134                 qemu_log_mask(LOG_GUEST_ERROR, "attempt to change DMA 8bit"
1135                               " %d(%d), 16bit %d(%d) (val=0x%x)\n", dma, s->dma,
1136                               hdma, s->hdma, val);
1137             }
1138 #if 0
1139             s->dma = dma;
1140             s->hdma = hdma;
1141 #endif
1142         }
1143         break;
1144 
1145     case 0x82:
1146         qemu_log_mask(LOG_GUEST_ERROR, "attempt to write into IRQ status"
1147                       " register (val=0x%x)\n", val);
1148         return;
1149 
1150     default:
1151         if (s->mixer_nreg >= 0x80) {
1152             ldebug("attempt to write mixer[0x%x] <- 0x%x", s->mixer_nreg, val);
1153         }
1154         break;
1155     }
1156 
1157     s->mixer_regs[s->mixer_nreg] = val;
1158 }
1159 
1160 static uint32_t mixer_read(void *opaque, uint32_t nport)
1161 {
1162     SB16State *s = opaque;
1163 
1164     (void) nport;
1165 #ifndef DEBUG_SB16_MOST
1166     if (s->mixer_nreg != 0x82) {
1167         ldebug("mixer_read[0x%x] -> 0x%x",
1168                 s->mixer_nreg, s->mixer_regs[s->mixer_nreg]);
1169     }
1170 #else
1171     ldebug("mixer_read[0x%x] -> 0x%x",
1172             s->mixer_nreg, s->mixer_regs[s->mixer_nreg]);
1173 #endif
1174     return s->mixer_regs[s->mixer_nreg];
1175 }
1176 
1177 static int write_audio (SB16State *s, int nchan, int dma_pos,
1178                         int dma_len, int len)
1179 {
1180     IsaDma *isa_dma = nchan == s->dma ? s->isa_dma : s->isa_hdma;
1181     IsaDmaClass *k = ISADMA_GET_CLASS(isa_dma);
1182     int temp, net;
1183     QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
1184 
1185     temp = len;
1186     net = 0;
1187 
1188     while (temp) {
1189         int left = dma_len - dma_pos;
1190         int copied;
1191         size_t to_copy;
1192 
1193         to_copy = MIN (temp, left);
1194         if (to_copy > sizeof (tmpbuf)) {
1195             to_copy = sizeof (tmpbuf);
1196         }
1197 
1198         copied = k->read_memory(isa_dma, nchan, tmpbuf, dma_pos, to_copy);
1199         copied = AUD_write (s->voice, tmpbuf, copied);
1200 
1201         temp -= copied;
1202         dma_pos = (dma_pos + copied) % dma_len;
1203         net += copied;
1204 
1205         if (!copied) {
1206             break;
1207         }
1208     }
1209 
1210     return net;
1211 }
1212 
1213 static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len)
1214 {
1215     SB16State *s = opaque;
1216     int till, copy, written, free;
1217 
1218     if (s->block_size <= 0) {
1219         qemu_log_mask(LOG_GUEST_ERROR, "invalid block size=%d nchan=%d"
1220                       " dma_pos=%d dma_len=%d\n", s->block_size, nchan,
1221                       dma_pos, dma_len);
1222         return dma_pos;
1223     }
1224 
1225     if (s->left_till_irq < 0) {
1226         s->left_till_irq = s->block_size;
1227     }
1228 
1229     if (s->voice) {
1230         free = s->audio_free & ~s->align;
1231         if ((free <= 0) || !dma_len) {
1232             return dma_pos;
1233         }
1234     }
1235     else {
1236         free = dma_len;
1237     }
1238 
1239     copy = free;
1240     till = s->left_till_irq;
1241 
1242 #ifdef DEBUG_SB16_MOST
1243     warn_report("sb16: pos:%06d %d till:%d len:%d",
1244            dma_pos, free, till, dma_len);
1245 #endif
1246 
1247     if (till <= copy) {
1248         if (s->dma_auto == 0) {
1249             copy = till;
1250         }
1251     }
1252 
1253     written = write_audio (s, nchan, dma_pos, dma_len, copy);
1254     dma_pos = (dma_pos + written) % dma_len;
1255     s->left_till_irq -= written;
1256 
1257     if (s->left_till_irq <= 0) {
1258         s->mixer_regs[0x82] |= (nchan & 4) ? 2 : 1;
