Operating under the current assumption that RAM is 32 KiB banked at address 0000-7fff, with the first 256 bytes masked off by special function registers and internal SRAM, some other code sections of interest were found. E.g.:
ED00 loc_ED00:
ED00 BD EC 79 jsr EC79 ; select page 0
ED03 4F clra
ED04 B7 01 5E staa byte_15E ; ??? stamp page no 0
ED07 86 01 ldaa #1
ED09 BD EC 60 jsr EC60 ; select page 1
ED0C 86 01 ldaa #1
ED0E B7 01 5E staa byte_15E ; ??? stamp page no 1
ED11 86 02 ldaa #2
ED13 BD EC 60 jsr EC60 ; select page 2
ED16 86 02 ldaa #2
ED18 B7 01 5E staa byte_15E ; ??? stamp page no 2
ED1B 86 03 ldaa #3
ED1D BD EC 60 jsr EC60 ; select page 3
ED20 86 03 ldaa #3
ED22 B7 01 5E staa byte_15E ; ??? stamp page no 3
ED25 BD EC 79 jsr EC79 ; select page 0
ED28 B6 01 5E ldaa byte_15E ; ??? retrieve page number
ED2B 81 00 cmpa #0 ; validate page no 0
ED2D 26 CE bne ECFD
...
So, assuming the 'select RAM page number' functions from yesterday are indeed what they are, it seems that we iterate through the 4 pages, stamping the page number in a well-known location.
Also, following down that path to the ECFD section:
EDDF loc_EDDF:
EDDF E6 00 ldab 0,x
EDE1 37 pshb
EDE2 36 psha
EDE3 3C pshx
EDE4 BD F7 48 jsr setcpLine0_F748 ; set cursor Line 0
EDE7 CE FC A3 ldx #aAdrbusramErr ; "AdrBusRAM err:"
EDEA BD F6 69 jsr showText_F669 ; show nts text @ X
EDED 20 C5 bra loc_EDB4
...
and then
EDB4 loc_EDB4:
EDB4 38 pulx
EDB5 8F xgdx
EDB6 BD F5 B0 jsr showHexAB_F5B0 ; send AB as four-digit hex to display
EDB9
EDB9 loc_EDB9:
EDB9 CE FC B6 ldx #aExp ; "Exp:"
EDBC BD F6 69 jsr showText_F669 ; show nts text @ X
EDBF 32 pula
EDC0 BD F5 B9 jsr showHexA_F5B9 ; send A as two-digit hex to display
EDC3 CE FC B2 ldx #aRd ; "Rd:"
EDC6 BD F6 69 jsr showText_F669 ; show nts text @ X
EDC9 32 pula
EDCA BD F5 B9 jsr showHexA_F5B9 ; send A as two-digit hex to display
EDCD 0B sev
EDCE 39 rts
So, when the stamped page number does not match the selected page, a message is emitted:
AdrBusRAM err: AAAA Exp: EE Rd: RR
and the V flag is set to indicate error
AAAA is the address of the fault (015e), EE is the value expected (the page no), and RR is the value actually read.
OK, so comments added and labels updated and propagated throughout. After that comes some calls to this routine:
EDEF EDEF:
EDEF CE 7F FF ldx #$7FFF ; start from top of external RAM
EDF2 loop_EDF2:
EDF2 E6 00 ldab 0,x ; save what's currently there
EDF4 A7 00 staa 0,x ; stick in our pattern
EDF6 A1 00 cmpa 0,x ; read back to test
EDF8 26 0A bne leaveFail_EE04 ; oh no...
EDFA E7 00 stab 0,x ; restore what was there before
EDFC 09 dex ; next!
EDFD 8C 01 00 cpx #$100 ; go to bottom of external RAM
EE00 24 F0 bcc loop_EDF2
EE02 0A clv ; clear V; success!
EE03 39 rts
EE04 leaveFail_EE04:
EE04 E6 00 ldab 0,x ; fail; save fail address in D for later display
EE06 0B sev ; set V; fail :(
EE07 39 rts
So this fills RAM (non-destructively) with a value in A and tests that it reads back correctly. It goes from 7fff down to 0100, so this also tends to confirm the 'we threw away the first 256 bytes of each page in the interest of simplifying the hardware design' hypothesis.
All this tends to confirm that the external RAM is grouped into 4 x 32 KiB pages, or we'd probably have seen many more page selects made. (Plus there were only two bits in the presumed page select functions, so there can only be four.)
This seems obvious since I've spelled the conclusions out here, but when reverse-engineering a disassembly, you have to be prepared to backtrack any assumptions you make pending future discoveries. But we seem to have a preponderance of evidence in this case, so I feel pretty confident about this interpretation of the RAM arrangement in this system.
Discussions
Become a Hackaday.io Member
Create an account to leave a comment. Already have an account? Log In.