ViewVC Help
View File | Revision Log | Show Annotations | Revision Graph | Root Listing
root/cebix/SheepShaver/src/rom_patches.cpp
Revision: 1.17
Committed: 2003-10-07T19:28:09Z (20 years, 7 months ago) by gbeauche
Branch: MAIN
Changes since 1.16: +4 -4 lines
Log Message: 
Adapt ROM patches space to Gossamer ROMs layout. Weird that it passed the
other day.

File Contents

# Content
1 /*
2 * rom_patches.cpp - ROM patches
3 *
4 * SheepShaver (C) 1997-2002 Christian Bauer and Marc Hellwig
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19 */
20
21 /*
22 * TODO:
23 * IRQ_NEST must be handled atomically
24 * Don't use r1 in extra routines
25 */
26
27 #include <string.h>
28
29 #include "sysdeps.h"
30 #include "rom_patches.h"
31 #include "main.h"
32 #include "prefs.h"
33 #include "cpu_emulation.h"
34 #include "emul_op.h"
35 #include "xlowmem.h"
36 #include "sony.h"
37 #include "disk.h"
38 #include "cdrom.h"
39 #include "audio.h"
40 #include "audio_defs.h"
41 #include "serial.h"
42 #include "macos_util.h"
43
44 #define DEBUG 0
45 #include "debug.h"
46
47
48 // 68k breakpoint address
49 //#define M68K_BREAK_POINT 0x29e0 // BootMe
50 //#define M68K_BREAK_POINT 0x2a1e // Boot block code returned
51 //#define M68K_BREAK_POINT 0x3150 // CritError
52 //#define M68K_BREAK_POINT 0x187ce // Unimplemented trap
53
54 // PowerPC breakpoint address
55 //#define POWERPC_BREAK_POINT 0x36e6c0 // 68k emulator start
56
57 #define DISABLE_SCSI 1
58
59
60 // Other ROM addresses
61 const uint32 CHECK_LOAD_PATCH_SPACE = 0x2fcf00;
62 const uint32 PUT_SCRAP_PATCH_SPACE = 0x2fcf80;
63 const uint32 GET_SCRAP_PATCH_SPACE = 0x2fcfc0;
64 const uint32 ADDR_MAP_PATCH_SPACE = 0x2fd000;
65
66 // Global variables
67 int ROMType; // ROM type
68 static uint32 sony_offset; // Offset of .Sony driver resource
69
70 // Prototypes
71 static bool patch_nanokernel_boot(void);
72 static bool patch_68k_emul(void);
73 static bool patch_nanokernel(void);
74 static bool patch_68k(void);
75
76
77 // Decode LZSS data
78 static void decode_lzss(const uint8 *src, uint8 *dest, int size)
79 {
80 char dict[0x1000];
81 int run_mask = 0, dict_idx = 0xfee;
82 for (;;) {
83 if (run_mask < 0x100) {
84 // Start new run
85 if (--size < 0)
86 break;
87 run_mask = *src++ | 0xff00;
88 }
89 bool bit = run_mask & 1;
90 run_mask >>= 1;
91 if (bit) {
92 // Verbatim copy
93 if (--size < 0)
94 break;
95 int c = *src++;
96 dict[dict_idx++] = c;
97 *dest++ = c;
98 dict_idx &= 0xfff;
99 } else {
100 // Copy from dictionary
101 if (--size < 0)
102 break;
103 int idx = *src++;
104 if (--size < 0)
105 break;
106 int cnt = *src++;
107 idx |= (cnt << 4) & 0xf00;
108 cnt = (cnt & 0x0f) + 3;
109 while (cnt--) {
110 char c = dict[idx++];
111 dict[dict_idx++] = c;
112 *dest++ = c;
113 idx &= 0xfff;
114 dict_idx &= 0xfff;
115 }
116 }
117 }
118 }
119
120 // Decode parcels of ROM image (MacOS 9.X and even earlier)
121 void decode_parcels(const uint8 *src, uint8 *dest, int size)
122 {
123 uint32 parcel_offset = 0x14;
124 D(bug("Offset Type Name\n"));
125 while (parcel_offset != 0) {
126 const uint32 *parcel_data = (uint32 *)(src + parcel_offset);
127 uint32 next_offset = ntohl(parcel_data[0]);
128 uint32 parcel_type = ntohl(parcel_data[1]);
129 D(bug("%08x %c%c%c%c %s\n", parcel_offset,
130 (parcel_type >> 24) & 0xff, (parcel_type >> 16) & 0xff,
131 (parcel_type >> 8) & 0xff, parcel_type & 0xff, &parcel_data[6]));
132 if (parcel_type == FOURCC('r','o','m',' ')) {
133 uint32 lzss_offset = ntohl(parcel_data[2]);
134 uint32 lzss_size = ((uintptr)src + next_offset) - ((uintptr)parcel_data + lzss_offset);
135 decode_lzss((uint8 *)parcel_data + lzss_offset, dest, lzss_size);
136 }
137 parcel_offset = next_offset;
138 }
139 }
140
141
142 /*
143 * Decode ROM image, 4 MB plain images or NewWorld images
144 */
145
146 bool DecodeROM(uint8 *data, uint32 size)
147 {
148 if (size == ROM_SIZE) {
149 // Plain ROM image
150 memcpy((void *)ROM_BASE, data, ROM_SIZE);
151 return true;
152 }
153 else if (strncmp((char *)data, "<CHRP-BOOT>", 11) == 0) {
154 // CHRP compressed ROM image
155 uint32 image_offset, image_size;
156 bool decode_info_ok = false;
157
158 char *s = strstr((char *)data, "constant lzss-offset");
159 if (s != NULL) {
160 // Probably a plain LZSS compressed ROM image
161 if (sscanf(s - 7, "%06x", &image_offset) == 1) {
162 s = strstr((char *)data, "constant lzss-size");
163 if (s != NULL && (sscanf(s - 7, "%06x", &image_size) == 1))
164 decode_info_ok = true;
165 }
166 }
167 else {
168 // Probably a MacOS 9.2.x ROM image
169 s = strstr((char *)data, "constant parcels-offset");
170 if (s != NULL) {
171 if (sscanf(s - 7, "%06x", &image_offset) == 1) {
172 s = strstr((char *)data, "constant parcels-size");
173 if (s != NULL && (sscanf(s - 7, "%06x", &image_size) == 1))
174 decode_info_ok = true;
175 }
176 }
177 }
178
179 // No valid information to decode the ROM found?
180 if (!decode_info_ok)
181 return false;
182
183 // Check signature, this could be a parcels-based ROM image
184 uint32 rom_signature = ntohl(*(uint32 *)(data + image_offset));
185 if (rom_signature == FOURCC('p','r','c','l')) {
186 D(bug("Offset of parcels data: %08x\n", image_offset));
187 D(bug("Size of parcels data: %08x\n", image_size));
188 decode_parcels(data + image_offset, (uint8 *)ROM_BASE, image_size);
189 }
190 else {
191 D(bug("Offset of compressed data: %08x\n", image_offset));
192 D(bug("Size of compressed data: %08x\n", image_size));
193 decode_lzss(data + image_offset, (uint8 *)ROM_BASE, image_size);
194 }
195 return true;
196 }
197 return false;
198 }
199
200
201 /*
202 * Search ROM for byte string, return ROM offset (or 0)
203 */
204
205 static uint32 find_rom_data(uint32 start, uint32 end, const uint8 *data, uint32 data_len)
206 {
207 uint32 ofs = start;
208 while (ofs < end) {
209 if (!memcmp((void *)(ROM_BASE + ofs), data, data_len))
210 return ofs;
211 ofs++;
212 }
213 return 0;
214 }
215
216
217 /*
218 * Search ROM resource by type/ID, return ROM offset of resource data
219 */
220
221 static uint32 rsrc_ptr = 0;
222
223 // id = 4711 means "find any ID"
224 static uint32 find_rom_resource(uint32 s_type, int16 s_id = 4711, bool cont = false)
225 {
226 uint32 *lp = (uint32 *)(ROM_BASE + 0x1a);
227 uint32 x = ntohl(*lp);
228 uint8 *bp = (uint8 *)(ROM_BASE + x + 5);
229 uint32 header_size = *bp;
230
231 if (!cont)
232 rsrc_ptr = x;
233 else if (rsrc_ptr == 0)
234 return 0;
235
236 for (;;) {
237 lp = (uint32 *)(ROM_BASE + rsrc_ptr);
238 rsrc_ptr = ntohl(*lp);
239 if (rsrc_ptr == 0)
240 break;
241
242 rsrc_ptr += header_size;
243
244 lp = (uint32 *)(ROM_BASE + rsrc_ptr + 4);
245 uint32 data = ntohl(*lp); lp++;
246 uint32 type = ntohl(*lp); lp++;
247 int16 id = ntohs(*(int16 *)lp);
248 if (type == s_type && (id == s_id || s_id == 4711))
249 return data;
250 }
251 return 0;
252 }
253
254
255 /*
256 * Search offset of A-Trap routine in ROM
257 */
258
259 static uint32 find_rom_trap(uint16 trap)
260 {
261 uint32 *lp = (uint32 *)(ROM_BASE + 0x22);
262 lp = (uint32 *)(ROM_BASE + ntohl(*lp));
263
264 if (trap > 0xa800)
265 return ntohl(lp[trap & 0x3ff]);
266 else
267 return ntohl(lp[(trap & 0xff) + 0x400]);
268 }
269
270
271 /*
272 * List of audio sifters installed in ROM and System file
273 */
274
275 struct sift_entry {
276 uint32 type;
277 int16 id;
278 };
279 static sift_entry sifter_list[32];
280 static int num_sifters;
281
282 void AddSifter(uint32 type, int16 id)
283 {
284 if (FindSifter(type, id))
285 return;
286 D(bug(" adding sifter type %c%c%c%c (%08x), id %d\n", type >> 24, (type >> 16) & 0xff, (type >> 8) & 0xff, type & 0xff, type, id));
287 sifter_list[num_sifters].type = type;
288 sifter_list[num_sifters].id = id;
289 num_sifters++;
290 }
291
292 bool FindSifter(uint32 type, int16 id)
293 {
294 for (int i=0; i<num_sifters; i++) {
295 if (sifter_list[i].type == type && sifter_list[i].id == id)
296 return true;
297 }
298 return false;
299 }
300
301
302 /*
303 * Driver stubs
304 */
305
306 static const uint8 sony_driver[] = { // Replacement for .Sony driver
307 // Driver header
308 SonyDriverFlags >> 8, SonyDriverFlags & 0xff, 0, 0, 0, 0, 0, 0,
309 0x00, 0x18, // Open() offset
310 0x00, 0x1c, // Prime() offset
311 0x00, 0x20, // Control() offset
312 0x00, 0x2c, // Status() offset
313 0x00, 0x52, // Close() offset
314 0x05, 0x2e, 0x53, 0x6f, 0x6e, 0x79, // ".Sony"
315
316 // Open()
317 M68K_EMUL_OP_SONY_OPEN >> 8, M68K_EMUL_OP_SONY_OPEN & 0xff,
318 0x4e, 0x75, // rts
319
320 // Prime()
321 M68K_EMUL_OP_SONY_PRIME >> 8, M68K_EMUL_OP_SONY_PRIME & 0xff,
322 0x60, 0x0e, // bra IOReturn
323
324 // Control()
325 M68K_EMUL_OP_SONY_CONTROL >> 8, M68K_EMUL_OP_SONY_CONTROL & 0xff,
326 0x0c, 0x68, 0x00, 0x01, 0x00, 0x1a, // cmp.w #1,$1a(a0)
327 0x66, 0x04, // bne IOReturn
328 0x4e, 0x75, // rts
329
330 // Status()
331 M68K_EMUL_OP_SONY_STATUS >> 8, M68K_EMUL_OP_SONY_STATUS & 0xff,
332
333 // IOReturn
334 0x32, 0x28, 0x00, 0x06, // move.w 6(a0),d1
335 0x08, 0x01, 0x00, 0x09, // btst #9,d1
336 0x67, 0x0c, // beq 1
337 0x4a, 0x40, // tst.w d0
338 0x6f, 0x02, // ble 2
339 0x42, 0x40, // clr.w d0
340 0x31, 0x40, 0x00, 0x10, //2 move.w d0,$10(a0)
341 0x4e, 0x75, // rts
342 0x4a, 0x40, //1 tst.w d0
343 0x6f, 0x04, // ble 3
344 0x42, 0x40, // clr.w d0
345 0x4e, 0x75, // rts
346 0x2f, 0x38, 0x08, 0xfc, //3 move.l $8fc,-(sp)
347 0x4e, 0x75, // rts
348
349 // Close()
350 0x70, 0xe8, // moveq #-24,d0
351 0x4e, 0x75 // rts
352 };
353
354 static const uint8 disk_driver[] = { // Generic disk driver
355 // Driver header
356 DiskDriverFlags >> 8, DiskDriverFlags & 0xff, 0, 0, 0, 0, 0, 0,
357 0x00, 0x18, // Open() offset
358 0x00, 0x1c, // Prime() offset
359 0x00, 0x20, // Control() offset
360 0x00, 0x2c, // Status() offset
361 0x00, 0x52, // Close() offset
362 0x05, 0x2e, 0x44, 0x69, 0x73, 0x6b, // ".Disk"
363
364 // Open()
365 M68K_EMUL_OP_DISK_OPEN >> 8, M68K_EMUL_OP_DISK_OPEN & 0xff,
366 0x4e, 0x75, // rts
367
368 // Prime()
369 M68K_EMUL_OP_DISK_PRIME >> 8, M68K_EMUL_OP_DISK_PRIME & 0xff,
370 0x60, 0x0e, // bra IOReturn
371
372 // Control()
373 M68K_EMUL_OP_DISK_CONTROL >> 8, M68K_EMUL_OP_DISK_CONTROL & 0xff,
374 0x0c, 0x68, 0x00, 0x01, 0x00, 0x1a, // cmp.w #1,$1a(a0)
375 0x66, 0x04, // bne IOReturn
376 0x4e, 0x75, // rts
377
378 // Status()
379 M68K_EMUL_OP_DISK_STATUS >> 8, M68K_EMUL_OP_DISK_STATUS & 0xff,
380
381 // IOReturn
382 0x32, 0x28, 0x00, 0x06, // move.w 6(a0),d1
383 0x08, 0x01, 0x00, 0x09, // btst #9,d1
384 0x67, 0x0c, // beq 1
385 0x4a, 0x40, // tst.w d0
386 0x6f, 0x02, // ble 2
387 0x42, 0x40, // clr.w d0
388 0x31, 0x40, 0x00, 0x10, //2 move.w d0,$10(a0)
389 0x4e, 0x75, // rts
390 0x4a, 0x40, //1 tst.w d0
391 0x6f, 0x04, // ble 3
392 0x42, 0x40, // clr.w d0
393 0x4e, 0x75, // rts
394 0x2f, 0x38, 0x08, 0xfc, //3 move.l $8fc,-(sp)
395 0x4e, 0x75, // rts
396
397 // Close()
398 0x70, 0xe8, // moveq #-24,d0
399 0x4e, 0x75 // rts
400 };
401
402 static const uint8 cdrom_driver[] = { // CD-ROM driver
403 // Driver header
404 CDROMDriverFlags >> 8, CDROMDriverFlags & 0xff, 0, 0, 0, 0, 0, 0,
405 0x00, 0x1c, // Open() offset
406 0x00, 0x20, // Prime() offset
407 0x00, 0x24, // Control() offset
408 0x00, 0x30, // Status() offset
409 0x00, 0x56, // Close() offset
410 0x08, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x43, 0x44, 0x00, // ".AppleCD"
411
412 // Open()
413 M68K_EMUL_OP_CDROM_OPEN >> 8, M68K_EMUL_OP_CDROM_OPEN & 0xff,
414 0x4e, 0x75, // rts
415
416 // Prime()
417 M68K_EMUL_OP_CDROM_PRIME >> 8, M68K_EMUL_OP_CDROM_PRIME & 0xff,
418 0x60, 0x0e, // bra IOReturn
419
420 // Control()
421 M68K_EMUL_OP_CDROM_CONTROL >> 8, M68K_EMUL_OP_CDROM_CONTROL & 0xff,
422 0x0c, 0x68, 0x00, 0x01, 0x00, 0x1a, // cmp.w #1,$1a(a0)
423 0x66, 0x04, // bne IOReturn
424 0x4e, 0x75, // rts
425
426 // Status()
427 M68K_EMUL_OP_CDROM_STATUS >> 8, M68K_EMUL_OP_CDROM_STATUS & 0xff,
428
429 // IOReturn
430 0x32, 0x28, 0x00, 0x06, // move.w 6(a0),d1
431 0x08, 0x01, 0x00, 0x09, // btst #9,d1
432 0x67, 0x0c, // beq 1
433 0x4a, 0x40, // tst.w d0
434 0x6f, 0x02, // ble 2
435 0x42, 0x40, // clr.w d0
436 0x31, 0x40, 0x00, 0x10, //2 move.w d0,$10(a0)
437 0x4e, 0x75, // rts
438 0x4a, 0x40, //1 tst.w d0
439 0x6f, 0x04, // ble 3
440 0x42, 0x40, // clr.w d0
441 0x4e, 0x75, // rts
442 0x2f, 0x38, 0x08, 0xfc, //3 move.l $8fc,-(sp)
443 0x4e, 0x75, // rts
444
445 // Close()
446 0x70, 0xe8, // moveq #-24,d0
447 0x4e, 0x75 // rts
448 };
449
450 #if EMULATED_PPC
451 #define SERIAL_TRAMPOLINES 1
452 static uint32 serial_nothing_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_NOTHING)), 0};
453 static uint32 serial_open_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_OPEN)), 0};
454 static uint32 serial_prime_in_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_PRIME_IN)), 0};
455 static uint32 serial_prime_out_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_PRIME_OUT)), 0};
456 static uint32 serial_control_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_CONTROL)), 0};
457 static uint32 serial_status_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_STATUS)), 0};
458 static uint32 serial_close_tvect[2] = {tswap32(POWERPC_NATIVE_OP_FUNC(NATIVE_SERIAL_CLOSE)), 0};
459 #elif defined(__linux__)
460 #define SERIAL_TRAMPOLINES 1
