-
ROMulus and Remus; a tale of two EPROMs
09/15/2017 at 16:02 • 8 commentsA couple days ago Esot.eric dumped the two EPROMS on the board, U9 and U32. I spent a little time with those images, and Esot.eric suggested I share my findings thus far (there is much more to go, but that will take several days work).
U9 is the character generator ROM, and U34 is the 'boot' ROM. Why the quotes? Well, we're pretty sure it is more than just the boot ROM. For starters, a boot ROM would not need to be 8K -- 2K would be more than sufficient to init the system and load the second stage loader off disk (and indeed earlier Kaypros did have a 2K boot ROM), so the current thinking is that it contains other subroutines that are of use at runtime.
The Kaypro is a CP/M machine, and those familiar with CP/M will know that one of it's quirks is that it requires RAM at the bottom of memory. Yet 0000h is the reset vector for 8080 and Z80 (for which CP/M was created), so you've got to have ROM there at least during boot up, and that generally implies some sort of bank switching to get it out once you've gotten past boot. So far, so conventional. Also interesting is that the ROM does not reference any RAM locations below 8000h (even though this one is only 2000h long), so it seems that Kaypro had plans to possibly expand this ROM-based subroutine approach in future models, and set up their codebase accordingly.
I'll cover the disassembly findings in a subsequent post in more detail (i.e., when I have details to post!), but some interesting things have come out already with a cursory scan:
- there are some peculiar register addressings related to video
The video is mostly controlled by the then-popular MC6845 (or clones). This chip has 18 registers, and is interfaced through two physical addresses: the first is the address register selecting which of the 18 internal registers is being operated upon, and the second is the data register that is mapped to the selected register. So far so straightforward, but I noticed in the code many times accessing of a register 1Fh, which does not exist on the chip. Blargh! My mind is boggled. - to add confusion to befuddlement, there is a physical port 1fh that is routinely accessed in the (ostensibly) video driver code. But this one I think I have more of a handle on:
The video memory on this unit is composed of two 6116 static RAMs, 2K each. Hmm, this device has an 80x25 display, which is 2000 characters, so why do we need a total of 4K? Hypothesis: attributes. 8 bits for character data, and some more bits for things like high-intensity, inverse video, etc. Some of Esot.eric's screen shots show that these capabilities are there, so we know we need the extra bits. Also, the 6845 is essentially a fancy address generator -- you still have to implement circuitry to shift out pixels and blend in sync pulses and whatnot. So, the video memory is typically being addressed and controlled by the 6845 on a continual basis, and not mapped into the CPU's direct address space. But something's gotta let us write data into video memory!
There is a gate array in this machine (actually two). Since it is a custom chip, it is a black box from the standpoint of analysis, and could be doing anything. So, my hypothesis in this case is that the port 1fh is decoded by the gate array, and is used to access the video memory to write characters into it. And probably the attribute bits as well. Much more work will be done in this area. - As was common on many machine designs, the address decoding may take shortcuts by not decoding some bits and thus creating aliases in the address space. This was typically done simply to save on parts count ($) but was Hell on 3rd party expandability. This was done here as well, and A6 does not contribute to the decoding of port addresses, and so there are IO aliases of the first 64 ports into the 40h-7fh space. Fortunately for the rest of the world, they did decode A7, leaving the upper 128 ports for others, which brings me to my point: I have noticed in the ROM I/O accesses to ports 81h-87h, which are not standard Kaypro 2x ports. Hmm. Ain't that something? It's so obvious now, but it wasn't until I woke up this morning that I realized that the boot ROM is also custom to the Omni4 (over the Kaypro 2x), and that these ports must be part of the logic analyzer daughterboard. Also, because there is customization of the boot ROM, it further suggests that Omni either had a close business relationship with Kaypro to have access to the source code to modify, or they were hackers that reverse-engineered it. My guess is the former, but the latter was not at all uncommon in those days (for fun, search "Michael Geary Adobe Type Manager" to learn about an (in)famous case, and the wrath of the software pusblisher whose code was reverse-engineered). Anyway, my suspicion is that ports 80h-87h (at least) operate the Omni4 daughterboard, and it is very good indeed that we have the ROM dump, because disassembling the code on the floppy would be insufficient. Thanks Esot.eric!