1259         qemu_irq_raise (s->pic);
1260         if (s->dma_auto == 0) {
1261             control (s, 0);
1262             speaker (s, 0);
1263         }
1264     }
1265 
1266 #ifdef DEBUG_SB16_MOST
1267     ldebug("pos %5d free %5d size %5d till % 5d copy %5d written %5d size %5d",
1268             dma_pos, free, dma_len, s->left_till_irq, copy, written,
1269             s->block_size);
1270 #endif
1271 
1272     while (s->left_till_irq <= 0) {
1273         s->left_till_irq = s->block_size + s->left_till_irq;
1274     }
1275 
1276     return dma_pos;
1277 }
1278 
1279 static void SB_audio_callback (void *opaque, int free)
1280 {
1281     SB16State *s = opaque;
1282     s->audio_free = free;
1283 }
1284 
1285 static int sb16_post_load (void *opaque, int version_id)
1286 {
1287     SB16State *s = opaque;
1288 
1289     if (s->voice) {
1290         AUD_close_out(s->audio_be, s->voice);
1291         s->voice = NULL;
1292     }
1293 
1294     if (s->dma_running) {
1295         if (s->freq) {
1296             struct audsettings as;
1297 
1298             s->audio_free = 0;
1299 
1300             as.freq = s->freq;
1301             as.nchannels = 1 << s->fmt_stereo;
1302             as.fmt = s->fmt;
1303             as.endianness = 0;
1304 
1305             s->voice = AUD_open_out (
1306                 s->audio_be,
1307                 s->voice,
1308                 "sb16",
1309                 s,
1310                 SB_audio_callback,
1311                 &as
1312                 );
1313         }
1314 
1315         control (s, 1);
1316         speaker (s, s->speaker);
1317     }
1318     return 0;
1319 }
1320 
1321 static const VMStateDescription vmstate_sb16 = {
1322     .name = "sb16",
1323     .version_id = 1,
1324     .minimum_version_id = 1,
1325     .post_load = sb16_post_load,
1326     .fields = (const VMStateField[]) {
1327         VMSTATE_UNUSED(  4 /* irq */
1328                        + 4 /* dma */
1329                        + 4 /* hdma */
1330                        + 4 /* port */
1331                        + 4 /* ver */),
1332         VMSTATE_INT32 (in_index, SB16State),
1333         VMSTATE_INT32 (out_data_len, SB16State),
1334         VMSTATE_INT32 (fmt_stereo, SB16State),
1335         VMSTATE_INT32 (fmt_signed, SB16State),
1336         VMSTATE_INT32 (fmt_bits, SB16State),
1337         VMSTATE_UINT32 (fmt, SB16State),
1338         VMSTATE_INT32 (dma_auto, SB16State),
1339         VMSTATE_INT32 (block_size, SB16State),
1340         VMSTATE_INT32 (fifo, SB16State),
1341         VMSTATE_INT32 (freq, SB16State),
1342         VMSTATE_INT32 (time_const, SB16State),
1343         VMSTATE_INT32 (speaker, SB16State),
1344         VMSTATE_INT32 (needed_bytes, SB16State),
1345         VMSTATE_INT32 (cmd, SB16State),
1346         VMSTATE_INT32 (use_hdma, SB16State),
1347         VMSTATE_INT32 (highspeed, SB16State),
1348         VMSTATE_INT32 (can_write, SB16State),
1349         VMSTATE_INT32 (v2x6, SB16State),
1350 
1351         VMSTATE_UINT8 (csp_param, SB16State),
1352         VMSTATE_UINT8 (csp_value, SB16State),
1353         VMSTATE_UINT8 (csp_mode, SB16State),
1354         VMSTATE_UINT8 (csp_param, SB16State),
1355         VMSTATE_BUFFER (csp_regs, SB16State),
1356         VMSTATE_UINT8 (csp_index, SB16State),
1357         VMSTATE_BUFFER (csp_reg83, SB16State),
1358         VMSTATE_INT32 (csp_reg83r, SB16State),
1359         VMSTATE_INT32 (csp_reg83w, SB16State),
1360 
1361         VMSTATE_BUFFER (in2_data, SB16State),
1362         VMSTATE_BUFFER (out_data, SB16State),
1363         VMSTATE_UINT8 (test_reg, SB16State),
1364         VMSTATE_UINT8 (last_read_byte, SB16State),
1365 
1366         VMSTATE_INT32 (nzero, SB16State),
1367         VMSTATE_INT32 (left_till_irq, SB16State),
