{"id":2232145,"url":"http://patchwork.ozlabs.org/api/patches/2232145/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260503015756.99176-6-54weasels@gmail.com/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260503015756.99176-6-54weasels@gmail.com>","list_archive_url":null,"date":"2026-05-03T01:57:54","name":"[5/7] hw/m68k: Overhaul Sun-3 MMU and Boot PROM mapping","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"3b344d14627ea9c157f75aee33209caeb128d9e6","submitter":{"id":93309,"url":"http://patchwork.ozlabs.org/api/people/93309/?format=json","name":"54weasels","email":"54weasels@gmail.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260503015756.99176-6-54weasels@gmail.com/mbox/","series":[{"id":502564,"url":"http://patchwork.ozlabs.org/api/series/502564/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=502564","date":"2026-05-03T01:57:51","name":"m68k: Add Sun-3 Machine Emulation","version":1,"mbox":"http://patchwork.ozlabs.org/series/502564/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2232145/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2232145/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=R2NcN/kw;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g7Yyg5p6vz1yJ0\n\tfor ; Sun, 03 May 2026 15:59:55 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wJPrM-0001GV-VY; Sun, 03 May 2026 01:59:21 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <54weasels@gmail.com>)\n id 1wJM6H-0004x9-0Z\n for qemu-devel@nongnu.org; Sat, 02 May 2026 21:58:29 -0400","from mail-dl1-x1234.google.com ([2607:f8b0:4864:20::1234])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from <54weasels@gmail.com>)\n id 1wJM6C-0000Ye-BO\n for qemu-devel@nongnu.org; Sat, 02 May 2026 21:58:28 -0400","by mail-dl1-x1234.google.com with SMTP id\n a92af1059eb24-12dbd0f7ecaso6827179c88.0\n for ; Sat, 02 May 2026 18:58:23 -0700 (PDT)","from newsled.lan ([76.133.142.170]) by smtp.gmail.com with ESMTPSA\n id\n 5a478bee46e88-2ee38d79eb9sm14361735eec.8.2026.05.02.18.58.20\n (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256);\n Sat, 02 May 2026 18:58:21 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777773503; x=1778378303; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=8bxTylT5zdHOxeOuQ+JQtXcO2yUlfuze6HxbUoeHOzw=;\n b=R2NcN/kwpqEJHSe2KmvaTsPNTRYb5GH7JOt5zF+dr9HEWfbFwAl0ixNfO4clI+iiqC\n VYgRJD6k1Z0qkksTnO0cWZWKNt8QnVf8/4MInDYHLpxBqt5o6Di1Pcf6mNitAGof9t0N\n yi85kHqfEthbXyA6y0QxSAF34RxDlShXXflBdRCBaPNCJCQuT/URG01875s0V/SfCoCD\n A7aiTbVBRkws25SK6MenjRGz5XF0UwUf/eQ57S/YAOqaV4eeUqRVrLoRzc5glUeZrHid\n unRgFQuXQ+4gNRNgamxZLFPwqwiPUP2SACT/JaQPSh4gh4/Gc3JZEaEiDBJFigQ4CbRH\n qWAw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777773503; x=1778378303;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=8bxTylT5zdHOxeOuQ+JQtXcO2yUlfuze6HxbUoeHOzw=;\n b=epkwBLyZFGxByfvLAisG9su9iNFS2+D0ayoAtRult7OcDKLoweQaT+rl2n/qsPp3gc\n +GyNRGC7Qx9I00azikdwlvn5a7lVH6juu0UmcJWktVKEpdU9l0ZM6IaSzXfI2lkp+5TV\n i4kSePFi/TsIUy2G8H6GldcCqUwrpAZU1/xky6re8AA0W2HXaM9C1BrkcZs9gRGbhJaA\n cCnh+IPkPAcn2oSPezinsTQlC5GlFbG8i+QRhmfQ9UqVfqxiCdkq4e/a9sa/0+ot07ch\n JhCmhltjWmS/Fv6Q1SSJcWWZPVt8ZIo8t0GqEogJvpq5ZrlTWwisHEgQTE9FO67Nap0j\n zIhA==","X-Gm-Message-State":"AOJu0Yw2mv7A4oGGME+PouRrDNCV/U1xWZNqseepqSxWIM65l1oUrUaq\n x09CbkoTGhwsDzo2wQ07Qv/2ROCLIGUaGC/RgNpWi8kqCMJo5yN+RDE9mr8Mww==","X-Gm-Gg":"AeBDiesqPvIPQnqaMX7IsWPFl4Sliw6Oq30VKKzxMdKhNhhl+4LdOs6QohbvvmsMtOS\n ZHsDFFNF3RXxKOO8mQV1Afw9dAQAAWZhH2MSC45ufmHA0UY4h14ZNlSrpt5+cFkKunz5GeXK42h\n NCsHFg/ba++9T/xDeROGKx9XBntYsA4cC3Ch5IHwmNtnAooVhFm92ZBd8sV3/s9EQAAtQ90LLZR\n wqvw840312GtLVEArh6oNOooFdBvdaFo0sCnt6Gnf9hoKcbQg/8hYQfw0cmyknh34UwHdfaC/0x\n sfdyWyNORlEPr5m/45tsnXktSSArMKriLosq0CM7yUwIrju2O9S+K9BHXZXd6oqjOQvACKix/6f\n Bpd0ecT7KbGebLNjj0jnHBc3bLUTZ3wQvHcE4RM2B7d/MK15npeGGcpkqhJVBiO7gACUh8TPils\n sm9h0HNcOoS1IRd2DSFTD5KjJa8dxMCV7sWPonwZPrQxHlOLf8WcTfgbr28RgW","X-Received":"by 2002:a05:7022:401:b0:12d:b3f8:60e7 with SMTP id\n a92af1059eb24-12dfd85ed7fmr2551232c88.34.1777773501751;\n Sat, 02 May 2026 18:58:21 -0700 (PDT)","From":"54weasels <54weasels@gmail.com>","To":"qemu-devel@nongnu.org","Cc":"laurent@vivier.eu,\n\tthuth@redhat.com,\n\t54weasels <54weasels@gmail.com>","Subject":"[PATCH 5/7] hw/m68k: Overhaul Sun-3 MMU and Boot PROM mapping","Date":"Sat, 2 May 2026 18:57:54 -0700","Message-ID":"<20260503015756.99176-6-54weasels@gmail.com>","X-Mailer":"git-send-email 2.50.1","In-Reply-To":"<20260503015756.99176-1-54weasels@gmail.com>","References":"<20260503015756.99176-1-54weasels@gmail.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=2607:f8b0:4864:20::1234;\n envelope-from=54weasels@gmail.com; helo=mail-dl1-x1234.google.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-Mailman-Approved-At":"Sun, 03 May 2026 01:59:18 -0400","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"This heavily refactors the Sun-3 machine initialization to support its proprietary Custom MMU implementation, which replaces the standard Motorola 68851 MMU. It maps the diagnostic EEPROM, sets the correct 28-bit address bus masks, implements the OBIO aliasing rules for the Boot PROM, and connects the newly added LANCE, ESCC, and Intersil 7170 peripherals.