LEEK@QUCDN.QueensU.CA (07/30/90)
I am working on a PD hardware project to allow A1000 owners to run 2.0.
-- (yeap !!)
I have some questions...
Can anyone please tell me when and where the kickstart WCS is write protected ?
Is it in Boot Rom or in Kickstart ?
Right now I have added an extra 256K ram chip at f80000 to fbffff successfully.
The problem is that the extra decoding address line A18 is tangled in the PAL
equations that perform the write protect function among other things. I need
the info to continue this project.
Will Commodore licence an official 2.0 Kickstart rom image on a floppy ?
I can see quite a few might want a legal copy.
(BTW the hardware hack for putting 2.0 in 32-bit ram for the Lucas/Frances
should be as simple as soldering a piece of wire. I can't give any details as
it is still on my drawing board.)
Thanks in advance.
K. C. Lee
No disclaimer required...jraja@niksula.hut.fi (Jarno Rajahalme) (08/09/90)
In article <90210.130137LEEK@QUCDN.BITNET> LEEK@QUCDN.QueensU.CA writes: > Path: santra!fuug!sics.se!sunic!uupsi!rpi!zaphod.mps.ohio-state.edu!samsung!cs.utexas.edu!news-server.csri.toronto.edu!qucdn!leek > From: LEEK@QUCDN.QueensU.CA > Newsgroups: comp.sys.amiga.hardware > Date: 29 Jul 90 17:01:37 GMT > Organization: Queen's University at Kingston > Lines: 25 > I am working on a PD hardware project to allow A1000 owners to run 2.0. > -- (yeap !!) > I have some questions... > > Can anyone please tell me when and where the kickstart WCS is write protected ? > Is it in Boot Rom or in Kickstart ? > Write protection is disabled as an consequence of the RESET command. RESET also disables all CHIP-RAM. Following code gets your A1000 in to unprotected mode: * This program switches on the bootROM at $f80000 !!! * And makes KickRAM writeable * * Caution: RESETs your machine!!! move.l #trap0,$80 trap #0 trap0 movea.l $fc0004,a0 ;Of cource works for 256K ROM only :-) reset ;<<<< must be longword aligned (prefetch) jmp (a0) or located in FAST-RAM at runtime! I disassembled the Boot-ROM a little and noticed that Write-Protection is enabled by attempting to write to Boot-ROM's area. To be exact: First the Kickstart is tested (somehow) and if test is succesful all tollowing tests and disk activity is bypassed. If not, the whole system is checked and Kickstart loaded. THEN: (from $f80262) Bootroms address ($f80000) is loaded to a1, Kickstart's entry address (from $fc0004) is loaded to a0, d0 is cleared; following code is moved to stack: move.w d0,(a1) jmp (a0) and then we jump to (sp) (containing the code above!). As the tesult Boot-rom is disabled (and write-protection enabled) and KickStart started. Now there is a conflict here. Because Boot-ROM is located at $f80000 where the new ram should be placed, the ram in the same location is not usable (ofcourse). At first, Boot-ROM, however, checks if it is located in $f00000 (!) and if not, checks if $f00000 contains any valid ROM and jumps there. (a5 contains the return address, as elsewhere in Boot-ROM code.) BUT: Boot-ROM contains much position dependent code, and would have to be totally corrected for the new location. Changing the loader wouldn't be so difficult to load whatever Kick version. This Task would be MUCH easier with some co-operation with Commodore-Amiga (SOURCES!, we NEED SOURCE-CODE!). Another solution would be to let the 1.3 boot normally, and then write a program to load 2.0. There are few problems with this: - RESET disables the chip-RAM. So some FAST is needed. - Would C-A-A-reset work normally??? > Right now I have added an extra 256K ram chip at f80000 to fbffff successfully. > The problem is that the extra decoding address line A18 is tangled in the PAL > equations that perform the write protect function among other things. I need > the info to continue this project. > I don't have any schematics so I can say nothing to this My A1000 (European (PAL) version differs slightly from others I've seen. I't doesn't have