461 static uint32 serial_nothing_tvect[2] = {(uint32)SerialNothing, 0};
462 static uint32 serial_open_tvect[2] = {(uint32)SerialOpen, 0};
463 static uint32 serial_prime_in_tvect[2] = {(uint32)SerialPrimeIn, 0};
464 static uint32 serial_prime_out_tvect[2] = {(uint32)SerialPrimeOut, 0};
465 static uint32 serial_control_tvect[2] = {(uint32)SerialControl, 0};
466 static uint32 serial_status_tvect[2] = {(uint32)SerialStatus, 0};
467 static uint32 serial_close_tvect[2] = {(uint32)SerialClose, 0};
468 #endif
469
470 static const uint32 ain_driver[] = { // .AIn driver header
471 0x4d000000, 0x00000000,
472 0x00200040, 0x00600080,
473 0x00a0042e, 0x41496e00,
474 0x00000000, 0x00000000,
475 0xaafe0700, 0x00000000,
476 0x00000000, 0x00179822,
477 #ifdef SERIAL_TRAMPOLINES
478 0x00010004, (uint32)serial_nothing_tvect,
479 #else
480 0x00010004, (uint32)SerialNothing,
481 #endif
482 0x00000000, 0x00000000,
483 0xaafe0700, 0x00000000,
484 0x00000000, 0x00179822,
485 #ifdef SERIAL_TRAMPOLINES
486 0x00010004, (uint32)serial_prime_in_tvect,
487 #else
488 0x00010004, (uint32)SerialPrimeIn,
489 #endif
490 0x00000000, 0x00000000,
491 0xaafe0700, 0x00000000,
492 0x00000000, 0x00179822,
493 #ifdef SERIAL_TRAMPOLINES
494 0x00010004, (uint32)serial_control_tvect,
495 #else
496 0x00010004, (uint32)SerialControl,
497 #endif
498 0x00000000, 0x00000000,
499 0xaafe0700, 0x00000000,
500 0x00000000, 0x00179822,
501 #ifdef SERIAL_TRAMPOLINES
502 0x00010004, (uint32)serial_status_tvect,
503 #else
504 0x00010004, (uint32)SerialStatus,
505 #endif
506 0x00000000, 0x00000000,
507 0xaafe0700, 0x00000000,
508 0x00000000, 0x00179822,
509 #ifdef SERIAL_TRAMPOLINES
510 0x00010004, (uint32)serial_nothing_tvect,
511 #else
512 0x00010004, (uint32)SerialNothing,
513 #endif
514 0x00000000, 0x00000000,
515 };
516
517 static const uint32 aout_driver[] = { // .AOut driver header
518 0x4d000000, 0x00000000,
519 0x00200040, 0x00600080,
520 0x00a0052e, 0x414f7574,
521 0x00000000, 0x00000000,
522 0xaafe0700, 0x00000000,
523 0x00000000, 0x00179822,
524 #ifdef SERIAL_TRAMPOLINES
525 0x00010004, (uint32)serial_open_tvect,
526 #else
527 0x00010004, (uint32)SerialOpen,
528 #endif
529 0x00000000, 0x00000000,
530 0xaafe0700, 0x00000000,
531 0x00000000, 0x00179822,
532 #ifdef SERIAL_TRAMPOLINES
533 0x00010004, (uint32)serial_prime_out_tvect,
534 #else
535 0x00010004, (uint32)SerialPrimeOut,
536 #endif
537 0x00000000, 0x00000000,
538 0xaafe0700, 0x00000000,
539 0x00000000, 0x00179822,
540 #ifdef SERIAL_TRAMPOLINES
541 0x00010004, (uint32)serial_control_tvect,
542 #else
543 0x00010004, (uint32)SerialControl,
544 #endif
545 0x00000000, 0x00000000,
546 0xaafe0700, 0x00000000,
547 0x00000000, 0x00179822,
548 #ifdef SERIAL_TRAMPOLINES
549 0x00010004, (uint32)serial_status_tvect,
550 #else
551 0x00010004, (uint32)SerialStatus,
552 #endif
553 0x00000000, 0x00000000,
554 0xaafe0700, 0x00000000,
555 0x00000000, 0x00179822,
556 #ifdef SERIAL_TRAMPOLINES
557 0x00010004, (uint32)serial_close_tvect,
558 #else
559 0x00010004, (uint32)SerialClose,
560 #endif
561 0x00000000, 0x00000000,
562 };
563
564 static const uint32 bin_driver[] = { // .BIn driver header
565 0x4d000000, 0x00000000,
566 0x00200040, 0x00600080,
567 0x00a0042e, 0x42496e00,
568 0x00000000, 0x00000000,
569 0xaafe0700, 0x00000000,
570 0x00000000, 0x00179822,
571 #ifdef SERIAL_TRAMPOLINES
572 0x00010004, (uint32)serial_nothing_tvect,
573 #else
574 0x00010004, (uint32)SerialNothing,
575 #endif
576 0x00000000, 0x00000000,
577 0xaafe0700, 0x00000000,
578 0x00000000, 0x00179822,
579 #ifdef SERIAL_TRAMPOLINES
580 0x00010004, (uint32)serial_prime_in_tvect,
581 #else
582 0x00010004, (uint32)SerialPrimeIn,
583 #endif
584 0x00000000, 0x00000000,
585 0xaafe0700, 0x00000000,
586 0x00000000, 0x00179822,
587 #ifdef SERIAL_TRAMPOLINES
588 0x00010004, (uint32)serial_control_tvect,
589 #else
590 0x00010004, (uint32)SerialControl,
591 #endif
592 0x00000000, 0x00000000,
593 0xaafe0700, 0x00000000,
594 0x00000000, 0x00179822,
595 #ifdef SERIAL_TRAMPOLINES
596 0x00010004, (uint32)serial_status_tvect,
597 #else
598 0x00010004, (uint32)SerialStatus,
599 #endif
600 0x00000000, 0x00000000,
601 0xaafe0700, 0x00000000,
602 0x00000000, 0x00179822,
603 #ifdef SERIAL_TRAMPOLINES
604 0x00010004, (uint32)serial_nothing_tvect,
605 #else
606 0x00010004, (uint32)SerialNothing,
607 #endif
608 0x00000000, 0x00000000,
609 };
610
611 static const uint32 bout_driver[] = { // .BOut driver header
612 0x4d000000, 0x00000000,
613 0x00200040, 0x00600080,
614 0x00a0052e, 0x424f7574,
615 0x00000000, 0x00000000,
616 0xaafe0700, 0x00000000,
617 0x00000000, 0x00179822,
618 #ifdef SERIAL_TRAMPOLINES
619 0x00010004, (uint32)serial_open_tvect,
620 #else
621 0x00010004, (uint32)SerialOpen,
622 #endif
623 0x00000000, 0x00000000,
624 0xaafe0700, 0x00000000,
625 0x00000000, 0x00179822,
626 #ifdef SERIAL_TRAMPOLINES
627 0x00010004, (uint32)serial_prime_out_tvect,
628 #else
629 0x00010004, (uint32)SerialPrimeOut,
630 #endif
631 0x00000000, 0x00000000,
632 0xaafe0700, 0x00000000,
633 0x00000000, 0x00179822,
634 #ifdef SERIAL_TRAMPOLINES
635 0x00010004, (uint32)serial_control_tvect,
636 #else
637 0x00010004, (uint32)SerialControl,
638 #endif
639 0x00000000, 0x00000000,
640 0xaafe0700, 0x00000000,
641 0x00000000, 0x00179822,
642 #ifdef SERIAL_TRAMPOLINES
643 0x00010004, (uint32)serial_status_tvect,
644 #else
645 0x00010004, (uint32)SerialStatus,
646 #endif
647 0x00000000, 0x00000000,
648 0xaafe0700, 0x00000000,
649 0x00000000, 0x00179822,
650 #ifdef SERIAL_TRAMPOLINES
651 0x00010004, (uint32)serial_close_tvect,
652 #else
653 0x00010004, (uint32)SerialClose,
654 #endif
655 0x00000000, 0x00000000,
656 };
657
658 static const uint8 adbop_patch[] = { // Call ADBOp() completion procedure
659 // The completion procedure may call ADBOp() again!
660 0x40, 0xe7, // move sr,-(sp)
661 0x00, 0x7c, 0x07, 0x00, // ori #$0700,sr
662 M68K_EMUL_OP_ADBOP >> 8, M68K_EMUL_OP_ADBOP & 0xff,
663 0x48, 0xe7, 0x70, 0xf0, // movem.l d1-d3/a0-a3,-(sp)
664 0x26, 0x48, // move.l a0,a3
665 0x4a, 0xab, 0x00, 0x04, // tst.l 4(a3)
666 0x67, 0x00, 0x00, 0x18, // beq 1
667 0x20, 0x53, // move.l (a3),a0
668 0x22, 0x6b, 0x00, 0x04, // move.l 4(a3),a1
669 0x24, 0x6b, 0x00, 0x08, // move.l 8(a3),a2
670 0x26, 0x78, 0x0c, 0xf8, // move.l $cf8,a3
671 0x4e, 0x91, // jsr (a1)
672 0x70, 0x00, // moveq #0,d0
673 0x60, 0x00, 0x00, 0x04, // bra 2
674 0x70, 0xff, //1 moveq #-1,d0
675 0x4c, 0xdf, 0x0f, 0x0e, //2 movem.l (sp)+,d1-d3/a0-a3
676 0x46, 0xdf, // move (sp)+,sr
677 0x4e, 0x75 // rts
678 };
679
680
681 /*
682 * Copy PowerPC code to ROM image and reverse bytes if necessary
683 */
684
685 static inline void memcpy_powerpc_code(void *dst, const void *src, size_t len)
686 {
687 #ifdef WORDS_BIGENDIAN
688 (void)memcpy(dst, src, len);
689 #else
690 uint32 *d = (uint32 *)dst;
691 uint32 *s = (uint32 *)src;
692 for (int i = 0; i < len/4; i++)
693 d[i] = htonl(s[i]);
694 #endif
695 }
696
697
698 /*
699 * Install ROM patches (RAMBase and KernelDataAddr must be set)
700 */
701
702 bool PatchROM(void)
703 {
704 // Print ROM info
705 D(bug("Checksum: %08lx\n", ntohl(*(uint32 *)ROM_BASE)));
706 D(bug("Version: %04x\n", ntohs(*(uint16 *)(ROM_BASE + 8))));
707 D(bug("Sub Version: %04x\n", ntohs(*(uint16 *)(ROM_BASE + 18))));
708 D(bug("Nanokernel ID: %s\n", (char *)ROM_BASE + 0x30d064));
709 D(bug("Resource Map at %08lx\n", ntohl(*(uint32 *)(ROM_BASE + 26))));
710 D(bug("Trap Tables at %08lx\n\n", ntohl(*(uint32 *)(ROM_BASE + 34))));
711
712 // Detect ROM type
713 if (!memcmp((void *)(ROM_BASE + 0x30d064), "Boot TNT", 8))
714 ROMType = ROMTYPE_TNT;
715 else if (!memcmp((void *)(ROM_BASE + 0x30d064), "Boot Alchemy", 12))
716 ROMType = ROMTYPE_ALCHEMY;
717 else if (!memcmp((void *)(ROM_BASE + 0x30d064), "Boot Zanzibar", 13))
718 ROMType = ROMTYPE_ZANZIBAR;
719 else if (!memcmp((void *)(ROM_BASE + 0x30d064), "Boot Gazelle", 12))
720 ROMType = ROMTYPE_GAZELLE;
721 else if (!memcmp((void *)(ROM_BASE + 0x30d064), "Boot Gossamer", 13))
722 ROMType = ROMTYPE_GOSSAMER;
723 else if (!memcmp((void *)(ROM_BASE + 0x30d064), "NewWorld", 8))
724 ROMType = ROMTYPE_NEWWORLD;
725 else
726 return false;
727
728 // Check that other ROM addresses point to really free regions
729 if (ntohl(*(uint32 *)(ROM_BASE + CHECK_LOAD_PATCH_SPACE)) != 0x6b636b63)
730 return false;
731 if (ntohl(*(uint32 *)(ROM_BASE + PUT_SCRAP_PATCH_SPACE)) != 0x6b636b63)
732 return false;
733 if (ntohl(*(uint32 *)(ROM_BASE + GET_SCRAP_PATCH_SPACE)) != 0x6b636b63)
734 return false;
735 if (ntohl(*(uint32 *)(ROM_BASE + ADDR_MAP_PATCH_SPACE)) != 0x6b636b63)
736 return false;
737
738 // Apply patches
739 if (!patch_nanokernel_boot()) return false;
740 if (!patch_68k_emul()) return false;
741 if (!patch_nanokernel()) return false;
742 if (!patch_68k()) return false;
743
744 #ifdef M68K_BREAK_POINT
745 // Install 68k breakpoint
746 uint16 *wp = (uint16 *)(ROM_BASE + M68K_BREAK_POINT);
747 *wp++ = htons(M68K_EMUL_BREAK);
748 *wp = htons(M68K_EMUL_RETURN);
749 #endif
750
751 #ifdef POWERPC_BREAK_POINT
752 // Install PowerPC breakpoint
753 uint32 *lp = (uint32 *)(ROM_BASE + POWERPC_BREAK_POINT);
754 *lp = htonl(0);
755 #endif
756
757 // Copy 68k emulator to 2MB boundary
758 memcpy((void *)(ROM_BASE + ROM_SIZE), (void *)(ROM_BASE + ROM_SIZE - 0x100000), 0x100000);
759 return true;
760 }
761
762
763 /*
764 * Nanokernel boot routine patches
765 */
766
767 static bool patch_nanokernel_boot(void)
768 {
769 uint32 *lp;
770
771 // ROM boot structure patches
772 lp = (uint32 *)(ROM_BASE + 0x30d000);
773 lp[0x9c >> 2] = htonl(KernelDataAddr); // LA_InfoRecord
774 lp[0xa0 >> 2] = htonl(KernelDataAddr); // LA_KernelData
775 lp[0xa4 >> 2] = htonl(KernelDataAddr + 0x1000); // LA_EmulatorData
776 lp[0xa8 >> 2] = htonl(ROM_BASE + 0x480000); // LA_DispatchTable
777 lp[0xac >> 2] = htonl(ROM_BASE + 0x460000); // LA_EmulatorCode
778 lp[0x360 >> 2] = htonl(0); // Physical RAM base (? on NewWorld ROM, this contains -1)
779 lp[0xfd8 >> 2] = htonl(ROM_BASE + 0x2a); // 68k reset vector
780
781 // Skip SR/BAT/SDR init
782 if (ROMType == ROMTYPE_GAZELLE || ROMType == ROMTYPE_GOSSAMER || ROMType == ROMTYPE_NEWWORLD) {
783 lp = (uint32 *)(ROM_BASE + 0x310000);
784 *lp++ = htonl(POWERPC_NOP);
785 *lp = htonl(0x38000000);
786 }
787 static const uint32 sr_init_loc[] = {0x3101b0, 0x3101b0, 0x3101b0, 0x3101ec, 0x3101fc, 0x310200};
788 lp = (uint32 *)(ROM_BASE + 0x310008);
789 *lp = htonl(0x48000000 | (sr_init_loc[ROMType] - 8) & 0xffff); // b ROM_BASE+0x3101b0
790 lp = (uint32 *)(ROM_BASE + sr_init_loc[ROMType]);
791 *lp++ = htonl(0x80200000 + XLM_KERNEL_DATA); // lwz r1,(pointer to Kernel Data)
792 *lp++ = htonl(0x3da0dead); // lis r13,0xdead (start of kernel memory)
793 *lp++ = htonl(0x3dc00010); // lis r14,0x0010 (size of page table)
794 *lp = htonl(0x3de00010); // lis r15,0x0010 (size of kernel memory)
795
796 // Don't read PVR
797 static const uint32 pvr_loc[] = {0x3103b0, 0x3103b4, 0x3103b4, 0x310400, 0x310430, 0x310438};
798 lp = (uint32 *)(ROM_BASE + pvr_loc[ROMType]);
799 *lp = htonl(0x81800000 + XLM_PVR); // lwz r12,(theoretical PVR)
800
801 // Set CPU specific data (even if ROM doesn't have support for that CPU)
802 lp = (uint32 *)(ROM_BASE + pvr_loc[ROMType]);
803 if (ntohl(lp[6]) != 0x2c0c0001)
804 return false;
805 uint32 ofs = ntohl(lp[7]) & 0xffff;
806 D(bug("ofs %08lx\n", ofs));
807 lp[8] = htonl((ntohl(lp[8]) & 0xffff) | 0x48000000); // beq -> b
808 uint32 loc = (ntohl(lp[8]) & 0xffff) + (uint32)(lp+8) - ROM_BASE;
809 D(bug("loc %08lx\n", loc));
810 lp = (uint32 *)(ROM_BASE + ofs + 0x310000);
811 switch (PVR >> 16) {
812 case 1: // 601
813 lp[0] = htonl(0x1000); // Page size
814 lp[1] = htonl(0x8000); // Data cache size
815 lp[2] = htonl(0x8000); // Inst cache size
816 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
817 lp[4] = htonl(0x00010040); // Unified caches/Inst cache line size
818 lp[5] = htonl(0x00400020); // Data cache line size/Data cache block size touch
819 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
820 lp[7] = htonl(0x00080008); // Inst cache assoc/Data cache assoc
821 lp[8] = htonl(0x01000002); // TLB total size/TLB assoc
822 break;
823 case 3: // 603
824 lp[0] = htonl(0x1000); // Page size
825 lp[1] = htonl(0x2000); // Data cache size
826 lp[2] = htonl(0x2000); // Inst cache size
827 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
828 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
829 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
830 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
831 lp[7] = htonl(0x00020002); // Inst cache assoc/Data cache assoc
832 lp[8] = htonl(0x00400002); // TLB total size/TLB assoc
833 break;
834 case 4: // 604
835 lp[0] = htonl(0x1000); // Page size
836 lp[1] = htonl(0x4000); // Data cache size
837 lp[2] = htonl(0x4000); // Inst cache size
838 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
839 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
840 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
841 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
842 lp[7] = htonl(0x00040004); // Inst cache assoc/Data cache assoc
843 lp[8] = htonl(0x00800002); // TLB total size/TLB assoc
844 break;
845 // case 5: // 740?