\n\nSigned-off-by: 54weasels <54weasels@gmail.com>\n---\n hw/m68k/Kconfig | 8 +\n hw/m68k/meson.build | 1 +\n hw/m68k/sun3.c | 499 ++++++++++++++++++++++++++\n hw/m68k/sun3_eeprom_data.h | 259 ++++++++++++++\n hw/m68k/sun3mmu.c | 705 +++++++++++++++++++++++++++++++++++++\n include/hw/m68k/sun3mmu.h | 65 ++++\n 6 files changed, 1537 insertions(+)\n create mode 100644 hw/m68k/sun3.c\n create mode 100644 hw/m68k/sun3_eeprom_data.h\n create mode 100644 hw/m68k/sun3mmu.c\n create mode 100644 include/hw/m68k/sun3mmu.h","diff":"diff --git a/hw/m68k/Kconfig b/hw/m68k/Kconfig\nindex aff769b30f..59b36c75ee 100644\n--- a/hw/m68k/Kconfig\n+++ b/hw/m68k/Kconfig\n@@ -46,3 +46,11 @@ config M68K_VIRT\n select GOLDFISH_TTY\n select GOLDFISH_RTC\n select VIRTIO_MMIO\n+\n+config SUN3\n+ bool\n+ default y\n+ depends on M68K\n+ select ESCC\n+ select LANCE\n+ select INTERSIL7170\ndiff --git a/hw/m68k/meson.build b/hw/m68k/meson.build\nindex 84bc68fa4e..c8b07d81fb 100644\n--- a/hw/m68k/meson.build\n+++ b/hw/m68k/meson.build\n@@ -3,6 +3,7 @@ m68k_ss.add(when: 'CONFIG_AN5206', if_true: files('an5206.c', 'mcf5206.c'))\n m68k_ss.add(when: 'CONFIG_MCF5208', if_true: files('mcf5208.c', 'mcf_intc.c'))\n m68k_ss.add(when: 'CONFIG_NEXTCUBE', if_true: files('next-kbd.c', 'next-cube.c'))\n m68k_ss.add(when: 'CONFIG_Q800', if_true: files('q800.c', 'q800-glue.c'))\n+m68k_ss.add(when: 'CONFIG_SUN3', if_true: files('sun3.c', 'sun3mmu.c'))\n m68k_ss.add(when: 'CONFIG_M68K_VIRT', if_true: files('virt.c'))\n \n hw_arch += {'m68k': m68k_ss}\ndiff --git a/hw/m68k/sun3.c b/hw/m68k/sun3.c\nnew file mode 100644\nindex 0000000000..16ad8b063d\n--- /dev/null\n+++ b/hw/m68k/sun3.c\n@@ -0,0 +1,499 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+/*\n+ * QEMU Sun-3 Board Emulation\n+ *\n+ * Copyright (c) 2026\n+ */\n+\n+#include \"qemu/osdep.h\"\n+\n+#include \"chardev/char.h\"\n+#include \"hw/char/escc.h\"\n+#include \"hw/core/boards.h\"\n+#include \"hw/core/irq.h\"\n+#include \"hw/core/loader.h\"\n+#include \"hw/core/qdev-properties.h\"\n+#include \"hw/core/sysbus.h\"\n+#include \"hw/net/lance.h\"\n+#include \"hw/intc/m68k_irqc.h\"\n+#include \"hw/m68k/sun3mmu.h\"\n+#include \"hw/timer/intersil7170.h\"\n+#include \"qapi/error.h\"\n+#include \"system/qtest.h\"\n+#include \"qemu/error-report.h\"\n+#include \"qemu/log.h\"\n+#include \"qemu/units.h\"\n+#include \"sun3_eeprom_data.h\"\n+#include \"system/address-spaces.h\"\n+#include \"system/reset.h\"\n+#include \"system/system.h\"\n+#include \"target/m68k/cpu.h\"\n+#include \"qom/object.h\"\n+\n+#define SUN3_PROM_BASE 0x0FEF0000\n+#define SUN3_PROM_SIZE (64 * 1024)\n+\n+#define TYPE_SUN3_MACHINE MACHINE_TYPE_NAME(\"sun3\")\n+OBJECT_DECLARE_SIMPLE_TYPE(Sun3MachineState, SUN3_MACHINE)\n+\n+struct Sun3MachineState {\n+ MachineState parent_obj;\n+\n+ /* Embedded Memory Regions */\n+ MemoryRegion rom;\n+ MemoryRegion rom_alias;\n+ MemoryRegion idprom;\n+ MemoryRegion intreg_iomem;\n+ MemoryRegion memerr_iomem;\n+ MemoryRegion eeprom;\n+ MemoryRegion nvram;\n+ MemoryRegion timeout_net;\n+\n+ /* Devices */\n+ DeviceState *irqc_dev;\n+ DeviceState *sun3mmu;\n+\n+ /* Boot State */\n+ uint32_t boot_sp;\n+ uint32_t boot_pc;\n+\n+ /* Interrupt Register State */\n+ uint8_t intreg;\n+ bool clock_pending;\n+\n+ /* Memory Error Register (Parity Spoof) State */\n+ uint8_t memerr_reg;\n+ uint8_t spoof_parity_lane;\n+ uint8_t parity_bit_counter;\n+ bool test_parity_written;\n+};\n+\n+static void sun3_update_clock_irq(Sun3MachineState *s)\n+{\n+ if (!s->irqc_dev) {\n+ return;\n+ }\n+\n+ /* Lower everything first */\n+ qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_5));\n+ qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));\n+\n+ /* Assert the currently enabled level if the clock is pulsing */\n+ if (s->clock_pending && (s->intreg & 0x01)) {\n+ if (s->intreg & 0x20) {\n+ qemu_irq_raise(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_5));\n+ } else if (s->intreg & 0x80) {\n+ qemu_irq_raise(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));\n+ }\n+ }\n+}\n+\n+static void sun3_clock_irq_handler(void *opaque, int n, int level)\n+{\n+ Sun3MachineState *s = SUN3_MACHINE(opaque);\n+ s->clock_pending = !!level;\n+ sun3_update_clock_irq(s);\n+}\n+\n+static uint64_t sun3_intreg_read(void *opaque, hwaddr addr, unsigned size)\n+{\n+ Sun3MachineState *s = SUN3_MACHINE(opaque);\n+ return s->intreg;\n+}\n+\n+static void sun3_intreg_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MachineState *s = SUN3_MACHINE(opaque);\n+ s->intreg = val;\n+\n+ qemu_log_mask(\n+ LOG_GUEST_ERROR,\n+ \"[SUN3 INTREG] Write: 0x%02x (Enable=%d, L1=%d, L2=%d, L3=%d)\\n\",\n+ (uint8_t)val, !!(val & 0x01), !!(val & 0x02), !!(val & 0x04),\n+ !!(val & 0x08));\n+\n+ if ((val & 0x01) == 0) {\n+ /* Master Interrupt Enable is CLEAR. Mask everything! */\n+ qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_1), 0);\n+ qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_2), 0);\n+ qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_3), 0);\n+ sun3_update_clock_irq(s);\n+ return;\n+ }\n+\n+ /* Master Enable is SET. Fire the Soft Interrupts! */\n+ qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_1),\n+ !!(val & 0x02));\n+ qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_2),\n+ !!(val & 0x04));\n+ qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_3),\n+ !!(val & 0x08));\n+\n+ /*\n+ * Retrigger clock IRQs because the Master Enable or Local Enables might\n+ * have changed\n+ */\n+ sun3_update_clock_irq(s);\n+}\n+\n+static const MemoryRegionOps sun3_intreg_ops = {.read = sun3_intreg_read,\n+ .write = sun3_intreg_write,\n+ .endianness =\n+ DEVICE_BIG_ENDIAN,\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ } };\n+\n+static uint64_t sun3_memerr_read(void *opaque, hwaddr addr, unsigned size)\n+{\n+ Sun3MachineState *s = SUN3_MACHINE(opaque);\n+ return s->memerr_reg;\n+}\n+\n+static void sun3_memerr_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MachineState *s = SUN3_MACHINE(opaque);\n+\n+ if (addr == 4) {\n+ s->memerr_reg &= ~0x80;\n+ if (s->irqc_dev) {\n+ qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));\n+ }\n+ return;\n+ }\n+\n+ s->memerr_reg = val & 0xFF;\n+ if (val == 0x20) {\n+ s->test_parity_written = true;\n+ } else if (val == 