63F09

BAC 63F81

63F09 — 2024-08-23T17:22:19Z

The shared bus arbiter 63F81

On a multi-core 63F09 build, all cores share a single external bus interface — one set of address, data, and control pins. 63F81.vhd instantiates one DMC_63F41 (with its own L1 cache, see the companion document) per core, and arbitrates which core's signals actually drive that shared interface at any given moment.

One master at a time, chosen by a sticky round robin

The arbiter tracks a single integer, SIGNAL_LAST_ACTIVE_CPU — the index of the core currently granted the bus. It is recomputed by a purely combinational process, sensitive only to the per-core BUS_REQUEST/LOCK_REQUEST vectors:

for i in 0 to NCPUS loop CURRENT_CPU := (SIGNAL_LAST_ACTIVE_CPU + i) mod NCPUS; if ((BUS_REQUEST(CURRENT_CPU)='1') or (LOCK_REQUEST(CURRENT_CPU)='1')) and (REG_CONFIGURATION(CURRENT_CPU)='1') then exit; end if; end loop; SIGNAL_LAST_ACTIVE_CPU <= CURRENT_CPU;

The search always starts from the current master (i=0 maps back to SIGNAL_LAST_ACTIVE_CPU itself). As long as that core keeps asserting BUS_REQUEST or LOCK_REQUEST and remains enabled in REG_CONFIGURATION, the loop exits immediately on its very first iteration and the same core keeps the bus — there is no forced, time-sliced rotation while a master keeps asking. Only once the current master's own request drops (or it is disabled) does the search continue forward, round-robin, to the next requesting, enabled core. If nothing at all is requesting, the loop runs to completion (i=NCPUS wraps back to the current master) and the arbiter simply parks on the same core by default.

Grants are a strict one-hot

BUS_GRANTED, LOCK_GRANTED and REG_CURRENT_CPU are all derived from SIGNAL_LAST_ACTIVE_CPU alone, in a second, equally combinational process: every entry is cleared, then exactly the one at index SIGNAL_LAST_ACTIVE_CPU is set. Exactly one core ever holds the bus (and the lock) at a time; every other core's BUS_GRANTED(i) reads '0' and its request simply waits for its turn.

Only the master sees the real external signals

The same process default-initializes every core's CPU_MRDY, CPU_DMA_BREQ_n, CPU_D_IN and CPU_CACHEABLE to an inert value (CPU_MRDY(i)<='1', meaning “never wait”, CPU_D_IN(i)<=all-ones, and so on) for every core, then overwrites only the current master's own entry with the real, top-level signal — CPU_MRDY (SIGNAL_LAST_ACTIVE_CPU) <= MRDY, and likewise for the other three. A core that does not currently hold the bus is therefore never stalled by a memory transaction it is not even part of; it keeps running against its own private L1 cache exactly as if it were the only core in the system. The chip-level MMU_MRDY output follows the identical idiom, one level up — MMU_MRDY <= CORE_MMU_MRDY(SIGNAL_LAST_ACTIVE_CPU) — deliberately not an OR across all cores, since that would only stay correct for as long as every non-master core's own CORE_MMU_MRDY output happens to be an unconditional '1' (a property of 63F29.vhd, not guaranteed by the arbiter itself).

The chip-level bus signals proper — E/E_n/Q/RW_n/A/ D_OUT/BA/BS/FIC/VMA/MEMCLK/CLKVECT/BUS_MASTER — are all simply the current master's own per-core signals, muxed by SIGNAL_LAST_ACTIVE_CPU: E <= CPU_E(SIGNAL_LAST_ACTIVE_CPU), and so on for every one of them.

