xref: /openbmc/qemu/hw/m68k/next-cube.c (revision 646b5378)
1 /*
2  * NeXT Cube System Driver
3  *
4  * Copyright (c) 2011 Bryce Lanham
5  *
6  * This code is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published
8  * by the Free Software Foundation; either version 2 of the License,
9  * or (at your option) any later version.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "exec/hwaddr.h"
14 #include "sysemu/sysemu.h"
15 #include "sysemu/qtest.h"
16 #include "hw/irq.h"
17 #include "hw/m68k/next-cube.h"
18 #include "hw/boards.h"
19 #include "hw/loader.h"
20 #include "hw/scsi/esp.h"
21 #include "hw/sysbus.h"
22 #include "qom/object.h"
23 #include "hw/char/escc.h" /* ZILOG 8530 Serial Emulation */
24 #include "hw/block/fdc.h"
25 #include "hw/qdev-properties.h"
26 #include "qapi/error.h"
27 #include "qemu/error-report.h"
28 #include "ui/console.h"
29 #include "target/m68k/cpu.h"
30 #include "migration/vmstate.h"
31 
32 /* #define DEBUG_NEXT */
33 #ifdef DEBUG_NEXT
34 #define DPRINTF(fmt, ...) \
35     do { printf("NeXT: " fmt , ## __VA_ARGS__); } while (0)
36 #else
37 #define DPRINTF(fmt, ...) do { } while (0)
38 #endif
39 
40 #define TYPE_NEXT_MACHINE MACHINE_TYPE_NAME("next-cube")
41 OBJECT_DECLARE_SIMPLE_TYPE(NeXTState, NEXT_MACHINE)
42 
43 #define ENTRY       0x0100001e
44 #define RAM_SIZE    0x4000000
45 #define ROM_FILE    "Rev_2.5_v66.bin"
46 
47 typedef struct next_dma {
48     uint32_t csr;
49 
50     uint32_t saved_next;
51     uint32_t saved_limit;
52     uint32_t saved_start;
53     uint32_t saved_stop;
54 
55     uint32_t next;
56     uint32_t limit;
57     uint32_t start;
58     uint32_t stop;
59 
60     uint32_t next_initbuf;
61     uint32_t size;
62 } next_dma;
63 
64 typedef struct NextRtc {
65     int8_t phase;
66     uint8_t ram[32];
67     uint8_t command;
68     uint8_t value;
69     uint8_t status;
70     uint8_t control;
71     uint8_t retval;
72 } NextRtc;
73 
74 struct NeXTState {
75     MachineState parent;
76 
77     MemoryRegion rom;
78     MemoryRegion rom2;
79     MemoryRegion dmamem;
80     MemoryRegion bmapm1;
81     MemoryRegion bmapm2;
82 
83     next_dma dma[10];
84 };
85 
86 #define TYPE_NEXT_PC "next-pc"
87 OBJECT_DECLARE_SIMPLE_TYPE(NeXTPC, NEXT_PC)
88 
89 /* NeXT Peripheral Controller */
90 struct NeXTPC {
91     SysBusDevice parent_obj;
92 
93     M68kCPU *cpu;
94 
95     MemoryRegion mmiomem;
96     MemoryRegion scrmem;
97 
98     uint32_t scr1;
99     uint32_t scr2;
100     uint32_t old_scr2;
101     uint32_t int_mask;
102     uint32_t int_status;
103     uint32_t led;
104     uint8_t scsi_csr_1;
105     uint8_t scsi_csr_2;
106 
107     qemu_irq scsi_reset;
108     qemu_irq scsi_dma;
109 
110     NextRtc rtc;
111 };
112 
113 /* Thanks to NeXT forums for this */
114 /*
115 static const uint8_t rtc_ram3[32] = {
116     0x94, 0x0f, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
117     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x7B, 0x00,
118     0x00, 0x00, 0x65, 0x6e, 0x00, 0x00, 0x00, 0x00,
119     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x13
120 };
121 */
122 static const uint8_t rtc_ram2[32] = {
123     0x94, 0x0f, 0x40, 0x03, 0x00, 0x00, 0x00, 0x00,
124     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x4b, 0x00,
125     0x41, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
126     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x7e,
127 };
128 
129 #define SCR2_RTCLK 0x2
130 #define SCR2_RTDATA 0x4
131 #define SCR2_TOBCD(x) (((x / 10) << 4) + (x % 10))
132 
133 static void next_scr2_led_update(NeXTPC *s)
134 {
135     if (s->scr2 & 0x1) {
136         DPRINTF("fault!\n");
137         s->led++;
138         if (s->led == 10) {
139             DPRINTF("LED flashing, possible fault!\n");
140             s->led = 0;
141         }
142     }
143 }
144 
145 static void next_scr2_rtc_update(NeXTPC *s)
146 {
147     uint8_t old_scr2, scr2_2;
148     NextRtc *rtc = &s->rtc;
149 
150     old_scr2 = extract32(s->old_scr2, 8, 8);
151     scr2_2 = extract32(s->scr2, 8, 8);
152 
153     if (scr2_2 & 0x1) {
154         /* DPRINTF("RTC %x phase %i\n", scr2_2, rtc->phase); */
155         if (rtc->phase == -1) {
156             rtc->phase = 0;
157         }
158         /* If we are in going down clock... do something */
159         if (((old_scr2 & SCR2_RTCLK) != (scr2_2 & SCR2_RTCLK)) &&
160                 ((scr2_2 & SCR2_RTCLK) == 0)) {
161             if (rtc->phase < 8) {
162                 rtc->command = (rtc->command << 1) |
