On Mon, Apr 30, 2018 at 10:29:13AM -0400, Ethan Dicks via cctalk wrote: > [...] The exact value to write to which address is documented somewhere but I > haven't done any digging to find it. I've just been using the Fluke and > running the processor for a few seconds (UUT button) to let the ROMs do their > thing, _then_ using the Fluke for RAM tests at $FC0000-$FFFFFF.
I disassembled the A1000 boot ROM recently. There's a lot of interesting debugging cruft left in there, otherwise it could have fitted on a smaller chip. As far as I can tell from the code, a 68000 RESET sets the latch such that F80000-FBFFFF contains the boot ROM and FC0000-FFFFFF is the writable WCS. A *write* to F80000 (and probably any other address up to FBFFFF) flips the latch such that the WCS is write-protected and is mirrored throughout the region F80000-FFFFFF. Playing with the UAE debugger confirms this theory is correct for it, but I don't own a suitable hardware debugger to test on my real A1000. Without a debugger, one could also build a Zorro-I board for the edge slot which presents a debug ROM at F00000-F7FFFF, and provided it starts with the right magic number, will be executed with the WCS still write-enabled. (The CDTV puts its CD-ROM driver and fancy animated boot screen in that space.)