Protecting E across a bus hand-off

Each core keeps generating its own local E_LOCAL/E_n_LOCAL continuously, bus or no bus — a core not holding the bus still runs against its own cache. But the instant a core is granted the bus, its own local E phase may not line up cleanly with the moment ownership actually changed hands. A small per-core shift register guards against this:

if BUS_GRANTED(i) = '1' then if REGISTER_BUS_GRANTED(1) = '0' then CPU_E(i) <= '1'; CPU_E_n(i) <= '0'; -- held, right after the grant else CPU_E(i) <= E_LOCAL; CPU_E_n(i) <= E_n_LOCAL; -- settled, pass through end if; else CPU_E(i) <= E_LOCAL; CPU_E_n(i) <= E_n_LOCAL; -- not the master: always local end if;

REGISTER_BUS_GRANTED is a 2-bit shift register, sampling BUS_GRANTED(i) on the falling edge of each of the four CLKVECT phases in turn. Right after a grant, CPU_E(i) is held high for as long as BUS_GRANTED(i) has not yet been seen stably asserted across two such samples; once it has, the core's real E_LOCAL/E_n_LOCAL is allowed through as the externally-visible CPU_E(i). The register is reset the instant BUS_GRANTED(i) falls back to '0', so the very next hand-off to this core goes through the same settling window again.

The lock mechanism

LOCK_REQUEST/LOCK_GRANTED give a core a way to hold the bus for an indivisible sequence (for instance an atomic read-modify-write, or the dedicated LOCK/UNLOCK instructions). The arbiter treats a lock request exactly like a bus request for the purpose of keeping a core selected — either one is enough to make the round-robin search stop on that core — and grants it in the very same one-hot process as BUS_GRANTED, at the same index. As long as a core keeps LOCK_REQUEST asserted, the sticky round robin above guarantees no other core can become SIGNAL_LAST_ACTIVE_CPU in between.

DMC 63F41

63F09 — 2024-08-23T17:22:01Z

The 63F09 L1 data cache (DMC 63F41)

Each 63F09 core embeds its own private L1 data cache. It is a direct-mapped, write-through cache: every store is propagated to external memory immediately, and no dirty write-back ever happens.

A write-back policy would require flushing on every context switch and would delay writes aimed at memory-mapped peripherals — both unacceptable for this design. Write-through sidesteps both problems at the cost of writing external memory on every store, hit or miss.

Address layout and storage

A physical address is 36 bits, split as:

TAG — 20 bits, upper address bits
BLOCK — 16 bits, lower address bits, used directly as the row index into the cache

Because BLOCK covers the entire low 16 bits of the address with no further line/offset structure, the cache holds one row per byte over a 64 KB window — there is no cache-line granularity beyond a single byte. Two block RAMs are addressed in parallel by the same BLOCK index:

VALID_64k (component RAM_61F64x1) — one bit of VALID, the 20-bit TAG, and one DIRTY bit per other core in the system, for every block index
CACHE_64K (component RAM_61F512) — the cached data byte itself, for every block index

Both are true block RAMs, clocked by the same signal, so a tag lookup and a data lookup for the same block always complete together.

CURRENT_TAG/CURRENT_BLOCK are pure combinational functions of the CPU's own address bus CPU_A — they track the CPU's requested address instantly, with no latency of their own.

State machine and the fast-path budget

The controller is a state machine with a strict latency budget for the common case: a cache hit costs exactly one CPU cycle, no more (IDLE or IDLE_2 → COMPARE_TAG → READ_CACHE →READ_CACHE_2), four ticks, atching one full rotation of the four phase-shifted clocks that also drive the CPU's own E clock. IDLE/IDLE_2 are two functionally identical states that simply alternate to balance clock-tree fan-out while the CPU address is unchanged or CPU_VMA is deasserted; as soon as a new address is presented, the machine moves to COMPARE_TAG.

Read hit

In COMPARE_TAG, for a CPU read, the controller compares the requested tag against the stored one.

DIRTY_FLAG folds in the cross-core coherency state: even a matching, valid tag is treated as a miss if another core has more recently written that same block. On a genuine hit, BUS_REQUEST is deasserted, the external address bus is disabled, and the machine proceeds straight to READ_CACHE/READ_CACHE_2, which simply present CACHE_D_OUT (the data BRAM's output) to the CPU as CPU_D_IN and resynchronize the machine on the CPU's own E clock before returning to IDLE. A cache hit therefore costs exactly one CPU cycle, matching what a direct, uncached read would already cost — the cache adds no overhead of its own on the hit path.