163                                ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
164             }
165             if (rtc->phase >= 8 && rtc->phase < 16) {
166                 rtc->value = (rtc->value << 1) |
167                              ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
168 
169                 /* if we read RAM register, output RT_DATA bit */
170                 if (rtc->command <= 0x1F) {
171                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
172                     if (rtc->ram[rtc->command] & (0x80 >> (rtc->phase - 8))) {
173                         scr2_2 |= SCR2_RTDATA;
174                     }
175 
176                     rtc->retval = (rtc->retval << 1) |
177                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
178                 }
179                 /* read the status 0x30 */
180                 if (rtc->command == 0x30) {
181                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
182                     /* for now status = 0x98 (new rtc + FTU) */
183                     if (rtc->status & (0x80 >> (rtc->phase - 8))) {
184                         scr2_2 |= SCR2_RTDATA;
185                     }
186 
187                     rtc->retval = (rtc->retval << 1) |
188                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
189                 }
190                 /* read the status 0x31 */
191                 if (rtc->command == 0x31) {
192                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
193                     if (rtc->control & (0x80 >> (rtc->phase - 8))) {
194                         scr2_2 |= SCR2_RTDATA;
195                     }
196                     rtc->retval = (rtc->retval << 1) |
197                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
198                 }
199 
200                 if ((rtc->command >= 0x20) && (rtc->command <= 0x2F)) {
201                     scr2_2 = scr2_2 & (~SCR2_RTDATA);
202                     /* for now 0x00 */
203                     time_t time_h = time(NULL);
204                     struct tm *info = localtime(&time_h);
205                     int ret = 0;
206 
207                     switch (rtc->command) {
208                     case 0x20:
209                         ret = SCR2_TOBCD(info->tm_sec);
210                         break;
211                     case 0x21:
212                         ret = SCR2_TOBCD(info->tm_min);
213                         break;
214                     case 0x22:
215                         ret = SCR2_TOBCD(info->tm_hour);
216                         break;
217                     case 0x24:
218                         ret = SCR2_TOBCD(info->tm_mday);
219                         break;
220                     case 0x25:
221                         ret = SCR2_TOBCD((info->tm_mon + 1));
222                         break;
223                     case 0x26:
224                         ret = SCR2_TOBCD((info->tm_year - 100));
225                         break;
226 
227                     }
228 
229                     if (ret & (0x80 >> (rtc->phase - 8))) {
230                         scr2_2 |= SCR2_RTDATA;
231                     }
232                     rtc->retval = (rtc->retval << 1) |
233                                   ((scr2_2 & SCR2_RTDATA) ? 1 : 0);
234                 }
235 
236             }
237 
238             rtc->phase++;
239             if (rtc->phase == 16) {
240                 if (rtc->command >= 0x80 && rtc->command <= 0x9F) {
241                     rtc->ram[rtc->command - 0x80] = rtc->value;
242                 }
243                 /* write to x30 register */
244                 if (rtc->command == 0xB1) {
245                     /* clear FTU */
246                     if (rtc->value & 0x04) {
247                         rtc->status = rtc->status & (~0x18);
248                         s->int_status = s->int_status & (~0x04);
249                     }
250                 }
251             }
252         }
253     } else {
254         /* else end or abort */
255         rtc->phase = -1;
256         rtc->command = 0;
257         rtc->value = 0;
258     }
259 
260     s->scr2 = deposit32(s->scr2, 8, 8, scr2_2);
261 }
262 
263 static uint64_t next_mmio_read(void *opaque, hwaddr addr, unsigned size)
264 {
265     NeXTPC *s = NEXT_PC(opaque);
266     uint64_t val;
267 
268     switch (addr) {
269     case 0x7000:
270         /* DPRINTF("Read INT status: %x\n", s->int_status); */
271         val = s->int_status;
272         break;
273 