846 case 6: // 603e
847 case 7: // 603ev
848 lp[0] = htonl(0x1000); // Page size
849 lp[1] = htonl(0x4000); // Data cache size
850 lp[2] = htonl(0x4000); // Inst cache size
851 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
852 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
853 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
854 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
855 lp[7] = htonl(0x00040004); // Inst cache assoc/Data cache assoc
856 lp[8] = htonl(0x00400002); // TLB total size/TLB assoc
857 break;
858 case 8: // 750
859 lp[0] = htonl(0x1000); // Page size
860 lp[1] = htonl(0x8000); // Data cache size
861 lp[2] = htonl(0x8000); // Inst cache size
862 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
863 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
864 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
865 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
866 lp[7] = htonl(0x00080008); // Inst cache assoc/Data cache assoc
867 lp[8] = htonl(0x00800002); // TLB total size/TLB assoc
868 break;
869 case 9: // 604e
870 case 10: // 604ev5
871 lp[0] = htonl(0x1000); // Page size
872 lp[1] = htonl(0x8000); // Data cache size
873 lp[2] = htonl(0x8000); // Inst cache size
874 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
875 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
876 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
877 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
878 lp[7] = htonl(0x00040004); // Inst cache assoc/Data cache assoc
879 lp[8] = htonl(0x00800002); // TLB total size/TLB assoc
880 break;
881 // case 11: // X704?
882 case 12: // ???
883 lp[0] = htonl(0x1000); // Page size
884 lp[1] = htonl(0x8000); // Data cache size
885 lp[2] = htonl(0x8000); // Inst cache size
886 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
887 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
888 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
889 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
890 lp[7] = htonl(0x00080008); // Inst cache assoc/Data cache assoc
891 lp[8] = htonl(0x00800002); // TLB total size/TLB assoc
892 break;
893 case 13: // ???
894 lp[0] = htonl(0x1000); // Page size
895 lp[1] = htonl(0x8000); // Data cache size
896 lp[2] = htonl(0x8000); // Inst cache size
897 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
898 lp[4] = htonl(0x00000020); // Unified caches/Inst cache line size
899 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
900 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
901 lp[7] = htonl(0x00080008); // Inst cache assoc/Data cache assoc
902 lp[8] = htonl(0x01000004); // TLB total size/TLB assoc
903 break;
904 // case 50: // 821
905 // case 80: // 860
906 case 96: // ???
907 lp[0] = htonl(0x1000); // Page size
908 lp[1] = htonl(0x8000); // Data cache size
909 lp[2] = htonl(0x8000); // Inst cache size
910 lp[3] = htonl(0x00200020); // Coherency block size/Reservation granule size
911 lp[4] = htonl(0x00010020); // Unified caches/Inst cache line size
912 lp[5] = htonl(0x00200020); // Data cache line size/Data cache block size touch
913 lp[6] = htonl(0x00200020); // Inst cache block size/Data cache block size
914 lp[7] = htonl(0x00080008); // Inst cache assoc/Data cache assoc
915 lp[8] = htonl(0x00800004); // TLB total size/TLB assoc
916 break;
917 default:
918 printf("WARNING: Unknown CPU type\n");
919 break;
920 }
921
922 // Don't set SPRG3, don't test MQ
923 lp = (uint32 *)(ROM_BASE + loc + 0x20);
924 *lp++ = htonl(POWERPC_NOP);
925 lp++;
926 *lp++ = htonl(POWERPC_NOP);
927 lp++;
928 *lp = htonl(POWERPC_NOP);
929
930 // Don't read MSR
931 lp = (uint32 *)(ROM_BASE + loc + 0x40);
932 *lp = htonl(0x39c00000); // li r14,0
933
934 // Don't write to DEC
935 lp = (uint32 *)(ROM_BASE + loc + 0x70);
936 *lp++ = htonl(POWERPC_NOP);
937 loc = (ntohl(lp[0]) & 0xffff) + (uint32)lp - ROM_BASE;
938 D(bug("loc %08lx\n", loc));
939
940 // Don't set SPRG3
941 lp = (uint32 *)(ROM_BASE + loc + 0x2c);
942 *lp = htonl(POWERPC_NOP);
943
944 // Don't read PVR
945 static const uint32 pvr_ofs[] = {0x138, 0x138, 0x138, 0x140, 0x148, 0x148};
946 lp = (uint32 *)(ROM_BASE + loc + pvr_ofs[ROMType]);
947 *lp = htonl(0x82e00000 + XLM_PVR); // lwz r23,(theoretical PVR)
948 lp = (uint32 *)(ROM_BASE + loc + 0x170);
949 if (ntohl(*lp) == 0x7eff42a6) // NewWorld or Gossamer ROM
950 *lp = htonl(0x82e00000 + XLM_PVR); // lwz r23,(theoretical PVR)
951 lp = (uint32 *)(ROM_BASE + 0x313134);
952 if (ntohl(*lp) == 0x7e5f42a6)
953 *lp = htonl(0x82400000 + XLM_PVR); // lwz r18,(theoretical PVR)
954 lp = (uint32 *)(ROM_BASE + 0x3131f4);
955 if (ntohl(*lp) == 0x7e5f42a6) // NewWorld ROM
956 *lp = htonl(0x82400000 + XLM_PVR); // lwz r18,(theoretical PVR)
957 lp = (uint32 *)(ROM_BASE + 0x314600);
958 if (ntohl(*lp) == 0x7d3f42a6)
959 *lp = htonl(0x81200000 + XLM_PVR); // lzw r9,(theoritical PVR)
960
961 // Don't read SDR1
962 static const uint32 sdr1_ofs[] = {0x174, 0x174, 0x174, 0x17c, 0x19c, 0x19c};
963 lp = (uint32 *)(ROM_BASE + loc + sdr1_ofs[ROMType]);
964 *lp++ = htonl(0x3d00dead); // lis r8,0xdead (pointer to page table)
965 *lp++ = htonl(0x3ec0001f); // lis r22,0x001f (size of page table)
966 *lp = htonl(POWERPC_NOP);
967
968 // Don't clear page table
969 static const uint32 pgtb_ofs[] = {0x198, 0x198, 0x198, 0x1a0, 0x1c0, 0x1c4};
970 lp = (uint32 *)(ROM_BASE + loc + pgtb_ofs[ROMType]);
971 *lp = htonl(POWERPC_NOP);
972
973 // Don't invalidate TLB
974 static const uint32 tlb_ofs[] = {0x1a0, 0x1a0, 0x1a0, 0x1a8, 0x1c8, 0x1cc};
975 lp = (uint32 *)(ROM_BASE + loc + tlb_ofs[ROMType]);
976 *lp = htonl(POWERPC_NOP);
977
978 // Don't create RAM descriptor table
979 static const uint32 desc_ofs[] = {0x350, 0x350, 0x350, 0x358, 0x378, 0x37c};
980 lp = (uint32 *)(ROM_BASE + loc + desc_ofs[ROMType]);
981 *lp = htonl(POWERPC_NOP);
982
983 // Don't load SRs and BATs
984 static const uint32 sr_ofs[] = {0x3d8, 0x3d8, 0x3d8, 0x3e0, 0x400, 0x404};
985 lp = (uint32 *)(ROM_BASE + loc + sr_ofs[ROMType]);
986 *lp = htonl(POWERPC_NOP);
987
988 // Don't mess with SRs
989 static const uint32 sr2_ofs[] = {0x312118, 0x312118, 0x312118, 0x312118, 0x312118, 0x3121b4};
990 lp = (uint32 *)(ROM_BASE + sr2_ofs[ROMType]);
991 *lp = htonl(POWERPC_BLR);
992
993 // Don't check performance monitor
994 static const uint32 pm_ofs[] = {0x313148, 0x313148, 0x313148, 0x313148, 0x313158, 0x313218};
995 lp = (uint32 *)(ROM_BASE + pm_ofs[ROMType]);
996 while (ntohl(*lp) != 0x7e58eba6) lp++;
997 *lp++ = htonl(POWERPC_NOP);
998 while (ntohl(*lp) != 0x7e78eaa6) lp++;
999 *lp++ = htonl(POWERPC_NOP);
1000 while (ntohl(*lp) != 0x7e59eba6) lp++;
1001 *lp++ = htonl(POWERPC_NOP);
1002 while (ntohl(*lp) != 0x7e79eaa6) lp++;
1003 *lp++ = htonl(POWERPC_NOP);
1004 while (ntohl(*lp) != 0x7e5aeba6) lp++;
1005 *lp++ = htonl(POWERPC_NOP);
1006 while (ntohl(*lp) != 0x7e7aeaa6) lp++;
1007 *lp++ = htonl(POWERPC_NOP);
1008 while (ntohl(*lp) != 0x7e5beba6) lp++;
1009 *lp++ = htonl(POWERPC_NOP);
1010 while (ntohl(*lp) != 0x7e7beaa6) lp++;
1011 *lp++ = htonl(POWERPC_NOP);
1012 while (ntohl(*lp) != 0x7e5feba6) lp++;
1013 *lp++ = htonl(POWERPC_NOP);
1014 while (ntohl(*lp) != 0x7e7feaa6) lp++;
1015 *lp++ = htonl(POWERPC_NOP);
1016 while (ntohl(*lp) != 0x7e5ceba6) lp++;
1017 *lp++ = htonl(POWERPC_NOP);
1018 while (ntohl(*lp) != 0x7e7ceaa6) lp++;
1019 *lp++ = htonl(POWERPC_NOP);
1020 while (ntohl(*lp) != 0x7e5deba6) lp++;
1021 *lp++ = htonl(POWERPC_NOP);
1022 while (ntohl(*lp) != 0x7e7deaa6) lp++;
1023 *lp++ = htonl(POWERPC_NOP);
1024 while (ntohl(*lp) != 0x7e5eeba6) lp++;
1025 *lp++ = htonl(POWERPC_NOP);
1026 while (ntohl(*lp) != 0x7e7eeaa6) lp++;
1027 *lp++ = htonl(POWERPC_NOP);
1028
1029 // Jump to 68k emulator
1030 static const uint32 jump68k_ofs[] = {0x40c, 0x40c, 0x40c, 0x414, 0x434, 0x438};
1031 lp = (uint32 *)(ROM_BASE + loc + jump68k_ofs[ROMType]);
1032 *lp++ = htonl(0x80610634); // lwz r3,0x0634(r1) (pointer to Emulator Data)
1033 *lp++ = htonl(0x8081119c); // lwz r4,0x119c(r1) (pointer to opcode table)
1034 *lp++ = htonl(0x80011184); // lwz r0,0x1184(r1) (pointer to emulator init routine)
1035 *lp++ = htonl(0x7c0903a6); // mtctr r0
1036 *lp = htonl(POWERPC_BCTR);
1037 return true;
1038 }
1039
1040
1041 /*
1042 * 68k emulator patches
1043 */
1044
1045 static bool patch_68k_emul(void)
1046 {
1047 uint32 *lp;
1048 uint32 base;
1049
1050 // Overwrite twi instructions
1051 static const uint32 twi_loc[] = {0x36e680, 0x36e6c0, 0x36e6c0, 0x36e6c0, 0x36e740, 0x36e740};
1052 base = twi_loc[ROMType];
1053 lp = (uint32 *)(ROM_BASE + base);
1054 *lp++ = htonl(0x48000000 + 0x36f900 - base); // b 0x36f900 (Emulator start)
1055 *lp++ = htonl(0x48000000 + 0x36fa00 - base - 4); // b 0x36fa00 (Mixed mode)
1056 *lp++ = htonl(0x48000000 + 0x36fb00 - base - 8); // b 0x36fb00 (Reset/FC1E opcode)
1057 *lp++ = htonl(0x48000000 + 0x36fc00 - base - 12); // FE0A opcode
1058 *lp++ = htonl(POWERPC_ILLEGAL); // Interrupt
1059 *lp++ = htonl(POWERPC_ILLEGAL); // ?
