[PATCH 0/7] m68k: Add Sun-3 Machine Emulation

[PATCH 0/7] m68k: Add Sun-3 Machine Emulation

[54weasels]

This implements a barebones Sun 3/60 that can boot a standard firmware, pass all the diagnostic tests and fully netboot both NetBSD 10 and SunOS 4.1.1
It has the minimum necessary devices: memory/MMU, diagnostic and error registers, interrupt, TOD clock, DMA, IDprom and configuration eeprom. I/O is the console serial and lance ethernet.
There are a few modifications needed to emulate a proper 68020, support another external MMU and sun3 specific ways of u sing the escc and ethernet devices.
Next steps are implementing SCSI, graphics, and patching through the keyboard and mouse.

This is part of the Sun 3/60 preservation project: https://github.com/54weasels/sun3_60

54weasels (7):
  target/m68k: Implement Physical Bus Error exception handling
  hw/net/lance: Add Sun-3 Native DMA byte-swapping support
  hw/char/escc: Expose diagnostic RS232 I/O routing
  hw/timer: Introduce Intersil 7170 RTC implementation
  hw/m68k: Overhaul Sun-3 MMU and Boot PROM mapping
  tests/qtest: Add Sun-3 hardware interaction tests
  tests/functional: Add Sun-3 firmware boot and diagnostic test

 hw/char/escc.c                      |  33 +-
 hw/m68k/Kconfig                     |   8 +
 hw/m68k/meson.build                 |   1 +
 hw/m68k/sun3.c                      | 499 ++++++++++++++++++++
 hw/m68k/sun3_eeprom_data.h          | 259 ++++++++++
 hw/m68k/sun3mmu.c                   | 705 ++++++++++++++++++++++++++++
 hw/net/lance.c                      | 111 ++++-
 hw/net/meson.build                  |   3 +-
 hw/timer/Kconfig                    |   3 +
 hw/timer/intersil7170.c             | 216 +++++++++
 hw/timer/meson.build                |   1 +
 include/hw/char/escc.h              |   3 +
 include/hw/m68k/sun3mmu.h           |  65 +++
 include/hw/net/lance.h              |   3 +
 include/hw/timer/intersil7170.h     |   9 +
 target/m68k/cpu.c                   |   5 +-
 target/m68k/cpu.h                   |  18 +-
 target/m68k/helper.c                | 130 ++++-
 target/m68k/op_helper.c             | 176 ++++---
 target/m68k/translate.c             |  31 +-
 tests/functional/m68k/meson.build   |   1 +
 tests/functional/m68k/test_sun3.py  |  34 ++
 tests/functional/qemu_test/asset.py |  11 +-
 tests/qtest/meson.build             |   1 +
 tests/qtest/sun3-test.c             |  67 +++
 25 files changed, 2294 insertions(+), 99 deletions(-)
 create mode 100644 hw/m68k/sun3.c
 create mode 100644 hw/m68k/sun3_eeprom_data.h
 create mode 100644 hw/m68k/sun3mmu.c
 create mode 100644 hw/timer/intersil7170.c
 create mode 100644 include/hw/m68k/sun3mmu.h
 create mode 100644 include/hw/timer/intersil7170.h
 create mode 100755 tests/functional/m68k/test_sun3.py
 create mode 100644 tests/qtest/sun3-test.c

-- 
2.50.1 (Apple Git-155)

[PATCH 1/7] target/m68k: Implement Physical Bus Error exception handling

[54weasels]

The M68020 natively maps hardware Bus Error (BERR) timeouts into a Long Bus Cycle Fault (Format 0xB). This commit adds the memory exception routing to natively synthesize these EXCP_ACCESS cycle faults. It also implements the double-fault / watchdog reset behavior required for Sun-3 hardware diagnostics, properly handles FSAVE/FRESTORE for 68881 FPU stubs, and properly constructs the 84-byte internal bus fault frame.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 target/m68k/cpu.c       |   5 +-
 target/m68k/cpu.h       |  18 +++-
 target/m68k/helper.c    | 130 ++++++++++++++++++++++++++++-
 target/m68k/op_helper.c | 176 ++++++++++++++++++++++++++--------------
 target/m68k/translate.c |  31 +++++--
 5 files changed, 283 insertions(+), 77 deletions(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index d849a4a90f..af375f0bce 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
  * QEMU Motorola 68k CPU
  *
@@ -51,8 +52,8 @@ static TCGTBCPUState m68k_get_tb_cpu_state(CPUState *cs)
     flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
     if (env->sr & SR_S) {
         flags |= TB_FLAGS_MSR_S;
-        flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) & TB_FLAGS_SFC_S;
-        flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) & TB_FLAGS_DFC_S;
+    flags |= (env->sfc << TB_FLAGS_SFC_S_BIT) & TB_FLAGS_SFC_S;
+    flags |= (env->dfc << TB_FLAGS_DFC_S_BIT) & TB_FLAGS_DFC_S;
     }
     if (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS) {
         flags |= TB_FLAGS_TRACE;
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 7911ab9de3..426ef6a6e1 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -149,10 +149,18 @@ typedef struct CPUArchState {
 
     int pending_vector;
     int pending_level;
+    bool nmi_pending;
 
     /* Fields up to this point are cleared by a CPU reset */
     struct {} end_reset_fields;
 
+    /* Custom MMU intercept logic, if any (e.g. for Sun-3) */
+    void *custom_mmu_opaque;
+    int (*custom_mmu_get_physical_address)(void *env, hwaddr *physical,
+                                           int *prot, vaddr address,
+                                           int access_type,
+                                           hwaddr *page_size);
+
     /* Fields from here on are preserved across CPU reset. */
     uint64_t features;
 } CPUM68KState;
@@ -601,12 +609,14 @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
 #define TB_FLAGS_MSR_S_BIT      13
 #define TB_FLAGS_MSR_S          (1 << TB_FLAGS_MSR_S_BIT)
 #define TB_FLAGS_SFC_S_BIT      14
-#define TB_FLAGS_SFC_S          (1 << TB_FLAGS_SFC_S_BIT)
-#define TB_FLAGS_DFC_S_BIT      15
-#define TB_FLAGS_DFC_S          (1 << TB_FLAGS_DFC_S_BIT)
-#define TB_FLAGS_TRACE          16
+#define TB_FLAGS_SFC_S          (7 << TB_FLAGS_SFC_S_BIT) /* 3 Bits reserved */
+#define TB_FLAGS_DFC_S_BIT      17
+#define TB_FLAGS_DFC_S          (7 << TB_FLAGS_DFC_S_BIT) /* 3 Bits reserved */
+#define TB_FLAGS_TRACE          20
 #define TB_FLAGS_TRACE_BIT      (1 << TB_FLAGS_TRACE)
 
+#define MMU_MOVES_FC_BASE       2 /* mmu_idx 2-9 correspond to FC 0-7 */
+
 void dump_mmu(CPUM68KState *env);
 
 #endif
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 9bab184389..997c2616f4 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -28,6 +28,7 @@
 #include "system/memory.h"
 #include "gdbstub/helpers.h"
 #include "fpu/softfloat.h"
+#include "qemu/log.h"
 #include "qemu/qemu-print.h"
 
 #define SIGNBIT (1u << 31)
@@ -280,8 +281,10 @@ void HELPER(m68k_movec_to)(CPUM68KState *env, uint32_t reg, uint32_t val)
             return;
         }
         break;
-    /* Unimplemented Registers */
+    /* Dummy implementation for CAAR */
     case M68K_CR_CAAR:
+        return;
+    /* Unimplemented Registers */
     case M68K_CR_PCR:
     case M68K_CR_BUSCR:
         cpu_abort(env_cpu(env),
@@ -384,8 +387,10 @@ uint32_t HELPER(m68k_movec_from)(CPUM68KState *env, uint32_t reg)
             return env->mmu.ttr[M68K_DTTR1];
         }
         break;
-    /* Unimplemented Registers */
+    /* Dummy implementation for CAAR */
     case M68K_CR_CAAR:
+        return 0;
+    /* Unimplemented Registers */
     case M68K_CR_PCR:
     case M68K_CR_BUSCR:
         cpu_abort(env_cpu(env), "Unimplemented control register read 0x%x\n",
@@ -915,6 +920,21 @@ hwaddr m68k_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
     int access_type;
     target_ulong page_size;
 
+    access_type = ACCESS_DATA | ACCESS_DEBUG;
+    if (env->sr & SR_S) {
+        access_type |= ACCESS_SUPER;
+    }
+
+    if (env->custom_mmu_get_physical_address) {
+        hwaddr custom_page_size;
+        if (env->custom_mmu_get_physical_address(env, &phys_addr, &prot, addr,
+                                                 access_type,
+                                                 &custom_page_size) == 0) {
+            return phys_addr;
+        }
+        return -1;
+    }
+
     if ((env->mmu.tcr & M68K_TCR_ENABLED) == 0) {
         /* MMU disabled */
         return addr;
@@ -944,6 +964,12 @@ void m68k_set_irq_level(M68kCPU *cpu, int level, uint8_t vector)
     CPUState *cs = CPU(cpu);
     CPUM68KState *env = &cpu->env;
 
+    if (level == 7 && env->pending_level != 7) {
+        env->nmi_pending = true;
+    } else if (level != 7) {
+        env->nmi_pending = false;
+    }
+
     env->pending_level = level;
     env->pending_vector = vector;
     if (level) {
@@ -964,6 +990,106 @@ bool m68k_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     int ret;
     target_ulong page_size;
 
+    if (qemu_access_type == MMU_INST_FETCH) {
+        access_type = ACCESS_CODE;
+    } else {
+        access_type = ACCESS_DATA;
+        if (qemu_access_type == MMU_DATA_STORE) {
+            access_type |= ACCESS_STORE;
+        }
+    }
+
+    /* Decode explicit Function Codes from moves instructions */
+    if (mmu_idx >= MMU_MOVES_FC_BASE) {
+        uint8_t fc = mmu_idx - MMU_MOVES_FC_BASE;
+        access_type |= (fc << 8); /* Pack explicit FC into access type */
+        if (fc != 1 && fc != 2) {
+            access_type |= ACCESS_SUPER;
+        }
+    } else {
+        /* Standard memory accesses map logically to normal M68K FCs */
+        if (mmu_idx == MMU_KERNEL_IDX) {
+            access_type |= ACCESS_SUPER;
+            access_type |= ((qemu_access_type == MMU_INST_FETCH ? 6 : 5) << 8);
+        } else {
+            access_type |= ((qemu_access_type == MMU_INST_FETCH ? 2 : 1) << 8);
+        }
+    }
+
+    if (env->custom_mmu_get_physical_address) {
+        hwaddr custom_page_size;
+
+        /* Delegate translation to external board-specific MMU if registered */
+        ret = env->custom_mmu_get_physical_address(env, &physical, &prot,
+                                                   address, access_type,
+                                                   &custom_page_size);
+
+        if (likely(ret == 0)) {
+            tlb_set_page(cs, address & TARGET_PAGE_MASK,
+                         physical & TARGET_PAGE_MASK, prot,
+                         mmu_idx, custom_page_size);
+            return true;
+        }
+
+        if (probe) {
+            return false;
+        }
+
+        /* page fault */
+        cs->exception_index = EXCP_ACCESS;
+        env->mmu.ar = address;
+
+        if (m68k_feature(env, M68K_FEATURE_M68040)) {
+            env->mmu.ssw = M68K_ATC_040;
+            switch (size) {
+            case 1:
+                env->mmu.ssw |= M68K_BA_SIZE_BYTE;
+                break;
+            case 2:
+                env->mmu.ssw |= M68K_BA_SIZE_WORD;
+                break;
+            case 4:
+                env->mmu.ssw |= M68K_BA_SIZE_LONG;
+                break;
+            }
+            env->mmu.ssw |= M68K_TM_040_DATA;
+        } else {
+            /* M68020/030 Special Status Word (SSW) */
+            uint16_t ssw = 0x0100; /* DF - Data Fault */
+            switch (size) {
+            case 1:
+                ssw |= 0x0010;
+                break;
+            case 2:
+                ssw |= 0x0020;
+                break;
+            case 3:
+                ssw |= 0x0030;
+                break;
+            case 4:
+                ssw |= 0x0000;
+                break;
+            }
+            if (qemu_access_type != MMU_DATA_STORE) {
+                ssw |= 0x0040; /* RW - Read */
+            }
+            /* Function Code */
+            uint8_t fc;
+            if (mmu_idx >= MMU_MOVES_FC_BASE) {
+                fc = mmu_idx - MMU_MOVES_FC_BASE;
+            } else {
+                if (mmu_idx == MMU_KERNEL_IDX) {
+                    fc = (qemu_access_type == MMU_INST_FETCH) ? 6 : 5;
+                } else {
+                    fc = (qemu_access_type == MMU_INST_FETCH) ? 2 : 1;
+                }
+            }
+            ssw |= (fc & 7);
+            env->mmu.ssw = ssw;
+        }
+        cpu_loop_exit_restore(cs, retaddr);
+    }
+
     if ((env->mmu.tcr & M68K_TCR_ENABLED) == 0) {
         /* MMU disabled */
         tlb_set_page(cs, address & TARGET_PAGE_MASK,
diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index 8148a8852e..84d5270767 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
  *  M68K helper routines
  *
@@ -25,6 +26,7 @@
 #include "qemu/plugin.h"
 