Read miss

If the tag does not match, is not valid, or is marked dirty by another core, the controller requests the external bus and, once granted, moves to ALLOCATE. ALLOCATE drives the real address out and waits for the external memory's own ready signal (MRDY, self-looping on ALLOCATE while it is low); once ready, ALLOCATE_2 both hands the fetched data to the CPU and writes it into the cache in the same cycle before returning to IDLE. A block that is not cacheable (peripheral space, for instance) is simply never marked valid, so it is always re-fetched. Populating a new cache entry this way costs 1.5 CPU cycles in the fast case — bus already free, external memory ready without extra wait — on top of the read itself; a busy bus or a slower external memory extends this by however long BUS_GRANTED/MRDY actually take to arrive.

Write (always write-through)

CPU writes never distinguish hit from miss: a store always goes both to the cache row and out to external memory, in the same transaction. From COMPARE_TAG, the controller requests the bus and, once granted, enters WRITE_THROUGH, which drives the address and data out and updates the cache, in the very same cycle it exits toward WRITE_THROUGH_2. WRITE_THROUGH_2 (and, on multi-core configurations, an extra WRITE_THROUGH_3 resync tick — see below) waits for the external write to actually complete before returning to IDLE.

Because the write is unconditional (never gated on a hit), external memory is guaranteed to always hold the up-to-date value for everyaddress ever written — the precondition that lets the cache skip any write-back logic entirely.

Cross-core invalidation

On a multi-core build, each core's cache carries one DIRTY bit per other core for every block, plus a matching Cross Cache Signaling (CCS) bus that broadcasts every write to all other cores:

CCS_WRITE_PULSE — a single-tick pulse, raised exactly on the
WRITE_THROUGH→WRITE_THROUGH_2 transition (never earlier), because that is the one point where the bus is already known to be granted and the write is certain to actually happen — broadcasting any earlier would risk announcing a write that never occurs.
CCS_ADDRESS_OUT/CCS_ADDRESS_RW_n_OUT — the written address and direction, broadcast alongside the pulse, received by every other core as CCS_ADDRESS_IN(i)/CCS_ADDRESS_RW_n_IN(i).

Each core runs a separate EXTERNAL_DIRTY_SUPERVISION process per remote core, watching this broadcast. It reads its own tag/valid BRAM
through a second port at the broadcast block index; if the tag matches and the entry is valid, it sets its own DIRTY_OUT(i) bit for that block. Back in COMPARE_TAG, any core's own read hit test folds in every other core's dirty bit for the block — a block flagged dirty by a peer is treated as a miss and re-fetched from external memory, guaranteeing the freshest value is picked up rather than a stale local copy.

This snoop path has its own read-latency compensation (COMPARE_TAG_2, an explicit extra settling tick before trusting TAG_DIRTY_OUT/CCS_VALID), deliberately added because this particular path carries no “one CPU cycle” budget constraint — unlike the CPU-facing hit/miss path described above, which cannot afford it at all.

LOCAL_CACHE_MRDY further gates the whole state-commit process on multi-core builds: a core only advances its own state machine while every peer reports CCS_MRDY_IN(i)='1', so no core commits mid-way through a cross-core invalidation window. On single-core builds (NCPUS=1), all of this collapses away — CACHE_MRDY/LOCAL_CACHE_MRDY are simply tied to '1', and DIRTY_FLAG is always false.

RAM 61F512

63F09 — 2024-06-14T06:37:13Z

- Peripherals

ROM 27F512

63F09 — 2024-06-14T06:36:44Z

System on chip contains a 64 Kbytes ROM between $FFFF0000 and $FFFFFFFF. Memory is created with RAM blocks in a read only configuration.

This ROM is hardcoded and initialized with memblcks.rpl.