0) {\n+ s->test_parity_written = false;\n+ }\n+\n+ if (s->irqc_dev) {\n+ if ((val & 0x10) && (val & 0x40) && s->test_parity_written) {\n+ s->memerr_reg |=\n+ 0x80 | s->spoof_parity_lane; /* active & spoofed bit lane */\n+ s->parity_bit_counter++;\n+ if (s->parity_bit_counter == 8) {\n+ s->parity_bit_counter = 0;\n+ s->spoof_parity_lane >>= 1;\n+ if (s->spoof_parity_lane == 0) {\n+ s->spoof_parity_lane = 8;\n+ }\n+ }\n+\n+ qemu_irq_raise(qdev_get_gpio_in(\n+ s->irqc_dev, M68K_IRQC_LEVEL_7)); /* M68K_IRQC_LEVEL_7 */\n+ } else {\n+ s->memerr_reg &= ~0x80;\n+ qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));\n+ }\n+ }\n+}\n+\n+static const MemoryRegionOps sun3_memerr_ops = {\n+ .read = sun3_memerr_read,\n+ .write = sun3_memerr_write,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ .unaligned = true,\n+ },\n+ .impl = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ .unaligned = true,\n+ },\n+};\n+\n+static MemTxResult sun3_timeout_read_with_attrs(void *opaque, hwaddr addr,\n+ uint64_t *data, unsigned size,\n+ MemTxAttrs attrs)\n+{\n+ Sun3MMUState *mmu = SUN3_MMU(opaque);\n+ mmu->buserr_reg |= 0x20; /* Timeout */\n+ return MEMTX_ERROR;\n+}\n+\n+static MemTxResult sun3_timeout_write_with_attrs(void *opaque, hwaddr addr,\n+ uint64_t val, unsigned size,\n+ MemTxAttrs attrs)\n+{\n+ Sun3MMUState *mmu = SUN3_MMU(opaque);\n+ mmu->buserr_reg |= 0x20; /* Timeout */\n+ return MEMTX_ERROR;\n+}\n+\n+static const MemoryRegionOps sun3_timeout_ops = {\n+ .read_with_attrs = sun3_timeout_read_with_attrs,\n+ .write_with_attrs = sun3_timeout_write_with_attrs,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+};\n+\n+static void sun3_cpu_reset(void *opaque)\n+{\n+ M68kCPU *cpu = opaque;\n+ CPUState *cs = CPU(cpu);\n+ CPUM68KState *env = cpu_env(cs);\n+ Sun3MachineState *s = SUN3_MACHINE(current_machine);\n+\n+ /*\n+ * Execute generic QEMU system reset (wipes everything to 0).\n+ * This includes setting env->pc = 0 and env->aregs[7] = 0.\n+ */\n+ cpu_reset(cs);\n+\n+ /*\n+ * Forcefully inject the Boot PROM SP/PC vectors on EVERY reset.\n+ * The Sun-3 hardware uses a temporary MMU override to map the PROM to\n+ * 0x00000000 during the first few cycles of reset. Since QEMU does not\n+ * emulate this specific micro-architectural quirk, we must manually\n+ * restore the vectors here to prevent the CPU from executing uninitialized\n+ * RAM at 0x00000000 and getting stuck in a zero-pitch orib loop.\n+ */\n+ env->aregs[7] = s->boot_sp;\n+ env->sp[0] = s->boot_sp; /* M68K_SSP (Master) */\n+ env->sp[1] = s->boot_sp; /* M68K_USP (User) */\n+ env->sp[2] = s->boot_sp; /* M68K_ISP (Interrupt) */\n+ env->pc = s->boot_pc;\n+}\n+\n+static void sun3_init(MachineState *machine)\n+{\n+ Sun3MachineState *s_mach = SUN3_MACHINE(machine);\n+ M68kCPU *cpu;\n+ CPUM68KState *env;\n+ DeviceState *sun3mmu;\n+ DeviceState *dev;\n+ DeviceState *irqc_dev;\n+ SysBusDevice *s;\n+\n+ /* Initialize defaults */\n+ s_mach->memerr_reg = 0x40;\n+ s_mach->spoof_parity_lane = 8;\n+ s_mach->parity_bit_counter = 0;\n+ s_mach->test_parity_written = false;\n+ s_mach->intreg = 0;\n+ s_mach->clock_pending = false;\n+\n+ /* Initialize the CPU. The Sun 3/60 uses a 68020. */\n+ cpu = M68K_CPU(cpu_create(machine->cpu_type));\n+ env = &cpu->env;\n+ qemu_register_reset(sun3_cpu_reset, cpu);\n+\n+ /* Use automatically allocated main RAM */\n+ memory_region_add_subregion(get_system_memory(), 0x00000000, machine->ram);\n+\n+ /* Allocate and map ROM as writable RAM! */\n+ memory_region_init_ram(&s_mach->rom, NULL, \"sun3.prom\",\n+ SUN3_PROM_SIZE, &error_fatal);\n+ memory_region_set_readonly(&s_mach->rom, false);\n+ memory_region_add_subregion(get_system_memory(), SUN3_PROM_BASE,\n+ &s_mach->rom);\n+\n+ memory_region_init_alias(&s_mach->rom_alias, NULL, \"sun3.prom.alias\",\n+ &s_mach->rom, 0,\n+ SUN3_PROM_SIZE);\n+ memory_region_add_subregion(get_system_memory(), 0x0FF00000,\n+ &s_mach->rom_alias);\n+\n+ const char *bios_name = machine->firmware ?: \"sun3.prom\";\n+ if (bios_name) {\n+ int load_size = load_image_targphys(bios_name, SUN3_PROM_BASE,\n+ SUN3_PROM_SIZE,\n+ qtest_enabled() ? NULL : &error_fatal);\n+ if (load_size < 0) {\n+ if (!qtest_enabled()) {\n+ error_report(\"sun3: could not load prom '%s'\", bios_name);\n+ exit(1);\n+ }\n+ }\n+ error_report(\"Sun3 Init: Loaded %d bytes from '%s' at 0x%08x\",\n+ load_size,\n+ bios_name, SUN3_PROM_BASE);\n+\n+ /* Initial PC is always at offset 4 in firmware binaries */\n+ uint8_t *ptr = rom_ptr(SUN3_PROM_BASE, 8);\n+ if (ptr) {\n+ s_mach->boot_sp = ldl_be_p(ptr);\n+ s_mach->boot_pc = ldl_be_p(ptr + 4);\n+ error_report(\"Sun3 Init: Saved Firmware Vectors \"\n+ \"SP=0x%08x PC=0x%08x\",\n+ s_mach->boot_sp, s_mach->boot_pc);\n+ }\n+ } else {\n+ error_report(\n+ \"Sun3 Init: No firmware specified! Use -bios or -machine firmware=\");\n+ }\n+\n+ /* Set up the custom Sun-3 MMU */\n+ sun3mmu = qdev_new(TYPE_SUN3_MMU);\n+ s_mach->sun3mmu = sun3mmu;\n+ s = SYS_BUS_DEVICE(sun3mmu);\n+ sysbus_realize_and_unref(s, &error_fatal);\n+\n+ /* Intercept CPU memory translations with our custom MMU hook */\n+ env->custom_mmu_opaque = sun3mmu;\n+ env->custom_mmu_get_physical_address = sun3mmu_get_physical_address;\n+\n+ sysbus_mmio_map(s, 0, 0x80000000); /* Context Register */\n+ sysbus_mmio_map(s, 1, 0x90000000); /* Segment Map */\n+ sysbus_mmio_map(s, 2, 0xA0000000); /* Page Map */\n+ sysbus_mmio_map(s, 3, 0xB0000000); /* Control / System Enable */\n+ sysbus_mmio_map(s, 4, 0xC0000000); /* Bus Error Register */\n+\n+ memory_region_init_ram(&s_mach->idprom, NULL, \"sun3.idprom\", 8192,\n+ &error_fatal);\n+ memory_region_add_subregion(get_system_memory(), 0x08000000,\n+ &s_mach->idprom);\n+\n+ uint8_t idprom_data[32] = {\n+ 0x01, /* Format: 1 */\n+ 