From d571e579dae0c4bbdc9eb28eac49137c49f181f2 Mon Sep 17 00:00:00 2001 From: Mihai Parparita Date: Wed, 14 Oct 2026 10:37:37 -0700 Subject: [PATCH] machines: repeat 4 MB ROM in 16 MB mapped space Per the Hammerhead ERS the ROM region is 0xFF000000-0xFFFFFFFF. We were only mapping the ROM at the uppermost 4 MB of that (0xFFC00000). The fact that copies are returned at other addresses in that range is not explicitly stated in the ERS, but it does appear to be emprically true. It's also corroborated by the 9600 wiring diagram, which shows only enough address bits for 4MB being used for the ROM. Also does the same fix for Platinum/7200, which has the same mapping and address bits, and adds some notes about this to the documentation. Fixes SheepShaver in BeOS guests, which was using 0xFF000000 to get at the hardware ROM (see https://github.com/cebix/macemu/blob/96e512bd6376e78a2869f16dcc8a9028bce5ee72/BasiliskII/src/BeOS/SheepDriver/sheep_driver.c#L454). --- cpu/ppc/ppcmmu.cpp | 2 +- machines/machinecatalyst.cpp | 9 +++++++++ machines/machinetnt.cpp | 9 +++++++++ zdocs/developers/memorymaps.md | 22 +++++++++++++++++----- 4 files changed, 36 insertions(+), 6 deletions(-) diff --git a/cpu/ppc/ppcmmu.cpp b/cpu/ppc/ppcmmu.cpp index 09c434a752..a47eb7ad36 100644 --- a/cpu/ppc/ppcmmu.cpp +++ b/cpu/ppc/ppcmmu.cpp @@ -863,7 +863,7 @@ static TLBEntry* dtlb2_refill(uint32_t guest_va, int is_write, bool is_dbg = fal (tlb_entry->flags & TLBFlags::TLBE_CTX_TRACKED); tlb_entry->host_va_offs_r = (int64_t)rgn_desc->mem_ptr - guest_va + (phys_addr - rgn_desc->start); - if (rgn_desc->type == RT_ROM) { + if (rgn_desc->type & RT_ROM) { // redirect writes to the dummy page for ROM regions tlb_entry->host_va_offs_w = (int64_t)&dummy_page - tag; } else { diff --git a/machines/machinecatalyst.cpp b/machines/machinecatalyst.cpp index 18279e6d8f..591112200a 100644 --- a/machines/machinecatalyst.cpp +++ b/machines/machinecatalyst.cpp @@ -85,6 +85,15 @@ int MachineCatalyst::initialize(const std::string &id) { return -1; } + // Platinum uses the top 16 MB of the address space for ROM. + // The installed 4 MB ROM appears four times within that range. + for (uint32_t addr : {0xFF000000U, 0xFF400000U, 0xFF800000U}) { + if (!platinum_obj->add_mem_mirror(addr, 0xFFC00000)) { + LOG_F(ERROR, "Could not create ROM mirror!"); + return -1; + } + } + // insert RAM DIMMs platinum_obj->insert_ram_dimm(0, GET_INT_PROP("rambank1_size") * DRAM_CAP_1MB); platinum_obj->insert_ram_dimm(1, GET_INT_PROP("rambank2_size") * DRAM_CAP_1MB); diff --git a/machines/machinetnt.cpp b/machines/machinetnt.cpp index 041e44c5b5..ce0466420c 100644 --- a/machines/machinetnt.cpp +++ b/machines/machinetnt.cpp @@ -123,6 +123,15 @@ int MachineTnt::initialize(const std::string &id) { return -1; } + // Hammerhead uses the top 16 MB of the address space for ROM. + // The installed 4 MB ROM appears four times within that range. + for (uint32_t addr : {0xFF000000U, 0xFF400000U, 0xFF800000U}) { + if (!memctrl_obj->add_mem_mirror(addr, 0xFFC00000)) { + LOG_F(ERROR, "Could not create ROM mirror!"); + return -1; + } + } + // populate RAM banks from configuration properties for (int bank_num = 0; bank_num <= 12; bank_num++) { std::string bn = std::to_string(bank_num); diff --git a/zdocs/developers/memorymaps.md b/zdocs/developers/memorymaps.md index 6d95c10161..2dc440e2a1 100644 --- a/zdocs/developers/memorymaps.md +++ b/zdocs/developers/memorymaps.md @@ -25,8 +25,11 @@ | 0x50000000 | 0x5FFFFFFF | IO Devices | | 0x5FFFFFFC | | "cpuid", really a Machine ID | | 0x60000000 | 0xEFFFFFFF | NuBus "super slot" space | -| 0xF1000000 | 0xFFBFFFFF | NuBus "standard slot" space | -| 0xFFC00000 | 0xFFFFFFFF | ROM | +| 0xF1000000 | 0xFEFFFFFF | NuBus "standard slot" space | +| 0xFF000000 | 0xFFFFFFFF | ROM alias | + +The high ROM alias range is documented in Apple's +[6100/7100/8100 Developer Note, Table 2-5](https://www.macdat.net/files/pdf/apple/developer_notes/power_macintosh_6100_7100_8100.pdf#page=36). ### IO Bus @@ -90,9 +93,18 @@ * 0xFEE00000 - Grackle CONFIG_DATA (0x4 bytes, all redirected to 0xXXXXXCFF) ### ROM / Misc Area (0xFF000000 - 0xFFFFFFFF) -* 0xFF000000 - ? - * 0xFF000004 - "cpuid", really a machine ID +On TNT/Tsunami (Hammerhead) and Catalyst (Platinum), the 4 MB ROM repeats at +`0xFF000000`, `0xFF400000`, `0xFF800000`, and `0xFFC00000`. Both controllers +use the full 16 MB range for ROM; the ROM chips receive only PowerPC address bits +10โ€“28 ([9600 schematic, sheet 6](https://www.macdat.net/files/pdf/apple/schematics/apple/powermac_9600.pdf#page=6), +[7200 schematic, sheet 9](https://www.macdat.net/files/pdf/apple/schematics/apple/powermac_7200.pdf#page=9)). + +Gossamer differs: Grackle selects ROM with RCS0 (`0xFF800000โ€“0xFFFFFFFF`), +while RCS1 (`0xFF000000โ€“0xFF7FFFFF`) enables board-status buffers, including +the machine ID at `0xFF000004`. Do not apply the TNT aliases to this range +([Gossamer schematic, sheet 7](https://www.macdat.net/files/pdf/apple/schematics/apple/powermac_g3_gossamer.pdf#page=7), +[MPC106 manual, ยง1.2.3](https://www.nxp.com/docs/en/reference-manual/MPC106UM.pdf)). * 0xFFC00000 - 0xFFFFFFFF Mac OS ROM Area @@ -103,4 +115,4 @@ * 0xFFF00100 - Reset Area (where the ROM begins executing) * 0xFFF10000 - Nanokernel Code - * 0xFFF20000 - HW Init \ No newline at end of file + * 0xFFF20000 - HW Init