Hiding kilobytes C=Hacking Issue 7.txt
Taken from The Fridge C=Hacking Section C=Hacking Issue #7
This issue of C=Hacking #7 was stripped down to just the Hiding kilobytes article by Marko Mäkela which contains the interesting sections "_Freezer cartridges_" and "_Building an unbeatable freezer circuit_".
Hiding kilobytes by Marko M"akel"a <Marko.Makela@Helsinki.FI> Most Commodore 64 programs do not utilize even nearly all of the 64 kB random access memory space. By default, there are only 44 kilobytes of accessible RAM. This article describes how you can take the hiding 20 kilobytes to use. _Memory management_ The Commodore 64 has access to more memory than its processor can directly handle. This is possible by banking the memory. There are five user configurable inputs that affect the banking. Three of them can be controlled by program, and the rest two serve as control lines on the memory expansion port. The 6510 MPU has an integrated I/O port with six I/O lines. This port is accessed through the memory locations 0 and 1. The location 0 is the Data Direction Register for the Peripheral data Register, which is mapped to the other location. When a bit in the DDR is set, the corresponding PR bit controls the state of a corresponding Peripheral line as an output. When it is clear, the state of the Peripheral line is reflected by the Peripheral register. The Peripheral lines are numbered from 0 to 5, and they are mapped to the DDR and PR bits 0 - 5, respectively. The 8502 processor, which is used in the Commodore 128, has seven Peripheral lines in its I/O port. The seventh line is connected to the Caps lock or ASC/CC key. The I/O lines have the following functions: Direction Line Function --------- ---- -------- out P5 Cassette motor control. (0 = motor spins) in P4 Cassette sense. (0 = PLAY button depressed) out P3 Cassette write data. out P2 CHAREN out P1 HIRAM out P0 LORAM The default value of the DDR register is $2F, so all lines except Cassette sense are outputs. The default PR value is $37 (Datassette motor stopped, and all three memory management lines high). Like most chips in the Commodore 64, the 6510 MPU uses the NMOS (N-channel metal oxide semiconductor) technology. The NMOS switches produce strong logical '0' levels, but weak '1' levels. The opposite is the PMOS (P-channel metal oxide semiconductor) technology, which cannot pull strong signals low, but is able to drive them high. The CMOS technology (complementary metal oxide semiconductor), which combines these two technologies, is able to drive both logical levels. Because most integrated circuits in the C64 use the NMOS technology, all hardware lines that are not outputs are driven to +5 volts with a weak current. This is usually accomplished by pull-up resistors, large resistances between the hardware lines and the +5 volt power supply line. The resistors can be inside a chip or on the printed circuit board. This allows any NMOS or CMOS chip to drive the line to the desired state (low or high voltage level). The difference between an input and an output is that an output uses more current to drive the signal to the desired level. An input and an output outputting logical '1' are equivalent for any other inputting chip. But if a chip is trying to drive a signal to ground level, it needs more current to sink an output than an input. You can even use outputs as inputs, i.e. read them in your program. You can use this feature to distinquish between the left shift and the shift lock keys, although they are connected to same hardware lines. The shift lock key has smaller resistance than the left shift. If you make both CIA 1 ports to outputs (write $FF to $DC03 and $DC01) prior reading the left shift key, only shift lock can change the values you read from CIA 1 port B ($DC01).) So, if you turn any memory management line to input, the external pull-up resistors will make it look like it is outputting logical '1'. This is actually why the computer always switches the ROMs in upon startup: Pulling the -RESET line low resets all Peripheral lines to inputs, thus driving all three processor-driven memory management lines high. The two remaining memory management lines are -EXROM and -GAME on the cartridge port. Each line has a pull-up resistor, so the lines