Dragon-s-Lair-X68k/tools/analysis/21_iplrom_dmac.py

#!/usr/bin/env python3
"""What the X68000's own ROM programs into the DMAC -- read out of the bytes.

    python3 tools/analysis/21_iplrom_dmac.py [iplrom.dat]

FINDINGS 48.4 / ROADMAP B3 left the single-address vs dual-address question
open for the disk, priced it at 242 KB/s and 0.69 dB, and blocked it on
sourcing `scsiexrom.bin` so its DMAC init could be disassembled. The same
question was open for AUDIO and nobody had asked it: ROADMAP P6 budgets ADPCM
at 7.8 KB/s and `11_cpu_budget.py` charges those bytes the DISK's per-byte
rate, which is a guess about a channel whose configuration was never read.

It does not have to be a guess. **The IPL ROM is on this machine** -- MAME runs
the player rig with `-bios ipl10` -- and it programs all four HD63450 channels
itself. This script reads the configuration straight out of the ROM image and
decodes the MC68450 register fields, so every claim below is a byte at a named
address rather than a recollection about a chip.

It is a GATE, not a report: each piece of evidence is (address, expected bytes,
what it means), and a mismatch exits non-zero. If a different ROM revision is
pointed at it, it says so instead of quietly decoding something else.

SOURCED for the field layouts: MC68450 Direct Memory Access Controller,
Motorola, Jul 1989 (bitsavers) -- the same document FINDINGS 39 already cites
for the transfer timings in tools/analysis/buscost.py.

NOTE THE LAYER: this is the ROM's own choice of configuration, read from the
shipping image. It is not a measurement of a running machine, and it is not
proof that a different configuration is impossible -- our player programs these
registers itself. It is evidence about what Sharp's engineers could get the
board to do, from the vendor, for these exact devices.
"""
import sys, os, argparse, hashlib
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))

BASE = 0xFE0000          # where the IPL ROM is mapped (and its 0xFF0000 alias)

# The image this was decoded against. A different revision is a different
# machine's answer, so it is named rather than assumed.
KNOWN = {
    "7fd4caabac1d9169e289f0f7bbf71d8e":
        "IPL 1.0 (MAME x68000 -bios ipl10), 131,072 B",
}

from mc68450 import REG, XRM, DTYP, DPS, PCL, SIZE, CHAIN, REQG, dcr, ocr, scr

# --- the evidence ----------------------------------------------------------
# (address, expected bytes, one-line description). Every register value quoted
# anywhere below comes out of one of these; nothing is typed in twice.
EV = [
 (0xFF0BEA, "49f900e84080197c00080004197c0005",
  "boot: lea $E84080,a4 (ch2) ; DCR=$08 ; SCR=$05..."),
 (0xFF0C2E, "49f900e840c0197c00800004197c00040006197c00050029197c0001002d"
            "197c00050031197c00050039297c00e92003",
  "boot: lea $E840C0,a4 (ch3, ADPCM) ; DCR=$80 SCR=$04 MFC=$05 CPR=$01 "
  "DFC=$05 BFC=$05 DAR=$E92003"),
 (0xFF0D8E, "0480060429052d0031054480460469056d027105",
  "boot: the ch0/ch1 init TABLE, ten (offset,value) pairs, written by the "
  "loop at $FF0CD8"),
 (0xFF0CE4, "217c00e940030014217c00e960010054",
  "boot: DAR ch0 = $E94003 (FDC data) ; DAR ch1 = $E96001 (SASI data)"),
 (0xFF9A82, "13fc003200e840c5610a13fc000200e920014e75",
  "IOCS ADPCM PLAY:   OCR(ch3) = $32 ; then command $02 to $E92001"),
 (0xFF9A5E, "13fc00b200e840c5612e13fc000400e920014e75",
  "IOCS ADPCM RECORD: OCR(ch3) = $B2 ; then command $04 to $E92001"),
 (0xFF9A96, "13fc00ff00e840c023c900e840cc33c200e840ca",
  "IOCS ADPCM arm:    CSR=$FF ; MAR = a1 ; MTC = d2   (DCR/SCR untouched)"),
 (0xFF9944, "13fc00ff00e8404013fc00b200e84045601013fc00ff00e8404013fc003200"
            "e8404523c900e8404c33c300e8404a13fc008000e840474e75",
  "IOCS SASI: OCR(ch1) = $B2 read / $32 write ; MAR ; MTC ; CCR = $80"),
]

