atonce.cpp

/*
* UAE - The Un*x Amiga Emulator
*
* Vortex ATonce Plus emulation
* (80286 PC emulator board for the Amiga 500 68000 socket, 1991)
*
* The board consists of an 80C286-16, optional 80C287, 512KB local DRAM and
* a Xilinx XC2018 LCA acting as bridge/chipset. There is NO PC support
* hardware at all: every IN/OUT executed by the 286 (except the 287 range
* 0xF8-0xFF) freezes the CPU and is emulated by the Amiga-side 68k driver
* through a polling protocol on two "magic" addresses in CIA space.
*
* Hardware model reverse engineered from the original LCA bitstream
* (configuration "atplus2"), the GAL equations and the original v2.20/v3.00
* driver disassembly: https://github.com/na103/Dueottosei
* The address translation below is ported 1:1 from the formally verified
* RTL (xc2018/rtl/atplus2_core.v).
*
* Magic ports (GAL U22, decodes only A6/A7/A15 within /VPA space):
*   PORT_A = base+0x41 (byte): write = mode bits, read = status
*   PORT_B = base+0x80 (word): write = resume(+INT), read = stop + trap info
*   default base 0xBFF000 -> 0xBFF041/0xBFF080 (aliases all over CIA space)
*
* Uses the PCem v16 core already present for the A1060/A2088/A2286/A2386
* bridgeboards. Mutually exclusive with those boards (PCem is single
* instance).
*/

#include "sysconfig.h"
#include "sysdeps.h"

#ifdef WITH_X86

#include "options.h"
#include "custom.h"
#include "memory.h"
#include "newcpu.h"
#include "debug.h"
#include "x86.h"
#include "atonce.h"
#include "uae.h"
#include "rommgr.h"
#include "zfile.h"
#include "devices.h"
#include "autoconf.h"
#include "filesys.h"

#include "pcem/ibm.h"
#include "pcem/device.h"
#include "pcem/cpu.h"
#include "pcem/pic.h"
#include "pcem/timer.h"
#include "pcem/pcemglue.h"
#include "pcem/model.h"
#include "pcem/mem.h"
#include "pcem/codegen.h"
#include "pcem/x86.h"
#include "pcem/io.h"

/*
* INTEGRATION STATUS (2026-06-13): structurally complete, compiles into the
* expansion list as "ATonce Plus" (Vortex). Points to validate once running:
*   1. PCem core bring-up: minimal init (no pit/dma/kbc). Confirm exec386 runs
*      and the 286 starts from F000:FFF0 (= chip RAM 0x3FFF0 via the F000 map).
*   2. Trap/resume timing: atonce_trap ends the slice (cycles=0) AFTER the I/O
*      instruction; data flows through the pusha frame in shared RAM, so this is
*      equivalent to the hardware freeze-inside-OUT for BIOS service traps.
*      Verify raw (non-BIOS) IN/OUT paths behave too.
*   3. Magic-port base is hardwired to the v2.20 default (A6/A7/A15 in 0xBFxxxx).
*      The driver can relocate it; make it configurable if a disk uses another base.
*   4. 287/FPU: fpu_type=FPU_NONE; the err287/setup287 path is not wired yet.
*   Acceptance test: original floppies in Disk/ -> driver loads, Vortex BIOS POST
*   beacon (OUT 0xBB) reached, DOS prompt.
*/

#define ONBOARD_SIZE 0x80000   // 512KB local DRAM

// Cycles run synchronously inside a PORT_B resume: the 286 advances until its
// next I/O instruction traps (atonce_trap forces the slice to end) or this
// budget is exhausted. On real hardware the 286 runs FREELY at 16 MHz between
// I/O instructions; the 68k only intervenes on a trap. The 68k driver stops the
// 286 (PORT_B read) right after each resume, so atonce_hsync cannot continue a
// budget-exhausted run (it is frozen, not merely idle) -> the per-resume budget
// IS the throughput unit. PERFORMANCE: at 2000 the 286 effectively ran at only
// 0.2-0.85 MHz (resumes/s x 2000), making DOS sluggish. A trap ends the burst
// early anyway, so this is just the cap on no-I/O stretches; sized so the 286
// reaches ~16 MHz effective without long stretches blocking the Amiga thread.
#define ATONCE_RUN_CYCLES 65536

// PORT_A write bits (68k D0-D7 = 286 D8-D15, byte-swapped by U24/U25)
#define PORTA_DIN     0x01   // config DIN / runtime: 286 reset pulse
#define PORTA_SETUP   0x02   // 287 reset / MEMMODE setup mode
#define PORTA_A20     0x04   // gate A20 enable
#define PORTA_ACK287  0x08   // 287 error acknowledge
#define PORTA_PROG    0x10   // DONE / -PROG

// PORT_A read (status) bits
#define PORTA_ST_ERR287_OR_DIR 0x01  // pre-stop: 287 error; post-stop: 1=IN 0=OUT
#define PORTA_ST_TRAP          0x02  // I/O trap pending

struct atonce_s {
	int configured;          // LCA configured (DONE)
	uae_u8 mode;             // last PORT_A write
	int a20en;
	int setup;               // MEMMODE setup mode (PORT_A D1)
	int frozen;              // 286 stalled: trap pending or stopped by PORT_B read
	int stopped;             // explicitly stopped by PORT_B read
	int in_reset;            // 286 held in reset
	int trap_pending;
	uae_u16 trap_port;       // latched 10-bit port
	int trap_dir;            // 1 = IN
	int refresh_div;         // hsync counter for the idle video-refresh trap
	uae_u32 text_hash;       // last-rendered hash of the 286 text page (change detect)
	int refresh_heartbeat;   // frames since last refresh (slow cursor-blink heartbeat)
	int refresh_due;         // a video refresh is owed (set per frame, serviced
	                         // at the next safe point: idle hsync or 286 resume)
	int fake_active;         // a synthetic CRTC refresh trap is in flight
	int err287;
	// MEMMODE shift register, stages AH/BH/CH/DH (AH = last shifted bit)
	int mm_a, mm_b, mm_c, mm_d;
	// translation table: x86 64K bank -> Amiga bank base, -1 = onboard DRAM
	int bank_amiga[256];
	uae_u8 *dram;            // 512KB onboard DRAM (= PCem "ram")
	uae_u8 *vmem;            // DIAGNOSTIC: private backing for the 286's sub-1MB
	                         // chip windows (banks 0-6), so video/conventional
	                         // writes can't corrupt Amiga chip RAM. F000 mailbox
	                         // (chip 0x30000) stays on real chip RAM.
	int ext_memsize;         // configured extended memory (bytes), 0 = none
	uae_u8 *emem;            // DIAGNOSTIC: private flat buffer backing the 286's
	                         // >1MB extended memory (ATONCE_ISOLATE_EXT), with a
	                         // real exec pointer so getpccache works in the HMA.
	struct romconfig *rc;
};

// DIAGNOSTIC toggle: when 1, the 286's sub-1MB chip windows (except the F000
// mailbox) are backed by a private buffer instead of Amiga chip RAM. If the
// 68k Guru disappears, it proves the crash is the 286 stamping on OS chip RAM.
// Now 0: the wild-jump root cause (missing OUT-data shadow) is fixed, and the
// driver's video bridge reads the 286 framebuffer FROM real chip RAM (chip
// 0x18000) to render the Amiga screen, so the 286 must write video there (not
// into the private vmem) or the screen stays black.
#define ATONCE_ISOLATE_CHIP 0
#define ATONCE_VMEM_SIZE 0x70000   // covers chip banks 0..6 (0x00000-0x6FFFF)

// DIAGNOSTIC toggle: when 1, the 286's extended memory (>1MB) is backed by a
// private, flat buffer instead of the dynamic MEMMODE translation onto Amiga
// fast RAM. This buffer is mapped with a REAL exec pointer, so PCem's code fetch
// (getpccache) works when himem.sys relocates/executes in the HMA (>1MB). It
// also fully isolates the 286's extended memory from the Amiga (no sharing of
// fast RAM with the 286, as on the video-isolation test). Use to bring up XMS /
// himem.sys before wiring the extended memory back onto shared Amiga RAM.
#define ATONCE_ISOLATE_EXT 1
#define ATONCE_EMEM_SIZE 0xf00000  // covers the whole >1MB window (0x100000-0xFFFFFF)

static struct atonce_s *atonce;

int atonce_intr_vector = -1;  // consumed by picinterrupt() (pcem/pic.cpp patch)