are '1' by default. (In the Commodore 128, you can set the state of these two lines prior to selecting the C64 mode, provided that you write the mode switch routine yourself.) Even though the memory banking has been implemented with a 82S100 Programmable _Logic_ Array, there is only one control line that seems to behave logically at first sight, the -CHAREN line. It is mostly used to choose between I/O address space and the character generator ROM. The following memory map introduces the oddities of -CHAREN and the other memory management lines. It is based on the memory maps in the Commodore 64 Programmer's Reference Guide, pp. 263 - 267, and some errors and inaccuracies have been corrected. The leftmost column of the table contains addresses in hexadecimal notation. The columns aside it introduce all possible memory configurations. The default mode is on the left, and the absolutely most rarely used Ultimax game console configuration is on the right. (There have been at least two Ultimax cartridges on the market.) Each memory configuration column has one or more four-digit binary numbers as a title. The bits, from left to right, represent the state of the -LORAM, -HIRAM, -GAME and -EXROM lines, respectively. The bits whose state does not matter are marked with "x". For instance, when the Ultimax video game configuration is active (the -GAME line is shorted to ground, -EXROM kept high), the -LORAM and -HIRAM lines have no effect. default Ultimax 1111 101x 1000 011x 001x 1110 0100 1100 xx01 00x0 10000 ----------------------------------------------------------------------------- F000 Kernal RAM RAM Kernal RAM Kernal Kernal Kernal ROMH(* E000 ----------------------------------------------------------------------------- D000 IO/C IO/C IO/RAM IO/C RAM IO/C IO/C IO/C I/O ----------------------------------------------------------------------------- C000 RAM RAM RAM RAM RAM RAM RAM RAM - ----------------------------------------------------------------------------- B000 BASIC RAM RAM RAM RAM BASIC ROMH ROMH - A000 ----------------------------------------------------------------------------- 9000 RAM RAM RAM RAM RAM ROML RAM ROML ROML(* 8000 ----------------------------------------------------------------------------- 7000 6000 RAM RAM RAM RAM RAM RAM RAM RAM - 5000 4000 ----------------------------------------------------------------------------- 3000 2000 RAM RAM RAM RAM RAM RAM RAM RAM - 1000 ----------------------------------------------------------------------------- 0000 RAM RAM RAM RAM RAM RAM RAM RAM RAM ----------------------------------------------------------------------------- *) Internal memory does not respond to write accesses to these areas. Legend: Kernal E000-FFFF Kernal ROM. IO/C D000-DFFF I/O address space or Character generator ROM, selected by -CHAREN. If the CHAREN bit is clear, the character generator ROM is chosen. If it is set, the I/O chips are accessible. IO/RAM D000-DFFF I/O address space or RAM, selected by -CHAREN. If the CHAREN bit is clear, the character generator ROM is chosen. If it is set, the internal RAM is accessible. I/O D000-DFFF I/O address space. The -CHAREN line has no effect. BASIC A000-BFFF BASIC ROM. ROMH A000-BFFF or External ROM with the -ROMH line E000-FFFF connected to its -CS line. ROML 8000-9FFF External ROM with the -ROML line connected to its -CS line. RAM various ranges Commodore 64's internal RAM. - 1000-7FFF and Open address space. A000-CFFF The Commodore 64's memory chips do not detect any memory accesses to this area except the VIC-II's DMA and memory refreshes. NOTE: Whenever the processor tries to write to any ROM area (Kernal, BASIC, CHAROM, ROML, ROMH), the data will get "through the ROM" to the C64's internal RAM. For this reason, you can easily copy data from ROM to RAM, without any bank switching. But implementing external memory expansions without DMA is very hard, as you have to use the Ultimax memory configuration, or the data will be written both to internal and external RAM. However, this is not true for the Ultimax game configuration. In that mode, the internal RAM ignores all memory accesses outside the area $0000-$0FFF, unless they are performed by the VIC, and you can write to external memory at $1000-$CFFF and $E000-$FFFF, if any, without changing