Willy Byte loads slowly with MB enabled

[tomcw]

BerliOS Bug #11593

Date: 2007-July-20 21:46
Submitted By: tomch
Category: 1.13.2
Bug Group: none
Assigned To: tomch
Priority: 5

[From cea2, Xorxif]

As an interesting side note, Willy Byte in the Digital Dimension loads painfully slowly if Mockingboard cards are enabled, and doesn't work at all with the Phasor card, but I suspect that is just a matter of incompatibility.

[tomcw]

[2008-October-18 20:11, by: tomch]

Tested with 1.15.0.4:
[Enhanced Apple //e, Mouse=OFF, Z80=OFF]

. MB in slot4 & slot5:

• Loads quickly to title screen
• Music & Speech work OK
• Takes ages to start game

. Phasor in slot4:

• Loads quickly to black screen
• Music played super-fast, then silence for a bit, then random beeps & whistles!
• Can't start game

I have now fixed the MB loading time problem (in my branch).

[tomcw]

I've revisited this after #765 was reported, and it seemed similar (since both using timers in one-shot mode). As it turns out the Lancaster issue was to do with Timer2 not actually being active.

Re-cap on Willy Byte:
At the intro/title sequence, press space then:

• 6502 I flag=0 (ints enabled), IRQ pin=0 (no IRQ pending)
• pc=0xa0e1, SEI (ints disabled)
• pc=0xa0f7, IER=02 (clear speech int)
• pc=0xa0fd, ACR=02 (T1=one-shot mode)
• T1 underflow
  • IRQ = 1
  • bTimer1Active = 0
• pc=0xa0e1, SEI (ints still disabled)
• pc=0xa0f4, $C40E/IER=02 ; Disable CA1 interrupt
• pc=0xa0f7, $C48E/IER=02 ; Disable CA1 interrupt
• pc=0xa0fa, $C40B/ACR=02 ; T1 one-shot & PB: enable latching & PA: disable latching
• pc=0xb7b7, SEI
• T1 underflow
  • current AppleWin "fix" is to clear IFR.T1 on this 2nd underflow (if in one-shot mode)
  • but not doing this..
• "Joystick or Keyboard?"
  • waiting ~20s
    • pc=0x784b, Read T1L-C (0x04) - clear IFR.b6 (IRQ 1->0)
    • Restart intro/title sequence...
  • pressing J or K...
• pc=0x691f, CLI (IRQ=1, I flag 1->0, so int enabled)
• Hangs here, as IRQ is never being deasserted by the ISR!

6920: ; ISR - only for speech interrupt:
	C48D = 02	; clr IFR.b1

. end of msg:
	C440 = 0
	C443 = 70
	68C6 = 0	; clr doing speech flag
	C48E = 02	; clr IER.b1
	RTI

. cont msg:
	C444 = ($A2),Y	; ($A2)++, ($A3)+=C
	C443 = ($A2),Y	; ($A2)++, ($A3)+=C
	C442 = ($A2),Y	; ($A2)++, ($A3)+=C
	C441 = ($A2),Y	; ($A2)++, ($A3)+=C
	C440 = ($A2),Y	; ($A2)++, ($A3)+=C
	RTI

[tomcw]

In AppleWin if I comment out the SSI263 I/O support, then Willy Byte doesn't lock-up as above (obviously there's no speech, just the AY8910 intro tune & in-game sfx).