1060 *lp++ = htonl(POWERPC_ILLEGAL);
1061 *lp++ = htonl(POWERPC_ILLEGAL);
1062 *lp++ = htonl(POWERPC_ILLEGAL);
1063 *lp++ = htonl(POWERPC_ILLEGAL);
1064 *lp++ = htonl(POWERPC_ILLEGAL);
1065 *lp++ = htonl(POWERPC_ILLEGAL);
1066 *lp++ = htonl(POWERPC_ILLEGAL);
1067 *lp++ = htonl(POWERPC_ILLEGAL);
1068 *lp++ = htonl(POWERPC_ILLEGAL);
1069 *lp = htonl(POWERPC_ILLEGAL);
1070
1071 #if EMULATED_PPC
1072 // Install EMUL_RETURN, EXEC_RETURN, EXEC_NATIVE and EMUL_OP opcodes
1073 lp = (uint32 *)(ROM_BASE + 0x380000 + (M68K_EMUL_RETURN << 3));
1074 *lp++ = htonl(POWERPC_EMUL_OP);
1075 *lp++ = htonl(0x4bf66e80); // b 0x366084
1076 *lp++ = htonl(POWERPC_EMUL_OP | 1);
1077 *lp++ = htonl(0x4bf66e78); // b 0x366084
1078 *lp++ = htonl(POWERPC_EMUL_OP | 2);
1079 *lp++ = htonl(0x4bf66e70); // b 0x366084
1080 for (int i=0; i<OP_MAX; i++) {
1081 *lp++ = htonl(POWERPC_EMUL_OP | (i + 3));
1082 *lp++ = htonl(0x4bf66e68 - i*8); // b 0x366084
1083 }
1084 #else
1085 // Install EMUL_RETURN, EXEC_RETURN and EMUL_OP opcodes
1086 lp = (uint32 *)(ROM_BASE + 0x380000 + (M68K_EMUL_RETURN << 3));
1087 *lp++ = htonl(0x80000000 + XLM_EMUL_RETURN_PROC); // lwz r0,XLM_EMUL_RETURN_PROC
1088 *lp++ = htonl(0x4bf705fc); // b 0x36f800
1089 *lp++ = htonl(0x80000000 + XLM_EXEC_RETURN_PROC); // lwz r0,XLM_EXEC_RETURN_PROC
1090 *lp++ = htonl(0x4bf705f4); // b 0x36f800
1091 *lp++ = htonl(0x00dead00); // Let SheepShaver crash, since
1092 *lp++ = htonl(0x00beef00); // no native opcode is available
1093 for (int i=0; i<OP_MAX; i++) {
1094 *lp++ = htonl(0x38a00000 + i); // li r5,OP_*
1095 *lp++ = htonl(0x4bf705ec - i*8); // b 0x36f808
1096 }
1097
1098 // Extra routines for EMUL_RETURN/EXEC_RETURN/EMUL_OP
1099 lp = (uint32 *)(ROM_BASE + 0x36f800);
1100 *lp++ = htonl(0x7c0803a6); // mtlr r0
1101 *lp++ = htonl(0x4e800020); // blr
1102
1103 *lp++ = htonl(0x80000000 + XLM_EMUL_OP_PROC); // lwz r0,XLM_EMUL_OP_PROC
1104 *lp++ = htonl(0x7c0803a6); // mtlr r0
1105 *lp = htonl(0x4e800020); // blr
1106 #endif
1107
1108 // Extra routine for 68k emulator start
1109 lp = (uint32 *)(ROM_BASE + 0x36f900);
1110 *lp++ = htonl(0x7c2903a6); // mtctr r1
1111 #if EMULATED_PPC
1112 *lp++ = POWERPC_NATIVE_OP(NATIVE_DISABLE_INTERRUPT);
1113 #else
1114 *lp++ = htonl(0x80200000 + XLM_IRQ_NEST); // lwz r1,XLM_IRQ_NEST
1115 *lp++ = htonl(0x38210001); // addi r1,r1,1
1116 *lp++ = htonl(0x90200000 + XLM_IRQ_NEST); // stw r1,XLM_IRQ_NEST
1117 #endif
1118 *lp++ = htonl(0x80200000 + XLM_KERNEL_DATA);// lwz r1,XLM_KERNEL_DATA
1119 *lp++ = htonl(0x90c10018); // stw r6,0x18(r1)
1120 *lp++ = htonl(0x7cc902a6); // mfctr r6
1121 *lp++ = htonl(0x90c10004); // stw r6,$0004(r1)
1122 *lp++ = htonl(0x80c1065c); // lwz r6,$065c(r1)
1123 *lp++ = htonl(0x90e6013c); // stw r7,$013c(r6)
1124 *lp++ = htonl(0x91060144); // stw r8,$0144(r6)
1125 *lp++ = htonl(0x9126014c); // stw r9,$014c(r6)
1126 *lp++ = htonl(0x91460154); // stw r10,$0154(r6)
1127 *lp++ = htonl(0x9166015c); // stw r11,$015c(r6)
1128 *lp++ = htonl(0x91860164); // stw r12,$0164(r6)
1129 *lp++ = htonl(0x91a6016c); // stw r13,$016c(r6)
1130 *lp++ = htonl(0x7da00026); // mfcr r13
1131 *lp++ = htonl(0x80e10660); // lwz r7,$0660(r1)
1132 *lp++ = htonl(0x7d8802a6); // mflr r12
1133 *lp++ = htonl(0x50e74001); // rlwimi. r7,r7,8,$80000000
1134 *lp++ = htonl(0x814105f0); // lwz r10,0x05f0(r1)
1135 *lp++ = htonl(0x7d4803a6); // mtlr r10
1136 *lp++ = htonl(0x7d8a6378); // mr r10,r12
1137 *lp++ = htonl(0x3d600002); // lis r11,0x0002
1138 *lp++ = htonl(0x616bf072); // ori r11,r11,0xf072 (MSR)
1139 *lp++ = htonl(0x50e7deb4); // rlwimi r7,r7,27,$00000020
1140 *lp = htonl(0x4e800020); // blr
1141
1142 // Extra routine for Mixed Mode
1143 lp = (uint32 *)(ROM_BASE + 0x36fa00);
1144 *lp++ = htonl(0x7c2903a6); // mtctr r1
1145 #if EMULATED_PPC
1146 *lp++ = POWERPC_NATIVE_OP(NATIVE_DISABLE_INTERRUPT);
1147 #else
1148 *lp++ = htonl(0x80200000 + XLM_IRQ_NEST); // lwz r1,XLM_IRQ_NEST
1149 *lp++ = htonl(0x38210001); // addi r1,r1,1
1150 *lp++ = htonl(0x90200000 + XLM_IRQ_NEST); // stw r1,XLM_IRQ_NEST
1151 #endif
1152 *lp++ = htonl(0x80200000 + XLM_KERNEL_DATA);// lwz r1,XLM_KERNEL_DATA
1153 *lp++ = htonl(0x90c10018); // stw r6,0x18(r1)
1154 *lp++ = htonl(0x7cc902a6); // mfctr r6
1155 *lp++ = htonl(0x90c10004); // stw r6,$0004(r1)
1156 *lp++ = htonl(0x80c1065c); // lwz r6,$065c(r1)
1157 *lp++ = htonl(0x90e6013c); // stw r7,$013c(r6)
1158 *lp++ = htonl(0x91060144); // stw r8,$0144(r6)
1159 *lp++ = htonl(0x9126014c); // stw r9,$014c(r6)
1160 *lp++ = htonl(0x91460154); // stw r10,$0154(r6)
1161 *lp++ = htonl(0x9166015c); // stw r11,$015c(r6)
1162 *lp++ = htonl(0x91860164); // stw r12,$0164(r6)
1163 *lp++ = htonl(0x91a6016c); // stw r13,$016c(r6)
1164 *lp++ = htonl(0x7da00026); // mfcr r13
1165 *lp++ = htonl(0x80e10660); // lwz r7,$0660(r1)
1166 *lp++ = htonl(0x7d8802a6); // mflr r12
1167 *lp++ = htonl(0x50e74001); // rlwimi. r7,r7,8,$80000000
1168 *lp++ = htonl(0x814105f4); // lwz r10,0x05f4(r1)
1169 *lp++ = htonl(0x7d4803a6); // mtlr r10
1170 *lp++ = htonl(0x7d8a6378); // mr r10,r12
1171 *lp++ = htonl(0x3d600002); // lis r11,0x0002
1172 *lp++ = htonl(0x616bf072); // ori r11,r11,0xf072 (MSR)
1173 *lp++ = htonl(0x50e7deb4); // rlwimi r7,r7,27,$00000020
1174 *lp = htonl(0x4e800020); // blr
1175
1176 // Extra routine for Reset/FC1E opcode
1177 lp = (uint32 *)(ROM_BASE + 0x36fb00);
1178 *lp++ = htonl(0x7c2903a6); // mtctr r1
1179 #if EMULATED_PPC
1180 *lp++ = POWERPC_NATIVE_OP(NATIVE_DISABLE_INTERRUPT);
1181 #else
1182 *lp++ = htonl(0x80200000 + XLM_IRQ_NEST); // lwz r1,XLM_IRQ_NEST
1183 *lp++ = htonl(0x38210001); // addi r1,r1,1
1184 *lp++ = htonl(0x90200000 + XLM_IRQ_NEST); // stw r1,XLM_IRQ_NEST
1185 #endif
1186 *lp++ = htonl(0x80200000 + XLM_KERNEL_DATA);// lwz r1,XLM_KERNEL_DATA
1187 *lp++ = htonl(0x90c10018); // stw r6,0x18(r1)
1188 *lp++ = htonl(0x7cc902a6); // mfctr r6
1189 *lp++ = htonl(0x90c10004); // stw r6,$0004(r1)
1190 *lp++ = htonl(0x80c1065c); // lwz r6,$065c(r1)
1191 *lp++ = htonl(0x90e6013c); // stw r7,$013c(r6)
1192 *lp++ = htonl(0x91060144); // stw r8,$0144(r6)
1193 *lp++ = htonl(0x9126014c); // stw r9,$014c(r6)
1194 *lp++ = htonl(0x91460154); // stw r10,$0154(r6)
1195 *lp++ = htonl(0x9166015c); // stw r11,$015c(r6)
1196 *lp++ = htonl(0x91860164); // stw r12,$0164(r6)
1197 *lp++ = htonl(0x91a6016c); // stw r13,$016c(r6)
1198 *lp++ = htonl(0x7da00026); // mfcr r13
1199 *lp++ = htonl(0x80e10660); // lwz r7,$0660(r1)
1200 *lp++ = htonl(0x7d8802a6); // mflr r12
1201 *lp++ = htonl(0x50e74001); // rlwimi. r7,r7,8,$80000000
1202 *lp++ = htonl(0x814105f8); // lwz r10,0x05f8(r1)
1203 *lp++ = htonl(0x7d4803a6); // mtlr r10
1204 *lp++ = htonl(0x7d8a6378); // mr r10,r12
1205 *lp++ = htonl(0x3d600002); // lis r11,0x0002
1206 *lp++ = htonl(0x616bf072); // ori r11,r11,0xf072 (MSR)
1207 *lp++ = htonl(0x50e7deb4); // rlwimi r7,r7,27,$00000020
1208 *lp = htonl(0x4e800020); // blr
1209
1210 // Extra routine for FE0A opcode (QuickDraw 3D needs this)
1211 lp = (uint32 *)(ROM_BASE + 0x36fc00);
1212 *lp++ = htonl(0x7c2903a6); // mtctr r1
1213 #if EMULATED_PPC
1214 *lp++ = POWERPC_NATIVE_OP(NATIVE_DISABLE_INTERRUPT);
1215 #else
1216 *lp++ = htonl(0x80200000 + XLM_IRQ_NEST); // lwz r1,XLM_IRQ_NEST
1217 *lp++ = htonl(0x38210001); // addi r1,r1,1
1218 *lp++ = htonl(0x90200000 + XLM_IRQ_NEST); // stw r1,XLM_IRQ_NEST
1219 #endif
1220 *lp++ = htonl(0x80200000 + XLM_KERNEL_DATA);// lwz r1,XLM_KERNEL_DATA
1221 *lp++ = htonl(0x90c10018); // stw r6,0x18(r1)
1222 *lp++ = htonl(0x7cc902a6); // mfctr r6
1223 *lp++ = htonl(0x90c10004); // stw r6,$0004(r1)
1224 *lp++ = htonl(0x80c1065c); // lwz r6,$065c(r1)
1225 *lp++ = htonl(0x90e6013c); // stw r7,$013c(r6)
1226 *lp++ = htonl(0x91060144); // stw r8,$0144(r6)
1227 *lp++ = htonl(0x9126014c); // stw r9,$014c(r6)
1228 *lp++ = htonl(0x91460154); // stw r10,$0154(r6)
1229 *lp++ = htonl(0x9166015c); // stw r11,$015c(r6)
1230 *lp++ = htonl(0x91860164); // stw r12,$0164(r6)
1231 *lp++ = htonl(0x91a6016c); // stw r13,$016c(r6)
1232 *lp++ = htonl(0x7da00026); // mfcr r13
1233 *lp++ = htonl(0x80e10660); // lwz r7,$0660(r1)
1234 *lp++ = htonl(0x7d8802a6); // mflr r12
1235 *lp++ = htonl(0x50e74001); // rlwimi. r7,r7,8,$80000000
1236 *lp++ = htonl(0x814105fc); // lwz r10,0x05fc(r1)
1237 *lp++ = htonl(0x7d4803a6); // mtlr r10
1238 *lp++ = htonl(0x7d8a6378); // mr r10,r12
1239 *lp++ = htonl(0x3d600002); // lis r11,0x0002
1240 *lp++ = htonl(0x616bf072); // ori r11,r11,0xf072 (MSR)
1241 *lp++ = htonl(0x50e7deb4); // rlwimi r7,r7,27,$00000020
1242 *lp = htonl(0x4e800020); // blr
1243
1244 // Patch DR emulator to jump to right address when an interrupt occurs
1245 lp = (uint32 *)(ROM_BASE + 0x370000);
1246 while (lp < (uint32 *)(ROM_BASE + 0x380000)) {
1247 if (ntohl(*lp) == 0x4ca80020) // bclr 5,8
1248 goto dr_found;
1249 lp++;
1250 }
1251 D(bug("DR emulator patch location not found\n"));
1252 return false;
1253 dr_found:
1254 lp++;
1255 *lp = htonl(0x48000000 + 0xf000 - (((uint32)lp - ROM_BASE) & 0xffff)); // b DR_CACHE_BASE+0x1f000
1256 lp = (uint32 *)(ROM_BASE + 0x37f000);
1257 *lp++ = htonl(0x3c000000 + ((ROM_BASE + 0x46d0a4) >> 16)); // lis r0,xxx
1258 *lp++ = htonl(0x60000000 + ((ROM_BASE + 0x46d0a4) & 0xffff)); // ori r0,r0,xxx
1259 *lp++ = htonl(0x7c0903a6); // mtctr r0
1260 *lp = htonl(POWERPC_BCTR); // bctr
1261 return true;
1262 }
1263
1264
1265 /*
1266 * Nanokernel patches
1267 */
1268
1269 static bool patch_nanokernel(void)
1270 {
1271 uint32 *lp;
1272
1273 // Patch Mixed Mode trap
1274 lp = (uint32 *)(ROM_BASE + 0x313c90); // Don't translate virtual->physical
1275 while (ntohl(*lp) != 0x3ba10320) lp++;
1276 lp++;
1277 *lp++ = htonl(0x7f7fdb78); // mr r31,r27
1278 lp++;
1279 *lp = htonl(POWERPC_NOP);
1280
1281 lp = (uint32 *)(ROM_BASE + 0x313c3c); // Don't activate PPC exception table
1282 while (ntohl(*lp) != 0x39010420) lp++;
1283 *lp++ = htonl(0x39000000 + MODE_NATIVE); // li r8,MODE_NATIVE
1284 *lp = htonl(0x91000000 + XLM_RUN_MODE); // stw r8,XLM_RUN_MODE
1285
1286 lp = (uint32 *)(ROM_BASE + 0x312e88); // Don't modify MSR to turn on FPU
1287 while (ntohl(*lp) != 0x556b04e2) lp++;
1288 lp -= 4;
1289 *lp++ = htonl(POWERPC_NOP);
1290 lp++;
1291 *lp++ = htonl(POWERPC_NOP);
1292 lp++;
1293 *lp = htonl(POWERPC_NOP);
1294
1295 lp = (uint32 *)(ROM_BASE + 0x312b3c); // Always save FPU state
1296 while (ntohl(*lp) != 0x81010668) lp++;
1297 lp--;
1298 *lp = htonl(0x48000000 | (ntohl(*lp) & 0xffff)); // bl 0x00312e88
1299
1300 lp = (uint32 *)(ROM_BASE + 0x312b44); // Don't read DEC
1301 while (ntohl(*lp) != 0x7ff602a6) lp++;
1302 *lp = htonl(0x3be00000); // li r31,0
1303
1304 lp = (uint32 *)(ROM_BASE + 0x312b50); // Don't write DEC
1305 while (ntohl(*lp) != 0x7d1603a6) lp++;
1306 #if 1
1307 *lp++ = htonl(POWERPC_NOP);
1308 *lp = htonl(POWERPC_NOP);
1309 #else
1310 *lp++ = htonl(0x39000040); // li r8,0x40
1311 *lp = htonl(0x990600e4); // stb r8,0xe4(r6)
1312 #endif
1313
1314 lp = (uint32 *)(ROM_BASE + 0x312b9c); // Always restore FPU state
1315 while (ntohl(*lp) != 0x7c00092d) lp++;
1316 lp--;
1317 *lp = htonl(0x48000000 | (ntohl(*lp) & 0xffff)); // bl 0x00312ddc
1318
1319 lp = (uint32 *)(ROM_BASE + 0x312a68); // Don't activate 68k exception table
1320 while (ntohl(*lp) != 0x39010360) lp++;
1321 *lp++ = htonl(0x39000000 + MODE_68K); // li r8,MODE_68K
1322 *lp = htonl(0x91000000 + XLM_RUN_MODE); // stw r8,XLM_RUN_MODE
1323
1324 // Patch 68k emulator trap routine
1325 lp = (uint32 *)(ROM_BASE + 0x312994); // Always restore FPU state
1326 while (ntohl(*lp) != 0x39260040) lp++;
1327 lp--;
1328 *lp = htonl(0x48000000 | (ntohl(*lp) & 0xffff)); // bl 0x00312dd4
1329
1330 lp = (uint32 *)(ROM_BASE + 0x312dd8); // Don't modify MSR to turn on FPU
1331 while (ntohl(*lp) != 0x810600e4) lp++;
1332 lp--;
1333 *lp++ = htonl(POWERPC_NOP);
1334 lp += 2;
1335 *lp++ = htonl(POWERPC_NOP);
1336 lp++;
1337 *lp++ = htonl(POWERPC_NOP);
1338 *lp++ = htonl(POWERPC_NOP);
1339 *lp = htonl(POWERPC_NOP);
1340
1341 // Patch trap return routine
1342 lp = (uint32 *)(ROM_BASE + 0x312c20);
1343 while (ntohl(*lp) != 0x7d5a03a6) lp++;
1344 *lp++ = htonl(0x7d4903a6); // mtctr r10
1345 *lp++ = htonl(0x7daff120); // mtcr r13
1346 *lp = htonl(0x48000000 + 0x8000 - (((uint32)lp - ROM_BASE) & 0xffff)); // b ROM_BASE+0x318000
1347 uint32 xlp = ((uint32)(lp+1) - ROM_BASE) & 0xffff;
1348
1349 lp = (uint32 *)(ROM_BASE + 0x312c50); // Replace rfi
1350 while (ntohl(*lp) != 0x4c000064) lp++;
1351 *lp = htonl(POWERPC_BCTR);
1352
1353 lp = (uint32 *)(ROM_BASE + 0x318000);
1354 #if EMULATED_PPC
1355 *lp++ = POWERPC_NATIVE_OP(NATIVE_ENABLE_INTERRUPT);
1356 *lp = htonl(0x48000000 + ((xlp - 0x8004) & 0x03fffffc)); // b ROM_BASE+0x312c2c
1357 #else
1358 *lp++ = htonl(0x81400000 + XLM_IRQ_NEST); // lwz r10,XLM_IRQ_NEST
1359 *lp++ = htonl(0x394affff); // subi r10,r10,1
1360 *lp++ = htonl(0x91400000 + XLM_IRQ_NEST); // stw r10,XLM_IRQ_NEST
1361 *lp = htonl(0x48000000 + ((xlp - 0x800c) & 0x03fffffc)); // b ROM_BASE+0x312c2c
1362 #endif
1363
1364 /*
1365 // Disable FE0A/FE06 opcodes
