Midwest Scientific 6800, SS-50, PSU help!

[fdiskitup]

I can write to memory !
For example
>M 7000/
When you type the / it gives you the current contents of memory location 7000, then you type in your value press space and you get the value at the next address, keep using space to go through the addresses or enter to stop.
>M 7000/FF01 FF02 FF03 <enter>

A dump shows the values are stored in 7000, 7001, 7002 etc.
(This means my ram board is working, at least at 7000.)

In a burst of over confidence I then wrote a program into 7000 to load A with 2 and add 2 then store the accumulated value in 7010….
Just typing
>G 7000
Crashes the system, so I think I need to set up the G command with an entry and exit ?

Not far from a “hello world “ program now…

 

[daver2]

Excellent.

What you need to do as well is to dump the memory starting at f000 or f800 up to ffff and see what you can see. One of the common ways if storing command tables is the ASCII code for the command followed by a 2-byte address of the routine to process it. If you can find this table hiding in the ROM, then that will give you a fairly substantial list of known commands to play with!

A further check that you have the table is that the the address of the routine itself should lie within the boundary of the ROM code (e.g. f000 or f800 up to ffff).

Dave

 

[daver2]

Just looking at your initial dump of FLEXBUG.

It seems to reset to physical address FF00 in the ROM.

It would be interesting to get a dump of the ROMs (if you can capture the memory dump output). I should be able to disassemble the code from that...

Dave

 

[fdiskitup]

If you have the time and the inclination, here's a copy of all the ROM that I extracted.

There is a MEM command that seems to check the Memory, that might be searchable, single letter commands will be harder to search.

There are 4 x 2k EPROM 2716 chips
"Boot" is in the first socket
"KK" is in the second (KK was Kevin K who gave me the computer)
"Old1" F000-F7FF - I'm not sure it was a good dump
"Old2" F800-FBFF - seems to be a good dump

I suspect FLEXBUG lives in the 2 "OLD" EPROMS

 

[daver2]

I am slowly making sense of it.

I can see the code that gets executed on a system RESET.

I can also see where it displays the message "FLEXBUG V1.02".

I will have another look some other time and see if I can find the command table. It is not jumping out at me at the moment.

Dave

 

[fdiskitup]

I can dump a selection using the format :
>D E000/E800

Strangely I can type
>IBM
and it seems to be waiting for something... IBM format disk ?

>T hhhh gives me a scrolling report of some kind.

also I think "." steps the operation forward.

 

[daver2]

I think I have found the command table (pretty close to the beginning of the $F000 ROM):

B, C, D, G, M, R, T, MOV, MEMT, MEM, LP, F, S, W, ADD, SUB, DISK, FLEX, MDOS, LO, MD and IBM.

I also see the text strings "BEGIN = $" and "END = $" indicating that there may be a routine to disassemble code built in somewhere - but this is a pure guess on my part.

I am on a business trip in a few days, so I will printout the relevant dumps and see what I can glean when I am bored in the hotel!

Some of the command entry points are outside the range $F000 through $FFFF - so they probably invoke code in the other EPROMs. These commands are: MEMT, MEM, LP, DISK, FLEX, MDOS, MD and IBM.

The E800 ROM has the following strings visible: "TO", "MEMORY ERROR AT" and "PRINTER NOT READY".

The BOOT ROM is strange. It has a small piece of code at the beginning and then what appears to be a large table (or tables).

Dave

 

[daver2]

Command table entry points.

B = $F213.
C = $F4EA.
D = $F287.
G = $F4ED.
M = $F657.
M = $F6DA. Duplicate?
R = $F748.
T = $F9D7.
MOV = $F567.
MEMT = $EC5A.
MEM = $EC00.
LP = $ED5C.
F = $F57B.
S = $F812.
W = $F7F3.
ADD = $F726.
SUB = $F73D.
DISK = $EAD5.
FLEX = $EAE1.
MDOS = $EAD5. Alias for 'DISK'.
LO = $F708.
MD = $EACB.
IBM = $ED8D.

$E000 ROM called 'BOOT'.
$E800 ROM called 'KK'.
$F000 ROM called 'OLD1'.
$F800 ROM called 'OLD2'.

Dave

 

[daver2]

The 'DISK' / 'MDOS' command at $EAD5 appears to load code into memory from $C000 to $C0FF = 256 bytes (presumably one sector of 256 bytes). The loaded code is then executed at $C000.

Dave

 

[daver2]

The command 'IBM' ($ED8D) doesn't appear to to much...