It also has this SSI263 detection at $7863:

; Pre: I flag=1
7863:A9 02      LDA #$02 
7865:8D 8D C4   STA $C48D	; clr IFR.b1 (speech irq)
7868:A9 0C      LDA #$0C 
786A:8D 8C C4   STA $C48C	; PCR
786D:A9 80      LDA #$80 
786F:8D 43 C4   STA $C443	; SSI263.CTTRAMP
7872:A9 C0      LDA #$C0 
7874:8D 40 C4   STA $C440	; SSI263.DURPHON
7877:A9 70      LDA #$70 
7879:8D 43 C4   STA $C443	; SSI263.CTTRAMP
787C:A9 FF      LDA #$FF 
787E:20 A8 FC   JSR WAIT 
7881:AD 8D C4   LDA $C48D
7884:29 02      AND #$02 	; tst IFR.b1 / speech irq occurred?
7886:F0 02      BEQ $788A
7888:A9 01      LDA #$01 
788A:8D 95 B6   STA $B695	; 0=No SSI263, 1=Found SSI263
788D:60         RTS

@peterferrie: maybe of interest to you? Since I know you did one recently for Total Replay.

[tomcw]

Here's the code that sets up the speech for "Prepare to enter the digital dimension":
(Except TIMER1 irq is still pending - so the CLI at the end causes the hang; and also to skip the msg being spoken, since it'll just race through it due to the interrupt not coming from the SSI263).

68C7:	lda b695	; got SSI263?
	beq +
		a0.w = #$696b
		jmp 68d8
+ 	rts
68D8:78          SEI
68D9:A9 20       LDA #$20    
68DB:8D FE 03    STA IRQLOC  
68DE:A9 69       LDA #$69    
68E0:8D FF 03    STA IRQLOC+1
68E3:A5 A0       LDA $A0     
68E5:18          CLC         
68E6:69 02       ADC #$02    
68E8:85 A2       STA $A2     
68EA:A5 A1       LDA $A1     
68EC:69 00       ADC #$00    
68EE:85 A3       STA $A3     
68F0:A0 00       LDY #$00    
68F2:B1 A0       LDA ($A0),Y 
68F4:18          CLC         
68F5:65 A0       ADC $A0
68F7:85 A4       STA $A4
68F9:C8          INY         
68FA:B1 A0       LDA ($A0),Y 
68FC:65 A1       ADC $A1   
68FE:85 A5       STA $A5     
6900:A9 FF       LDA #$FF    
6902:8D C6 68    STA $68C6   ; doing speech flag
6905:A9 0C       LDA #$0C    
6907:8D 8C C4    STA $C48C
690A:A9 80       LDA #$80    
690C:8D 43 C4    STA $C443   
690F:A9 C0       LDA #$C0    
6911:8D 40 C4    STA $C440   
6914:A9 70       LDA #$70    
6916:8D 43 C4    STA $C443   
6919:A9 82       LDA #$82    
691B:8D 8E C4    STA $C48E   
691E:58          CLI         ; enable ints
691F:60          RTS         

[peterferrie]

It also has this SSI263 detection at $7863: ``` ; Pre: I flag=1 7863:A9 02 LDA #$02 7865:8D 8D C4 STA $C48D ; clr IFR.b1 (speech irq) 7868:A9 0C LDA #$0C 786A:8D 8C C4 STA $C48C ; PCR 786D:A9 80 LDA #$80 786F:8D 43 C4 STA $C443 ; SSI263.CTTRAMP 7872:A9 C0 LDA #$C0 7874:8D 40 C4 STA $C440 ; SSI263.DURPHON 7877:A9 70 LDA #$70 7879:8D 43 C4 STA $C443 ; SSI263.CTTRAMP 787C:A9 FF LDA #$FF 787E:20 A8 FC JSR WAIT 7881:AD 8D C4 LDA $C48D 7884:29 02 AND #$02 ; tst IFR.b1 / speech irq occurred? 7886:F0 02 BEQ $788A 7888:A9 01 LDA #$01 788A:8D 95 B6 STA $B695 ; 0=No SSI263, 1=Found SSI263 788D:60 RTS ``` @peterferrie: maybe of interest to you? Since I know you did one recently for Total Replay.

Thanks Tom, this is essentially the same solution that I found to work, except that I was setting the "IRQ fired" state from within the IRQ handler itself, and reading the result from a memory location instead of a card register. I thought that the $8x registers were specific to the second AY chip, since all of the stereo games check that $8x responds like $0x. Or is it that the range for AY is x0-x7, and speech is x8+? The Sound/Speech I has only one AY chip and the sound chip.