 #if !defined(CONFIG_USER_ONLY)
+#include "system/runstate.h"
 
 static void cf_rte(CPUM68KState *env)
 {
@@ -73,6 +75,12 @@ throwaway:
         case 7:
             sp += 52;
             break;
+        case 0xa: /* Short Bus Cycle Fault (Format 0xA) */
+            sp += 32 - 8; /* 32 bytes total - 8 bytes header = 24 bytes */
+            break;
+        case 0xb: /* Long Bus Cycle Fault (Format 0xB) */
+            sp += 92 - 8; /* 92 bytes total - 8 bytes header = 84 bytes */
+            break;
         }
     }
     env->aregs[7] = sp;
@@ -342,56 +350,80 @@ static void m68k_interrupt_all(CPUM68KState *env, int is_hw)
     switch (cs->exception_index) {
     case EXCP_ACCESS:
         if (env->mmu.fault) {
-            cpu_abort(cs, "DOUBLE MMU FAULT\n");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "M68K: Double MMU Fault. Halting CPU and requesting reset.\n");
+            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+            cs->halted = 1;
+            cs->exception_index = EXCP_HLT;
+            cpu_loop_exit(cs);
         }
         env->mmu.fault = true;
-        /* push data 3 */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* push data 2 */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* push data 1 */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 1 / push data 0 */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 1 address */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 2 data */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 2 address */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 3 data */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 3 address */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
-        /* fault address */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
-        /* write back 1 status */
-        sp -= 2;
-        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 2 status */
-        sp -= 2;
-        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* write back 3 status */
-        sp -= 2;
-        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
-        /* special status word */
-        sp -= 2;
-        cpu_stw_be_mmuidx_ra(env, sp, env->mmu.ssw, MMU_KERNEL_IDX, 0);
-        /* effective address */
-        sp -= 4;
-        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
-
-        do_stack_frame(env, &sp, 7, oldsr, 0, env->pc);
+
+        if (m68k_feature(env, M68K_FEATURE_M68040)) {
+            /* push data 3 */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* push data 2 */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* push data 1 */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 1 / push data 0 */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 1 address */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 2 data */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 2 address */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 3 data */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 3 address */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
+            /* fault address */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
+            /* write back 1 status */
+            sp -= 2;
+            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 2 status */
+            sp -= 2;
+            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* write back 3 status */
+            sp -= 2;
+            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
+            /* special status word */
+            sp -= 2;
+            cpu_stw_be_mmuidx_ra(env, sp, env->mmu.ssw, MMU_KERNEL_IDX, 0);
+            /* effective address */
+            sp -= 4;
+            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
+
+            do_stack_frame(env, &sp, 7, oldsr, 0, env->pc);
+        } else {
+            /* M68020 Long Bus Cycle Fault (Format 0xB) */
+            /*
+             * 84 bytes of internal state are pushed before the generic
+             * 8-byte header
+             */
+            sp -= 84;
+            for (int i = 0; i < 84; i += 4) {
+                cpu_stl_be_mmuidx_ra(env, sp + i, 0, MMU_KERNEL_IDX, 0);
+            }
+            /* Offset 0x02 from internal frame: SSW */
+            cpu_stw_be_mmuidx_ra(env, sp + 2, env->mmu.ssw, MMU_KERNEL_IDX, 0);
+            /* Offset 0x08 from internal frame: Fault Address */
+            cpu_stl_be_mmuidx_ra(env, sp + 8, env->mmu.ar, MMU_KERNEL_IDX, 0);
+
+            do_stack_frame(env, &sp, 0xb, oldsr, 0, env->pc);
+        }
         env->mmu.fault = false;
         if (qemu_loglevel_mask(CPU_LOG_INT)) {
             qemu_log("            "
@@ -437,7 +469,9 @@ static void m68k_interrupt_all(CPUM68KState *env, int is_hw)
 
     env->aregs[7] = sp;
     /* Jump to vector.  */
+    env->mmu.fault = true;
     env->pc = cpu_ldl_be_mmuidx_ra(env, env->vbr + vector, MMU_KERNEL_IDX, 0);
+    env->mmu.fault = false;
 
     do_plugin_vcpu_interrupt_cb(cs, last_pc);
 }
@@ -509,26 +543,46 @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
         if (access_type != MMU_DATA_STORE) {
             env->mmu.ssw |= M68K_RW_040;
         }
-
-        env->mmu.ar = addr;
-
-        cs->exception_index = EXCP_ACCESS;
-        cpu_loop_exit(cs);
+    } else if (m68k_feature(env, M68K_FEATURE_M68020)) {
+        /*
+         * M68020 Long Bus Cycle Fault (Format 0xB).
+         * The Motorola 68020 hardware intrinsically generates a physical
+         * Bus Error exception whenever the system bus flags a transaction
+         * timeout or failure (e.g., attempting to read an unpopulated bus
+         * address). This natively injects the EXCP_ACCESS cycle to build
+         * the generic 84-byte exception stack frame.
+         */
+        env->mmu.ssw = 0;
+        if (access_type == MMU_INST_FETCH) {
+            env->mmu.ssw |= 0x1000;
+        } else if (access_type == MMU_DATA_STORE) {
+            env->mmu.ssw |= 0x0040;
+        } else {
+            env->mmu.ssw |= 0x0080;
+        }
+    } else {
+        /*
+         * Older architectures (e.g. 68000) do not currently support
+         * hardware-injected transaction failures in QEMU.
+         */
+        return;
     }
+
+    env->mmu.ar = addr;
+    cs->exception_index = EXCP_ACCESS;
+    cpu_loop_exit(cs);
 }
 
 bool m68k_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     CPUM68KState *env = cpu_env(cs);
 
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && ((env->sr & SR_I) >> SR_I_SHIFT) < env->pending_level) {
-        /*
-         * Real hardware gets the interrupt vector via an IACK cycle
-         * at this point.  Current emulated hardware doesn't rely on
-         * this, so we provide/save the vector when the interrupt is
-         * first signalled.
-         */
+    if (env->nmi_pending) {
+        env->nmi_pending = false;
+        cs->exception_index = env->pending_vector;
+        do_interrupt_m68k_hardirq(env);
+        return true;
+    } else if (((env->sr & SR_I) >> SR_I_SHIFT) < env->pending_level) {
         cs->exception_index = env->pending_vector;
         do_interrupt_m68k_hardirq(env);
         return true;
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index abc1c79f3c..d6fcd6c4d9 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
  *  m68k translation
  *
@@ -163,10 +164,12 @@ static void do_writebacks(DisasContext *s)
 #define IS_USER(s) 1
 #else
 #define IS_USER(s)   (!(s->base.tb->flags & TB_FLAGS_MSR_S))
-#define SFC_INDEX(s) ((s->base.tb->flags & TB_FLAGS_SFC_S) ? \
-                      MMU_KERNEL_IDX : MMU_USER_IDX)
-#define DFC_INDEX(s) ((s->base.tb->flags & TB_FLAGS_DFC_S) ? \
-                      MMU_KERNEL_IDX : MMU_USER_IDX)
+#define SFC_INDEX(s) (MMU_MOVES_FC_BASE + \
+                     (((s)->base.tb->flags & TB_FLAGS_SFC_S) >> \
+                      TB_FLAGS_SFC_S_BIT))
+#define DFC_INDEX(s) (MMU_MOVES_FC_BASE + \
+                     (((s)->base.tb->flags & TB_FLAGS_DFC_S) >> \
+                      TB_FLAGS_DFC_S_BIT))
 #endif
 
 typedef void (*disas_proc)(CPUM68KState *env, DisasContext *s, uint16_t insn);
@@ -5364,11 +5367,19 @@ DISAS_INSN(frestore)
         gen_exception(s, s->base.pc_next, EXCP_PRIVILEGE);
         return;
     }
-    if (m68k_feature(s->env, M68K_FEATURE_M68040)) {
+    if (m68k_feature(s->env, M68K_FEATURE_M68040) ||
+        m68k_feature(s->env, M68K_FEATURE_FPU)) {
         SRC_EA(env, addr, OS_LONG, 0, NULL);
-        /* FIXME: check the state frame */
+        if (m68k_feature(s->env, M68K_FEATURE_M68040)) {
+            /* FIXME: check the state frame */
+        } else {
+            /*
+             * 68881/68882 FRESTORE: read the state frame
+             * (NULL frame is 4 bytes)
+             */
+        }
     } else {
-        disas_undef(env, s, insn);
+        disas_undef_fpu(env, s, insn);
     }
 }
 
@@ -5383,8 +5394,12 @@ DISAS_INSN(fsave)
         /* always write IDLE */
         TCGv idle = tcg_constant_i32(0x41000000);
         DEST_EA(env, insn, OS_LONG, idle, NULL);
+    } else if (m68k_feature(s->env, M68K_FEATURE_FPU)) {
+        /* 68881/68882 FSAVE: always write NULL frame */
+        TCGv null_frame = tcg_constant_i32(0x00000000);
+        DEST_EA(env, insn, OS_LONG, null_frame, NULL);
     } else {
-        disas_undef(env, s, insn);
+        disas_undef_fpu(env, s, insn);
     }
 }
 #endif
-- 
2.50.1 (Apple Git-155)

Re: [PATCH 1/7] target/m68k: Implement Physical Bus Error exception handling

[Thomas Huth]

 Hi!

Thanks for your patches ... some comments inline below...

Am Sat,  2 May 2026 18:57:50 -0700
schrieb 54weasels <54weasels@gmail.com>:

> The M68020 natively maps hardware Bus Error (BERR) timeouts into a Long Bus Cycle Fault (Format 0xB). This commit adds the memory exception routing to natively synthesize these EXCP_ACCESS cycle faults. It also implements the double-fault / watchdog reset behavior required for Sun-3 hardware diagnostics, properly handles FSAVE/FRESTORE for 68881 FPU stubs, and properly constructs the 84-byte internal bus fault frame.
> 
> Signed-off-by: 54weasels <54weasels@gmail.com>
> ---
>  target/m68k/cpu.c       |   5 +-
>  target/m68k/cpu.h       |  18 +++-
>  target/m68k/helper.c    | 130 ++++++++++++++++++++++++++++-
>  target/m68k/op_helper.c | 176 ++++++++++++++++++++++++++--------------
>  target/m68k/translate.c |  31 +++++--
>  5 files changed, 283 insertions(+), 77 deletions(-)
> 
> diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
> index d849a4a90f..af375f0bce 100644
> --- a/target/m68k/cpu.c
> +++ b/target/m68k/cpu.c
> @@ -1,3 +1,4 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */

Looking at the comment at the top of this file, it clearly states that this
file is licensed under the Lesser GPL, so this change is wrong.

>  /*
>   * QEMU Motorola 68k CPU
>   *
> @@ -51,8 +52,8 @@ static TCGTBCPUState m68k_get_tb_cpu_state(CPUState *cs)
>      flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
>      if (env->sr & SR_S) {
>          flags |= TB_FLAGS_MSR_S;
> -        flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) & TB_FLAGS_SFC_S;
> -        flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) & TB_FLAGS_DFC_S;
> +    flags |= (env->sfc << TB_FLAGS_SFC_S_BIT) & TB_FLAGS_SFC_S;
> +    flags |= (env->dfc << TB_FLAGS_DFC_S_BIT) & TB_FLAGS_DFC_S;

Wrong indentation now?

>      }
>      if (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS) {
>          flags |= TB_FLAGS_TRACE;
...
> diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
> index 8148a8852e..84d5270767 100644
> --- a/target/m68k/op_helper.c
> +++ b/target/m68k/op_helper.c
> @@ -1,3 +1,4 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */
>  /*
>   *  M68K helper routines
>   *
> @@ -25,6 +26,7 @@
>  #include "qemu/plugin.h"
>  
>  #if !defined(CONFIG_USER_ONLY)
> +#include "system/runstate.h"
>  
>  static void cf_rte(CPUM68KState *env)
>  {
> @@ -73,6 +75,12 @@ throwaway:
>          case 7:
>              sp += 52;
>              break;
> +        case 0xa: /* Short Bus Cycle Fault (Format 0xA) */
> +            sp += 32 - 8; /* 32 bytes total - 8 bytes header = 24 bytes */
> +            break;
> +        case 0xb: /* Long Bus Cycle Fault (Format 0xB) */
> +            sp += 92 - 8; /* 92 bytes total - 8 bytes header = 84 bytes */
> +            break;
>          }
>      }
>      env->aregs[7] = sp;
> @@ -342,56 +350,80 @@ static void m68k_interrupt_all(CPUM68KState *env, int is_hw)
>      switch (cs->exception_index) {
>      case EXCP_ACCESS:
>          if (env->mmu.fault) {
> -            cpu_abort(cs, "DOUBLE MMU FAULT\n");
> +            qemu_log_mask(LOG_GUEST_ERROR,
> +                          "M68K: Double MMU Fault. Halting CPU and requesting reset.\n");
> +            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
> +            cs->halted = 1;
> +            cs->exception_index = EXCP_HLT;
> +            cpu_loop_exit(cs);
>          }
>          env->mmu.fault = true;
> -        /* push data 3 */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* push data 2 */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* push data 1 */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 1 / push data 0 */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 1 address */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 2 data */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 2 address */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 3 data */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 3 address */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> -        /* fault address */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> -        /* write back 1 status */
> -        sp -= 2;
> -        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 2 status */
> -        sp -= 2;
> -        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* write back 3 status */
> -        sp -= 2;
> -        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> -        /* special status word */
> -        sp -= 2;
> -        cpu_stw_be_mmuidx_ra(env, sp, env->mmu.ssw, MMU_KERNEL_IDX, 0);
> -        /* effective address */
> -        sp -= 4;
> -        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> -
> -        do_stack_frame(env, &sp, 7, oldsr, 0, env->pc);
> +
> +        if (m68k_feature(env, M68K_FEATURE_M68040)) {
> +            /* push data 3 */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* push data 2 */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* push data 1 */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 1 / push data 0 */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 1 address */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 2 data */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 2 address */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 3 data */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 3 address */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> +            /* fault address */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> +            /* write back 1 status */
> +            sp -= 2;
> +            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 2 status */
> +            sp -= 2;
> +            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* write back 3 status */
> +            sp -= 2;
> +            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> +            /* special status word */
> +            sp -= 2;
> +            cpu_stw_be_mmuidx_ra(env, sp, env->mmu.ssw, MMU_KERNEL_IDX, 0);
> +            /* effective address */
> +            sp -= 4;
> +            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> +
> +            do_stack_frame(env, &sp, 7, oldsr, 0, env->pc);
> +        } else {
> +            /* M68020 Long Bus Cycle Fault (Format 0xB) */
> +            /*
> +             * 84 bytes of internal state are pushed before the generic
> +             * 8-byte header
> +             */
> +            sp -= 84;
> +            for (int i = 0; i < 84; i += 4) {
> +                cpu_stl_be_mmuidx_ra(env, sp + i, 0, MMU_KERNEL_IDX, 0);
> +            }
> +            /* Offset 0x02 from internal frame: SSW */
> +            cpu_stw_be_mmuidx_ra(env, sp + 2, env->mmu.ssw, MMU_KERNEL_IDX, 0);
> +            /* Offset 0x08 from internal frame: Fault Address */
> +            cpu_stl_be_mmuidx_ra(env, sp + 8, env->mmu.ar, MMU_KERNEL_IDX, 0);
> +
> +            do_stack_frame(env, &sp, 0xb, oldsr, 0, env->pc);
> +        }

Your patch got quite big already and does multiple things at once ... could
you maybe split independent parts like the above fixup for the stack frame
layout into a separate patch, so that this can get reviewed more easily?

> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
> index abc1c79f3c..d6fcd6c4d9 100644
> --- a/target/m68k/translate.c
> +++ b/target/m68k/translate.c
> @@ -1,3 +1,4 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */

This file is also LPGL, not GPL.

 Thomas

Re: [PATCH 1/7] target/m68k: Implement Physical Bus Error exception handling

[Purr Box]

[-- Attachment #1: Type: text/plain, Size: 9782 bytes --]

Thanks for the feedback, I'll perform the clean-ups and start splitting
some stuff up. If you have more suggestions for how it'll be easiest to
cut, let me know.
I'll resubmit a new patch and reference this one asap.

Thanks again,
Dan.