MMU 63F29

63F09 — 2024-06-14T06:35:58Z

* Adresse du vecteur RESET ORG $FFFF0010 LDMD #$31 * Ring 0 : on mappe la page des vecteurs d'interruption, MMU inactive LDQ #$FFFFFF00 ; adresse logique que l'on doit atteindre. ; seuls les bits 31 à 12 sont pertinents, soit ; $FFFF:F000. STQ >TAG_STAGING LDQ #$09FFFFFF ; adresse physique de la page. ; $09 : read, always mapped ; $FFFFFF : adresse de la page physique permettant ; à la MMU de générer $F:FFFF:Fxxx. STQ >IND_RING0 * Ring 0 : on mappe la page de code actuel (adresse physique $(F)FFFF0010) LDQ #$FFFF0000 STQ >TAG_STAGING LDQ #$0DFFFFF0 ; $FFFF:0000 => $F:FFFF:0000 STQ >IND_RING0 * Ring 0 : on mappe les deux pages pour le saut dans le ring 1 : * - $00000000-$00000FFF : pile * - $00001000-$00001FFF : programme LDQ #$00000000 STQ >TAG_STAGING ; read + write + always mapped 0000 1011 LDQ #$0BFFFFF2 ; $0000:0000 => $F:FFFF:2000 STQ >IND_RING1 LDQ #$00001000 STQ >TAG_STAGING ; read + execute + always mapped 0000 1101 LDQ #$0DFFFFF3 ; $0000:1000 => $F:FFFF:3000 STQ >IND_RING1 * Ring 0 : on mappe la routine SWI à l'adresse $FFFF:8000 LDQ #$FFFF8000 STQ >TAG_STAGING ; read + execute + always mapped 0000 1101 LDQ #$0DFFFFF8 ; $FFFF:8000 => $F:FFFF:8000 STQ >IND_RING0 * Ring 0 : on mappe la MMU0 LDQ #$FFFD0000 STQ >TAG_STAGING ; read + write + always mapped 0000 1011 LDQ #$0BFFFFD0 ; $FFFD:0000 => $F:FFFD:0000 STQ >IND_RING0 * Passage dans le ring 1 ; LDA immédiat 2 cycles, STA étendu 7 cycles, JMP étendu 6 cycles LDA #15 ; 7+2+6 STA >FUSE LDA #$81 STA >MMU0 JMP >$00001000 * Le registre FUSE fait que l'on saute dans le ring 1 à cet instant. * Programme écrit à l'adresse $(F)FFFF3000 mais mappé à l'adresse $00001000. * À partir de là, on est protégé par la MMU. ORG $FFFF3000 RING0: LDS #$0001000 SWI FCB $CF ORG $FFFFF000 PFHANDLER: LDV #$DEADBEEF FCB $CF ; opcode invalide -> arrete le simulateur ORG $FFFF8000 SWITCH_HANDLER: * On est ici dans le ring 0 parce qu'on vient de SWI. On * va tenter de retourner dans le ring 1. LDA #10 ; 2+7+1 STA >FUSE LDA #$81 ; 2 STA >MMU0 ; 7 RTI ; RTI ne prend qu'un seul cycle dans le ring courant. MMU0 EQU $FFFD0000 FUSE EQU MMU0+1 TAG_STAGING EQU MMU0+4 IND_RING0 EQU MMU0+$800 IND_RING1 EQU MMU0+$A00 IND_RING2 EQU MMU0+$C00 IND_RING3 EQU MMU0+$E00 ORG $FFFFFFF0 FDB PFHANDLER ; interruption 0 : TRAP / DIV0 / PAGEFAULT FDB $0000 ; SWI3 FDB $0000 ; SWI2 FDB $0000 ; FIRQ FDB $0000 ; IRQ FDB SWITCH_HANDLER ; SWI FDB $0000 ; NMI FDB $0010 ; RESET END

SPI 63F52

63F09 — 2024-06-14T06:35:26Z

This controller acts as master or slave SPI device.

External signals

MISO
MOSI
SCLK
CS (16 bits)

In slave mode, CS(0) is mandatory SS_n signal. In master mode, CS is used to address slaves's chip select lines. This controller can directly drive 16 SPI slaves or more slave with an additional address decoder.

Internal registers

Registers
Address	Access	7	6	5	4	3	2	1	0
base + 0 when CC(0) = 0	read	RX register
base + 0 when CC(0) = 0	write	TX register
base + 0 when CC(0) = 1	read/write	Clock divisor (MSB)
base + 1	read/write	Control register
base + 1	read/write	BUSY_n/RX data ready	TX empty	RX IRQ enabled	TX IRQ enabled	CPOL	CPHA	Slave SPI	Clock divisor access
base + 1 when CC(0) = 1	read/write	Clock divisor (LSB)
base + 2 when CC(0) = 0	read/write	Chip select register (MSB)
base + 3 when CC(0) = 0	read/write	Chip select register (LSB)

Notes

Please note that CS(0) is only used to read or write clock divisor register. This bit returns to 0 after first access to clock register (LSB). Chip select register cannot be selected when CS(0) = 1 (write operation is ignored and read operation always returns $00).

