With the information in pndc's answer to this question I've been able to examine the various ROMs and I think I have the definitive answer. Firstly it seems that CDTV and CD32 do things slightly differently so I'll examine them separately.
The commented disassembly of Exec by Markus Wandel provides some very useful information. In particular, it confirms points 1 and 2 in pndc's answer:
- exec, normally mapped at 0xf80000, will very early in the process see if there's another ROM at 0xf00000, and jump to it if it appears to be valid
- the entire area from 0xf00000 to 0xffffff is scanned for ROMTags.
(Footnote: interestingly, the code for these two items has been in Kickstart since version 1.2 if not earlier, and seems to be in as late as 3.1 - meaning that if there's a way to get a ROM with the right magic number to appear at 0xf00000, just about any Amiga will run it!)
The CDTV extended ROM
I inspected the hex dump of the first few bytes of the CDTV ROM. All normal Amiga ROMs start with the following:
- a two-byte magic number 0x1111 (for 256KiB ROMs which were normal at this time in the Amiga's history; later ROMs were 512KiB and have a magic number of 0x1114)
- a two-byte
jmp opcode, 0x4ef9
- a four-byte absolute address of the start of exec's instruction code
The CDTV follows this pattern, and the pointer to the instruction code is at 0xf000d6. This confirms that the CDTV extended ROM must appear at 0xf00000.
After the initial ROM data, the CDTV extended ROM contains the exec code, just like the real ROM does, although in this case the CDTV extended ROM contains a different version of exec, version 34.1001, instead of 34.2 in Kickstart 1.3. The remainder of the CDTV extended ROM is more ROMTags for the CDTV specific code. As pndc notes, the entire area of both the extended and standard ROMs is searched for ROMTags, so all modules from both ROMs (after deduping - this would remove the exec module from the standard ROM as it is a lower version number) are linked in to the running system.
(Footnote: it's not certain whether it's the normal ROM or the extended ROM which appears at location zero when the "ROM overlay" is on after a reset - on other Amiga models it would be the normal ROM at 0xf80000, but OTOH the CDTV designers may have made its ROM appear there instead. It doesn't really matter anyway - the standard ROM will jump to the extended ROM if it's present so it doesn't matter if the extended ROM is first executed or not.)
A500 with A570 fitted
At mnem's suggestion (in a comment on the question) I've also looked at the A500+A570 combo. The A570 was a CD-ROM drive and controller which attached to the side expansion bus of the Amiga 500 and 500Plus. It seems that the A570 included the same or similar extension ROM as the CDTV, to the point where an A500+A570 would display the CDTV boot logo. The CDTV has Kickstart 1.3 and its extended ROM is compatible only with 1.3 - a newer version of the extended ROM is needed to be compatible with Kickstart 2.04 that was in A500Pluses, so it seems that the A570's extended ROM was actually a newer version that was compatible. I'm not sure if there are any A570s with the original, 1.3-only ROM.
The CD32 does things a bit differently. I've read forum posts that say that if an Amiga 1200 is fitted with a 1MiB ROM (instead of the 512KiB that is usual with Kickstart 2.0 onwards), the first half of the ROM appears at 0xe00000 and the second half at 0xf80000 as normally expected. Unusually, when the ROM overlay is active, it's actually the 0xe00000 part of the ROM which appears at address zero.
I examined a hex dump of the CD32 extended ROM looking for ROMTags. A ROMTag starts with the magic number 0x4afc, followed by a longword which is a pointer back to the magic number. Examining that longword pointer allows us to determine the base address that the ROM is expecting to appear at. Sure enough, the first ROM tag appears 16 bytes in, and the pointer is 0xe00010. So we can conclude that the CD32 extended ROM is compiled with an expected base address of 0xe00000.
I also examined the very first part of the ROM:
- Magic number 0x1114 (indicating a 512KiB ROM)
jmp opcode 0x4ef9
- 0x00f8002, the address of the
jmp opcode near the start of the regular Kickstart ROM location
This is evidence that the 0xe00000 ROM is the one which appears at location zero when the ROM overlay is on after a reset. These early bytes reference the 0xf80000 ROM instead of itself, and would cause the CPU to jump to the 0xf80000 ROM immediately after reset.
The CD32 extended ROM does not contain an exec replacement like the CDTV ROM does. After the 16-byte initial code, it goes straight into ROMTags for the CD32 functionality. So how do these ROMTags get linked in to the running system? Recall that for the CDTV, exec's search for ROMTags covered the address space 0xf00000 up to 0xffffff. I tried to find the same tables in the hex dump of later ROMs. In Kickstart 3.1, revision 40.60 as used on the CDTV, I found this table:
- 0x00f80000 - 0x01000000 (regular Kickstart area)
- 0x00e00000 - 0x00e80000 (CD32 extended ROM)
- 0x00a80000 - 0x00b80000 (additional ROM area)
- 0x00f00000 - 0x00f80000 (additional ROM area, as used to be used by CDTV extended ROM)
- 0xffffffff (end of list marker)
This new table appeared in revision 40.60, which as far as I can tell is the first public release of Kickstart 3.1, and was made for the CD32. Revision 40.55, a beta version for the Amiga 3000, has the old table.
So the case for the CD32 is:
- The extended ROM is mapped at 0xe00000
- It's the ROM that appears at location zero when the ROM overlay is switched on at reset, but it immediately jumps to the regular Kickstart ROM at 0xf80000
- Kickstart 3.1, as used on the CD32, has additional entries in the ROMTag scanning table, to make it scan the CD32 extended ROM at 0xe00000. From hereonwards, it's the same process as on the CD32.
(Footnote: the Amiga 1200 schematics show that it can actually accept 2MiB of ROM [consisting of two 16x512Mbit ROMs in parallel]. It's a good guess based on the ROMTag scanning table that the additional 1MiB of ROM is appearing at 0xa80000. A forum post appears to back up this guess.) If this is true, it would appear that the Amiga 1200 hardware supported this extra ROM space well before Kickstart knew about it.)
(Footnote: I was wondering why the CD32 extended ROM didn't appear at 0xf00000 like the CDTV ROM did. According to the Amiga 1200 memory map as appearing in the same forum post yet again), this area is used for something else: Flash ROM. A flash ROM component does appear on the Amiga 1200 schematic, but as far as I can see, it never made it to the PCB, not even as a vacant footprint. Google does not say much about this part of the A1200. It sounds like it would be a handy way of making