separate Kick-RAM board so I can't use any Rejuvenator or such. This project is my only (?) hope to get 2.0. > Will Commodore licence an official 2.0 Kickstart rom image on a floppy ? > > I can see quite a few might want a legal copy. > > (BTW the hardware hack for putting 2.0 in 32-bit ram for the Lucas/Frances > should be as simple as soldering a piece of wire. I can't give any details as > it is still on my drawing board.) > > Thanks in advance. > > K. C. Lee Jarno > > No disclaimer required... -- _____________________________________________________________________________ | // Address: Jarno Rajahalme | EMail: | | //| Servin Maijan tie 12 H 111 | jrajahal@otax.tky.hut.hi | | \\ //-| M I G A 02150 ESPOO | d37686l@kaira.hut.fi | | \X/ | forever!! FINLAND , tel (90) 4682891 | jraja@niksula.hut.fi | -----------------------------------------------------------------------------
valentin@cbmvax.commodore.com (Valentin Pepelea) (08/09/90)
In article <JRAJA.90Aug8191625@punisher.hut.fi> jraja@niksula.hut.fi (Jarno Rajahalme) writes: > > Write protection is disabled as an consequence of the RESET command. > RESET also disables all CHIP-RAM. And all external devices. In other words, all FAST ram also. :-( > I disassembled the Boot-ROM a little and noticed that Write-Protection > is enabled by attempting to write to Boot-ROM's area. Not quite. The boot-ROM's are turned off and CHIP ram is turned on by clearing the least significant bit of the ciaa.pra register ($bfe001). But before doing that, one must first set the the least significant bit as output. We do that by setting the least significant bit of the ciaa.ddra register. ($bfe201) The following sequence will do what you want: move.b #3,$bfe201 ; Set 2 least significant bits as outputs move.b #2,$bfe001 ; Light up led; turn off boot-ROMs > Another solution would be to let the 1.3 boot normally, and then write > a program to load 2.0. There are few problems with this: > > - RESET disables the chip-RAM. So some FAST is needed. > - Would C-A-A-reset work normally??? This has indeed been done. The above code which turns on CHIP ram is first loaded into a 68020's cache, then a reset is executed, and finally the code from the cache is executed. Both SetCPU 1.6 and a special program called MMUkick do just that. Actually, since there was a 68030 accelerator board that disabled all caching of CHIP ram, even instruction caching, the cache had to be loaded from FAST ram. Quite a hack. But I've already described at length how that was done. Valentin -- The Goddess of democracy? "The tyrants Name: Valentin Pepelea may distroy a statue, but they cannot Phone: (215) 431-9327 kill a god." UseNet: cbmvax!valentin@uunet.uu.net - Ancient Chinese Proverb Claimer: I not Commodore spokesman be
jraja@niksula.hut.fi (Jarno Rajahalme) (08/10/90)
In article <13715@cbmvax.commodore.com> valentin@cbmvax.commodore.com (Valentin Pepelea) writes: > In article <JRAJA.90Aug8191625@punisher.hut.fi> jraja@niksula.hut.fi > (Jarno Rajahalme) writes: > > > > Write protection is disabled as an consequence of the RESET command. > > RESET also disables all CHIP-RAM. > > And all external devices. In other words, all FAST ram also. :-( mine (insider-type ) doesn't even detect RESET signal. The $c00000 pseudo-FAST ram gets resetted because it is controlled by Custom-Chips. I don't know about autoconfig ram. > > I disassembled the Boot-ROM a little and noticed that Write-Protection > > is enabled by attempting to write to Boot-ROM's area. > > Not quite. The boot-ROM's are turned off and CHIP ram is turned on by > clearing the least significant bit of the ciaa.pra register ($bfe001). But > before doing that, one must first set the the least significant bit as output. > We do that by setting the least significant bit of the ciaa.ddra register. > ($bfe201) The following sequence will do what you want: > > move.b #3,$bfe201 ; Set 2 least significant bits as outputs > move.b #2,$bfe001 ; Light