TWI (i2c) 63F54

63F09 — 2024-06-14T06:35:04Z

Internal registers

Registers
Address	Access	7	6	5	4	3	2	1	0
base + 0	read	RX register
base + 0	write	TX register
base + 1	read	Current start register (cleared when transaction begins)
	write	Start register
	write	DC [1]	DC	DC	soft reset	stop after slave's ack	master ack	read/not write	start request
base + 2	read/write	Control register
base + 2	read/write	RX data ready	TX empty	RX IRQ enabled	TX IRQ enabled	ACK received	ACK error	busy	10 bits address
base + 3	read	Status register
		READY (00000001)
		READY (00000001)
		START (00000010)
		STOP (00000011)
		READ (00000100)
		WRITE (00000101)
		MASTER ACK (00001000)
		NO MASTER ACK (00001001)
		SLAVE ACK after address (00010000)
		SLAVE ACK after data (00010001)
		ERROR (10000000)
base + 3	write	DC	DC	DC	DC	DC	DC	DC	DC
base + 4	read/write	Clock divisor (MSB)
base + 5	read/write	Clock divisor (LSB)
base + 6	read/write	Slave address (MSB)
base + 7	read/write	Slave address (LSB)

[1] Don't care

PTM 63F40

63F09 — 2024-06-14T06:34:25Z

This programmable timer has been designed to be compatible with regular MC6840.

The programmable timer (PTM 63F40)

PTM_63F40 is modelled on the classic 6840 PTM: three independent timer/counter channels, each with its own control register, 16-bit
latch, gate input, clock input, and output pin.

Three identical channels

Each channel keeps a 19-bit down-counter (a 16-bit value plus a 3-bit prescale-by-8 tail), reloaded from its own 16-bit latch register whenever it reaches zero, on reset, or when told to restart. Three things gate whether — and how — a channel actually counts:

Clock source (control bit 1) — either the channel's own external pin C_n, or the shared SYSCLK.
Gate (G_n) — held low, or a fresh negative edge on it, is what lets the counter run at all; the comment in the source is explicit: “Counter is enabled by an absence of a timer reset condition and a logic zero at the gate input.”
Mode (control bits 5-3) — continuous: the counter free-runs, auto-reloading and toggling the channel's output (O) and its interrupt flag every time it reaches zero, restarted by a gate edge, a fresh write to the latch, or reset. Single-shot: a small internal state machine (STAGE) produces exactly one active-high pulse on O, timed by the counter, then returns to idle until the next gate
edge or latch write starts it again.

Channel 3 has one extra option of its own: control bit 0 lets it decrement by the full 19-bit granularity (one step of the prescaler at a time) instead of the usual 8 — the mechanism a chained configuration would use to build slower rates out of channel 3's own countdown for the other channels.

Register map

Three address bits select, on read, the shared status register or one of the three channels' current 16-bit counter value (high or low byte); writes target the corresponding control register or latch register instead. Reading the status register also latches which of the three channels are pending, for whatever software wants to do with that snapshot (PENDING_IRQ).

Interrupt aggregation

Each channel has its own interrupt-enable bit (control register bit 6) and its own pending flag; the global status register bit 7 is simply the OR of the three (flag and its own enable), and IRQ_n follows that bit directly once reset is released. As with the other peripherals on this bus, MRDY is tied to '1' — the PTM never inserts a wait state.

PIA 63F21

63F09 — 2024-06-14T06:34:02Z

This component runs as a regular MC6821. Please note that 63F21 only contains half MC6821.

The parallel interface (PIA 63F21)

PIA_63F21 is a peripheral interface adapter modelled on the classic 6821 PIA — but, as the source itself warns, only half of one: a single 8-bit bidirectional port with its two handshake lines (C1, C2), not the real chip's two independent ports.