0x17, /* Machine Type: Sun-3/60 (0x17) */\n+ 0x08, 0x00, 0x20, 0x00, 0x00, 0x01, /* MAC Address */\n+ 0x00, 0x00, 0x00, 0x00, /* Date */\n+ 0x00, 0x00, 0x01, /* Serial */\n+ 0x00 /* Checksum */\n+ };\n+ uint8_t chksum = 0;\n+ for (int i = 0; i < 15; i++) {\n+ chksum ^= idprom_data[i];\n+ }\n+ idprom_data[15] = chksum;\n+\n+ rom_add_blob_fixed(\"sun3.idprom_content\", idprom_data, sizeof(idprom_data),\n+ 0x08000000);\n+\n+ /*\n+ * Set up the Interrupt Controller (IRQC) to route IRQs to\n+ * CPU autovectors\n+ */\n+ irqc_dev = qdev_new(TYPE_M68K_IRQC);\n+ object_property_set_link(OBJECT(irqc_dev), \"m68k-cpu\", OBJECT(cpu),\n+ &error_abort);\n+ sysbus_realize_and_unref(SYS_BUS_DEVICE(irqc_dev), &error_fatal);\n+ s_mach->irqc_dev = irqc_dev;\n+\n+ dev = qdev_new(TYPE_INTERSIL_7170);\n+ s = SYS_BUS_DEVICE(dev);\n+ sysbus_realize_and_unref(s, &error_fatal);\n+ sysbus_mmio_map(s, 0, 0x0FE60000);\n+ sysbus_connect_irq(s, 0,\n+ qemu_allocate_irq(sun3_clock_irq_handler, s_mach, 0));\n+\n+ dev = qdev_new(TYPE_ESCC);\n+ qdev_prop_set_bit(dev, \"force-hw-ready\", true);\n+ qdev_prop_set_uint32(dev, \"disabled\", 0);\n+ qdev_prop_set_uint32(dev, \"frequency\", 4915200); /* 4.9152 MHz */\n+ qdev_prop_set_uint32(dev, \"it_shift\", 1);\n+ qdev_prop_set_bit(dev, \"bit_swap\", false); /* Control/Data interleaving */\n+ qdev_prop_set_uint32(dev, \"mmio_size\", 8192);\n+ qdev_prop_set_chr(dev, \"chrB\", serial_hd(0)); /* Keyboard/Mouse A */\n+ qdev_prop_set_chr(dev, \"chrA\", serial_hd(1)); /* Keyboard/Mouse B */\n+ qdev_prop_set_uint32(dev, \"chnBtype\", escc_serial);\n+ qdev_prop_set_uint32(dev, \"chnAtype\", escc_serial);\n+ s = SYS_BUS_DEVICE(dev);\n+ sysbus_realize_and_unref(s, &error_fatal);\n+ sysbus_mmio_map(s, 0, 0x0FE00000);\n+ sysbus_connect_irq(s, 0,\n+ qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));\n+ /* IPL 6 */\n+ sysbus_connect_irq(s, 1,\n+ qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));\n+ /* IPL 6 */\n+\n+ dev = qdev_new(TYPE_ESCC);\n+ qdev_prop_set_bit(dev, \"force-hw-ready\", true);\n+ qdev_prop_set_uint32(dev, \"disabled\", 0);\n+ qdev_prop_set_uint32(dev, \"frequency\", 4915200); /* 4.9152 MHz */\n+ qdev_prop_set_uint32(dev, \"it_shift\", 1);\n+ qdev_prop_set_bit(dev, \"bit_swap\", false); /* Control/Data interleaving */\n+ qdev_prop_set_uint32(dev, \"mmio_size\", 8192);\n+ qdev_prop_set_chr(dev, \"chrB\", serial_hd(2)); /* Serial B */\n+ qdev_prop_set_chr(dev, \"chrA\", serial_hd(3)); /* Serial A */\n+ qdev_prop_set_uint32(dev, \"chnBtype\", escc_serial);\n+ qdev_prop_set_uint32(dev, \"chnAtype\", escc_serial);\n+ s = SYS_BUS_DEVICE(dev);\n+ sysbus_realize_and_unref(s, &error_fatal);\n+ sysbus_mmio_map(s, 0, 0x0FE20000);\n+ sysbus_connect_irq(s, 0,\n+ qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));\n+ /* IPL 6 */\n+ sysbus_connect_irq(s, 1,\n+ qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));\n+ /* IPL 6 */\n+\n+ memory_region_init_io(&s_mach->intreg_iomem, NULL, &sun3_intreg_ops, s_mach,\n+ \"sun3.intreg\", 8192);\n+ memory_region_add_subregion(get_system_memory(), 0x0FEA0000,\n+ &s_mach->intreg_iomem);\n+\n+ memory_region_init_io(&s_mach->memerr_iomem, NULL, &sun3_memerr_ops, s_mach,\n+ \"sun3.memerr\", 32);\n+ memory_region_add_subregion(get_system_memory(), 0x0FE80000,\n+ &s_mach->memerr_iomem);\n+\n+ dev = qdev_new(\"lance\");\n+ qemu_configure_nic_device(dev, true, NULL);\n+ object_property_set_link(OBJECT(dev), \"dma_mr\",\n+ OBJECT(&SUN3_MMU(sun3mmu)->dvma_iommu),\n+ &error_abort);\n+ s = SYS_BUS_DEVICE(dev);\n+ sysbus_realize_and_unref(s, &error_fatal);\n+ sysbus_mmio_map(s, 0, 0x0FF20000);\n+ sysbus_connect_irq(s, 0, qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_3));\n+\n+ memory_region_init_ram(&s_mach->eeprom, NULL, \"sun3.eeprom\", 2048,\n+ &error_fatal);\n+ memory_region_add_subregion(get_system_memory(), 0x0FE40000,\n+ &s_mach->eeprom);\n+ memcpy(memory_region_get_ram_ptr(&s_mach->eeprom), sun3_eeprom_blob,\n+ sizeof(sun3_eeprom_blob));\n+\n+ memory_region_init_ram(&s_mach->nvram, NULL, \"sun3.nvram\", 8192,\n+ &error_fatal);\n+ memory_region_add_subregion(get_system_memory(), 0x0FE50000,\n+ &s_mach->nvram);\n+\n+ memory_region_init_io(&s_mach->timeout_net, NULL, &sun3_timeout_ops,\n+ sun3mmu,\n+ \"sun3.timeout\", 0x06000000);\n+ memory_region_add_subregion_overlap(get_system_memory(), 0x0A000000,\n+ &s_mach->timeout_net, -10);\n+}\n+\n+static void sun3_machine_class_init(ObjectClass *oc, const void *data)\n+{\n+ MachineClass *mc = MACHINE_CLASS(oc);\n+\n+ mc->desc = \"Sun-3 (3/60)\";\n+ mc->init = sun3_init;\n+ mc->default_cpu_type = M68K_CPU_TYPE_NAME(\"m68020\");\n+ /* Minimum of 4MB for a 3/60, typical maximum ~24MB */\n+ mc->default_ram_size = 4 * MiB;\n+ mc->default_ram_id = \"sun3.ram\";\n+\n+ mc->ignore_memory_transaction_failures = false;\n+}\n+\n+static const TypeInfo sun3_machine_type = {\n+ .name = TYPE_SUN3_MACHINE,\n+ .parent = TYPE_MACHINE,\n+ .class_init = sun3_machine_class_init,\n+ .instance_size = sizeof(Sun3MachineState),\n+};\n+\n+static void sun3_machine_register_types(void)\n+{\n+ type_register_static(&sun3_machine_type);\n+}\n+\n+type_init(sun3_machine_register_types)\ndiff --git a/hw/m68k/sun3_eeprom_data.h b/hw/m68k/sun3_eeprom_data.h\nnew file mode 100644\nindex 0000000000..fbe3a84d6d\n--- /dev/null\n+++ b/hw/m68k/sun3_eeprom_data.h\n@@ -0,0 +1,259 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+static const uint8_t sun3_eeprom_blob[2048] = {\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x3c,\n+ 0x00, 0x3c, 0x00, 0x00, 0xc4, 0xc4, 0xc4, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00,\n+ 0x12, 0x73, 0x64, 0x00, 0x08, 0x00, 0x03, 0x12,\n+ 0x12, 0x00, 0x73, 0x64, 0x00, 