badline 0.16.1 → 0.17.0

data/doc/snapshots.md

@@ -160,11 +160,13 @@ saved with `--vice` (see [xpet](#xpet)).
 A PET snapshot saved with `--vice`, or `computer.export_snapshot(path)`,
 also holds xpet's modules for the CPU, the RAM with the screen RAM, or
 an 8296's 32K from `$8000`, an 8096's or 8296's board and its control
-register, the CRTC, both PIAs and the VIA, and the ones xpet 3.10 needs
-to open the file, with nothing open on the file system drive and
-nothing on the user port. The CRTC module carries the discrete boards'
-video too, in xpet's terms. The file says it is in VICE's snapshot
-format 1.0, the only one xpet reads.
+register, the CRTC, both PIAs and the VIA, a true 2031's CPU, RAM, VIAs
+and head, or a true 8050's or 8250's interface processor with its RAM
+and 6532s and the heads' tracks, and the ones xpet 3.10 needs to open
+the file, with nothing open on the file system drive and nothing on the
+user port. The CRTC module carries the discrete boards' video too, in
+xpet's terms. The file says it is in VICE's snapshot format 1.0, the
+only one xpet reads.
 
 xpet 3.10 opens those snapshots as long as its model and editor match:
 `-model 2001`, `3032`, `3032B`, `4032`, `8032`, `8096` or `8296`, and
@@ -172,15 +174,33 @@ for a badline editor other than xpet's own, `-editor` naming badline's
 ROM. xpet's 8296 runs the 8032's editor, 901474-04 dated 0283, so an
 8296 saved for it has to run that editor (`--editor 4-80-b-50hz-0283`),
 and xpet takes the 8296's jumpers from its own settings. It keeps its
-own drives and datasettes and leaves out badline's tapes and disk. Its
-CRTC loses a few lines on opening any snapshot, its own too, so a
-program it runs on from one finds the vertical sync a few hundred
-cycles later than one it ran without stopping.
+own datasettes and leaves out badline's tapes and disks. A true drive
+needs `-drive8type 2031`, `8050` or `8250` with `-drive8truedrive` and
+the disk attached as `-8`. Its snapshot is settled with the 2031's CPU
+between instructions too, and one saved while the 2031 talks on the bus
+can stall there in xpet, as xpet's own snapshots saved while it searches
+for a file do. xpet runs an 8050's floppy controller at a high level, so
+a snapshot for it is settled until badline's controller sits in its idle
+loop with both processors between instructions, and xpet's controller
+starts from idle there, taking up any job the interface processor has
+left it. A unit that doesn't reach its idle loop within about 262,000
+cycles, such as one still starting up, is left out of xpet's modules,
+and badline's own modules keep it. Its CRTC loses a few lines on
+opening any snapshot, its own too, so a program it runs on from one
+finds the vertical sync a few hundred cycles later than one it ran
+without stopping.
 
 Snapshots xpet saves open in badline through the same modules: the CPU
 at its instruction boundary, the RAM, the screen RAM, an 8096's or
 8296's board, the CRTC's registers and beam, both PIAs' registers and
-flags, and the VIA's registers, timers and shift register. A program
+flags, the VIA's registers, timers and shift register, a true 2031's
+CPU, RAM, VIAs and head, which go on the bus with the disk badline's
+2031 had in it, and a true 8050's or 8250's interface processor, its RAM
+and both 6532s, which go on the bus with the disks badline's unit of the
+same model had in it. Its floppy controller comes back as a unit
+switched on has it, in its idle loop with the heads on track 1: its next
+job steps them out to the track, and a job xpet's controller had under
+way starts again from there. A program
 badline runs on from xpet's snapshot finds the vertical sync on the
 cycle xpet does, so the two run on alike, cycle for cycle. The picture
 starts again with the next frame. xpet doesn't save its ROMs, which
@@ -190,10 +210,124 @@ board, a 4032, an 8032, an 8096 or an 8296 with none of its jumpers
 fitted, at 50 or 60 Hz, and an 8032, 8096 or 8296 whose CRTC lines are
 64 cycles long runs xpet's own 50 Hz editor, 901474-04 dated 0283. A
 SuperPET's snapshot fails. It reports the modules it leaves out, such
-as the drives, the datasettes and the keyboard, and carries on without
-them. Restored into a running PET, an xpet snapshot fails for a PET
-built another way, such as a 3032B, and otherwise switches the machine
-off and on, keeping its tapes and the disk device 8 serves.