1368         VMSTATE_INT32 (dma_running, SB16State),
1369         VMSTATE_INT32 (bytes_per_second, SB16State),
1370         VMSTATE_INT32 (align, SB16State),
1371 
1372         VMSTATE_INT32 (mixer_nreg, SB16State),
1373         VMSTATE_BUFFER (mixer_regs, SB16State),
1374 
1375         VMSTATE_END_OF_LIST ()
1376     }
1377 };
1378 
1379 static const MemoryRegionPortio sb16_ioport_list[] = {
1380     {  4, 1, 1, .write = mixer_write_indexb },
1381     {  5, 1, 1, .read = mixer_read, .write = mixer_write_datab },
1382     {  6, 1, 1, .read = dsp_read, .write = dsp_write },
1383     { 10, 1, 1, .read = dsp_read },
1384     { 12, 1, 1, .write = dsp_write },
1385     { 12, 4, 1, .read = dsp_read },
1386     PORTIO_END_OF_LIST (),
1387 };
1388 
1389 
1390 static void sb16_initfn (Object *obj)
1391 {
1392     SB16State *s = SB16 (obj);
1393 
1394     s->cmd = -1;
1395 }
1396 
1397 static void sb16_realizefn (DeviceState *dev, Error **errp)
1398 {
1399     ISADevice *isadev = ISA_DEVICE (dev);
1400     ISABus *bus = isa_bus_from_device(isadev);
1401     SB16State *s = SB16 (dev);
1402     IsaDmaClass *k;
1403 
1404     if (!AUD_backend_check(&s->audio_be, errp)) {
1405         return;
1406     }
1407 
1408     s->isa_hdma = isa_bus_get_dma(bus, s->hdma);
1409     s->isa_dma = isa_bus_get_dma(bus, s->dma);
1410     if (!s->isa_dma || !s->isa_hdma) {
1411         error_setg(errp, "ISA controller does not support DMA");
1412         return;
1413     }
1414 
1415     s->pic = isa_bus_get_irq(bus, s->irq);
1416 
1417     s->mixer_regs[0x80] = magic_of_irq (s->irq);
1418     s->mixer_regs[0x81] = (1 << s->dma) | (1 << s->hdma);
1419     s->mixer_regs[0x82] = 2 << 5;
1420 
1421     s->csp_regs[5] = 1;
1422     s->csp_regs[9] = 0xf8;
1423 
1424     reset_mixer (s);
1425     s->aux_ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, aux_timer, s);
1426     if (!s->aux_ts) {
1427         error_setg(errp, "warning: Could not create auxiliary timer");
1428     }
1429 
1430     isa_register_portio_list(isadev, &s->portio_list, s->port,
1431                              sb16_ioport_list, s, "sb16");
1432 
1433     k = ISADMA_GET_CLASS(s->isa_hdma);
1434     k->register_channel(s->isa_hdma, s->hdma, SB_read_DMA, s);
1435 
1436     k = ISADMA_GET_CLASS(s->isa_dma);
1437     k->register_channel(s->isa_dma, s->dma, SB_read_DMA, s);
1438 
1439     s->can_write = 1;
1440 }
1441 
1442 static const Property sb16_properties[] = {
1443     DEFINE_AUDIO_PROPERTIES(SB16State, audio_be),
1444     DEFINE_PROP_UINT32 ("version", SB16State, ver,  0x0405), /* 4.5 */
1445     DEFINE_PROP_UINT32 ("iobase",  SB16State, port, 0x220),
1446     DEFINE_PROP_UINT32 ("irq",     SB16State, irq,  5),
1447     DEFINE_PROP_UINT32 ("dma",     SB16State, dma,  1),
1448     DEFINE_PROP_UINT32 ("dma16",   SB16State, hdma, 5),
1449 };
1450 
1451 static void sb16_class_initfn(ObjectClass *klass, const void *data)
1452 {
1453     DeviceClass *dc = DEVICE_CLASS (klass);
1454 
1455     dc->realize = sb16_realizefn;
1456     set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
1457     dc->desc = "Creative Sound Blaster 16";
1458     dc->vmsd = &vmstate_sb16;
1459     device_class_set_props(dc, sb16_properties);
1460 }
1461 
1462 static const TypeInfo sb16_info = {
1463     .name          = TYPE_SB16,
1464     .parent        = TYPE_ISA_DEVICE,
1465     .instance_size = sizeof (SB16State),
1466     .instance_init = sb16_initfn,
1467     .class_init    = sb16_class_initfn,
1468 };
1469 
1470 static void sb16_register_types (void)
1471 {
1472     type_register_static (&sb16_info);
1473     audio_register_model("sb16", "Creative Sound Blaster 16", TYPE_SB16);
1474 }
1475 
1476 type_init (sb16_register_types)
1477