On Sat, May 9, 2026 at 10:40 PM Thomas Huth <th.huth+qemu@posteo.eu> wrote:

>
>  Hi!
>
> Thanks for your patches ... some comments inline below...
>
> Am Sat,  2 May 2026 18:57:50 -0700
> schrieb 54weasels <54weasels@gmail.com>:
>
> > The M68020 natively maps hardware Bus Error (BERR) timeouts into a Long
> Bus Cycle Fault (Format 0xB). This commit adds the memory exception routing
> to natively synthesize these EXCP_ACCESS cycle faults. It also implements
> the double-fault / watchdog reset behavior required for Sun-3 hardware
> diagnostics, properly handles FSAVE/FRESTORE for 68881 FPU stubs, and
> properly constructs the 84-byte internal bus fault frame.
> >
> > Signed-off-by: 54weasels <54weasels@gmail.com>
> > ---
> >  target/m68k/cpu.c       |   5 +-
> >  target/m68k/cpu.h       |  18 +++-
> >  target/m68k/helper.c    | 130 ++++++++++++++++++++++++++++-
> >  target/m68k/op_helper.c | 176 ++++++++++++++++++++++++++--------------
> >  target/m68k/translate.c |  31 +++++--
> >  5 files changed, 283 insertions(+), 77 deletions(-)
> >
> > diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
> > index d849a4a90f..af375f0bce 100644
> > --- a/target/m68k/cpu.c
> > +++ b/target/m68k/cpu.c
> > @@ -1,3 +1,4 @@
> > +/* SPDX-License-Identifier: GPL-2.0-or-later */
>
> Looking at the comment at the top of this file, it clearly states that this
> file is licensed under the Lesser GPL, so this change is wrong.
>
> >  /*
> >   * QEMU Motorola 68k CPU
> >   *
> > @@ -51,8 +52,8 @@ static TCGTBCPUState m68k_get_tb_cpu_state(CPUState
> *cs)
> >      flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
> >      if (env->sr & SR_S) {
> >          flags |= TB_FLAGS_MSR_S;
> > -        flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) &
> TB_FLAGS_SFC_S;
> > -        flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) &
> TB_FLAGS_DFC_S;
> > +    flags |= (env->sfc << TB_FLAGS_SFC_S_BIT) & TB_FLAGS_SFC_S;
> > +    flags |= (env->dfc << TB_FLAGS_DFC_S_BIT) & TB_FLAGS_DFC_S;
>
> Wrong indentation now?
>
> >      }
> >      if (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS) {
> >          flags |= TB_FLAGS_TRACE;
> ...
> > diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
> > index 8148a8852e..84d5270767 100644
> > --- a/target/m68k/op_helper.c
> > +++ b/target/m68k/op_helper.c
> > @@ -1,3 +1,4 @@
> > +/* SPDX-License-Identifier: GPL-2.0-or-later */
> >  /*
> >   *  M68K helper routines
> >   *
> > @@ -25,6 +26,7 @@
> >  #include "qemu/plugin.h"
> >
> >  #if !defined(CONFIG_USER_ONLY)
> > +#include "system/runstate.h"
> >
> >  static void cf_rte(CPUM68KState *env)
> >  {
> > @@ -73,6 +75,12 @@ throwaway:
> >          case 7:
> >              sp += 52;
> >              break;
> > +        case 0xa: /* Short Bus Cycle Fault (Format 0xA) */
> > +            sp += 32 - 8; /* 32 bytes total - 8 bytes header = 24 bytes
> */
> > +            break;
> > +        case 0xb: /* Long Bus Cycle Fault (Format 0xB) */
> > +            sp += 92 - 8; /* 92 bytes total - 8 bytes header = 84 bytes
> */
> > +            break;
> >          }
> >      }
> >      env->aregs[7] = sp;
> > @@ -342,56 +350,80 @@ static void m68k_interrupt_all(CPUM68KState *env,
> int is_hw)
> >      switch (cs->exception_index) {
> >      case EXCP_ACCESS:
> >          if (env->mmu.fault) {
> > -            cpu_abort(cs, "DOUBLE MMU FAULT\n");
> > +            qemu_log_mask(LOG_GUEST_ERROR,
> > +                          "M68K: Double MMU Fault. Halting CPU and
> requesting reset.\n");
> > +            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
> > +            cs->halted = 1;
> > +            cs->exception_index = EXCP_HLT;
> > +            cpu_loop_exit(cs);
> >          }
> >          env->mmu.fault = true;
> > -        /* push data 3 */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* push data 2 */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* push data 1 */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 1 / push data 0 */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 1 address */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 2 data */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 2 address */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 3 data */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 3 address */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> > -        /* fault address */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> > -        /* write back 1 status */
> > -        sp -= 2;
> > -        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 2 status */
> > -        sp -= 2;
> > -        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* write back 3 status */
> > -        sp -= 2;
> > -        cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > -        /* special status word */
> > -        sp -= 2;
> > -        cpu_stw_be_mmuidx_ra(env, sp, env->mmu.ssw, MMU_KERNEL_IDX, 0);
> > -        /* effective address */
> > -        sp -= 4;
> > -        cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX, 0);
> > -
> > -        do_stack_frame(env, &sp, 7, oldsr, 0, env->pc);
> > +
> > +        if (m68k_feature(env, M68K_FEATURE_M68040)) {
> > +            /* push data 3 */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* push data 2 */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* push data 1 */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 1 / push data 0 */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 1 address */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 2 data */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 2 address */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 3 data */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 3 address */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX,
> 0);
> > +            /* fault address */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX,
> 0);
> > +            /* write back 1 status */
> > +            sp -= 2;
> > +            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 2 status */
> > +            sp -= 2;
> > +            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* write back 3 status */
> > +            sp -= 2;
> > +            cpu_stw_be_mmuidx_ra(env, sp, 0, MMU_KERNEL_IDX, 0);
> > +            /* special status word */
> > +            sp -= 2;
> > +            cpu_stw_be_mmuidx_ra(env, sp, env->mmu.ssw, MMU_KERNEL_IDX,
> 0);
> > +            /* effective address */
> > +            sp -= 4;
> > +            cpu_stl_be_mmuidx_ra(env, sp, env->mmu.ar, MMU_KERNEL_IDX,
> 0);
> > +
> > +            do_stack_frame(env, &sp, 7, oldsr, 0, env->pc);
> > +        } else {
> > +            /* M68020 Long Bus Cycle Fault (Format 0xB) */
> > +            /*
> > +             * 84 bytes of internal state are pushed before the generic
> > +             * 8-byte header
> > +             */
> > +            sp -= 84;
> > +            for (int i = 0; i < 84; i += 4) {
> > +                cpu_stl_be_mmuidx_ra(env, sp + i, 0, MMU_KERNEL_IDX, 0);
> > +            }
> > +            /* Offset 0x02 from internal frame: SSW */
> > +            cpu_stw_be_mmuidx_ra(env, sp + 2, env->mmu.ssw,
> MMU_KERNEL_IDX, 0);
> > +            /* Offset 0x08 from internal frame: Fault Address */
> > +            cpu_stl_be_mmuidx_ra(env, sp + 8, env->mmu.ar,
> MMU_KERNEL_IDX, 0);
> > +
> > +            do_stack_frame(env, &sp, 0xb, oldsr, 0, env->pc);
> > +        }
>
> Your patch got quite big already and does multiple things at once ... could
> you maybe split independent parts like the above fixup for the stack frame
> layout into a separate patch, so that this can get reviewed more easily?
>
> > diff --git a/target/m68k/translate.c b/target/m68k/translate.c
> > index abc1c79f3c..d6fcd6c4d9 100644
> > --- a/target/m68k/translate.c
> > +++ b/target/m68k/translate.c
> > @@ -1,3 +1,4 @@
> > +/* SPDX-License-Identifier: GPL-2.0-or-later */
>
> This file is also LPGL, not GPL.
>
>  Thomas
>

[-- Attachment #2: Type: text/html, Size: 12618 bytes --]

[PATCH 2/7] hw/net/lance: Add Sun-3 Native DMA byte-swapping support

[54weasels]

The Sun-3 hardware physically byte-swaps the D0-D7 and D8-D15 DMA lanes between the Little-Endian LANCE controller and the Big-Endian Sun-3 memory. This commit intercepts the LANCE DMA reads/writes by injecting a phys_mem override in pcnet.c specifically for the Sun-3 instance, dynamically neutralizing the hardcoded internal initblk swap and properly mapping the payload payloads.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 hw/net/lance.c         | 111 ++++++++++++++++++++++++++++++++++++++---
 hw/net/meson.build     |   3 +-
 include/hw/net/lance.h |   3 ++
 3 files changed, 109 insertions(+), 8 deletions(-)

diff --git a/hw/net/lance.c b/hw/net/lance.c
index 5d5bf9b961..93944fb35d 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
  * QEMU AMD PC-Net II (Am79C970A) emulation
  *
@@ -22,7 +23,8 @@
  * THE SOFTWARE.
  */
 
-/* This software was written to be compatible with the specification:
+/*
+ * This software was written to be compatible with the specification:
  * AMD Am79C970A PCnet-PCI II Ethernet Controller Data-Sheet
  * AMD Publication# 19436  Rev:E  Amendment/0  Issue Date: June 2000
  */
@@ -44,8 +46,73 @@
 #include "hw/core/qdev-properties.h"
 #include "trace.h"
 #include "system/system.h"
+#include "system/address-spaces.h"
+#include "system/dma.h"
+
+/*
+ * LANCE Native DMA Read Hook
+ *
+ * Sun-3 Hardware intrinsically byte-swaps the D0-D7 and D8-D15 DMA lanes
+ * between the Little-Endian LANCE controller and the Big-Endian Sun-3 memory.
+ * We MUST model this manually. pcnet.c passes CSR_BSWP(s) for payloads
+ * (correctly bypassing the swap if LANCE internally neutralizes it).
+ * However, pcnet.c hardcodes do_bswap=1 for the `initblk` structure
+ * (len 24/28).
+ * We dynamically intercept the `initblk` fetch by cross-referencing CSR_IADR to
+ * enforce the hardware swap reliably. Because this branch is only taken when
+ * `dma_mr` is explicitly provided by the machine, this quirk is safely isolated
+ * to the Sun-3 and does not impact SPARC (which uses `ledma`).
+ */
+static void lance_dma_read(void *dma_opaque, hwaddr addr,
+                           uint8_t *buf, int len, int do_bswap)
+{
+    SysBusPCNetState *d = SYSBUS_PCNET(dma_opaque);
+    PCNetState *s = &d->state;
+
+    dma_memory_read(&d->dma_as, addr, buf, len, MEMTXATTRS_UNSPECIFIED);
+
+    uint32_t bcr_ssize32 = (s->bcr[20] & 0x0100);
+    hwaddr iadr = (s->csr[1] | ((uint32_t)s->csr[2] << 16));
+    if (!bcr_ssize32) {
+        iadr |= ((0xff00 & (uint32_t)s->csr[2]) << 16);
+    }
 
+    int internal_bswap = do_bswap;
+    if (addr == iadr && (len == 24 || len == 28)) {
+        internal_bswap = 0; /* Force hardware swap natively for initblk */
+    }
 
+    if (!internal_bswap) {
+        for (int i = 0; i < (len & ~1); i += 2) {
+            uint8_t tmp = buf[i];
+            buf[i] = buf[i + 1];
+            buf[i + 1] = tmp;
+        }
+    }
+}
+
+/* LANCE Native DMA Write Hook */
+static void lance_dma_write(void *dma_opaque, hwaddr addr,
+                            uint8_t *buf, int len, int do_bswap)
+{
+    SysBusPCNetState *s = SYSBUS_PCNET(dma_opaque);
+
+    if (!do_bswap) {
+        uint8_t *swapped_buf = g_malloc(len);
+        for (int i = 0; i < (len & ~1); i += 2) {
+            swapped_buf[i] = buf[i + 1];
+            swapped_buf[i + 1] = buf[i];
+        }
+        if (len & 1) {
+            swapped_buf[len - 1] = buf[len - 1];
+        }
+        dma_memory_write(&s->dma_as, addr, swapped_buf, len,
+                         MEMTXATTRS_UNSPECIFIED);
+        g_free(swapped_buf);
+    } else {
+        dma_memory_write(&s->dma_as, addr, buf, len, MEMTXATTRS_UNSPECIFIED);
+    }
+}
 static void parent_lance_reset(void *opaque, int irq, int level)
 {
     SysBusPCNetState *d = opaque;
@@ -59,7 +126,15 @@ static void lance_mem_write(void *opaque, hwaddr addr,
     SysBusPCNetState *d = opaque;
 
     trace_lance_mem_writew(addr, val & 0xffff);
-    pcnet_ioport_writew(&d->state, addr, val & 0xffff);
+    if (size == 1) {
+        uint16_t orig = pcnet_ioport_readw(&d->state, addr & ~1);
+        if (addr & 1) { /* LSB in Big Endian */
+            val = (orig & 0xff00) | (val & 0xff);
+        } else { /* MSB in Big Endian */
+            val = (orig & 0x00ff) | ((val & 0xff) << 8);
+        }
+    }
+    pcnet_ioport_writew(&d->state, addr & ~1, val & 0xffff);
 }
 
 static uint64_t lance_mem_read(void *opaque, hwaddr addr,
@@ -68,18 +143,28 @@ static uint64_t lance_mem_read(void *opaque, hwaddr addr,
     SysBusPCNetState *d = opaque;
     uint32_t val;
 
-    val = pcnet_ioport_readw(&d->state, addr);
-    trace_lance_mem_readw(addr, val & 0xffff);
+    val = pcnet_ioport_readw(&d->state, addr & ~1);
+    if (size == 1) {
+        if (addr & 1) {
+            val = val & 0xff;
+        } else {
+            val = (val >> 8) & 0xff;
+        }
+    }
     return val & 0xffff;
 }
 
 static const MemoryRegionOps lance_mem_ops = {
     .read = lance_mem_read,
     .write = lance_mem_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_BIG_ENDIAN,
     .valid = {
-        .min_access_size = 2,
-        .max_access_size = 2,
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 4,
     },
 };
 
@@ -115,8 +200,18 @@ static void lance_realize(DeviceState *dev, Error **errp)
 
     sysbus_init_irq(sbd, &s->irq);
 
+    if (d->dma_mr) {
+        address_space_init(&d->dma_as, d->dma_mr, "lance-dma");
+        s->phys_mem_read = lance_dma_read;
+        s->phys_mem_write = lance_dma_write;
+        s->dma_opaque = DEVICE(d);
+    } else {
+#if defined(TARGET_SPARC)
     s->phys_mem_read = ledma_memory_read;
     s->phys_mem_write = ledma_memory_write;
+#endif
+    }
+
     pcnet_common_init(dev, s, &net_lance_info);
 }
 