274     case 0x7800:
275         DPRINTF("MMIO Read INT mask: %x\n", s->int_mask);
276         val = s->int_mask;
277         break;
278 
279     case 0xc000 ... 0xc003:
280         val = extract32(s->scr1, (4 - (addr - 0xc000) - size) << 3,
281                         size << 3);
282         break;
283 
284     case 0xd000 ... 0xd003:
285         val = extract32(s->scr2, (4 - (addr - 0xd000) - size) << 3,
286                         size << 3);
287         break;
288 
289     case 0x14020:
290         val = 0x7f;
291         break;
292 
293     default:
294         val = 0;
295         DPRINTF("MMIO Read @ 0x%"HWADDR_PRIx" size %d\n", addr, size);
296         break;
297     }
298 
299     return val;
300 }
301 
302 static void next_mmio_write(void *opaque, hwaddr addr, uint64_t val,
303                             unsigned size)
304 {
305     NeXTPC *s = NEXT_PC(opaque);
306 
307     switch (addr) {
308     case 0x7000:
309         DPRINTF("INT Status old: %x new: %x\n", s->int_status,
310                 (unsigned int)val);
311         s->int_status = val;
312         break;
313 
314     case 0x7800:
315         DPRINTF("INT Mask old: %x new: %x\n", s->int_mask, (unsigned int)val);
316         s->int_mask  = val;
317         break;
318 
319     case 0xc000 ... 0xc003:
320         DPRINTF("SCR1 Write: %x\n", (unsigned int)val);
321         s->scr1 = deposit32(s->scr1, (4 - (addr - 0xc000) - size) << 3,
322                             size << 3, val);
323         break;
324 
325     case 0xd000 ... 0xd003:
326         s->scr2 = deposit32(s->scr2, (4 - (addr - 0xd000) - size) << 3,
327                             size << 3, val);
328         next_scr2_led_update(s);
329         next_scr2_rtc_update(s);
330         s->old_scr2 = s->scr2;
331         break;
332 
333     default:
334         DPRINTF("MMIO Write @ 0x%"HWADDR_PRIx " with 0x%x size %u\n", addr,
335                 (unsigned int)val, size);
336     }
337 }
338 
339 static const MemoryRegionOps next_mmio_ops = {
340     .read = next_mmio_read,
341     .write = next_mmio_write,
342     .valid.min_access_size = 1,
343     .valid.max_access_size = 4,
344     .endianness = DEVICE_BIG_ENDIAN,
345 };
346 
347 #define SCSICSR_ENABLE  0x01
348 #define SCSICSR_RESET   0x02  /* reset scsi dma */
349 #define SCSICSR_FIFOFL  0x04
350 #define SCSICSR_DMADIR  0x08  /* if set, scsi to mem */
351 #define SCSICSR_CPUDMA  0x10  /* if set, dma enabled */
352 #define SCSICSR_INTMASK 0x20  /* if set, interrupt enabled */
353 
354 static uint64_t next_scr_readfn(void *opaque, hwaddr addr, unsigned size)
355 {
356     NeXTPC *s = NEXT_PC(opaque);
357     uint64_t val;
358 
359     switch (addr) {
360     case 0x14108:
361         DPRINTF("FD read @ %x\n", (unsigned int)addr);
362         val = 0x40 | 0x04 | 0x2 | 0x1;
363         break;
364 
365     case 0x14020:
366         DPRINTF("SCSI 4020  STATUS READ %X\n", s->scsi_csr_1);
367         val = s->scsi_csr_1;
368         break;
369 
370     case 0x14021:
371         DPRINTF("SCSI 4021 STATUS READ %X\n", s->scsi_csr_2);
372         val = 0x40;
373         break;
374 
375     /*
376      * These 4 registers are the hardware timer, not sure which register
377      * is the latch instead of data, but no problems so far.
378      *
379      * Hack: We need to have the LSB change consistently to make it work
380      */
381     case 0x1a000 ... 0x1a003:
382         val = extract32(clock(), (4 - (addr - 0x1a000) - size) << 3,
383                         size << 3);
384         break;
385 
386     /* For now return dummy byte to allow the Ethernet test to timeout */
387     case 0x6000:
388         val = 0xff;
389         break;
390 
391     default:
392         DPRINTF("BMAP Read @ 0x%x size %u\n", (unsigned int)addr, size);
393         val = 0;
394         break;
395     }
396 
397     return val;
398 }
399 
400 static void next_scr_writefn(void *opaque, hwaddr addr, uint64_t val,
401                              unsigned size)
402 {
403     NeXTPC *s = NEXT_PC(opaque);
404 
405     switch (addr) {
406     case 0x14108:
407         DPRINTF("FDCSR Write: %"PRIx64 "\n", val);
408         if (val == 0x0) {
409             /* qemu_irq_raise(s->fd_irq[0]); */
410         }
411         break;
412 
413     case 0x14020: /* SCSI Control Register */
414         if (val & SCSICSR_FIFOFL) {
415             DPRINTF("SCSICSR FIFO Flush\n");
416             /* will have to add another irq to the esp if this is needed */
417             /* esp_puflush_fifo(esp_g); */
418         }