0x08, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x57, 0x65, 0x6c, 0x63, 0x6f, 0x6d, 0x65, 0x20,\n+ 0x74, 0x6f, 0x20, 0x53, 0x2f, 0x57, 0x20, 0x77,\n+ 0x6f, 0x72, 0x6b, 0x73, 0x74, 0x61, 0x74, 0x69,\n+ 0x6f, 0x6e, 0x20, 0x4c, 0x4d, 0x53, 0x32, 0x20,\n+ 0x21, 0x21, 0x21, 0x21, 0x21, 0x21, 0x21, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x0d, 0x0a, 0x0a, 0x0a,\n+ 0x00, 0x00, 0x00, 0x00, 0x01, 0x04, 0x01, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x0c, 0x03, 0x01, 0x01,\n+ 0x02, 0x01, 0x02, 0x03, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0xf0, 0xf0, 0xf0, 0xf0, 0xf0, 0xf0, 0xf0, 0xf0,\n+ 0xf0, 0xf0, 0xf0, 0xf0, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0,\n+};\ndiff --git a/hw/m68k/sun3mmu.c b/hw/m68k/sun3mmu.c\nnew file mode 100644\nindex 0000000000..a0192b5677\n--- /dev/null\n+++ b/hw/m68k/sun3mmu.c\n@@ -0,0 +1,705 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+/*\n+ * QEMU Sun-3 MMU Model\n+ *\n+ * Copyright (c) 2026\n+ */\n+#include \"qemu/osdep.h\"\n+\n+#include \"exec/cputlb.h\"\n+#include \"hw/core/boards.h\"\n+#include \"hw/core/qdev-properties.h\"\n+#include \"hw/core/sysbus.h\"\n+#include \"hw/m68k/sun3mmu.h\"\n+#include \"qapi/error.h\"\n+#include \"qemu/log.h\"\n+#include \"qemu/module.h\"\n+#include \"system/runstate.h\"\n+#include \"target/m68k/cpu.h\"\n+#include \"system/address-spaces.h\"\n+\n+#define SUN3_MMU_CONTEXT(addr) ((addr >> 28) & 0x7)\n+\n+static uint64_t sun3_mmu_context_read(void *opaque, hwaddr addr,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ return s->context_reg;\n+}\n+\n+static void sun3_mmu_context_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ s->context_reg = val & 0x7;\n+ tlb_flush(CPU(first_cpu));\n+}\n+\n+static const MemoryRegionOps sun3_mmu_context_ops = {\n+ .read = sun3_mmu_context_read,\n+ .write = sun3_mmu_context_write,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+};\n+\n+static uint64_t sun3_mmu_segment_read(void *opaque, hwaddr addr,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);\n+ /*\n+ * The Segment Map index is determined by bits 17..27 of the virtual address\n+ */\n+ uint16_t seg_index = (addr >> 17) & 0x7FF;\n+ uint32_t index = (ctx << 11) | seg_index;\n+ return s->segment_map[index];\n+}\n+\n+static void sun3_mmu_segment_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);\n+ /*\n+ * The Segment Map index is determined by bits 17..27 of the virtual address\n+ */\n+ uint16_t seg_index = (addr >> 17) & 0x7FF;\n+ s->segment_map[(ctx * SUN3_MMU_SEGMENTS_PER_CONTEXT) + seg_index] =\n+ val & 0xFF;\n+ tlb_flush(CPU(first_cpu));\n+}\n+\n+static const MemoryRegionOps sun3_mmu_segment_ops = {\n+ .read = sun3_mmu_segment_read,\n+ .write = sun3_mmu_segment_write,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .impl = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+};\n+\n+static uint64_t sun3_mmu_page_read(void *opaque, hwaddr addr, unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);\n+\n+ /*\n+ * The Page Map address offset contains the virtual segment AND page\n+ * index.\n+ */\n+ uint16_t vtr_seg = (addr >> 17) & 0x7FF;\n+ uint16_t vtr_page = (addr >> 13) & 0xF;\n+ uint32_t pmeg = s->segment_map[(ctx << 11) | vtr_seg];\n+ uint32_t index = (pmeg << 4) | vtr_page;\n+ return s->page_map[index];\n+}\n+\n+static void sun3_mmu_page_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);\n+\n+ uint16_t vtr_seg = (addr >> 17) & 0x7FF;\n+ uint16_t vtr_page = (addr >> 13) & 0xF;\n+ uint32_t pmeg = s->segment_map[(ctx << 11) | vtr_seg];\n+ uint32_t index = (pmeg << 4) | vtr_page;\n+\n+ if (size == 4) {\n+ s->page_map[index] = val;\n+ } else if (size == 2) {\n+ uint32_t shift = (addr & 2) ? 0 : 16;\n+ s->page_map[index] = (s->page_map[index] & ~(0xFFFF << shift)) |\n+ ((val & 0xFFFF) << shift);\n+ } else if (size == 1) {\n+ uint32_t shift = (3 - (addr & 3)) * 8;\n+ s->page_map[index] = (s->page_map[index] & ~(0xFF << shift)) |\n+ ((val & 0xFF) << shift);\n+ }\n+\n+ tlb_flush(CPU(first_cpu));\n+}\n+\n+static const MemoryRegionOps sun3_mmu_page_ops = {\n+ .read = sun3_mmu_page_read,\n+ .write = sun3_mmu_page_write,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .impl = {\n+ .min_access_size = 4,\n+ .max_access_size = 4,\n+ },\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+};\n+\n+static uint64_t sun3_mmu_control_read(void *opaque, hwaddr addr,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ /* The region covers multiple 32-bit mapped registers now */\n+ if (addr == 0x0) {\n+ /*\n+ * The hardware diagnostic switch on the Sun-3 CPU board is checked\n+ * here. Setting bit 0 to 1 forces the extended memory test.\n+ */\n+ return s->enable_reg | 0x01;\n+ }\n+\n+ /* Diagnostic LEDs */\n+ if (addr == 0x30000000) {\n+ return 0xFF; /* Typically inverted, 0xFF means all off */\n+ }\n+\n+ qemu_log_mask(LOG_UNIMP,\n+ \"sun3_mmu_control_read at offset 0x%\" HWADDR_PRIx\n+ \" (size=%u)\\n\",\n+ addr, size);\n+ return 0;\n+}\n+\n+static uint64_t sun3_mmu_buserr_read(void *opaque, hwaddr addr, unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+\n+ uint8_t ret = s->buserr_reg;\n+ s->buserr_reg = 0; /* Hardware clears on read */\n+\n+ return ret;\n+}\n+\n+static void sun3_mmu_buserr_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ s->buserr_reg = 0;\n+}\n+\n+static const MemoryRegionOps sun3_mmu_buserr_ops = {\n+ .read = sun3_mmu_buserr_read,\n+ .write = sun3_mmu_buserr_write,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+};\n+\n+static void sun3_mmu_control_write(void *opaque, hwaddr addr, uint64_t val,\n+ unsigned size)\n+{\n+ Sun3MMUState *s = SUN3_MMU(opaque);\n+ if (addr == 0x0) {\n+ /* System Enable Register at 0x40000000 */\n+ uint8_t enable_old = s->enable_reg;\n+ s->enable_reg = (enable_old & 0x01) | (val & 0xFE);\n+\n+ tlb_flush(CPU(first_cpu));\n+ return;\n+ }\n+\n+ if (addr == 0x30000000) {\n+ /* Otherwise Diagnostic LEDs (e.g. 0xFF to clear) */\n+ return;\n+ }\n+\n+ qemu_log_mask(LOG_UNIMP,\n+ \"sun3_mmu_control_write at offset 0x%\" HWADDR_PRIx\n+ \"\\n\", addr);\n+}\n+\n+static const MemoryRegionOps sun3_mmu_control_ops = {\n+ .read = sun3_mmu_control_read,\n+ .write = sun3_mmu_control_write,\n+ .endianness = DEVICE_BIG_ENDIAN,\n+ .valid = {\n+ .min_access_size = 1,\n+ .max_access_size = 4,\n+ },\n+};\n+\n+static void sun3_mmu_reset(DeviceState *dev)\n+{\n+ Sun3MMUState *s = SUN3_MMU(dev);\n+\n+ s->context_reg = 0;\n+\n+ /*\n+ * On a Cold Boot, the Bus Error Register MUST be 0x00.