// Allocates pcemmap (the PCem memory-map block table) + the PCem video infra.
// The bridgeboards reach it via their video card; the ATonce has no PCem video,
// so we call it directly (priv=NULL is safe: it is only stored as gfxboard_priv,
// never dereferenced unless PCem video is rendered, which we never do).
extern void initpcemvideo(void *p, bool swapped);

/*-------------------------------------------------------------------------*/
/* Address translation 286 -> Amiga, ported from atplus2_core.v             */
/* (formally equivalent to the golden LCA netlist).                         */
/* Translation depends only on x86 A16-A23 + board state, so it is          */
/* precomputed per 64K bank and rebuilt when MEMMODE/A20 change.            */
/*-------------------------------------------------------------------------*/

// Drive PCem's physical A20 mask from the LCA gate (PORT_A D2). On the ATonce
// there is no keyboard controller: the LCA A20 gate IS the A20 line. PCem masks
// bit 20 of the physical address via rammask (mem_a20_recalc), so this makes the
// 286 wrap 0x100000->0x000000 when A20 is gated off - exactly what himem.sys's
// A20-control test checks (else: "Unable to control A20 line!"). We own A20
// entirely: keep mem_a20_key cleared (PCem defaults it to 2 = A20 always on).
static void atonce_apply_a20(struct atonce_s *xb)
{
	mem_a20_key = 0;
	mem_a20_alt = xb->a20en ? 1 : 0;
	mem_a20_recalc();
}

static void atonce_rebuild_map(struct atonce_s *xb)
{
	for (int bank = 0; bank < 256; bank++) {
		int a16 = (bank >> 0) & 1, a17 = (bank >> 1) & 1;
		int a18 = (bank >> 2) & 1, a19 = (bank >> 3) & 1;
		int a20 = (bank >> 4) & 1, a21 = (bank >> 5) & 1;
		int a22 = (bank >> 6) & 1, a23 = (bank >> 7) & 1;

		// U15: A20 gated by PORT_A D2 (DI.Q)
		int a20g = a20 & xb->a20en;

		// U45/U43 glue: onboard DRAM select for x86 0-512K (memory cycles)
		if (!a23 && !a22 && !a21 && !a20g && !a19) {
			xb->bank_amiga[bank] = -1;
			continue;
		}

		// U28/U45 glue: P67 = A23 XOR NOR(A23,A22,A21,A20g); ~P67 = 1MB-8MB
		int p67 = a23 ^ ((a23 | a22 | a21 | a20g) ? 0 : 1);
		// LCA DI.X: EXT = M/IO & ~P67 & A20-enable
		int ext = (!p67 && xb->a20en) ? 1 : 0;

		int mm_a = xb->mm_a, mm_b = xb->mm_b, mm_c = xb->mm_c, mm_d = xb->mm_d;

		// CLB AF
		int af_x = (!a19 & a17) | (!a16 & a17) | (a18 & a17) | (a19 & !a16 & a18);
		// CLB FC (memory cycle: mio=1)
		int za16 = a16;
		// CLB BF
		int za17 = (af_x & a17) | (af_x & !ext) | (a17 & ext);
		// CLB BG
		int za18 = (!a19 & a18) | (ext & a18) | (a19 & !a17 & !ext & !a18);
		// CLB AH (G)
		int za19 = (a19 & ext) | (ext & mm_a);
		// CLB CI
		int ci_x = (a20g & !a21) | (mm_d & !a21) | (!a20g & !mm_d & a21);
		int za20 = (!a20g & !mm_d & ext) | (a20g & mm_d & ext);
		// CLB CJ
		int cj_x = (a22 & !mm_d) | (a22 & !a21) | (!a22 & mm_d & a21) | (!a22 & a21 & a20g);
		// CLB BH (G)
		int za21 = ext & ci_x & mm_b;
		// CLB DH (G)
		int za23 = mm_c & ext;
		// CLB BJ
		int za22 = za23 | (!za23 & cj_x & ext & mm_b);

		xb->bank_amiga[bank] =
			((za23 << 7) | (za22 << 6) | (za21 << 5) | (za20 << 4) |
			 (za19 << 3) | (za18 << 2) | (za17 << 1) | za16) << 16;
	}
}

/*-------------------------------------------------------------------------*/
/* x86-side memory access (PCem handlers). Byte order: the data bus is      */
/* byte-swapped by wiring (U24/U25), which makes byte addresses map 1:1;    */
/* reading consecutive Amiga bytes as a little-endian word is exactly what  */
/* the hardware produces.                                                   */
/*-------------------------------------------------------------------------*/

static uint8_t atonce_mem_readb(uint32_t addr, void *priv)
{
	struct atonce_s *xb = (struct atonce_s*)priv;
	if (!xb || !xb->dram) {
		write_log(_T("ATonce: ext readb @%06x with NULL ctx\n"), addr);
		return 0xff;
	}
	int base = xb->bank_amiga[(addr >> 16) & 0xff];
	if (base < 0)
		return xb->dram[addr & (ONBOARD_SIZE - 1)];
	return get_byte(base | (addr & 0xffff));
}
static uint16_t atonce_mem_readw(uint32_t addr, void *priv)
{
	return atonce_mem_readb(addr, priv) | (atonce_mem_readb(addr + 1, priv) << 8);
}
static uint32_t atonce_mem_readl(uint32_t addr, void *priv)
{
	return atonce_mem_readw(addr, priv) | (atonce_mem_readw(addr + 2, priv) << 16);
}
static void atonce_mem_writeb(uint32_t addr, uint8_t val, void *priv)
{
	struct atonce_s *xb = (struct atonce_s*)priv;
	if (!xb || !xb->dram) {
		write_log(_T("ATonce: ext writeb @%06x with NULL ctx\n"), addr);
		return;
	}
	int base = xb->bank_amiga[(addr >> 16) & 0xff];
	if (base < 0) {
		xb->dram[addr & (ONBOARD_SIZE - 1)] = val;
		return;
	}
	put_byte(base | (addr & 0xffff), val);
}
static void atonce_mem_writew(uint32_t addr, uint16_t val, void *priv)
{
	atonce_mem_writeb(addr, val & 0xff, priv);
	atonce_mem_writeb(addr + 1, val >> 8, priv);
}
static void atonce_mem_writel(uint32_t addr, uint32_t val, void *priv)
{
	atonce_mem_writew(addr, val & 0xffff, priv);
	atonce_mem_writew(addr + 2, val >> 16, priv);
}

static mem_mapping_t atonce_mapping;   // extended memory (1MB+), dynamic

/*-------------------------------------------------------------------------*/
/* Sub-1MB chip-RAM windows (static map). The 286 executes code from here    */
/* (BIOS at F000 = chip 0x30000, conventional 512-640K = chip 0x40000), and  */
/* PCem's code fetch (getpccache) needs a real pointer, not the function     */
/* handlers. So each window exposes WinUAE chip RAM directly via an "exec"   */
/* pointer; data goes through funcs that index the same buffer. The U24/U25  */
/* byte-swap is 1:1 at byte level, so a direct pointer matches the handlers. */
/* This map is MEMMODE-independent: for banks 0-0xF the LCA EXT term is 0.   */
/* priv = chipbase + chipoff - xbase, so priv[addr] is the chip byte.        */
/*-------------------------------------------------------------------------*/

static uint8_t atonce_chip_readb(uint32_t addr, void *priv)
{
	return ((uae_u8*)priv)[addr];
}
static uint16_t atonce_chip_readw(uint32_t addr, void *priv)
{
	uae_u8 *p = (uae_u8*)priv;
	return p[addr] | (p[addr + 1] << 8);
}
static uint32_t atonce_chip_readl(uint32_t addr, void *priv)
{
	uae_u8 *p = (uae_u8*)priv;
	return p[addr] | (p[addr + 1] << 8) | (p[addr + 2] << 16) | (p[addr + 3] << 24);
}
static void atonce_chip_writeb(uint32_t addr, uint8_t v, void *priv)
{
	uae_u8 *p = (uae_u8*)priv;
	p[addr] = v;
}
static void atonce_chip_writew(uint32_t addr, uint16_t v, void *priv)
{
	uae_u8 *p = (uae_u8*)priv;
	p[addr] = (uae_u8)v;
	p[addr + 1] = (uae_u8)(v >> 8);
}
static void atonce_chip_writel(uint32_t addr, uint32_t v, void *priv)
{
	uae_u8 *p = (uae_u8*)priv;
	p[addr] = (uae_u8)v;
	p[addr + 1] = (uae_u8)(v >> 8);
	p[addr + 2] = (uae_u8)(v >> 16);
	p[addr + 3] = (uae_u8)(v >> 24);
}