1366 lp = (uint32 *)(ROM_BASE + 0x3144ac);
1367 *lp++ = htonl(POWERPC_NOP);
1368 *lp += 8;
1369 */
1370 return true;
1371 }
1372
1373
1374 /*
1375 * 68k boot routine patches
1376 */
1377
1378 static bool patch_68k(void)
1379 {
1380 uint32 *lp;
1381 uint16 *wp;
1382 uint8 *bp;
1383 uint32 base;
1384
1385 // Remove 68k RESET instruction
1386 static const uint8 reset_dat[] = {0x4e, 0x70};
1387 if ((base = find_rom_data(0xc8, 0x120, reset_dat, sizeof(reset_dat))) == 0) return false;
1388 D(bug("reset %08lx\n", base));
1389 wp = (uint16 *)(ROM_BASE + base);
1390 *wp = htons(M68K_NOP);
1391
1392 // Fake reading PowerMac ID (via Universal)
1393 static const uint8 powermac_id_dat[] = {0x45, 0xf9, 0x5f, 0xff, 0xff, 0xfc, 0x20, 0x12, 0x72, 0x00};
1394 if ((base = find_rom_data(0xe000, 0x15000, powermac_id_dat, sizeof(powermac_id_dat))) == 0) return false;
1395 D(bug("powermac_id %08lx\n", base));
1396 wp = (uint16 *)(ROM_BASE + base);
1397 *wp++ = htons(0x203c); // move.l #id,d0
1398 *wp++ = htons(0);
1399 // if (ROMType == ROMTYPE_NEWWORLD)
1400 // *wp++ = htons(0x3035); // (PowerMac 9500 ID)
1401 // else
1402 *wp++ = htons(0x3020); // (PowerMac 9500 ID)
1403 *wp++ = htons(0xb040); // cmp.w d0,d0
1404 *wp = htons(0x4ed6); // jmp (a6)
1405
1406 // Patch UniversalInfo
1407 if (ROMType == ROMTYPE_NEWWORLD) {
1408 static const uint8 univ_info_dat[] = {0x3f, 0xff, 0x04, 0x00};
1409 if ((base = find_rom_data(0x14000, 0x18000, univ_info_dat, sizeof(univ_info_dat))) == 0) return false;
1410 D(bug("universal_info %08lx\n", base));
1411 lp = (uint32 *)(ROM_BASE + base - 0x14);
1412 lp[0x00 >> 2] = htonl(ADDR_MAP_PATCH_SPACE - (base - 0x14));
1413 lp[0x10 >> 2] = htonl(0xcc003d11); // Make it like the PowerMac 9500 UniversalInfo
1414 lp[0x14 >> 2] = htonl(0x3fff0401);
1415 lp[0x18 >> 2] = htonl(0x0300001c);
1416 lp[0x1c >> 2] = htonl(0x000108c4);
1417 lp[0x24 >> 2] = htonl(0xc301bf26);
1418 lp[0x28 >> 2] = htonl(0x00000861);
1419 lp[0x58 >> 2] = htonl(0x30200000);
1420 lp[0x60 >> 2] = htonl(0x0000003d);
1421 } else if (ROMType == ROMTYPE_ZANZIBAR) {
1422 base = 0x12b70;
1423 lp = (uint32 *)(ROM_BASE + base - 0x14);
1424 lp[0x00 >> 2] = htonl(ADDR_MAP_PATCH_SPACE - (base - 0x14));
1425 lp[0x10 >> 2] = htonl(0xcc003d11); // Make it like the PowerMac 9500 UniversalInfo
1426 lp[0x14 >> 2] = htonl(0x3fff0401);
1427 lp[0x18 >> 2] = htonl(0x0300001c);
1428 lp[0x1c >> 2] = htonl(0x000108c4);
1429 lp[0x24 >> 2] = htonl(0xc301bf26);
1430 lp[0x28 >> 2] = htonl(0x00000861);
1431 lp[0x58 >> 2] = htonl(0x30200000);
1432 lp[0x60 >> 2] = htonl(0x0000003d);
1433 } else if (ROMType == ROMTYPE_GOSSAMER) {
1434 base = 0x12d20;
1435 lp = (uint32 *)(ROM_BASE + base - 0x14);
1436 lp[0x00 >> 2] = htonl(ADDR_MAP_PATCH_SPACE - (base - 0x14));
1437 lp[0x10 >> 2] = htonl(0xcc003d11); // Make it like the PowerMac 9500 UniversalInfo
1438 lp[0x14 >> 2] = htonl(0x3fff0401);
1439 lp[0x18 >> 2] = htonl(0x0300001c);
1440 lp[0x1c >> 2] = htonl(0x000108c4);
1441 lp[0x24 >> 2] = htonl(0xc301bf26);
1442 lp[0x28 >> 2] = htonl(0x00000861);
1443 lp[0x58 >> 2] = htonl(0x30410000);
1444 lp[0x60 >> 2] = htonl(0x0000003d);
1445 }
1446
1447 // Construct AddrMap for NewWorld ROM
1448 if (ROMType == ROMTYPE_NEWWORLD || ROMType == ROMTYPE_ZANZIBAR || ROMType == ROMTYPE_GOSSAMER) {
1449 lp = (uint32 *)(ROM_BASE + ADDR_MAP_PATCH_SPACE);
1450 memset(lp - 10, 0, 0x128);
1451 lp[-10] = htonl(0x0300001c);
1452 lp[-9] = htonl(0x000108c4);
1453 lp[-4] = htonl(0x00300000);
1454 lp[-2] = htonl(0x11010000);
1455 lp[-1] = htonl(0xf8000000);
1456 lp[0] = htonl(0xffc00000);
1457 lp[2] = htonl(0xf3016000);
1458 lp[3] = htonl(0xf3012000);
1459 lp[4] = htonl(0xf3012000);
1460 lp[24] = htonl(0xf3018000);
1461 lp[25] = htonl(0xf3010000);
1462 lp[34] = htonl(0xf3011000);
1463 lp[38] = htonl(0xf3015000);
1464 lp[39] = htonl(0xf3014000);
1465 lp[43] = htonl(0xf3000000);
1466 lp[48] = htonl(0xf8000000);
1467 }
1468
1469 // Don't initialize VIA (via Universal)
1470 static const uint8 via_init_dat[] = {0x08, 0x00, 0x00, 0x02, 0x67, 0x00, 0x00, 0x2c, 0x24, 0x68, 0x00, 0x08};
1471 if ((base = find_rom_data(0xe000, 0x15000, via_init_dat, sizeof(via_init_dat))) == 0) return false;
1472 D(bug("via_init %08lx\n", base));
1473 wp = (uint16 *)(ROM_BASE + base + 4);
1474 *wp = htons(0x6000); // bra
1475
1476 static const uint8 via_init2_dat[] = {0x24, 0x68, 0x00, 0x08, 0x00, 0x12, 0x00, 0x30, 0x4e, 0x71};
1477 if ((base = find_rom_data(0xa000, 0x10000, via_init2_dat, sizeof(via_init2_dat))) == 0) return false;
1478 D(bug("via_init2 %08lx\n", base));
1479 wp = (uint16 *)(ROM_BASE + base);
1480 *wp = htons(0x4ed6); // jmp (a6)
1481
1482 static const uint8 via_init3_dat[] = {0x22, 0x68, 0x00, 0x08, 0x28, 0x3c, 0x20, 0x00, 0x01, 0x00};
1483 if ((base = find_rom_data(0xa000, 0x10000, via_init3_dat, sizeof(via_init3_dat))) == 0) return false;
1484 D(bug("via_init3 %08lx\n", base));
1485 wp = (uint16 *)(ROM_BASE + base);
1486 *wp = htons(0x4ed6); // jmp (a6)
1487
1488 // Don't RunDiags, get BootGlobs pointer directly
1489 if (ROMType == ROMTYPE_NEWWORLD) {
1490 static const uint8 run_diags_dat[] = {0x60, 0xff, 0x00, 0x0c};
1491 if ((base = find_rom_data(0x110, 0x128, run_diags_dat, sizeof(run_diags_dat))) == 0) return false;
1492 D(bug("run_diags %08lx\n", base));
1493 wp = (uint16 *)(ROM_BASE + base);
1494 *wp++ = htons(0x4df9); // lea xxx,a6
1495 *wp++ = htons((RAMBase + RAMSize - 0x1c) >> 16);
1496 *wp = htons((RAMBase + RAMSize - 0x1c) & 0xffff);
1497 } else {
1498 static const uint8 run_diags_dat[] = {0x74, 0x00, 0x2f, 0x0e};
1499 if ((base = find_rom_data(0xd0, 0xf0, run_diags_dat, sizeof(run_diags_dat))) == 0) return false;
1500 D(bug("run_diags %08lx\n", base));
1501 wp = (uint16 *)(ROM_BASE + base - 6);
1502 *wp++ = htons(0x4df9); // lea xxx,a6
1503 *wp++ = htons((RAMBase + RAMSize - 0x1c) >> 16);
1504 *wp = htons((RAMBase + RAMSize - 0x1c) & 0xffff);
1505 }
1506
1507 // Replace NVRAM routines
1508 static const uint8 nvram1_dat[] = {0x48, 0xe7, 0x01, 0x0e, 0x24, 0x68, 0x00, 0x08, 0x08, 0x83, 0x00, 0x1f};
1509 if ((base = find_rom_data(0x7000, 0xc000, nvram1_dat, sizeof(nvram1_dat))) == 0) return false;
1510 D(bug("nvram1 %08lx\n", base));
1511 wp = (uint16 *)(ROM_BASE + base);
1512 *wp++ = htons(M68K_EMUL_OP_XPRAM1);
1513 *wp = htons(M68K_RTS);
1514
1515 if (ROMType == ROMTYPE_NEWWORLD) {
1516 static const uint8 nvram2_dat[] = {0x48, 0xe7, 0x1c, 0xe0, 0x4f, 0xef, 0xff, 0xb4};
1517 if ((base = find_rom_data(0xa000, 0xd000, nvram2_dat, sizeof(nvram2_dat))) == 0) return false;
1518 D(bug("nvram2 %08lx\n", base));
1519 wp = (uint16 *)(ROM_BASE + base);
1520 *wp++ = htons(M68K_EMUL_OP_XPRAM2);
1521 *wp = htons(0x4ed3); // jmp (a3)
1522
1523 static const uint8 nvram3_dat[] = {0x48, 0xe7, 0xdc, 0xe0, 0x4f, 0xef, 0xff, 0xb4};
1524 if ((base = find_rom_data(0xa000, 0xd000, nvram3_dat, sizeof(nvram3_dat))) == 0) return false;
1525 D(bug("nvram3 %08lx\n", base));
1526 wp = (uint16 *)(ROM_BASE + base);
1527 *wp++ = htons(M68K_EMUL_OP_XPRAM3);
1528 *wp = htons(0x4ed3); // jmp (a3)
1529
1530 static const uint8 nvram4_dat[] = {0x4e, 0x56, 0xff, 0xa8, 0x48, 0xe7, 0x1f, 0x38, 0x16, 0x2e, 0x00, 0x13};
1531 if ((base = find_rom_data(0xa000, 0xd000, nvram4_dat, sizeof(nvram4_dat))) == 0) return false;
1532 D(bug("nvram4 %08lx\n", base));
1533 wp = (uint16 *)(ROM_BASE + base + 16);
1534 *wp++ = htons(0x1a2e); // move.b ($000f,a6),d5
1535 *wp++ = htons(0x000f);
1536 *wp++ = htons(M68K_EMUL_OP_NVRAM3);
1537 *wp++ = htons(0x4cee); // movem.l ($ff88,a6),d3-d7/a2-a4
1538 *wp++ = htons(0x1cf8);
1539 *wp++ = htons(0xff88);
1540 *wp++ = htons(0x4e5e); // unlk a6
1541 *wp = htons(M68K_RTS);
1542
1543 static const uint8 nvram5_dat[] = {0x0c, 0x80, 0x03, 0x00, 0x00, 0x00, 0x66, 0x0a, 0x70, 0x00, 0x21, 0xf8, 0x02, 0x0c, 0x01, 0xe4};
1544 if ((base = find_rom_data(0xa000, 0xd000, nvram5_dat, sizeof(nvram5_dat))) == 0) return false;
1545 D(bug("nvram5 %08lx\n", base));
1546 wp = (uint16 *)(ROM_BASE + base + 6);
1547 *wp = htons(M68K_NOP);
1548
1549 static const uint8 nvram6_dat[] = {0x2f, 0x0a, 0x24, 0x48, 0x4f, 0xef, 0xff, 0xa0, 0x20, 0x0f};
1550 if ((base = find_rom_data(0x9000, 0xb000, nvram6_dat, sizeof(nvram6_dat))) == 0) return false;
1551 D(bug("nvram6 %08lx\n", base));
1552 wp = (uint16 *)(ROM_BASE + base);
1553 *wp++ = htons(0x7000); // moveq #0,d0
1554 *wp++ = htons(0x2080); // move.l d0,(a0)
1555 *wp++ = htons(0x4228); // clr.b 4(a0)
1556 *wp++ = htons(0x0004);
1557 *wp = htons(M68K_RTS);
1558
1559 static const uint8 nvram7_dat[] = {0x42, 0x2a, 0x00, 0x04, 0x4f, 0xef, 0x00, 0x60, 0x24, 0x5f, 0x4e, 0x75, 0x4f, 0xef, 0xff, 0xa0, 0x20, 0x0f};
1560 base = find_rom_data(0x9000, 0xb000, nvram7_dat, sizeof(nvram7_dat));
1561 if (base) {
1562 D(bug("nvram7 %08lx\n", base));
1563 wp = (uint16 *)(ROM_BASE + base + 12);
1564 *wp = htons(M68K_RTS);
1565 }
1566 } else {
1567 static const uint8 nvram2_dat[] = {0x4e, 0xd6, 0x06, 0x41, 0x13, 0x00};
1568 if ((base = find_rom_data(0x7000, 0xb000, nvram2_dat, sizeof(nvram2_dat))) == 0) return false;
1569 D(bug("nvram2 %08lx\n", base));
1570 wp = (uint16 *)(ROM_BASE + base + 2);
1571 *wp++ = htons(M68K_EMUL_OP_XPRAM2);
1572 *wp = htons(0x4ed3); // jmp (a3)
1573
1574 static const uint8 nvram3_dat[] = {0x4e, 0xd3, 0x06, 0x41, 0x13, 0x00};
1575 if ((base = find_rom_data(0x7000, 0xb000, nvram3_dat, sizeof(nvram3_dat))) == 0) return false;
1576 D(bug("nvram3 %08lx\n", base));
1577 wp = (uint16 *)(ROM_BASE + base + 2);
1578 *wp++ = htons(M68K_EMUL_OP_XPRAM3);
1579 *wp = htons(0x4ed3); // jmp (a3)
1580
1581 static const uint32 nvram4_loc[] = {0x582f0, 0xa0a0, 0x7e50, 0xa1d0, 0x538d0, 0};
1582 wp = (uint16 *)(ROM_BASE + nvram4_loc[ROMType]);
1583 *wp++ = htons(0x202f); // move.l 4(sp),d0
1584 *wp++ = htons(0x0004);
1585 *wp++ = htons(M68K_EMUL_OP_NVRAM1);
1586 if (ROMType == ROMTYPE_ZANZIBAR || ROMType == ROMTYPE_GAZELLE)
1587 *wp = htons(M68K_RTS);
1588 else {
1589 *wp++ = htons(0x1f40); // move.b d0,8(sp)
1590 *wp++ = htons(0x0008);
1591 *wp++ = htons(0x4e74); // rtd #4
1592 *wp = htons(0x0004);
1593 }
1594
1595 static const uint32 nvram5_loc[] = {0x58460, 0xa0f0, 0x7f40, 0xa220, 0x53a20, 0};
1596 wp = (uint16 *)(ROM_BASE + nvram5_loc[ROMType]);
1597 if (ROMType == ROMTYPE_ZANZIBAR || ROMType == ROMTYPE_GAZELLE) {
1598 *wp++ = htons(0x202f); // move.l 4(sp),d0
1599 *wp++ = htons(0x0004);
1600 *wp++ = htons(0x122f); // move.b 11(sp),d1
1601 *wp++ = htons(0x000b);
1602 *wp++ = htons(M68K_EMUL_OP_NVRAM2);
1603 *wp = htons(M68K_RTS);
1604 } else {
1605 *wp++ = htons(0x202f); // move.l 6(sp),d0
1606 *wp++ = htons(0x0006);
1607 *wp++ = htons(0x122f); // move.b 4(sp),d1
1608 *wp++ = htons(0x0004);
1609 *wp++ = htons(M68K_EMUL_OP_NVRAM2);
1610 *wp++ = htons(0x4e74); // rtd #6
1611 *wp = htons(0x0006);
1612 }
1613 }
1614
1615 // Fix MemTop/BootGlobs during system startup
1616 static const uint8 mem_top_dat[] = {0x2c, 0x6c, 0xff, 0xec, 0x2a, 0x4c, 0xdb, 0xec, 0xff, 0xf4};
1617 if ((base = find_rom_data(0x120, 0x180, mem_top_dat, sizeof(mem_top_dat))) == 0) return false;
1618 D(bug("mem_top %08lx\n", base));
1619 wp = (uint16 *)(ROM_BASE + base);
1620 *wp++ = htons(M68K_EMUL_OP_FIX_MEMTOP);
1621 *wp = htons(M68K_NOP);
1622
1623 // Don't initialize SCC (via 0x1ac)
1624 static const uint8 scc_init_dat[] = {0x48, 0xe7, 0x38, 0xfe};
1625 if ((base = find_rom_data(0x190, 0x1f0, scc_init_dat, sizeof(scc_init_dat))) == 0) return false;
1626 D(bug("scc_init %08lx\n", base));
1627 wp = (uint16 *)(ROM_BASE + base - 2);
1628 wp = (uint16 *)(ROM_BASE + ntohs(*wp) + base - 2);
1629 *wp++ = htons(M68K_EMUL_OP_RESET);
1630 *wp = htons(M68K_RTS);
1631
1632 // Don't EnableExtCache (via 0x1f6) and don't DisableIntSources(via 0x1fc)
1633 static const uint8 ext_cache_dat[] = {0x4e, 0x7b, 0x00, 0x02};
1634 if ((base = find_rom_data(0x1d0, 0x230, ext_cache_dat, sizeof(ext_cache_dat))) == 0) return false;
1635 D(bug("ext_cache %08lx\n", base));
1636 lp = (uint32 *)(ROM_BASE + base + 6);
1637 wp = (uint16 *)(ROM_BASE + ntohl(*lp) + base + 6);
1638 *wp = htons(M68K_RTS);
1639 lp = (uint32 *)(ROM_BASE + base + 12);
1640 wp = (uint16 *)(ROM_BASE + ntohl(*lp) + base + 12);
1641 *wp = htons(M68K_RTS);
1642
1643 // Fake CPU speed test (SetupTimeK)
1644 static const uint8 timek_dat[] = {0x0c, 0x38, 0x00, 0x04, 0x01, 0x2f, 0x6d, 0x3c};
1645 if ((base = find_rom_data(0x400, 0x500, timek_dat, sizeof(timek_dat))) == 0) return false;
1646 D(bug("timek %08lx\n", base));
1647 wp = (uint16 *)(ROM_BASE + base);
1648 *wp++ = htons(0x31fc); // move.w #xxx,TimeDBRA
1649 *wp++ = htons(100);
1650 *wp++ = htons(0x0d00);
1651 *wp++ = htons(0x31fc); // move.w #xxx,TimeSCCDBRA
1652 *wp++ = htons(100);
1653 *wp++ = htons(0x0d02);
1654 *wp++ = htons(0x31fc); // move.w #xxx,TimeSCSIDBRA
1655 *wp++ = htons(100);
1656 *wp++ = htons(0x0b24);
1657 *wp++ = htons(0x31fc); // move.w #xxx,TimeRAMDBRA
1658 *wp++ = htons(100);
1659 *wp++ = htons(0x0cea);
1660 *wp = htons(M68K_RTS);
1661
1662 // Relocate jump tables ($2000..)