the contents of the internal RAM. _A note concerning the I/O area_ The I/O area is divided as follows: Address range Owner ------------- ----- D000-D3FF MOS 6567/6569 VIC-II Video Interface Controller D400-D7FF MOS 6581 SID Sound Interface Device D800-DBFF Color RAM (only lower nybbles are connected) DC00-DCFF MOS 6526 CIA Complex Interface Adapter #1 DD00-DDFF MOS 6526 CIA Complex Interface Adapter #2 DE00-DEFF User expansion #1 (-I/O1 on Expansion Port) DF00-DFFF User expansion #2 (-I/O2 on Expansion Port) As you can see, the address ranges for the chips are much larger than required. Because of this, you can access the chips through multiple memory areas. The VIC-II appears in its window every $40 addresses. For instance, the addresses $D040 and $D080 are both mapped to the Sprite 0 X co-ordinate register. The SID has one register selection line less, thus it appears at every $20 bytes. The CIA chips have only 16 registers, so there are 16 copies of each in their memory area. However, you should not use other addresses than those specified by Commodore. For instance, the Commodore 128 mapped its additional I/O chips to this same memory area, and the SID responds only to the addresses D400-D4FF, also when in C64 mode. And the Commodore 65, which unfortunately did not make its way to the market, could narrow the memory window reserved for the MOS 6569/6567 VIC-II (or CSG 4567 VIC-III in that machine). _The video chip_ The MOS 6567/6569 VIC-II Video Interface Controller has access to only 16 kilobytes at a time. To enable the VIC-II to access the whole 64 kB memory space, the main memory is divided to four banks of 16 kB each. The lines PA0 and PA1 of the second CIA are the inverse of the virtual VIC-II address lines VA14 and VA15, respectively. To select a VIC-II bank other than the default, you must program the CIA lines to output the desired bit pair. For instance, the following code selects the memory area $4000-$7FFF (bank 1) for the video controller: LDA $DD02 ; Data Direction Register A ORA #$03 ; Set pins PA0 and PA1 to outputs STA $DD02 LDA $DD00 AND #$FC ; Mask the lowmost bit pair off ORA #$02 ; Select VIC-II bank 1 (the inverse of binary 01 is 10) STA $DD00 Why should you set the pins to outputs? Hardware RESET resets all I/O lines to inputs, and thanks to the CIA's internal pull-up resistors, the inputs actually output logical high voltage level. So, upon -RESET, the video bank 0 is selected automatically, and older Kernals could leave it uninitialized. Note that the VIC-II always fetches its information from the internal RAM, totally ignoring the memory configuration lines. There is only one exception to this rule: The character generator ROM. Unless the Ultimax mode is selected, VIC-II "sees" character generator ROM in the memory areas 1000-1FFF and 9000-9FFF. If the Ultimax configuration is active, the VIC-II will fetch all data from the internal RAM. _An application: Making an operating system extension_ If you are making a memory resident program and want to make it as invisible to the system as possible, probably the best method is keeping most of your code under the I/O area (in the RAM at $D000-$DFFF). This area is very safe, since programs utilizing it are rare, since they are very difficult to implement and to debug. You need only a short routine in the normally visible RAM that pushes the current value of the processor's I/O register $01 on stack, switches RAM on to $D000-$DFFF and jumps to this area. Returning from the $D000-$DFFF area is possible even without any routine in the normally visible RAM area. Just write an RTS or an RTI to an I/O register and return through it. But what if your program needs to use I/O? And how can you write the return instruction to an I/O register while the I/O area is switched off? You need a swap area for your program in normally visible memory. The first thing your routine at $D000-$DFFF does is copying the I/O routines (or the whole program) to normally visible memory, swapping the bytes. For instance, if your I/O routines are initially being stored at $D200-$D3FF, exchange the bytes in $D200-$D3FF with the contents of $C000-$C1FF. Now you can call the I/O routines from your routine at $D000-$DFFF, and the I/O routines can switch the I/O area temporarily