419 
420         if (val & SCSICSR_ENABLE) {
421             DPRINTF("SCSICSR Enable\n");
422             /*
423              * qemu_irq_raise(s->scsi_dma);
424              * s->scsi_csr_1 = 0xc0;
425              * s->scsi_csr_1 |= 0x1;
426              * qemu_irq_pulse(s->scsi_dma);
427              */
428         }
429         /*
430          * else
431          *     s->scsi_csr_1 &= ~SCSICSR_ENABLE;
432          */
433 
434         if (val & SCSICSR_RESET) {
435             DPRINTF("SCSICSR Reset\n");
436             /* I think this should set DMADIR. CPUDMA and INTMASK to 0 */
437             qemu_irq_raise(s->scsi_reset);
438             s->scsi_csr_1 &= ~(SCSICSR_INTMASK | 0x80 | 0x1);
439             qemu_irq_lower(s->scsi_reset);
440         }
441         if (val & SCSICSR_DMADIR) {
442             DPRINTF("SCSICSR DMAdir\n");
443         }
444         if (val & SCSICSR_CPUDMA) {
445             DPRINTF("SCSICSR CPUDMA\n");
446             /* qemu_irq_raise(s->scsi_dma); */
447             s->int_status |= 0x4000000;
448         } else {
449             /* fprintf(stderr,"SCSICSR CPUDMA disabled\n"); */
450             s->int_status &= ~(0x4000000);
451             /* qemu_irq_lower(s->scsi_dma); */
452         }
453         if (val & SCSICSR_INTMASK) {
454             DPRINTF("SCSICSR INTMASK\n");
455             /*
456              * int_mask &= ~0x1000;
457              * s->scsi_csr_1 |= val;
458              * s->scsi_csr_1 &= ~SCSICSR_INTMASK;
459              * if (s->scsi_queued) {
460              *     s->scsi_queued = 0;
461              *     next_irq(s, NEXT_SCSI_I, level);
462              * }
463              */
464         } else {
465             /* int_mask |= 0x1000; */
466         }
467         if (val & 0x80) {
468             /* int_mask |= 0x1000; */
469             /* s->scsi_csr_1 |= 0x80; */
470         }
471         DPRINTF("SCSICSR Write: %"PRIx64 "\n", val);
472         /* s->scsi_csr_1 = val; */
473         break;
474 
475     /* Hardware timer latch - not implemented yet */
476     case 0x1a000:
477     default:
478         DPRINTF("BMAP Write @ 0x%x with 0x%"PRIx64 " size %u\n",
479                 (unsigned int)addr, val, size);
480     }
481 }
482 
483 static const MemoryRegionOps next_scr_ops = {
484     .read = next_scr_readfn,
485     .write = next_scr_writefn,
486     .valid.min_access_size = 1,
487     .valid.max_access_size = 4,
488     .endianness = DEVICE_BIG_ENDIAN,
489 };
490 
491 #define NEXTDMA_SCSI(x)      (0x10 + x)
492 #define NEXTDMA_FD(x)        (0x10 + x)
493 #define NEXTDMA_ENTX(x)      (0x110 + x)
494 #define NEXTDMA_ENRX(x)      (0x150 + x)
495 #define NEXTDMA_CSR          0x0
496 #define NEXTDMA_NEXT         0x4000
497 #define NEXTDMA_LIMIT        0x4004
498 #define NEXTDMA_START        0x4008
499 #define NEXTDMA_STOP         0x400c
500 #define NEXTDMA_NEXT_INIT    0x4200
501 #define NEXTDMA_SIZE         0x4204
502 
503 static void next_dma_write(void *opaque, hwaddr addr, uint64_t val,
504                            unsigned int size)
505 {
506     NeXTState *next_state = NEXT_MACHINE(opaque);
507 
508     switch (addr) {
509     case NEXTDMA_ENRX(NEXTDMA_CSR):
510         if (val & DMA_DEV2M) {
511             next_state->dma[NEXTDMA_ENRX].csr |= DMA_DEV2M;
512         }
513 
514         if (val & DMA_SETENABLE) {
515             /* DPRINTF("SCSI DMA ENABLE\n"); */
516             next_state->dma[NEXTDMA_ENRX].csr |= DMA_ENABLE;
517         }
518         if (val & DMA_SETSUPDATE) {
519             next_state->dma[NEXTDMA_ENRX].csr |= DMA_SUPDATE;
520         }
521         if (val & DMA_CLRCOMPLETE) {
522             next_state->dma[NEXTDMA_ENRX].csr &= ~DMA_COMPLETE;
523         }
524 
525         if (val & DMA_RESET) {
526             next_state->dma[NEXTDMA_ENRX].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
527                                                   DMA_ENABLE | DMA_DEV2M);
528         }
529         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
530         break;
531 
532     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
533         next_state->dma[NEXTDMA_ENRX].next_initbuf = val;
534         break;
535 
536     case NEXTDMA_ENRX(NEXTDMA_NEXT):
537         next_state->dma[NEXTDMA_ENRX].next = val;
538         break;
539 
540     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
541         next_state->dma[NEXTDMA_ENRX].limit = val;
542         break;
543 
544     case NEXTDMA_SCSI(NEXTDMA_CSR):
545         if (val & DMA_DEV2M) {