1663 static const uint8 jump_tab_dat[] = {0x41, 0xfa, 0x00, 0x0e, 0x21, 0xc8, 0x20, 0x10, 0x4e, 0x75};
1664 if ((base = find_rom_data(0x3000, 0x6000, jump_tab_dat, sizeof(jump_tab_dat))) == 0) return false;
1665 D(bug("jump_tab %08lx\n", base));
1666 lp = (uint32 *)(ROM_BASE + base + 16);
1667 for (;;) {
1668 D(bug(" %08lx\n", (uint32)lp - ROM_BASE));
1669 while ((ntohl(*lp) & 0xff000000) == 0xff000000) {
1670 *lp = htonl((ntohl(*lp) & (ROM_SIZE-1)) + ROM_BASE);
1671 lp++;
1672 }
1673 while (!ntohl(*lp)) lp++;
1674 if (ntohl(*lp) != 0x41fa000e)
1675 break;
1676 lp += 4;
1677 }
1678
1679 // Create SysZone at start of Mac RAM (SetSysAppZone, via 0x22a)
1680 static const uint8 sys_zone_dat[] = {0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x40, 0x00};
1681 if ((base = find_rom_data(0x600, 0x900, sys_zone_dat, sizeof(sys_zone_dat))) == 0) return false;
1682 D(bug("sys_zone %08lx\n", base));
1683 lp = (uint32 *)(ROM_BASE + base);
1684 *lp++ = htonl(RAMBase ? RAMBase : 0x3000);
1685 *lp = htonl(RAMBase ? RAMBase + 0x1800 : 0x4800);
1686
1687 // Set boot stack at RAMBase+4MB and fix logical/physical RAM size (CompBootStack)
1688 // The RAM size fix must be done after InitMemMgr!
1689 static const uint8 boot_stack_dat[] = {0x08, 0x38, 0x00, 0x06, 0x24, 0x0b};
1690 if ((base = find_rom_data(0x580, 0x800, boot_stack_dat, sizeof(boot_stack_dat))) == 0) return false;
1691 D(bug("boot_stack %08lx\n", base));
1692 wp = (uint16 *)(ROM_BASE + base);
1693 *wp++ = htons(0x207c); // move.l #RAMBase+0x3ffffe,a0
1694 *wp++ = htons((RAMBase + 0x3ffffe) >> 16);
1695 *wp++ = htons((RAMBase + 0x3ffffe) & 0xffff);
1696 *wp++ = htons(M68K_EMUL_OP_FIX_MEMSIZE);
1697 *wp = htons(M68K_RTS);
1698
1699 // Get PowerPC page size (InitVMemMgr, via 0x240)
1700 static const uint8 page_size_dat[] = {0x20, 0x30, 0x81, 0xf2, 0x5f, 0xff, 0xef, 0xd8, 0x00, 0x10};
1701 if ((base = find_rom_data(0xb000, 0x12000, page_size_dat, sizeof(page_size_dat))) == 0) return false;
1702 D(bug("page_size %08lx\n", base));
1703 wp = (uint16 *)(ROM_BASE + base);
1704 *wp++ = htons(0x203c); // move.l #$1000,d0
1705 *wp++ = htons(0);
1706 *wp++ = htons(0x1000);
1707 *wp++ = htons(M68K_NOP);
1708 *wp = htons(M68K_NOP);
1709
1710 // Gestalt PowerPC page size, RAM size (InitGestalt, via 0x25c)
1711 static const uint8 page_size2_dat[] = {0x26, 0x79, 0x5f, 0xff, 0xef, 0xd8, 0x25, 0x6b, 0x00, 0x10, 0x00, 0x1e};
1712 if ((base = find_rom_data(0x50000, 0x70000, page_size2_dat, sizeof(page_size2_dat))) == 0) return false;
1713 D(bug("page_size2 %08lx\n", base));
1714 wp = (uint16 *)(ROM_BASE + base);
1715 *wp++ = htons(0x257c); // move.l #$1000,$1e(a2)
1716 *wp++ = htons(0);
1717 *wp++ = htons(0x1000);
1718 *wp++ = htons(0x001e);
1719 *wp++ = htons(0x157c); // move.b #PVR,$1d(a2)
1720 *wp++ = htons(PVR >> 16);
1721 *wp++ = htons(0x001d);
1722 *wp++ = htons(0x263c); // move.l #RAMSize,d3
1723 *wp++ = htons(RAMSize >> 16);
1724 *wp++ = htons(RAMSize & 0xffff);
1725 *wp++ = htons(M68K_NOP);
1726 *wp++ = htons(M68K_NOP);
1727 *wp = htons(M68K_NOP);
1728 if (ROMType == ROMTYPE_NEWWORLD)
1729 wp = (uint16 *)(ROM_BASE + base + 0x4a);
1730 else
1731 wp = (uint16 *)(ROM_BASE + base + 0x28);
1732 *wp++ = htons(M68K_NOP);
1733 *wp = htons(M68K_NOP);
1734
1735 // Gestalt CPU/bus clock speed (InitGestalt, via 0x25c)
1736 if (ROMType == ROMTYPE_ZANZIBAR) {
1737 wp = (uint16 *)(ROM_BASE + 0x5d87a);
1738 *wp++ = htons(0x203c); // move.l #Hz,d0
1739 *wp++ = htons(BusClockSpeed >> 16);
1740 *wp++ = htons(BusClockSpeed & 0xffff);
1741 *wp++ = htons(M68K_NOP);
1742 *wp = htons(M68K_NOP);
1743 wp = (uint16 *)(ROM_BASE + 0x5d888);
1744 *wp++ = htons(0x203c); // move.l #Hz,d0
1745 *wp++ = htons(CPUClockSpeed >> 16);
1746 *wp++ = htons(CPUClockSpeed & 0xffff);
1747 *wp++ = htons(M68K_NOP);
1748 *wp = htons(M68K_NOP);
1749 }
1750
1751 // Don't write to GC interrupt mask register (via 0x262)
1752 if (ROMType != ROMTYPE_NEWWORLD) {
1753 static const uint8 gc_mask_dat[] = {0x83, 0xa8, 0x00, 0x24, 0x4e, 0x71};
1754 if ((base = find_rom_data(0x13000, 0x20000, gc_mask_dat, sizeof(gc_mask_dat))) == 0) return false;
1755 D(bug("gc_mask %08lx\n", base));
1756 wp = (uint16 *)(ROM_BASE + base);
1757 *wp++ = htons(M68K_NOP);
1758 *wp = htons(M68K_NOP);
1759 wp = (uint16 *)(ROM_BASE + base + 0x40);
1760 *wp++ = htons(M68K_NOP);
1761 *wp = htons(M68K_NOP);
1762 wp = (uint16 *)(ROM_BASE + base + 0x78);
1763 *wp++ = htons(M68K_NOP);
1764 *wp = htons(M68K_NOP);
1765 wp = (uint16 *)(ROM_BASE + base + 0x96);
1766 *wp++ = htons(M68K_NOP);
1767 *wp = htons(M68K_NOP);
1768
1769 static const uint8 gc_mask2_dat[] = {0x02, 0xa8, 0x00, 0x00, 0x00, 0x80, 0x00, 0x24};
1770 if ((base = find_rom_data(0x13000, 0x20000, gc_mask2_dat, sizeof(gc_mask2_dat))) == 0) return false;
1771 D(bug("gc_mask2 %08lx\n", base));
1772 wp = (uint16 *)(ROM_BASE + base);
1773 if (ROMType == ROMTYPE_GOSSAMER)
1774 *wp++ = htons(M68K_NOP);
1775 for (int i=0; i<5; i++) {
1776 *wp++ = htons(M68K_NOP);
1777 *wp++ = htons(M68K_NOP);
1778 *wp++ = htons(M68K_NOP);
1779 *wp++ = htons(M68K_NOP);
1780 wp += 2;
1781 }
1782 if (ROMType == ROMTYPE_ZANZIBAR || ROMType == ROMTYPE_GOSSAMER) {
1783 for (int i=0; i<6; i++) {
1784 *wp++ = htons(M68K_NOP);
1785 *wp++ = htons(M68K_NOP);
1786 *wp++ = htons(M68K_NOP);
1787 *wp++ = htons(M68K_NOP);
1788 wp += 2;
1789 }
1790 }
1791 }
1792
1793 // Don't initialize Cuda (via 0x274)
1794 static const uint8 cuda_init_dat[] = {0x08, 0xa9, 0x00, 0x04, 0x16, 0x00, 0x4e, 0x71, 0x13, 0x7c, 0x00, 0x84, 0x1c, 0x00, 0x4e, 0x71};
1795 if ((base = find_rom_data(0xa000, 0x12000, cuda_init_dat, sizeof(cuda_init_dat))) == 0) return false;
1796 D(bug("cuda_init %08lx\n", base));
1797 wp = (uint16 *)(ROM_BASE + base);
1798 *wp++ = htons(M68K_NOP);
1799 *wp++ = htons(M68K_NOP);
1800 *wp++ = htons(M68K_NOP);
1801 *wp++ = htons(M68K_NOP);
1802 *wp++ = htons(M68K_NOP);
1803 *wp++ = htons(M68K_NOP);
1804 *wp = htons(M68K_NOP);
1805
1806 // Patch GetCPUSpeed (via 0x27a) (some ROMs have two of them)
1807 static const uint8 cpu_speed_dat[] = {0x20, 0x30, 0x81, 0xf2, 0x5f, 0xff, 0xef, 0xd8, 0x00, 0x04, 0x4c, 0x7c};
1808 if ((base = find_rom_data(0x6000, 0xa000, cpu_speed_dat, sizeof(cpu_speed_dat))) == 0) return false;
1809 D(bug("cpu_speed %08lx\n", base));
1810 wp = (uint16 *)(ROM_BASE + base);
1811 *wp++ = htons(0x203c); // move.l #(MHz<<16)|MHz,d0
1812 *wp++ = htons(CPUClockSpeed / 1000000);
1813 *wp++ = htons(CPUClockSpeed / 1000000);
1814 *wp = htons(M68K_RTS);
1815 if ((base = find_rom_data(base, 0xa000, cpu_speed_dat, sizeof(cpu_speed_dat))) != 0) {
1816 D(bug("cpu_speed2 %08lx\n", base));
1817 wp = (uint16 *)(ROM_BASE + base);
1818 *wp++ = htons(0x203c); // move.l #(MHz<<16)|MHz,d0
1819 *wp++ = htons(CPUClockSpeed / 1000000);
1820 *wp++ = htons(CPUClockSpeed / 1000000);
1821 *wp = htons(M68K_RTS);
1822 }
1823
1824 // Don't poke VIA in InitTimeMgr (via 0x298)
1825 static const uint8 time_via_dat[] = {0x40, 0xe7, 0x00, 0x7c, 0x07, 0x00, 0x28, 0x78, 0x01, 0xd4, 0x43, 0xec, 0x10, 0x00};
1826 if ((base = find_rom_data(0x30000, 0x40000, time_via_dat, sizeof(time_via_dat))) == 0) return false;
1827 D(bug("time_via %08lx\n", base));
1828 wp = (uint16 *)(ROM_BASE + base);
1829 *wp++ = htons(0x4cdf); // movem.l (sp)+,d0-d5/a0-a4
1830 *wp++ = htons(0x1f3f);
1831 *wp = htons(M68K_RTS);
1832
1833 // Don't read from 0xff800000 (Name Registry, Open Firmware?) (via 0x2a2)
1834 // Remove this if FE03 works!!