on to access the I/O chips. And right before exiting your program at $D000-$DFFF swaps the old contents of that I/O routine area in, e.g. exchanges the memory areas $D200-$D3FF and $C000-$C1FF again. What I/O registers can you use for the return instruction? There are basically two alternatives: 8-bit VIC sprite registers or either CIA's serial port register. The VIC registers are easiest to use, as they act precisely like memory places: you can easily write the desired value to a register. But the CIA register is usually better, as changing the VIC registers might change the screen layout. However, also the SP register has some drawbacks: If the machine's CNT1 and CNT2 lines are connected to a frequency source, you must stop either CIA's Timer A to use the SP register method. Normally the 1st CIA's Timer A is the main hardware interrupt source. And if you use the Kernal's RS232, you cannot stop the 2nd CIA's Timer A either. Also, if you don't want to lose any CIA interrupts, you might want to know that executing the RTS or RTI at SP register has the side effect of reading the Interrupt Control Register, thus acknowledging an interrupt that might have been waiting. If you can't use either method, you can use either CIA's ToD seconds or minutes or ToD alarm time for storing an RTI. Or, if you don't want to alter any registers, use the VIC-II's light pen register. Before exiting, wait for appropriate raster line and trig the light pen latch with CIA1's PB4 bit. However, this method assumes that the control port 1's button/light pen line remains up for that frame. After trigging the light pen, causing the light pen Y co-ordinate register ($D014) to be $40 or $60, you have more than half a frame time to restore the state of the I/O chips and return through the register. You can also use the SID to store an RTI or RTS command. How is this possible, you might ask. After all, the chip consists of read only or write only registers. However, there are two registers that can be controlled by program, the envelope generator and oscillator outputs of the third voice. This method requires you to change the frequency of voice 3 and to select a waveform for it. This will affect on the voice output by turning the voice 3 off, but who would keep the voice 3 producing a tone while calling an operating system routine? Also keep in mind that the user could press RESTORE while the Kernal ROM and I/O areas are disabled. You could write your own non-maskable interrupt (NMI) handler (using the NMI vector at $FFFA), but a fast loader that uses very tight timing would still stop working if the user pressed RESTORE in the middle of a data block transfer. So, to make a robust program, you have to disable NMI interrupts. But how is this possible? They are Non-Maskable after all. The NMI interrupt is edge-sensitive, the processor jumps to NMI handler only when the -NMI line drops from +5V to ground. To disable the interrupt, simply cause an NMI with CIA2's timer, but don't read the Interrupt Control register. If you need to read $DD0D in your program, you must add a NMI handler just in case the user presses RESTORE. And don't forget to raise the -NMI line upon exiting the program. Otherwise the RESTORE key does not work until the user issues a -RESET or reads the ICR register explicitly. (The Kernal does not read $DD0D, unless it is handling an interrupt.) This can be done automatically by the two following SP register examples due to one of the 6510's undocumented features (refer to the descriptions of RTS and RTI below). ; Returning via VIC sprite 7 X co-ordinate register Initialization: ; This is executed when I/O is switched on LDA #$60 STA $D015 ; Write RTS to VIC register $15. Exiting: ; NOTE: This procedure must start at VIC register ; $12. You have multiple alternatives, as the VIC ; appears in memory at $D000+$40*n, where $0<=n<=$F. PLA ; Pull the saved 6510 I/O register state from stack STA $01 ; Restore original memory bank configuration ; Now the processor fetches the RTS command from the ; VIC register $15. ; Returning via CIA 2's ToD or ToD alarm seconds register Initialization: ; This is executed when I/O is switched on LDA #$40 STA $DD08 ; Set ToD tenths of seconds ; (clear it so that the seconds register ; would not overflow) ; If