@@ -140,6 +235,8 @@ static void lance_instance_init(Object *obj)
 static const Property lance_properties[] = {
     DEFINE_PROP_LINK("dma", SysBusPCNetState, state.dma_opaque,
                      TYPE_DEVICE, DeviceState *),
+    DEFINE_PROP_LINK("dma_mr", SysBusPCNetState, dma_mr,
+                     TYPE_MEMORY_REGION, MemoryRegion *),
     DEFINE_NIC_PROPERTIES(SysBusPCNetState, state.conf),
 };
 
diff --git a/hw/net/meson.build b/hw/net/meson.build
index 3102587469..e653a9bc73 100644
--- a/hw/net/meson.build
+++ b/hw/net/meson.build
@@ -31,7 +31,8 @@ system_ss.add(when: 'CONFIG_MARVELL_88W8618', if_true: files('mv88w8618_eth.c'))
 
 system_ss.add(when: 'CONFIG_CADENCE', if_true: files('cadence_gem.c'))
 system_ss.add(when: 'CONFIG_STELLARIS_ENET', if_true: files('stellaris_enet.c'))
-system_ss.add(when: 'CONFIG_LANCE', if_true: files('lance.c'))
+# LANCE uses target-specific memory types (e.g., target_ulong) and must be compiled per-target.
+specific_ss.add(when: 'CONFIG_LANCE', if_true: files('lance.c'))
 system_ss.add(when: 'CONFIG_LASI_82596', if_true: files('lasi_i82596.c'))
 system_ss.add(when: 'CONFIG_I82596_COMMON', if_true: files('i82596.c'))
 system_ss.add(when: 'CONFIG_SUNHME', if_true: files('sunhme.c'))
diff --git a/include/hw/net/lance.h b/include/hw/net/lance.h
index be473e2eed..706160d7eb 100644
--- a/include/hw/net/lance.h
+++ b/include/hw/net/lance.h
@@ -31,6 +31,7 @@
 
 #include "net/net.h"
 #include "hw/net/pcnet.h"
+#include "system/memory.h"
 #include "hw/core/sysbus.h"
 #include "qom/object.h"
 
@@ -43,6 +44,8 @@ struct SysBusPCNetState {
     SysBusDevice parent_obj;
 
     PCNetState state;
+    MemoryRegion *dma_mr;
+    AddressSpace dma_as;
 };
 
 #endif
-- 
2.50.1 (Apple Git-155)

[PATCH 3/7] hw/char/escc: Expose diagnostic RS232 I/O routing

[54weasels]

This adds proper initialization and routing hooks for the ESCC serial controller to support the specific diagnostic RS232 UART mappings expected by the Sun-3 Boot PROM.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 hw/char/escc.c         | 33 ++++++++++++++++++++++++---------
 include/hw/char/escc.h |  3 +++
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/hw/char/escc.c b/hw/char/escc.c
index 3b46818ecc..d870806a35 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -313,7 +313,8 @@ static void escc_soft_reset_chn(ESCCChannelState *s)
 
     s->rregs[R_STATUS] &= STATUS_DCD | STATUS_SYNC | STATUS_CTS | STATUS_BRK;
     s->rregs[R_STATUS] |= STATUS_TXEMPTY | STATUS_TXUNDRN;
-    if (s->disabled) {
+    if (s->disabled || s->parent->force_hw_ready) {
+        /* Force assert to satisfy Sun-3 PROM Flow Control */
         s->rregs[R_STATUS] |= STATUS_DCD | STATUS_SYNC | STATUS_CTS;
     }
     s->rregs[R_SPEC] &= SPEC_ALLSENT;
@@ -653,7 +654,8 @@ static void escc_mem_write(void *opaque, hwaddr addr,
         s->txint = 0;
         escc_update_irq(s);
         s->tx = val;
-        if (s->wregs[W_TXCTRL2] & TXCTRL2_TXEN) { /* tx enabled */
+        if (s->parent->force_hw_ready || (s->wregs[W_TXCTRL2] & TXCTRL2_TXEN)) {
+            /* tx consistently forced enabled for Sun-3 boot PROM hooks */
             if (s->wregs[W_MISC2] & MISC2_LCL_LOOP) {
                 serial_receive_byte(s, s->tx);
             } else if (qemu_chr_fe_backend_connected(&s->chr)) {
@@ -691,6 +693,12 @@ static uint64_t escc_mem_read(void *opaque, hwaddr addr,
     case SERIAL_CTRL:
         trace_escc_mem_readb_ctrl(CHN_C(s), s->reg, s->rregs[s->reg]);
         ret = s->rregs[s->reg];
+        if (s->reg == R_STATUS) {
+            if (serial->force_hw_ready) {
+                ret |= STATUS_DCD | STATUS_SYNC | STATUS_CTS;
+                /* Force Flow Control PINs */
+            }
+        }
         s->reg = 0;
         return ret;
     case SERIAL_DATA:
@@ -715,6 +723,10 @@ static const MemoryRegionOps escc_mem_ops = {
     .write = escc_mem_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+    .impl = {
         .min_access_size = 1,
         .max_access_size = 1,
     },
@@ -1067,16 +1079,17 @@ static void escc_realize(DeviceState *dev, Error **errp)
     s->chn[0].disabled = s->disabled;
     s->chn[1].disabled = s->disabled;
 
+    uint32_t escc_size = s->mmio_size ? s->mmio_size :\
+                         (ESCC_SIZE << s->it_shift);
     memory_region_init_io(&s->mmio, OBJECT(dev), &escc_mem_ops, s, "escc",
-                          ESCC_SIZE << s->it_shift);
+                        escc_size);
 
     for (i = 0; i < 2; i++) {
-        if (qemu_chr_fe_backend_connected(&s->chn[i].chr)) {
-            s->chn[i].clock = s->frequency / 2;
-            qemu_chr_fe_set_handlers(&s->chn[i].chr, serial_can_receive,
-                                     serial_receive1, serial_event, NULL,
-                                     &s->chn[i], NULL, true);
-        }
+        s->chn[i].parent = s;
+        s->chn[i].clock = s->frequency / 2;
+        qemu_chr_fe_set_handlers(&s->chn[i].chr, serial_can_receive,
+                                 serial_receive1, serial_event, NULL,
+                                 &s->chn[i], NULL, true);
     }
 
     if (s->chn[0].type == escc_mouse) {
@@ -1093,7 +1106,9 @@ static const Property escc_properties[] = {
     DEFINE_PROP_UINT32("frequency", ESCCState, frequency,   0),
     DEFINE_PROP_UINT32("it_shift",  ESCCState, it_shift,    0),
     DEFINE_PROP_BOOL("bit_swap",    ESCCState, bit_swap,    false),
+    DEFINE_PROP_BOOL("force-hw-ready", ESCCState, force_hw_ready, false),
     DEFINE_PROP_UINT32("disabled",  ESCCState, disabled,    0),
+    DEFINE_PROP_UINT32("mmio_size", ESCCState, mmio_size,   0),
     DEFINE_PROP_UINT32("chnBtype",  ESCCState, chn[0].type, 0),
     DEFINE_PROP_UINT32("chnAtype",  ESCCState, chn[1].type, 0),
     DEFINE_PROP_CHR("chrB", ESCCState, chn[0].chr),
diff --git a/include/hw/char/escc.h b/include/hw/char/escc.h
index 9e60175b77..db4700d8e4 100644
--- a/include/hw/char/escc.h
+++ b/include/hw/char/escc.h
@@ -49,6 +49,7 @@ typedef struct ESCCChannelState {
     int sunmouse_dx;
     int sunmouse_dy;
     int sunmouse_buttons;
+    ESCCState *parent;
 } ESCCChannelState;
 
 struct ESCCState {
@@ -57,9 +58,11 @@ struct ESCCState {
     struct ESCCChannelState chn[2];
     uint32_t it_shift;
     bool bit_swap;
+    bool force_hw_ready;
     MemoryRegion mmio;
     uint32_t disabled;
     uint32_t frequency;
+    uint32_t mmio_size;
 };
 
 #endif
-- 
2.50.1 (Apple Git-155)

[PATCH 4/7] hw/timer: Introduce Intersil 7170 RTC implementation

[54weasels]

This adds the Intersil 7170 Time-of-Day clock / CMOS RAM chip. It implements the register map, alarm interrupt logic, and persistent 32-byte battery-backed NVRAM used by the Sun-3 architecture for storing the MAC address, EEPROM checksums, and boot parameters.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 hw/timer/Kconfig                |   3 +
 hw/timer/intersil7170.c         | 216 ++++++++++++++++++++++++++++++++
 hw/timer/meson.build            |   1 +
 include/hw/timer/intersil7170.h |   9 ++
 4 files changed, 229 insertions(+)
 create mode 100644 hw/timer/intersil7170.c
 create mode 100644 include/hw/timer/intersil7170.h

diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig
index b3d823ce2c..a828273b6c 100644
--- a/hw/timer/Kconfig
+++ b/hw/timer/Kconfig
@@ -65,3 +65,6 @@ config STELLARIS_GPTM
 
 config AVR_TIMER16
     bool
+
+config INTERSIL7170
+    bool
diff --git a/hw/timer/intersil7170.c b/hw/timer/intersil7170.c
new file mode 100644
index 0000000000..138151fdc1
--- /dev/null
+++ b/hw/timer/intersil7170.c
@@ -0,0 +1,216 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU Intersil 7170 Real Time Clock and Timer Emulation
+ *
+ * This device mimics the core functionality of the Intersil 7170 RTC,
+ * specifically targeting the 1/100th second periodic interrupt requested
+ * by the Sun-3 Boot PROM diagnostic routines.
+ */
+
+#include "qemu/osdep.h"
+
+#include "hw/timer/intersil7170.h"
+#include "hw/core/irq.h"
+#include "hw/core/qdev.h"
+#include "hw/core/sysbus.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/timer.h"
+#include "qom/object.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(Intersil7170State, INTERSIL_7170)
+
+struct Intersil7170State {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    qemu_irq irq;
+    QEMUTimer *timer;
+
+    /* Registers */
+    uint8_t int_status; /* 0x10 */
+    uint8_t int_mask;
+    uint8_t command; /* 0x11 */
+};
+
+#define REG_INT 0x10
+#define REG_CMD 0x11
+
+/* Interrupt Register bits */
+#define RTC_INT_PENDING 0x80
+#define RTC_INT_DAY 0x40
+#define RTC_INT_HOUR 0x20
+#define RTC_INT_MIN 0x10
+#define RTC_INT_SEC 0x08
+#define RTC_INT_TSEC 0x04
+#define RTC_INT_HSEC 0x02
+#define RTC_INT_ALARM 0x01
+
+/* Command Register bits */
+#define RTC_CMD_INTENA 0x10
+#define RTC_CMD_RUN 0x08
+
+static void intersil7170_update_irq(Intersil7170State *s)
+{
+    bool level = (s->int_status & s->int_mask) && (s->command & RTC_CMD_INTENA);
+
+    if (level) {
+        s->int_status |= RTC_INT_PENDING;
+    } else {
+        s->int_status &= ~RTC_INT_PENDING;
+    }
+
+    qemu_set_irq(s->irq, level);
+}
+
+static void intersil7170_timer_cb(void *opaque)
+{
+    Intersil7170State *s = opaque;
+
+    if (!(s->command & RTC_CMD_RUN)) {
+        return;
+    }
+
+    /*
+     * Timer fired. Set pending bit based on what is unmasked.
+     * The Sun-3 PROM primarily demands the Hundredth-Second
+     * (RTC_INT_HSEC) tick.
+     */
+    if (s->int_mask & RTC_INT_HSEC) {
+        s->int_status |= RTC_INT_HSEC;
+        intersil7170_update_irq(s);
+
+        /* Reschedule for 1/100th of a second (10,000,000 ns) */
+        timer_mod(s->timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 10000000);
+    }
+}
+
+static uint64_t intersil7170_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Intersil7170State *s = opaque;
+    uint32_t val = 0;
+
+    switch (addr) {
+    case REG_INT:
+        val = s->int_status;
+        /*
+         * Reading the interrupt register formally clears all
+         * pending interrupts.
+         */
+        s->int_status = 0;
+        intersil7170_update_irq(s);
+        break;
+    case REG_CMD:
+        val = s->command;
+        break;
+    default:
+        val = 0;
+        break;
+    }
+
+    return val;
+}
+
+static void intersil7170_write(void *opaque, hwaddr addr, uint64_t val,
+                               unsigned size)
+{
+    Intersil7170State *s = opaque;
+
+    switch (addr) {
+    case REG_INT:
+        /*
+         * Writing to the INT register sets the mask!
+         * Pending flag is read-only.
+         */
+        s->int_mask = val & ~RTC_INT_PENDING;
+        intersil7170_update_irq(s);
+
+        /* If timer requires starting, schedule immediately */
+        if ((s->command & RTC_CMD_RUN) && (s->int_mask & RTC_INT_HSEC)) {
+            timer_mod(s->timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 10000000);
+        }
+        break;
+    case REG_CMD:
+        s->command = val;
+        intersil7170_update_irq(s);
+
+        if ((s->command & RTC_CMD_RUN) && (s->int_mask & RTC_INT_HSEC)) {
+            timer_mod(s->timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 10000000);
+        } else if (!(s->command & RTC_CMD_RUN)) {
+            timer_del(s->timer);
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+static const MemoryRegionOps intersil7170_ops = {
+    .read = intersil7170_read,
+    .write = intersil7170_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+            .unaligned = true,
+        },
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+            .unaligned = true,
+        },
+};
+
+static void intersil7170_realize(DeviceState *dev, Error **errp)
+{
+    Intersil7170State *s = INTERSIL_7170(OBJECT(dev));
+
+    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, intersil7170_timer_cb, s);
+}
+
+static void intersil7170_reset(DeviceState *dev)
+{
+    Intersil7170State *s = INTERSIL_7170(OBJECT(dev));
+
+    s->int_status = 0;
+    s->int_mask = 0;
+    s->command = 0;
+    timer_del(s->timer);
+}
+
+static void intersil7170_init(Object *obj)
+{
+    Intersil7170State *s = INTERSIL_7170(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &intersil7170_ops, s, "intersil7170",
+                        8192);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static void intersil7170_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = intersil7170_realize;
+    device_class_set_legacy_reset(dc, intersil7170_reset);
+}
+
+static const TypeInfo intersil7170_info = {
+    .name = TYPE_INTERSIL_7170,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Intersil7170State),
+    .instance_init = intersil7170_init,
+    .class_init = intersil7170_class_init,
+};
+
+static void intersil7170_register_types(void)
+{
+    type_register_static(&intersil7170_info);
+}
+
+type_init(intersil7170_register_types)
diff --git a/hw/timer/meson.build b/hw/timer/meson.build
index 178321c029..72f33ec31f 100644
--- a/hw/timer/meson.build
+++ b/hw/timer/meson.build
@@ -15,6 +15,7 @@ system_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210_pwm.c'))
 system_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_gptimer.c'))
 system_ss.add(when: 'CONFIG_HPET_C', if_true: files('hpet.c'))
 system_ss.add(when: 'CONFIG_I8254', if_true: files('i8254_common.c', 'i8254.c'))
+system_ss.add(when: 'CONFIG_INTERSIL7170', if_true: files('intersil7170.c'))
 system_ss.add(when: 'CONFIG_IMX', if_true: files('imx_epit.c'))
 system_ss.add(when: 'CONFIG_IMX', if_true: files('imx_gpt.c'))
 system_ss.add(when: 'CONFIG_MIPS_CPS', if_true: files('mips_gictimer.c'))
diff --git a/include/hw/timer/intersil7170.h b/include/hw/timer/intersil7170.h
new file mode 100644
index 0000000000..cab42b4cc0
--- /dev/null
+++ b/include/hw/timer/intersil7170.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef HW_TIMER_INTERSIL7170_H
+#define HW_TIMER_INTERSIL7170_H
+
+#define TYPE_INTERSIL_7170 "intersil7170"
+
+typedef struct Intersil7170State Intersil7170State;
+
+#endif
-- 
2.50.1 (Apple Git-155)