1835 static const uint8 open_firmware_dat[] = {0x2f, 0x79, 0xff, 0x80, 0x00, 0x00, 0x00, 0xfc};
1836 if ((base = find_rom_data(0x48000, 0x58000, open_firmware_dat, sizeof(open_firmware_dat))) == 0) return false;
1837 D(bug("open_firmware %08lx\n", base));
1838 wp = (uint16 *)(ROM_BASE + base);
1839 *wp++ = htons(0x2f7c); // move.l #deadbeef,0xfc(a7)
1840 *wp++ = htons(0xdead);
1841 *wp++ = htons(0xbeef);
1842 *wp = htons(0x00fc);
1843 wp = (uint16 *)(ROM_BASE + base + 0x1a);
1844 *wp++ = htons(M68K_NOP); // (FE03 opcode, tries to jump to 0xdeadbeef)
1845 *wp = htons(M68K_NOP);
1846
1847 // Don't EnableExtCache (via 0x2b2)
1848 static const uint8 ext_cache2_dat[] = {0x4f, 0xef, 0xff, 0xec, 0x20, 0x4f, 0x10, 0xbc, 0x00, 0x01, 0x11, 0x7c, 0x00, 0x1b};
1849 if ((base = find_rom_data(0x13000, 0x20000, ext_cache2_dat, sizeof(ext_cache2_dat))) == 0) return false;
1850 D(bug("ext_cache2 %08lx\n", base));
1851 wp = (uint16 *)(ROM_BASE + base);
1852 *wp = htons(M68K_RTS);
1853
1854 // Don't install Time Manager task for 60Hz interrupt (Enable60HzInts, via 0x2b8)
1855 if (ROMType == ROMTYPE_NEWWORLD || ROMType == ROMTYPE_GOSSAMER) {
1856 static const uint8 tm_task_dat[] = {0x30, 0x3c, 0x4e, 0x2b, 0xa9, 0xc9};
1857 if ((base = find_rom_data(0x2a0, 0x320, tm_task_dat, sizeof(tm_task_dat))) == 0) return false;
1858 D(bug("tm_task %08lx\n", base));
1859 wp = (uint16 *)(ROM_BASE + base + 28);
1860 *wp++ = htons(M68K_NOP);
1861 *wp++ = htons(M68K_NOP);
1862 *wp++ = htons(M68K_NOP);
1863 *wp++ = htons(M68K_NOP);
1864 *wp++ = htons(M68K_NOP);
1865 *wp = htons(M68K_NOP);
1866 } else {
1867 static const uint8 tm_task_dat[] = {0x20, 0x3c, 0x73, 0x79, 0x73, 0x61};
1868 if ((base = find_rom_data(0x280, 0x300, tm_task_dat, sizeof(tm_task_dat))) == 0) return false;
1869 D(bug("tm_task %08lx\n", base));
1870 wp = (uint16 *)(ROM_BASE + base - 6);
1871 *wp++ = htons(M68K_NOP);
1872 *wp++ = htons(M68K_NOP);
1873 *wp = htons(M68K_NOP);
1874 }
1875
1876 // Don't read PVR from 0x5fffef80 in DriverServicesLib (via 0x316)
1877 if (ROMType != ROMTYPE_NEWWORLD && ROMType != ROMTYPE_GOSSAMER) {
1878 uint32 dsl_offset = find_rom_resource(FOURCC('n','l','i','b'), -16401);
1879 if (ROMType == ROMTYPE_ZANZIBAR) {
1880 static const uint8 dsl_pvr_dat[] = {0x40, 0x82, 0x00, 0x40, 0x38, 0x60, 0xef, 0x80, 0x3c, 0x63, 0x60, 0x00, 0x80, 0x83, 0x00, 0x00, 0x54, 0x84, 0x84, 0x3e};
1881 if ((base = find_rom_data(dsl_offset, dsl_offset + 0x6000, dsl_pvr_dat, sizeof(dsl_pvr_dat))) == 0) return false;
1882 } else {
1883 static const uint8 dsl_pvr_dat[] = {0x3b, 0xc3, 0x00, 0x00, 0x30, 0x84, 0xff, 0xa0, 0x40, 0x82, 0x00, 0x44, 0x80, 0x84, 0xef, 0xe0, 0x54, 0x84, 0x84, 0x3e};
1884 if ((base = find_rom_data(dsl_offset, dsl_offset + 0x6000, dsl_pvr_dat, sizeof(dsl_pvr_dat))) == 0) return false;
1885 }
1886 D(bug("dsl_pvr %08lx\n", base));
1887 lp = (uint32 *)(ROM_BASE + base + 12);
1888 *lp = htonl(0x3c800000 | (PVR >> 16)); // lis r4,PVR
1889
1890 // Don't read bus clock from 0x5fffef88 in DriverServicesLib (via 0x316)
1891 if (ROMType == ROMTYPE_ZANZIBAR) {
1892 static const uint8 dsl_bus_dat[] = {0x81, 0x07, 0x00, 0x00, 0x39, 0x20, 0x42, 0x40, 0x81, 0x62, 0xff, 0x20};
1893 if ((base = find_rom_data(dsl_offset, dsl_offset + 0x6000, dsl_bus_dat, sizeof(dsl_bus_dat))) == 0) return false;
1894 D(bug("dsl_bus %08lx\n", base));
1895 lp = (uint32 *)(ROM_BASE + base);
1896 *lp = htonl(0x81000000 + XLM_BUS_CLOCK); // lwz r8,(bus clock speed)
1897 } else {
1898 static const uint8 dsl_bus_dat[] = {0x80, 0x83, 0xef, 0xe8, 0x80, 0x62, 0x00, 0x10, 0x7c, 0x04, 0x03, 0x96};
1899 if ((base = find_rom_data(dsl_offset, dsl_offset + 0x6000, dsl_bus_dat, sizeof(dsl_bus_dat))) == 0) return false;
1900 D(bug("dsl_bus %08lx\n", base));
1901 lp = (uint32 *)(ROM_BASE + base);
1902 *lp = htonl(0x80800000 + XLM_BUS_CLOCK); // lwz r4,(bus clock speed)
1903 }
1904 }
1905
1906 // Don't open InterruptTreeTNT in MotherBoardHAL init in DriverServicesLib init
1907 if (ROMType == ROMTYPE_ZANZIBAR) {
1908 lp = (uint32 *)(ROM_BASE + find_rom_resource(FOURCC('n','l','i','b'), -16408) + 0x16c);
1909 *lp = htonl(0x38600000); // li r3,0
1910 }
1911
1912 // Patch Name Registry
1913 static const uint8 name_reg_dat[] = {0x70, 0xff, 0xab, 0xeb};
1914 if ((base = find_rom_data(0x300, 0x380, name_reg_dat, sizeof(name_reg_dat))) == 0) return false;
1915 D(bug("name_reg %08lx\n", base));
1916 wp = (uint16 *)(ROM_BASE + base);
1917 *wp = htons(M68K_EMUL_OP_NAME_REGISTRY);
1918
1919 #if DISABLE_SCSI
1920 // Fake SCSI Manager
1921 // Remove this if SCSI Manager works!!
1922 static const uint8 scsi_mgr_a_dat[] = {0x4e, 0x56, 0x00, 0x00, 0x20, 0x3c, 0x00, 0x00, 0x04, 0x0c, 0xa7, 0x1e};
1923 static const uint8 scsi_mgr_b_dat[] = {0x4e, 0x56, 0x00, 0x00, 0x2f, 0x0c, 0x20, 0x3c, 0x00, 0x00, 0x04, 0x0c, 0xa7, 0x1e};
1924 if ((base = find_rom_data(0x1c000, 0x28000, scsi_mgr_a_dat, sizeof(scsi_mgr_a_dat))) == 0) {
1925 if ((base = find_rom_data(0x1c000, 0x28000, scsi_mgr_b_dat, sizeof(scsi_mgr_b_dat))) == 0) return false;
1926 }
1927 D(bug("scsi_mgr %08lx\n", base));
1928 wp = (uint16 *)(ROM_BASE + base);
1929 *wp++ = htons(0x21fc); // move.l #xxx,0x624 (SCSIAtomic)
1930 *wp++ = htons((ROM_BASE + base + 18) >> 16);
1931 *wp++ = htons((ROM_BASE + base + 18) & 0xffff);
1932 *wp++ = htons(0x0624);
1933 *wp++ = htons(0x21fc); // move.l #xxx,0xe54 (SCSIDispatch)
1934 *wp++ = htons((ROM_BASE + base + 22) >> 16);
1935 *wp++ = htons((ROM_BASE + base + 22) & 0xffff);
1936 *wp++ = htons(0x0e54);
1937 *wp++ = htons(M68K_RTS);
1938 *wp++ = htons(M68K_EMUL_OP_SCSI_ATOMIC);
1939 *wp++ = htons(M68K_RTS);
1940 *wp++ = htons(M68K_EMUL_OP_SCSI_DISPATCH);
1941 *wp = htons(0x4ed0); // jmp (a0)
1942 wp = (uint16 *)(ROM_BASE + base + 0x20);
1943 *wp++ = htons(0x7000); // moveq #0,d0
1944 *wp = htons(M68K_RTS);
1945 #endif
1946
1947 #if DISABLE_SCSI
1948 // Don't access SCSI variables
1949 // Remove this if SCSI Manager works!!
1950 if (ROMType == ROMTYPE_NEWWORLD) {
1951 static const uint8 scsi_var_dat[] = {0x70, 0x01, 0xa0, 0x89, 0x4a, 0x6e, 0xfe, 0xac, 0x4f, 0xef, 0x00, 0x10, 0x66, 0x00};
1952 if ((base = find_rom_data(0x1f500, 0x1f600, scsi_var_dat, sizeof(scsi_var_dat))) != 0) {
1953 D(bug("scsi_var %08lx\n", base));
1954 wp = (uint16 *)(ROM_BASE + base + 12);
1955 *wp = htons(0x6000); // bra
1956 }
1957
1958 static const uint8 scsi_var2_dat[] = {0x4e, 0x56, 0xfc, 0x58, 0x48, 0xe7, 0x1f, 0x38};
1959 if ((base = find_rom_data(0x1f700, 0x1f800, scsi_var2_dat, sizeof(scsi_var2_dat))) != 0) {
1960 D(bug("scsi_var2 %08lx\n", base));
1961 wp = (uint16 *)(ROM_BASE + base);
1962 *wp++ = htons(0x7000); // moveq #0,d0
1963 *wp = htons(M68K_RTS);
1964 }
1965 }
1966 else if (ROMType == ROMTYPE_GOSSAMER) {
1967 static const uint8 scsi_var_dat[] = {0x70, 0x01, 0xa0, 0x89, 0x4a, 0x6e, 0xfe, 0xac, 0x4f, 0xef, 0x00, 0x10, 0x66, 0x00};
1968 if ((base = find_rom_data(0x1d700, 0x1d800, scsi_var_dat, sizeof(scsi_var_dat))) != 0) {
1969 D(bug("scsi_var %08lx\n", base));
1970 wp = (uint16 *)(ROM_BASE + base + 12);
1971 *wp = htons(0x6000); // bra
1972 }
1973
1974 static const uint8 scsi_var2_dat[] = {0x4e, 0x56, 0xfc, 0x5a, 0x48, 0xe7, 0x1f, 0x38};
1975 if ((base = find_rom_data(0x1d900, 0x1da00, scsi_var2_dat, sizeof(scsi_var2_dat))) != 0) {
1976 D(bug("scsi_var2 %08lx\n", base));
1977 wp = (uint16 *)(ROM_BASE + base);
1978 *wp++ = htons(0x7000); // moveq #0,d0
1979 *wp = htons(M68K_RTS);
1980 }
1981 }
1982 #endif
1983
1984 // Don't wait in ADBInit (via 0x36c)
1985 static const uint8 adb_init_dat[] = {0x08, 0x2b, 0x00, 0x05, 0x01, 0x5d, 0x66, 0xf8};
1986 if ((base = find_rom_data(0x31000, 0x3d000, adb_init_dat, sizeof(adb_init_dat))) == 0) return false;
1987 D(bug("adb_init %08lx\n", base));
1988 wp = (uint16 *)(ROM_BASE + base + 6);
1989 *wp = htons(M68K_NOP);
1990
1991 // Modify check in InitResources() so that addresses >0x80000000 work
1992 static const uint8 init_res_dat[] = {0x4a, 0xb8, 0x0a, 0x50, 0x6e, 0x20};
1993 if ((base = find_rom_data(0x78000, 0x8c000, init_res_dat, sizeof(init_res_dat))) == 0) return false;
1994 D(bug("init_res %08lx\n", base));
1995 bp = (uint8 *)(ROM_BASE + base + 4);
1996 *bp = 0x66;
1997
1998 // Modify vCheckLoad() so that we can patch resources (68k Resource Manager)
1999 static const uint8 check_load_dat[] = {0x20, 0x78, 0x07, 0xf0, 0x4e, 0xd0};
2000 if ((base = find_rom_data(0x78000, 0x8c000, check_load_dat, sizeof(check_load_dat))) == 0) return false;
2001 D(bug("check_load %08lx\n", base));
2002 wp = (uint16 *)(ROM_BASE + base);
2003 *wp++ = htons(M68K_JMP);
2004 *wp++ = htons((ROM_BASE + CHECK_LOAD_PATCH_SPACE) >> 16);
2005 *wp = htons((ROM_BASE + CHECK_LOAD_PATCH_SPACE) & 0xffff);
2006 wp = (uint16 *)(ROM_BASE + CHECK_LOAD_PATCH_SPACE);
2007 *wp++ = htons(0x2f03); // move.l d3,-(a7)
2008 *wp++ = htons(0x2078); // move.l $07f0,a0
2009 *wp++ = htons(0x07f0);
2010 *wp++ = htons(M68K_JSR_A0);
2011 *wp++ = htons(M68K_EMUL_OP_CHECKLOAD);
2012 *wp = htons(M68K_RTS);
2013
2014 // Replace .Sony driver
2015 sony_offset = find_rom_resource(FOURCC('D','R','V','R'), 4);
2016 if (ROMType == ROMTYPE_ZANZIBAR || ROMType == ROMTYPE_NEWWORLD)
2017 sony_offset = find_rom_resource(FOURCC('D','R','V','R'), 4, true); // First DRVR 4 is .MFMFloppy
2018 if (sony_offset == 0) {
2019 sony_offset = find_rom_resource(FOURCC('n','d','r','v'), -20196); // NewWorld 1.6 has "PCFloppy" ndrv
2020 if (sony_offset == 0)
2021 return false;
2022 lp = (uint32 *)(ROM_BASE + rsrc_ptr + 8);
2023 *lp = htonl(FOURCC('D','R','V','R'));
2024 wp = (uint16 *)(ROM_BASE + rsrc_ptr + 12);
2025 *wp = htons(4);
2026 }
2027 D(bug("sony_offset %08lx\n", sony_offset));
2028 memcpy((void *)(ROM_BASE + sony_offset), sony_driver, sizeof(sony_driver));
2029
2030 // Install .Disk and .AppleCD drivers
2031 memcpy((void *)(ROM_BASE + sony_offset + 0x100), disk_driver, sizeof(disk_driver));
2032 memcpy((void *)(ROM_BASE + sony_offset + 0x200), cdrom_driver, sizeof(cdrom_driver));
2033
2034 // Install serial drivers
2035 memcpy_powerpc_code((void *)(ROM_BASE + sony_offset + 0x300), ain_driver, sizeof(ain_driver));
2036 memcpy_powerpc_code((void *)(ROM_BASE + sony_offset + 0x400), aout_driver, sizeof(aout_driver));
2037 memcpy_powerpc_code((void *)(ROM_BASE + sony_offset + 0x500), bin_driver, sizeof(bin_driver));
2038 memcpy_powerpc_code((void *)(ROM_BASE + sony_offset + 0x600), bout_driver, sizeof(bout_driver));
2039
2040 // Copy icons to ROM
2041 SonyDiskIconAddr = ROM_BASE + sony_offset + 0x800;
2042 memcpy((void *)(ROM_BASE + sony_offset + 0x800), SonyDiskIcon, sizeof(SonyDiskIcon));
2043 SonyDriveIconAddr = ROM_BASE + sony_offset + 0xa00;
2044 memcpy((void *)(ROM_BASE + sony_offset + 0xa00), SonyDriveIcon, sizeof(SonyDriveIcon));
2045 DiskIconAddr = ROM_BASE + sony_offset + 0xc00;
2046 memcpy((void *)(ROM_BASE + sony_offset + 0xc00), DiskIcon, sizeof(DiskIcon));
2047 CDROMIconAddr = ROM_BASE + sony_offset + 0xe00;
2048 memcpy((void *)(ROM_BASE + sony_offset + 0xe00), CDROMIcon, sizeof(CDROMIcon));
2049
2050 // Patch driver install routine
2051 static const uint8 drvr_install_dat[] = {0xa7, 0x1e, 0x21, 0xc8, 0x01, 0x1c, 0x4e, 0x75};
2052 if ((base = find_rom_data(0xb00, 0xd00, drvr_install_dat, sizeof(drvr_install_dat))) == 0) return false;
2053 D(bug("drvr_install %08lx\n", base));
2054 wp = (uint16 *)(ROM_BASE + base + 8);
2055 *wp++ = htons(M68K_EMUL_OP_INSTALL_DRIVERS);
2056 *wp = htons(M68K_RTS);
2057
2058 // Don't install serial drivers from ROM
2059 if (ROMType == ROMTYPE_ZANZIBAR || ROMType == ROMTYPE_NEWWORLD || ROMType == ROMTYPE_GOSSAMER) {
2060 wp = (uint16 *)(ROM_BASE + find_rom_resource(FOURCC('S','E','R','D'), 0));
2061 *wp = htons(M68K_RTS);
2062 } else {
2063 wp = (uint16 *)(ROM_BASE + find_rom_resource(FOURCC('s','l','0','5'), 2) + 0xc4);
2064 *wp++ = htons(M68K_NOP);
2065 *wp++ = htons(M68K_NOP);
2066 *wp++ = htons(M68K_NOP);
