badline 0.11.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f8a451e4b936c57d5cf39cc7253481e5c8deff31898cb015641ed54246a68da
-  data.tar.gz: 8d1e5c8aab0d9352e31a5f7b870896aaec254dbcd55c823fe24496d820b2befc
+  metadata.gz: 7e5111f801416999c9748d88475f3bdb54e1a1b4b25b3a4246a64c4b3b59bdd0
+  data.tar.gz: c924f57fce55ffd0e9c6134c22618106828e831feed277411e8e6d56bec7c3aa
 SHA512:
-  metadata.gz: d97d1b2876eafb8a51cd290c651904c798be975e0f3f7ea9ba4960a3dcaeebb6a76cc9cdad8bb5bf3ac5c732af3ec0eeddb779916b9e793292350d0749ed730f
-  data.tar.gz: 2b7f0307a605b0270490ae3155c1671e1197473a0c22edf836bce953c08ff8884d1b09ca92fd7b3bc8c4038de63b66d5b92e3e82297ecfaddd5cde592ef74493
+  metadata.gz: 6a7f251456552573fab6b3041c4cc0c2ce83550c81547953ba9bfb6550e331458bf307f58a3e47ffd2bfaa98cb5c7f8938adc7c68299e1ffd6adb604460f0241
+  data.tar.gz: 66632ccc5e1851a028837833e792a4ce2ff71cdd1e66113bed8b652618e73d0c90990359b00812c6368f949db6532b46a43684bf2d9c3334ab9876e7ea6836b6

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.12.0](https://github.com/elektronaut/badline/compare/v0.11.1...v0.12.0) (2026-10-10)
+
+
+### Features
+
+* add the 1581's WD1772 and its .d81 disks at sector level ([b834218](https://github.com/elektronaut/badline/commit/b834218bb686ceef295f2aafada86910fe8b61a2))
+* boot C128 boot disks such as CP/M at power-on ([69359b6](https://github.com/elektronaut/badline/commit/69359b60bfe91ec0d9634e3dec4e4039044814e7))
+* emulate the 1581 drive on the C64, the VIC-20 and the C128 ([4696c5b](https://github.com/elektronaut/badline/commit/4696c5b205689b2a86f91503ce153a63ff0f6816))
+* put the C128's Z80 on its bus and boot the C128 through it ([b3d0e60](https://github.com/elektronaut/badline/commit/b3d0e603a8dc606d090917a67a52c4f31854f307))
+
+
+### Bug Fixes
+
+* let the 1571's WD1770 run its commands, so CP/M's disk BIOS finds no MFM disk ([a380768](https://github.com/elektronaut/badline/commit/a380768ae02ce5da33e73dc23147b4edb72c72ff))
+* parse --at insert of a disk list without the rest of badline ([5d6b93a](https://github.com/elektronaut/badline/commit/5d6b93a86cf4b57be3312bfb7da32980d38f2800))
+* save the KCS Power cartridge's I/O RAM in snapshots ([54fab40](https://github.com/elektronaut/badline/commit/54fab408d0d7447d5b7b977905aa7aaabf8ad92a))
+* uninstall the serial traps when the VIC-20 unmounts ([b2acc3f](https://github.com/elektronaut/badline/commit/b2acc3ff495f10ec5bff3b56aae0e89b2741bd34))
+
+## [0.11.1](https://github.com/elektronaut/badline/compare/v0.11.0...v0.11.1) (2026-10-09)
+
+
+### Features
+
+* emulate the C128D's 1571 drive in 1541 and 1571 mode ([2c32d99](https://github.com/elektronaut/badline/commit/2c32d993a0449b4b537d5f82e9711b0e14604f95))
+* fast serial between the C128 and its 1571 ([34fe02f](https://github.com/elektronaut/badline/commit/34fe02f2098664c94233da9e40828b40e41b6b1a))
+
 ## [0.11.0](https://github.com/elektronaut/badline/compare/v0.10.1...v0.11.0) (2026-10-09)
 
 

data/CLAUDE.md

@@ -49,8 +49,9 @@ requires only the namespace file.