Since it is going to take me several days to analyze and comment this ROM dump, for fun in the meantime I decided to code up a little program to transform the character generator dump into something meaningful to the human eye. Attached herewith in the files section is OMNI4U9.txt containing that result. I didn't think that much of it at first, but Esot.eric believes that some of the graphics characters are non-standard, and are used by the Omni4 software to depict timing waveforms. So, once again, thanks for the dumps, because that will make disassembling the logic analyzer program make much more sense knowing what the special characters look like!
Next, I must weave time between real-world responsibilities and code archaeology, so it may be a week or so before I have the ROM disassembly completed. Or sooner if my burning desires overcome my sense of responsibility -- this has happened before, alas....
- there are some peculiar register addressings related to video
-
Serial
09/14/2017 at 22:28 • 0 commentsAnother previously-unfinished draft, but plausibly useful
_---------
turns out pip doesn't convert *to* intel hex... it can convert *from*. Well, that doesn't help.
Took a bit of effort to get communication working... a few surprises.
Unless I happened across two bad pinouts, this guy has tx and rx swapped from the RS232 standard. Also it doesn't have most pins typically used... it has a CTS input, but no RTS output, nor DTR, etc. So, my null modem cable, per wikipedia, didn't work.
First i Cut the RTS->CTS wire and rewired the PC's DTR->CTS and
-
Easy pipping, aka to pip or not to pip
09/14/2017 at 02:25 • 2 commentsUPDATE: NOPE. See next log...
ziggurat and I have both been unable to fiigure out how to successfully mount the disk (image) on a linux machine using cpmtools. Seems strange... seems like surely enough folk out there use (d) kaypro 2x's that surely the settings should already be in there. But alas, two folk, no go.
The idea, then, is to use pip, the peripheral interchange program, to send the files from the booted disk in the booted machine via serial port to a linux (or whatever) machine. Sounds simple enough...
Unsure how exactly to format the command line, came across this: https://groups.google.com/forum/m/#!topic/comp.os.cpm/f9vzK1OvaII
Wherein numerous caveats I'd vagued upon are brought up... and several I hadn't considered.
First... pip does have the ability to send binary files, but how would the receiver recognize the end of the file, when only 8 bits are transferred at a time, and a binary file can contain *any* 8bit value in any location, including the "end of file" byte...?
So then pip must use a protocol for the transfer, like xmodem, right? Well I don't see that in the manual, it looks like it isn't that sophisticated. Then raw binary transfer... I guess I could have a timeout... or maybe the handshaking lines... dunno.
Then that page made note of something I'd glossed over... pip *does* have the ability to convert an input file to intel hex format. BAM.
Which is also a great idea because: I haven't found anywhere info on how to configure the serial port... yahknow, baudrate, parity, handshaking... which didn't seem like too big a deal until I happened upon anithher comment at that page... default it 7bit! Well shit... that'd put a serious damper on a binary transfer.
So yes... I think intel hex conversion will do quite nicely. Built into pip. And crc's to boot. BAM.
-
(TODO!) + ROMs, Good Disk, First Samples
09/13/2017 at 06:55 • 2 comments(TODO: Apparently I set the logic-analyzer board on a scanner way-back when... 350MB files my computer can't handle right now. But maybe they show some now-unreadable chip-markings. I do remember, now... my scanners weren't too happy with the three-dimensionality of the thing. But who knows... Next time I free up a couple gigs for temporary files, I'll try to remember to look at 'em, and maybe upload. And now I recall why I was so excited to spend $300 on a student's wage to buy a SCSI scanner I did a lot of researching for, way back when.)
Two EPROMs exist on the KayPro motherboard (none seen on the Logic Analyzer board). U9 and U34, different sizes.
U9 seems to be the character-generator ROM (likely once labelled "K2xCHAR", though the sticker has been floating in the case).
U34 seems to be the boot-ROM/BIOS...