\n+ * Bit 0 is NOT a Watchdog flag that must be 1. In fact, if the register\n+ * reads\n+ * non-zero, the PROM assumes it is returning from a Watchdog/Bus Error\n+ * Panic and attempts to dump CPU state to memory (moveml) before the\n+ * MMU is initialized, causing a Double Fault.\n+ */\n+ s->buserr_reg = 0x00;\n+\n+ /*\n+ * CRITICAL: Do NOT wipe the Segment Map or Page Map!\n+ The Sun-3 Boot PROM relies on the physical MMU SRAM persisting across\n+ * Watchdog Resets so it can trace and push exception vectors back\n+ * into mapped physical RAM!\n+ */\n+}\n+\n+static void sun3_mmu_init(Object *obj)\n+{\n+ Sun3MMUState *s = SUN3_MMU(obj);\n+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n+\n+ /* Context Map */\n+ /*\n+ * Note: Control space regions decode the top nibble of a 32-bit address.\n+ The PROM uses the raw virtual address as the offset when accessing\n+ these regions, so they must handle sparsely distributed addresses up to\n+ 256MB.\n+ */\n+ memory_region_init_io(&s->context_mem, obj, &sun3_mmu_context_ops, s,\n+ \"sun3-mmu-context\", 0x10000000);\n+ sysbus_init_mmio(sbd, &s->context_mem);\n+\n+ /* Segment Map */\n+ memory_region_init_io(&s->segment_mem, obj, &sun3_mmu_segment_ops, s,\n+ \"sun3-mmu-segment\", 0x10000000);\n+ sysbus_init_mmio(sbd, &s->segment_mem);\n+\n+ /* Page Map */\n+ memory_region_init_io(&s->page_mem, obj, &sun3_mmu_page_ops, s,\n+ \"sun3-mmu-page\", 0x10000000);\n+ sysbus_init_mmio(sbd, &s->page_mem);\n+\n+ /* Other control bits (Enable Register, Diagnostic LEDs) */\n+ memory_region_init_io(&s->control_mem, obj, &sun3_mmu_control_ops, s,\n+ \"sun3-mmu-control\", 0x40000000);\n+ sysbus_init_mmio(sbd, &s->control_mem);\n+\n+ /*\n+ * Bus Error Register dedicated mapping\n+ */\n+ memory_region_init_io(&s->buserr_mem, obj, &sun3_mmu_buserr_ops, s,\n+ \"sun3-mmu-buserr\", 1);\n+ sysbus_init_mmio(sbd, &s->buserr_mem);\n+\n+ /* DVMA IOMMU interception region */\n+ memory_region_init_iommu(&s->dvma_iommu, sizeof(s->dvma_iommu),\n+ TYPE_SUN3_DVMA_IOMMU_MEMORY_REGION,\n+ obj, \"sun3-dvma\", 0x1000000);\n+}\n+\n+static void sun3_mmu_class_init(ObjectClass *klass, const void *data)\n+{\n+ DeviceClass *dc = DEVICE_CLASS(klass);\n+\n+ device_class_set_legacy_reset(dc, sun3_mmu_reset);\n+ dc->vmsd = NULL; /* TODO: Add migration state later */\n+}\n+\n+static IOMMUTLBEntry sun3_dvma_translate(IOMMUMemoryRegion *iommu, hwaddr addr,\n+ IOMMUAccessFlags flag, int iommu_idx)\n+{\n+ Sun3MMUState *s = container_of(iommu, Sun3MMUState, dvma_iommu);\n+ CPUState *cs = first_cpu;\n+ CPUM68KState *env = cs ? cpu_env(cs) : NULL;\n+\n+ IOMMUTLBEntry ret = {\n+ .target_as = &address_space_memory,\n+ .iova = addr,\n+ .translated_addr = 0,\n+ .addr_mask = ~(hwaddr)0,\n+ .perm = IOMMU_NONE,\n+ };\n+\n+ if (!env) {\n+ return ret;\n+ }\n+\n+ hwaddr physical;\n+ int prot;\n+ hwaddr page_size;\n+ /*\n+ * Lance DVMA translates 24-bit requests implicitly onto the top 16MB of\n+ * the 28-bit virtual Bus (0x0Fxxxxxx) tied rigidly to Context 0.\n+ */\n+ uint32_t vaddr = addr + 0x0F000000;\n+\n+ int access_type = ACCESS_DATA | ACCESS_SUPER | (5 << 8);\n+ if (flag == IOMMU_WO || flag == IOMMU_RW) {\n+ access_type |= ACCESS_STORE;\n+ }\n+\n+ uint8_t old_ctx = s->context_reg;\n+ s->context_reg = 0; /* Hardware forces Context 0 during DVMA */\n+\n+ if (sun3mmu_get_physical_address(env, &physical, &prot, vaddr,\n+ access_type, &page_size) == 0) {\n+ ret.translated_addr = physical & ~(page_size - 1);\n+ ret.addr_mask = page_size - 1;\n+ if (prot & PAGE_WRITE) {\n+ ret.perm = IOMMU_RW;\n+ } else if (prot & PAGE_READ) {\n+ ret.perm = IOMMU_RO;\n+ }\n+ }\n+ s->context_reg = old_ctx; /* Restore pre-DVMA context */\n+ return ret;\n+}\n+\n+static void sun3_dvma_iommu_memory_region_class_init(ObjectClass *klass,\n+ const void *data)\n+{\n+ IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);\n+ imrc->translate = sun3_dvma_translate;\n+}\n+\n+static const TypeInfo sun3_dvma_iommu_memory_region_info = {\n+ .name = TYPE_SUN3_DVMA_IOMMU_MEMORY_REGION,\n+ .parent = TYPE_IOMMU_MEMORY_REGION,\n+ .class_init = sun3_dvma_iommu_memory_region_class_init,\n+};\n+\n+static const TypeInfo sun3_mmu_info = {\n+ .name = TYPE_SUN3_MMU,\n+ .parent = TYPE_SYS_BUS_DEVICE,\n+ .instance_size = sizeof(Sun3MMUState),\n+ .instance_init = sun3_mmu_init,\n+ .class_init = sun3_mmu_class_init,\n+};\n+\n+static void sun3_mmu_register_types(void)\n+{\n+ type_register_static(&sun3_mmu_info);\n+ type_register_static(&sun3_dvma_iommu_memory_region_info);\n+}\n+\n+type_init(sun3_mmu_register_types)\n+\n+static bool is_valid_sun3_phys(hwaddr p, ram_addr_t ram_size)\n+{\n+ if (p < ram_size) {\n+ return true;\n+ }\n+ if (p >= 0x0FE50000 && p <= 0x0FE7FFFF) {\n+ return true; /* NVRAM and OBIO RAM */\n+ }\n+ if (p >= 0x08000000 && p <= 0x08001FFF) {\n+ return true; /* IDPROM */\n+ }\n+ if (p >= 0x0FEF0000 && p <= 0x0FEFFFFF) {\n+ return true; /* PROM */\n+ }\n+ if (p >= 0x0FF00000 && p <= 0x0FF0FFFF) {\n+ return true; /* PROM Alias */\n+ }\n+\n+ /* Specific OBIO devices for Sun-3/60 (Ferrari) */\n+ if (p >= 0x0FE00000 && p <= 0x0FE00007) {\n+ return true; /* ZS1 (Kbd/Mouse) */\n+ }\n+ if (p >= 0x0FE20000 && p <= 0x0FE20007) {\n+ return true; /* ZS0 (Serial) */\n+ }\n+ if (p >= 0x0FE40000 && p <= 0x0FE407FF) {\n+ return true; /* EEPROM */\n+ }\n+ if (p >= 0x0FF20000 && p <= 0x0FF201FF) {\n+ return true; /* LANCE Am7990 */\n+ }\n+ if (p >= 0x0FE60000 && p <= 0x0FE6003F) {\n+ return true; /* Timer */\n+ }\n+ if (p >= 0x0FE80000 && p <= 0x0FE8001F) {\n+ return true; /* Memerr */\n+ }\n+ if (p >= 0x0FEA0000 && p <= 0x0FEA0003) {\n+ return true; /* Intreg */\n+ }\n+\n+ return false;\n+}\n+\n+int sun3mmu_get_physical_address(void *env, hwaddr *physical, int *prot,\n+ vaddr address, int access_type,\n+ hwaddr *page_size)\n+{\n+ /*\n+ * Translate the virtual address using the Sun-3 MMU maps.