 | --- | --- | --- |
 | rspec (`spec/`) | `bundle exec rspec` | Unit behaviour, all of `lib/` |
 | SingleStepTests 65x02 | `rake test` (100 sampled cases per opcode) | CPU, per-cycle bus traces |
+| SingleStepTests z80 | `rake test` (the first 100 cases per opcode, `Z80_SAMPLE=all` for all 1,604,000) | `Z80`: registers, flags, ports and the bus pins on every T-state |
 | Wolfgang Lorenz suite | `bin/lorenz` | CPU, CIA, interrupts |
-| VICE testbench | `bin/testbench <subtree>` | `VICII/`, `CIA/`, `interrupts/`, `CPU/`, cartridges with `--carts`, the true 1541 drive with `--drive`, the VIC-20 with `--vic20`, and the C128 in C64 mode with `--c128c64` |
+| VICE testbench | `bin/testbench <subtree>` | `VICII/`, `CIA/`, `interrupts/`, `CPU/`, cartridges with `--carts`, the true 1541 drive with `--drive`, the VIC-20 with `--vic20`, the C128 in C64 mode with `--c128c64`, in C128 mode with `--c128`, and its Z80 with `--c128-z80` |
 | VICE SID testprogs | `bin/sidtests` | SID |
 | Drive scenarios | `bin/drive_scenarios` | The true 1541 running the DOS ROM: save, format, the error channel, idle, write protect and autostart |
 | CIA offline grids | `bundle exec rspec --tag slow spec/badline/cia` | CIA timers and shift register, against a bare CIA in about 2 min |
@@ -103,7 +104,7 @@ worktree and owns a different set of files.
 - The external suites under `vendor/` are gitignored, so a new worktree has
   only `vendor/.gitkeep`. From the worktree root, symlink the main
   checkout's suites into it:
-  `for d in 65x02 VICE-testprogs; do ln -sfn ../../../../vendor/$d vendor/$d; done`.
+  `for d in 65x02 z80-sample VICE-testprogs; do ln -sfn ../../../../vendor/$d vendor/$d; done`.
   The main checkout also has `vendor/OneLoad64-Games-Collection-v5`, which
   `rake vendor:checkout` doesn't fetch. Link it the same way only for
   `.sid` or media work. Don't re-run `rake vendor:checkout` there, and
@@ -129,12 +130,29 @@ worktree and owns a different set of files.
 
 ## Testing and baselines
 
-- `rake vendor:checkout` fetches SingleStepTests and VICE-testprogs into
-  `vendor/`
+- `rake vendor:checkout` fetches SingleStepTests 65x02, the Z80 sample
+  and VICE-testprogs into `vendor/`
 - `bundle exec rspec`: line coverage is about 97%. `spec/spec_helper.rb`
   fails a whole-suite run (every spec file, no filters) below 90%, while
   single-file and filtered runs skip the floor. `:slow` specs are excluded
   by default: run them with `bundle exec rspec --tag slow`
+- `bundle exec parallel_rspec` is the whole run, `:slow` specs included,
+  in a process per core, held to the same 90% over the merged coverage.
+  CI runs it as two jobs, the plain examples (with the floor) and the
+  `:slow` ones. Agents run only the spec files they touch, with
+  plain `bundle exec rspec`, and leave whole runs to CI
+- Keep each plain example to a few hundred ms. A million cycles of a C64 or
+  a C128 cost 3 to 5 s of CPU, and about three times that under coverage,
+  so an example that boots a machine or runs more than about a million
+  cycles goes under `:slow`
+- Don't boot per example. Restore a machine from a State taken once
+  (`spec/support/taken_once.rb`), and share one machine between examples
+  that only read it. Assert on the cheapest oracle that proves the point: a
+  register or a RAM byte over a booted screen, a bare chip over a whole
+  machine, and the fewest cycles that reach the state
+- Before opening a pull request, run `bundle exec rspec --profile 10` (with
+  `--tag slow` for `:slow` ones) on the spec files you added or changed,
+  and hold them to that budget
 - `rake test`: SingleStepTests, plus the Minitest tests for the regression
   runners in `test/`. Run it for any CPU change
 
@@ -198,13 +216,13 @@ the 6526A) for anything the interrupt register or the CIA model reaches; cartrid
 `testbench-drive` (`bin/testbench --drive`) and `drive-scenarios` (`bin/drive_scenarios <filter>`), plus `testbench-vic20` for the VIA; the VIC-20 (`vic20/`) →
 `testbench-vic20` (`bin/testbench --vic20`); the C128 (`c128.rb`, `c128/`), or
 the VIC-IIe, CPU or PLA code it shares with the C64 → `testbench-c128c64`
-(`bin/testbench --c128c64`); SID → `sid`, plus `sid-8580` for anything the 8580
