Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
more analysis of Apple IIGS ROM 03 firmware bugs
59 views
Skip to first unread message
retrogear
May 14, 2013, 8:05:38 PM5/14/13
to
Evidently there is a bug in the Apple IIGS ROM 03 firmware that does not initialize a variable at power-on. I found the variable in the System 601 source with this note:
E1/017D byte ROMDAACT 0 = Do not activate, <> = activate Bits 7 and 6 are used as flags. ROM 3 accidentally assumes that bit 7 powers up as 0! If it comes up as 1, the user gets Visit Monitor and Memory Peeker whether they want them or not (regardless of BRAM location $59, that is).
Here is a description of it's function from the source:
* ROMDAACT is a flag which is reset on to $00 on power up only. It is set <>0 if and only if the user types in the '#' command in the monitor. The '#' command installs the monitor desk accessory and the memory peeker desk accessory. If ROMDAACT is <>0 the monitor on coldstart only will reinstall the monitor/memory peeker desk accessories. ROMDAACT EQUDS.B 1 ;0=Do not activate <>0=activate
This is an excerpt of a csa2 discussion from 1995 about this and the reference below it:
FYI there is a third type of ROM 3, though it has nothing to do with
the firmware. It has to do with the value found at E1:017D:xx in memory at
cold-boot. The value _should_ be '00' but on my ROM 3 (and a hundred or so
others) the value is 'FF'. This bug causes the programmer CDAs be invoked
whenever the machine is powered on, even the bRAM settings don't help here.
No one has quite figured out the source of the problem, but a guess is the
type of DRAMs used in the 'Standard RAM' (128K) bank, just next to DOC RAM.
Solutions? If you have the prototype ROMs (rare) swap them with a copy
of the current ROMs. Alltech might have the parts or perhaps you can burn
a copy if none are available. It's important that it be done...
CDA-bug: Install a small INIT in your System folder that temporarily purges
them from memory. At the same time it changes the address at E1 to '017D:00'
so the first warm-boot keeps them from returning (until you power down the GS).
The extra CDAs are really just a minor annoyance and eats only a couple of
bytes. This, like the other ROM 3, is rare. I found a batch of them at
Apple Headquarters in Montreal though, possible they only made it to this
part of Canada. You could do a motherboard swap too, if your luckly enough
to find one (the Apple dealer out here tossed a dozen or so in the dumpster
a few weeks ago, wish I had been there. :-(
(end of excerpt)
reference:
https://groups.google.com/forum/?fromgroups#!searchin/comp.sys.apple2/342-0728%7Csort:relevance/comp.sys.apple2/CL0AMh1mgao/l-e1JiJu8ooJ
I searched through the entire firmware source and nowhere is the variable init'd to 0 so it remains a potential bug in any ROM 03 IIGS as far as I can determine. Since I don't have a real ROM 03 GS I used the GSport emulator. If I manually set E1/017D:FF it remains after ctrl-OA-reset !! Try this on a real ROM 03. Is it a fluke that the value is 00 at power on ? Maybe Apple issued a tech bulletin and a patch ? Putting the pieces together after 20+ years is just plain fun !!!
Larry
E1/017D byte ROMDAACT 0 = Do not activate, <> = activate Bits 7 and 6 are used as flags. ROM 3 accidentally assumes that bit 7 powers up as 0! If it comes up as 1, the user gets Visit Monitor and Memory Peeker whether they want them or not (regardless of BRAM location $59, that is).
Here is a description of it's function from the source:
* ROMDAACT is a flag which is reset on to $00 on power up only. It is set <>0 if and only if the user types in the '#' command in the monitor. The '#' command installs the monitor desk accessory and the memory peeker desk accessory. If ROMDAACT is <>0 the monitor on coldstart only will reinstall the monitor/memory peeker desk accessories. ROMDAACT EQUDS.B 1 ;0=Do not activate <>0=activate
This is an excerpt of a csa2 discussion from 1995 about this and the reference below it:
FYI there is a third type of ROM 3, though it has nothing to do with
the firmware. It has to do with the value found at E1:017D:xx in memory at
cold-boot. The value _should_ be '00' but on my ROM 3 (and a hundred or so
others) the value is 'FF'. This bug causes the programmer CDAs be invoked
whenever the machine is powered on, even the bRAM settings don't help here.
No one has quite figured out the source of the problem, but a guess is the
type of DRAMs used in the 'Standard RAM' (128K) bank, just next to DOC RAM.
Solutions? If you have the prototype ROMs (rare) swap them with a copy
of the current ROMs. Alltech might have the parts or perhaps you can burn
a copy if none are available. It's important that it be done...
CDA-bug: Install a small INIT in your System folder that temporarily purges
them from memory. At the same time it changes the address at E1 to '017D:00'
so the first warm-boot keeps them from returning (until you power down the GS).
The extra CDAs are really just a minor annoyance and eats only a couple of
bytes. This, like the other ROM 3, is rare. I found a batch of them at
Apple Headquarters in Montreal though, possible they only made it to this
part of Canada. You could do a motherboard swap too, if your luckly enough
to find one (the Apple dealer out here tossed a dozen or so in the dumpster
a few weeks ago, wish I had been there. :-(
(end of excerpt)
reference:
https://groups.google.com/forum/?fromgroups#!searchin/comp.sys.apple2/342-0728%7Csort:relevance/comp.sys.apple2/CL0AMh1mgao/l-e1JiJu8ooJ
I searched through the entire firmware source and nowhere is the variable init'd to 0 so it remains a potential bug in any ROM 03 IIGS as far as I can determine. Since I don't have a real ROM 03 GS I used the GSport emulator. If I manually set E1/017D:FF it remains after ctrl-OA-reset !! Try this on a real ROM 03. Is it a fluke that the value is 00 at power on ? Maybe Apple issued a tech bulletin and a patch ? Putting the pieces together after 20+ years is just plain fun !!!
Larry
0 new messages