[PATCH 5/7] hw/m68k: Overhaul Sun-3 MMU and Boot PROM mapping

[54weasels]

This heavily refactors the Sun-3 machine initialization to support its proprietary Custom MMU implementation, which replaces the standard Motorola 68851 MMU. It maps the diagnostic EEPROM, sets the correct 28-bit address bus masks, implements the OBIO aliasing rules for the Boot PROM, and connects the newly added LANCE, ESCC, and Intersil 7170 peripherals.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 hw/m68k/Kconfig            |   8 +
 hw/m68k/meson.build        |   1 +
 hw/m68k/sun3.c             | 499 ++++++++++++++++++++++++++
 hw/m68k/sun3_eeprom_data.h | 259 ++++++++++++++
 hw/m68k/sun3mmu.c          | 705 +++++++++++++++++++++++++++++++++++++
 include/hw/m68k/sun3mmu.h  |  65 ++++
 6 files changed, 1537 insertions(+)
 create mode 100644 hw/m68k/sun3.c
 create mode 100644 hw/m68k/sun3_eeprom_data.h
 create mode 100644 hw/m68k/sun3mmu.c
 create mode 100644 include/hw/m68k/sun3mmu.h

diff --git a/hw/m68k/Kconfig b/hw/m68k/Kconfig
index aff769b30f..59b36c75ee 100644
--- a/hw/m68k/Kconfig
+++ b/hw/m68k/Kconfig
@@ -46,3 +46,11 @@ config M68K_VIRT
     select GOLDFISH_TTY
     select GOLDFISH_RTC
     select VIRTIO_MMIO
+
+config SUN3
+    bool
+    default y
+    depends on M68K
+    select ESCC
+    select LANCE
+    select INTERSIL7170
diff --git a/hw/m68k/meson.build b/hw/m68k/meson.build
index 84bc68fa4e..c8b07d81fb 100644
--- a/hw/m68k/meson.build
+++ b/hw/m68k/meson.build
@@ -3,6 +3,7 @@ m68k_ss.add(when: 'CONFIG_AN5206', if_true: files('an5206.c', 'mcf5206.c'))
 m68k_ss.add(when: 'CONFIG_MCF5208', if_true: files('mcf5208.c', 'mcf_intc.c'))
 m68k_ss.add(when: 'CONFIG_NEXTCUBE', if_true: files('next-kbd.c', 'next-cube.c'))
 m68k_ss.add(when: 'CONFIG_Q800', if_true: files('q800.c', 'q800-glue.c'))
+m68k_ss.add(when: 'CONFIG_SUN3', if_true: files('sun3.c', 'sun3mmu.c'))
 m68k_ss.add(when: 'CONFIG_M68K_VIRT', if_true: files('virt.c'))
 