Funny it mentions CP/M in the ROM... because that message doesn't come up until the disk loads.
The ROM images are now in the "Files" section.
----------
"Burnt" new disks (several, infact). Turns out the first diskette was corrupt. The image burnt without errors numerous times thereafter.
Now I can run D.COM:
yeahp... I ran that once before and forgot... basically just a little more sophisticated than "dir"
STARDNLD.COM still just freezes... anyone know what it might be?
I think the majority of the rest of the files are actual logic-analyzer samples and/or configurations... but I have yet to look into them.
------------
On to sampling!
Only one probe is labelled... and the other seems to have different heatshrink...I had to look inside... (I'm guessing someone else did before, as well).
Huh... This thing supposedly does waveform generation, but I don't see that happening with 7400's at the probes. Maybe they require different probes.
I set up the logic analyzer pods to read from a few pins on what I think to be the video-controller and discovered an interesting error message:
"External clock does not generate waveform"
This message occurs when the cables are near other circuitry... or when the cables overlap themselves. Lotsa testing happened... Apparently we've got some antennas.
Re-ran the cables away from other circuitry, and now we have waveforms!
----------
Gotta cut my laptop-usage short... thing eats through the battery, gotta leave the engine on to use it longer than an hour-ish, else I'll need a jump-start tomorrow.
-
Mounted, etc. And a Kaypro question.
09/12/2017 at 09:32 • 4 commentsopening and closing the case every time I want to work with the thing is getting tiresome... but space and the necessity to "batten down the hatches" requires its full assembly when not in use. so mounted a 3.5in drive in place of the original 5.25... took a while to find the right drive for the job... and had to resolder the drive-select jumpers. But it's just a standard 1.44mb drive and works... no other jumper changes required.
Had a brilliant idea to mount the original drive inside so it can't get misplaced... went through all the racket necessary (reopening the case, removing the PCBs, mounting the thing, making sure it was secure for transport...
Friggin thing fit perfectly. Then put the PCBs back in.... and dag nab if it wasn't 1/8th of an inch too high. So the original drive and the kaypro may both be suffering separation anxiety. I kinda am as well.
Ran some experiments while it was open... tried running the logic analyzer program with the board disconnected. Definitely failed all self tests.
So looks like the LA board is functioning, despite not having sampled any data yet. Also, it detects that I hadn't yet attached the probe-pods. Smart cookie.
Also experimented with the other programs
D.com (?) has a sector error. And recall that there were a couple failures during the write-process... so may just be a flaky disk.
Stardnld.com (?) just freezes...
But prog.com apparently turns the thing into an eprom programmer (with the right personality modules... which of course I don't have)
Pg.com turns it into a pattern generator... 16 channels?
La.com is the logic analyzer
Pip.com is the cp/m program for peripheral intercommunication (basically xcopy or dd, if I understand)
Masmenu.com makes for a nice UI.
And here's a full listing of all the files... since two folks, now, have been unable to mount successfully with cpmtools...
...
Other notables: "Omni4" is printed on screen in many locations... once before reading any disks, so this must have a custom ROM, rather than the standard Kaypro 2x ROM. Got the eeprommer running with the 486 lappy (man it's way easier to use floppies than my original plan to use xmodem) and waiting for my next patience with case opening, etc.
Thanks to my new pal ziggurat for bringing the custom ROM and more to my attention.
Also cp/m appears to be customized.
But we're pretty durn certain this is a kaypro 2x.
Also... the 3v battery (over 30 years old) has 2.73v on it... so if anyone knows how to read things in the nvram and/or date/time on one of these things, we're curious what it's been holding onto all these years.
-
Incredible star alignment
09/11/2017 at 05:48 • 0 commentsthe laptop floppy didn't need anything other than a different belt.
The default settings in imagedisk worked
The floppy drive I picked for the first try in the kaypro was beat up but had clearly marked and easily accessible jumpers. (Need to change to DS0, at the very least).
Booted right up.
Oddities certainly abounded... but nothing particularly relevant to preventing getting it going quite easily.
