Help decoding some System/3 machine code

[voidstar78]

The prior table was from the IBM 5110 BASIC NX ROS.

The table below shows that the IBM 5100 BASIC NX (BCOM bin) exhibits essentially the same jump vector table at the very start (offset 0x0000):

The offsets are of course different, but the overall pattern is the same.



The offsets themselves don't mean much - but the mystery here is what Processor has these opcodes (in the "HEX" columns). The dark brown are presumably unsupported codes (like "32"hex and "CA" hex). Haven't yet deciphered what address is implementing which instruction.... But for PMC, for example, "06" is suppose to be an ADD and that does jive with the above table.

 

[voidstar78]

Ok, whatever instruction set the BASIC NX ROS contains, I stepped through a few dozen of them on the 5110 ROS to get a general feel for the operands they contain.

I did this by issuing a simple BASIC statement ("10 A=8") and then trapped each time the PALM code did a GETB Rxx, $1 after that -- i.e. extracted each byte that was requested out of the BASIC NX ROS (and the emulator keeps track of the current address offset into that NX ROS).

So the first byte in each row in the following corresponds to some opcode that is being processed. We've always assumed it was some System/3 instructions, but we're not sure. It could be a later post-1970 model of System/3, or some "extended mnemonic" variant that we're not familiar with.

The addresses (0924, etc) are in the BASIC NX ROS (unless otherwise specified).

0920: C3 00 0B 22

(start of BASIC NX ROS in support of "10 A=8" BASIC statement)
0924: C8 20 0B 2A 05 C4
      CA 0F 0B 2A 23 EE
      3B 10 0B 6C
      38 80 0B A1 04 9F
        31 00 0B A8   (not executed, appears to be in support of prior instruction or is skipped)
      3C 40 05 C0
      3C 00 0B 57
      09 01 0B 58 00 00
      3B 10 0B 6D
      3B 08 0B A4
      33 40 01 3F
      3C FF 10 CE         (set  RWS[10CE] == FF)
      04 40 10 CF 10 CE   (copy RWS[10CE] into 10CF, looks like 5x64 times -- not sure how this knows to do this more than 40h/64dec times)
      3B 04 0B 6D
      35 40 0B 63
      33 50 00 03
      F8 40 50
      C0 A0 04 D5
      C4 40 0B 61
        08 04 D5      (not executed, appears to be in support of prior instruction or is skipped)
      34 40 0B AC
      3B 03 0B AD
      0C 01 0B AA 0D B0
      3B 03 0B AB
      33 40 06 07
      34 40 0B B2
      33 40 00 04
      36 40 0B AC
      C0 A0 04 D5
      C4 40 0B AA
        18 04 E1      (not executed, appears to be in support of prior instruction or is skipped)
---------------------- jump to 0x09C2
09C2: 3B 04 0B 6D
      09 03 0B A6 00 00
      0C 03 0B AE 0B A6
      33 00 06 07
      34 00 0B B0
      30 04 0B AA --> leads to the BRA table at 0x217E in the BASIC ROS (3rd offset) that targets 0x20BC

BASIC ROS 20BC: perform data movement (using PALM), then finally JMP ($0104) to start processing the next BASIC NX instruction at 09DE

09DE: 33 40 00 05
      33 10 05 80
      33 30 05 BF
      F1 05 F4
------------------------------ jump to 0x0BE8
0BE8: 34 80 0F D9
      33 30 05 C0
      DD 40 00 06 01
      33 ...

Using SC21-7509-7_System3_Basic_Assembler_Reference_Manual as a reference (here), Appendix A, my understanding is that for the System/3, the second half of the opcode-byte is a kind of "opcode category". Like 07-A7 (or any "x7" series) is a variant of the "SZ" instruction. So, I grouped the set of opcodes covered above ordered by the second byte. There may be a newer version of this reference manual that is not yet digitized, or IBM took liberties at having some extended or "undocumented" opcodes. A lot of these opcodes do jive with the manual, but for example there are no "3-series" opcodes (e.g. "33") - since this is from the 5110, it's possible that was added after 1975.

30 SNS (page 66)
C0 BC (page 66)

F1 APL (page 68)

33 ????