ToD alarm register is selected, this ; instruction will be unnecessary. STA $DD09 ; Set ToD seconds LDA $DD0B ; Read ToD hours (freeze ToD display) Exiting: ; NOTE: This procedure must start at CIA 2 register ; $6. As the CIA 2 appears in memory at $DD00+$10*n, ; where 0<=n<=$F, you have sixteen alternatives. PLA STA $01 ; Restore original memory bank configuration ; Now the processor fetches the RTS command from ; the CIA 2 register $9. ; Returning via CIA 2's SP register (assuming that CNT2 is stable) Initialization: ; This is executed when I/O is switched on LDA $DD0E ; CIA 2's Control Register A AND #$BF ; Set Serial Port to input STA $DD0E ; (make the SP register to act as a memory place) LDA #$60 STA $DD0C ; Write RTS to CIA 2 register $C. Exiting: ; NOTE: This procedure must start at CIA 2 register ; $9. As the CIA 2 appears in memory at $DD00+$10*n, ; where 0<=n<=$F, you have sixteen alternatives. PLA STA $01 ; Restore original memory bank configuration ; Now the processor fetches the RTS command from ; the CIA 2 register $C. ; Returning via CIA 2's SP register, stopping the Timer A ; and forcing SP2 and CNT2 to output Initialization: ; This is executed when I/O is switched on LDA $DD0E ; CIA 2's Control Register A AND #$FE ; Stop Timer A ORA #$40 ; Set Serial Port to output STA $DD0E ; (make the SP register to act as a memory place) LDA #$60 STA $DD0C ; Write RTS to CIA register $C. Exiting: ; NOTE: This procedure must start at CIA 2 register ; $9. As the CIA 2 appears in memory at $DD00+$10*n, ; where 0<=n<=$F, you have sixteen alternatives. PLA STA $01 ; Restore original memory bank configuration ; Now the processor fetches the RTS command from ; the CIA 2 register $C. ; Returning via SID oscillator 3 output register Initialization: ; This is executed when I/O is switched on LDA #$20 ; Select sawtooth waveform STA $D412 ; but do not enable the sound LDY #$00 ; Select frequency STY $D40E ; (system clock)/$FF00, LDA #$FF ; causing the OSC3 output to increment by one STY $D40F ; every $10000/$FF00 cycles. LDA #$0E LDX #$60 BIT $D41B ; Wait for the oscillator 3 output BMI *-3 ; to be in the range BVS *-5 ; $00-$3F. BIT $D41B ; Wait for the oscillator 3 output BVC *-3 ; to be at least $40. STA $D40F ; Slow down the frequency to (system clock)/$0E00. CPX $D41B ; Wait for the oscillator 3 BNE *-3 ; output to reach $60 (RTS) STY $D40F ; Reset the frequency of voice 3 ; (stop the OSC3 register from increasing) Exiting: ; NOTE: This procedure must start at SID register ; $18. As the SID appears in memory at $D400+$20*n, ; where 0<=n<=$20, you have thirty-two alternatives. ; However, in C128 there are only eight alternatives, ; as the SID is only at $D400-$D4FF. PLA STA $01 ; Restore original memory bank configuration ; Now the processor fetches the RTS command from ; the SID register $1B. For instance, if you want to make a highly compatible fast loader, make the ILOAD vector ($0330) point to the beginning of the stack area. Remember that the BASIC interpreter uses the first bytes of stack while converting numbers to text. A good address is $0120. Robust programs practically never use so much stack that it could corrupt this routine. Usually only crunched programs (demos and alike) use all stack in the decompression phase. They also make use of the $D000-$DFFF area. This stack routine will jump to your routine at $D000-$DFFF, as described above. For performance's sake, copy the whole byte transfer loop to the swap area, e.g. $C000-$C1FF, and call that subroutine after doing the preliminary work. But what about files that load over $C000-$C1FF? Wouldn't that destroy the transfer loop and jam the machine? Not necessarily. If you copy those bytes to your swap area at $D000-$DFFF, they will be loaded properly, as your program restores the original $C000-$C1FF area. If you want to make your program user-friendly, put a vector initialization routine to the stack area as well, so that the user can restore the fast loader by issuing a SYS command, rather than loading it each time he has pressed RESET. _An example: A "hello world" program_ To help you in getting started, I have written a small example program that echoes the famous message "hello, world!" to standard output (normally screen) using the Kernal's CHROUT subroutine. After the initialization routine has been run, the program can be started by commanding SYS 300. I used the Commodore 128's machine language monitor to put it up, but it was still pretty difficult to debug the program. Here it is in uuencoded format: begin 644 hello M`0@+",D'GC(P-C$```!XI0%(*?B%`:(,O3`(G2P!RA#WHHN]/`B=8]W*T/=H MA0%88*4!JBGX"01XA0%,I-WF`:*!C@W=H@".!