// Sub-1MB x86 bank -> Amiga chip bank. This MUST match the hardware LCA
// translation (atonce_rebuild_map, ported from the verified RTL atplus2_core.v):
// these exec-pointer windows and the function-handler map model the same chip.
//   x86 8->chip 0x40000  9->0x50000  A->0x20000  B->0x10000
//       C->0x20000  D->0x10000  E->0x20000  F->0x30000 (BIOS)
// NOTE banks A and C: the .dsg software translation table the 68k driver shifts
// in says 0x60000 (A) / 0x00000 (C), but those are SOFTWARE-only aliases; the
// LCA hardware decodes both to 0x20000 .
// Both banks are unused aliases (no EGA/VGA), so this is a fidelity fix, not a
// functional one for DOS - but the emulator models the hardware, so use the LCA value.
static const struct { uae_u32 xbase, size, chipoff; } atonce_win_map[] = {
	{ 0x80000, 0x20000, 0x40000 },  // banks 8,9 -> chip 0x40000,0x50000 (contiguous)
	{ 0xA0000, 0x10000, 0x20000 },  // bank A -> chip 0x20000 (LCA; .dsg software says 0x60000)
	{ 0xB0000, 0x10000, 0x10000 },  // bank B -> chip 0x10000 (MDA/CGA video shadow)
	{ 0xC0000, 0x10000, 0x20000 },  // bank C -> chip 0x20000 (LCA; .dsg software says 0x00000)
	{ 0xD0000, 0x10000, 0x10000 },  // bank D -> chip 0x10000 (hardware alias of B0000)
	{ 0xE0000, 0x10000, 0x20000 },  // bank E -> chip 0x20000
	{ 0xF0000, 0x10000, 0x30000 },  // bank F -> chip 0x30000 (BIOS; FFFF0->chip 0x3FFF0)
};
#define ATONCE_NWIN (sizeof(atonce_win_map) / sizeof(atonce_win_map[0]))
static mem_mapping_t atonce_win[ATONCE_NWIN];

static void atonce_map_windows(void)
{
	uae_u8 *chip = chipmem_bank.baseaddr;
	uae_u32 chipsize = chipmem_bank.allocated_size;
	if (!chip || chipsize < 0x60000) {
		write_log(_T("ATonce: chip RAM too small (%uK) for shared windows; ")
			_T("286 cannot fetch the BIOS\n"), chipsize / 1024);
		return;
	}
	for (unsigned i = 0; i < ATONCE_NWIN; i++) {
		uae_u8 *base = chip;
#if ATONCE_ISOLATE_CHIP
		// Back every window except the F000 mailbox (chip 0x30000) with a private
		// buffer, so the 286's video/conventional writes never touch Amiga chip RAM.
		if (atonce && atonce->vmem && atonce_win_map[i].chipoff != 0x30000)
			base = atonce->vmem;
#endif
		uae_u8 *lin = base + atonce_win_map[i].chipoff - atonce_win_map[i].xbase;
		// NOTE: mem_mapping_add (stock PCem), NOT mem_mapping_addx (WinUAE glue).
		// The 286 core's getpccache/readmembl consult read_mapping[]/_mem_exec[]
		// filled by the stock mem_mapping_add; the glue's addx fills a separate
		// pcemmap[] table and self-disables on re-add. The bridgeboards use add.
		mem_mapping_add(&atonce_win[i], atonce_win_map[i].xbase, atonce_win_map[i].size,
			atonce_chip_readb, atonce_chip_readw, atonce_chip_readl,
			atonce_chip_writeb, atonce_chip_writew, atonce_chip_writel,
			base + atonce_win_map[i].chipoff,   // exec ptr: indexed [addr - xbase]
			MEM_MAPPING_EXTERNAL, lin);          // priv:     indexed [addr]
	}
	// Mark 512K-1MB as EXTERNAL RAM, else mem_mapping_recalc refuses our
	// EXTERNAL mappings (default state is INTERNAL) and getpccache fails.
	mem_set_mem_state(0x80000, 0x80000, MEM_READ_EXTERNAL | MEM_WRITE_EXTERNAL);
	mem_mapping_t *w = &atonce_win[ATONCE_NWIN - 1];   // F000 window
	write_log(_T("ATonce: mapped %u windows, chip=%p %uK; ")
		_T("phys 0=%02x 10000=%02x 80000=%02x F0000=%02x FFFF0=%02x; ")
		_T("win[F].base=%x size=%x flags=%x en=%d directRB=%02x\n"),
		(unsigned)ATONCE_NWIN, chip, chipsize / 1024,
		mem_readb_phys(0), mem_readb_phys(0x10000), mem_readb_phys(0x80000),
		mem_readb_phys(0xF0000), mem_readb_phys(0xFFFF0),
		(unsigned)w->base, (unsigned)w->size, w->flags, w->enable,
		w->read_b(0xFFFF0, w->p));
}

/*-------------------------------------------------------------------------*/
/* x86-side I/O: every access freezes the 286 (the LCA holds READY) and     */
/* latches port + direction. The 68k driver polls PORT_A, stops/reads the   */
/* trap info from PORT_B, emulates the device and resumes with PORT_B       */
/* write (optionally delivering an INT whose stub patches the register      */
/* frame in shared RAM). The data returned to a trapped IN here is junk     */
/* (0xFF) exactly like on real hardware: the BIOS stub overwrites AX in     */
/* the pusha frame afterwards.                                              */
/*-------------------------------------------------------------------------*/

static void atonce_trap(struct atonce_s *xb, uae_u16 port, int dir)
{
	xb->trap_pending = 1;
	xb->trap_port = port & 0x3ff;
	xb->trap_dir = dir;
	xb->frozen = 1;
	// End the current PCem slice right after this instruction. exec386's inner
	// loop exits on cycdiff (= oldcyc - cycles) >= cycle_period, not on cycles
	// alone, so a huge-negative value forces cycdiff past any cycle_period and
	// bails out of both the inner and the outer (cycles>0) loop immediately.
	cycles = -0x40000000;
}

// Drive the 286 for up to `budget` cycles. PCem's exec386 paces itself against
// the timer subsystem: its inner loop runs until cycdiff >= cycle_period, where
// cycle_period = (timer_target - tsc) + 1, and timer_process() only advances
// timer_target while a timer is registered. We register no PCem timers (the PIT
// lives behind the I/O trap and is emulated by the 68k), so timer_target stays
// behind the ever-growing tsc, cycle_period goes <= 0, and exec386 spins
// forever in its outer loop without ever issuing an instruction. Keeping
// timer_target a budget ahead of tsc makes each burst actually execute, then
// return when the budget is spent or a trap forces it out (atonce_trap).
static void atonce_run(struct atonce_s *xb, int budget)
{
	(void)xb;
	timer_target = (uint32_t)tsc + (uint32_t)budget + 16;
	cycles = 0;
	exec386(budget);
}

