Crashing RAM with the REU

From: Marko Mäkelä (msmakela_at_cc.hut.fi)
Date: 1998-03-29 18:18:49

Hello all!

Andreas Boose asked me what happens when transferring data from the REU in
2MHz mode.  I had said previously that the C128's cartridge port runs at
2MHz, and I assumed that there wouldn't be any trouble with that.  But
actually there is!  I made a very simple test program to demonstrate this. 
The program sets up the REU (assuming that the REU address and transfer
length registers are zero after RESET) for a transfer to $3FFF and
switches on the 2MHz mode:

3013 A9 01      LDA #$1
3015 8D 30 D0   STA LD030
3018 A9 FF      LDA #$FF
301A 8D 02 DF   STA LDF02
301D A9 3F      LDA #$3F
301F 8D 03 DF   STA LDF03
3022 A9 BF      LDA #$BF
3024 8D 0A DF   STA LDF0A
3027 A9 B1      LDA #$B1
3029          L3029:
3029 8D 01 DF   STA LDF01
302C 4C 29 30   JMP L3029

The program will be interrupted by a BRK.  To get back to 1MHz mode,
blindly type >fd030 0.  When you examine the code, you will see that the
target byte of the jump has been incremented by one!  And this seems to
hold, whatever target address you choose.  Why could this be?  Probably
the computer will read a $EE (INC) instead of the $4C (JMP).  Yep,
adding a JMP $302C right before the JMP $3029 makes the program work a
bit better, but the REU transfer will be run only once, because the JMP
will change to an EOR $302C, which will change the value that will be
written to $DF01.  Changing the program to

302C JMP $302C
302F INC $D020
3032 JMP $3027

worked for a while, but after a second the screen blanked, and after RESET
I saw that the program area was overwritten, probably by the REU.

Does anyone know what is going on here?  I would investigate this further
if I had time.

	Marko

Archive generated by hypermail 2.1.1.