If ACC A is $2D on entry to the subroutine then memory/IO address $FF08 is cleared to $00. Otherwise, memory/IO address $FF08 is set to $01.

I assume $FF08 must be RAM then - or an I/O port (more likely)?

I suppose the next thing is to work out the memory map for the machine...

Dave

 

[fdiskitup]

The manual for the CPU board describes how 2 monitors can be used, in their example GMXBUG-09 and OS9. There is a software addressable bit that will swop roms at say F000 into E000.
What I think we have in “boot” is a bootstrap to get FLEX started from disk. (I did not connect the 8” drives yet because I dont have any 8” disks, and the disk controller card is out of the system.

Ive been reading the GMXBUG-09 documentation, they call it a monitor / debugger but its really similar to FLEXBUG.
Next step is to compare FLEXBUG to this memory map.

 

[fdiskitup]

I can do maths and I can run a memory test!
>LP tried to load a printer but fails (I have none)
>FLEX puts it into a waiting state waiting for a disk?
>MD is a mystery, mount disk?
>LO another mystery

 

[daver2]

Fun isn't it!

Dave

 

[fdiskitup]

MEMT takes a very long time …
Long enough to build a new serial card and 2 cups of tea.

 

[falter]

You may be in the same boat I was in with Weebug on my own MSI 6800. Weebug had very limited functionality and mainly served to get the machines into a state where it was ready to boot Flex. My fix was to recreate the original ROM image. I think mine had 2708s.. so I had to use my 2708 burner on my SWTPC. I think I used my PC terminal to feed the contents into RAM and then burn those. Someone here kindly posted the listing for MSIbug to make that happen. It should be here in the forums on a thread somewhere..

 

[daver2]

This monitor looks to be more comprehensive. Unfortunately, there doesn't seem to be any documentation on it. Hence a combination of trial and error and disassembly is called for to release the secrets of the magic box...

Dave

 

[fdiskitup]

Since its a GIMIX cpu card, I think I could use GMXBUG-09 or HUMBUG. I have some 2816 EEPROM chips that migh be pin compatible with the existing UV erasable EPROM chips. Perhaps I can sneak a mini basic in.

I didnt try the ELEKTRA cpu boad with the now working SS-30 serial / baud rate generator, do you think I should disable the baud rate generator on the ELEKTRA cpu card, it cant be good to have 2 baud rate generators in the same system ?

Based on the disassembly from Daver2 I’ve been doing alot of trial and error stuff with FLEXBUG, but I’m still just enjoying noodling arround and trying to figure out the SS-50 vs SS-50c IO space etc. Theres a lot of reading to do and I get sidetracked into kilobaud and 68 magazine articles.

What I really need to do is to get the dual 8” floppy unit connected and give it a Flex boot disk. But to make a flex disk I may need to connect the 8” to my IBM to put an image on the disk…

 

[fdiskitup]

Here is the full 8k Memory Dump for E000 to FFFF from the running FLEXBUG V1.02 system.
It does come very close to the rom images I dumped - but there are a few differences. I'd trust this more than the bin files. but it is less user friendly for disassembly,

I'm still not sure about the I/O, perhaps it is not readable - so we just get the ROM values at that address.

I can directly call some of the entry points you gave, for example

>G ED5C - calls the "LP" command and gives me the "No Printer Installed" message, then it crashes probably because it does not have a return vector ?

Also, through blind experimentation
>B- removes breakpoints.

 

[fdiskitup]

You may be in the same boat I was in with Weebug on my own MSI 6800. Weebug had very limited functionality and mainly served to get the machines into a state where it was ready to boot Flex. My fix was to recreate the original ROM image. I think mine had 2708s.. so I had to use my 2708 burner on my SWTPC. I think I used my PC terminal to feed the contents into RAM and then burn those. Someone here kindly posted the listing for MSIbug to make that happen. It should be here in the forums on a thread somewhere..

Falter, I read through the MSIBUG / WEEBUG thread - quite a process just to get the OCR converted to Assembly. I uploaded all my MSI6800 documentation to archive.org - including the paper listing for MSIBUG.

 

[falter]

Falter, I read through the MSIBUG / WEEBUG thread - quite a process just to get the OCR converted to Assembly. I uploaded all my MSI6800 documentation to archive.org - including the paper listing for MSIBUG.

Fantastic! Yes it was a learning experience for sure. I wish the documentation and software were more available. I recently purchased an MSI 1702a eprom burner but no software or docs.