z8000,z8010,zilog/s8000: correct CPU/MMU behavior and boot ZEUS (#15866)

cpu/z8000: Fixes and updates
* fix addr_to_reg segment mask to replace full high byte
* fix MULTW carry-flag boundary
* preserve DIVW/DIVL quotient on representable overflow
* toggle H flag in COMFLG
* write POPL @rd,@rs result to memory
* read indirect MULTL operand from memory
* fix dynamic shift dispatch and count sign-extension [tpaxia]
* fix RRDB temp register and RLDB/RRDB S flag
* accumulate V flag across shift/rotate steps
* fix compare-string repeat and block-move Z flag
* fix SOTIRB/SOUTIB source not incrementing (bumped segment word instead of offset)
* fix block-I/O instruction flags and address increment
* fix COMB @rd destination register decode
* trap the 4F extended EPU family at the correct instruction
* preserve the indexed LDA operand across an overlapping destination
* derive the DAB correction table from measured Z8001 behaviour
* leave the tcc destination alone when the condition is false
* fix the MULTL carry boundary
* take the DIV overflow sign flag from the whole quotient
* order the translate RH1 writeback against the pointer step
* replace the whole high word when writing a segmented address back
* do not mask PSAPSEG through LDCTL
* read a byte for the non-indexed COMB
* do not mask the FCW written through LDCTL
* calculate DAB correction directly

cpu/z8010: correct violation semantics per Olivetti UC3003 factory test [tpaxia]

zilog/s8000: fix ZEUS clock, MMU and device handling, support multi-sector SMDC transfers, and fix Series Two interrupt daisy chain [tpaxia]

---------
Co-authored-by: tpaxia <spaxia@notoslab.com>

Author: tpaxia

scripts/src/cpu.lua

@@ -3250,9 +3250,7 @@ if CPUS["Z8000"] then
 	files {
 		MAME_DIR .. "src/devices/cpu/z8000/z8000.cpp",
 		MAME_DIR .. "src/devices/cpu/z8000/z8000.h",
-		--MAME_DIR .. "src/devices/cpu/z8000/makedab.cpp",
 		MAME_DIR .. "src/devices/cpu/z8000/z8000cpu.h",
-		MAME_DIR .. "src/devices/cpu/z8000/z8000dab.h",
 		MAME_DIR .. "src/devices/cpu/z8000/z8000ops.hxx",
 		MAME_DIR .. "src/devices/cpu/z8000/z8000tbl.hxx",
 	}

src/devices/bus/zbi/s8k_cpu.cpp

@@ -34,6 +34,7 @@ E000 - FFFF    Communication Devices
 
 #include "bus/rs232/rs232.h"
 #include "bus/centronics/ctronics.h"
+#include "machine/clock.h"
 
 //#define VERBOSE 1
 #include "logmacro.h"
@@ -84,6 +85,10 @@ void s8k_cpu_base::base_device_start()
 	save_item(NAME(m_reg_snvr));
 	save_item(NAME(m_reg_trpl));
 	save_item(NAME(m_reg_if1l));
+	save_item(NAME(m_lad_seg));
+	save_item(NAME(m_lad_low));
+	save_item(NAME(m_if1_low));
+	save_item(NAME(m_segt_state));
 }
 
 void s8k_cpu_base::base_device_reset()
@@ -93,6 +98,10 @@ void s8k_cpu_base::base_device_reset()
 	m_reg_snvr = 0;
 	m_reg_trpl = 0;
 	m_reg_if1l = 0;
+	m_lad_seg = 0;
+	m_lad_low = 0;
+	m_if1_low = 0;
+	m_segt_state = false;
 
 	m_view_code.select(0);
 	m_view_data.select(0);
@@ -115,9 +124,35 @@ void s8k_cpu_base::base_device_resolve_objects()
 
 void s8k_cpu_base::segt_interrupt(int state)
 {
+	if (state && !m_segt_state)
+	{
+		// U66 (sheet 2) and U48-U50 (sheet 3) capture the segment number
+		// and the address low bytes -- which the Z8010s cannot record --
+		// at the moment the segment trap is raised.  A trap handler
+		// combines them with the high bytes latched inside the MMUs.
+		m_reg_snvr = m_lad_seg;
+		m_reg_trpl = m_lad_low;
+		m_reg_if1l = m_if1_low;
+	}
+	m_segt_state = (state != 0);
 	m_maincpu->set_input_line(z8001_device::SEGT_LINE, state ? ASSERT_LINE : CLEAR_LINE);
 }
 