=WHC@3=HMV.#MVB0(X,W<8! M8*4!2`D#A0&@#+DSP"#2_X@0]VB%`6`A1$Q23U<@+$],3$5(BDBM^O](K?O_ M2*D6C?K_J<"-^_\@W-T@`,!HC?O_:(WZ_R`=P"#<W6BHJ0!(NOX"`=`#_@,! 5A`&@/[X`P+EDW9D`P(J99-V($/!@ ` end In order to fully understand the operation of this program, you need to know how the instructions RTI, RTS and PHA work. There is some work going on to reverse engineer the NMOS 6502 microprocessor to large extent, and it is now known for most instructions what memory places they access during their execution and for what purpose. The internal procedures haven't been described in detail yet, but these descriptions should be easier to read anyway. For curiosity, I quote here the description of all instructions that use the stack. The descriptions of internal operations are yet inaccurate, but the memory accesses have been verified with an oscilloscope. I will mail copies the whole document upon request. When finished, the document will be put on an FTP site. JSR # address R/W description --- ------- --- ------------------------------------------------- 1 PC R fetch opcode, increment PC 2 PC R fetch address's low byte to latch, increment PC 3 $0100,S R 4 $0100,S W push PCH on stack, decrement S 5 $0100,S W push PCL on stack, decrement S 6 PC R copy latch to PCL, fetch address's high byte to latch, copy latch to PCH RTS # address R/W description --- ------- --- ----------------------------------------------- 1 PC R fetch opcode, increment PC 2 PC R read next instruction byte (and throw it away), increment PC 3 $0100,S R increment S 4 $0100,S R pull PCL from stack, increment S 5 $0100,S R pull PCH from stack 6 PC R increment PC BRK # address R/W description --- ------- --- ----------------------------------------------- 1 PC R fetch opcode, increment PC 2 PC R read next instruction byte (and throw it away), increment PC 3 $0100,S W push PCH on stack, decrement S 4 $0100,S W push PCL on stack, decrement S 5 $0100,S W push P on stack (with B flag set), decrement S, set I flag 6 $FFFE R fetch PCL 7 $FFFF R fetch PCH RTI # address R/W description --- ------- --- ----------------------------------------------- 1 PC R fetch opcode, increment PC 2 PC R read next instruction byte (and throw it away), increment PC 3 $0100,S R increment S 4 $0100,S R pull P from stack, increment S 5 $0100,S R pull PCL from stack, increment S 6 $0100,S R pull PCH from stack PHA, PHP # address R/W description --- ------- --- ----------------------------------------------- 1 PC R fetch opcode, increment PC 2 PC R read next instruction byte (and throw it away), increment PC 3 $0100,S W push register on stack, decrement S PLA, PLP # address R/W description --- ------- --- ----------------------------------------------- 1 PC R fetch opcode, increment PC 2 PC R read next instruction byte (and throw it away), increment PC 3 $0100,S R increment S 4 $0100,S R pull register from stack The example program consists of three parts. The first part transfers the other parts to appropriate memory areas. The second part is located in stack area (300-312), and it invokes the third part, the main module. The loader part ($0801-$08C7) is as follows: 1993 SYS2061 080D SEI Disable interrupts. 080E LDA $01 0810 PHA Store the state of the processor's I/O lines. 0811 AND #$F8 0813 STA $01 Select 64 kB RAM memory configuration. 0815 LDX #$0C Copy the invoking part to 300-312. 0817 LDA $0830,X 081A STA $012C,X 081D DEX 081E BPL $0817 0820 LDX #$8B Copy the main part to $DD64-$DDEE. 0822 LDA $083C,X 0825 STA $DD63,X 0828 DEX 0829 BNE $0822 082B PLA Restore original memory configuration. 082C STA $01 082E CLI Enable interrupts. 082F RTS Return. The user invokes the following part by issuing SYS 300. This part changes the memory configuration and jumps to the main part. 012C LDA $01 012E TAX Store original memory configuration to X register. 012F AND #$F8 0131 ORA #$04 0133 SEI Disable interrupts. 