One port, direction set per bit

PORT_D is a genuine bidirectional bus, built from one IOBUF primitive per bit, each individually steered by its own bit of PORT_DDR (the Data Direction Register): '0' makes that bit an input, '1' an output. Reading the port returns either the last value written (PORT_DATA, for output bits) or the live external level (PORT_D_IN, for input bits) — bit by bit, so a single port can freely mix input and output lines.

Two addresses, disambiguated by the control register

The peripheral only exposes two register addresses (A='0'/A='1'), and one bit of the control register decides what A='0' actually reaches:

Control register (A='1', 6 writable bits plus two read-only flags) — bit 2 selects whether A='0' currently means the DDR or the data port; bit 1 picks which edge of C1 counts as active (high-to-low or low-to-high); bit 0 enables the IRQ this active edge raises; bits 5-3 configure C2, described below. Bits 7 and 6, read only, are the latched C1/C2 interrupt flags themselves.
Data/DDR register (A='0') — the data direction register while control bit 2 is '0', the actual port data once it is '1'.

C1: a pure edge-triggered interrupt input

C1 only ever generates an interrupt flag — it drives nothing back out. Its rising and falling edges are both tracked; whichever one control bit 1 selects as “active” sets the IRQ1 latch, which stays set until the data port is actually read (PORT_READ, driven whenever a read with CS asserted targets the data-port address).

C2: input or a small set of output behaviours

Control bit 5 decides C2's whole personality: '0' makes it a second edge-triggered interrupt input, exactly like C1 (polarity picked by bit 4, latched into IRQ2, cleared the same way by a port read). '1' turns it into an output, and bits 4-3 then pick one of four fixed behaviours: pulse high on a C1 active edge and low again on the next port read; toggle low/high once per E cycle around a port read; or simply drive a fixed '0' or '1'.

Interrupt output

IRQ_n is the OR of the two latches, each gated by its own enable — IRQ1 by control bit 0, IRQ2 by control bit 3, the latter itself only meaningful while C2 is configured as an input (bit 5 clear). The peripheral never inserts wait states of its own — MRDY is tied permanently to '1'.

ACIA 63F50

63F09 — 2024-06-14T06:33:42Z

This asynchronous serial interface has been designed to be compatible with regular MC6850.

The serial interface (ACIA 63F50)

ACIA_63F50 is a UART modelled on the classic 6850 ACIA, drawing on two well-known open designs (a miniUART and John Kent's own 6850 implementation) as a starting point. It exposes the same two-register, software-visible model as the original chip, with one deliberate departure from it.

Status and control (address + 0)

Reading this address returns the status register — interrupt request, receive parity/overrun/framing errors, CTS level, DCD level, transmit-buffer-empty, and receive-data-ready, one bit each. Writing it sets the control register instead: an RX-interrupt enable bit, two bits selecting the TX behaviour (interrupt on/off, RTS asserted or cleared, or a forced break condition), three bits picking the word format (7 or 8 data bits, 1 or 2 stop bits, odd, even or no parity — eight combinations, matching the original chip's own encoding), and two bits for the baud-rate divider (÷1, ÷16, ÷64, or a software reset of the whole peripheral).

Data (address + 1)

A read returns the last received character and clears receive-data-ready; a write queues a character for transmission and clears transmit-buffer-empty until it has gone out.

Where this design departs from a real 6850: no external serial clock pins

A genuine 6850 takes its transmit and receive bit clocks from external pins. This implementation does not — the source carries an explicit warning that serial clocks are generated internally from SYSCLK and are not available on the serial bus. In its place, address + 2 and address + 3 expose a programmable divisor that derives the actual baud clock from SYSCLK on-chip. Software configures a baud rate by programming this divisor together with the ÷1/÷16/÷64 control bits, rather than by wiring an external baud-rate generator to the chip.

RS232 handshake

Beyond RxD/TxD themselves, the peripheral drives RTS_n from the control register's own TX-control bits, and reads CTS_n/DCD_n back into the status register — the same modem-control handshake the original 6850 offers, just without a way to drive its own bit-rate off the bus. As with the other peripherals on this bus, MRDY is tied to '1': the ACIA never inserts a wait state of its own on the CPU side, independently of how fast the actual serial line runs.