546             next_state->dma[NEXTDMA_SCSI].csr |= DMA_DEV2M;
547         }
548         if (val & DMA_SETENABLE) {
549             /* DPRINTF("SCSI DMA ENABLE\n"); */
550             next_state->dma[NEXTDMA_SCSI].csr |= DMA_ENABLE;
551         }
552         if (val & DMA_SETSUPDATE) {
553             next_state->dma[NEXTDMA_SCSI].csr |= DMA_SUPDATE;
554         }
555         if (val & DMA_CLRCOMPLETE) {
556             next_state->dma[NEXTDMA_SCSI].csr &= ~DMA_COMPLETE;
557         }
558 
559         if (val & DMA_RESET) {
560             next_state->dma[NEXTDMA_SCSI].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
561                                                   DMA_ENABLE | DMA_DEV2M);
562             /* DPRINTF("SCSI DMA RESET\n"); */
563         }
564         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
565         break;
566 
567     case NEXTDMA_SCSI(NEXTDMA_NEXT):
568         next_state->dma[NEXTDMA_SCSI].next = val;
569         break;
570 
571     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
572         next_state->dma[NEXTDMA_SCSI].limit = val;
573         break;
574 
575     case NEXTDMA_SCSI(NEXTDMA_START):
576         next_state->dma[NEXTDMA_SCSI].start = val;
577         break;
578 
579     case NEXTDMA_SCSI(NEXTDMA_STOP):
580         next_state->dma[NEXTDMA_SCSI].stop = val;
581         break;
582 
583     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
584         next_state->dma[NEXTDMA_SCSI].next_initbuf = val;
585         break;
586 
587     default:
588         DPRINTF("DMA write @ %x w/ %x\n", (unsigned)addr, (unsigned)val);
589     }
590 }
591 
592 static uint64_t next_dma_read(void *opaque, hwaddr addr, unsigned int size)
593 {
594     NeXTState *next_state = NEXT_MACHINE(opaque);
595     uint64_t val;
596 
597     switch (addr) {
598     case NEXTDMA_SCSI(NEXTDMA_CSR):
599         DPRINTF("SCSI DMA CSR READ\n");
600         val = next_state->dma[NEXTDMA_SCSI].csr;
601         break;
602 
603     case NEXTDMA_ENRX(NEXTDMA_CSR):
604         val = next_state->dma[NEXTDMA_ENRX].csr;
605         break;
606 
607     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
608         val = next_state->dma[NEXTDMA_ENRX].next_initbuf;
609         break;
610 
611     case NEXTDMA_ENRX(NEXTDMA_NEXT):
612         val = next_state->dma[NEXTDMA_ENRX].next;
613         break;
614 
615     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
616         val = next_state->dma[NEXTDMA_ENRX].limit;
617         break;
618 
619     case NEXTDMA_SCSI(NEXTDMA_NEXT):
620         val = next_state->dma[NEXTDMA_SCSI].next;
621         break;
622 
623     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
624         val = next_state->dma[NEXTDMA_SCSI].next_initbuf;
625         break;
626 
627     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
628         val = next_state->dma[NEXTDMA_SCSI].limit;
629         break;
630 
631     case NEXTDMA_SCSI(NEXTDMA_START):
632         val = next_state->dma[NEXTDMA_SCSI].start;
633         break;
634 
635     case NEXTDMA_SCSI(NEXTDMA_STOP):
636         val = next_state->dma[NEXTDMA_SCSI].stop;
637         break;
638 
639     default:
640         DPRINTF("DMA read @ %x\n", (unsigned int)addr);
641         val = 0;
642     }
643 
644     /*
645      * once the csr's are done, subtract 0x3FEC from the addr, and that will
646      * normalize the upper registers
647      */
648 
649     return val;
650 }
651 
652 static const MemoryRegionOps next_dma_ops = {
653     .read = next_dma_read,
654     .write = next_dma_write,
655     .impl.min_access_size = 4,
656     .valid.min_access_size = 4,
657     .valid.max_access_size = 4,
658     .endianness = DEVICE_BIG_ENDIAN,
659 };
660 
661 static void next_irq(void *opaque, int number, int level)
662 {
663     NeXTPC *s = NEXT_PC(opaque);
664     M68kCPU *cpu = s->cpu;
665     int shift = 0;
666 
667     /* first switch sets interrupt status */
668     /* DPRINTF("IRQ %i\n",number); */
669     switch (number) {
670     /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
671     case NEXT_FD_I:
672         shift = 7;
673         break;
674     case NEXT_KBD_I:
675         shift = 3;
676         break;
677     case NEXT_PWR_I:
678         shift = 2;
679         break;
680     case NEXT_ENRX_I:
681         shift = 9;
682         break;
683     case NEXT_ENTX_I:
684         shift = 10;
685         break;
686     case NEXT_SCSI_I:
687         shift = 12;
688         break;
689     case NEXT_CLK_I:
690         shift = 5;