 hw_arch += {'m68k': m68k_ss}
diff --git a/hw/m68k/sun3.c b/hw/m68k/sun3.c
new file mode 100644
index 0000000000..16ad8b063d
--- /dev/null
+++ b/hw/m68k/sun3.c
@@ -0,0 +1,499 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU Sun-3 Board Emulation
+ *
+ * Copyright (c) 2026
+ */
+
+#include "qemu/osdep.h"
+
+#include "chardev/char.h"
+#include "hw/char/escc.h"
+#include "hw/core/boards.h"
+#include "hw/core/irq.h"
+#include "hw/core/loader.h"
+#include "hw/core/qdev-properties.h"
+#include "hw/core/sysbus.h"
+#include "hw/net/lance.h"
+#include "hw/intc/m68k_irqc.h"
+#include "hw/m68k/sun3mmu.h"
+#include "hw/timer/intersil7170.h"
+#include "qapi/error.h"
+#include "system/qtest.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qemu/units.h"
+#include "sun3_eeprom_data.h"
+#include "system/address-spaces.h"
+#include "system/reset.h"
+#include "system/system.h"
+#include "target/m68k/cpu.h"
+#include "qom/object.h"
+
+#define SUN3_PROM_BASE 0x0FEF0000
+#define SUN3_PROM_SIZE (64 * 1024)
+
+#define TYPE_SUN3_MACHINE MACHINE_TYPE_NAME("sun3")
+OBJECT_DECLARE_SIMPLE_TYPE(Sun3MachineState, SUN3_MACHINE)
+
+struct Sun3MachineState {
+    MachineState parent_obj;
+
+    /* Embedded Memory Regions */
+    MemoryRegion rom;
+    MemoryRegion rom_alias;
+    MemoryRegion idprom;
+    MemoryRegion intreg_iomem;
+    MemoryRegion memerr_iomem;
+    MemoryRegion eeprom;
+    MemoryRegion nvram;
+    MemoryRegion timeout_net;
+
+    /* Devices */
+    DeviceState *irqc_dev;
+    DeviceState *sun3mmu;
+
+    /* Boot State */
+    uint32_t boot_sp;
+    uint32_t boot_pc;
+
+    /* Interrupt Register State */
+    uint8_t intreg;
+    bool clock_pending;
+
+    /* Memory Error Register (Parity Spoof) State */
+    uint8_t memerr_reg;
+    uint8_t spoof_parity_lane;
+    uint8_t parity_bit_counter;
+    bool test_parity_written;
+};
+
+static void sun3_update_clock_irq(Sun3MachineState *s)
+{
+    if (!s->irqc_dev) {
+        return;
+    }
+
+    /* Lower everything first */
+    qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_5));
+    qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));
+
+    /* Assert the currently enabled level if the clock is pulsing */
+    if (s->clock_pending && (s->intreg & 0x01)) {
+        if (s->intreg & 0x20) {
+            qemu_irq_raise(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_5));
+        } else if (s->intreg & 0x80) {
+            qemu_irq_raise(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));
+        }
+    }
+}
+
+static void sun3_clock_irq_handler(void *opaque, int n, int level)
+{
+    Sun3MachineState *s = SUN3_MACHINE(opaque);
+    s->clock_pending = !!level;
+    sun3_update_clock_irq(s);
+}
+
+static uint64_t sun3_intreg_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Sun3MachineState *s = SUN3_MACHINE(opaque);
+    return s->intreg;
+}
+
+static void sun3_intreg_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned size)
+{
+    Sun3MachineState *s = SUN3_MACHINE(opaque);
+    s->intreg = val;
+
+    qemu_log_mask(
+        LOG_GUEST_ERROR,
+        "[SUN3 INTREG] Write: 0x%02x (Enable=%d, L1=%d, L2=%d, L3=%d)\n",
+        (uint8_t)val, !!(val & 0x01), !!(val & 0x02), !!(val & 0x04),
+        !!(val & 0x08));
+
+    if ((val & 0x01) == 0) {
+        /* Master Interrupt Enable is CLEAR. Mask everything! */
+        qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_1), 0);
+        qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_2), 0);
+        qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_3), 0);
+        sun3_update_clock_irq(s);
+        return;
+    }
+
+    /* Master Enable is SET. Fire the Soft Interrupts! */
+    qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_1),
+                 !!(val & 0x02));
+    qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_2),
+                 !!(val & 0x04));
+    qemu_set_irq(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_3),
+                 !!(val & 0x08));
+
+    /*
+     * Retrigger clock IRQs because the Master Enable or Local Enables might
+     * have changed
+     */
+    sun3_update_clock_irq(s);
+}
+
+static const MemoryRegionOps sun3_intreg_ops = {.read = sun3_intreg_read,
+                                                .write = sun3_intreg_write,
+                                                .endianness =
+                                                    DEVICE_BIG_ENDIAN,
+                                                .valid = {
+                                                    .min_access_size = 1,
+                                                    .max_access_size = 4,
+                                                } };
+
+static uint64_t sun3_memerr_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Sun3MachineState *s = SUN3_MACHINE(opaque);
+    return s->memerr_reg;
+}
+
+static void sun3_memerr_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned size)
+{
+    Sun3MachineState *s = SUN3_MACHINE(opaque);
+
+    if (addr == 4) {
+        s->memerr_reg &= ~0x80;
+        if (s->irqc_dev) {
+            qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));
+        }
+        return;
+    }
+
+    s->memerr_reg = val & 0xFF;
+    if (val == 0x20) {
+        s->test_parity_written = true;
+    } else if (val == 0) {
+        s->test_parity_written = false;
+    }
+
+    if (s->irqc_dev) {
+        if ((val & 0x10) && (val & 0x40) && s->test_parity_written) {
+            s->memerr_reg |=
+                0x80 | s->spoof_parity_lane; /* active & spoofed bit lane */
+            s->parity_bit_counter++;
+            if (s->parity_bit_counter == 8) {
+                s->parity_bit_counter = 0;
+                s->spoof_parity_lane >>= 1;
+                if (s->spoof_parity_lane == 0) {
+                    s->spoof_parity_lane = 8;
+                }
+            }
+
+            qemu_irq_raise(qdev_get_gpio_in(
+                s->irqc_dev, M68K_IRQC_LEVEL_7)); /* M68K_IRQC_LEVEL_7 */
+        } else {
+            s->memerr_reg &= ~0x80;
+            qemu_irq_lower(qdev_get_gpio_in(s->irqc_dev, M68K_IRQC_LEVEL_7));
+        }
+    }
+}
+
+static const MemoryRegionOps sun3_memerr_ops = {
+    .read = sun3_memerr_read,
+    .write = sun3_memerr_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+            .unaligned = true,
+        },
+    .impl = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+            .unaligned = true,
+        },
+};
+
+static MemTxResult sun3_timeout_read_with_attrs(void *opaque, hwaddr addr,
+                                                uint64_t *data, unsigned size,
+                                                MemTxAttrs attrs)
+{
+    Sun3MMUState *mmu = SUN3_MMU(opaque);
+    mmu->buserr_reg |= 0x20; /* Timeout */
+    return MEMTX_ERROR;
+}
+
+static MemTxResult sun3_timeout_write_with_attrs(void *opaque, hwaddr addr,
+                                                 uint64_t val, unsigned size,
+                                                 MemTxAttrs attrs)
+{
+    Sun3MMUState *mmu = SUN3_MMU(opaque);
+    mmu->buserr_reg |= 0x20; /* Timeout */
+    return MEMTX_ERROR;
+}
+
+static const MemoryRegionOps sun3_timeout_ops = {
+    .read_with_attrs = sun3_timeout_read_with_attrs,
+    .write_with_attrs = sun3_timeout_write_with_attrs,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
+static void sun3_cpu_reset(void *opaque)
+{
+    M68kCPU *cpu = opaque;
+    CPUState *cs = CPU(cpu);
+    CPUM68KState *env = cpu_env(cs);
+    Sun3MachineState *s = SUN3_MACHINE(current_machine);
+
+    /*
+     * Execute generic QEMU system reset (wipes everything to 0).
+     * This includes setting env->pc = 0 and env->aregs[7] = 0.
+     */
+    cpu_reset(cs);
+
+    /*
+     * Forcefully inject the Boot PROM SP/PC vectors on EVERY reset.
+     * The Sun-3 hardware uses a temporary MMU override to map the PROM to
+     * 0x00000000 during the first few cycles of reset. Since QEMU does not
+     * emulate this specific micro-architectural quirk, we must manually
+     * restore the vectors here to prevent the CPU from executing uninitialized
+     * RAM at 0x00000000 and getting stuck in a zero-pitch orib loop.
+     */
+    env->aregs[7] = s->boot_sp;
+    env->sp[0] = s->boot_sp; /* M68K_SSP (Master) */
+    env->sp[1] = s->boot_sp; /* M68K_USP (User) */
+    env->sp[2] = s->boot_sp; /* M68K_ISP (Interrupt) */
+    env->pc = s->boot_pc;
+}
+
+static void sun3_init(MachineState *machine)
+{
+    Sun3MachineState *s_mach = SUN3_MACHINE(machine);
+    M68kCPU *cpu;
+    CPUM68KState *env;
+    DeviceState *sun3mmu;
+    DeviceState *dev;
+    DeviceState *irqc_dev;
+    SysBusDevice *s;
+
+    /* Initialize defaults */
+    s_mach->memerr_reg = 0x40;
+    s_mach->spoof_parity_lane = 8;
+    s_mach->parity_bit_counter = 0;
+    s_mach->test_parity_written = false;
+    s_mach->intreg = 0;
+    s_mach->clock_pending = false;
+
+    /* Initialize the CPU. The Sun 3/60 uses a 68020. */
+    cpu = M68K_CPU(cpu_create(machine->cpu_type));
+    env = &cpu->env;
+    qemu_register_reset(sun3_cpu_reset, cpu);
+
+    /* Use automatically allocated main RAM */
+    memory_region_add_subregion(get_system_memory(), 0x00000000, machine->ram);
+
+    /* Allocate and map ROM as writable RAM! */
+    memory_region_init_ram(&s_mach->rom, NULL, "sun3.prom",
+                           SUN3_PROM_SIZE, &error_fatal);
+    memory_region_set_readonly(&s_mach->rom, false);
+    memory_region_add_subregion(get_system_memory(), SUN3_PROM_BASE,
+                                &s_mach->rom);
+
+    memory_region_init_alias(&s_mach->rom_alias, NULL, "sun3.prom.alias",
+                             &s_mach->rom, 0,
+                             SUN3_PROM_SIZE);
+    memory_region_add_subregion(get_system_memory(), 0x0FF00000,
+                                &s_mach->rom_alias);
+
+    const char *bios_name = machine->firmware ?: "sun3.prom";
+    if (bios_name) {
+        int load_size = load_image_targphys(bios_name, SUN3_PROM_BASE,
+                                            SUN3_PROM_SIZE,
+                             qtest_enabled() ? NULL : &error_fatal);
+        if (load_size < 0) {
+            if (!qtest_enabled()) {
+                error_report("sun3: could not load prom '%s'", bios_name);
+                exit(1);
+            }
+        }
+        error_report("Sun3 Init: Loaded %d bytes from '%s' at 0x%08x",
+                     load_size,
+                     bios_name, SUN3_PROM_BASE);
+
+        /* Initial PC is always at offset 4 in firmware binaries */
+        uint8_t *ptr = rom_ptr(SUN3_PROM_BASE, 8);
+        if (ptr) {
+            s_mach->boot_sp = ldl_be_p(ptr);
+            s_mach->boot_pc = ldl_be_p(ptr + 4);
+            error_report("Sun3 Init: Saved Firmware Vectors "
+                         "SP=0x%08x PC=0x%08x",
+                         s_mach->boot_sp, s_mach->boot_pc);
+        }
+    } else {
+        error_report(
+            "Sun3 Init: No firmware specified! Use -bios or -machine firmware=");
+    }
+
+    /* Set up the custom Sun-3 MMU */
+    sun3mmu = qdev_new(TYPE_SUN3_MMU);
+    s_mach->sun3mmu = sun3mmu;
+    s = SYS_BUS_DEVICE(sun3mmu);
+    sysbus_realize_and_unref(s, &error_fatal);
+
+    /* Intercept CPU memory translations with our custom MMU hook */
+    env->custom_mmu_opaque = sun3mmu;
+    env->custom_mmu_get_physical_address = sun3mmu_get_physical_address;
+
+    sysbus_mmio_map(s, 0, 0x80000000); /* Context Register */
+    sysbus_mmio_map(s, 1, 0x90000000); /* Segment Map */
+    sysbus_mmio_map(s, 2, 0xA0000000); /* Page Map */
+    sysbus_mmio_map(s, 3, 0xB0000000); /* Control / System Enable */
+    sysbus_mmio_map(s, 4, 0xC0000000); /* Bus Error Register */
+
+    memory_region_init_ram(&s_mach->idprom, NULL, "sun3.idprom", 8192,
+                           &error_fatal);
+    memory_region_add_subregion(get_system_memory(), 0x08000000,
+                                &s_mach->idprom);
+
+    uint8_t idprom_data[32] = {
+        0x01,                               /* Format: 1 */
+        0x17,                               /* Machine Type: Sun-3/60 (0x17) */
+        0x08, 0x00, 0x20, 0x00, 0x00, 0x01, /* MAC Address */
+        0x00, 0x00, 0x00, 0x00,             /* Date */
+        0x00, 0x00, 0x01,                   /* Serial */
+        0x00                                /* Checksum */
+    };
+    uint8_t chksum = 0;
+    for (int i = 0; i < 15; i++) {
+        chksum ^= idprom_data[i];
+    }
+    idprom_data[15] = chksum;
+
+    rom_add_blob_fixed("sun3.idprom_content", idprom_data, sizeof(idprom_data),
+                       0x08000000);
+
+    /*
+     * Set up the Interrupt Controller (IRQC) to route IRQs to
+     * CPU autovectors
+     */
+    irqc_dev = qdev_new(TYPE_M68K_IRQC);
+    object_property_set_link(OBJECT(irqc_dev), "m68k-cpu", OBJECT(cpu),
+                             &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(irqc_dev), &error_fatal);
+    s_mach->irqc_dev = irqc_dev;
+
+    dev = qdev_new(TYPE_INTERSIL_7170);
+    s = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(s, &error_fatal);
+    sysbus_mmio_map(s, 0, 0x0FE60000);
+    sysbus_connect_irq(s, 0,
+                       qemu_allocate_irq(sun3_clock_irq_handler, s_mach, 0));
+
+    dev = qdev_new(TYPE_ESCC);
+    qdev_prop_set_bit(dev, "force-hw-ready", true);
+    qdev_prop_set_uint32(dev, "disabled", 0);
+    qdev_prop_set_uint32(dev, "frequency", 4915200); /* 4.9152 MHz */
+    qdev_prop_set_uint32(dev, "it_shift", 1);
+    qdev_prop_set_bit(dev, "bit_swap", false); /* Control/Data interleaving */
+    qdev_prop_set_uint32(dev, "mmio_size", 8192);
+    qdev_prop_set_chr(dev, "chrB", serial_hd(0)); /* Keyboard/Mouse A */
+    qdev_prop_set_chr(dev, "chrA", serial_hd(1)); /* Keyboard/Mouse B */
+    qdev_prop_set_uint32(dev, "chnBtype", escc_serial);
+    qdev_prop_set_uint32(dev, "chnAtype", escc_serial);
+    s = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(s, &error_fatal);
+    sysbus_mmio_map(s, 0, 0x0FE00000);
+    sysbus_connect_irq(s, 0,
+                       qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));
+    /* IPL 6 */
+    sysbus_connect_irq(s, 1,
+                       qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));
+    /* IPL 6 */
+
+    dev = qdev_new(TYPE_ESCC);
+    qdev_prop_set_bit(dev, "force-hw-ready", true);
+    qdev_prop_set_uint32(dev, "disabled", 0);
+    qdev_prop_set_uint32(dev, "frequency", 4915200); /* 4.9152 MHz */
+    qdev_prop_set_uint32(dev, "it_shift", 1);
+    qdev_prop_set_bit(dev, "bit_swap", false); /* Control/Data interleaving */
+    qdev_prop_set_uint32(dev, "mmio_size", 8192);
+    qdev_prop_set_chr(dev, "chrB", serial_hd(2)); /* Serial B */
+    qdev_prop_set_chr(dev, "chrA", serial_hd(3)); /* Serial A */
+    qdev_prop_set_uint32(dev, "chnBtype", escc_serial);
+    qdev_prop_set_uint32(dev, "chnAtype", escc_serial);
+    s = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(s, &error_fatal);
+    sysbus_mmio_map(s, 0, 0x0FE20000);
+    sysbus_connect_irq(s, 0,
+                       qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));
+    /* IPL 6 */
+    sysbus_connect_irq(s, 1,
+                       qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_6));
+    /* IPL 6 */
+
+    memory_region_init_io(&s_mach->intreg_iomem, NULL, &sun3_intreg_ops, s_mach,
+                          "sun3.intreg", 8192);
+    memory_region_add_subregion(get_system_memory(), 0x0FEA0000,
+                                &s_mach->intreg_iomem);
+
+    memory_region_init_io(&s_mach->memerr_iomem, NULL, &sun3_memerr_ops, s_mach,
+                          "sun3.memerr", 32);
+    memory_region_add_subregion(get_system_memory(), 0x0FE80000,
+                                &s_mach->memerr_iomem);
+
+    dev = qdev_new("lance");
+    qemu_configure_nic_device(dev, true, NULL);
+    object_property_set_link(OBJECT(dev), "dma_mr",
+                             OBJECT(&SUN3_MMU(sun3mmu)->dvma_iommu),
+                             &error_abort);
+    s = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(s, &error_fatal);
+    sysbus_mmio_map(s, 0, 0x0FF20000);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(irqc_dev, M68K_IRQC_LEVEL_3));
+
+    memory_region_init_ram(&s_mach->eeprom, NULL, "sun3.eeprom", 2048,
+                           &error_fatal);
+    memory_region_add_subregion(get_system_memory(), 0x0FE40000,
+                                &s_mach->eeprom);
+    memcpy(memory_region_get_ram_ptr(&s_mach->eeprom), sun3_eeprom_blob,
+           sizeof(sun3_eeprom_blob));
+
+    memory_region_init_ram(&s_mach->nvram, NULL, "sun3.nvram", 8192,
+                           &error_fatal);
+    memory_region_add_subregion(get_system_memory(), 0x0FE50000,
+                                &s_mach->nvram);
+
+    memory_region_init_io(&s_mach->timeout_net, NULL, &sun3_timeout_ops,
+                          sun3mmu,
+                          "sun3.timeout", 0x06000000);
+    memory_region_add_subregion_overlap(get_system_memory(), 0x0A000000,
+                                        &s_mach->timeout_net, -10);
+}
+
+static void sun3_machine_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Sun-3 (3/60)";
+    mc->init = sun3_init;
+    mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68020");
+    /* Minimum of 4MB for a 3/60, typical maximum ~24MB */
+    mc->default_ram_size = 4 * MiB;
+    mc->default_ram_id = "sun3.ram";
+
+    mc->ignore_memory_transaction_failures = false;
+}
+
+static const TypeInfo sun3_machine_type = {
+    .name = TYPE_SUN3_MACHINE,
+    .parent = TYPE_MACHINE,
+    .class_init = sun3_machine_class_init,
+    .instance_size = sizeof(Sun3MachineState),
+};
+
+static void sun3_machine_register_types(void)
+{
+    type_register_static(&sun3_machine_type);
+}
+
+type_init(sun3_machine_register_types)
diff --git a/hw/m68k/sun3_eeprom_data.h b/hw/m68k/sun3_eeprom_data.h
new file mode 100644
index 0000000000..fbe3a84d6d
--- /dev/null
+++ b/hw/m68k/sun3_eeprom_data.h
@@ -0,0 +1,259 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+static const uint8_t sun3_eeprom_blob[2048] = {
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x3c,
+    0x00, 0x3c, 0x00, 0x00, 0xc4, 0xc4, 0xc4, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00,
+    0x12, 0x73, 0x64, 0x00, 0x08, 0x00, 0x03, 0x12,
+    0x12, 0x00, 0x73, 0x64, 0x00, 0x08, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x57, 0x65, 0x6c, 0x63, 0x6f, 0x6d, 0x65, 0x20,
+    0x74, 0x6f, 0x20, 0x53, 0x2f, 0x57, 0x20, 0x77,
+    0x6f, 0x72, 0x6b, 0x73, 0x74, 0x61, 0x74, 0x69,
+    0x6f, 0x6e, 0x20, 0x4c, 0x4d, 0x53, 0x32, 0x20,
+    0x21, 0x21, 0x21, 0x21, 0x21, 0x21, 0x21, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x0d, 0x0a, 0x0a, 0x0a,
+    0x00, 0x00, 0x00, 0x00, 0x01, 0x04, 0x01, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x0c, 0x03, 0x01, 0x01,
+    0x02, 0x01, 0x02, 0x03, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0xf0, 0xf0, 0xf0, 0xf0, 0xf0, 0xf0, 0xf0, 0xf0,
+    0xf0, 0xf0, 0xf0, 0xf0, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0,
+};
diff --git a/hw/m68k/sun3mmu.c b/hw/m68k/sun3mmu.c
new file mode 100644
index 0000000000..a0192b5677
--- /dev/null
+++ b/hw/m68k/sun3mmu.c
@@ -0,0 +1,705 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU Sun-3 MMU Model
+ *
+ * Copyright (c) 2026
+ */
+#include "qemu/osdep.h"
+
+#include "exec/cputlb.h"
+#include "hw/core/boards.h"
+#include "hw/core/qdev-properties.h"
+#include "hw/core/sysbus.h"
+#include "hw/m68k/sun3mmu.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "system/runstate.h"
+#include "target/m68k/cpu.h"
+#include "system/address-spaces.h"
+
+#define SUN3_MMU_CONTEXT(addr) ((addr >> 28) & 0x7)
+
+static uint64_t sun3_mmu_context_read(void *opaque, hwaddr addr,
+                                      unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    return s->context_reg;
+}
+
+static void sun3_mmu_context_write(void *opaque, hwaddr addr, uint64_t val,
+                                   unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    s->context_reg = val & 0x7;
+    tlb_flush(CPU(first_cpu));
+}
+
+static const MemoryRegionOps sun3_mmu_context_ops = {
+    .read = sun3_mmu_context_read,
+    .write = sun3_mmu_context_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+};
+
+static uint64_t sun3_mmu_segment_read(void *opaque, hwaddr addr,
+                                      unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);
+    /*
+     * The Segment Map index is determined by bits 17..27 of the virtual address
+     */
+    uint16_t seg_index = (addr >> 17) & 0x7FF;
+    uint32_t index = (ctx << 11) | seg_index;
+    return s->segment_map[index];
+}
+
+static void sun3_mmu_segment_write(void *opaque, hwaddr addr, uint64_t val,
+                                   unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);
+    /*
+     * The Segment Map index is determined by bits 17..27 of the virtual address
+     */
+    uint16_t seg_index = (addr >> 17) & 0x7FF;
+    s->segment_map[(ctx * SUN3_MMU_SEGMENTS_PER_CONTEXT) + seg_index] =
+        val & 0xFF;
+    tlb_flush(CPU(first_cpu));
+}
+
+static const MemoryRegionOps sun3_mmu_segment_ops = {
+    .read = sun3_mmu_segment_read,
+    .write = sun3_mmu_segment_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+};
+
+static uint64_t sun3_mmu_page_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);
+
+    /*
+     * The Page Map address offset contains the virtual segment AND page
+     * index.
+     */
+    uint16_t vtr_seg = (addr >> 17) & 0x7FF;
+    uint16_t vtr_page = (addr >> 13) & 0xF;
+    uint32_t pmeg = s->segment_map[(ctx << 11) | vtr_seg];
+    uint32_t index = (pmeg << 4) | vtr_page;
+    return s->page_map[index];
+}
+
+static void sun3_mmu_page_write(void *opaque, hwaddr addr, uint64_t val,
+                                unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    uint32_t ctx = s->context_reg & (SUN3_MMU_CONTEXTS - 1);