+as the drives past device 8, the datasettes and the keyboard, and
+carries on without them, and a snapshot without a true drive takes
+badline's, a 2031, an 8050 or an 8250, off the bus and says so.
+Restored into a running PET, an xpet snapshot fails for a PET built
+another way, such as a 3032B, and otherwise switches the machine off
+and on, keeping its tapes and the disk device 8 serves.
+
+## The CBM-II
+
+The B series, the 610, 620, 710 and 720, saves and restores the same
+way. A snapshot of one holds segment 15's RAM, the screen RAM, the RAM
+board's segments, both segment registers, a cartridge's ROMs, the CPU,
+the CRTC with the picture, the SID, the CIA, the ACIA, both TPIs with
+their priority stacks, the mains' place in its period, and the disk or
+directory device 8 serves through the IEEE-488 traps. It restores into
+a machine of the same model with the same KERNAL and mains. Its file
+names its machine `CBM-II`, as xcbm2's do, and holds only badline's
+modules, so xcbm2 doesn't open it unless it is saved with `--vice` (see
+[xcbm2](#xcbm2)).
+
+### xcbm2
+
+A CBM-II snapshot saved with `--vice`, or `computer.export_snapshot(path)`, also holds
+xcbm2's modules for the CPU, the RAM with both segment registers, the
+CRTC, the CIA, both TPIs, the ACIA and the SID, a true 2031, 8050 or
+8250 as xpet's are written (see [xpet](#xpet)), or with no true drive,
+none on any device, and the ones xcbm2 3.10 needs to open the file, with
+no cartridge, nothing open on the file system drive and nothing on the
+user port. The file says it is in
+VICE's snapshot format 1.0, the only one xcbm2 reads.
+
+xcbm2 3.10 opens those snapshots as long as its model matches: `-model
+610`, `620`, `710` or `720`. It takes a 600's 60 Hz from the snapshot
+and leaves out badline's cartridge and disks. A true drive needs
+`-drive8type 2031`, `8050` or `8250` with `-drive8truedrive` and the
+disk attached as `-8`, and with no true drive in the snapshot xcbm2
+takes its own off the bus. It
+runs on from badline's snapshot just as it runs on from one it saved
+itself, cycle for cycle. Opening any snapshot, its own too, costs it a
+couple of hundred cycles of its CRTC, so the mains ticks that much later
+than in a run that didn't stop.
+
+xcbm2 saves no mains. It ticks the mains once a frame of its CRTC, as
+vertical sync ends, whatever its mains is set to, so its ticks come a
+frame apart: 40,064 cycles on a 600 at 50 Hz, where badline's come
+40,000 apart, and its 700 has no 60 Hz. A snapshot saved for xcbm2 ticks
+where xcbm2's CRTC says, not where badline's mains had it. Neither
+does xcbm2 save a TPI's priority stack, so the interrupts in service are
+lost both ways. Its cursor blinks 32 fields on and 32 off, where the
+6845 blinks 16 and 16, so it comes back showing or hidden as it was,
+with its place in the blink scaled.