ap = argparse.ArgumentParser()
ap.add_argument("rom", nargs="?",
                default=os.path.expanduser("~/mame/roms/iplrom.dat"))
a = ap.parse_args()
if not os.path.exists(a.rom):
    sys.exit(f"missing {a.rom} -- point this at the IPL ROM MAME boots the rig "
             f"with (-bios ipl10).")
d = open(a.rom, "rb").read()
md5 = hashlib.md5(d).hexdigest()
print(f"{a.rom}: {len(d):,} B, md5 {md5}")
if md5 in KNOWN:
    print(f"  {KNOWN[md5]}\n")
else:
    sys.exit(f"\nUNKNOWN ROM. Every field decoded below was read out of\n"
             f"  {list(KNOWN.values())[0]}\n"
             f"and a different revision is a different machine's answer, not a "
             f"detail. Add its\nmd5 to KNOWN only after re-reading the sites -- "
             f"the addresses are revision-specific.")

print("EVIDENCE -- each line is bytes at an address, not a recollection")
bad = 0
for addr, hx, what in EV:
    want = bytes.fromhex(hx)
    got = d[addr - BASE: addr - BASE + len(want)]
    ok = got == want
    bad += not ok
    print(f"  {'OK  ' if ok else 'FAIL'} ${addr:06X}  {what}")
    if not ok:
        print(f"       expected {want.hex()}\n       got      {got.hex()}")
if bad:
    sys.exit(f"\nFAIL: {bad} evidence site(s) do not hold. The decode below "
             "would be about\nsome other code, so it is not printed.")

# The ch0/ch1 table, decoded from the bytes rather than restated.
tbl = d[0xFF0D8E - BASE: 0xFF0D8E - BASE + 20]
init = {}
for i in range(0, len(tbl), 2):
    off, val = tbl[i], tbl[i + 1]
    init[(off >> 6, off & 0x3F)] = val
init[(2, 0x04)] = 0x08                      # from the inline moves at $FF0BEA
init[(2, 0x06)] = 0x05
init[(2, 0x2D)] = 0x03
init[(3, 0x04)] = 0x80                      # ...and at $FF0C2E
init[(3, 0x06)] = 0x04
init[(3, 0x2D)] = 0x01

DEV = {0: ("FDC",   "$E94003"), 1: ("SASI",  "$E96001"),
       2: ("IOCS _DMAMOVE (general purpose)", "set per call"),
       3: ("ADPCM MSM6258V", "$E92003")}
print("\nWHAT THE ROM PROGRAMS, per channel")
for ch in range(4):
    name, dar = DEV[ch]
    print(f"\n  ch{ch}  base $E840{ch*0x40:02X}   {name}   DAR = {dar}")
    v = init[(ch, 0x04)]
    print(f"    DCR = ${v:02X}")
    for line in dcr(v):
        print(f"      {line}")
    v = init[(ch, 0x06)]
    print(f"    SCR = ${v:02X}   " + " ; ".join(scr(v)))
    print(f"    CPR = ${init[(ch,0x2D)]:02X}   channel priority "
          f"({init[(ch,0x2D)]}, 0 = highest)")

print("\nAND THE PER-TRANSFER OCR, written every time a transfer is armed")
for label, ch, v in (("ADPCM playback", 3, 0x32), ("ADPCM record", 3, 0xB2),
                     ("SASI write",     1, 0x32), ("SASI read",   1, 0xB2)):
    print(f"\n  {label:<15} ch{ch}  OCR = ${v:02X}")
    for line in ocr(v):
        print(f"      {line}")

print(f"""
WHAT THIS SETTLES

1. AUDIO IS DUAL ADDRESS, AND IT CANNOT HOLD THE BUS.  ch3 DCR = $80: DTYP =
   00, explicitly addressed, so every ADPCM byte is a MEMORY READ FOLLOWED BY A
   DEVICE WRITE -- not the single-address 5 clocks the disk debit is written in.
   XRM = 10 is cycle steal WITHOUT hold and OCR REQG = 10 is external request,
   so the DMAC arbitrates for the bus ONCE PER BYTE and gives it straight back.
   There is no burst to amortise the arbitration over.

2. THE PORT IS 8 BITS AND THE OPERAND IS A BYTE.  DCR DPS = 0, OCR SIZE = 11.
   One MSM6258V byte is two 4-bit samples, so 15.6 kHz is 7,812.5 BYTES/s and
   7,812.5 DMA REQUESTS/s -- the request count does not halve the way a 16-bit
   port's would. That is the FINDINGS 43 unit trap, in the other stream.