static uint8_t atonce_io_inb(uint16_t addr, void *priv)
{
	atonce_trap((struct atonce_s*)priv, addr, 1);
	return 0xff;
}
static uint16_t atonce_io_inw(uint16_t addr, void *priv)
{
	atonce_trap((struct atonce_s*)priv, addr, 1);
	return 0xffff;
}
static uint32_t atonce_io_inl(uint16_t addr, void *priv)
{
	atonce_trap((struct atonce_s*)priv, addr, 1);
	return 0xffffffff;
}
// On a trapped 286 OUT the board latches the written data into the shared F000
// I/O shadow at F000:[port] (= chip 0x30000 + port). The 68k driver reads this
// shadow byte to recover the OUT value: e.g. the CRTC handler reads the register
// index from F000:03D4 and the data from F000:03D5 (it never reads the pusha
// frame for these). WinUAE previously discarded the OUT data, so the shadow kept
// the reject handler's 0xFF -> the driver's signed index bound-check (cmp.b #$f /
// bgt) let 0xFF through, indexed 0xFF*4 past its 16-entry jump table, and did a
// wild jmp (a4)=0x264ad7c4 -> stack-overflow MOVEM sled -> Task corruption ->
// Guru #3. Mirroring the data into the shadow on every OUT fixes that at the
// source. trap_port is the 10-bit PC I/O address, so the shadow lives in
// F000:0000-03FF, well below the BIOS mailboxes at F000:1400+. (For IN the data
// flows the other way, via the BIOS pusha-frame edit, and needs no shadow here.)
static void atonce_io_shadow(uae_u16 port, uae_u32 val, int size)
{
	uae_u8 *chip = chipmem_bank.baseaddr;
	if (!chip || chipmem_bank.allocated_size < 0x30400)
		return;
	uae_u8 *sh = chip + 0x30000;
	for (int i = 0; i < size; i++)
		sh[(port + i) & 0x3ff] = (uae_u8)(val >> (8 * i));
}

// Symmetric to the OUT shadow: a trapped 286 IN reads back the value the driver
// pre-staged in the shared F000 I/O shadow (F000:[port]). E.g. on an Amiga key
// the driver writes the PC scancode to F000:0060 and the 8042 status to
// F000:0064, then injects keyboard IRQ1; the 286's keyboard ISR does IN 0x60 /
// IN 0x64 and must read those, not junk. (Returning 0xff broke every device
// poll that reads back driver-maintained state: keyboard, 8042, PIC mask, RTC,
// CGA retrace 0x3da, ...). The 0xBx BIOS services are OUTs, not INs, so the
// pusha-frame path is unaffected.
static uae_u32 atonce_io_shadow_read(uae_u16 port, int size)
{
	uae_u8 *chip = chipmem_bank.baseaddr;
	if (!chip || chipmem_bank.allocated_size < 0x30400)
		return 0xffffffff;
	uae_u8 *sh = chip + 0x30000;
	uae_u32 v = 0;
	for (int i = 0; i < size; i++)
		v |= (uae_u32)sh[(port + i) & 0x3ff] << (8 * i);
	return v;
}

static void atonce_io_outb(uint16_t addr, uint8_t val, void *priv)
{
	atonce_io_shadow(addr & 0x3ff, val, 1);
	atonce_trap((struct atonce_s*)priv, addr, 0);
}
static void atonce_io_outw(uint16_t addr, uint16_t val, void *priv)
{
	atonce_io_shadow(addr & 0x3ff, val, 2);
	atonce_trap((struct atonce_s*)priv, addr, 0);
}
static void atonce_io_outl(uint16_t addr, uint32_t val, void *priv)
{
	atonce_io_shadow(addr & 0x3ff, val, 4);
	atonce_trap((struct atonce_s*)priv, addr, 0);
}

/*-------------------------------------------------------------------------*/
/* HDD bypass: serve the PC C: drive by reading the disk image the user attached  */
/* in WinUAE's HDD settings, replacing the 68k driver's scsi.device path. The VHD  */
/* MUST be attached as a WinUAE hardfile (the Amiga boots from its Amiga partition */
/* and loads the atonce driver from there); we read the PC partition through       */
/* WinUAE's own hardfile handle (get_hardfile_data/hdf_read), so there is no        */
/* file-lock / double-open conflict. Nothing geometry-related is hardcoded: we      */
/* parse the RDB and pick the partition whose first block is a PC MBR (0x55AA); its */
/* byte offset comes from the RDB DosEnvVec and its CHS geometry from the MBR        */
/* partition table's ending CHS. The BIOS forwards INT 13h as OUT 0xB0 (data) /      */
/* OUT 0xB9 (control) with the registers live; for drive >= 0x80 we do the I/O       */
/* against the hardfile, write the result into the 286 PUSHA frame and skip the trap.*/
/* NOTE: the board's 286 DRAM window at 0x900000-0x9FFFFF must not overlap OS-usable  */
/* Z2 fast RAM, or the OS may allocate there and corrupt (see atonce_init mapping).   */
/*-------------------------------------------------------------------------*/
#define ATONCE_HDD_DRIVE    0x80      // BIOS drive number of the first HDD (C:)

static struct hardfiledata *atonce_hfd;   // WinUAE hardfile backing the PC C: drive
static int      atonce_hdd_tried;
static uae_u64  atonce_part_off;          // byte offset of PC LBA 0 inside the hardfile
static int      atonce_hdd_heads;         // PC geometry (from the MBR ending CHS)
static int      atonce_hdd_spt;
static uae_u32  atonce_hdd_sectors;       // total PC sectors (for AH=08 max cylinder)

static uae_u32 atonce_be32(const uae_u8 *p)
{
	return ((uae_u32)p[0] << 24) | ((uae_u32)p[1] << 16) |
		((uae_u32)p[2] << 8) | (uae_u32)p[3];
}

// Resolve the PC C: drive from WinUAE's attached hardfiles (once). Returns 1 if found.
static int atonce_hdd_resolve(void)
{
	if (atonce_hdd_tried)
		return atonce_hfd != NULL;
	atonce_hdd_tried = 1;

	for (int nr = 0; nr < MAX_FILESYSTEM_UNITS; nr++) {
		struct hardfiledata *hfd = get_hardfile_data(nr);
		if (!hfd)
			continue;
		write_log(_T("ATonce HDD: examine unit %d '%s' handle_valid=%d virtsize=%llu\n"),
			nr, hfd->ci.rootdir, hfd->handle_valid, hfd->virtsize);
		if (!hfd->handle_valid)
			continue;

		uae_u8 blk[512];
		uae_u32 err = 0;
		// Find the RDSK block within the first 16 sectors.
		int found_rdb = 0;
		for (int b = 0; b < 16; b++) {
			if (hdf_read(hfd, blk, (uae_u64)b * 512, 512, &err) != 512)
				break;
			if (blk[0] == 'R' && blk[1] == 'D' && blk[2] == 'S' && blk[3] == 'K') {
				found_rdb = 1;
				break;
			}
		}
		if (!found_rdb)
			continue;

		// Walk the partition list looking for one that starts with a PC MBR.
		uae_u32 part = atonce_be32(blk + 0x1c);   // rdb_PartitionList (RDSK off 0x1C)
		for (int guard = 0; part != 0xffffffff && guard < 64; guard++) {
			if (hdf_read(hfd, blk, (uae_u64)part * 512, 512, &err) != 512)
				break;
			if (!(blk[0] == 'P' && blk[1] == 'A' && blk[2] == 'R' && blk[3] == 'T'))
				break;
			uae_u32 next     = atonce_be32(blk + 0x10);
			uae_u32 surfaces = atonce_be32(blk + 0x8c);   // de_Surfaces
			uae_u32 bpt      = atonce_be32(blk + 0x94);   // de_BlocksPerTrack
			uae_u32 lowcyl   = atonce_be32(blk + 0xa4);   // de_LowCyl
			uae_u32 highcyl  = atonce_be32(blk + 0xa8);   // de_HighCyl
			uae_u32 bsize    = atonce_be32(blk + 0x84) * 4; // de_SizeBlock (longs) -> bytes
			if (bsize < 512)
				bsize = 512;
			uae_u64 part_off = (uae_u64)lowcyl * surfaces * bpt * bsize;

