Falcon Speed 286 emulator

[SteveBagley]

Ooo, if you're looking at Ghidra (I still must learn to use that -- the few attempts I've had so far to play with it have ended in ignominy), let me know if you see anything related to IDE. Seems to be a big weak point. I suspect it struggles with modern devices for a couple of reasons. Timing may be one (there are a *lot* of lockups with my CF card) but the biggest hurdle is it doesn't seem to accept any *drive* over a figure between 64 and 256 MB. Perhaps cylinder count is stored as a byte?!

Here's the code that handles the IDE sector/cylinders/head stuff…

Code: Select all

                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                               undefined FUN_00018480()
             undefined         <UNASSIGNED>   <RETURN>
                             FUN_00018480                                         XREF[2]:     FUN_00018df4:00018390(c), 
                                                                                              FUN_000189a8:000183f4(c)  
        00018480 38 2e 00 8c     move.w          (0x8c,A6),D4w
        00018484 13 c4 ff        move.b          D4b,(DAT_fff00008).l
                 f0 00 08
        0001848a 28 2e 00 90     move.l          (0x90,A6),D4
        0001848e 88 ee 07 56     divu.w          (0x756,A6),D4
        00018492 48 44           swap            D4
        00018494 52 44           addq.w          #0x1,D4w
        00018496 13 c4 ff        move.b          D4b,(DAT_fff0000c).l
                 f0 00 0c
        0001849c 42 44           clr.w           D4w
        0001849e 48 44           swap            D4
        000184a0 88 ee 07 54     divu.w          (0x754,A6),D4
        000184a4 13 c4 ff        move.b          D4b,(DAT_fff00010).l
                 f0 00 10
        000184aa e0 4c           lsr.w           #0x8,D4w
        000184ac 13 c4 ff        move.b          D4b,(DAT_fff00014).l
                 f0 00 14
        000184b2 48 44           swap            D4
        000184b4 00 04 00 a0     ori.b           #0xA0,D4b
        000184b8 13 c4 ff        move.b          D4b,(DAT_fff00018).l
                 f0 00 18
        000184be 4e 75           rts

which seems to implement a conversion back from LBA to CHS, i.e. the reverse of: LBA = (( C x HPC ) + H ) x SPT + S - 1.

Steven

[Badwolf]

This is probably the code you saw?

That's the one.

which fits with the BIOS startup code I extracted:
If you take 0x8F and shift to the left 5 bits, you get 0x11E0 the low byte of which is 0xE0. This suggests that $ffffc05 might be reading the value from the 286 data bus directly (although the byte swapping on the data bus, coupled with the different endianness of the processors is confusing me somewhat!), which would suggest $ffffc07 is reading from the 74HC753 in IC2 (so would contains the port number)?

I've fixed up the equations and attach them below (I hadn't taken into account the difference in pinout between the PLCC and DIP versions of the 20V8).

Not knowing enough about the x86 architecture, I can't be sure what's going on yet, but it does look like there's a (very!) partial decode of those addresses in IC7 that only compares 15 of the 23 address bits. It hits the ACIAs and a couple of unassigned ranges.

If 286_HOLD is high (active) then...

• IC7 triggers output on a *word* read of the MIDI ACIA which seems to transmit certain 286 lines to data0,1,2,6 & 7 (IC9). A status read, it seems.
• A word read of the IKBD address puts the lower byte of 286 address bus on the lower byte of the Falcon databus via IC2. Is this some kind of IO/interrupt handling routine?
• A *byte* write on the lower (MIDI) address looks to trigger a 286 interrupt (IC7)
• A byte write on the keyboard address looks to trigger a 286 reset.
• A word write on the midi address looks to trigger the bus arbitration process by asserting XBR.
• A word write on the keyboard address, providing the 286 has acknowledge relinquishing the bus, seems to do something funky with the address bus. At first glance it appears to try to drive some of the the high bits, translating the 286 address to the ST space a bit, providing 286_MIO is high. I don't quite see how this ties in with the ST side driving the bus too. I must have misinterpreted this somewhere. INTER_1 between IC7 and IC6 is the signal of interest.

I feel I understand a little bit more now. But not *that* much more!

BW

[Badwolf]

Here's the code that handles the IDE sector/cylinders/head stuff…
[...]
which seems to implement a conversion back from LBA to CHS, i.e. the reverse of: LBA = (( C x HPC ) + H ) x SPT + S - 1.

Aha, thanks. Can't see anything obviously bogus there.

Ah well, was a bit of a wild-arsed-guess. Must be deeper.

Cheers,

BW