\n+ */\n+ CPUM68KState *m68k_env = env;\n+ Sun3MMUState *s = SUN3_MMU(m68k_env->custom_mmu_opaque);\n+\n+ uint8_t context;\n+ uint16_t pmeg = 0;\n+ uint32_t pte;\n+ uint32_t pte_index = 0;\n+ uint32_t pte_offset = 0;\n+ uint32_t phys_addr;\n+\n+ /*\n+ * access_type from m68k TCG:\n+ ACCESS_CODE (0x10), ACCESS_DATA (0x20)\n+ * ACCESS_SUPER (0x01) *\n+ */\n+ bool is_write = access_type & ACCESS_STORE;\n+ bool is_supervisor = access_type & ACCESS_SUPER;\n+\n+ *page_size = TARGET_PAGE_SIZE;\n+\n+ /*\n+ * QEMU Pipeline Prefetch Workaround:\n+ * The Sun-3 PROM executes `movesb %d0, 0x40000000` out of ROM (0x0FEFxxxx)\n+ * to enable the MMU (`enable_reg |= 0x80`). On real M68020 hardware, the\n+ * subsequent instruction(s) have already been prefetched while the MMU\n+ * was off. QEMU attempts to fetch the next sequential instruction\n+ * synchronously with the MMU fully active. Because the PROM has not mapped\n+ * 0x0FEF0000 in the Page Table (it only maps Virtual 0x00000000 to\n+ * the ROM),\n+ * QEMU triggers an immediate Translation Fault Exception Loop! We must\n+ * manually bless instruction fetches originating mechanically from the\n+ * physical ROM space to emulate the prefetch cache. *\n+ */\n+ if ((access_type & ACCESS_CODE) &&\n+ (address >= 0x0FEF0000 && address <= 0x0FEFFFFF)) {\n+ *physical = address;\n+ *prot = PAGE_READ | PAGE_EXEC;\n+ return 0;\n+ }\n+\n+ /*\n+ * Boot Mode PROM Bypass:\n+ If the Not-Boot bit (0x80) in the Enable Register is clear (System is in\n+ Boot State): ONLY Instruction Fetches bypass the MMU mapping mechanism!\n+ Data accesses and Stack Pushes (such as the Exception Frame push to\n+ 0x0FEEFFFE) proceed through the MMU mapped tables normally because the\n+ * PROM sets up its stack logically! *\n+ */\n+\n+\n+\n+ qemu_log_mask(CPU_LOG_MMU,\n+ \"[SUN3MMU] get_physical_address(0x%08\" VADDR_PRIx\n+ \") enable_reg=0x%02x\\n\",\n+ address, s->enable_reg);\n+\n+ /*\n+ * Sun-3 Hardware Architectural Demultiplexer:\n+ * The M68020 emulator now seamlessly passes the Source/Destination Function\n+ * Code inside the top 8 bits of the `access_type` bitmask, directly\n+ * supplied\n+ * via an isolation index in the QEMU TCG pipeline. This mirrors\n+ * how the physical M68K processor provides 3 explicit FC pins in\n+ * addition to\n+ * the 32-bit physical address bus!\n+ *\n+ * If the extracted FC equals 3 (Control Space / Hardware Registers), it\n+ * NEVER enters the MMU Segment Map. It is universally 1:1 mapped to\n+ * physical memory for raw HW device configuration (0x60000000, 0x10000000)!\n+ */\n+ uint8_t true_fc = (access_type >> 8) & 0x07;\n+ if (true_fc == 3) {\n+ /*\n+ * Direct Physical Bypass Mapping to discrete SysBus devices.\n+ * The top nibble of the virtual address selects the Control Space\n+ * target. All lower bits are aliases.\n+ */\n+ uint32_t device_base = address & 0x70000000;\n+\n+ if (device_base == 0x00000000) {\n+ /*\n+ * IDPROM is logically at 0x0 and occupies 32 bytes in hardware. We\n+ * shift it to 0x08000000 linearly in QEMU and force a 5-bit wrap\n+ * so it safely avoids physical Main RAM/ROM collisions! *\n+ */\n+ *physical = 0x08000000 | (address & 0x1F);\n+ } else {\n+ switch (device_base) {\n+ case 0x10000000: /* Page Map */\n+ /*\n+ * Hardware Page Map physically contains 256 PMEGs *\n+ * 16 PTEs * 4 bytes = 16,384 bytes\n+ */\n+ *physical = 0xA0000000 | (address & 0x0FFFFFFF);\n+ break;\n+ case 0x20000000: /* Segment Map */\n+ /*\n+ * Hardware Segment Map structurally is 8 Contexts *\n+ * 2048 segments * 1 byte = 16,384 bytes\n+ */\n+ *physical = 0x90000000 | (address & 0x0FFFFFFF);\n+ break;\n+ case 0x30000000: /* Context Register */\n+ /*\n+ * Context register physically uniquely masks natively\n+ * strictly functionally inside hardware\n+ */\n+ *physical = 0x80000000 | (address & 0x07);\n+ break;\n+ case 0x40000000: /* System Enable */\n+ *physical = 0xB0000000 | (address & 0x0FFFFFFF);\n+ break;\n+ case 0x60000000: /* Bus Error Register */\n+ *physical = 0xC0000000 | (address & 0x0FFFFFFF);\n+ break;\n+ case 0x70000000:\n+ /* Diagnostic Register (Aliases into Enable mem region) */\n+ *physical = 0xB0000000ULL + 0x30000000ULL +\n+ (address & 0x0FFFFFFF);\n+ break;\n+ default:\n+ s->buserr_reg |= 0x20; /* Timeout */\n+ return 1;\n+ }\n+ }\n+\n+ *prot = PAGE_READ | PAGE_WRITE;\n+ *page_size = SUN3_PAGE_SIZE;\n+\n+ qemu_log_mask(\n+ CPU_LOG_MMU,\n+ \"[SUN3MMU] TRUE FC=3 CONTROL SPACE DECODE: vaddr=0x%08\" VADDR_PRIx\n+ \" mapped directly to physical 0x%08x\\n\",\n+ address, (unsigned int)*physical);\n+\n+ return 0;\n+ }\n+\n+ /*\n+ * For all standard memory operations, the Sun-3 physically masks the\n+ * Address Bus to 28 virtual bits before hitting the MMU Arrays.\n+ */\n+ address &= 0x0FFFFFFF;\n+\n+ if (!(s->enable_reg & 0x80)) {\n+ /* Boot State: Not-Boot bit (0x80) is CLEAR */\n+\n+ /*\n+ * Address < 0x01000000 && Supervisor Program:\n+ * Bypass MMU and map to the physical PROM (0x0FEF0000).