30 Apr
2018
30 Apr
'18
3:24 p.m.
On Mon, Apr 30, 2018 at 10:29:13AM -0400, Ethan Dicks via cctalk wrote:
[...] The exact value to write to which address is
documented somewhere but I
haven't done any digging to find it. I've just been using the Fluke and
running the processor for a few seconds (UUT button) to let the ROMs do their
thing, _then_ using the Fluke for RAM tests at $FC0000-$FFFFFF.
I disassembled the A1000 boot ROM recently. There's a lot of interesting
debugging cruft left in there, otherwise it could have fitted on a smaller
chip.
As far as I can tell from the code, a 68000 RESET sets the latch such that
F80000-FBFFFF contains the boot ROM and FC0000-FFFFFF is the writable WCS. A
*write* to F80000 (and probably any other address up to FBFFFF) flips the latch
such that the WCS is write-protected and is mirrored throughout the region
F80000-FFFFFF. Playing with the UAE debugger confirms this theory is correct
for it, but I don't own a suitable hardware debugger to test on my real A1000.
Without a debugger, one could also build a Zorro-I board for the edge slot
which presents a debug ROM at F00000-F7FFFF, and provided it starts with the
right magic number, will be executed with the WCS still write-enabled. (The
CDTV puts its CD-ROM driver and fancy animated boot screen in that space.)