2067 *wp++ = htons(M68K_NOP);
2068 *wp = htons(0x7000); // moveq #0,d0
2069 wp = (uint16 *)(ROM_BASE + find_rom_resource(FOURCC('s','l','0','5'), 2) + 0x8ee);
2070 *wp = htons(M68K_NOP);
2071 }
2072 uint32 nsrd_offset = find_rom_resource(FOURCC('n','s','r','d'), 1);
2073 if (nsrd_offset) {
2074 lp = (uint32 *)(ROM_BASE + rsrc_ptr + 8);
2075 *lp = htonl(FOURCC('x','s','r','d'));
2076 }
2077
2078 // Replace ADBOp()
2079 memcpy((void *)(ROM_BASE + find_rom_trap(0xa07c)), adbop_patch, sizeof(adbop_patch));
2080
2081 // Replace Time Manager
2082 wp = (uint16 *)(ROM_BASE + find_rom_trap(0xa058));
2083 *wp++ = htons(M68K_EMUL_OP_INSTIME);
2084 *wp = htons(M68K_RTS);
2085 wp = (uint16 *)(ROM_BASE + find_rom_trap(0xa059));
2086 *wp++ = htons(0x40e7); // move sr,-(sp)
2087 *wp++ = htons(0x007c); // ori #$0700,sr
2088 *wp++ = htons(0x0700);
2089 *wp++ = htons(M68K_EMUL_OP_RMVTIME);
2090 *wp++ = htons(0x46df); // move (sp)+,sr
2091 *wp = htons(M68K_RTS);
2092 wp = (uint16 *)(ROM_BASE + find_rom_trap(0xa05a));
2093 *wp++ = htons(0x40e7); // move sr,-(sp)
2094 *wp++ = htons(0x007c); // ori #$0700,sr
2095 *wp++ = htons(0x0700);
2096 *wp++ = htons(M68K_EMUL_OP_PRIMETIME);
2097 *wp++ = htons(0x46df); // move (sp)+,sr
2098 *wp = htons(M68K_RTS);
2099 wp = (uint16 *)(ROM_BASE + find_rom_trap(0xa093));
2100 *wp++ = htons(M68K_EMUL_OP_MICROSECONDS);
2101 *wp = htons(M68K_RTS);
2102
2103 // Disable Egret Manager
2104 static const uint8 egret_dat[] = {0x2f, 0x30, 0x81, 0xe2, 0x20, 0x10, 0x00, 0x18};
2105 if ((base = find_rom_data(0xa000, 0x10000, egret_dat, sizeof(egret_dat))) == 0) return false;
2106 D(bug("egret %08lx\n", base));
2107 wp = (uint16 *)(ROM_BASE + base);
2108 *wp++ = htons(0x7000);
2109 *wp = htons(M68K_RTS);
2110
2111 // Don't call FE0A opcode in Shutdown Manager
2112 static const uint8 shutdown_dat[] = {0x40, 0xe7, 0x00, 0x7c, 0x07, 0x00, 0x48, 0xe7, 0x3f, 0x00, 0x2c, 0x00, 0x2e, 0x01};
2113 if ((base = find_rom_data(0x30000, 0x40000, shutdown_dat, sizeof(shutdown_dat))) == 0) return false;
2114 D(bug("shutdown %08lx\n", base));
2115 wp = (uint16 *)(ROM_BASE + base);
2116 if (ROMType == ROMTYPE_ZANZIBAR)
2117 *wp = htons(M68K_RTS);
2118 else if (ntohs(wp[-4]) == 0x61ff)
2119 *wp = htons(M68K_RTS);
2120 else if (ntohs(wp[-2]) == 0x6700)
2121 wp[-2] = htons(0x6000); // bra
2122
2123 // Patch PowerOff()
2124 wp = (uint16 *)(ROM_BASE + find_rom_trap(0xa05b)); // PowerOff()
2125 *wp = htons(M68K_EMUL_RETURN);
2126
2127 // Patch VIA interrupt handler
2128 static const uint8 via_int_dat[] = {0x70, 0x7f, 0xc0, 0x29, 0x1a, 0x00, 0xc0, 0x29, 0x1c, 0x00};
2129 if ((base = find_rom_data(0x13000, 0x1c000, via_int_dat, sizeof(via_int_dat))) == 0) return false;
2130 D(bug("via_int %08lx\n", base));
2131 uint32 level1_int = ROM_BASE + base;
2132 wp = (uint16 *)level1_int; // Level 1 handler
2133 *wp++ = htons(0x7002); // moveq #2,d0 (60Hz interrupt)
2134 *wp++ = htons(M68K_NOP);
2135 *wp++ = htons(M68K_NOP);
2136 *wp++ = htons(M68K_NOP);
2137 *wp = htons(M68K_NOP);
2138
2139 static const uint8 via_int2_dat[] = {0x13, 0x7c, 0x00, 0x02, 0x1a, 0x00, 0x4e, 0x71, 0x52, 0xb8, 0x01, 0x6a};
2140 if ((base = find_rom_data(0x10000, 0x18000, via_int2_dat, sizeof(via_int2_dat))) == 0) return false;
2141 D(bug("via_int2 %08lx\n", base));
2142 wp = (uint16 *)(ROM_BASE + base); // 60Hz handler
2143 *wp++ = htons(M68K_EMUL_OP_IRQ);
2144 *wp++ = htons(0x4a80); // tst.l d0
2145 *wp++ = htons(0x6700); // beq xxx
2146 *wp = htons(0xffe8);
2147
2148 if (ROMType == ROMTYPE_NEWWORLD) {
2149 static const uint8 via_int3_dat[] = {0x48, 0xe7, 0xf0, 0xf0, 0x76, 0x01, 0x60, 0x26};
2150 if ((base = find_rom_data(0x15000, 0x19000, via_int3_dat, sizeof(via_int3_dat))) == 0) return false;
2151 D(bug("via_int3 %08lx\n", base));
2152 wp = (uint16 *)(ROM_BASE + base); // CHRP level 1 handler
2153 *wp++ = htons(M68K_JMP);
2154 *wp++ = htons((level1_int - 12) >> 16);
2155 *wp = htons((level1_int - 12) & 0xffff);
2156 }
2157
2158 // Patch PutScrap() for clipboard exchange with host OS
2159 uint32 put_scrap = find_rom_trap(0xa9fe); // PutScrap()
2160 wp = (uint16 *)(ROM_BASE + PUT_SCRAP_PATCH_SPACE);
2161 *wp++ = htons(M68K_EMUL_OP_PUT_SCRAP);
2162 *wp++ = htons(M68K_JMP);
2163 *wp++ = htons((ROM_BASE + put_scrap) >> 16);
2164 *wp++ = htons((ROM_BASE + put_scrap) & 0xffff);
2165 lp = (uint32 *)(ROM_BASE + 0x22);
2166 lp = (uint32 *)(ROM_BASE + ntohl(*lp));
2167 lp[0xa9fe & 0x3ff] = htonl(PUT_SCRAP_PATCH_SPACE);
2168
2169 // Patch GetScrap() for clipboard exchange with host OS
2170 uint32 get_scrap = find_rom_trap(0xa9fd); // GetScrap()
2171 wp = (uint16 *)(ROM_BASE + GET_SCRAP_PATCH_SPACE);
2172 *wp++ = htons(M68K_EMUL_OP_GET_SCRAP);
2173 *wp++ = htons(M68K_JMP);
2174 *wp++ = htons((ROM_BASE + get_scrap) >> 16);
2175 *wp++ = htons((ROM_BASE + get_scrap) & 0xffff);
2176 lp = (uint32 *)(ROM_BASE + 0x22);
2177 lp = (uint32 *)(ROM_BASE + ntohl(*lp));
2178 lp[0xa9fd & 0x3ff] = htonl(GET_SCRAP_PATCH_SPACE);
2179
2180 #if __BEOS__
2181 // Patch SynchIdleTime()
2182 if (PrefsFindBool("idlewait")) {
2183 wp = (uint16 *)(ROM_BASE + find_rom_trap(0xabf7) + 4); // SynchIdleTime()
2184 D(bug("SynchIdleTime at %08lx\n", wp));
2185 if (ntohs(*wp) == 0x2078) {
2186 *wp++ = htons(M68K_EMUL_OP_IDLE_TIME);
2187 *wp = htons(M68K_NOP);
2188 } else {
2189 D(bug("SynchIdleTime patch not installed\n"));
2190 }
2191 }
2192 #endif
2193
2194 // Construct list of all sifters used by sound components in ROM
2195 D(bug("Searching for sound components with type sdev in ROM\n"));
2196 uint32 thing = find_rom_resource(FOURCC('t','h','n','g'));
2197 while (thing) {
2198 thing += ROM_BASE;
2199 D(bug(" found %c%c%c%c %c%c%c%c\n", ReadMacInt8(thing), ReadMacInt8(thing + 1), ReadMacInt8(thing + 2), ReadMacInt8(thing + 3), ReadMacInt8(thing + 4), ReadMacInt8(thing + 5), ReadMacInt8(thing + 6), ReadMacInt8(thing + 7)));
2200 if (ReadMacInt32(thing) == FOURCC('s','d','e','v') && ReadMacInt32(thing + 4) == FOURCC('s','i','n','g')) {
2201 WriteMacInt32(thing + 4, FOURCC('a','w','g','c'));
2202 D(bug(" found sdev component at offset %08x in ROM\n", thing));
2203 AddSifter(ReadMacInt32(thing + componentResType), ReadMacInt16(thing + componentResID));
2204 if (ReadMacInt32(thing + componentPFCount))
2205 AddSifter(ReadMacInt32(thing + componentPFResType), ReadMacInt16(thing + componentPFResID));
2206 }
2207 thing = find_rom_resource(FOURCC('t','h','n','g'), 4711, true);
2208 }
2209
2210 // Patch component code
2211 D(bug("Patching sifters in ROM\n"));
2212 for (int i=0; i<num_sifters; i++) {
2213 if ((thing = find_rom_resource(sifter_list[i].type, sifter_list[i].id)) != 0) {
2214 D(bug(" patching type %08x, id %d\n", sifter_list[i].type, sifter_list[i].id));
2215 // Install 68k glue code
2216 uint16 *wp = (uint16 *)(ROM_BASE + thing);
2217 *wp++ = htons(0x4e56); *wp++ = htons(0x0000); // link a6,#0
2218 *wp++ = htons(0x48e7); *wp++ = htons(0x8018); // movem.l d0/a3-a4,-(a7)
2219 *wp++ = htons(0x266e); *wp++ = htons(0x000c); // movea.l $c(a6),a3
2220 *wp++ = htons(0x286e); *wp++ = htons(0x0008); // movea.l $8(a6),a4
2221 *wp++ = htons(M68K_EMUL_OP_AUDIO_DISPATCH);
2222 *wp++ = htons(0x2d40); *wp++ = htons(0x0010); // move.l d0,$10(a6)
2223 *wp++ = htons(0x4cdf); *wp++ = htons(0x1801); // movem.l (a7)+,d0/a3-a4
2224 *wp++ = htons(0x4e5e); // unlk a6
2225 *wp++ = htons(0x4e74); *wp++ = htons(0x0008); // rtd #8
2226 }
2227 }
2228 return true;
2229 }
2230
2231
2232 /*
2233 * Install .Sony, disk and CD-ROM drivers
2234 */
2235
2236 void InstallDrivers(void)
2237 {
2238 D(bug("Installing drivers...\n"));
2239 M68kRegisters r;
2240 uint8 pb[SIZEOF_IOParam];
2241
2242 // Install floppy driver
2243 if (ROMType == ROMTYPE_NEWWORLD || ROMType == ROMTYPE_GOSSAMER) {
2244
2245 // Force installation of floppy driver with NewWorld and Gossamer ROMs
2246 r.a[0] = ROM_BASE + sony_offset;
2247 r.d[0] = (uint32)SonyRefNum;
2248 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2249 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~SonyRefNum * 4); // Get driver handle from Unit Table
2250 Execute68kTrap(0xa029, &r); // HLock()
2251 uint32 dce = ReadMacInt32(r.a[0]);
2252 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset);
2253 WriteMacInt16(dce + dCtlFlags, SonyDriverFlags);
2254 }
2255
2256 #if DISABLE_SCSI && 0
2257 // Fake SCSIGlobals
2258 static const uint8 fake_scsi_globals[32] = {0,};
2259 WriteMacInt32(0xc0c, (uint32)fake_scsi_globals);
2260 #endif
2261
2262 // Open .Sony driver
2263 WriteMacInt8((uint32)pb + ioPermssn, 0);
2264 WriteMacInt32((uint32)pb + ioNamePtr, (uint32)"\005.Sony");
2265 r.a[0] = (uint32)pb;
2266 Execute68kTrap(0xa000, &r); // Open()
2267
2268 // Install disk driver
2269 r.a[0] = ROM_BASE + sony_offset + 0x100;
2270 r.d[0] = (uint32)DiskRefNum;
2271 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2272 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~DiskRefNum * 4); // Get driver handle from Unit Table
2273 Execute68kTrap(0xa029, &r); // HLock()
2274 uint32 dce = ReadMacInt32(r.a[0]);
2275 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset + 0x100);
2276 WriteMacInt16(dce + dCtlFlags, DiskDriverFlags);
2277
2278 // Open disk driver
2279 WriteMacInt32((uint32)pb + ioNamePtr, (uint32)"\005.Disk");
2280 r.a[0] = (uint32)pb;
2281 Execute68kTrap(0xa000, &r); // Open()
2282
2283 // Install CD-ROM driver unless nocdrom option given
2284 if (!PrefsFindBool("nocdrom")) {
2285
2286 // Install CD-ROM driver
2287 r.a[0] = ROM_BASE + sony_offset + 0x200;
2288 r.d[0] = (uint32)CDROMRefNum;
2289 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2290 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~CDROMRefNum * 4); // Get driver handle from Unit Table
2291 Execute68kTrap(0xa029, &r); // HLock()
2292 dce = ReadMacInt32(r.a[0]);
2293 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset + 0x200);
2294 WriteMacInt16(dce + dCtlFlags, CDROMDriverFlags);
2295
2296 // Open CD-ROM driver
2297 WriteMacInt32((uint32)pb + ioNamePtr, (uint32)"\010.AppleCD");
2298 r.a[0] = (uint32)pb;
2299 Execute68kTrap(0xa000, &r); // Open()
2300 }
2301
2302 // Install serial drivers
2303 r.a[0] = ROM_BASE + sony_offset + 0x300;
2304 r.d[0] = (uint32)-6;
2305 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2306 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~(-6) * 4); // Get driver handle from Unit Table
2307 Execute68kTrap(0xa029, &r); // HLock()
2308 dce = ReadMacInt32(r.a[0]);
2309 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset + 0x300);
2310 WriteMacInt16(dce + dCtlFlags, 0x4d00);
2311
2312 r.a[0] = ROM_BASE + sony_offset + 0x400;
2313 r.d[0] = (uint32)-7;
2314 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2315 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~(-7) * 4); // Get driver handle from Unit Table
2316 Execute68kTrap(0xa029, &r); // HLock()
2317 dce = ReadMacInt32(r.a[0]);
2318 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset + 0x400);
2319 WriteMacInt16(dce + dCtlFlags, 0x4e00);
2320
2321 r.a[0] = ROM_BASE + sony_offset + 0x500;
2322 r.d[0] = (uint32)-8;
2323 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2324 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~(-8) * 4); // Get driver handle from Unit Table
2325 Execute68kTrap(0xa029, &r); // HLock()
2326 dce = ReadMacInt32(r.a[0]);
2327 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset + 0x500);
2328 WriteMacInt16(dce + dCtlFlags, 0x4d00);
2329
2330 r.a[0] = ROM_BASE + sony_offset + 0x600;
2331 r.d[0] = (uint32)-9;
2332 Execute68kTrap(0xa43d, &r); // DrvrInstallRsrvMem()
2333 r.a[0] = ReadMacInt32(ReadMacInt32(0x11c) + ~(-9) * 4); // Get driver handle from Unit Table
2334 Execute68kTrap(0xa029, &r); // HLock()
2335 dce = ReadMacInt32(r.a[0]);
2336 WriteMacInt32(dce + dCtlDriver, ROM_BASE + sony_offset + 0x600);
2337 WriteMacInt16(dce + dCtlFlags, 0x4e00);
2338 }