+
+Snapshots xcbm2 saves open in badline through the same modules: the CPU
+at its instruction boundary, the RAM and both segment registers, the
+CRTC's registers and beam, the CIA's registers, timers and clock, both
+TPIs' registers, latches, mask, AIR, CA and CB, the ACIA's registers and
+the byte it waits to send, and the SID's registers and reSID voice
+state. The mains' next falling edge comes where xcbm2 would tick it, and
+the ones after at badline's 50 or 60 Hz, so the two part from the
+second tick on. xcbm2 has no DRAM refresh, so a program badline runs
+on from xcbm2's snapshot runs about 5% slower than in xcbm2, as the
+refresh takes a cycle from the CPU about every 21. On a machine built
+with `refresh: false` it reads the mains, the CIA and the rest as xcbm2
+does until that second tick, cycle for cycle. The picture starts again with the next frame. xcbm2 doesn't
+save its ROMs, so the RAM board and the model line build the machine:
+a 610, 620, 710 or 720 with xcbm2's KERNAL, 901244-04a, at 60 Hz for a
+600 whose model line says so and at 50 Hz otherwise. A board of 512K or
+more, or RAM mapped into segment 15, fails. A true 2031, 8050 or 8250
+goes on the bus as xpet's does, with the disks badline's drive of that
+model had, and xcbm2 runs a true 2031 on device 8 unless told otherwise,
+so its snapshots mostly put one there. One saved part way into a `LOAD`
+from xcbm2's true drive goes on with it in badline. A snapshot without
+a true drive takes badline's off the bus and says so. It reports the
+modules it leaves out, such as the datasette and the keyboard, and
+carries on without them. Restored into a running CBM-II, an xcbm2
+snapshot fails for a CBM-II built another way, and otherwise switches
+the machine off and on, keeping the disk device 8 serves through the
+traps.
+
+### xcbm5x0
+
+The P500, the 510 on PAL and NTSC, saves and restores as the B series
+does, with the VIC-II and its colour RAM in place of the CRTC. Its file
+names its machine `CBM-II-5x0`, as xcbm5x0's do. Saved with `--vice`,
+or `computer.export_snapshot(path)`, it also holds xcbm5x0's modules
+for the CPU, the RAM with the video matrix, the colour RAM and both
+segment registers, the CIA, both TPIs, the ACIA, the SID, a true drive
+or none as for the B series, the VIC-II and the mains, and the ones
+xcbm5x0 3.10 needs to open the file, with
+no cartridge, nothing open on the file system drive and the joysticks
+released. The file says it is in VICE's snapshot format 0.0, as
+xcbm5x0 writes it.
+
+xcbm5x0 3.10 opens those snapshots with `-model 510`, and `-ntsc` for
+an NTSC 510, takes the true drive as xcbm2 does and leaves out badline's
+cartridge and disks. It runs on from badline's snapshot as it runs on from its own,
+cycle for cycle. xcbm5x0 runs VICE's line-based VIC-II, not x64sc's, and
+its module is laid out otherwise: it carries the registers, colour RAM,
+the beam, VC, VCBASE, whether the sequencer is idle, the buffers and
+the sprites' DMA, and badline writes the rest as xcbm5x0 leaves it.
+xcbm5x0 saves the cycles to the mains' next tick, which badline reads
+and writes. It ticks the mains every 19,656 cycles, a PAL frame, on
+NTSC too, about 52 Hz there, where badline's NTSC 510 runs at 60 Hz, so
+a tick more than a 60 Hz period away comes back sooner.
+
+Snapshots xcbm5x0 saves open in badline through the same modules, as
+xcbm2's do, with the VIC-II's registers, beam, counters and colour RAM,
+and the mains' next tick on xcbm5x0's cycle. The row counter follows
+from the line, and the sprites' counters, the borders' flip-flops and
+the pixel pipeline start afresh. xcbm5x0's VIC isn't cycle exact as
+x64sc's is, so a program badline runs on from its snapshot reads the
+raster a cycle off now and then, and its cycles drift from xcbm5x0's by
+a few over a second. The picture starts again with the next frame. The
+RAM's size and the VIC's picture build the machine: a 510, on NTSC for
+NTSC's picture. More RAM fails. A true drive goes on the bus as from
+xcbm2's snapshots. Restored into a running P500, an
+xcbm5x0 snapshot fails for a P500 built another way, and otherwise
+switches the machine off and on, keeping the disk device 8 serves.
 
 ## VICE
 

data/lib/badline/cbm2/acia.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Badline
+  class CBM2
+    # The B series' 6551 at $DD00, the RS-232 port's, whose IRQ reaches
+    # TPI1's I4.