+(`bin/testbench --c128c64`); the C128's Z80, MMU or hand-over → `testbench-c128-z80` (`bin/testbench --c128-z80`) and `testbench-c128`; SID → `sid`, plus `sid-8580` for anything the 8580
 model reaches (`bin/sidtests --sid 8580`). Leave the Lorenz chain to CI,
 unless your code has a rule in `doc/pinned-behaviour.md` that names Lorenz
 tests: the interrupt polling, CPU port and CIA timer rules. Run just the
 tests that rule names, one at a time, with
 `ruby --yjit bin/lorenz --resume <test> --stop-after <test>`. A stretch
-resumes on a fresh machine, so its cuts in the Rakefile have to stay before
+resumes on a fresh machine, so its cuts in `test/support/suites.rb` have to stay before
 `trap1`, where the tests start carrying state from one to the next. Both Lorenz
 and testbench load through the LOAD trap and type through the keyboard
 buffer, so storage, IEC and keyboard changes can move them too. A broken

data/CONTRIBUTING.md

@@ -55,25 +55,31 @@ brew install sdl2           # macOS
 apt install libsdl2-2.0-0   # Debian/Ubuntu
 ```
 
-Install the dependencies and run the specs:
+Install the dependencies and run the whole suite, a process per core, as
+CI does:
 
 ```sh
 bundle install
-bundle exec rspec
+bundle exec parallel_rspec
 ```
 
-A run of the whole suite fails if line coverage drops below 90%. Runs of
-single files or filtered examples skip that check. Specs tagged `:slow`
-boot the whole machine and are skipped by default. Run them with
-`bundle exec rspec --tag slow`.
+A run of the whole suite fails if line coverage drops below 90%. Run
+single files or filtered examples with `bundle exec rspec`, which skips
+that check. Specs tagged `:slow` boot the whole machine, and a plain
+`bundle exec rspec` skips them. Run them with `bundle exec rspec --tag slow`.
 
 The CPU is verified separately against the
-[65x02 single step tests](https://github.com/SingleStepTests/65x02).
-`rake test` checks the fixtures out into `vendor/65x02` first, which
-takes a moment the first time:
+[65x02 single step tests](https://github.com/SingleStepTests/65x02), and
+the Z80 against the [Z80 ones](https://github.com/SingleStepTests/z80).
+`rake test` checks the 65x02 fixtures out into `vendor/65x02` first,
+which takes a moment the first time. For the Z80 it fetches only the
+first 100 cases of each opcode's file into `vendor/z80-sample`.
+`Z80_SAMPLE=all` checks the whole Z80 suite out into `vendor/z80`
+(about 1.5 GB) and runs every case:
 
 ```sh
 bundle exec rake test
+Z80_SAMPLE=all bundle exec rake test
 ```
 
 Check style before pushing:

data/README.md

@@ -125,7 +125,7 @@ library, are covered in [doc/library.md](doc/library.md).
 | Format | Handling |
 |--------|----------|
 | `.prg`, `.p00` | Loaded into memory after boot. A program at the BASIC start (`$0801`) is `RUN`, anything else is left for you to `SYS` |
-| `.d64`, `.d71`, `.d81` | Mounted as device 8, then `LOAD"*",8,1` and `RUN`. Write-protected unless `--writable` |
+| `.d64`, `.d71`, `.d81` | Mounted as device 8, then `LOAD"*",8,1` and `RUN`. On a C128 in C128 mode a boot disk goes in a true drive instead and boots at power-on. See [Media](doc/media.md#c128-boot-disks). Write-protected unless `--writable` |
 | `.g64` | Put in a true 1541, then `LOAD"*",8,1` and `RUN`. It holds the disk's raw GCR, so copy protection that reads it works. Write-protected unless `--writable` |
 | `.m3u`, `.vfl` | A list of disk images, one path a line, relative to the list: an `.m3u` playlist, or a VICE flip list, which only unit 8's entries are taken from. Its first disk goes in as above, and the list is its set for the pause menu |
 | `.t64` | Mounted read-only as device 8 and loaded like a disk image. The files load by name, and no tape is involved |
@@ -139,7 +139,8 @@ Without `--true-drive`, device 8 is no drive at all but traps on the
 KERNAL's disk routines. Loading is instant, but fast loaders and copy
 protection that run code on the drive need `--true-drive`, which puts
 an emulated 1541 there, running its own DOS at a real 1541's speed. Its
-red LED lights in the bottom right corner of the border.
+red LED lights in the bottom right corner of the border. With
+`--true-drive`, a `.d81` goes in an emulated 1581 in place of the 1541.
