From b48594a4cc10e4a96d4444d9010025b0230bcd7d Mon Sep 17 00:00:00 2001
From: RichardG867 <richardg867@gmail.com>
Date: Mon, 20 Jan 2025 14:20:14 -0300
Subject: [PATCH] AD1848: Add one more CS4235 register access backdoor

---
 src/sound/snd_ad1848.c | 30 ++++++++++++++++++++++++------
 src/sound/snd_cs423x.c |  7 +++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/src/sound/snd_ad1848.c b/src/sound/snd_ad1848.c
index ddf8e61ec..d870b4588 100644
--- a/src/sound/snd_ad1848.c
+++ b/src/sound/snd_ad1848.c
@@ -200,10 +200,22 @@ ad1848_read(uint16_t addr, void *priv)
 
                 case 23:
                     if ((ad1848->type >= AD1848_TYPE_CS4236B) && (ad1848->regs[23] & 0x08)) {
-                        if ((ad1848->xindex & 0xfe) == 0x00) /* remapped line volume */
-                            ret = ad1848->regs[18 + ad1848->xindex];
-                        else
-                            ret = ad1848->xregs[ad1848->xindex];
+                        ret = ad1848->xregs[ad1848->xindex];
+                        switch (ad1848->xindex) {
+                            case 0 ... 1:
+                                /* Remapped line volume. */
+                                ret = ad1848->regs[18 + ad1848->xindex];
+                                break;
+
+                            case 26:
+                                /* Backdoor to the Joystick Control register on CS4235+. */
+                                if (ad1848->type >= AD1848_TYPE_CS4235)
+                                    ret = ad1848->cram_read(0, ad1848->cram_priv);
+                                break;
+
+                            default:
+                                break;
+                        }
                     }
                     break;
 
@@ -353,8 +365,8 @@ ad1848_write(uint16_t addr, uint8_t val, void *priv)
                         }
 
                         switch (ad1848->xindex) {
-                            case 0:
-                            case 1: /* remapped line volume */
+                            case 0 ... 1:
+                                /* Remapped line volume. */
                                 ad1848->regs[18 + ad1848->xindex] = val;
                                 return;
 
@@ -380,6 +392,12 @@ ad1848_write(uint16_t addr, uint8_t val, void *priv)
                             case 25:
                                 return;
 
+                            case 26:
+                                /* Backdoor to the Joystick Control register on CS4235+. */
+                                if (ad1848->type >= AD1848_TYPE_CS4235)
+                                    ad1848->cram_write(0, val, ad1848->cram_priv);
+                                break;
+
                             default:
                                 break;
                         }
diff --git a/src/sound/snd_cs423x.c b/src/sound/snd_cs423x.c
index 0a383e13f..288314a13 100644
--- a/src/sound/snd_cs423x.c
+++ b/src/sound/snd_cs423x.c
@@ -144,6 +144,7 @@ typedef struct cs423x_t {
 } cs423x_t;
 
 static void cs423x_slam_enable(cs423x_t *dev, uint8_t enable);
+static void cs423x_ctxswitch_write(uint16_t addr, UNUSED(uint8_t val), void *priv);
 static void cs423x_pnp_enable(cs423x_t *dev, uint8_t update_rom, uint8_t update_hwconfig);
 static void cs423x_pnp_config_changed(uint8_t ld, isapnp_device_config_t *config, void *priv);
 static void cs423x_reset(void *priv);
@@ -237,6 +238,12 @@ cs423x_write(uint16_t addr, uint8_t val, void *priv)
         case 0: /* Joystick and Power Control */
             if (dev->type <= CRYSTAL_CS4232)
                 val &= 0xeb;
+            if ((dev->type >= CRYSTAL_CS4235) && (addr == 0) && (val & 0x08)) {
+                /* CS4235+ through X26 backdoor only (hence the addr check): WSS off (one-way trip?) */
+                io_removehandler(dev->wss_base, 4, ad1848_read, NULL, NULL, ad1848_write, NULL, NULL, &dev->ad1848);
+                io_removehandler(dev->wss_base, 4, NULL, NULL, NULL, cs423x_ctxswitch_write, NULL, NULL, dev);
+                dev->wss_base = 0;
+            }
             break;
 
         case 1: /* EEPROM Interface */