And we're looking at a partial success with the SDR.
Sending a byte, causes CNT to pulse 8 times, and an interrupt is generated afterwards. (Empty buffer interrupt)
Sending two bytes, causes CNT to pulse 16 times, and an interrupt is generated afterwards. (Empty buffer interrupt, again)
This means the state machine that controls the output is pretty much correct. However, no byte is received on the second CIA. Or, more accurately, a 00 is received. (The second CIA being a real MOS6526). The interrupt bit is set in the second CIA, so it acknowledges the byte being received, even though it is zero. I need to get the Logic Analizer out, to check is SP is doing anything, but probably it's flat at 0.
Receiving a byte is not looking good. I can see the timer counting CNT pulses, when configured to do so, so CNT is being received. However, no interrupt is generated, and nothing gets written into the SDR. This points to an issue in the shift register(U307) and/or bit counter (U308)
The SDR is aware of the SPMODE bit (input or output). Trying to send a byte when the SDR is configured for INPUT, doesn't do anything (except writing to the SDR register, which is expected), but nothing is shifted out.
The output stage fix feels easy. As it is sending enough pulses, and stoping right when it has to stop, I can trust the state machine is doing it's job. I'm now pretty sure the clock pulse to load the shift register (U313) is arriving too late, right after it has been put into output mode (S1=0), so it's not loading the value present in the register. Delaying this control bit for the shift register by one clock cycle should do the trick. I have no spare FFs in the board, so some hacking will be needed.
Regarding the input stage issues.. there's a couple points where I'm replicating the DFF arrangement seen in here
http://forum.6502.org/download/file.php?id=17004&mode=view. I'm using it to sync the CNT pulses, and again to generate the FULL signal, that indicates 8 bits have been received. Any of these two circuits failing would cause what I'm seing. Two bodge wires and two cut traces should correct this, and hopefully, bring the input stage to live.
The schematic for B3 is here
https://github.com/dmolinagarcia/74HCT6526/blob/main/pdf/B3.pdf if anyone feels like taking a look.
Cheers!