 [doc/media.md](doc/media.md) has the details, and how to attach media
 from Ruby.
 
@@ -184,8 +185,12 @@ starts, and a `.sid` tune start C64 mode the same way, and so does a C64
 cartridge, through the KERNAL. `GO64` gets there from BASIC 7.0. A
 program that loads at `$1C01`, where BASIC 7.0 starts, runs, and other
 programs load at their own address. The disk in device 8 is served
-through the KERNAL traps in either mode. The C128's Z80 isn't emulated:
-the 8502 starts the machine. `--model` picks the board: `c128` (the default, the flat C128
+through the KERNAL traps in either mode, or with `--true-drive` by the
+C128D's 1571. A boot disk boots in C128 mode, as on a real C128: CP/M's
+system disks, a `.d81` such as VICE-testprogs' `c128-cpm/cpm3.d81` on a
+1581 among them, and boot games. `badline c128 cpm3.d81` comes up at
+CP/M's `A>` prompt. The Z80 starts the machine, as on a real C128, and hands
+it to the 8502. `--model` picks the board: `c128` (the default, the flat C128
 and the plastic C128D, PAL, with the 6581 SID and a VDC with 16K of
 RAM), `c128dcr` (the metal C128DCR, with the 8580, 6526As and a VDC with
 64K), and `c128ntsc` and `c128dcrntsc` for their NTSC versions. `--sid`
@@ -348,8 +353,14 @@ program or `.sid` dropped on it opens the menu to ask first.
 - **C128**: C128 mode with BASIC 7.0 and C64 mode, on the 8502 with its
   port, FAST mode, the VIC-IIe with its extra keyboard lines, the 8722
   MMU, the 8563 or 8568 VDC with its 80 column display, and 128K of RAM
-  (`badline c128`). The Z80 and the 1571 aren't emulated yet.
+  (`badline c128`), and the Z80, which boots the machine.
 - **1541**: an emulated drive running its own DOS (`--true-drive`).
+- **1571**: the C128D's drive running DOS 3.0, in 1541 mode and in 1571
+  mode at 2 MHz with both sides of a `.d71` or `.g71`, and fast serial
+  (burst) to a C128 in C128 mode (`badline c128 --true-drive`).
+- **1581**: the 3.5" drive running its own DOS on its WD1772 and 8520,
+  reading and writing `.d81` images, on the C64, the VIC-20 and the C128
+  (`--true-drive` with a `.d81`).
 - **Cartridges**: standard 8K, 16K and Ultimax, Simons' BASIC, Ocean,
   Fun Play / Power Play, Super Games, Epyx FastLoad, Westermann
   Learning, Rex Utility, C64 Game System / System 3, Dinamic, Zaxxon /

data/doc/media.md

@@ -36,6 +36,31 @@ drive's red LED lights in the bottom right corner of the border.
 A `.g64` holds the disk's raw GCR, half tracks and all, so copy
 protection and fast loaders that read it work.
 
+## The true 1581
+
+With a true drive on device 8, a `.d81` goes in an emulated 1581 in
+its place: the 3.5" drive's own DOS on its 6502, with its WD1772 reading
+and writing the image's sectors and its 8520 on the serial bus. Another
+disk image swaps the 1541 (or on the C128 the 1571) back in. On the
+C128 in C128 mode the 1581 talks fast serial (burst), as the 1571 does.
+
+## C128 boot disks
+
+At power-on the C128 KERNAL reads track 1, sector 0 of the disk in
+device 8, and when the block starts with `CBM` it loads and runs it.
+CP/M's system disks and boot games boot that way. A 1581 first loads and
+runs a `USR` file named `COPYRIGHT CBM 86` when the disk has one, which
+is how CP/M's 1581 disks hand the KERNAL their boot block.
+
+On a C128 in C128 mode, a `.d64`, `.d71` or `.d81` that boots, with that
+block or that file, goes in a true drive as device 8, a 1581 for a
+`.d81` and the C128D's 1571 otherwise, and nothing is typed, so the
+KERNAL boots it. `badline c128 cpm3.d81` comes up at CP/M's `A>`
+prompt. Other disks keep the traps and `LOAD"*",8,1`, `--true-drive`
+puts any disk in a true drive, and on the C64, the VIC-20 and a C128 in
+C64 mode nothing changes. A boot disk inserted while the machine runs
+boots at the next reset.
