+Lathe26 Posted March 28, 2021 Share Posted March 28, 2021 11 hours ago, DZ-Jay said: I think steps 2 and 3 are reversed. The EXEC starts execution and first looks at address $4800 for a usable ROM. This is why we then can bank-switch the ECS EXEC at $7000 to get that memory segment back in case it's plugged in. ... I just double-checked things and the original post is correct. First address $7000 is checked, then $4800. Here's how I confirmed... Starting jzIntv... 0000 0000 0000 0000 0000 0000 0000 1000 -------- JSRD R5,$1026 0 > @ 4800 4fff Now watching reads of $4800 through $4FFF > @ 7000 7fff Now watching reads of $7000 through $7FFF > r RD a=$7000 d=FFFF CP-1610 (PC = $101F) t=618 RD a=$4800 d=FFFF CP-1610 (PC = $101F) t=51333 Notice that the '@' command (memory read watching/logging) was used instead of the 'b' command (execution breakpoint). I'll mention significance of this later on. In the above case, no executable code was loaded into $7000 (no ECS) nor at $4800 (no PlayCable or etc). The 2 reads above correspond to steps 2 and 4, respectively, where the EXEC first reads those addresses. In both cases, $FFFF was read back which informs the EXEC that no code was present so steps 3 and 5 were skipped. For as a comparison, below is what occurs when the ECS is present so that there is code at $7000 (as well as the other ECS addresses). As above, no code was present at $4800. The spoiler is only here since the output is much longer. Spoiler Starting jzIntv... 0000 0000 0000 0000 0000 0000 0000 1000 -------- JSRD R5,$1026 0 > @ 7000 7fff Now watching reads of $7000 through $7FFF > @ 4800 4fff Now watching reads of $4800 through $4FFF > r RD a=$7000 d=0001 CP-1610 (PC = $101F) t=618 RD a=$7000 d=0001 CP-1610 (PC = $7000) t=654 RD a=$7001 d=02B8 CP-1610 (PC = $7001) t=658 RD a=$7002 d=00C0 CP-1610 (PC = $7001) t=658 RD a=$7003 d=0007 CP-1610 (PC = $7001) t=658 RD a=$7004 d=0001 CP-1610 (PC = $7004) t=668 RD a=$7005 d=02BC CP-1610 (PC = $7005) t=672 RD a=$7006 d=0040 CP-1610 (PC = $7005) t=672 RD a=$7007 d=0040 CP-1610 (PC = $7005) t=672 RD a=$7008 d=0004 CP-1610 (PC = $7008) t=682 RD a=$7009 d=0114 CP-1610 (PC = $7008) t=682 RD a=$700A d=0338 CP-1610 (PC = $7008) t=682 RD a=$700B d=0001 CP-1610 (PC = $700B) t=48357 RD a=$700C d=02BB CP-1610 (PC = $700C) t=48361 RD a=$700D d=0051 CP-1610 (PC = $700C) t=48361 RD a=$700E d=002A CP-1610 (PC = $700C) t=48361 RD a=$700F d=0001 CP-1610 (PC = $700F) t=48371 RD a=$7010 d=02BA CP-1610 (PC = $7010) t=48375 RD a=$7011 d=00FF CP-1610 (PC = $7010) t=48375 RD a=$7012 d=002F CP-1610 (PC = $7010) t=48375 RD a=$7013 d=0253 CP-1610 (PC = $7013) t=48385 RD a=$7014 d=0001 CP-1610 (PC = $7014) t=48394 RD a=$7015 d=02BB CP-1610 (PC = $7015) t=48398 RD a=$7016 d=0001 CP-1610 (PC = $7015) t=48398 RD a=$7017 d=00C0 CP-1610 (PC = $7015) t=48398 RD a=$7018 d=0004 CP-1610 (PC = $7018) t=48408 RD a=$7019 d=0120 CP-1610 (PC = $7018) t=48408 RD a=$701A d=001F CP-1610 (PC = $7018) t=48408 RD a=$701B d=02A2 CP-1610 (PC = $701B) t=48505 RD a=$701C d=037A CP-1610 (PC = $701C) t=48513 RD a=$701D d=01C1 CP-1610 (PC = $701C) t=48513 RD a=$701E d=020C CP-1610 (PC = $701E) t=48521 RD a=$701F d=0003 CP-1610 (PC = $701E) t=48521 RD a=$7023 d=0004 CP-1610 (PC = $7023) t=48530 RD a=$7024 d=0320 CP-1610 (PC = $7023) t=48530 RD a=$7025 d=0000 CP-1610 (PC = $7023) t=48530 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=48679 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=48837 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=48995 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=49153 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=49311 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=49469 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=49627 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=49785 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=49943 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=50101 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=50259 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=50417 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=50575 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=50733 RD a=$7FFF d=FFFF CP-1610 (PC = $2010) t=50891 RD a=$7026 d=0001 CP-1610 (PC = $7026) t=51060 RD a=$7027 d=02BB CP-1610 (PC = $7027) t=51064 RD a=$7028 d=0001 CP-1610 (PC = $7027) t=51064 RD a=$7029 d=00E0 CP-1610 (PC = $7027) t=51064 RD a=$702A d=0004 CP-1610 (PC = $702A) t=51074 RD a=$702B d=0120 CP-1610 (PC = $702A) t=51074 RD a=$702C d=001F CP-1610 (PC = $702A) t=51074 RD a=$702D d=0004 CP-1610 (PC = $702D) t=51171 RD a=$702E d=0110 CP-1610 (PC = $702D) t=51171 RD a=$702F d=00AB CP-1610 (PC = $702D) t=51171 RD a=$7030 d=000C CP-1610 (PC = $10AB) t=51184 RD a=$7031 d=00A9 CP-1610 (PC = $7031) t=51256 RD a=$7032 d=0041 CP-1610 (PC = $7032) t=51262 RD a=$7033 d=03B9 CP-1610 (PC = $7033) t=51268 RD a=$7034 d=00FD CP-1610 (PC = $7033) t=51268 RD a=$7035 d=0379 CP-1610 (PC = $7035) t=51276 RD a=$7036 d=0001 CP-1610 (PC = $7035) t=51276 RD a=$7037 d=0204 CP-1610 (PC = $7037) t=51284 RD a=$7038 d=0006 CP-1610 (PC = $7037) t=51284 RD a=$703F d=0004 CP-1610 (PC = $703F) t=51293 RD a=$7040 d=0310 CP-1610 (PC = $703F) t=51293 RD a=$7041 d=003D CP-1610 (PC = $703F) t=51293 RD a=$4800 d=FFFF CP-1610 (PC = $101F) t=51333 Notice how $7000 is read twice. The first is where the EXEC checks if code is present at $7000 (step 2). Since it is, the EXEC jumps to address $7000 (step 3). However, before the CPU can actually execute the instruction, it has to first read it from memory. This is why there is a 2nd read of $7000. Execution continues normally through the early $7000 range (with a detour through the $2xxx range). Only after the code in $7xxx is done does execution return back to the EXEC where it later checks $4800, which is the last read in the list. Now, why didn't the 'b' command (execution breakpoint) show this? Mainly, execution breakpoints are only hit if execution is attempted at that address. My guess is that when you ran your experiment, that the ecs.bin file was missing or not loaded by jzintz. Thus, $7000 was $FFFF so the EXEC didn't attempt to execute anything (skipped step 3) so the breakpoint at $7000 wasn't triggered. Less likely, perhaps you had the re-written exec.bin file that older jzintv shipped with, which might not check the addresses or might not check them in the correct order (not sure since I avoid the re-written exec.bin). However, the exec.bin thing seems very unlikely (also, the latest jzintv doesn't ship this file anymore). 1 Quote Link to comment Share on other sites More sharing options...
mr_me Posted March 28, 2021 Share Posted March 28, 2021 17 hours ago, DZ-Jay said: Has it been confirmed that you could do so? Confirmed in emulation. When you have a $4800 cartridge plugged in to the keyboard component, the system boots to the keyboard component and the catridge can be started from the KC menu. Someone can try Demon Attack in their Keyboard Component to test with real hardware. Quote Link to comment Share on other sites More sharing options...
+DZ-Jay Posted March 28, 2021 Share Posted March 28, 2021 (edited) 8 hours ago, Lathe26 said: I just double-checked things and the original post is correct. First address $7000 is checked, then $4800. Here's how I confirmed... Starting jzIntv... 0000 0000 0000 0000 0000 0000 0000 1000 -------- JSRD R5,$1026 0 > @ 4800 4fff Now watching reads of $4800 through $4FFF > @ 7000 7fff Now watching reads of $7000 through $7FFF > r RD a=$7000 d=FFFF CP-1610 (PC = $101F) t=618 RD a=$4800 d=FFFF CP-1610 (PC = $101F) t=51333 Notice that the '@' command (memory read watching/logging) was used instead of the 'b' command (execution breakpoint). I'll mention significance of this later on. You know, I though about that after I posted:. You are right, it won't stop at $7000 first if nothing is found there first. UPDATE: I did some more analysis but my lights went out before I was able to submit it, so I'll post it again later. In the meantime, the short and sweet is that, I realized I was getting different results from you because I was using the "mini" ROMs instead of the original ones. The "miniexec.bin" will apparently test $4800 first. The real EXEC will do as you say. -dZ. Edited March 28, 2021 by DZ-Jay Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted March 28, 2021 Share Posted March 28, 2021 10 hours ago, mr_me said: Confirmed in emulation. When you have a $4800 cartridge plugged in to the keyboard component, the system boots to the keyboard component and the catridge can be started from the KC menu. Someone can try Demon Attack in their Keyboard Component to test with real hardware. Just confirmed that Demon Attack does work on KC. 1 Quote Link to comment Share on other sites More sharing options...
mr_me Posted March 28, 2021 Share Posted March 28, 2021 2 hours ago, Lathe26 said: Just confirmed that Demon Attack does work on KC. And does the keyboard component work with demon attack plugged in? Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted March 28, 2021 Share Posted March 28, 2021 9 minutes ago, mr_me said: And does the keyboard component work with demon attack plugged in? Yes. 1 Quote Link to comment Share on other sites More sharing options...
Zendocon Posted March 29, 2021 Share Posted March 29, 2021 On 3/27/2021 at 11:11 AM, mr_me said: Don't some of the ECS cartridges bypass the ECS menu as well? Yes. Of the 6 released carts, all but Melody Blaster and Mr. BASIC bypass the ECS menu. Any original cart could do so by raising a bit in part of the cartridge ROM header, near that one bit that bypasses the Intellivision-II "Coleco lockout" feature. 1 Quote Link to comment Share on other sites More sharing options...
Like us on Facebook
Follow us on Twitter
AtariAge on Instagram
Watch us on YouTube
Chat on Discord
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.