691         break;
692 
693     /* level 5 - scc (serial) */
694     case NEXT_SCC_I:
695         shift = 17;
696         break;
697 
698     /* level 6 - audio etherrx/tx dma */
699     case NEXT_ENTX_DMA_I:
700         shift = 28;
701         break;
702     case NEXT_ENRX_DMA_I:
703         shift = 27;
704         break;
705     case NEXT_SCSI_DMA_I:
706         shift = 26;
707         break;
708     case NEXT_SND_I:
709         shift = 23;
710         break;
711     case NEXT_SCC_DMA_I:
712         shift = 21;
713         break;
714 
715     }
716     /*
717      * this HAS to be wrong, the interrupt handlers in mach and together
718      * int_status and int_mask and return if there is a hit
719      */
720     if (s->int_mask & (1 << shift)) {
721         DPRINTF("%x interrupt masked @ %x\n", 1 << shift, cpu->env.pc);
722         /* return; */
723     }
724 
725     /* second switch triggers the correct interrupt */
726     if (level) {
727         s->int_status |= 1 << shift;
728 
729         switch (number) {
730         /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
731         case NEXT_FD_I:
732         case NEXT_KBD_I:
733         case NEXT_PWR_I:
734         case NEXT_ENRX_I:
735         case NEXT_ENTX_I:
736         case NEXT_SCSI_I:
737         case NEXT_CLK_I:
738             m68k_set_irq_level(cpu, 3, 27);
739             break;
740 
741         /* level 5 - scc (serial) */
742         case NEXT_SCC_I:
743             m68k_set_irq_level(cpu, 5, 29);
744             break;
745 
746         /* level 6 - audio etherrx/tx dma */
747         case NEXT_ENTX_DMA_I:
748         case NEXT_ENRX_DMA_I:
749         case NEXT_SCSI_DMA_I:
750         case NEXT_SND_I:
751         case NEXT_SCC_DMA_I:
752             m68k_set_irq_level(cpu, 6, 30);
753             break;
754         }
755     } else {
756         s->int_status &= ~(1 << shift);
757         cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
758     }
759 }
760 
761 static void nextdma_write(void *opaque, uint8_t *buf, int size, int type)
762 {
763     uint32_t base_addr;
764     int irq = 0;
765     uint8_t align = 16;
766     NeXTState *next_state = NEXT_MACHINE(qdev_get_machine());
767 
768     if (type == NEXTDMA_ENRX || type == NEXTDMA_ENTX) {
769         align = 32;
770     }
771     /* Most DMA is supposedly 16 byte aligned */
772     if ((size % align) != 0) {
773         size -= size % align;
774         size += align;
775     }
776 
777     /*
778      * prom sets the dma start using initbuf while the bootloader uses next
779      * so we check to see if initbuf is 0
780      */
781     if (next_state->dma[type].next_initbuf == 0) {
782         base_addr = next_state->dma[type].next;
783     } else {
784         base_addr = next_state->dma[type].next_initbuf;
785     }
786 
787     cpu_physical_memory_write(base_addr, buf, size);
788 
789     next_state->dma[type].next_initbuf = 0;
790 
791     /* saved limit is checked to calculate packet size by both, rom and netbsd */
792     next_state->dma[type].saved_limit = (next_state->dma[type].next + size);
793     next_state->dma[type].saved_next  = (next_state->dma[type].next);
794 
795     /*
796      * 32 bytes under savedbase seems to be some kind of register
797      * of which the purpose is unknown as of yet
798      */
799     /* stl_phys(s->rx_dma.base-32,0xFFFFFFFF); */
800 
801     if (!(next_state->dma[type].csr & DMA_SUPDATE)) {
802         next_state->dma[type].next  = next_state->dma[type].start;
803         next_state->dma[type].limit = next_state->dma[type].stop;
804     }
805 
806     /* Set dma registers and raise an irq */
807     next_state->dma[type].csr |= DMA_COMPLETE; /* DON'T CHANGE THIS! */
808 
809     switch (type) {
810     case NEXTDMA_SCSI:
811         irq = NEXT_SCSI_DMA_I;
812         break;
813     }
814 
815     next_irq(opaque, irq, 1);
816     next_irq(opaque, irq, 0);
817 }
818 
819 static void nextscsi_read(void *opaque, uint8_t *buf, int len)
820 {
821     DPRINTF("SCSI READ: %x\n", len);
822     abort();
823 }
824 
825 static void nextscsi_write(void *opaque, uint8_t *buf, int size)
826 {
827     DPRINTF("SCSI WRITE: %i\n", size);
828     nextdma_write(opaque, buf, size, NEXTDMA_SCSI);
829 }
830 
831 static void next_scsi_init(DeviceState *pcdev)
832 {
833     struct NeXTPC *next_pc = NEXT_PC(pcdev);
834     DeviceState *dev;
835     SysBusDevice *sysbusdev;
836     SysBusESPState *sysbus_esp;
837     ESPState *esp;
838 
839     dev = qdev_new(TYPE_SYSBUS_ESP);