+
 ## Write protection
 
 Disks given on the command line, inserted from the pause menu or by an
@@ -56,7 +81,9 @@ another disk. Both write to disk images unless told otherwise:
 `disk: { read_only: true }`, as the test harnesses under `bin/` do. A
 `.g64` goes in the true 1541, and takes out a disk mounted through the
 traps, so `LOAD` and `SAVE` reach the 1541 too. With the 1541 in device
-8, a `.d64` goes in its drive as well.
+8, a `.d64` goes in its drive as well, and a `.d81` in a 1581 that takes
+the 1541's place. On a C128 in C128 mode, `attach` puts a boot disk in a
+true drive and types nothing (`Badline::Media::BootDisk`).
 
 `Badline::Media::DiskSet.around(path)` lists the disks of the set a disk
 image belongs to, which the pause menu's PREVIOUS DISK and NEXT DISK step

data/doc/pinned-behaviour.md

@@ -26,6 +26,7 @@ only catches the rows that happen to move.
 - [VIC light pen](#vic-light-pen)
 - [VIC-II 8565](#vic-ii-8565)
 - [VIC-IIe 2 MHz and TEST bit](#vic-iie-2-mhz-and-test-bit)
+- [C128 Z80 bus](#c128-z80-bus)
 - [VIC-II NTSC](#vic-ii-ntsc)
 - [VIC-II 6572 (Drean)](#vic-ii-6572-drean)
 - [CIA 6526 timer pipeline](#cia-6526-timer-pipeline)
@@ -1001,6 +1002,35 @@ $1C0E and checks the readings they print.
   per-cycle blanking. Their 8566 shows no grey dots. The 2mhzVIC
   references have none either.
 
+## C128 Z80 bus
+
+- The Z80 gets 2 T-states in every cycle BA leaves it the bus, with no
+  wait states for memory or I/O: each of the 1,868 `c128z80timing`
+  programs measures `T-states / 2` 1 MHz cycles with the screen blanked.
+  Pinned by `c128/z80/c128z80timing`. The timing rows can't pin where in
+  an I/O machine cycle the chips see an IN or OUT, since the timer starts
+  and stops through the same OUT: `Z80Turns::IO_DELAY` is 2 because
+  `c128modez80-23`'s IN at `$D700`, which reads open bus, passes at 1 or 2
+  and fails at 0, 3 and 4.
+- In C128 mode with CR bits 6-7 both 0, `$0000-$0FFF` reads the BIOS
+  (`$D000-$DFFF` of the KERNAL ROM), and a write, IN or OUT there reaches
+  the RAM at `$Dxxx` of bank 0. CR `$BF` (bank 2, which is bank 0 on a
+  128K machine) leaves the BIOS out, as does bank 1: `$0xxx` is RAM, common
+  RAM's or the bank's. `$D000-$DFFF` is RAM to the Z80's memory accesses.
+  Pinned by `c128modez80-15` to `-22` and `-25`, `outi/tstouti2` and
+  `mmu_zp_sp/tstz80bk` (x128 fails the last).
+- IN and OUT reach the chips at `$D000-$DFFF` whatever CR's I/O bit says,
+  in both modes. The MMU at `$D500` takes an OUT either way in C128 mode,
+  but answers an IN only with I/O on. Pinned by `c128modez80-10` (the IN)
+  and `tstz80bk`, which programs page relocation through OUT with CR
+  `$BF`.
+- While I/O is mapped in, the colour RAM the 8502 sees also answers at
+  `$1000-$13FF`, in memory and through IN and OUT. Pinned by
+  `c128modez80-02` to `-09` and `c64modez80-03` and `-05`.
+- In C64 mode the Z80's memory accesses decode as the 8502's do through
+  the PLA, with no BIOS. Pinned by `c64modez80-00` to `-06`.
+- Spec guard: [`z80_bus_spec.rb`](../spec/badline/c128/z80_bus_spec.rb).
+
 ## VIC-II NTSC
 
 The 6567R8 (`Region::NTSC`) and the 6567R56A (`Region::NTSC_OLD`) run
@@ -1507,7 +1537,7 @@ wasn't read.
     [`mechanism_spec.rb`](../spec/badline/drive1541/mechanism_spec.rb),
     and the `format/name-and-id`, `format/bam-free` and
     `format/trap-readable` rows of the `drive-scenarios` suite
-    ([`drive_scenarios.rb`](../test/drive_scenarios.rb)), which read the
+    ([`drive_scenarios.rb`](../test/support/drive_scenarios.rb)), which read the
     formatted disk back from its image.
