68000 Help on start adress - what do I miss?

[pelule]

I am working on the Datron 1281 for CALRAM readout via GPIB.
It uses the 68000 (68k) and I want to dig into the code to check some undocumented GPIB commands (re-engineering).
But since more than 2 weeks I am struggeling on finding the correct program start adress to step in the disassembler.

Doc of 68k states:
after RESET CPU loads first initial values of SSP and PC (start adress) in form of 2 LWORDs (32 bit)
  SSP (LWORD, 32 Bit, 4 bytes) from adress 00-0000
  PC (LWORD, 32 bit, 4 bytes) from adress 00-0004

Data orientation is:
  adr+0 = BYTE 3 / MSB of LWORD
  adr+1 = BYTE 2
  adr+2 = BYTE 1
  adr+3 = Byte 0 / LSB of LWORD

ROM Content is:
  00-0000h: 61 63 74 6B 63 6D 64 20

Means:
SSP: 00-0000 = 61 => 61 63-75 6B
     00-0001 = 63
     00-0002 = 74
     00-0003 = 6B

PC:  00-0004 = 63 => 63 6D-64 20 = 0110.0011.0110.1101.0110.0100.0010.0000 Binary
     00-0005 = 6D                   6    3     6   D    6    4     2    0
     00-0006 = 64
     00-0007 = 20

ROM is wired to the CPU (see attached picture)
 A1  -> A0-ROM
  :
 A17 -> A16-ROM
 A19 -> /CE-ROM, means ROM acess only, if A19(A18) = LOW (xddd.d0da.aaaa.aaaa.aaaa.aaaa Binary)
 A20
  :  -> A20 - A23 used for mapping (decoding by PAL)
 A23

note: a = cpu address line, d = decoding, x = don't care


Taking that intitial PC value as Startadress I see some miracles, I am not able to explain myself:
- A19 (A18 ROM) is HIGH, so /CE is HIGH, means ROM will not enabled - ?
- 68k max addess A1-A24, thus higher valus should have no effect?

Anybode able to get me on the right path of understanding?

BR
PeLuLe

[deephaven]

Where else does A19 go?

[PA0PBZ]

Code: [Select]

61 63 74 6B 63 6D 64 20
a  c  t  k  c  m  d
I think you are looking at the wrong address...

[westfw]

ROM Content is:
  00-0000h: 61 63 74 6B 63 6D 64 20

ROM content derived how?  That DOES look suspiciously like ASCII text rather than binary code!

Some 68k systems have special reset logic to cause the first memory fetches after reset to go 'elsewhere', because having ROM at 0x0000 can be particularly inconvenient.

[legacy]

because having ROM at 0x0000 can be particularly inconvenient.

good point, Amiga68K, and IDP are two examples

[pelule]

Some 68k systems have special reset logic to cause the first memory fetches after reset to go 'elsewhere', because having ROM at 0x0000 can be particularly inconvenient.

Yes, this is based on a Motorola AppNote and mainly used in 68000 based computers, which require to have programmable (RAM) vectors in their BIOS (ie. CPM/68k).
As mentione in the Motoral 68k AppNote:

After power-on or a system reset, the CPU fetches the initial Program Counter and the
Supervisor Stackpointer. These vectors are addressed at 0x000000 and 0x000004. Therefore,
the CPU has to see ROM at these addresses.

If you need to have the vector table located into RAM, you take a shift register clocked by the AS, and after the first 2 ROM fetches (SSP &  PC) the ROM is mapped to a different address range.

Where else does A19 go?

A19 goes to the decoders also (2x PALs).

So, we are looking to that 2 initial fetched directly after RESET. Nothing can be prepared in the CPU as there was no sw execution before, thus CPU acts by design, accessing Vect 0 @ 0h for SSP and Vect1 @ 4h for PC, both to be located in the ROM. CPU put 4h to the address-line for the PC.
As all adress-lines of the ROM are wired directly to the CPU, ROM selection have be controlled by /CE and /OE only.  A19 controls /CE, means A19 must be 0, to get ROM access.
Thus only /OE is able to map the ROM.
But no matter where ROM is mapped, A1...A17 are wired to the CPU (= 04h)
QED: CPU will access 4h and thus selects ROM address 4h.
Is there an error in my logic?

[NivagSwerdna]

I had a quick look at the schematic... it's not quite as simple as your section of schematic suggests...

On this device there are quite a few things mapped into the memory map... You have the ROMS, some Static RAM, some Battery backed RAM, an ASIC U203 and probably various bits of memory mapped measuring logic.

The decoding is not obvious, it is implemented by PALs and there is no diagram of the memory map.

My hunch would be that U203 serves the Restart Vector.

A logic analyser across the data and address buses would tell you.