			// Partition name (BSTR at pb_DriveName, off 0x24: len byte + chars).
			char pname[32];
			int pl = blk[0x24]; if (pl > 31) pl = 31;
			for (int i = 0; i < pl; i++) pname[i] = blk[0x25 + i];
			pname[pl] = 0;
			uae_u8 mbr[512];
			int rd = hdf_read(hfd, mbr, part_off, 512, &err);
			write_log(_T("ATonce HDD: PART '%hs' surf=%u bpt=%u lcyl=%u hcyl=%u ")
				_T("off=%llu rd=%d sig=%02x%02x\n"),
				pname, surfaces, bpt, lowcyl, highcyl,
				(unsigned long long)part_off, rd, mbr[0x1fe], mbr[0x1ff]);
			if (rd == 512 && mbr[0x1fe] == 0x55 && mbr[0x1ff] == 0xaa) {
				// PC disk found. CHS geometry from a partition entry's ending CHS
				// (the standard heuristic DOS/fdisk use). Scan all 4 entries and
				// take the first non-empty one, preferring the active (0x80) one,
				// so an empty/extended entry 0 doesn't give bogus 0/0 geometry.
				const uae_u8 *pe = NULL;
				for (int e = 0; e < 4; e++) {
					const uae_u8 *p = mbr + 0x1be + e * 16;
					if (p[4] == 0)            // type 0 = unused entry
						continue;
					if (!pe)
						pe = p;               // first non-empty: fallback choice
					if (p[0] == 0x80) {       // active partition: preferred
						pe = p;
						break;
					}
				}
				int heads = pe ? pe[5] + 1 : 0;
				int spt   = pe ? (pe[6] & 0x3f) : 0;
				if (heads < 1) heads = 1;
				if (spt < 1)   spt = 1;
				atonce_hfd         = hfd;
				atonce_part_off    = part_off;
				atonce_hdd_heads   = heads;
				atonce_hdd_spt     = spt;
				atonce_hdd_sectors = (uae_u32)(((uae_u64)(highcyl - lowcyl + 1) *
					surfaces * bpt) * (bsize / 512));
				write_log(_T("ATonce HDD: unit %d '%s' PC disk at byte %llu, ")
					_T("CHS=%d/%d, %u sectors (%u MB)\n"),
					nr, hfd->ci.rootdir, (unsigned long long)part_off,
					heads, spt, atonce_hdd_sectors, atonce_hdd_sectors / 2048);
				return 1;
			}
			part = next;
		}
	}
	write_log(_T("ATonce HDD: no PC partition (MBR) found in any WinUAE hardfile; ")
		_T("falling back to the 68k driver\n"));
	return 0;
}

// Write the INT 13h result into the 286 PUSHA frame (the BIOS published its
// SS:SP, so it is at ss+SP). Byte offsets match the 68k driver's a3-relative
// reads (AH=status @+0x13, AL=count @+0x12, FLAGS @+0x18; CF bit0 = error);
// 286 byte addressing is 1:1 with the driver's view.
static void atonce_disk_result(uint8_t ah, uint8_t al, int error)
{
	uint32_t frame = ss + SP;
	mem_writeb_phys(frame + 0x13, ah);
	mem_writeb_phys(frame + 0x12, al);
	uint8_t fl = mem_readb_phys(frame + 0x18);
	if (error)
		fl |= 0x01;
	else
		fl &= ~0x01;
	mem_writeb_phys(frame + 0x18, fl);
}

// Returns 1 if the disk service was fully handled here (skip the 68k trap).
static int atonce_disk_bypass(uint16_t port)
{
	int drive = DL;
	if (drive < ATONCE_HDD_DRIVE || (drive & 0x7f) != 0)
		return 0;                 // floppy / non-C: HDD -> let the 68k driver run
	if (!atonce_hdd_resolve())
		return 0;                 // no PC disk configured -> fall back to the driver

	int func  = AH;
	int cyl   = CH | ((CL & 0xc0) << 2);
	int sec   = CL & 0x3f;
	int head  = DH;
	int count = AL;

	switch (func) {
	case 0x02:     // read sectors
	case 0x03: {   // write sectors
		if (sec == 0) { atonce_disk_result(0x01, 0, 1); return 1; }
		uint32_t lba = (uint32_t)(cyl * atonce_hdd_heads + head) * atonce_hdd_spt
			+ (sec - 1);
		uint32_t buf = es + BX;
		uae_u64 pos = atonce_part_off + (uae_u64)lba * 512u;
		int ok = 1, done = 0;
		uint8_t sb[512];
		uae_u32 err = 0;
		for (int s = 0; s < count; s++) {
			uae_u64 sp = pos + (uae_u64)s * 512;
			if (func == 0x02) {
				if (hdf_read(atonce_hfd, sb, sp, 512, &err) != 512) { ok = 0; break; }
				for (int i = 0; i < 512; i++)
					mem_writeb_phys(buf + s * 512 + i, sb[i]);
			} else {
				for (int i = 0; i < 512; i++)
					sb[i] = mem_readb_phys(buf + s * 512 + i);
				if (hdf_write(atonce_hfd, sb, sp, 512, &err) != 512) { ok = 0; break; }
			}
			done++;
		}
		atonce_disk_result(ok ? 0x00 : 0x04, (uint8_t)done, ok ? 0 : 1);
		return 1;
	}
	case 0x08: {   // get drive parameters
		int percyl = atonce_hdd_heads * atonce_hdd_spt;
		int maxcyl = (percyl > 0 ? (int)(atonce_hdd_sectors / percyl) : 1) - 1;
		if (maxcyl > 1023) maxcyl = 1023;
		uint32_t frame = ss + SP;
		uint8_t ch = (uint8_t)(maxcyl & 0xff);
		uint8_t cl = (uint8_t)(atonce_hdd_spt | ((maxcyl >> 2) & 0xc0));
		mem_writeb_phys(frame + 0x10, cl);                  // CL
		mem_writeb_phys(frame + 0x11, ch);                  // CH
		mem_writeb_phys(frame + 0x0e, 0x01);                // DL = 1 HDD
		mem_writeb_phys(frame + 0x0f, atonce_hdd_heads - 1); // DH = max head
		atonce_disk_result(0x00, 0, 0);
		return 1;
	}
	case 0x00:     // reset
	case 0x01:     // get last status
	case 0x04:     // verify (no transfer)
	case 0x09:     // set drive params
	case 0x0c:     // seek
	case 0x0d:     // alternate reset
	case 0x10:     // test drive ready
	case 0x11:     // recalibrate
		atonce_disk_result(0x00, (uint8_t)count, 0);
		return 1;
	default:       // unsupported function: claim success rather than stall the BIOS
		atonce_disk_result(0x00, (uint8_t)count, 0);
		return 1;
	}
}

// Entry point from pcem/x86.cpp's portin/portout. The 286's IN/OUT opcodes go
// through outb()/inb() -> portout()/portin() in x86.cpp, which are the *bridge-
// board* dispatchers and dereference bridges[0] (NULL for the ATonce). Those
// functions now fall through to here when no PC bridgeboard owns the x86 side.
// Every x86 I/O freezes the 286 (the LCA holds READY) and is emulated by the
// 68k driver; the 287 ports 0xf8-0xff are handled by the FPU and not trapped.
// dir: 1 = IN, 0 = OUT. On OUT the board latches the written data into the
// shared F000 I/O shadow (F000:[port] = chip 0x30000+port); the 68k driver
// reads it back (CRTC index from F000:03D4, data from F000:03D5, etc.). This is
// the ACTUAL OUT path: x86.cpp's portout/portin short-circuit here before the
// stock io_sethandlerx table, so the shadow must be read/written here. Returns
// the IN data (the driver-staged shadow byte/word) for dir=1; 0 for OUT.
uint32_t atonce_x86_io(uint16_t port, int dir, uint32_t val, int size)
{
	struct atonce_s *xb = atonce;
	if (!xb)
		return 0xffffffff;
	if ((port & 0xfff8) == 0xf8)
		return 0xffffffff;   // 287 coprocessor range: no trap (no FPU configured)
	if (!dir) {
		// HDD bypass: serve drive >= 0x80 from the host VHD and skip the 68k trap.
		if ((port == 0xb0 || port == 0xb9) && atonce_disk_bypass(port))
			return 0;
		atonce_io_shadow(port & 0x3ff, val, size);
		atonce_trap(xb, port, dir);
		return 0;
	}
	// IN: return the value the driver pre-staged in the F000 I/O shadow, then
	// trap so it can post-update device state (e.g. clear the 8042 data-ready).
	uint32_t v = atonce_io_shadow_read(port & 0x3ff, size);
	atonce_trap(xb, port, dir);
	return v;
}