+void s8k_cpu_base::observe_bus_cycle(offs_t offset, bool if1)
+{
+	m_lad_seg = uint8_t(offset >> 16) & 0x7f;
+	m_lad_low = uint8_t(offset);
+	if (if1)
+	{
+		m_if1_low = uint8_t(offset);
+		// Every MMU sits on the CPU's address/data bus and snoops each
+		// IFETCH1 cycle, whether or not it translates it.
+		m_mmu_code->ifetch1_observed(offset);
+		m_mmu_data->ifetch1_observed(offset);
+		m_mmu_stck->ifetch1_observed(offset);
+	}
+}
+
 uint16_t s8k_cpu_base::segtack_r()
 {
 	uint16_t code = (m_mmu_code->segtack_r() |
@@ -188,9 +223,6 @@ z8010_device *s8k_cpu_base::select_code_mmu(offs_t offset)
 		{
 			if (m_normal_mode)  // Trying to access in normal mode?
 			{
-				// SEGTRAP!
-				m_reg_snvr = seg;
-				m_reg_if1l = offset;
 				mmu = nullptr;
 				segt_interrupt(1);
 			}
@@ -239,9 +271,8 @@ z8010_device *s8k_cpu_base::select_data_mmu(offs_t offset, uint8_t sbr, uint8_t
 		{
 			if (m_normal_mode)  // Trying to access in normal mode?
 			{
-				// SEGTRAP!
-				m_reg_snvr = seg;
-				m_reg_trpl = offset;
+				// SEGTRAP!  (the address latches are captured by the
+				// segment trap flip-flop in segt_interrupt)
 				mmu = nullptr;
 				segt_interrupt(1);
 			}
@@ -529,19 +560,21 @@ bool zbi_s8k_cpu10_card_device::translate_addr(int spacenum, bool write, offs_t
 	if (m_reg_scr & SCR_MMU_ONH)
 	{
 		bool code_access = (spacenum == AS_PROGRAM);
+		int st = code_access ?
+					(m_maincpu->is_ifetch1() ?
+						z8002_device::ST_IFETCH_1 :
+						z8002_device::ST_IFETCH_N) :
+					(stack_access ?
+						z8002_device::ST_REQ_STACK :
+						z8002_device::ST_REQ_DATA);
+
+		observe_bus_cycle(offset, st == z8002_device::ST_IFETCH_1);
+
 		z8010_device *mmu = code_access ?
 							select_code_mmu(offset) : select_data_mmu(offset, m_reg_sbr, m_reg_nbr);
 
 		if (mmu)
 		{
-			int st = code_access ?
-						(m_maincpu->is_ifetch1() ?
-							z8002_device::ST_IFETCH_1 :
-							z8002_device::ST_IFETCH_N) :
-						(stack_access ?
-							z8002_device::ST_REQ_STACK :
-							z8002_device::ST_REQ_DATA);
-
 			LOG("%s MMU MEM REQ (space %d): %06x\n", machine().describe_context(), spacenum, offset);
 
 			offset &= 0x3f'ffff;    // Mask off seg bit 7 to disable URS checking in MMUs
@@ -648,6 +681,11 @@ void zbi_s8k_cpu10_card_device::device_add_mconfig(machine_config &config)
 	m_sio[0]->out_txdb_callback().set("sio0:chb:console", FUNC(rs232_port_device::write_txd));
 	m_sio[0]->out_rtsb_callback().set("sio0:chb:console", FUNC(rs232_port_device::write_rts));
 	m_sio[0]->out_dtrb_callback().set("sio0:chb:console", FUNC(rs232_port_device::write_dtr));
+	// Local console terminal: loop the driver's own DTR/RTS back as DCD/CTS so
+	// carrier is present when sioopen() does its carrier-wait on a read-only
+	// open of /dev/console (otherwise the console shell sleeps forever).
+	m_sio[0]->out_dtrb_callback().append(m_sio[0], FUNC(z80sio_device::dcdb_w));
+	m_sio[0]->out_rtsb_callback().append(m_sio[0], FUNC(z80sio_device::ctsb_w));
 