up led; turn off boot-ROMs > This code is in position $f800EE of Boot-ROM, in middle of code and before KS is even loaded. ( Wierd: the bit is really NAMED 'memory overlay bit'). So it surely does NOT disable Boot-ROM. BUT definately the last thing that Boot-ROM-code does is A write to $F80000 and jump to KS. (This code is executed in stack. Boot-ROM uses first 256K of address space as stack. It calls it 'local-ram' (local on the motherboard??)). You can try this yourself with the code I provided in the beginning of my previous post. It resets your machine to unprotected state: The Boot-Rom is visible at $F80000, and KS is writeable. This is how I got the disassembly of the boot-ROM-code. When you try to write to $F80000 (with some monitor), the Boot-ROM is gone and the KS is freezed as you left it!. The code jumps directly after reset to KS entry point and no such code you privided above is ever executed. So it doesn't enable CHIP-ram either. > > Another solution would be to let the 1.3 boot normally, and then write > > a program to load 2.0. There are few problems with this: > > > > - RESET disables the chip-RAM. So some FAST is needed. > > - Would C-A-A-reset work normally??? > > This has indeed been done. The above code which turns on CHIP ram is first > loaded into a 68020's cache, then a reset is executed, and finally the code > from the cache is executed. Both SetCPU 1.6 and a special program called > MMUkick do just that. > > Actually, since there was a 68030 accelerator board that disabled all caching > of CHIP ram, even instruction caching, the cache had to be loaded from FAST > ram. Quite a hack. But I've already described at length how that was done. Won't help vanilla A1000 without MMU :-( And now something else... Someone mentioned, that Commodore has an version of 2.0 mapped to $F00000. GRREEAAT! just get this (somehow) to your A1000 and boot! How? The very first thing that Boot-ROM-code does is to check if there is some ROM in $F00000 (checks the $1111), and if founds, jumps there BEFORE enabling the WCS-write protection. IMAGINE: As the first thing you could load 256K of some favourite code to $FC0000 and then enable the write protection (if you wish). And there it is to the next power shutdown! (Yes! this RAM and WCS check and exeption is made before any RAM-tests so it is preserved!). Then this ROM board would include some switch which removes the Rom-tag ($1111) and you can load your favourite post-2.0 kickstart from floppy. NOTICE! No modifications to your Boot-ROM needed, just an internal or external ROM-plate and some switch and GO! The problem with the $F80000 KS is that Boot-ROM is mapped to same location, and the code in Boot-ROM is position DEpendent. HELP needed!! I checked my A1000 and it really doesn't have any separate WCS-board. WCS-RAM is on the motherboard. So I can't use any products/hacks based to replacing the WCS-board. I need schematics to get my work on. WHERE COULD I GET SCHEMATICS????? Motherboard is PART NO 252277 dated 86.03.28 and is made in JAPAN (?!). > Valentin Jarno > -- > The Goddess of democracy? "The tyrants Name: Valentin Pepelea > may distroy a statue, but they cannot Phone: (215) 431-9327 > kill a god." UseNet: cbmvax!valentin@uunet.uu.net > - Ancient Chinese Proverb Claimer: I not Commodore spokesman be -- _____________________________________________________________________________ | // Address: Jarno Rajahalme | EMail: | | //| Servin Maijan tie 12 H 111 | jrajahal@otax.tky.hut.hi | | \\ //-| M I G A 02150 ESPOO | d37686l@kaira.hut.fi | | \X/ | forever!! FINLAND , tel (90) 4682891 | jraja@niksula.hut.fi | -----------------------------------------------------------------------------
ggem@mtecv2.mty.itesm.mx (Gustavo Gomez-E Mtz) (08/13/90)
Has anybody checked out the boot sector in the AMAX distribution disk? It contains code to disable the write protection of the WCS so that it can load the M*c rom code into it. well, enough rambling...