/*-------------------------------------------------------------------------*/
/* 68k side: magic ports. Called from cia.cpp for accesses in CIA space.    */
/* GAL U22 decode: only A6/A7/A15 (+ /VPA + any data strobe):               */
/*   PORT_A: A15=1 A6=1 A7=0  -> (addr & 0x80c0) == 0x8040                  */
/*   PORT_B: A15=1 A7=1 A6=0  -> (addr & 0x80c0) == 0x8080                  */
/*-------------------------------------------------------------------------*/

static uae_u8 atonce_porta_read(struct atonce_s *xb)
{
	uae_u8 v = 0;
	if (xb->trap_pending)
		v |= PORTA_ST_TRAP;
	if (xb->stopped) {
		if (xb->trap_dir)
			v |= PORTA_ST_ERR287_OR_DIR;
	} else {
		if (xb->err287)
			v |= PORTA_ST_ERR287_OR_DIR;
	}
	return v;
}

static void atonce_porta_write(struct atonce_s *xb, uae_u8 v)
{
	uae_u8 old = xb->mode;
	xb->mode = v;

	// D2: gate A20
	int a20 = (v & PORTA_A20) ? 1 : 0;
	if (a20 != xb->a20en) {
		xb->a20en = a20;
		atonce_rebuild_map(xb);
		atonce_apply_a20(xb);
	}

	// D1: 287 reset / MEMMODE setup mode
	xb->setup = (v & PORTA_SETUP) ? 1 : 0;

	// D3: 287 error acknowledge
	if (v & PORTA_ACK287)
		xb->err287 = 0;

	// D0: at config time = DIN; at runtime, a 0->1 edge = explicit 286 reset
	// (the driver's boot-retry pulses it when the 286 fails to POST). Edge-
	// triggered so the per-poll mode-byte write does not reset every time.
	if (xb->configured && (v & PORTA_DIN) && !(old & PORTA_DIN)) {
		xb->in_reset = 1;
		resetx86();     // 286 restarts at FFFF0
	}
}

// Fabricate a synthetic CRTC register-12 (display-start-address-high) write so the
// 68k driver runs a FULL-screen change-detection re-render of the CGA text page,
// flushing it to the Amiga screen even when the 286 issues no real video I/O (DOS
// prompt idle, BIOS "press any key" boot wait).
//
// Why not OUT 0xBA: that handler (0x694C->0x5AAE) only re-renders ONE row (the
// bottom row, the post-scroll case) -- it never touches an arbitrary row like the
// boot prompt at row 14 or a pre-scroll "A>" prompt. The full-screen render is
// 0x5B70 (25 rows, chip 0x18000 vs shadow 0x10000 -> bitplane 0x20000), reached via
// the driver's CRTC path: a write to reg 12/13 in text mode routes to 0x5174, which
// only sets the full-render request flags ($16C6 bit2 / $15B2 bit2) -- it does NOT
// apply the data to the display start -- and the main loop services the request.
// This is exactly the path DOS scrolling uses (which renders correctly). So we
// pre-stage the CRTC index in the I/O shadow (chip 0x303D4 = F000:03D4) and trap on
// the data port 0x3D5 with the current start value (a no-op write, no scroll).
// Cheap hash of the 286's live CGA text page (x86 B8000 = chip 0x18000), plus the
// CRTC start address and video mode. Used to skip the (expensive, 68k-side
// graphics.library) full-screen re-render when nothing on screen changed.
static uae_u32 atonce_text_hash(void)
{
	uae_u8 *chip = chipmem_bank.baseaddr;
	if (!chip || chipmem_bank.allocated_size < 0x30400)
		return 0;
	const uae_u8 *p = chip + 0x18000;        // live CGA text page
	uae_u32 h = 2166136261u;                 // FNV-1a
	for (int i = 0; i < 80 * 25 * 2; i++) {
		h ^= p[i];
		h *= 16777619u;
	}
	// fold in CRTC start (hardware scroll) + mode so those also trigger a refresh
	h ^= (uae_u32)chip[0x3158c] | ((uae_u32)chip[0x3158d] << 8) |
	     ((uae_u32)chip[0x315b5] << 16);
	return h;
}

static void atonce_fire_refresh(struct atonce_s *xb)
{
	uae_u8 *chip = chipmem_bank.baseaddr;
	if (!chip || chipmem_bank.allocated_size < 0x30400)
		return;
	chip[0x303d4] = 0x0c;            // CRTC index = reg 12 (start address high)
	chip[0x303d5] = chip[0x3158c];   // data = current start high -> no actual scroll
	xb->refresh_due = 0;
	xb->fake_active = 1;
	xb->trap_port = 0x3d5;
	xb->trap_dir = 0;                // OUT
	xb->trap_pending = 1;
	xb->frozen = 1;
}

// A synthetic refresh trap must not be injected from a resume that is part of a
// multi-step Vortex service or a disk/CRTC sequence: those handlers depend on the
// 286 PUSHA frame (which we transiently redirect) and on running the 286 promptly,
// so interposing a render there can derail a boot. Only inject after a "plain"
// device trap (keyboard/PIC/timer/RTC idle polls), where a resume cleanly continues.
static int atonce_refresh_safe_port(uae_u16 p)
{
	if (p >= 0x0b0 && p <= 0x0bf) return 0;   // Vortex private services (disk/video)
	if (p >= 0x3f0 && p <= 0x3ff) return 0;   // floppy controller -> trackdisk
	if (p >= 0x1f0 && p <= 0x1f7) return 0;   // AT hard disk
	if (p == 0x3d4 || p == 0x3d5) return 0;   // CGA CRTC
	if (p == 0x3b4 || p == 0x3b5) return 0;   // MDA CRTC
	return 1;
}

static uae_u16 atonce_portb_read(struct atonce_s *xb)
{
	// stop the 286 + latch trap info.
	xb->frozen = 1;
	xb->stopped = 1;
	// readback format: driver does AND #$FF03 + ROR #8 to recover the port
	return ((xb->trap_port & 0xff) << 8) | ((xb->trap_port >> 8) & 3);
}

static void atonce_portb_write(struct atonce_s *xb, uae_u16 v)
{
	if (xb->setup) {
		// MEMMODE shift: data = 68k D12, LSB first, into AH->BH->CH->DH
		xb->mm_d = xb->mm_c;
		xb->mm_c = xb->mm_b;
		xb->mm_b = xb->mm_a;
		xb->mm_a = (v >> 12) & 1;
		atonce_rebuild_map(xb);
		// first shift releases the 286 reset line (LCA DA flip-flop)
		xb->in_reset = 0;
		return;
	}
	// resume the 286; bit0 = also deliver INT, vector in the high byte
	// was_fake marks a resume that consumes a synthetic video-refresh trap, so we
	// don't immediately re-fire another one on its own resume.
	int was_fake = xb->fake_active;
	xb->fake_active = 0;
	xb->frozen = 0;
	xb->stopped = 0;
	xb->trap_pending = 0;
	xb->in_reset = 0;
	// The first resume after config/MEMMODE means "let the 286 run". There is
	// no real bitstream to load here (we ARE the LCA logic), so this is where
	// the board becomes live and the 286 starts at its reset vector (FFFF0).
	if (!xb->configured) {
		xb->configured = 1;
		atonce_rebuild_map(xb);
		resetx86();
		// resetx86() resets PCem's _mem_state (back to INTERNAL), which drops our
		// EXTERNAL chip-RAM windows from _mem_exec -> the 286 can't fetch the BIOS
		// (Bad getpccache at FFFF0). Re-assert the state so recalc reinstalls the
		// still-listed mappings. (Don't re-add the mappings: that corrupts the list.)
		mem_set_mem_state(0x80000, 0x80000, MEM_READ_EXTERNAL | MEM_WRITE_EXTERNAL);
		mem_set_mem_state(0x100000, 0x1000000 - 0x100000,
			MEM_READ_EXTERNAL | MEM_WRITE_EXTERNAL);
	}
	if (v & 1) {
		atonce_intr_vector = (v >> 8) & 0xff;
		pic_intpending = 1;
	}
	// If a video refresh is owed (set once per frame by atonce_hsync), inject it
	// here instead of running the 286: a resume is a safe point (the trap just
	// cleared, no real trap in flight). The driver picks up the synthetic 0xBA on
	// its next PORT_A poll, renders, then resumes again (refresh no longer due) and
	// the 286 runs. This covers busy 286 I/O-poll loops (e.g. the BIOS "press any
	// key" boot wait) where atonce_hsync never catches an idle moment. Gate it to
	// plain device traps (atonce_refresh_safe_port): never interpose a render in a
	// disk/video/service sequence, which derails the boot. Skip on a fake's own
	// resume (was_fake) so two renders don't chain.
	if (xb->refresh_due && !was_fake && atonce_refresh_safe_port(xb->trap_port)) {
		atonce_fire_refresh(xb);
		return;
	}
	// Trap-driven execution: run the 286 until its next I/O instruction traps
	// (atonce_trap forces the slice to end) or the cycle budget is spent.
	atonce_run(xb, ATONCE_RUN_CYCLES);
}