 	rs232_port_device &rs232_0(RS232_PORT(config, "sio0:cha:tty0", default_rs232_devices, nullptr));
 	rs232_0.rxd_handler().set(m_sio[0], FUNC(z80sio_device::rxa_w));
@@ -735,13 +773,21 @@ void zbi_s8k_cpu10_card_device::device_add_mconfig(machine_config &config)
 	Z80CTC(config, m_ctc[2], CLK_CPU);
 	m_ctc[2]->set_clk<0>(CLK_CTC);
 	m_ctc[2]->set_clk<1>(CLK_CTC);
-	m_ctc[2]->set_clk<2>(CLK_CTC);
 	m_ctc[2]->zc_callback<0>().set(m_sio[3], FUNC(z80sio_device::rxca_w));
 	m_ctc[2]->zc_callback<0>().append(m_sio[3], FUNC(z80sio_device::txca_w));
 	m_ctc[2]->zc_callback<1>().set(m_sio[3], FUNC(z80sio_device::rxcb_w));
 	m_ctc[2]->zc_callback<1>().append(m_sio[3], FUNC(z80sio_device::txcb_w));
 	m_ctc[2]->zc_callback<2>().set(m_ctc[2], FUNC(z80ctc_device::trg3));
 
+	// Real-time (line) clock: CTC 2 channels 2 & 3 are cascaded and run in
+	// COUNTER mode, counting the independent 1.2288 MHz baud-rate oscillator fed
+	// to the CTC trigger inputs (S8000 CPU Hardware Manual sec 4.2.2). ZEUS
+	// programs ch2 /256 and ch3 /80 -> a 60 Hz jiffy interrupt.  Feed ch2 only
+	// through trg2: configuring both its internal clock and this external trigger
+	// would count the oscillator twice and make the ZEUS clock run at 120 Hz.
+	clock_device &rtc_clk(CLOCK(config, "rtc_clk", CLK_CTC));
+	rtc_clk.signal_handler().set(m_ctc[2], FUNC(z80ctc_device::trg2));
+
 	Z80PIO(config, m_pio, CLK_CPU);
 	m_pio->in_pa_callback().set(FUNC(zbi_s8k_cpu10_card_device::pa_data_r));
 	m_pio->out_pb_callback().set("pio0:printer1:data_out", FUNC(output_latch_device::write));
@@ -976,19 +1022,23 @@ bool zbi_s8k_hpcpu_card_device::translate_addr(int spacenum, bool write, offs_t
 	if (m_reg_scr & SCR_MMU_ONH)
 	{
 		bool code_access = (spacenum == AS_PROGRAM);
+		int st = code_access ?
+					(m_maincpu->is_ifetch1() ?
+						z8002_device::ST_IFETCH_1 :
+						z8002_device::ST_IFETCH_N) :
+					(stack_access ?
+						z8002_device::ST_REQ_STACK :
+						z8002_device::ST_REQ_DATA);
+
+		// Board latches and MMU bus snoop see the cycle before any
+		// violation can be raised for it.
+		observe_bus_cycle(offset, st == z8002_device::ST_IFETCH_1);
+
 		z8010_device *mmu = code_access ?
 							select_code_mmu(offset) : select_data_mmu(offset, 0, m_reg_ubr);
 
 		if (mmu)
 		{
-			int st = code_access ?
-						(m_maincpu->is_ifetch1() ?
-							z8002_device::ST_IFETCH_1 :
-							z8002_device::ST_IFETCH_N) :
-						(stack_access ?
-							z8002_device::ST_REQ_STACK :
-							z8002_device::ST_REQ_DATA);
-
 			LOG("%s MMU MEM REQ (space %d): %06x\n", machine().describe_context(), spacenum, offset);
 
 			offset &= 0x3f'ffff;    // Mask off seg bit 7 to disable URS checking in MMUs

src/devices/bus/zbi/s8k_cpu.h

@@ -81,6 +81,8 @@ class s8k_cpu_base : public device_t, public device_zbi_card_interface
 	uint8_t reg_trpl_r();
 	uint8_t reg_if1l_r();
 