0134 STA $01 Select 64 kB RAM memory configuration. 0136 JMP $DDA4 Jump to the main part. The main part actually consists of two parts. It may be a bit complicated, and it might teach new tricks to you. DDA4 TXA DDA5 PHA Push original memory configuration on stack. DDA6 LDA $FFFA DDA9 PHA DDAA LDA $FFFB DDAD PHA Store the original values of $FFFA and $FFFB. DDAE LDA #$16 DDB0 STA $FFFA Set ($FFFA) to point to RTI. DDB3 LDA #$C0 DDB5 STA $FFFB DDB8 JSR $DDDC Swap the auxiliary routines in. DDBB JSR $C000 Disable NMI's and initialize CIA2. DDBE PLA DDBF STA $FFFB Restore original values to $FFFA and $FFFB. DDC2 PLA DDC3 STA $FFFA DDC6 JSR $C01D Print the message. DDC9 JSR $DDDC Swap the auxiliary routines out. DDCC PLA DDCD TAY Load original memory configuration to Y register. DDCE LDA #$00 Push desired stack register value on stack DDD0 PHA (clear all flags, especially the I flag). DDD1 TSX DDD2 INC $0102,X Increment the return address. DDD5 BNE $DDDA (RTS preincrements it, but RTI does not.) DDD7 INC $0103,X DDDA STY $01 Restore original memory configuration. (The 6510 fetches the next instruction from $DDDC, which is now connected to the CIA2's register $C, the Serial Port register. The initialization routine wrote an RTI to it. The processor also reads from $DDDD as a side effect of the instruction fetch, thus re-enabling NMI's.) DDDC LDY #$3F Subroutine: Swap the memory areas $C000-$C03F DDDE LDX $C000,Y and $DD64-$DDA3 with each other. DDE1 LDA $DD64,Y DDE4 STA $C000,Y DDE7 TXA DDE8 STA $DD64,Y DDEB DEY DDEC BPL $DDDE DDEE RTS C000 INC $01 Enable the I/O area. C002 LDX #$81 C004 STX $DD0D Enable Timer A interrupts of CIA2. C007 LDX #$00 C009 STX $DD05 C00C INX C00D STX $DD04 Prepare Timer A to count from 1 to 0. C010 LDX #$DD C012 STX $DD0E Cause an interrupt. (The instruction sets SP to output, makes Timer A to count system clock pulses, forces the CIA to load the initial value to the counter, selects one-shot counting and starts the timer.) C015 LDX #$40 (The processor now jumps to the NMI handler ($C016), and the SP register starts to act as a memory place.) C017 STX $DD0C Write an RTI to Serial Port register. C01A DEC $01 Disable the I/O area. C01C RTS Return. C01D LDA $01 C01F PHA C020 ORA #$03 Enable I/O and ROMs. C022 STA $01 C024 LDY #$0C Print the message. C026 LDA $C033,Y C029 JSR $FFD2 C02C DEY C02D BPL $C026 C02F PLA C030 STA $01 Restore the 64 kB memory configuration. C032 RTS C033 "!DLROW ,OLLEH" (The string is backwards in memory, since I don't want to waste cycles in explicit comparisons. This method results in more readable code than doing a forward loop with an index value $100-(number of characters).) This program is not excellent. It has the following bugs: o The 6510's memory management lines P0 and P1 (LORAM and HIRAM, respectively) are assumed to be outputs. If you issued the command POKE0,PEEK(0)AND252, this program would not work. This could be easily corrected by setting the P0 and P1 lines to output in the beginning of the interfacing routine (300 - 312): LDA $00 ORA #$02 STA $00 o The program does not restore the original state of the CIA2 Control Register A or Interrupt Control Register. It might be impossible to start using the Kernal's RS-232 routines after running this. o If the user redirected output to cassette or RS-232, interrupts would be required. However, they are completely disabled. o If a non-maskable interrupt occurs while the loader part is being executed, the program will screw up. This will happen also in the main part, if an NMI is issued after disabling ROMs and I/O in $0134 but before exchanging the contents of the memory places $C016 and $DD7A. _Freezer cartridges_ There are many cartridges that let you to stop almost any program for "back-up" purposes. One of the most popular of these freezer cartridges is the Action Replay VI made by Datel Electronics back in 1989. The cartridge has 8 kilobytes RAM and 32 kilobytes ROM on board, and it has a custom chip for fiddling with the C64 cartridge port lines -EXROM, -GAME, -IRQ, -NMI and BA. If the -NMI line is not asserted (the NMI interrupts are enabled), all freezer cartridges should be able to halt any program. When the user presses the "freeze" button, the cartridges halt the processor by dropping the BA line low. Then they switch