// returns 1 if the access was claimed (magic port hit)
int atonce_cia_access(uaecptr addr, uae_u32 *value, int size, int iswrite)
{
	struct atonce_s *xb = atonce;
	if (!xb)
		return 0;
	if ((addr & 0xff0000) != 0xbf0000)
		return 0;
	int hit_a = (addr & 0x80c0) == 0x8040;
	int hit_b = (addr & 0x80c0) == 0x8080;
	if (!hit_a && !hit_b)
		return 0;
	if (hit_a) {
		if (iswrite)
			atonce_porta_write(xb, (uae_u8)*value);
		else
			*value = atonce_porta_read(xb);
	} else {
		if (iswrite)
			atonce_portb_write(xb, size == 2 ? (uae_u16)*value : (uae_u8)*value);
		else
			*value = atonce_portb_read(xb);
	}
	return 1;
}

/*-------------------------------------------------------------------------*/
/* Amiga side: 68k window 0x900000-0x9FFFFF exposes the onboard DRAM        */
/* (LCA comparator AJ cuts the motherboard strobes via U43/U42).            */
/*-------------------------------------------------------------------------*/

// The 0x900000 DRAM window stays mapped (map_banks) even while atonce is NULL:
// before the first atonce_init and after every atonce_free (the board re-inits
// once per Amiga reset). Kickstart/expansion scans and stray 68k reads can hit
// it in that gap, so every handler must tolerate atonce == NULL / dram == NULL.
// While the board is unconfigured (DONE not asserted) the 286 DRAM window must
// stay inert and let any Z2 fast RAM underneath show through, so the OS can use
// that RAM during boot (it shadows only once the driver brings the board up).
// fastmem_bank[0] is looked up live (not captured at init, where it isn't mapped
// yet) so the range test reflects the actual configured fast RAM.
static addrbank *atonce_dram_under(uaecptr addr)
{
	addrbank *fb = &fastmem_bank[0];
	if (fb->baseaddr && addr >= fb->start &&
		addr < fb->start + fb->allocated_size)
		return fb;
	return NULL;
}

static uae_u32 REGPARAM2 atonce_dram_lget(uaecptr addr)
{
	struct atonce_s *xb = atonce;
	if (!xb || !xb->dram)
		return 0xffffffff;
	if (!xb->configured) {
		addrbank *u = atonce_dram_under(addr);
		if (u) return u->lget(addr);
	}
	addr &= ONBOARD_SIZE - 1;
	return (xb->dram[addr] << 24) | (xb->dram[addr + 1] << 16) |
		(xb->dram[addr + 2] << 8) | xb->dram[addr + 3];
}
static uae_u32 REGPARAM2 atonce_dram_wget(uaecptr addr)
{
	struct atonce_s *xb = atonce;
	if (!xb || !xb->dram)
		return 0xffff;
	if (!xb->configured) {
		addrbank *u = atonce_dram_under(addr);
		if (u) return u->wget(addr);
	}
	addr &= ONBOARD_SIZE - 1;
	return (xb->dram[addr] << 8) | xb->dram[addr + 1];
}
static uae_u32 REGPARAM2 atonce_dram_bget(uaecptr addr)
{
	struct atonce_s *xb = atonce;
	if (!xb || !xb->dram)
		return 0xff;
	if (!xb->configured) {
		addrbank *u = atonce_dram_under(addr);
		if (u) return u->bget(addr);
	}
	return xb->dram[addr & (ONBOARD_SIZE - 1)];
}
static void REGPARAM2 atonce_dram_lput(uaecptr addr, uae_u32 l)
{
	struct atonce_s *xb = atonce;
	if (!xb || !xb->dram)
		return;
	if (!xb->configured) {
		addrbank *u = atonce_dram_under(addr);
		if (u) { u->lput(addr, l); return; }
	}
	addr &= ONBOARD_SIZE - 1;
	xb->dram[addr] = l >> 24;
	xb->dram[addr + 1] = l >> 16;
	xb->dram[addr + 2] = l >> 8;
	xb->dram[addr + 3] = (uae_u8)l;
}
static void REGPARAM2 atonce_dram_wput(uaecptr addr, uae_u32 w)
{
	struct atonce_s *xb = atonce;
	if (!xb || !xb->dram)
		return;
	if (!xb->configured) {
		addrbank *u = atonce_dram_under(addr);
		if (u) { u->wput(addr, w); return; }
	}
	addr &= ONBOARD_SIZE - 1;
	xb->dram[addr] = w >> 8;
	xb->dram[addr + 1] = (uae_u8)w;
}
static void REGPARAM2 atonce_dram_bput(uaecptr addr, uae_u32 b)
{
	struct atonce_s *xb = atonce;
	if (!xb || !xb->dram)
		return;
	if (!xb->configured) {
		addrbank *u = atonce_dram_under(addr);
		if (u) { u->bput(addr, b); return; }
	}
	xb->dram[addr & (ONBOARD_SIZE - 1)] = (uae_u8)b;
}

static addrbank atonce_dram_bank = {
	atonce_dram_lget, atonce_dram_wget, atonce_dram_bget,
	atonce_dram_lput, atonce_dram_wput, atonce_dram_bput,
	default_xlate, default_check, NULL, NULL, _T("ATonce Plus DRAM"),
	atonce_dram_lget, atonce_dram_wget,
	ABFLAG_RAM | ABFLAG_SAFE, 0, 0
};

/*-------------------------------------------------------------------------*/
/* Execution scheduling: the 286 advances mainly inside a PORT_B resume     */
/* (synchronous, low latency). This hsync slice is the continuation path:   */
/* it keeps a still-running 286 going across hsyncs when a resume slice did  */
/* not reach an I/O trap (long computation). It stays off while frozen, so   */
/* it never double-runs against the resume slice.                           */
/*-------------------------------------------------------------------------*/

static void atonce_hsync(void)
{
	static float totalcycles;
	struct atonce_s *xb = atonce;
	if (!xb || !xb->configured || xb->in_reset)
		return;

	// Idle video refresh: the 68k driver only re-renders the Amiga screen on real
	// 286 video activity (a CRTC scroll, or the bottom-row OUT 0xBA). At the DOS
	// prompt the 286 sits idle, or text lands on a row that never triggers a render,
	// so the boot prompt / pre-scroll "A>" / typed chars stay invisible. So we owe a
	// synthetic full-screen refresh (atonce_fire_refresh fakes a CRTC reg-12 write),
	// serviced at the next safe point.
	//
	// PERFORMANCE: that re-render runs on the 68k via graphics.library and is heavy
	// (25 rows, char->bitplane). Forcing it every frame (50Hz) saturated the 68k ->
	// the prompt felt sluggish, keys took ~1s to appear and arrived in bursts (the
	// 68k was too busy rendering to promptly inject the keyboard IRQ / service the
	// 286's key traps / show the new text). Fix: only refresh when the 286's text
	// page ACTUALLY changed (cheap FNV hash once per frame), plus a slow ~2Hz
	// heartbeat so the blinking cursor still shows. Idle = no render -> 68k free.
	if (++xb->refresh_div >= maxvpos) {
		xb->refresh_div = 0;
		uae_u32 h = atonce_text_hash();
		xb->refresh_heartbeat++;
		int changed = (h != xb->text_hash);
		if (changed || xb->refresh_heartbeat >= 25) {
			xb->text_hash = h;
			xb->refresh_heartbeat = 0;
			xb->refresh_due = 1;
		}
	}
	// If the 286 happens to be idle right now, fire it immediately (low latency).
	// Otherwise atonce_portb_write services refresh_due at the next resume, which
	// keeps firing even through a busy poll loop. atonce_fire_refresh fakes a CRTC
	// reg-12 write -> driver full-screen re-render; see its comment.
	if (xb->refresh_due && !xb->frozen && !xb->trap_pending) {
		atonce_fire_refresh(xb);
		return;                          // driver will render + resume the 286
	}