[tomcw]

Yes, the $8x regs are for the 2nd 6522+AY chip.
But the SSI263 is also connected to this 2nd 6522 chip, eg. for some setup & the interrupt.
$C48C is 6522 PCR (Peripheral Control reg), and needs to be set to 0x0C for the SSI263.

The Sound/Speech I has only one AY chip and the sound chip.

From the wikipedia article this old card used the old SC-01 speech chip, which interfaces differently to the SSI263.

[peterferrie]

Yes, the $8x regs are for the 2nd 6522+AY chip. But the SSI263 is also connected to this 2nd 6522 chip, eg. for some setup & the interrupt. $C48C is 6522 PCR (Peripheral Control reg), and needs to be set to 0x0C for the SSI263. >The Sound/Speech I has only one AY chip and the sound chip. From the [wikipedia article](https://en.wikipedia.org/wiki/Mockingboard) this old card used the old SC-01 speech chip, which interfaces differently to the SSI263.

From the implementation in Berzap, the interface looks at least similar but using $0x registers instead of $8x.

[tomcw]

It'll depend on which socket you plug your SSI263 into on the Mockingboard (I guess).

AppleWin only supports the SSI263 mapped to $Cn4x, connected to the (2nd) 6522 at $Cn8x.
But I wonder where the SSI263 gets mapped if you plug it into the other socket?

I will check the Berzap code...

[peterferrie]

AppleWin only supports the SSI263 mapped to $Cn4x, connected to the (2nd) 6522 at $Cn8x. But I wonder where the SSI263 gets mapped if you plug it into the other socket?

I have no idea.

I will check the Berzap code...

Specifically the "GRADER" file. It's the one that has the speech, and $38A holds the type of MB that was selected from the configuration.

[tomcw]

Aside relating to Berzap! ...

Berzap! from Asimov (berzap.dsk)

MB-A: in game music, no speech
MB-C: in game music & speech

• SSI263 speech chip

; Speech off
; Pre: 6502 I=0
978A:A9 00                LDA #$00   
978C:8D 03 C4             STA $C403  ; DDRA=0 - nothing to do with speech/wrong 6522!
978F:8D 02 C4             STA $C402  ; DDRB=0 - nothing to do with speech/wrong 6522!
9792:A9 0C                LDA #$0C   
9794:8D 8C C4             STA $C48C  ; PCR=0x0C
9797:A9 02                LDA #$02   
9799:8D 8D C4             STA $C48D  ; IFR=0x02, clr IFR.b1
979C:A9 02                LDA #$02   
979E:8D 8E C4             STA $C48E  ; IER=0x02, clr IER.b1
97A1:A9 80                LDA #$80   
97A3:8D 43 C4             STA $C443  
97A6:A9 C0                LDA #$C0   
97A8:8D 40 C4             STA $C440  ; SSI263.DURPHON=0xC0
97AB:A9 70                LDA #$70   
97AD:8D 43 C4             STA $C443  
97B0:A5 E3                LDA HGR.Y+1
97B2:29 7F                AND #$7F   
97B4:85 E3                STA HGR.Y+1
97B6:60                   RTS        

So like Willy Byte, this uses the SSI263 at $C440 and the 6522 at $C480.

---

MB Sound II: in game music, no speech
MB Sound/Speech: no in game music (only music at title screen)

• Votrax speech chip

; Speech off
; Pre: 6502 I=1
9773:A9 FF                LDA #$FF   
9775:8D 02 C4             STA $C402  ; DDRB=0xFF  
9778:AD 0C C4             LDA $C40C
977B:09 B0                ORA #$B0   
977D:8D 0C C4             STA $C40C  ; PCR|=0xB0
9780:A9 10                LDA #$10   
9782:8D 0D C4             STA $C40D  ; IFR=0x10, clr IFR.b4
9785:A9 00                LDA #$00   
9787:85 EF                STA FIRST-1
9789:60                   RTS        

This older MB uses the Votrax/SC-01 speech chip, which just hangs off the 6522 at $C400.

