[abc80] Super Smartaid Cartridge

[H. Peter Anvin]

>>
>> The 82S131 is definitely being used as an address decoder, and it looks
>> like only half of it (256 words) is actually used.  Without tracing the
>> wiring it is probably hard to know what the various values mean, though.
>>

OK, doing some educated guessing again, I think I have at least some
idea what we might have here.

It appears that just like ABC80 itself, the memory decoder PROM has a 1K
granularity and contain 4 maps (in ABC80 itself, only one is ever used,
but the PROM contains four.)

0-16K is BASIC, and 32-64K is RAM, so those ought to be "ignore".  Those
are all 4 hex (0100), so this bit pattern most likely means OFF in some way.

The four pattern for the 16-32K region look like:

   16 17 18 19 20 21 22 23  24 25 26 27 28 29 30 31K
---------------------------------------------------
A: 0f 08 08 08 0e 0e 04 04  0c 04 04 04 04 04 0d 04
B: 0c 08 08 08 0e 0e 04 04  04 04 04 04 04 04 0d 04
C: 0f 08 08 08 0e 0e 04 04  0c 04 04 04 04 04 0d 04
D: 0c 08 08 08 0e 0e 04 04  04 04 04 04 04 04 0d 04

The first thing to notice is that 22-24K (TKN80), 25-30K (DOS, printer,
IEC), and 31-32K (normal screen memory) are 04 as expected.

Surprisingly, they are pairwise identical A/C and B/D, so in effect
there are only two maps even though the PROM has room for 8 (the upper 4
aren't even programmed.)

Map A has 0c at 24K, which indicates that it does, indeed, hijack the
DOS autostart entry point to start up. There is a jump table at the
beginning of SSA2 which looks at least in part like the DOS jump table;
and assuming this gets mapped over address 0x6000 it immediately jumps
to a different table in the 0x40xx area, and then goes into a routine
that looks very much like initialization. It does *not* perform any kind
of I/O operation, but then looks to see if there is a jump instruction
at address 0x6000 and if it does, eventually invokes (through a weirdly
complex routine) the original address.

Thus, it would seem that map A is some kind of "boot mode", which
switches to map B when an address in the original ROM is tickled.

The code in SSA2 appears to be paged into two 4K chunks, with similar
but not identical jump tables at the start, which makes some of the rest
easy to guess:

0c, 0f, and 08 all mean SSA2; 0e means the CMOS RAM, and 0d means SSA1.

0100 - ignore
1000 - SSA2 (except first 1K)
1100 - SSA2 (first 1K)
1101 - SSA1
1110 - CMOS
1111 - SSA2 (first 1K during boot mode)???

Bit 3 = 1 obviously selects SSA.
Bit 2 = 0 probably turns off boot mode.
Bits 1:0 seems to select the memory accessed.

This leaves a huge mystery what 1111 means. It is possible that 1111 has
something to do with turning off boot mode, but then bit 2 becomes a
mystery.

The disassembly seems to indicate that both pages of SSA2 has
instructions that write to the ROM, and if we end up going to the DOS
initialization vector when page 1 is active, it seems we execute one of
them:

404B:  C36C40    .l@   JP 406Ch
406C:  CD8140    ..@   CALL 4081h
4081:  00        .     NOP
4082:  324040    2@@   LD (4040h),A
4085:  CDBA41    ..A   CALL 41BAh
4088:  00        .     NOP
4089:  324040    2@@   LD (4040h),A
408C:  C9        .     RET

There are a bunch of stubs looking like that starting at 0x4081.

Page 0 has similar-looking stubs on starting at 0x4081, but with other
addresses, and the writes are all to 4041h:

4081:  00        .     NOP
4082:  324140    2A@   LD (4041h),A
4085:  CDB54C    ..L   CALL 4CB5h
4088:  00        .     NOP
4089:  324140    2A@   LD (4041h),A
408C:  C9        .     RET

This strongly implies that writing to 0x4040 switches to page 0, and
writing to 0x4041 switches to page 1; A is uninitialized at this point,
which means only the address matters.

This is also made more likely by the simple fact that there are only
four OUT instructions in SSA2, and they all point to the sound generator
(06h), so the paging mechanism doesn't use I/O ports - probably easier
not to.

So now for figuring out:

1. How the heck is boot mode actually implemented, and what is the deal
   with 0f?
2. What is the data wiring of SSA1? I would assume that it, too, is has
   two pages, but perhaps not the same.

	-hpa