	if (xb->frozen)
		return;

	float cycles_to_run = (float)cpu_get_speed() / (vblank_hz * maxvpos);
	totalcycles += cycles_to_run;
	int cycs = (int)totalcycles;
	if (cycs > 0)
		atonce_run(xb, cycs);   // same timer_target priming as the resume path
	totalcycles -= (int)totalcycles;
}

static void atonce_reset(int hardreset)
{
	struct atonce_s *xb = atonce;
	if (!xb)
		return;
	xb->configured = 0;
	xb->frozen = 0;
	xb->stopped = 0;
	xb->trap_pending = 0;
	xb->in_reset = 1;
	xb->a20en = 0;
	xb->setup = 0;
	xb->mm_a = xb->mm_b = xb->mm_c = xb->mm_d = 0;
	atonce_intr_vector = -1;
	atonce_rebuild_map(xb);
	atonce_apply_a20(xb);
}

static void atonce_free(void)
{
	if (atonce) {
		pcem_close();
		xfree(atonce->vmem);
		xfree(atonce->emem);
		xfree(atonce);
		atonce = NULL;
	}
	// Re-resolve the PC C: drive next boot (the hardfile handle is owned by the
	// filesystem layer; the user may have changed WinUAE's HDD settings).
	atonce_hfd = NULL;
	atonce_hdd_tried = 0;
}

/*-------------------------------------------------------------------------*/
/* Device init (expansion system, non-autoconfig board).                    */
/*-------------------------------------------------------------------------*/

bool atonce_init(struct autoconfig_info *aci)
{
	aci->zorro = 0;
	aci->addrbank = &expamem_null;
	if (!aci->doinit)
		return true;

	struct atonce_s *xb = xcalloc(struct atonce_s, 1);
	atonce = xb;
	xb->rc = aci->rc;

	atonce_hdd_tried = (xb->rc->device_settings & 1) ? 0 : -1;

	// PCem setup: bare 286, no PC support devices (the LCA has none; the
	// PIT/PIC/DMA/KBC/RTC are all emulated by the 68k driver through traps)
	romset = ROM_AMI286;     // model index only; no ROM is loaded
	model = 1;               // [286] entry of models[] (model_init is empty)
	cpu_manufacturer = 0;
	cpu = 4;                 // cpus_286[4] = "286/16" (16 MHz); the board is 286-16
	fpu_type = FPU_NONE;     // TODO: optional 287 (FPU_287) + err287 path
	AT = 1;
	cpu_set();

	// allocate the PCem memory-map table (pcemmap) before any mem_mapping_add
	initpcemvideo(NULL, false);

	mem_size = ONBOARD_SIZE / 1024;
	mem_init();
	mem_alloc();
	xb->dram = ram;          // PCem-owned 512KB = the board's local DRAM
#if ATONCE_ISOLATE_CHIP
	if (!xb->vmem)
		xb->vmem = xcalloc(uae_u8, ATONCE_VMEM_SIZE);
#endif

	// Minimal PCem core bring-up. We deliberately do NOT init the PC support
	// chips (pit/dma/keyboard/nvr): the LCA has none, the 68k driver emulates
	// them via the I/O traps. pic is still init'd because the CPU core calls
	// picinterrupt() (patched in pcem/pic.cpp to deliver atonce_intr_vector).
	timer_reset();
	pic_init();
	pic_reset();
	codegen_init();          // CPU recompiler tables
	// Turbo ON: cpu_get_speed() (which paces atonce_run via atonce_hsync) returns
	// cpu_turbo_speed = cpu_s->rspeed = the full 16 MHz. With turbo OFF, PCem caps
	// cpu_nonturbo_speed at 8 MHz (cpu.cpp ~229) for any 286 -> the emulated 286
	// ran at half clock (the DOS prompt felt 2-3x slower than real hardware).
	cpu_set_turbo(1);

	// catch-all I/O traps, except 287 range 0xF8-0xFF
	io_sethandlerx(0x0000, 0x00f8,
		atonce_io_inb, atonce_io_inw, atonce_io_inl,
		atonce_io_outb, atonce_io_outw, atonce_io_outl, xb);
	io_sethandlerx(0x0100, 0xff00,
		atonce_io_inb, atonce_io_inw, atonce_io_inl,
		atonce_io_outb, atonce_io_outw, atonce_io_outl, xb);

	// Sub-1MB chip-RAM windows (static, with exec pointers so the 286 can run
	// the BIOS from F000). Must come after mem_init (chip RAM is already
	// allocated by the WinUAE memory system at this point).
	atonce_map_windows();

	// Extended memory above 1MB.
#if ATONCE_ISOLATE_EXT
	// DIAGNOSTIC: back the whole >1MB window with a private, flat buffer mapped
	// with a REAL exec pointer, so PCem's code fetch (getpccache) works when
	// himem.sys relocates/runs in the HMA (>1MB). Fully isolates the 286's
	// extended memory from Amiga RAM (no shared fast RAM, no MEMMODE translation).
	// The atonce_chip_* handlers are generic linear-buffer handlers:
	//   exec ptr = emem            -> getpccache fetches emem[addr - 0x100000]
	//   priv     = emem - 0x100000 -> handlers index priv[addr] = emem[addr-0x100000]
	if (!xb->emem)
		xb->emem = xcalloc(uae_u8, ATONCE_EMEM_SIZE);
	mem_mapping_add(&atonce_mapping, 0x100000, ATONCE_EMEM_SIZE,
		atonce_chip_readb, atonce_chip_readw, atonce_chip_readl,
		atonce_chip_writeb, atonce_chip_writew, atonce_chip_writel,
		xb->emem, MEM_MAPPING_EXTERNAL, xb->emem - 0x100000);
	mem_set_mem_state(0x100000, ATONCE_EMEM_SIZE,
		MEM_READ_EXTERNAL | MEM_WRITE_EXTERNAL);
	write_log(_T("ATonce: extended memory ISOLATED, private %uMB flat buffer at x86 0x100000 (exec=%p)\n"),
		ATONCE_EMEM_SIZE / (1024 * 1024), xb->emem);
#else
	// MEMMODE-placed, dynamic translation onto Amiga RAM, function handlers (no
	// exec ptr - code fetch from >1MB needs the private buffer above).
	mem_mapping_add(&atonce_mapping, 0x100000, 0x1000000 - 0x100000,
		atonce_mem_readb, atonce_mem_readw, atonce_mem_readl,
		atonce_mem_writeb, atonce_mem_writew, atonce_mem_writel,
		NULL, MEM_MAPPING_EXTERNAL, xb);
	mem_set_mem_state(0x100000, 0x1000000 - 0x100000,
		MEM_READ_EXTERNAL | MEM_WRITE_EXTERNAL);
#endif

	atonce_reset(1);

	// 68k window to the onboard DRAM at 0x900000-0x9FFFFF. The handlers delegate to
	// the Z2 fast RAM underneath (fastmem_bank[0], looked up live - see
	// atonce_dram_under) while the board is unconfigured, so the OS can use that fast
	// RAM during boot; the window shadows only once the driver brings the board up.
	// This mirrors real HW (board inert from power-on). Without it, the OS allocates
	// at 0x900000 during early boot (e.g. an attached hardfile's RDB filesystem load)
	// and the accesses hit the 286 DRAM -> corruption -> crash / "no system disk".
	map_banks(&atonce_dram_bank, 0x900000 >> 16, 0x100000 >> 16, ONBOARD_SIZE);

	device_add_hsync(atonce_hsync);
	device_add_reset(atonce_reset);
	device_add_exit(atonce_free, NULL);

	write_log(_T("ATonce Plus initialized\n"));
	return true;
}

bool atonce_available(void)
{
	return atonce != NULL;
}

#endif /* WITH_X86 */