+	void observe_bus_cycle(offs_t offset, bool if1);
+
 	//helpers
 	void out_ns_cb(int state);
 	void out_busack_cb(int state);
@@ -95,11 +97,18 @@ class s8k_cpu_base : public device_t, public device_zbi_card_interface
 	devcb_write_line m_ns_cb;
 	devcb_write_line m_busack_cb;
 
-	// Board registers
+	// Board registers: snapshots of the running latches below, captured by
+	// the segment trap flip-flop (U20 sheet 8) when SEGT- is raised.
 	uint8_t m_reg_snvr  = 0; // Segment Violation Register
 	uint8_t m_reg_trpl  = 0; // Segment trap memory address low-byte
 	uint8_t m_reg_if1l  = 0; // Segment trap instruction low-byte
 
+	// Running bus-side latches and the SEGT- line state
+	uint8_t m_lad_seg   = 0; // segment number of the current memory cycle
+	uint8_t m_lad_low   = 0; // low address byte of the current memory cycle
+	uint8_t m_if1_low   = 0; // low address byte of the last IFETCH1 cycle
+	bool m_segt_state   = false;
+
 	bool m_is_seg_os = false;
 	bool m_is_seg_user = false;
 

src/devices/bus/zbi/s8k_smdc.cpp

@@ -556,12 +556,6 @@ int zbi_s8k_smdc_card_device::get_lbasector()
 		LOGDATA("%s: Unexpected sector number %d for range 0 to %d\n", machine().describe_context(), pkt->SC, info.sectors - 1);
 	}
 
-	if ((pkt->CT == 0) || (pkt->CT > info.sectorbytes))
-	{
-		LOGDATA("%s: Unexpected sector bytes %d for range 1 to %d\n", machine().describe_context(), pkt->CT, info.sectorbytes);
-		pkt->CT = 512;
-	}
-
 	lbasector = pkt->CY;
 	lbasector *= info.heads;
 	lbasector += pkt->HD;
@@ -635,7 +629,7 @@ void zbi_s8k_smdc_card_device::smd_do_drive(int drv)
 		LOGWRITE("%s SMD write: unit=%d cyl=%d hd=%d sec=%d count=%d addr=%04x:%04x\n", machine().describe_context(),
 				 unit, pkt->CY, pkt->HD, pkt->SC, pkt->CT, pkt->AH, pkt->AL);
 
-		if (pkt->CT & 1)
+		if ((pkt->CT == 0) || (pkt->CT & 1))
 		{
 			m_es = SMD_ES_BADCT;
 			pkt->DS |= SMD_DS_FT;
@@ -649,6 +643,12 @@ void zbi_s8k_smdc_card_device::smd_do_drive(int drv)
 			pkt->DS |= SMD_DS_FT;
 			break;
 		}
+		if (file->get_info().sectorbytes > sizeof(m_buffer))
+		{
+			m_es = SMD_ES_BADCT;
+			pkt->DS |= SMD_DS_FT;
+			break;
+		}
 
 		dma_idx = (pkt->AH << 16) | pkt->AL;
 
@@ -663,24 +663,38 @@ void zbi_s8k_smdc_card_device::smd_do_drive(int drv)
 
 		LOGSEEK(" --> seek to block $%d (offset %d)\n", block, block*512);
 
-		/* DMA from main memory */
-		for (unsigned int n = 0; n < pkt->CT; n++)
+		// CT is the total transfer size and may span sectors (swap I/O uses up to 0xfe00 bytes).
+		for (unsigned remaining = pkt->CT; remaining != 0; block++)
 		{
-			m_buffer[n] = m_bus->ram8_r(dma_idx++);
-		}
+			unsigned const count = std::min<unsigned>(remaining, file->get_info().sectorbytes);
 