+    class ACIA < Chips::ACIA
+    end
+  end
+end

data/lib/badline/cbm2/bus.rb

@@ -0,0 +1,263 @@
+# frozen_string_literal: true
+
+module Badline
+  class CBM2
+    # The 6509's bus: sixteen segments of 64K, which the CPU's four extra
+    # address lines pick from the execution register at $0000 or, for the
+    # data of LDA (zp),Y and STA (zp),Y, the indirection register at $0001
+    # (CPU). Both registers answer at $0000 and $0001 in every segment.
+    #
+    # Segment 15 is the system's:
+    #
+    # $0000-$07FF - 2K of static RAM
+    # $0800-$0FFF - nothing: the buffer RAM socket
+    # $1000-$7FFF - the disk ROM's socket and the cartridge's three 8K
+    #               selects, nothing until a ROM is in (#attach_cartridge)
+    # $8000-$BFFF - BASIC
+    # $C000-$CFFF - nothing
+    # $D000-$D7FF - the screen RAM
+    # $D800-$DFFF - I/O, a chip a page (#map_io), nothing where none is
+    # $E000-$FFFF - the KERNAL
+    #
+    # The RAM board fills the segments +ram_segments+ names, and the rest
+    # hold nothing. The data lines hold the last byte they carried, which
+    # a read from nothing finds, and a write to ROM or to nothing goes
+    # nowhere.
+    #
+    # Each segment is a pair of page tables, one read and one write. The
+    # CPU reads and writes through the execution segment's (#peek and
+    # #poke), and a write to $0000 switches them, so an access pays
+    # nothing for the banking. For an indirect access the CPU switches to
+    # the indirection segment's tables and back (#select_indirect! and
+    # #select_execute!).
+    class Bus
+      include Addressable
+
+      SEGMENTS = 16
+      SYSTEM = 15
+
+      # The last byte the CPU moved, which nothing reads back.
+      class OpenBus
+        def initialize(bus)
+          @bus = bus
+        end
+
+        def peek(_addr) = @bus.data
+        def poke(_addr, _value); end
+      end
+
+      # A segment's page 0: the execution register at $0000 and the
+      # indirection register at $0001, whose reads return the register in
+      # the low four bits and 0 in the high four, over what the page holds.
+      class Registers
+        def initialize(bus, under)
+          @bus = bus
+          @under = under
+        end
+
+        def peek(addr)
+          case addr
+          when 0 then @bus.execution_segment
+          when 1 then @bus.indirect_segment
+          else @under.peek(addr)
+          end
+        end
+
+        def poke(addr, value)
+          case addr
+          when 0 then @bus.execution_segment = value & 0x0f
+          when 1 then @bus.indirect_segment = value & 0x0f
+          else @under.poke(addr, value)
+          end
+        end
+      end
+
+      # VICE's debug cartridge register at $DAFF in segment 15, which a
+      # write calls the handler with, the exit code the VICE testprogs
+      # report. Every other write to its page passes to the chip there.
+      class DebugRegister
+        ADDRESS = 0xdaff
+
+        attr_accessor :under
+
+        def initialize(&handler)
+          @handler = handler
+          @under = nil
+        end
+
+        def poke(addr, value)
+          return @handler.call(value) if addr == ADDRESS
+
+          @under.poke(addr, value)
+        end
+      end
+
+      attr_reader :ram, :screen, :segment_ram, :execution_segment
+      attr_accessor :indirect_segment
+
+      # The last byte the CPU read or wrote.
+      attr_reader :data
+
+      # +basic+ and +kernal+ are ROM files for $8000-$BFFF and
+      # $E000-$FFFF, +ram_segments+ the segments the RAM board fills, and
+      # +screen_length+ the bytes of screen RAM from $D000 on.