 - The disk turns at 300 rpm whatever bit rate VIA 2's PB5-6 select: a
   turn is 200,000 drive cycles over every track and over a half track

data/exe/badline-ruby

@@ -39,7 +39,7 @@ if options.headless?
   console = if options.player_window?
               lambda do |input:, output:|
                 load_sdl
-                Badline::Frontend::PlayerWindow.new(input:, output:)
+                Badline::Frontend::PlayerController.new(input:, output:)
               end
             else
               Badline::Audio::Console.method(:new)

data/lib/badline/c128/bus.rb

@@ -37,6 +37,8 @@ module Badline
       include AddressBus::PLA
       include AddressBus::ROMs
       include MMUPages
+      include IOPages
+      include Z80Pages
       include SavedState
 
       # The 8502's port has seven pins. P0-P5 are the 6510's, and P6 senses
@@ -152,6 +154,7 @@ module Badline
 
         @color_lines = ColorLines.new(@vic, @cia2, character_rom, @c128_character_rom)
         @color_ram = @color_lines.color_ram(1)
+        build_z80_pages
         @vic_writes = VICWrites.new(@vic, @control_ports)
         @open_bus = AddressBus::OpenBus.new(@vic)
         @configuration_reads = ConfigurationPage.new(@mmu, @open_bus)
@@ -318,6 +321,7 @@ module Badline
                                 romh: @cartridge&.romh)
         @color_ram = @color_lines.cpu_color_ram(c64_mode, port)
         c64_mode ? map_pla_pages : map_c128_pages
+        update_z80!
         mode_changed if c64_mode != @c64_mode
       end
 
@@ -325,23 +329,6 @@ module Badline
         @c64_mode = !@c64_mode
         @on_mode_change&.call
       end
-
-      def map_io_pages
-        @io_mapped = true
-        @read_pages.fill(@vic, 0xd0, 4)
-        @write_pages.fill(@vic_writes, 0xd0, 4)
-        @read_pages[0xd4] = @write_pages[0xd4] = @sid
-        @read_pages[0xd5] = @write_pages[0xd5] = @mmu.c64_mode? ? @open_bus : @mmu
-        @read_pages[0xd6] = @write_pages[0xd6] = @vdc
-        @read_pages[0xd7] = @write_pages[0xd7] = @debug_page || @open_bus
-        @read_pages.fill(@color_ram, 0xd8, 4)
-        @write_pages.fill(@color_ram, 0xd8, 4)
-        @read_pages[0xdc] = @write_pages[0xdc] = @cia1
-        @read_pages[0xdd] = @write_pages[0xdd] = @cia2
-        @read_pages.fill(@open_bus, 0xde, 2)
-        @write_pages.fill(@open_bus, 0xde, 2)
-        map_cartridge_io if @cartridge
-      end
     end
   end
 end

data/lib/badline/c128/drives.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Badline
+  class C128
+    # The true drives on the C128's serial bus: a Drive1541, the C128D's
+    # built-in 1571 (Drive1571) or a 1581 (Drive1581::Slot), each in a
+    # field of its own, so none makes another's per-cycle call a union.
+    module Drives
+      attr_reader :drive1571
+
+      # Plugs in a Drive1571, which then runs alongside the C128 on its own
+      # clock and talks to it over the serial bus, as attach_drive1541 does
+      # for a 1541.
+      def attach_drive1571(drive)
+        @iec_bus.detach(@drive1571) if @drive1571
+        drive.host_clock_hz = region.clock_hz
+        @drive1571 = drive
+        drive.connect(iec_bus)
+        @serial_trap&.device = serial_trap_device
+      end
+
+      # Unplugs the Drive1571.
+      def detach_drive1571
+        return unless @drive1571
+
+        @iec_bus.detach(@drive1571)
+        @drive1571 = nil
+        @serial_trap&.device = serial_trap_device
+      end
+
+      # The true drive on the bus, a 1581 ahead of the 1571 ahead of a 1541.
+      def true_drive = @drive1581 || @drive1571 || @drive1541
+
+      # Plugs in the C128D's 1571 as device 8, in place of a 1581 there, and
+      # returns it.
+      def plug_true_drive
+        detach_drive1581 if drive1581_on_device8?
+        Drive1571.new.tap { |drive| attach_drive1571(drive) }
+      end
+
+      private
+
+      # The serial bus, with no disk in device 8's traps and no true drive.