-		if (!file->write(block, m_buffer))
-		{
-			m_es = SMD_ES_NOSECTOR;
-			pkt->DS |= SMD_DS_FT;
+			// Preserve the unused part of a sector for a short final transfer.
+			if ((count != file->get_info().sectorbytes) && !file->read(block, m_buffer))
+			{
+				m_es = SMD_ES_NOSECTOR;
+				pkt->DS |= SMD_DS_FT;
+				break;
+			}
+
+			for (unsigned n = 0; n < count; n++)
+				m_buffer[n] = m_bus->ram8_r(dma_idx++);
+
+			if (!file->write(block, m_buffer))
+			{
+				m_es = SMD_ES_NOSECTOR;
+				pkt->DS |= SMD_DS_FT;
+				break;
+			}
+
+			remaining -= count;
 		}
 		break;
 
 	case SMD_CM_CMD_READ:       /* read */
 		LOGREAD("%s SMD read: unit=%d cyl=%d hd=%d sec=%d count=%d addr=%04x:%04x\n", machine().describe_context(),
 				unit, pkt->CY, pkt->HD, pkt->SC, pkt->CT, pkt->AH, pkt->AL);
 
-		if (pkt->CT & 1)
+		if ((pkt->CT == 0) || (pkt->CT & 1))
 		{
 			m_es = SMD_ES_BADCT;
 			pkt->DS |= SMD_DS_FT;
@@ -694,6 +708,12 @@ void zbi_s8k_smdc_card_device::smd_do_drive(int drv)
 			pkt->DS |= SMD_DS_FT;
 			break;
 		}
+		if (file->get_info().sectorbytes > sizeof(m_buffer))
+		{
+			m_es = SMD_ES_BADCT;
+			pkt->DS |= SMD_DS_FT;
+			break;
+		}
 
 		dma_idx = (pkt->AH << 16) | pkt->AL;
 
@@ -708,18 +728,21 @@ void zbi_s8k_smdc_card_device::smd_do_drive(int drv)
 
 		LOGSEEK(" --> seek to block $%d (offset %d)\n", block, block*512);
 
-		if (!file->read(block, m_buffer))
-		{
-			m_es = SMD_ES_NOSECTOR;
-			pkt->DS |= SMD_DS_FT;
-		}
-		else
+		for (unsigned remaining = pkt->CT; remaining != 0; block++)
 		{
-			/* DMA to main memory */
-			for (unsigned int n = 0; n < pkt->CT; n++)
+			unsigned const count = std::min<unsigned>(remaining, file->get_info().sectorbytes);
+
+			if (!file->read(block, m_buffer))
 			{
-				m_bus->ram8_w(dma_idx++, m_buffer[n]);
+				m_es = SMD_ES_NOSECTOR;
+				pkt->DS |= SMD_DS_FT;
+				break;
 			}
+
+			for (unsigned n = 0; n < count; n++)
+				m_bus->ram8_w(dma_idx++, m_buffer[n]);
+
+			remaining -= count;
 		}
 		break;
 
@@ -742,11 +765,13 @@ void zbi_s8k_smdc_card_device::smd_do_drive(int drv)
 		pkt->DS = SMD_DS_FT;
 	}
 
-	if (drv_good)
-		pkt->DS |= SMD_DS_OC;
-
 	pkt->DS &= 0x003f;
-	pkt->DS |= SMD_DS_RY | ((1<<drv) << 8) | ((1<<drv) << 12);
+	pkt->DS |= ((1<<drv) << 8) | ((1<<drv) << 12);
+	// Only report the drive ready / on-cylinder when a disk is actually present.
+	// Reporting RY for an empty unit makes ZEUS's disk-config probe treat the 3
+	// unpopulated SMD units as real (size 0) drives and spin on them.
+	if (drv_good)
+		pkt->DS |= SMD_DS_RY | SMD_DS_OC;
 }
 
 //**************************************************************************

src/devices/bus/zbi/zbi.cpp

@@ -211,7 +211,12 @@ void zbi_bus_device::ram32_w(offs_t offset, uint32_t data, uint32_t mask)
 uint16_t zbi_bus_device::viack_r()
 {
 	device_z80daisy_interface *intf = daisy_get_irq_device();
-	return intf ? intf->z80daisy_irq_ack() : 0;
+	uint16_t vec = intf ? intf->z80daisy_irq_ack() : 0;
+	// The ack changed the acked device's daisy state (INT -> IEO), so the VI
+	// request line must be re-evaluated -- otherwise it stays asserted and the
+	// CPU takes a phantom vectored interrupt that no device owns.
+	vi_w(CLEAR_LINE);
+	return vec;
 }
 
 uint16_t zbi_bus_device::nviack_r()