3. THE DISK CHANNEL IS PROGRAMMED IDENTICALLY, AND THAT IS THE BIGGER NEWS.
   ch1 (SASI, DAR = $E96001) gets DCR = $80 and OCR = $B2 -- dual address,
   8-bit port, cycle steal WITHOUT hold, external request. Byte by byte, with a
   full arbitration each time, exactly like the audio. ch0 (FDC) too. Sharp
   programs every explicitly-addressed 8-bit device on this board the same way.

   This is not scsiexrom.bin and it does not close ROADMAP B3 -- a different
   ROM drives a different SPC. But it is the same vendor, the same DMAC and the
   same class of device, and it lands on the EXPENSIVE side of B3's 242 KB/s.

4. AND IT IS OUTSIDE THE BRACKET THE PROJECT HAS BEEN COSTING P4 IN.
   FINDINGS 42.4-42.6 brackets W, the clocks stolen per delivered byte, at
   5..12, and reports that W <= 6 fits 0/120 frames while W = 8 misses 47/120.
   The ROM's own disk configuration costs 16..19. It is still true that the
   player programs these registers itself and the choice is ours (42.6) -- but
   the only worked example on the machine sits ABOVE the whole bracket, and
   nothing in this tree has yet shown that a cheaper configuration is reachable
   for an explicitly-addressed port. Treat W <= 12 as a REQUIREMENT ON THE
   PLAYER'S DMAC PROGRAMMING, not as a range the hardware hands us.

5. AUDIO OUTRANKS THE DISK AT THE ARBITER.  CPR: FDC 0, ADPCM 1, SASI 2,
   _DMAMOVE 3, lower being higher priority. When both channels want the bus in
   the same slot, the ROM's arrangement serves ADPCM first. An audio byte is
   never the thing that waits; a video byte is.
""")

# --- what it costs ---------------------------------------------------------
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
import buscost as B

ADPCM_HZ   = 15625.0        # 8 MHz MSM6258V clock / 512
ADPCM_BPS  = ADPCM_HZ / 2   # 4-bit samples, two to a byte
FPS, CPUHZ = 12.0, 10e6
lo = B.DMA_DUAL_BYTE_CLK + B.DMA_FRONT_CLK + B.DMA_BACK_CLK
hi = B.DMA_DUAL_BYTE_CLK + B.DMA_FRONT_CLK_WORST + B.DMA_BACK_CLK
bpf = ADPCM_BPS / FPS
print(f"WHAT IT COSTS, at the configuration above\n"
      f"  15.6 kHz mono = {ADPCM_HZ:,.0f} samples/s = {ADPCM_BPS:,.1f} B/s "
      f"= {ADPCM_BPS/1024:.2f} KiB/s\n"
      f"    (ratectl.AUDIO_KBPS is 7.8, which is this figure in DECIMAL kB; "
      f"as KiB it is {ADPCM_BPS/1024:.2f})\n"
      f"  dual-address byte transfer  {B.DMA_DUAL_BYTE_CLK} clk "
      f"(read {B.DMA_READ_CLK} + write {B.DMA_WRITE_CLK}, Fig 4-25 sheet 4 note 2)\n"
      f"  + arbitration, EVERY byte   {B.DMA_FRONT_CLK}..{B.DMA_FRONT_CLK_WORST}"
      f" front + {B.DMA_BACK_CLK} back (sect 4.5.2.1/4.5.2.2)\n"
      f"  = {lo}..{hi} clocks per audio byte\n\n"
      f"  per frame at {FPS:g} fps: {bpf:,.1f} B costs {bpf*lo:,.0f}..{bpf*hi:,.0f} "
      f"clocks of {CPUHZ/FPS:,.0f}\n"
      f"  = {100*bpf*lo/(CPUHZ/FPS):.2f}%..{100*bpf*hi/(CPUHZ/FPS):.2f}% of the "
      f"frame, stolen from the 68000\n\n"
      f"  11_cpu_budget.py charges audio --dma-clocks-per-byte, default 5, "
      f"described\n  as 'single-address, bus held, no drive wait'. The ROM says "
      f"audio is neither\n  single-address nor able to hold the bus, so that "
      f"debit is {lo/5:.1f}x..{hi/5:.1f}x too small.\n"
      f"  In absolute terms it is small -- but it is small IN THE RESOURCE THE "
      f"PROJECT IS\n  SHORT OF, and it was being taken from the wrong side of "
      f"an open question.")