+      def init_drives
+        @drive = nil
+        @serial_trap = nil
+        @save_trap = nil
+        @drive1541 = nil
+        @drive1571 = nil
+        @drive1581 = nil
+        plug_serial_bus
+        plug_fast_serial
+      end
+
+      # Device 8, unless a true drive is on the bus as device 8.
+      def serial_trap_device
+        device = KernalTrap::Routine::DEVICE
+        @drive1571&.device == device || @drive1541&.device == device || drive1581_on_device8? ? nil : device
+      end
+
+      # A 1581 plugged in holds the machine's on_init handlers back until
+      # its DOS has booted, which takes longer than the C128 KERNAL's.
+      def drive1581_attached
+        @init_threshold = [@init_threshold, Drive1581::BOOT_CYCLES].max if @cycles < @init_threshold
+      end
+
+      # Unplugs the 1541 and the 1571 if either is device 8, for a 1581 to
+      # take its place.
+      def unplug_device8
+        device = KernalTrap::Routine::DEVICE
+        detach_drive1541 if @drive1541&.device == device
+        detach_drive1571 if @drive1571&.device == device
+      end
+
+      # A true 1541 (Computer::Attachments#save_serial_bus), then a 1571 and
+      # a 1581.
+      def save_serial_bus(out)
+        out.boolean(true).boolean(!@drive1541.nil?)
+        if @drive1541
+          out.int(@drive1541.device)
+          @drive1541.save_state(out)
+        end
+        out.boolean(!@drive1571.nil?)
+        if @drive1571
+          out.int(@drive1571.device)
+          @drive1571.save_state(out)
+        end
+        save_drive1581(out)
+      end
+
+      def load_serial_bus(input)
+        input.boolean?
+        load_drive1541(input)
+        load_drive1571(input)
+        load_drive1581(input)
+      end
+
+      def load_drive1571(input)
+        return detach_drive1571 unless input.boolean?
+
+        device = input.int
+        detach_drive1571 if @drive1571 && @drive1571.device != device
+        attach_drive1571(Drive1571.new(device:)) unless @drive1571
+        @drive1571.load_state(input)
+      end
+    end
+  end
+end

data/lib/badline/c128/fast_serial.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Badline
+  class C128
+    # Fast serial: CIA 1's CNT and SP on the serial bus's SRQ and DATA,
+    # through buffers MCR's FSDIR turns round. Outwards, the machine pushes
+    # the lines the pins pull into the bus as they move. Inwards, CIA 1
+    # hears the lines whenever a drive moves its own fast serial pins
+    # (IECBus#on_fast_change).
+    module FastSerial
+      private
+
+      def plug_fast_serial
+        @fast_serial_out = false
+        @bus.mmu.on_fast_serial_change { turn_fast_serial }
+        @iec_bus.on_fast_change { hear_fast_serial unless @fast_serial_out }
+      end
+
+      # The machine's side of the serial bus each cycle: CIA 1's pins
+      # pushed while FSDIR has them out, then the drives.
+      def clock_serial_bus
+        drive_fast_serial if @fast_serial_out
+        @drive1541&.host_cycle!
+        @drive1571&.host_cycle!
+        @drive1581&.host_cycle!
+      end
+
+      def turn_fast_serial
+        push_fast_serial
+        hear_fast_serial unless @fast_serial_out
+      end
+
+      # Pushes the lines CIA 1's pins pull while FSDIR has them out. A
+      # restored machine pushes them again, its CIA 1 hearing the lines as
+      # it last did.
+      def push_fast_serial
+        @fast_serial_out = @bus.mmu.fast_serial_out?
+        @iec_bus.host_fast_lines = @fast_serial_out ? fast_pins : 0
+      end
+
+      def drive_fast_serial
+        @iec_bus.host_fast_lines = fast_pins
+      end
+
+      # The lines CIA 1's CNT and SP pull while its serial port drives
+      # them.
+      def fast_pins
+        serial = @cia1.serial
+        return 0 unless serial.output?
+
+        low = serial.cnt ? 0 : IECBus::SRQ
+        serial.sp_out ? low : low | IECBus::DATA
+      end
+
+      def hear_fast_serial
+        low = @iec_bus.low_lines
+        serial = @cia1.serial
+        serial.cnt_in = low.nobits?(IECBus::SRQ)
+        serial.sp_in = low.nobits?(IECBus::DATA)
+      end
+    end
+  end
+end

data/lib/badline/c128/io_pages.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Badline
+  class C128
+    class Bus
+      # The chips at $D000-$DFFF, which the 8502 sees while I/O is mapped
+      # in and the Z80 reaches through IN and OUT.