+
+    uint16_t vtr_seg = (addr >> 17) & 0x7FF;
+    uint16_t vtr_page = (addr >> 13) & 0xF;
+    uint32_t pmeg = s->segment_map[(ctx << 11) | vtr_seg];
+    uint32_t index = (pmeg << 4) | vtr_page;
+
+    if (size == 4) {
+        s->page_map[index] = val;
+    } else if (size == 2) {
+        uint32_t shift = (addr & 2) ? 0 : 16;
+        s->page_map[index] = (s->page_map[index] & ~(0xFFFF << shift)) |
+                             ((val & 0xFFFF) << shift);
+    } else if (size == 1) {
+        uint32_t shift = (3 - (addr & 3)) * 8;
+        s->page_map[index] = (s->page_map[index] & ~(0xFF << shift)) |
+                             ((val & 0xFF) << shift);
+    }
+
+    tlb_flush(CPU(first_cpu));
+}
+
+static const MemoryRegionOps sun3_mmu_page_ops = {
+    .read = sun3_mmu_page_read,
+    .write = sun3_mmu_page_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+            .min_access_size = 4,
+            .max_access_size = 4,
+        },
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+};
+
+static uint64_t sun3_mmu_control_read(void *opaque, hwaddr addr,
+                                      unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    /* The region covers multiple 32-bit mapped registers now */
+    if (addr == 0x0) {
+        /*
+         * The hardware diagnostic switch on the Sun-3 CPU board is checked
+         * here. Setting bit 0 to 1 forces the extended memory test.
+         */
+        return s->enable_reg | 0x01;
+    }
+
+    /* Diagnostic LEDs */
+    if (addr == 0x30000000) {
+        return 0xFF; /* Typically inverted, 0xFF means all off */
+    }
+
+    qemu_log_mask(LOG_UNIMP,
+                  "sun3_mmu_control_read at offset 0x%" HWADDR_PRIx
+                  " (size=%u)\n",
+                  addr, size);
+    return 0;
+}
+
+static uint64_t sun3_mmu_buserr_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+
+    uint8_t ret = s->buserr_reg;
+    s->buserr_reg = 0; /* Hardware clears on read */
+
+    return ret;
+}
+
+static void sun3_mmu_buserr_write(void *opaque, hwaddr addr, uint64_t val,
+                                  unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    s->buserr_reg = 0;
+}
+
+static const MemoryRegionOps sun3_mmu_buserr_ops = {
+    .read = sun3_mmu_buserr_read,
+    .write = sun3_mmu_buserr_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+};
+
+static void sun3_mmu_control_write(void *opaque, hwaddr addr, uint64_t val,
+                                   unsigned size)
+{
+    Sun3MMUState *s = SUN3_MMU(opaque);
+    if (addr == 0x0) {
+        /* System Enable Register at 0x40000000 */
+        uint8_t enable_old = s->enable_reg;
+        s->enable_reg = (enable_old & 0x01) | (val & 0xFE);
+
+        tlb_flush(CPU(first_cpu));
+        return;
+    }
+
+    if (addr == 0x30000000) {
+        /* Otherwise Diagnostic LEDs (e.g. 0xFF to clear) */
+        return;
+    }
+
+    qemu_log_mask(LOG_UNIMP,
+                  "sun3_mmu_control_write at offset 0x%" HWADDR_PRIx
+                  "\n", addr);
+}
+
+static const MemoryRegionOps sun3_mmu_control_ops = {
+    .read = sun3_mmu_control_read,
+    .write = sun3_mmu_control_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+            .min_access_size = 1,
+            .max_access_size = 4,
+        },
+};
+
+static void sun3_mmu_reset(DeviceState *dev)
+{
+    Sun3MMUState *s = SUN3_MMU(dev);
+
+    s->context_reg = 0;
+
+    /*
+     * On a Cold Boot, the Bus Error Register MUST be 0x00.
+     * Bit 0 is NOT a Watchdog flag that must be 1. In fact, if the register
+     * reads
+     * non-zero, the PROM assumes it is returning from a Watchdog/Bus Error
+     * Panic and attempts to dump CPU state to memory (moveml) before the
+     * MMU is initialized, causing a Double Fault.
+     */
+    s->buserr_reg = 0x00;
+
+    /*
+     * CRITICAL: Do NOT wipe the Segment Map or Page Map!
+       The Sun-3 Boot PROM relies on the physical MMU SRAM persisting across
+     * Watchdog Resets so it can trace and push exception vectors back
+     * into mapped physical RAM!
+     */
+}
+
+static void sun3_mmu_init(Object *obj)
+{
+    Sun3MMUState *s = SUN3_MMU(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    /* Context Map */
+    /*
+     * Note: Control space regions decode the top nibble of a 32-bit address.
+       The PROM uses the raw virtual address as the offset when accessing
+       these regions, so they must handle sparsely distributed addresses up to
+       256MB.
+    */
+    memory_region_init_io(&s->context_mem, obj, &sun3_mmu_context_ops, s,
+                          "sun3-mmu-context", 0x10000000);
+    sysbus_init_mmio(sbd, &s->context_mem);
+
+    /* Segment Map */
+    memory_region_init_io(&s->segment_mem, obj, &sun3_mmu_segment_ops, s,
+                          "sun3-mmu-segment", 0x10000000);
+    sysbus_init_mmio(sbd, &s->segment_mem);
+
+    /* Page Map */
+    memory_region_init_io(&s->page_mem, obj, &sun3_mmu_page_ops, s,
+                          "sun3-mmu-page", 0x10000000);
+    sysbus_init_mmio(sbd, &s->page_mem);
+
+    /* Other control bits (Enable Register, Diagnostic LEDs) */
+    memory_region_init_io(&s->control_mem, obj, &sun3_mmu_control_ops, s,
+                          "sun3-mmu-control", 0x40000000);
+    sysbus_init_mmio(sbd, &s->control_mem);
+
+    /*
+     * Bus Error Register dedicated mapping
+     */
+    memory_region_init_io(&s->buserr_mem, obj, &sun3_mmu_buserr_ops, s,
+                          "sun3-mmu-buserr", 1);
+    sysbus_init_mmio(sbd, &s->buserr_mem);
+
+    /* DVMA IOMMU interception region */
+    memory_region_init_iommu(&s->dvma_iommu, sizeof(s->dvma_iommu),
+                             TYPE_SUN3_DVMA_IOMMU_MEMORY_REGION,
+                             obj, "sun3-dvma", 0x1000000);
+}
+
+static void sun3_mmu_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    device_class_set_legacy_reset(dc, sun3_mmu_reset);
+    dc->vmsd = NULL; /* TODO: Add migration state later */
+}
+
+static IOMMUTLBEntry sun3_dvma_translate(IOMMUMemoryRegion *iommu, hwaddr addr,
+                                         IOMMUAccessFlags flag, int iommu_idx)
+{
+    Sun3MMUState *s = container_of(iommu, Sun3MMUState, dvma_iommu);
+    CPUState *cs = first_cpu;
+    CPUM68KState *env = cs ? cpu_env(cs) : NULL;
+
+    IOMMUTLBEntry ret = {
+        .target_as = &address_space_memory,
+        .iova = addr,
+        .translated_addr = 0,
+        .addr_mask = ~(hwaddr)0,
+        .perm = IOMMU_NONE,
+    };
+
+    if (!env) {
+        return ret;
+    }
+
+    hwaddr physical;
+    int prot;
+    hwaddr page_size;
+    /*
+     * Lance DVMA translates 24-bit requests implicitly onto the top 16MB of
+     * the 28-bit virtual Bus (0x0Fxxxxxx) tied rigidly to Context 0.
+     */
+    uint32_t vaddr = addr + 0x0F000000;
+
+    int access_type = ACCESS_DATA | ACCESS_SUPER | (5 << 8);
+    if (flag == IOMMU_WO || flag == IOMMU_RW) {
+        access_type |= ACCESS_STORE;
+    }
+
+    uint8_t old_ctx = s->context_reg;
+    s->context_reg = 0; /* Hardware forces Context 0 during DVMA */
+
+    if (sun3mmu_get_physical_address(env, &physical, &prot, vaddr,
+                                     access_type, &page_size) == 0) {
+        ret.translated_addr = physical & ~(page_size - 1);
+        ret.addr_mask = page_size - 1;
+        if (prot & PAGE_WRITE) {
+            ret.perm = IOMMU_RW;
+        } else if (prot & PAGE_READ) {
+            ret.perm = IOMMU_RO;
+        }
+    }
+    s->context_reg = old_ctx; /* Restore pre-DVMA context */
+    return ret;
+}
+
+static void sun3_dvma_iommu_memory_region_class_init(ObjectClass *klass,
+                                                     const void *data)
+{
+    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+    imrc->translate = sun3_dvma_translate;
+}
+
+static const TypeInfo sun3_dvma_iommu_memory_region_info = {
+    .name = TYPE_SUN3_DVMA_IOMMU_MEMORY_REGION,
+    .parent = TYPE_IOMMU_MEMORY_REGION,
+    .class_init = sun3_dvma_iommu_memory_region_class_init,
+};
+
+static const TypeInfo sun3_mmu_info = {
+    .name = TYPE_SUN3_MMU,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Sun3MMUState),
+    .instance_init = sun3_mmu_init,
+    .class_init = sun3_mmu_class_init,
+};
+
+static void sun3_mmu_register_types(void)
+{
+    type_register_static(&sun3_mmu_info);
+    type_register_static(&sun3_dvma_iommu_memory_region_info);
+}
+
+type_init(sun3_mmu_register_types)
+
+static bool is_valid_sun3_phys(hwaddr p, ram_addr_t ram_size)
+{
+    if (p < ram_size) {
+        return true;
+    }
+    if (p >= 0x0FE50000 && p <= 0x0FE7FFFF) {
+        return true; /* NVRAM and OBIO RAM */
+    }
+    if (p >= 0x08000000 && p <= 0x08001FFF) {
+        return true; /* IDPROM */
+    }
+    if (p >= 0x0FEF0000 && p <= 0x0FEFFFFF) {
+        return true; /* PROM */
+    }
+    if (p >= 0x0FF00000 && p <= 0x0FF0FFFF) {
+        return true; /* PROM Alias */
+    }
+
+    /* Specific OBIO devices for Sun-3/60 (Ferrari) */
+    if (p >= 0x0FE00000 && p <= 0x0FE00007) {
+        return true; /* ZS1 (Kbd/Mouse) */
+    }
+    if (p >= 0x0FE20000 && p <= 0x0FE20007) {
+        return true; /* ZS0 (Serial) */
+    }
+    if (p >= 0x0FE40000 && p <= 0x0FE407FF) {
+        return true; /* EEPROM */
+    }
+    if (p >= 0x0FF20000 && p <= 0x0FF201FF) {
+        return true; /* LANCE Am7990 */
+    }
+    if (p >= 0x0FE60000 && p <= 0x0FE6003F) {
+        return true; /* Timer */
+    }
+    if (p >= 0x0FE80000 && p <= 0x0FE8001F) {
+        return true; /* Memerr */
+    }
+    if (p >= 0x0FEA0000 && p <= 0x0FEA0003) {
+        return true; /* Intreg */
+    }
+
+    return false;
+}
+
+int sun3mmu_get_physical_address(void *env, hwaddr *physical, int *prot,
+                                 vaddr address, int access_type,
+                                 hwaddr *page_size)
+{
+    /*
+     * Translate the virtual address using the Sun-3 MMU maps.
+     */
+    CPUM68KState *m68k_env = env;
+    Sun3MMUState *s = SUN3_MMU(m68k_env->custom_mmu_opaque);
+
+    uint8_t context;
+    uint16_t pmeg = 0;
+    uint32_t pte;
+    uint32_t pte_index = 0;
+    uint32_t pte_offset = 0;
+    uint32_t phys_addr;
+
+    /*
+     * access_type from m68k TCG:
+       ACCESS_CODE (0x10), ACCESS_DATA (0x20)
+        * ACCESS_SUPER (0x01) *
+        */
+    bool is_write = access_type & ACCESS_STORE;
+    bool is_supervisor = access_type & ACCESS_SUPER;
+
+    *page_size = TARGET_PAGE_SIZE;
+
+    /*
+     * QEMU Pipeline Prefetch Workaround:
+     * The Sun-3 PROM executes `movesb %d0, 0x40000000` out of ROM (0x0FEFxxxx)
+     * to enable the MMU (`enable_reg |= 0x80`). On real M68020 hardware, the
+     * subsequent instruction(s) have already been prefetched while the MMU
+     * was off. QEMU attempts to fetch the next sequential instruction
+     * synchronously with the MMU fully active. Because the PROM has not mapped
+     * 0x0FEF0000 in the Page Table (it only maps Virtual 0x00000000 to
+     * the ROM),
+     * QEMU triggers an immediate Translation Fault Exception Loop! We must
+     * manually bless instruction fetches originating mechanically from the
+     * physical ROM space to emulate the prefetch cache. *
+     */
+    if ((access_type & ACCESS_CODE) &&
+        (address >= 0x0FEF0000 && address <= 0x0FEFFFFF)) {
+        *physical = address;
+        *prot = PAGE_READ | PAGE_EXEC;
+        return 0;
+    }
+
+    /*
+     * Boot Mode PROM Bypass:
+       If the Not-Boot bit (0x80) in the Enable Register is clear (System is in
+       Boot State): ONLY Instruction Fetches bypass the MMU mapping mechanism!
+       Data accesses and Stack Pushes (such as the Exception Frame push to
+       0x0FEEFFFE) proceed through the MMU mapped tables normally because the
+        * PROM sets up its stack logically! *
+        */
+
+
+
+    qemu_log_mask(CPU_LOG_MMU,
+                  "[SUN3MMU] get_physical_address(0x%08" VADDR_PRIx
+                  ") enable_reg=0x%02x\n",
+                  address, s->enable_reg);
+
+    /*
+     * Sun-3 Hardware Architectural Demultiplexer:
+     * The M68020 emulator now seamlessly passes the Source/Destination Function
+     * Code inside the top 8 bits of the `access_type` bitmask, directly
+     * supplied
+     * via an isolation index in the QEMU TCG pipeline. This mirrors
+     * how the physical M68K processor provides 3 explicit FC pins in
+     * addition to
+     * the 32-bit physical address bus!
+     *
+     * If the extracted FC equals 3 (Control Space / Hardware Registers), it
+     * NEVER enters the MMU Segment Map. It is universally 1:1 mapped to
+     * physical memory for raw HW device configuration (0x60000000, 0x10000000)!
+     */
+    uint8_t true_fc = (access_type >> 8) & 0x07;
+    if (true_fc == 3) {
+        /*
+         * Direct Physical Bypass Mapping to discrete SysBus devices.
+         * The top nibble of the virtual address selects the Control Space
+         * target. All lower bits are aliases.
+         */
+        uint32_t device_base = address & 0x70000000;
+
+        if (device_base == 0x00000000) {
+            /*
+             * IDPROM is logically at 0x0 and occupies 32 bytes in hardware. We
+             * shift it to 0x08000000 linearly in QEMU and force a 5-bit wrap
+             * so it safely avoids physical Main RAM/ROM collisions! *
+             */
+            *physical = 0x08000000 | (address & 0x1F);
+        } else {
+            switch (device_base) {
+            case 0x10000000: /* Page Map */
+                /*
+                 * Hardware Page Map physically contains 256 PMEGs *
+                 * 16 PTEs * 4 bytes = 16,384 bytes
+                 */
+                *physical = 0xA0000000 | (address & 0x0FFFFFFF);
+                break;
+            case 0x20000000: /* Segment Map */
+                /*
+                 * Hardware Segment Map structurally is 8 Contexts *
+                 * 2048 segments * 1 byte = 16,384 bytes
+                 */
+                *physical = 0x90000000 | (address & 0x0FFFFFFF);
+                break;
+            case 0x30000000: /* Context Register */
+                /*
+                 * Context register physically uniquely masks natively
+                 * strictly functionally inside hardware
+                 */
+                *physical = 0x80000000 | (address & 0x07);
+                break;
+            case 0x40000000: /* System Enable */
+                *physical = 0xB0000000 | (address & 0x0FFFFFFF);
+                break;
+            case 0x60000000: /* Bus Error Register */
+                *physical = 0xC0000000 | (address & 0x0FFFFFFF);
+                break;
+            case 0x70000000:
+                /* Diagnostic Register (Aliases into Enable mem region) */
+                *physical = 0xB0000000ULL + 0x30000000ULL +
+                            (address & 0x0FFFFFFF);
+                break;
+            default:
+                s->buserr_reg |= 0x20; /* Timeout */
+                return 1;
+            }
+      }
+
+      *prot = PAGE_READ | PAGE_WRITE;
+      *page_size = SUN3_PAGE_SIZE;
+
+      qemu_log_mask(
+          CPU_LOG_MMU,
+          "[SUN3MMU] TRUE FC=3 CONTROL SPACE DECODE: vaddr=0x%08" VADDR_PRIx
+          " mapped directly to physical 0x%08x\n",
+          address, (unsigned int)*physical);
+
+      return 0;
+    }
+
+    /*
+     * For all standard memory operations, the Sun-3 physically masks the
+     * Address Bus to 28 virtual bits before hitting the MMU Arrays.
+     */
+    address &= 0x0FFFFFFF;
+
+    if (!(s->enable_reg & 0x80)) {
+        /* Boot State: Not-Boot bit (0x80) is CLEAR */
+
+        /*
+         * Address < 0x01000000 && Supervisor Program:
+         *    Bypass MMU and map to the physical PROM (0x0FEF0000).
+         */
+        if (true_fc == 6 && (address < 0x01000000 ||
+                             (address >= 0x0FEF0000 && address < 0x0FF00000))) {
+            *physical = 0x0FEF0000 | (address & 0x0001FFFF);
+            *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+            *page_size = SUN3_PAGE_SIZE;
+            return 0;
+        }
+    }
+
+    context = s->context_reg & (SUN3_MMU_CONTEXTS - 1);
+
+    /* Segment map lookup: top 11 bits of 28-bit virtual address (bits 17-27) */
+    uint32_t seg_index = (address >> 17) & (SUN3_MMU_SEGMENTS_PER_CONTEXT - 1);
+    pmeg = s->segment_map[(context * SUN3_MMU_SEGMENTS_PER_CONTEXT) +
+                          seg_index];
+
+    /* Page map lookup: bits 13-16 of virtual address */
+    pte_index = (address >> SUN3_PAGE_SHIFT) & (SUN3_MMU_PTE_PER_PMEG - 1);
+    pte_offset = (pmeg * SUN3_MMU_PTE_PER_PMEG) + pte_index;
+    pte = s->page_map[pte_offset];
+
+    /* Update PTE Accessed/Modified bits */
+    if (pte & SUN3_PTE_VALID) {
+        uint32_t new_pte = pte | SUN3_PTE_REF;
+        if (is_write) {
+            new_pte |= SUN3_PTE_MOD;
+        }
+        if (new_pte != pte) {
+            s->page_map[pte_offset] = new_pte;
+        }
+    }
+
+    if (!(pte & SUN3_PTE_VALID)) {
+        s->buserr_reg |= 0x80; /* Invalid */
+        return 1;              /* Translation fault */
+    }
+
+    /* Protection check */
+    uint8_t mmu_prot = (pte >> 29) & 3;
+
+    if (!is_supervisor && (mmu_prot & 1)) {
+        s->buserr_reg |= 0x40; /* Protection */
+        return 1;              /* User access to supervisor page */
+    }
+
+    *prot = PAGE_READ | PAGE_EXEC;
+    if (mmu_prot & 2) {
+        if (is_write || (pte & SUN3_PTE_MOD)) {
+            *prot |= PAGE_WRITE;
+        }
+    }
+
+    if (is_write && !(mmu_prot & 2)) {
+        s->buserr_reg |= 0x40; /* Protection */
+        return 1;
+    }
+
+    /*
+     * Extract physical address. The top 15 bits come from the PTE's
+     * PGFRAME. Bottom 13 bits (0x1FFF) come directly from the virtual
+     * address.
+     */
+    phys_addr = ((pte & SUN3_PTE_PGFRAME) << SUN3_PAGE_SHIFT) |
+                (address & (SUN3_PAGE_SIZE - 1));
+
+    /*
+     * Address space Mapping reference:
+     *   - OBMEM:   0x00000000 (Follows native Map)
+     *   - OBIO:    0x0FE00000 (Relocated above typical 24MB RAM)
+     *   - VME_D16: 0x40000000 (Relocated out of bounds)
+     *   - VME_D32: 0x50000000
+     */
+    uint32_t pgbase = ((pte & SUN3_PTE_PGFRAME) << SUN3_PAGE_SHIFT);
+    uint32_t pgtype = (pte & SUN3_PTE_PGTYPE) >> 26;
+
+    /*
+     * Sun-3 Hardware Quirk:
+     * The Boot PROM maps Virtual `0x00000000` to its ROM header using OBIO
+     * Page `0x80` (`0xC4000080`). Native hardware intercepts OBIO offset
+     * `0x100000` and transparently aliases it back to OBMEM PROM
+     * (`0x0FEF0000`) using the virtual address to index the ROM! *
+     */
+    if (pgtype == SUN3_PGTYPE_OBIO &&
+        (pgbase >= 0x100000 && pgbase < 0x120000)) {
+        phys_addr = 0x0FEF0000 | (address & 0x1FFFF);
+    } else {
+        switch (pgtype) {
+        case SUN3_PGTYPE_OBMEM:
+            break;
+        case SUN3_PGTYPE_OBIO:
+            phys_addr += 0x0FE00000;
+            break;
+        case SUN3_PGTYPE_VME_D16:
+            phys_addr += 0x40000000;
+            break;
+        case SUN3_PGTYPE_VME_D32:
+            phys_addr += 0x50000000;
+            break;
+        }
+    }
+
+    /* NXM (Non-Existent Memory) Bounds Checking */
+    if (!is_valid_sun3_phys(phys_addr, current_machine->ram_size)) {
+        s->buserr_reg |= 0x20; /* Timeout */
+        return 1;
+    }
+
+    /*
+     * The QEMU TLB works in 4KB frames, not Sun-3's 8KB native frames.
+     * We MUST explicitly append the intra-page offset within the 8KB page,
+     * otherwise accesses to the upper 4KB (e.g. 0x1000, 0x3000) will be
+     * truncated and overwrite the physical memory of the lower 4KB!
+     */
+    *physical = phys_addr | (address & (SUN3_PAGE_SIZE - 1));
+
+    *page_size = TARGET_PAGE_SIZE;
+
+    return 0; /* 0 = success, no fault */
+}
diff --git a/include/hw/m68k/sun3mmu.h b/include/hw/m68k/sun3mmu.h
new file mode 100644
index 0000000000..bdd79d963b
--- /dev/null
+++ b/include/hw/m68k/sun3mmu.h
@@ -0,0 +1,65 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef HW_M68K_SUN3MMU_H
+#define HW_M68K_SUN3MMU_H
+
+#include "exec/cpu-common.h"
+#include "exec/hwaddr.h"
+#include "exec/target_page.h"
+#include "hw/core/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SUN3_MMU "sun3-mmu"
+OBJECT_DECLARE_SIMPLE_TYPE(Sun3MMUState, SUN3_MMU)
+
+#define TYPE_SUN3_DVMA_IOMMU_MEMORY_REGION "sun3-dvma-iommu-memory-region"
+
+#define SUN3_MMU_CONTEXTS 8
+#define SUN3_MMU_PMEGS 256
+#define SUN3_MMU_PTE_PER_PMEG 16
+#define SUN3_MMU_SEGMENTS_PER_CONTEXT 2048
+
+#define SUN3_PAGE_SIZE 0x2000 /* 8 KB */
+#define SUN3_PAGE_MASK (~(SUN3_PAGE_SIZE - 1))
+#define SUN3_PAGE_SHIFT 13
+
+/* PTE bits */
+#define SUN3_PTE_VALID (1U << 31)
+#define SUN3_PTE_WRITE (1U << 30)
+#define SUN3_PTE_SYSTEM (1U << 29)
+#define SUN3_PTE_NC (1U << 28)
+#define SUN3_PTE_PGTYPE (3U << 26)
+#define SUN3_PTE_REF (1U << 25)
+#define SUN3_PTE_MOD (1U << 24)
+#define SUN3_PTE_PGFRAME 0x0007FFFF
+
+/* PTE PGTYPE values */
+#define SUN3_PGTYPE_OBMEM 0
+#define SUN3_PGTYPE_OBIO 1
+#define SUN3_PGTYPE_VME_D16 2
+#define SUN3_PGTYPE_VME_D32 3
+
+struct Sun3MMUState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion context_mem;
+    MemoryRegion segment_mem;
+    MemoryRegion page_mem;
+    MemoryRegion control_mem;
+    MemoryRegion buserr_mem;
+    IOMMUMemoryRegion dvma_iommu;
+
+    uint8_t sys_enable_reg; /* Reserved mapping for testing */
+
+    uint8_t context_reg;
+    uint8_t enable_reg;
+    uint8_t buserr_reg;
+    uint8_t int_reg;
+    uint8_t segment_map[SUN3_MMU_CONTEXTS * SUN3_MMU_SEGMENTS_PER_CONTEXT];
+    uint32_t page_map[SUN3_MMU_PMEGS * SUN3_MMU_PTE_PER_PMEG];
+};
+
+int sun3mmu_get_physical_address(void *env, hwaddr *physical, int *prot,
+                                 vaddr address, int access_type,
+                                 hwaddr *page_size);
+
+#endif
-- 
2.50.1 (Apple Git-155)