840     sysbus_esp = SYSBUS_ESP(dev);
841     esp = &sysbus_esp->esp;
842     esp->dma_memory_read = nextscsi_read;
843     esp->dma_memory_write = nextscsi_write;
844     esp->dma_opaque = pcdev;
845     sysbus_esp->it_shift = 0;
846     esp->dma_enabled = 1;
847     sysbusdev = SYS_BUS_DEVICE(dev);
848     sysbus_realize_and_unref(sysbusdev, &error_fatal);
849     sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(pcdev, NEXT_SCSI_I));
850     sysbus_mmio_map(sysbusdev, 0, 0x2114000);
851 
852     next_pc->scsi_reset = qdev_get_gpio_in(dev, 0);
853     next_pc->scsi_dma = qdev_get_gpio_in(dev, 1);
854 
855     scsi_bus_legacy_handle_cmdline(&esp->bus);
856 }
857 
858 static void next_escc_init(DeviceState *pcdev)
859 {
860     DeviceState *dev;
861     SysBusDevice *s;
862 
863     dev = qdev_new(TYPE_ESCC);
864     qdev_prop_set_uint32(dev, "disabled", 0);
865     qdev_prop_set_uint32(dev, "frequency", 9600 * 384);
866     qdev_prop_set_uint32(dev, "it_shift", 0);
867     qdev_prop_set_bit(dev, "bit_swap", true);
868     qdev_prop_set_chr(dev, "chrB", serial_hd(1));
869     qdev_prop_set_chr(dev, "chrA", serial_hd(0));
870     qdev_prop_set_uint32(dev, "chnBtype", escc_serial);
871     qdev_prop_set_uint32(dev, "chnAtype", escc_serial);
872 
873     s = SYS_BUS_DEVICE(dev);
874     sysbus_realize_and_unref(s, &error_fatal);
875     sysbus_connect_irq(s, 0, qdev_get_gpio_in(pcdev, NEXT_SCC_I));
876     sysbus_connect_irq(s, 1, qdev_get_gpio_in(pcdev, NEXT_SCC_DMA_I));
877     sysbus_mmio_map(s, 0, 0x2118000);
878 }
879 
880 static void next_pc_reset(DeviceState *dev)
881 {
882     NeXTPC *s = NEXT_PC(dev);
883 
884     /* Set internal registers to initial values */
885     /*     0x0000XX00 << vital bits */
886     s->scr1 = 0x00011102;
887     s->scr2 = 0x00ff0c80;
888     s->old_scr2 = s->scr2;
889 
890     s->rtc.status = 0x90;
891 
892     /* Load RTC RAM - TODO: provide possibility to load contents from file */
893     memcpy(s->rtc.ram, rtc_ram2, 32);
894 }
895 
896 static void next_pc_realize(DeviceState *dev, Error **errp)
897 {
898     NeXTPC *s = NEXT_PC(dev);
899     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
900 
901     qdev_init_gpio_in(dev, next_irq, NEXT_NUM_IRQS);
902 
903     memory_region_init_io(&s->mmiomem, OBJECT(s), &next_mmio_ops, s,
904                           "next.mmio", 0xd0000);
905     memory_region_init_io(&s->scrmem, OBJECT(s), &next_scr_ops, s,
906                           "next.scr", 0x20000);
907     sysbus_init_mmio(sbd, &s->mmiomem);
908     sysbus_init_mmio(sbd, &s->scrmem);
909 }
910 
911 /*
912  * If the m68k CPU implemented its inbound irq lines as GPIO lines
913  * rather than via the m68k_set_irq_level() function we would not need
914  * this cpu link property and could instead provide outbound IRQ lines
915  * that the board could wire up to the CPU.
916  */
917 static Property next_pc_properties[] = {
918     DEFINE_PROP_LINK("cpu", NeXTPC, cpu, TYPE_M68K_CPU, M68kCPU *),
919     DEFINE_PROP_END_OF_LIST(),
920 };
921 
922 static const VMStateDescription next_rtc_vmstate = {
923     .name = "next-rtc",
924     .version_id = 2,
925     .minimum_version_id = 2,
926     .fields = (const VMStateField[]) {
927         VMSTATE_INT8(phase, NextRtc),
928         VMSTATE_UINT8_ARRAY(ram, NextRtc, 32),
929         VMSTATE_UINT8(command, NextRtc),
930         VMSTATE_UINT8(value, NextRtc),
931         VMSTATE_UINT8(status, NextRtc),
932         VMSTATE_UINT8(control, NextRtc),
933         VMSTATE_UINT8(retval, NextRtc),
934         VMSTATE_END_OF_LIST()
935     },
936 };
937 
938 static const VMStateDescription next_pc_vmstate = {
939     .name = "next-pc",
940     .version_id = 2,
941     .minimum_version_id = 2,
942     .fields = (const VMStateField[]) {
943         VMSTATE_UINT32(scr1, NeXTPC),
944         VMSTATE_UINT32(scr2, NeXTPC),
945         VMSTATE_UINT32(old_scr2, NeXTPC),
946         VMSTATE_UINT32(int_mask, NeXTPC),
947         VMSTATE_UINT32(int_status, NeXTPC),
948         VMSTATE_UINT32(led, NeXTPC),
949         VMSTATE_UINT8(scsi_csr_1, NeXTPC),
950         VMSTATE_UINT8(scsi_csr_2, NeXTPC),
951         VMSTATE_STRUCT(rtc, NeXTPC, 0, next_rtc_vmstate, NextRtc),
952         VMSTATE_END_OF_LIST()
953     },
954 };
955 
956 static void next_pc_class_init(ObjectClass *klass, void *data)
957 {
958     DeviceClass *dc = DEVICE_CLASS(klass);
959 
960     dc->desc = "NeXT Peripheral Controller";
961     dc->realize = next_pc_realize;
962     device_class_set_legacy_reset(dc, next_pc_reset);