(Disk formatted and loaded with files in linux. Formatting in DOS then loading files in linux worked fine)
(Original belt surrounding unsuccessful replacement. Successful replacement was even smaller and required more force to stretch. also thicker material.)
(The workbench and something on the two screens I forget. Oh... the linux formatting commands used, and DOS's interpretation... oddly DOS said the newly-formatted 720k disk had 360k free... did a doubletake).
Bwamo. Lohic analyzer setup screen.
so now... trying to decide what to do for longish-term so's I don't gotta open the case all the time. Obvious choice: pull out the 5.25... but am hesitant to let it get lost. There's also just enough space it could be mounted internally... but then no swapping floppies (for what?).
Prepping to run some samples soon!
-
disk image notes
09/11/2017 at 02:14 • 0 commentsUse IMD117 (118 doesn't extract properly)
Settings, Attempt 1:
Cyl: 40
Double-Step: Disabled
(Presumably: Since a 1.44MB drive can work with 720KB floppies in an IBM/PC configured for a 360K drive: the 720KB "notch" indicates to the drive to double-step. I'm using a 1.44MB disk, with the notch covered)
---- Write Disk From File ----
LOTS of notes in disk image... too many to see on-screen.
(Isn't there a viewer utility that came with imagedisk????)
"Written with R/W Gap=20, Format Gap=23"
...
ImageDisk reports, while writing:
"A: 250k DD" (250kbps?)
"G1:7" "G2:14" (???)
"21/1: Write error <19> NoData" ???
"33/0: Write error <8> NoData" ???
"800 sectors (100 Compressed)
Write complete..."
The scrollbar at the top shows only half the disk written (?)
Did the drive not double-step automatically? Or...?
Also... I thought 360K drives were 300kbps, but then they wouldn't be interchangeable...?
Note that I used "Calculated" for gaps rather than entering the aforementioned values.
Disk wrote, despite odd gap-lengths necessary for fitting 10 sectors... so... maybe a go.
Time to throw the 3.5in drive in the KayPro.
-------
Oh, obviously managed to get the 486 laptop's floppy drive working... Tried another belt. This one smaller (both require quite a bit of stretching) in diameter, but thicker material. Stretch was harder... Thought: The other might've been too stretchy while spinning? Who knows.
Odd effects using disks made in linux under win95... "mkfs.vfat -I /dev/sdb" may have some issues... as formatting under windows (DOS) then using on the linux machine seems to be fine. Odd effects include: disks showing less available space than they should, files written to disk appearing *very* strange when 'dir'ed... including one 'directory entry' which appeared to be the contents of a file? Oddly, these disks work fine under linux.
-
TMI ctd
09/10/2017 at 06:00 • 5 commentsphone entries... wee!
Logic analyzer board has chips labelled letter number. E1 is at the low right M21 at the upper left. Letter is col. Number row ish.
The big three are intel peripheral ios and an intel timer.
Some of the chips are darn near but not impossible to read. Others I couldnt get. Nat semi seems to have used ink soluble in the clear coat... cleaning off that also cleans off the remaining label :(
Some thoughts for plausible deduction...
The logic analyzee board has traces cut off atrhe edges...dunno. maybe trying to fet away with multiple designs on a single panel purchas... done that myself... but I was 15 and in an era where fab houses were likely quite a bitdifferent than the early 80s aimed at large runs...
the kaypro board has a fallen off sticker "k2x char"... these are the crystals
Oddly no 20mhz... 18 though and 16
The copper tape on the eproms was my doing... wouldja believe they left the windows open?
-
TMI
09/10/2017 at 05:24 • 5 comments -
Lappy flop
09/09/2017 at 09:51 • 0 commentsthe 486 laptop has had floppy issues as long as I can remember... today was the first time I really looked into it. Turns out they use a belt for the spindle, and it was definitely slipping. Replaced, now, and spinning, but still not reading/writing.
Not many ideas. The only belt long ennough but not too long had to be stretched pretty tight... so maybe slowing it down.BUT the motor is a stepper, and the spindle has sensors.
Tired.