MESS and it's integrated debugger have already proved useful to me.
Unfortunately my grasp of C is weak (and the implementation of write-only and read registers at the same address with different semantics might be tricky)...
It looks as if the COMMUNICATIONS STATUS / CONTROL REGISTER 02 - - together with possibly less important registers (8,11, 27, 67, 50) are still unmapped in MESS(UI)145u7b.
Could be a problem, as the rainbow relies on the state of the MHFU ('massive hardware failure' watchdog) in bit 5. It must be somehow acknowledged by the 8088 and is triggered by the video processor.
P.S.: i just disassembled the boot rom with IDA 5 Freeware to find out what it does (below, feel free to change or improve it; IDA database included)...
https://dl.dropbox.com/u/37819653/RBLOW_v1_IDA5_free.7z
They used several fixed timing loops (which later had to be patched to higher values when the NEC V20 CPU came out).
Offsets are 072F and 0B36. Guess that's no problem for MESS, as it is cycle-exact...
Notes
- after reset, execution starts at pos.0 of the jump table (this redirects to $86)
- the CRC check of the ROM (possibly all 3) can be defeated by setting offset $303 to $00
- test routines for factory tests are implemented. When jumpers W13, W14 or W15 are set, bits 1-3 of register 0A (normally set at 1) go low. Code to evaluate these starts around offset $251.
An interesting feature, because diskette, video and printer signals can be routed to the serial port (if i read the manual correctly).
Is it difficult to get jumpers implemented?-----------
':maincpu' (F40A6): unmapped i/o memory write to 0002 = F4 & FF
':maincpu' (F40A8): unmapped i/o memory read from 0002 & FF
000000A2: B0F4 mov al,0F4 ;"�"
000000A4: E602 out 02,al
000000A6: E402 in al,02
000000A8: A820 test al,020 ;" "
LATER
':maincpu' (F4154): unmapped i/o memory read from 0067 & FF
':maincpu' (F4962): unmapped i/o memory write to 0027 = 94 & FF
':maincpu' (F4964): unmapped i/o memory read from 0050 & FF
':maincpu' (F5434): unmapped i/o memory read from 0000 & FF
':maincpu' (F5D95): unmapped i/o memory read from 0008 & FF
':maincpu' (FE87A): unmapped i/o memory write to 0011 = 17 & FF
///////////////////////////////////////////////////////////////
[02] COMMUNICATIONS STATUS REGISTER - PAGE 154 (**** READ **** )
=> SHOWN IN 4-30; bits in 4-16 (page 154)
Used to read status of SERIAL modem, IRQ line of each CPU, and MHFU logic enable signal.
TABLE 4-16:
# VALUE
0 1 * COMM RI (represents the state of RING INDICATOR - RI)
1 2 COMM SI/SCF (state of SPEED INDICATOR LINE -or- SECONDARY RECEIVE LINE SIGNAL DETECT)
2 4 * COMM DSR (state of DATA SET READY)
3 8 * COMM CTS (state of CLEAR TO SEND)
4 $10 COMM RLSD (RECEIVE LINE SIGNAL DETECT)
5 $20 MHFU ENBL L (status of MHFU enable L)
6 $40 INT88 L (reflects status of INT88 L bit asserted by the Z80 to interrupt the 8088)
7 $80 INTZ80L (reflects the status of the INTZ80L bit asserted by the 8088 to interrupt the Z80A)
///////////////////////////////////////////////////////////////
[02] COMMUNICATIONS CONTROL REGISTER - PAGE 155 (**** WRITE **** )
=> SHOWN IN 4-31 and the bits in 4-17 = PAGE 155
Used to set / write MODEM (SERIAL) + DIAGNOSTIC LEDs :
TABLE 4-17:
# VALUE
0 1 COMM SPD SEL H (controls SPEED SELECT line on COMM port)
1 2 COMM SRTS H (controls SECONDARY REQUEST TO SEND line on COMM port)
2 4 COMM DTR L
3 8 COMM RTS
4 $10 LED D6 LSB (wrong) - D3 !
5 $20 LED D3 (wrong) - D6 !
6 $40 LED D4
7 $80 LED D5
///////////////////////////////////////////////////////////////
2 DIAGNOSTIC 8 BIT REGISTERS:
///////////////////////////////////////////////////////////////
[0A] DIAGNOSTIC WRITE REGISTER - PAGE 153 ( *** WRITE ONLY *** )
=> SHOWN IN 4-28 and the bits in 4-10 to 4-14
Used during diagnostic testing to control and read the status of various system FX.
TABLE 4-10:
# VALUE
0 1 ZRESET (1 resets the Z80 from the 8088 processor side; active at power-up)
1 2 DISPLAY BLANK (blank = 0)
2 4 GRF VID SEL
3 8 PARITY TEST (1 = high enbales testing of the parity circuit on optional MEMORY BOARD)
4 $10 DIAG LOOPBACK (0 = cleared at power up, RX50 and DC12 video circuit testing thru printer)
5 $20 PORT LOOPBACK (COMM, PRINTER and KEYBOARD tests)
6 $40 PROGRAMM NVM (when 1, this allows data to be written into the NVM)
7 $80 RECALL NVM (read / recall data from the NVM)
NOT SHOWN : TABLES 4-11 to 4-14 show various LOOPBACK routings to serial
///////////////////////////////////////////////////////////////
[0A] DIAGNOSTIC READ REGISTER - PAGE 153 ( *** READ **** )
=> see TABLE 4-29 and for the bits see 4-15
TABLE 4-15:
# VALUE
0 1 ZRESET L (represents the state of bit 0 of the 8088 diagnostic write register)
1-3 - state of W13, W14 and W15 MANUFACTURING TEST JUMPERS (normally high = 1)
4 $10 DIAG LOOPBACK H (diagnostic loopback H, state of bit 4 of 8088 diag.write register)
5 $20 PORT LOOPBACK H (PORT loopback H, state of bit 5 of 8088 diag.write register)
6 $40 PROGRAMM NVM (program NVM : state of bit 6 of 8088 diag.write register)
7 $80 RECALL NVM (recall NVM: state of bit 7 ...)
EDIT: i detest un-searchable PDFs, so i typed in this textual representation with page references to the technical manual (pc100tm1.pdf). BTW: is there a programmer's manual for the Rainbow?