963     device_class_set_props(dc, next_pc_properties);
964     dc->vmsd = &next_pc_vmstate;
965 }
966 
967 static const TypeInfo next_pc_info = {
968     .name = TYPE_NEXT_PC,
969     .parent = TYPE_SYS_BUS_DEVICE,
970     .instance_size = sizeof(NeXTPC),
971     .class_init = next_pc_class_init,
972 };
973 
974 static void next_cube_init(MachineState *machine)
975 {
976     NeXTState *m = NEXT_MACHINE(machine);
977     M68kCPU *cpu;
978     CPUM68KState *env;
979     MemoryRegion *sysmem = get_system_memory();
980     const char *bios_name = machine->firmware ?: ROM_FILE;
981     DeviceState *pcdev;
982 
983     /* Initialize the cpu core */
984     cpu = M68K_CPU(cpu_create(machine->cpu_type));
985     if (!cpu) {
986         error_report("Unable to find m68k CPU definition");
987         exit(1);
988     }
989     env = &cpu->env;
990 
991     /* Initialize CPU registers.  */
992     env->vbr = 0;
993     env->sr  = 0x2700;
994 
995     /* Peripheral Controller */
996     pcdev = qdev_new(TYPE_NEXT_PC);
997     object_property_set_link(OBJECT(pcdev), "cpu", OBJECT(cpu), &error_abort);
998     sysbus_realize_and_unref(SYS_BUS_DEVICE(pcdev), &error_fatal);
999 
1000     /* 64MB RAM starting at 0x04000000  */
1001     memory_region_add_subregion(sysmem, 0x04000000, machine->ram);
1002 
1003     /* Framebuffer */
1004     sysbus_create_simple(TYPE_NEXTFB, 0x0B000000, NULL);
1005 
1006     /* MMIO */
1007     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 0, 0x02000000);
1008 
1009     /* BMAP IO - acts as a catch-all for now */
1010     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 1, 0x02100000);
1011 
1012     /* BMAP memory */
1013     memory_region_init_ram_flags_nomigrate(&m->bmapm1, NULL, "next.bmapmem",
1014                                            64, RAM_SHARED, &error_fatal);
1015     memory_region_add_subregion(sysmem, 0x020c0000, &m->bmapm1);
1016     /* The Rev_2.5_v66.bin firmware accesses it at 0x820c0020, too */
1017     memory_region_init_alias(&m->bmapm2, NULL, "next.bmapmem2", &m->bmapm1,
1018                              0x0, 64);
1019     memory_region_add_subregion(sysmem, 0x820c0000, &m->bmapm2);
1020 
1021     /* KBD */
1022     sysbus_create_simple(TYPE_NEXTKBD, 0x0200e000, NULL);
1023 
1024     /* Load ROM here */
1025     memory_region_init_rom(&m->rom, NULL, "next.rom", 0x20000, &error_fatal);
1026     memory_region_add_subregion(sysmem, 0x01000000, &m->rom);
1027     memory_region_init_alias(&m->rom2, NULL, "next.rom2", &m->rom, 0x0,
1028                              0x20000);
1029     memory_region_add_subregion(sysmem, 0x0, &m->rom2);
1030     if (load_image_targphys(bios_name, 0x01000000, 0x20000) < 8) {
1031         if (!qtest_enabled()) {
1032             error_report("Failed to load firmware '%s'.", bios_name);
1033         }
1034     } else {
1035         uint8_t *ptr;
1036         /* Initial PC is always at offset 4 in firmware binaries */
1037         ptr = rom_ptr(0x01000004, 4);
1038         g_assert(ptr != NULL);
1039         env->pc = ldl_be_p(ptr);
1040         if (env->pc >= 0x01020000) {
1041             error_report("'%s' does not seem to be a valid firmware image.",
1042                          bios_name);
1043             exit(1);
1044         }
1045     }
1046 
1047     /* Serial */
1048     next_escc_init(pcdev);
1049 
1050     /* TODO: */
1051     /* Network */
1052     /* SCSI */
1053     next_scsi_init(pcdev);
1054 
1055     /* DMA */
1056     memory_region_init_io(&m->dmamem, NULL, &next_dma_ops, machine,
1057                           "next.dma", 0x5000);
1058     memory_region_add_subregion(sysmem, 0x02000000, &m->dmamem);
1059 }
1060 
1061 static void next_machine_class_init(ObjectClass *oc, void *data)
1062 {
1063     MachineClass *mc = MACHINE_CLASS(oc);
1064 
1065     mc->desc = "NeXT Cube";
1066     mc->init = next_cube_init;
1067     mc->block_default_type = IF_SCSI;
1068     mc->default_ram_size = RAM_SIZE;
1069     mc->default_ram_id = "next.ram";
1070     mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68040");
1071 }
1072 
1073 static const TypeInfo next_typeinfo = {
1074     .name = TYPE_NEXT_MACHINE,
1075     .parent = TYPE_MACHINE,
1076     .class_init = next_machine_class_init,
1077     .instance_size = sizeof(NeXTState),
1078 };
1079 
1080 static void next_register_type(void)
1081 {
1082     type_register_static(&next_typeinfo);
1083     type_register_static(&next_pc_info);
1084 }
1085 
1086 type_init(next_register_type)
1087