+      def initialize(basic:, kernal:, ram_segments:, screen_length: 0x800)
+        addressable_at(0, length: 2**16)
+        @ram = Memory.new([], length: 0x800, start: 0)
+        @screen = Memory.new([], length: screen_length, start: 0xd000)
+        @screen_pages = screen_length >> 8
+        @basic_rom = ROM.load(basic, 0x8000)
+        @kernal_rom = ROM.load(kernal, 0xe000)
+        @open_bus = OpenBus.new(self)
+        @data = 0
+        @segment_ram = Array.new(SEGMENTS) do |segment|
+          ram_segments.include?(segment) ? Memory.new([], length: 0x10000, start: 0) : nil
+        end
+        @io = Array.new(8, @open_bus)
+        @cartridge = []
+        @video = Array.new(0x18, nil)
+        @video_writable = Array.new(0x18, false)
+        @debug_register = nil
+        @reads = Array.new(SEGMENTS) { Array.new(256, @open_bus) }
+        @writes = Array.new(SEGMENTS) { Array.new(256, @open_bus) }
+        reset!
+        map_pages
+      end
+
+      # The RES line sets both registers to 15.
+      def reset!
+        self.execution_segment = SYSTEM
+        @indirect_segment = SYSTEM
+      end
+
+      def power_on!
+        @ram.clear!
+        @screen.clear!
+        @segment_ram.each { |memory| memory&.clear! }
+      end
+
+      def execution_segment=(segment)
+        @execution_segment = segment
+        select_execute!
+      end
+
+      # Switches the CPU's accesses to the indirection segment, for the one
+      # access LDA (zp),Y or STA (zp),Y moves its data with.
+      def select_indirect!
+        @read_pages = @reads[@indirect_segment]
+        @write_pages = @writes[@indirect_segment]
+      end
+
+      # Switches them back to the execution segment.
+      def select_execute!
+        @read_pages = @reads[@execution_segment]
+        @write_pages = @writes[@execution_segment]
+      end
+
+      def peek(addr)
+        @data = @read_pages[addr >> 8].peek(addr)
+      end
+
+      def poke(addr, value)
+        @data = value
+        @write_pages[addr >> 8].poke(addr, value)
+      end
+
+      # Reads and writes +segment+ as the CPU would, wherever it executes.
+      def peek_bank(segment, addr) = @reads[segment][addr >> 8].peek(addr)
+
+      def poke_bank(segment, addr, value)
+        @writes[segment][addr >> 8].poke(addr, value)
+      end
+
+      # Whether the CPU runs the KERNAL: it executes in segment 15.
+      def kernal_mapped? = @execution_segment == SYSTEM
+
+      # Puts +chip+ at I/O page +page+, $D8 to $DF of segment 15. The chip
+      # hears the whole address.
+      def map_io(page, chip)
+        @io[page - 0xd8] = chip
+        map_pages
+      end
+
+      # Puts +chip+ at +count+ pages of segment 15 from +page+ on, between
+      # $C000 and $D7FF, over what was there: the P500's character ROM, and
+      # its colour RAM, which takes writes as well (+writable+). The chip
+      # hears the whole address.
+      def map_video(chip, page, count, writable: false)
+        count.times do |i|
+          @video[page + i - 0xc0] = chip
+          @video_writable[page + i - 0xc0] = writable
+        end
+        map_pages
+      end
+
+      # Puts the cartridge's ROM chips, Storage::CRTFile::Chips, at their
+      # load addresses in segment 15, from $1000 to $7FFF, in place of what
+      # was there.
+      def attach_cartridge(chips)
+        @cartridge = chips.map { |chip| ROM.new(chip.data, length: chip.data.length, start: chip.address) }
+        map_pages
+      end
+
+      def detach_cartridge
+        @cartridge = []
+        map_pages
+      end
+
+      # Calls the block with each byte written to $DAFF (DebugRegister).
+      def install_debug_register(&)
+        @debug_register = DebugRegister.new(&)
+        map_pages
+      end
+
+      private
+
+      def map_pages
+        SEGMENTS.times do |segment|
+          memory = @segment_ram[segment]
+          if memory
+            map(segment, memory, 0x00, 0x100)
+          else
+            map(segment, @open_bus, 0x00, 0x100)
+          end
+        end
+        map_system
+        SEGMENTS.times { |segment| map_registers(segment) }
+        select_execute!