04 ZAZ (page 53)
34 ST (page 65)
C4 ZAZ-extended??? (page 53)

35 L (page 65)

36 A (page 65)

C8 TBN-extended??? (page 64)
38 MVX or TBN-extended??? (page 56)
F8 MVX-extended??? (page 56)

09 TBF-extended??? (page 64)

CA SBN-extended??? (page 63)

3B SBF (page 64)

3C MVI (page 63)
0C MVC-extended??? (page 63)

DD CLC-extended??? (page 58)


Anyhow, I'm pretty confident none of that is PMC (pseudo machine code stuff). At least not as described in 3-277 in here . Pseudo code may still be involved, TBD. But at least some form of System/3 native does seem to be involved, and the emulator provides a method for isolating out the exact addresses/ROS offsets involved.

 

[voidstar78]

Page 385 of the S/3 Model 6 Logic Manual (here) lists a set of "Extended Mnemonics". The opcodes to those seem to be listed on page 51 of the assembler reference (here). That assembler referene also has a nice summary started on page 47. It still doesn't clarify "33" or "DD" though, but again those may be post-1975 additions to S/3.

 

[voidstar78]

The IBM 5100 "bcom" (BASIC NX) ROS exhibits the same overall pattern. Using the 5110 BASIC NX as a reference, I manually spotted around for alike-sequences. Since I cant (yet) run the 5100 NX ROS's, I had to kind of guess in a suitable address offset. I narrowed down to 0x06B8 as a likely candidate to the start of some code (in the IBM 5100 BASIC NX ROS). Using the vector offset table, then I manually "ran the code in notepad" using a PALM disassembled version of the 5100's executive ROS (e.g. "3B" is at offset 0x1D70 so just search for "1D70" in the disassembled exec ROS that contains the "BASIC executive"). From there, the code for emulating a "3B" is the same as what is in the 5110 (just different offset) - repeat for each opcode, and manually keep track of the number of GETB "calls" to get the next byte from the 5100's BASIC NX code. Not too tedious actually, but it comes up with this as a sample of "something-like-System/3" instructions for the IBM 5100 system...

-----------------------------
06B8: 3B 10 0B 69
      3D 0F 0B 1C 10 48 39
      38 80 0B 97 06 CD
      31 00 0B 9A
      3C 00 05 C0
      3B 10 0B 6A
      09 FF 0F D4 00 FF
      09 49 10 D4 00 FF
      33 40 00 05
      33 10 05 80
      33 30 05 BF
      F1 08 9C
      F0 07 33         ;  "7h"
      33 20 0F D4
      7D 1B 00 18 07 0C
      39 20 0B 97 08 55
      7D 0B 00 20 07 A4
      F0 07 57         ;  "73" 
      7D 24 00 00 07 3C
      39 02 0B 6A 07 1F
-----------------------------

What stands out to me is that the "mysterious" opcode 33 is present (so that wasn't a post-1975 thing for the 5110), and the use of "F0" (HPL) to illuminate the two character status LED.

I've no idea what this portion of code is doing, but its enough overlap with "System/3-isms" to convince me.. Maybe it wasn't a Model 6 that was used. And even in later Intel and Motorola microprocessors, they had plenty of instances of undocumented opcodes.

 

[voidstar78]

The IBM System/3 Model 10 Components Reference is listing a more extensive set of opcodes. But many of them don't actually have a mnemonic.

Does anyone know what "T1T3" or "T2T3" means in the context of System/3? It appears to refer to "tiers" (maybe tiers of punches?)

Using opcode "C8" as an example below, it seems to me that it is a variant of "BA" (card code). It can't be referenced directly from the assembler mnemonics (unless the context of use sometimes changes the tiers?). Or maybe the use of tiers is just a way to somehow speed of compilation if punch cards are involved?




Even the "mysterious" opcode 33 is similar: it appears to be some variant of card code "DC" with no associated assembler mnemonic (variant in terms of what tiers are involved).




The S/3 Model 6 Component reference is on archive.org here (it doesn't list any assembler mnemonic at all, just the card codes in its Appendix B).