machines: repeat 4 MB ROM in 16 MB mapped space

cpu/ppc/ppcmmu.cpp

@@ -863,7 +863,7 @@ static TLBEntry* dtlb2_refill(uint32_t guest_va, int is_write, bool is_dbg = fal
                 (tlb_entry->flags & TLBFlags::TLBE_CTX_TRACKED);
             tlb_entry->host_va_offs_r = (int64_t)rgn_desc->mem_ptr - guest_va +
                                         (phys_addr - rgn_desc->start);
-            if (rgn_desc->type == RT_ROM) {
+            if (rgn_desc->type & RT_ROM) {
                 // redirect writes to the dummy page for ROM regions
                 tlb_entry->host_va_offs_w = (int64_t)&dummy_page - tag;
             } else {

machines/machinecatalyst.cpp

@@ -85,6 +85,15 @@ int MachineCatalyst::initialize(const std::string &id) {
         return -1;
     }
 
+    // Platinum uses the top 16 MB of the address space for ROM.
+    // The installed 4 MB ROM appears four times within that range.
+    for (uint32_t addr : {0xFF000000U, 0xFF400000U, 0xFF800000U}) {
+        if (!platinum_obj->add_mem_mirror(addr, 0xFFC00000)) {
+            LOG_F(ERROR, "Could not create ROM mirror!");
+            return -1;
+        }
+    }
+
     // insert RAM DIMMs
     platinum_obj->insert_ram_dimm(0, GET_INT_PROP("rambank1_size") * DRAM_CAP_1MB);
     platinum_obj->insert_ram_dimm(1, GET_INT_PROP("rambank2_size") * DRAM_CAP_1MB);

machines/machinetnt.cpp

@@ -123,6 +123,15 @@ int MachineTnt::initialize(const std::string &id) {
         return -1;
     }
 
+    // Hammerhead uses the top 16 MB of the address space for ROM.
+    // The installed 4 MB ROM appears four times within that range.
+    for (uint32_t addr : {0xFF000000U, 0xFF400000U, 0xFF800000U}) {
+        if (!memctrl_obj->add_mem_mirror(addr, 0xFFC00000)) {
+            LOG_F(ERROR, "Could not create ROM mirror!");
+            return -1;
+        }
+    }
+
     // populate RAM banks from configuration properties
     for (int bank_num = 0; bank_num <= 12; bank_num++) {
         std::string bn = std::to_string(bank_num);

zdocs/developers/memorymaps.md

@@ -25,8 +25,11 @@
 | 0x50000000     | 0x5FFFFFFF   | IO Devices                   |
 | 0x5FFFFFFC     |              | "cpuid", really a Machine ID |
 | 0x60000000     | 0xEFFFFFFF   | NuBus "super slot" space     |
-| 0xF1000000     | 0xFFBFFFFF   | NuBus "standard slot" space  |
-| 0xFFC00000     | 0xFFFFFFFF   | ROM                          |
+| 0xF1000000     | 0xFEFFFFFF   | NuBus "standard slot" space  |
+| 0xFF000000     | 0xFFFFFFFF   | ROM alias                    |
+
+The high ROM alias range is documented in Apple's
+[6100/7100/8100 Developer Note, Table 2-5](https://www.macdat.net/files/pdf/apple/developer_notes/power_macintosh_6100_7100_8100.pdf#page=36).
 
 ### IO Bus
 
@@ -90,9 +93,18 @@
 * 0xFEE00000 - Grackle CONFIG_DATA (0x4 bytes, all redirected to 0xXXXXXCFF)
 
 ### ROM / Misc Area (0xFF000000 - 0xFFFFFFFF)
-* 0xFF000000 - ?
 
-  *  0xFF000004 - "cpuid", really a machine ID
+On TNT/Tsunami (Hammerhead) and Catalyst (Platinum), the 4 MB ROM repeats at
+`0xFF000000`, `0xFF400000`, `0xFF800000`, and `0xFFC00000`. Both controllers
+use the full 16 MB range for ROM; the ROM chips receive only PowerPC address bits
+10–28 ([9600 schematic, sheet 6](https://www.macdat.net/files/pdf/apple/schematics/apple/powermac_9600.pdf#page=6),
+[7200 schematic, sheet 9](https://www.macdat.net/files/pdf/apple/schematics/apple/powermac_7200.pdf#page=9)).
+
+Gossamer differs: Grackle selects ROM with RCS0 (`0xFF800000–0xFFFFFFFF`),
+while RCS1 (`0xFF000000–0xFF7FFFFF`) enables board-status buffers, including
+the machine ID at `0xFF000004`. Do not apply the TNT aliases to this range
+([Gossamer schematic, sheet 7](https://www.macdat.net/files/pdf/apple/schematics/apple/powermac_g3_gossamer.pdf#page=7),
+[MPC106 manual, §1.2.3](https://www.nxp.com/docs/en/reference-manual/MPC106UM.pdf)).
 
 * 0xFFC00000 - 0xFFFFFFFF
     Mac OS ROM Area
@@ -103,4 +115,4 @@
 
   * 0xFFF00100 - Reset Area (where the ROM begins executing)
   * 0xFFF10000 - Nanokernel Code
-  * 0xFFF20000 - HW Init
+  * 0xFFF20000 - HW Init