valentin@cbmvax.commodore.com (Valentin Pepelea) (08/18/90)
In article <JRAJA.90Aug10005930@psykoman.hut.fi> jraja@niksula.hut.fi (Jarno Rajahalme) writes: >> move.b #3,$bfe201 ; Set 2 least significant bits as outputs >> move.b #2,$bfe001 ; Light up led; turn off boot-ROMs > >This code is in position $f800EE of Boot-ROM, in middle of code and >before KS is even loaded. ( Wierd: the bit is really NAMED 'memory >overlay bit'). So it surely does NOT disable Boot-ROM. Well, I'll be damned! You're right. I got confused by the OVL (overlay) bit. I thought it was also write protecting the WCS (overlaying it somehow). Sheesh. >The code jumps directly after reset to KS entry point and no such code >you privided above is ever executed. So it doesn't enable CHIP-ram >either. Perhaps on the A1000. But on the A2000, the code I listed definitely enables CHIP-ram. MMUKick would definitely not work if this was not true. > Someone mentioned, that Commodore has an version of 2.0 mapped to > $F00000. GRREEAAT! just get this (somehow) to your A1000 and boot! There are also $200000 kickfiles. One uses KickIt to boot them. And there's ZKick from Dan Zenchelsky. He claims it works with any memory board addressed at $200000. > I checked my A1000 and it really doesn't have any separate WCS-board. > WCS-RAM is on the motherboard. > > So I can't use any products/hacks based to replacing the WCS-board. > I need schematics to get my work on. Where did you get such a machine? Did you replace the WCS yourself? I am not aware of any A1000's sold without a WCS daughter board. > WHERE COULD I GET SCHEMATICS????? CATS. Valentin -- The Goddess of democracy? "The tyrants Name: Valentin Pepelea may distroy a statue, but they cannot Phone: (215) 431-9327 kill a god." UseNet: cbmvax!valentin@uunet.uu.net - Ancient Chinese Proverb Claimer: I not Commodore spokesman be
U3364521@ucsvc.ucs.unimelb.edu.au (Lou Cavallo) (08/18/90)
G'day, my apologies for intruding into your discussion fellas but below you say.. VP> In article <13869@cbmvax.commodore.com>, valentin@cbmvax.commodore.com VP> (Valentin Pepelea) writes: JR> In article <JRAJA.90Aug10005930@psykoman.hut.fi> jraja@niksula.hut.fi JR> (Jarno Rajahalme) writes: JR> I checked my A1000 and it really doesn't have any separate WCS-board. JR> WCS-RAM is on the motherboard. JR> JR> So I can't use any products/hacks based to replacing the WCS-board. JR> I need schematics to get my work on. VP> Where did you get such a machine? Did you replace the WCS yourself? I VP> am not aware of any A1000's sold without a WCS daughter board. Are you perhaps discussing PAL Amiga 1000 machines without daughterboards? I have an Australian version of such a machine (perhaps v 1.4). I had to interrupt here. Because of this feature I believe that I cannot buy a ``Rejuvinator'' like board because I do not have a daughterboard to replace. {There is a local Oz motherboard like product to be released RSN :-) but I choose not to replace my motherbaord to get ECS compatibility.} Does anyone one know if the DVS Wonder must replace the daughterboard? I'll be watching for any of your developments Jarno. :-) yours truly, Lou Cavallo.
billsey@agora.uucp (Bill Seymour) (08/20/90)
In article <13869@cbmvax.commodore.com> valentin@cbmvax (Valentin Pepelea) writes: :In article <JRAJA.90Aug10005930@psykoman.hut.fi> jraja@niksula.hut.fi :(Jarno Rajahalme) writes: :> I checked my A1000 and it really doesn't have any separate WCS-board. :> WCS-RAM is on the motherboard. :> :> So I can't use any products/hacks based to replacing the WCS-board. :> I need schematics to get my work on. : :Where did you get such a machine? Did you replace the WCS yourself? I am not :aware of any A1000's sold without a WCS daughter board. The last batch of A1000s built (sold only outside the US, I believe) were all built with the WCS as part of the motherboard. It really threw us for a loop the first time we got a technical call from someone trying to install a Kickstart Eliminator in one! :-) :Valentin :-- :The Goddess of democracy? "The tyrants Name: Valentin Pepelea :may distroy a statue, but they cannot Phone: (215) 431-9327 :kill a god." UseNet: cbmvax!valentin@uunet.uu.net : - Ancient Chinese Proverb Claimer: I not Commodore spokesman be -- -Bill Seymour ...tektronix!reed!percival!agora!billsey ============================================================================= Bejed, Inc. NES, Inc. Northwest Amiga Group At Home Sometimes (503) 281-8153 (503) 246-9311 (503) 656-7393 BBS (503) 640-0842