[tomcw]

NB. AppleWin emulates an enhanced Mockingboard-C with support for both SSI263 and Votrax/SC-01 speech chips... so in Berzap! both MB-C and MB Sound/Speech will support speech.

[peterferrie]

Great, thanks. I just found the bug on my side so everything is good now.

[tomcw]

I see that you changed the TR scan order (when initially looking for a MB) - so that Berzap! is patched to MB in slot-4, instead of MB in slot-5. AppleWin should work with Berzap! patched to a MB in slot-5... so potentially still a bug in AppleWin?

[peterferrie]

No, my bug. I just pushed the fix. Swapping the scan order allowed me to hide it while I was searching.

[tomcw]

Thanks. Good to know :-)

[tomcw]

Back to Willy Byte...

In AppleWin if I comment out the SSI263 I/O support, then Willy Byte doesn't lock-up as above (obviously there's no speech, just the AY8910 intro tune & in-game sfx).

The short summary is that this code is executed on pressing space during the intro/title sequence:

60F6:	lda b694	; gotMB?
	beq +
	jsr 9e0c	; jmp A0E0
+

---

A0E0:
	sei
	9e1e = #0	; was 1
	jsr a01c	; ?
	9e1e++
	jsr a01c	; ?
	jsr 9fc6	; update AY regs [0..E] for C400 & C480
	c40e = #2	; clr IER.b1
	c48e = #2	; clr IER.b1
	c40b = #2	; T1 one-shot
	rts

The "T1 one-shot mode" still sets IFR.b6 on T1 counter underflow, because IER.b6 is set. But since SEI has 6502 interrupts disabled, and they're never re-enabled, then it doesn't matter for the non-SSI263 case.

Even during the game, pressing CTRL+R to restart, just takes you back to the "Type in your own message..." message... but never re-enables 6502 interrupts (and never clears IFR.b6 or IER.b6).

Things to try:

• Try with a clean / non-cracked version of the game, ie. when there's a woz image made
• Try on real h/w: MB + SSI263

[tomcw]

Willy Byte with real Phasor:

• SW1=CLOSED (Phasor mode): speech works
  • Select keyboard (or joystick)
  • Flip disk
  • ESC to skip message, then 1 for difficulty level
  • "Prepare to enter the digital dimension" spoken at a higher pitch
  • WB guy parachutes in
  • CTRL+R to restart, and can repeat the above (so no hang)
• SW1=OPEN (MB mode): speech works
  • basically same as SW1=CLOSED (Phasor mode)

Basically: all working fine.

[tomcw]

Limit to just the no-PX variants (06f8ccb).

[tomcw]

Here's the PPT from Kansasfest 2020 (without my pre-recorded audio - just because I don't want to attach a 17MB file!), which explains the Willy Byte (and AppleWin) bugs:
AppleWin-WB-bug-v10-for-GH.pptx

And here's the YT/KFest presentation: (audio is a bit noisy for some reason, and the subtitles are poor + annoying!)
https://www.youtube.com/watch?v=Xtu-w28cbbI&t=4977s

The AppleWin fix was easy:

• on a Mockingboard write:
  • check if the access is via a: STA (zp),Y (and CPU==6502) or STA abs16,Y or STA abs16,x
  • check if it's a no-PX (page-crossing) variant
  • check if the address's low nibble == 4 or 8
• if all of the above then perform a Mockingboard read as well

NB. AppleWin's CPU (6502/65C02) emulation doesn't support false-reads. Instead of re-writing the CPU emulation to support them (which would impact performance and likely add new bugs), I chose to localise the support in the peripheral card's emulation code. This is in line with the LC support for ProDOS 2.5.0's exploit (see #700 (comment)).