[PATCH 6/7] tests/qtest: Add Sun-3 hardware interaction tests

[54weasels]

This adds basic architectural and register validation for the newly assembled Sun-3 machine.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 tests/qtest/meson.build |  1 +
 tests/qtest/sun3-test.c | 67 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)
 create mode 100644 tests/qtest/sun3-test.c

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index be4fa627b5..184d1a3f8c 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -154,6 +154,7 @@ qtests_loongarch64 = qtests_filter + \
    'cpu-plug-test']
 
 qtests_m68k = ['boot-serial-test'] + \
+  ['sun3-test'] + \
   qtests_filter
 
 qtests_microblaze = ['boot-serial-test'] + \
diff --git a/tests/qtest/sun3-test.c b/tests/qtest/sun3-test.c
new file mode 100644
index 0000000000..50f6c166d1
--- /dev/null
+++ b/tests/qtest/sun3-test.c
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QTest device validation for the Sun-3 Machine
+ *
+ * Copyright (c) 2026
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest.h"
+
+/* OBIO Memory Map Addresses */
+#define SUN3_INTREG_BASE 0x0FEA0000
+#define SUN3_MEMERR_BASE 0x0FE80000
+
+static void test_intreg(void)
+{
+    QTestState *s;
+    uint8_t val;
+
+    s = qtest_init("-machine sun3 -nographic");
+
+    /* Default state should be 0 */
+    val = qtest_readb(s, SUN3_INTREG_BASE);
+    g_assert_cmphex(val, ==, 0x00);
+
+    /* Write and verify */
+    qtest_writeb(s, SUN3_INTREG_BASE, 0x0f);
+    val = qtest_readb(s, SUN3_INTREG_BASE);
+    g_assert_cmphex(val, ==, 0x0f);
+
+    qtest_quit(s);
+}
+
+static void test_memerr(void)
+{
+    QTestState *s;
+    uint8_t val;
+
+    s = qtest_init("-machine sun3 -nographic");
+
+    /* Default state should be 0x40 (default no-error) */
+    val = qtest_readb(s, SUN3_MEMERR_BASE);
+    g_assert_cmphex(val, ==, 0x40);
+
+    /* Test parity error spoof sequence */
+    qtest_writeb(s, SUN3_MEMERR_BASE, 0x20); /* Set test_parity_written */
+    qtest_writeb(s, SUN3_MEMERR_BASE, 0x50); /* Trigger spoof */
+    val = qtest_readb(s, SUN3_MEMERR_BASE);
+
+    /*
+     * Since we didn't clock enough parity lanes, high bit and lane 8 should
+     * be set (0x50 | 0x80 | 0x08 = 0xd8)
+     */
+    g_assert_cmphex(val, ==, 0xd8);
+
+    qtest_quit(s);
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/m68k/sun3/intreg", test_intreg);
+    qtest_add_func("/m68k/sun3/memerr", test_memerr);
+
+    return g_test_run();
+}
-- 
2.50.1 (Apple Git-155)

[PATCH 7/7] tests/functional: Add Sun-3 firmware boot and diagnostic test

[54weasels]

This adds an integration test that downloads the Sun-3/60 Boot PROM, initializes the machine, and ensures the self-test successfully routes to TTY A.

Signed-off-by: 54weasels <54weasels@gmail.com>
---
 tests/functional/m68k/meson.build   |  1 +
 tests/functional/m68k/test_sun3.py  | 34 +++++++++++++++++++++++++++++
 tests/functional/qemu_test/asset.py | 11 +++++-----
 3 files changed, 41 insertions(+), 5 deletions(-)
 create mode 100755 tests/functional/m68k/test_sun3.py

diff --git a/tests/functional/m68k/meson.build b/tests/functional/m68k/meson.build
index 679faaf86d..601c28d863 100644
--- a/tests/functional/m68k/meson.build
+++ b/tests/functional/m68k/meson.build
@@ -9,5 +9,6 @@ tests_m68k_system_thorough = [
   'nextcube',
   'replay',
   'q800',
+  'sun3',
   'tuxrun',
 ]
diff --git a/tests/functional/m68k/test_sun3.py b/tests/functional/m68k/test_sun3.py
new file mode 100755
index 0000000000..f441184616
--- /dev/null
+++ b/tests/functional/m68k/test_sun3.py
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#!/usr/bin/env python3
+#
+# Functional test that boots a Sun-3 machine and checks its serial console.
+#
+# Copyright (c) 2026
+#
+
+
+import os
+from qemu_test import QemuSystemTest, Asset
+from qemu_test import wait_for_console_pattern
+
+class Sun3Machine(QemuSystemTest):
+    timeout = 60
+
+    ASSET_PROM = Asset(
+        'https://github.com/54weasels/sun3_60/raw/main/bootprom/boot_1810_01.BIN',
+        '471bf34cc9313814726c2e3506d85a13291603e37b45aaffa71bc1154a2d4851'
+    )
+
+    def test_m68k_sun3_boot(self):
+        self.set_machine('sun3')
+        prom_path = self.ASSET_PROM.fetch()
+
+        # Sun-3 maps TTY A to serial_hd(3)
+        self.vm.set_console(console_index=3)
+        self.vm.add_args('-bios', prom_path)
+        self.vm.launch()
+
+        wait_for_console_pattern(self, '>')
+
+if __name__ == '__main__':
+    QemuSystemTest.main()
diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index 51a434b2b7..eac1e60536 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -223,11 +223,12 @@ def fetch(self):
             raise AssetError(self, "Download retries exceeded", transient=True)
 
         try:
-            # Set these just for informational purposes
-            os.setxattr(str(tmp_cache_file), "user.qemu-asset-url",
-                        self.url.encode('utf8'))
-            os.setxattr(str(tmp_cache_file), "user.qemu-asset-hash",
-                        self.hash.encode('utf8'))
+            if hasattr(os, 'setxattr'):
+                # Set these just for informational purposes
+                os.setxattr(str(tmp_cache_file), "user.qemu-asset-url",
+                            self.url.encode('utf8'))
+                os.setxattr(str(tmp_cache_file), "user.qemu-asset-hash",
+                            self.hash.encode('utf8'))
         except OSError as e:
             self.log.debug("Unable to set xattr on %s: %s", tmp_cache_file, e)
 
-- 
2.50.1 (Apple Git-155)