\n+ */\n+ if (true_fc == 6 && (address < 0x01000000 ||\n+ (address >= 0x0FEF0000 && address < 0x0FF00000))) {\n+ *physical = 0x0FEF0000 | (address & 0x0001FFFF);\n+ *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;\n+ *page_size = SUN3_PAGE_SIZE;\n+ return 0;\n+ }\n+ }\n+\n+ context = s->context_reg & (SUN3_MMU_CONTEXTS - 1);\n+\n+ /* Segment map lookup: top 11 bits of 28-bit virtual address (bits 17-27) */\n+ uint32_t seg_index = (address >> 17) & (SUN3_MMU_SEGMENTS_PER_CONTEXT - 1);\n+ pmeg = s->segment_map[(context * SUN3_MMU_SEGMENTS_PER_CONTEXT) +\n+ seg_index];\n+\n+ /* Page map lookup: bits 13-16 of virtual address */\n+ pte_index = (address >> SUN3_PAGE_SHIFT) & (SUN3_MMU_PTE_PER_PMEG - 1);\n+ pte_offset = (pmeg * SUN3_MMU_PTE_PER_PMEG) + pte_index;\n+ pte = s->page_map[pte_offset];\n+\n+ /* Update PTE Accessed/Modified bits */\n+ if (pte & SUN3_PTE_VALID) {\n+ uint32_t new_pte = pte | SUN3_PTE_REF;\n+ if (is_write) {\n+ new_pte |= SUN3_PTE_MOD;\n+ }\n+ if (new_pte != pte) {\n+ s->page_map[pte_offset] = new_pte;\n+ }\n+ }\n+\n+ if (!(pte & SUN3_PTE_VALID)) {\n+ s->buserr_reg |= 0x80; /* Invalid */\n+ return 1; /* Translation fault */\n+ }\n+\n+ /* Protection check */\n+ uint8_t mmu_prot = (pte >> 29) & 3;\n+\n+ if (!is_supervisor && (mmu_prot & 1)) {\n+ s->buserr_reg |= 0x40; /* Protection */\n+ return 1; /* User access to supervisor page */\n+ }\n+\n+ *prot = PAGE_READ | PAGE_EXEC;\n+ if (mmu_prot & 2) {\n+ if (is_write || (pte & SUN3_PTE_MOD)) {\n+ *prot |= PAGE_WRITE;\n+ }\n+ }\n+\n+ if (is_write && !(mmu_prot & 2)) {\n+ s->buserr_reg |= 0x40; /* Protection */\n+ return 1;\n+ }\n+\n+ /*\n+ * Extract physical address. The top 15 bits come from the PTE's\n+ * PGFRAME. Bottom 13 bits (0x1FFF) come directly from the virtual\n+ * address.\n+ */\n+ phys_addr = ((pte & SUN3_PTE_PGFRAME) << SUN3_PAGE_SHIFT) |\n+ (address & (SUN3_PAGE_SIZE - 1));\n+\n+ /*\n+ * Address space Mapping reference:\n+ * - OBMEM: 0x00000000 (Follows native Map)\n+ * - OBIO: 0x0FE00000 (Relocated above typical 24MB RAM)\n+ * - VME_D16: 0x40000000 (Relocated out of bounds)\n+ * - VME_D32: 0x50000000\n+ */\n+ uint32_t pgbase = ((pte & SUN3_PTE_PGFRAME) << SUN3_PAGE_SHIFT);\n+ uint32_t pgtype = (pte & SUN3_PTE_PGTYPE) >> 26;\n+\n+ /*\n+ * Sun-3 Hardware Quirk:\n+ * The Boot PROM maps Virtual `0x00000000` to its ROM header using OBIO\n+ * Page `0x80` (`0xC4000080`). Native hardware intercepts OBIO offset\n+ * `0x100000` and transparently aliases it back to OBMEM PROM\n+ * (`0x0FEF0000`) using the virtual address to index the ROM! *\n+ */\n+ if (pgtype == SUN3_PGTYPE_OBIO &&\n+ (pgbase >= 0x100000 && pgbase < 0x120000)) {\n+ phys_addr = 0x0FEF0000 | (address & 0x1FFFF);\n+ } else {\n+ switch (pgtype) {\n+ case SUN3_PGTYPE_OBMEM:\n+ break;\n+ case SUN3_PGTYPE_OBIO:\n+ phys_addr += 0x0FE00000;\n+ break;\n+ case SUN3_PGTYPE_VME_D16:\n+ phys_addr += 0x40000000;\n+ break;\n+ case SUN3_PGTYPE_VME_D32:\n+ phys_addr += 0x50000000;\n+ break;\n+ }\n+ }\n+\n+ /* NXM (Non-Existent Memory) Bounds Checking */\n+ if (!is_valid_sun3_phys(phys_addr, current_machine->ram_size)) {\n+ s->buserr_reg |= 0x20; /* Timeout */\n+ return 1;\n+ }\n+\n+ /*\n+ * The QEMU TLB works in 4KB frames, not Sun-3's 8KB native frames.\n+ * We MUST explicitly append the intra-page offset within the 8KB page,\n+ * otherwise accesses to the upper 4KB (e.g. 0x1000, 0x3000) will be\n+ * truncated and overwrite the physical memory of the lower 4KB!\n+ */\n+ *physical = phys_addr | (address & (SUN3_PAGE_SIZE - 1));\n+\n+ *page_size = TARGET_PAGE_SIZE;\n+\n+ return 0; /* 0 = success, no fault */\n+}\ndiff --git a/include/hw/m68k/sun3mmu.h b/include/hw/m68k/sun3mmu.h\nnew file mode 100644\nindex 0000000000..bdd79d963b\n--- /dev/null\n+++ b/include/hw/m68k/sun3mmu.h\n@@ -0,0 +1,65 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+#ifndef HW_M68K_SUN3MMU_H\n+#define HW_M68K_SUN3MMU_H\n+\n+#include \"exec/cpu-common.h\"\n+#include \"exec/hwaddr.h\"\n+#include \"exec/target_page.h\"\n+#include \"hw/core/sysbus.h\"\n+#include \"qom/object.h\"\n+\n+#define TYPE_SUN3_MMU \"sun3-mmu\"\n+OBJECT_DECLARE_SIMPLE_TYPE(Sun3MMUState, SUN3_MMU)\n+\n+#define TYPE_SUN3_DVMA_IOMMU_MEMORY_REGION \"sun3-dvma-iommu-memory-region\"\n+\n+#define SUN3_MMU_CONTEXTS 8\n+#define SUN3_MMU_PMEGS 256\n+#define SUN3_MMU_PTE_PER_PMEG 16\n+#define SUN3_MMU_SEGMENTS_PER_CONTEXT 2048\n+\n+#define SUN3_PAGE_SIZE 0x2000 /* 8 KB */\n+#define SUN3_PAGE_MASK (~(SUN3_PAGE_SIZE - 1))\n+#define SUN3_PAGE_SHIFT 13\n+\n+/* PTE bits */\n+#define SUN3_PTE_VALID (1U << 31)\n+#define SUN3_PTE_WRITE (1U << 30)\n+#define SUN3_PTE_SYSTEM (1U << 29)\n+#define SUN3_PTE_NC (1U << 28)\n+#define SUN3_PTE_PGTYPE (3U << 26)\n+#define SUN3_PTE_REF (1U << 25)\n+#define SUN3_PTE_MOD (1U << 24)\n+#define SUN3_PTE_PGFRAME 0x0007FFFF\n+\n+/* PTE PGTYPE values */\n+#define SUN3_PGTYPE_OBMEM 0\n+#define SUN3_PGTYPE_OBIO 1\n+#define SUN3_PGTYPE_VME_D16 2\n+#define SUN3_PGTYPE_VME_D32 3\n+\n+struct Sun3MMUState {\n+ SysBusDevice parent_obj;\n+\n+ MemoryRegion context_mem;\n+ MemoryRegion segment_mem;\n+ MemoryRegion page_mem;\n+ MemoryRegion control_mem;\n+ MemoryRegion buserr_mem;\n+ IOMMUMemoryRegion dvma_iommu;\n+\n+ uint8_t sys_enable_reg; /* Reserved mapping for testing */\n+\n+ uint8_t context_reg;\n+ uint8_t enable_reg;\n+ uint8_t buserr_reg;\n+ uint8_t int_reg;\n+ uint8_t segment_map[SUN3_MMU_CONTEXTS * SUN3_MMU_SEGMENTS_PER_CONTEXT];\n+ uint32_t page_map[SUN3_MMU_PMEGS * SUN3_MMU_PTE_PER_PMEG];\n+};\n+\n+int sun3mmu_get_physical_address(void *env, hwaddr *physical, int *prot,\n+ vaddr address, int access_type,\n+ hwaddr *page_size);\n+\n+#endif\n","prefixes":["5/7"]}