+      end
+
+      def map_system
+        map(SYSTEM, @open_bus, 0x00, 0x100)
+        map(SYSTEM, @ram, 0x00, 0x08)
+        @cartridge.each { |rom| @reads[SYSTEM].fill(rom, rom.start >> 8, rom.length >> 8) }
+        @reads[SYSTEM].fill(@basic_rom, 0x80, 0x40)
+        map(SYSTEM, @screen, 0xd0, @screen_pages)
+        @video.each_with_index { |chip, i| map_video_page(chip, 0xc0 + i, @video_writable[i]) if chip }
+        @io.each_with_index { |chip, i| map(SYSTEM, chip, 0xd8 + i, 1) }
+        @reads[SYSTEM].fill(@kernal_rom, 0xe0, 0x20)
+        map_debug_register if @debug_register
+      end
+
+      def map_video_page(chip, page, writable)
+        @reads[SYSTEM][page] = chip
+        @writes[SYSTEM][page] = writable ? chip : @open_bus
+      end
+
+      def map_registers(segment)
+        @reads[segment][0] = Registers.new(self, @reads[segment][0])
+        @writes[segment][0] = Registers.new(self, @writes[segment][0])
+      end
+
+      def map_debug_register
+        @debug_register.under = @writes[SYSTEM][0xda]
+        @writes[SYSTEM][0xda] = @debug_register
+      end
+
+      def map(segment, chip, first, count)
+        @reads[segment].fill(chip, first, count)
+        @writes[segment].fill(chip, first, count)
+      end
+    end
+  end
+end

data/lib/badline/cbm2/cpu.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Badline
+  class CBM2
+    # The 6509: a 6502 core with four more address lines, which pick one of
+    # the Bus's sixteen segments. Every access goes to the execution
+    # segment, but the ones at the address LDA (zp),Y and STA (zp),Y index,
+    # their data and the dummy read before it, which go to the indirection
+    # segment: the opcode and the zero-page pointer stay in the execution
+    # segment. Interrupts leave both segments alone.
+    class CPU
+      include Badline::Chips::CPU::Core
+
+      def initialize(memory, debug: false)
+        super
+        @indirect = false
+      end
+
+      def reset!
+        super
+        @indirect = false
+      end
+
+      private
+
+      def op_pointer_high_y
+        super
+        @indirect = @operation == :lda || @operation == :sta
+      end
+
+      def op_idx_dummy
+        return super unless @indirect
+
+        @memory.select_indirect!
+        super
+        @memory.select_execute!
+      end
+
+      def op_mem_read
+        return super unless @indirect
+
+        @indirect = false
+        @memory.select_indirect!
+        super
+        @memory.select_execute!
+      end
+
+      def op_mem_write
+        return super unless @indirect
+
+        @indirect = false
+        @memory.select_indirect!
+        super
+        @memory.select_execute!
+      end
+    end
+  end
+end

data/lib/badline/cbm2/crtc_video.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+module Badline
+  class CBM2
+    # What the B series makes of its 6845's outputs. Each character the
+    # CRTC displays reads the 2K screen RAM at its memory address, MA0-MA10,
+    # and the character ROM's 16-line glyph for the screen code's low seven
+    # bits, from the set TPI1's CA picks: the first 128 glyphs while it is
+    # low, the second while it is high. Bit 7 of the screen code reverses
+    # the glyph. The ROM's row is the CRTC's raster line, RA0-RA3, so the
+    # 600's eight lines show the 8x8 glyphs in the first half of each and
+    # the 700's fourteen the 8x16 ones.
+    #
+    # The cursor is the 6845's: on the character at R14:R15, from line
+    # R10's low five bits to line R11, it reverses the dots. R10's bits 5
+    # and 6 pick its blink: 00 steady, 01 no cursor, 10 on for 8 fields and
+    # off for 8, 11 on for 16 and off for 16.
+    #
+    # The picture is a PET::Canvas framed as xcbm2 frames its screenshots:
+    # 704 dots wide, the first displayed character 32 dots in, and 266
+    # lines high with the first row 33 lines down on a 600, or 367 lines
+    # with it 8 down on a 700. Each frame paints its displayed lines from
+    # there down. A frame laid out otherwise than the last, its lines,
+    # rows or sync moved, starts on a black canvas, so nothing the old
+    # layout painted stays.