+      module IOPages
+        private
+
+        def map_io_pages
+          @io_mapped = true
+          lay_out_io(@read_pages, @write_pages)
+          @read_pages[0xd5] = @write_pages[0xd5] = @mmu.c64_mode? ? @open_bus : @mmu
+          map_cartridge_io if @cartridge
+        end
+
+        # The chips into +reads+ and +writes+, but for the MMU's page.
+        def lay_out_io(reads, writes)
+          reads.fill(@vic, 0xd0, 4)
+          writes.fill(@vic_writes, 0xd0, 4)
+          reads[0xd4] = writes[0xd4] = @sid
+          reads[0xd6] = writes[0xd6] = @vdc
+          reads[0xd7] = writes[0xd7] = @debug_page || @open_bus
+          reads.fill(@color_ram, 0xd8, 4)
+          writes.fill(@color_ram, 0xd8, 4)
+          reads[0xdc] = writes[0xdc] = @cia1
+          reads[0xdd] = writes[0xdd] = @cia2
+          reads.fill(@open_bus, 0xde, 2)
+          writes.fill(@open_bus, 0xde, 2)
+        end
+      end
+    end
+  end
+end

data/lib/badline/c128/mmu.rb

@@ -19,12 +19,11 @@ module Badline
     # A write to P0H or P1H waits until the matching P0L or P1L write
     # takes it.
     #
-    # On the C128 the Z80 runs first and hands the bus to the 8502. Here the
-    # 8502 runs from reset, with MCR as the Z80 leaves it. A machine built
-    # for C64 mode resets into C64 mode, the state the C128 KERNAL leaves
-    # when C= is held at power-on. In C64 mode the MMU answers nowhere, but
-    # the CPU's RAM bank, common RAM and the VIC's bank it holds stay in
-    # force.
+    # A reset clears MCR bit 0, so the Z80 runs first, boots and hands the
+    # bus to the 8502. A machine built for C64 mode resets into C64 mode
+    # instead, with the 8502 running, the state the C128 KERNAL leaves when
+    # C= is held at power-on. In C64 mode the MMU answers nowhere, but the
+    # CPU's RAM bank, common RAM and the VIC's bank it holds stay in force.
     class MMU
       CR = 0
       MCR = 5
@@ -36,6 +35,7 @@ module Badline
       VR = 11
 
       MCR_8502 = 0x01
+      MCR_FSDIR = 0x08
       MCR_C64_MODE = 0x40
       VERSION = 0x20
 
@@ -68,6 +68,7 @@ module Badline
         @game = 1
         @exrom = 1
         @on_change = nil
+        @on_fast_serial_change = nil
         reset!
       end
 
@@ -76,18 +77,32 @@ module Badline
         @on_change = block
       end
 
+      # Calls the block whenever FSDIR turns the fast serial buffers round.
+      def on_fast_serial_change(&block)
+        @on_fast_serial_change = block
+      end
+
       def reset!
+        fast_serial_out = fast_serial_out?
         @registers.fill(0)
-        @registers[MCR] = @reset_mode == :c64 ? MCR_C64_MODE | MCR_8502 : MCR_8502
+        @registers[MCR] = @reset_mode == :c64 ? MCR_C64_MODE | MCR_8502 : 0
         @registers[P1L] = 0x01
         @registers[VR] = VERSION
         @p0h_latch = 0
         @p1h_latch = 0
         @on_change&.call
+        @on_fast_serial_change&.call if fast_serial_out
       end
 
       def c64_mode? = @registers[MCR].anybits?(MCR_C64_MODE)
 
+      # Whether MCR bit 3, FSDIR, turns the fast serial buffers outwards, so
+      # CIA 1's CNT and SP drive SRQ and DATA.
+      def fast_serial_out? = @registers[MCR].anybits?(MCR_FSDIR)
+
+      # Whether MCR bit 0 gives the bus to the Z80.
+      def z80? = @registers[MCR].nobits?(MCR_8502)
+
       # :c64 or :c128, the mode MCR bit 6 selects.
       def mode = c64_mode? ? :c64 : :c128
 
@@ -174,8 +189,10 @@ module Badline
       end
 
       def write(offset, value)
+        fast_serial_out = fast_serial_out?
         @registers[offset] = value
         @on_change&.call
+        @on_fast_serial_change&.call if fast_serial_out? != fast_serial_out
       end
     end
   end