Close

20230214a -- Memory, cont.

A project log for ROM Disassembly - AlphaSmart Pro

Wherein I disassemble the ROM from a vintage typewriter-thing

ziggurat29ziggurat29 02/16/2023 at 13:380 Comments

Operating under the current assumption that RAM is 32 KiB banked at address 0000-7fff, with the first 256 bytes masked off by special function registers and internal SRAM, some other code sections of interest were found.  E.g.:

ED00             loc_ED00:
ED00 BD EC 79        jsr     EC79            ; select page 0
ED03 4F              clra
ED04 B7 01 5E        staa    byte_15E        ; ??? stamp page no 0
ED07 86 01           ldaa    #1
ED09 BD EC 60        jsr     EC60            ; select page 1
ED0C 86 01           ldaa    #1
ED0E B7 01 5E        staa    byte_15E        ; ??? stamp page no 1
ED11 86 02           ldaa    #2
ED13 BD EC 60        jsr     EC60            ; select page 2
ED16 86 02           ldaa    #2
ED18 B7 01 5E        staa    byte_15E        ; ??? stamp page no 2
ED1B 86 03           ldaa    #3
ED1D BD EC 60        jsr     EC60            ; select page 3
ED20 86 03           ldaa    #3
ED22 B7 01 5E        staa    byte_15E        ; ??? stamp page no 3
ED25 BD EC 79        jsr     EC79            ; select page 0
ED28 B6 01 5E        ldaa    byte_15E        ; ??? retrieve page number
ED2B 81 00           cmpa    #0              ; validate page no 0
ED2D 26 CE           bne     ECFD
...

So, assuming the 'select RAM page number' functions from yesterday are indeed what they are, it seems that we iterate through the 4 pages, stamping the page number in a well-known location.

Also, following down that path to the ECFD section: 

EDDF             loc_EDDF:
EDDF E6 00           ldab    0,x
EDE1 37              pshb
EDE2 36              psha
EDE3 3C              pshx
EDE4 BD F7 48        jsr     setcpLine0_F748 ; set cursor Line 0
EDE7 CE FC A3        ldx     #aAdrbusramErr  ; "AdrBusRAM err:"
EDEA BD F6 69        jsr     showText_F669   ; show nts text @ X
EDED 20 C5           bra     loc_EDB4
...

and then

EDB4             loc_EDB4:
EDB4 38              pulx
EDB5 8F              xgdx
EDB6 BD F5 B0        jsr     showHexAB_F5B0  ; send AB as four-digit hex to display
EDB9
EDB9             loc_EDB9:
EDB9 CE FC B6        ldx     #aExp           ; "Exp:"
EDBC BD F6 69        jsr     showText_F669   ; show nts text @ X
EDBF 32              pula
EDC0 BD F5 B9        jsr     showHexA_F5B9   ; send A as two-digit hex to display
EDC3 CE FC B2        ldx     #aRd            ; "Rd:"
EDC6 BD F6 69        jsr     showText_F669   ; show nts text @ X
EDC9 32              pula
EDCA BD F5 B9        jsr     showHexA_F5B9   ; send A as two-digit hex to display
EDCD 0B              sev
EDCE 39              rts

So, when the stamped page number does not match the selected page, a message is emitted:

AdrBusRAM err: AAAA Exp: EE Rd: RR

and the V flag is set to indicate error

AAAA is the address of the fault (015e), EE is the value expected (the page no), and RR is the value actually read.

OK, so comments added and labels updated and propagated throughout.  After that comes some calls to this routine:

EDEF             EDEF:
EDEF CE 7F FF        ldx     #$7FFF          ; start from top of external RAM
EDF2             loop_EDF2:
EDF2 E6 00           ldab    0,x             ; save what's currently there
EDF4 A7 00           staa    0,x             ; stick in our pattern
EDF6 A1 00           cmpa    0,x             ; read back to test
EDF8 26 0A           bne     leaveFail_EE04  ; oh no...
EDFA E7 00           stab    0,x             ; restore what was there before
EDFC 09              dex                     ; next!
EDFD 8C 01 00        cpx     #$100           ; go to bottom of external RAM
EE00 24 F0           bcc     loop_EDF2
EE02 0A              clv                     ; clear V; success!
EE03 39              rts
EE04             leaveFail_EE04:
EE04 E6 00           ldab    0,x             ; fail; save fail address in D for later display
EE06 0B              sev                     ; set V; fail :(
EE07 39              rts

So this fills RAM (non-destructively) with a value in A and tests that it reads back correctly.  It goes from 7fff down to 0100, so this also tends to confirm the 'we threw away the first 256 bytes of each page in the interest of simplifying the hardware design' hypothesis.

All this tends to confirm that the external RAM is grouped into 4 x 32 KiB pages, or we'd probably have seen many more page selects made.  (Plus there were only two bits in the presumed page select functions, so there can only be four.)

This seems obvious since I've spelled the conclusions out here, but when reverse-engineering a disassembly, you have to be prepared to backtrack any assumptions you make pending future discoveries.  But we seem to have a preponderance of evidence in this case, so I feel pretty confident about this interpretation of the RAM arrangement in this system.

Discussions