+    class CRTCVideo
+      LEFT = 32
+      WIDTH = 704
+
+      # The lines of the picture and the line its first row starts on, for
+      # a 600 and a 700.
+      FRAMES = { false => [266, 33], true => [367, 8] }.freeze
+
+      attr_reader :canvas, :frames
+
+      # Whether it paints the characters: a run that never shows the
+      # picture can leave it alone.
+      attr_accessor :render
+
+      # +characters+ is the character ROM's bytes, +screen+ the screen RAM,
+      # +tpi+ TPI1, whose CA picks the set, and +registers+ the CRTC's.
+      def initialize(characters, screen, tpi, registers, high_profile:)
+        @glyphs = characters
+        @screen = screen
+        @tpi = tpi
+        @registers = registers
+        height, @top = FRAMES.fetch(high_profile)
+        @canvas = PET::Canvas.new(WIDTH, height)
+        @frames = 0
+        @line = 0
+        @line_shown = false
+        @origin = LEFT
+        @layout = []
+        @render = true
+        frame_start
+      end
+
+      def character(address, raster, since_hsync)
+        @line_shown = true
+        y = @top + @line
+        return if y >= @canvas.height || !@render
+
+        @canvas.paint(@origin + (since_hsync << 3), y, row_bits(address, raster))
+      end
+
+      def hsync; end
+
+      def line_end
+        @line += 1 if @line_shown
+        @line_shown = false
+      end
+
+      def rows_end; end
+
+      # A frame starts painting from the first row's line again, its
+      # characters placed so the first one the line displays sits LEFT
+      # dots in.
+      def frame_start
+        regs = @registers
+        @frames += 1
+        @line = 0
+        @origin = LEFT - ((regs[0] + 1 - regs[2]) << 3)
+        layout = regs.values_at(0, 1, 2, 4, 5, 6, 9, 12, 13)
+        return if layout == @layout
+
+        @layout = layout
+        @canvas.clear!
+      end
+
+      # The picture under canvas.*, the fields counted, the line the frame
+      # paints next and the layout it was framed by, in a keyed snapshot
+      # module (BL-VIDEO).
+      def save_fields(out)
+        out.int("frames", @frames).int("line", @line).bool("line_shown", @line_shown).int("origin", @origin)
+        out.ints("layout", @layout)
+        @canvas.save_fields(out, "canvas.")
+      end
+
+      def load_fields(input)
+        @frames = input.int("frames", @frames)
+        @line = input.int("line", @line)
+        @line_shown = input.bool("line_shown", @line_shown)
+        @origin = input.int("origin", @origin)
+        @layout = input.ints("layout", @layout).dup
+        @canvas.load_fields(input, "canvas.")
+      end
+
+      private
+
+      def row_bits(address, raster)
+        code = @screen.peek(0xd000 | (address & 0x7ff))
+        glyph = (code & 0x7f) | (@tpi.ca? ? 0x80 : 0)
+        bits = @glyphs[(glyph << 4) | (raster & 0x0f)]
+        bits ^= 0xff if code >= 0x80
+        bits ^= 0xff if cursor?(address, raster)
+        bits
+      end
+
+      def cursor?(address, raster)
+        regs = @registers
+        return false unless address == ((regs[14] << 8) | regs[15])
+        return false if raster < (regs[10] & 0x1f) || raster > regs[11]
+
+        case regs[10] & 0x60
+        when 0x00 then true
+        when 0x20 then false
+        when 0x40 then @frames.nobits?(0x08)
+        else @frames.nobits?(0x10)
+        end
+      end
+    end
+  end
+end

data/lib/badline/cbm2/ieee_drive.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "badline/machine/ieee_drives"
+
+module Badline
+  class CBM2
+    # The CBM-II's true drive, a 2031, 8050 or 8250 on its IEEE-488 bus
+    # (IEEEPorts), as Machine::IEEEDrives has it, at the machine's clock:
+    # 2 MHz on the B series, the VIC-II's on the P500. Both include it.
+    module IEEEDrive
+      include Machine::IEEEDrives
+
+      private
+
+      def ieee_host_clock_hz = timing.clock_hz
+    end
+  end
+end