some of their own ROM to the $E000 - $FFFF block by selecting the UltiMax configuration with the -EXROM and -GAME lines. After this, they assert the -NMI line and release the BA line. After completing the current instruction, the processor will take the NMI interrupt and load the program counter from the vector at $FFFA, provided that the NMI line was not asserted already. This approach is prone to many flaws. Firstly, if the processor is executing a write instruction when the program is being halted, and if the write occurred outside the area $0000 - $0FFF, the data would get lost, if the UltiMax configuration was asserted too early. This can be corrected to some extent by waiting at least two cycles after asserting the BA line, as the processor will not stop during write cycles. However, this is of no help if the processor has not gotten to the write stage yet. Secondly, if the instruction being executed is outside the area $0000 - $0FFF, or if it accesses any data outside that area, the processor will fetch either wrong parameters or incorrect data, or both. If the instruction does not write anything, will only corrupt one processor register. Thirdly, if the NMI interrupts are disabled, pressing the "freeze" button does not have any other immediate effect than leaving the UltiMax mode asserted, which makes any system RAM outside the area $0000 - $0FFF unavailable. It also forces the I/O area ($D000 - $DFFF) on. If the program has any instructions or data outside the lowmost four kilobytes, it will eventually jam, as that data will be something else than the program expects. One might except that reading from open address space should return random bytes. But, in at least two C64's, the bytes read are mostly $BD, which is the opcode for LDA absolute,X. So, if the processor has a "good luck", it will happily execute only LDA $BDBD,X commands, and it might survive to the cartridge ROM area without jamming. Or it could eventually fetch a BRK and jump to the cartridge ROM via the IRQ/BRK vector at $FFFE. The Action Replay VI has the familiar autostart data in the beginning of both the ROML and ROMH blocks by default, and that data could be interpreted as sensible commands. The Action Replay VI was indeed able to freeze my test program, even though I had covered its -RESET, -IRQ and -NMI lines with a piece of tape, until I relocated the program to the first 4 kilobyte block. _Building an unbeatable freezer circuit_ As you can see, it is totally impossible to design a freezer cartridge that freezes any program. If the program to be freezed has disabled the NMI interrupts, and if its code runs mostly at $0000 - $0FFF or $D000 - $DFFF, the computer will more probably hang than succeed in freezing the program. However, it is possible to make some internal modifications to a C64, so that it can freeze literally any program. You need to expand your machine to 256 kilobytes following the documents on ftp.funet.fi in the /pub/cbm/hardware/256kB directory. It will let you to reset the computer so that all of the 64 kilobytes the previous program used, will remain intact. If you add a switch to one of the memory expansion controller's chip selection lines, the program being examined will have no way to screw the machine up, as the additional memory management registers will not be available. A few enhancements to this circuit are required so that you can freeze the programs without losing the state of the I/O chips. You will also need to replace the Kernal ROM chip with your own code, if you do not want to lose the state of the A, X, P and S registers. Unfortunately this circuit will not preserve the state of the processor's Peripheral lines (its built-in I/O port mapped to the memory addresses 0 and 1), nor does it record the program counter (PC). I have a partial solution to the PC problem, though. If you are interested in this project, contact me. I will design the additional hardware, and I will program the startup routines, but I certainly do not have the time to program all of the freezer software. Most of the freezer software could be in RAM, so it would be very easy to develop it, and you could even use existing tools by patching them slightly. =============================================================================