[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
PATCHES for ProDOS 1.0.1 and 1.0.2
Hi!
A few people asked me, if i could post the patches for 48k ProDOS.
I've checked some old Apple magazines and Arne Schaerpers book
"ProDOS-Analyse". I don't know, if these were available outside
Germany, but i doubt it; therefore i'll give a summary now.
But before i do that, i have to announce, that these patches are
provided AS IS, without any warranty.
#include <std/disclaimer.h>
The patches are described for ProDOS 1.0.1. They can be applied to
Prodos 1.0.2 too, but some of the adresses have moved slightly.
Simply add 12 ($000C) to every address above $E94B.
ProDOS 1.1.1 can't boot with 48k any more, but the other bugs described
below are present too. ProDOS 1.1.1 is completely reassembled, and this
scrambles all adresses. Therfore i'll not give the patches for 1.1.1.
1. Patch for 48k
These old ProDOS versions have a relocater, which allows them
to run with only 48k of memory. To accomplish correct relocation
even if adresses are loaded into zero-page registers, these
adresses aren't loaded with LDA #$F6 immediate, but from a already
relocated address, for example: LDA $D82A, while $D828 contains
a LDA $F602.
At two positions, the programmer's of ProDOS have forgotten to
do so and without a patch, ProDOS refuse to work with 48k!!!
Do NOT use ProDOS with 48k without these patches. It destroys
the volume bit map of your disks.
Not many programs will run with 48k, but EXER.SYSTEM does.
Unfortunately, BASIC.SYSTEM won't run.
D57D- A9 F6 LDA #$F6 <--- here
D57F- 85 49 STA $49
D581- A9 04 LDA #$04
and
D692- A9 F6 LDA #$F6 <--- here
D694- 85 49 STA $49
D696 A9 04 LDA #$04
Simply replace the $F6 at $D57E and $D693 with $B6.
2. Patches for bugs in ProDOS 1.0.1 and 1.0.2
2.1 The command handler for the READ and WRITE call doesn't check,
if addresses above $BFFF are used. If you do so, ProDOS will
happlily bomb itself, because the language card is write enabled
all the time :-)
D0C8- E8 INX
D0C9- 20 89 EE JSR $EE89 <--- here
D0CC B0 08 BCS $D0D6
The JSR to $EE89 isn't correct; it jumps BEHIND the test
for >$BFFF.
Replace $D0C8-$D0CB with $EA $20 $84 $EE giving
D0C8- EA NOP
D0C9- 20 89 EE JSR $EE84
2.2 The error exit for SET FILE DATA invalidates the file reference
number, but with the wrong command :-)
This bug is totally redundant; the reference number is already
invalid and the wrong command bombs only the MLI scrtatchpad area
(which is freshly set up for every MLI-call).
D421- A9 00 LDA #$00
D423- 99 52 F0 STA $F052,Y <--- here
D426- A9 43 LDA #$43
D428- 38 SEC
D429- 60 RTS
The programmer has intermixed the FCB-index with the FCB-base
pointer. Replace $D424-$D425 with $00 $F3 giving
D423- 99 00 F3 STA $F300,Y
2.3 The error exit in SET MARK tries to set the file reference
number too. It looks like:
DE6D- A0 52 LDY #$52 <-- here
DE6F- 99 00 F3 STA $F300,Y
DE72- A9 43 LDA #$43
DE74- 38 SEC
DE75- 60 RTS
Obviously, there slipped a # into the assember file of ProDOS.
Correct is a LDY $F052.
Change $DE6D-$DE75 to $AC $52 $F0 $99 $00 $F3 $4C $26 $D4.
This gives:
DE6D- AC 52 F0 LDY $F052
DE70- 99 00 F3 STA $F300,Y
DE73- 4C 26 D4 JMP $D426
$D426 is the remainder of the error exit for SET FILE DATA.
It does the necessary LDA #$43 SEC RTS.
This bug can destroy data on your disk. If you have 4 open
files and this error occurs, some bytes are misplaced in the
written file resulting in damage or loss of data.
2.4 Bug in SEEKABS (RWTB for Disk ][)
If SEEKABS finds, that it is already on the desired track,
it jumps incorrectly into the arm mover and enables one
of the four phases. After that, it returns to the MYSEEK
routine, which disables all phases (phew!!!). This is not
a serious bug.
F931- 18 CLC
F932- 60 RTS
F933- 8D 72 FB STA $FB72
F936- CD 5A FB CMP $FB5A
F939- F0 4C BEQ $F987 <--- here
Correct would be a jump to the next CLC RTS (right before):
F939- F0 F6 BEQ $F931
2.5 Two addresses of the MLI scratchpad area are used twice:
$F0B5 and $F0B6. First, they are used for indirect jumps.
Second, they are used as scratch area for the interrupt!!!
If a interrupt arrives, while $F0B5/B6 has set up, but the indirect
JMP ($F0B5) hasn't been performed, then this could happen:
If there isn't enough space on the stack, 16 bytes are popped
and stored at locations $F0AF-$F0BE destroying the original address.
If the interrupt is finished and the normal execution continues,
the JMP ($F0B5) will go into never-never land.
This is the main reason, why you shouldn't use these old
ProDOS versions with a super serial or mouse card.
The addresses $F0A5 and $F0A6 are free and can be used for
this purpose:
D24D: A5
D253: A6
D27C: 6C A5 F0
D0E8: A5
D0EE: A6
D0F0: 6C A5 F0
Peter (koch@informatik.uni-kl.de)
--
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Peter Koch, Universitaet Kaiserslautern (AG Haerder, Raum 36/318)
Postfach 3049, 67653 Kaiserslautern (Germany)
@@@@@@@@@@@@@@@@@@ koch@informatik.uni-kl.de @@@@@@@@@@@@@@@@@@