I had the same type of question and I found this on the web;
The following is MSCP.MAC, the code for the toggle-in bootstrap for DU0 as
listed (almost) in the RT-11 5.6 manuals. When this is assembled, the .SAV
image at 76000 will match that of the boot.
The first set of comments on the right are the (octal) location and
contents of the bootstrap, should you actually need to toggle it in. I am
indebted to Jim Crapuchettes for deducing the missing word in the manual
listing, and for providing the comments as to what the code is doing.
[MSCP is a pretty mysterious protocol. Suffice to say that you build
instruction packets in PDP-11 memory, then tell the controller to execute
them.]
Note that I have used this code, as ODT instructions, to "ram" the
bootstrap over a serial line to an 11/73 which had no DU boot. The 11/73
came up in ODT, so all I had to do was to fire up VTCOM and send the
ODT-like instructions over the serial line (ending, of course, with
76000G). To my surprise, it worked!
;------------------------------------------------------------------------------
;This is the MSCP bootstrap as listed in the RT-11 5.6 INS manual ...
; along with its disassembly (by hand!). Additional comments and
; attempts to make "nicer" assembly by
; Bob Schor
bschor@vms.cis.pitt.edu (412) 647-2116 (w)
;
;Missing word (at 76102) and most of the explanation supplied by
; Jim Crapuchettes
jimc@netcom.com 408-732-0569
;
.asect
. = 42
.word 1000 ;-; Set stack pointer for RT-11 - don't "toggle" in
. = 76000
; The contents of R0 must be the MSCP unit number. Although it is set to 0
; below, it could be manually set to some other value and then execution
; started at 76002.
start: clr r0 ;76000/5000 ;; Preset register to 0 (unit)
mov #172150, r1 ;76002/12701 ;; Point to IP register
;76004/172150
1$: mov #itabl, r4 ;76006/12704 ;; Point to init/cmd params
;76010/76156
mov #4000, r5 ;76012/12705 ;; Set init step to 1
;76014/4000
; Do 4-step controller initialization. Begin by writing any value to IP to
; reset the controller; all the rest of initialization is done through SA.
mov r1, r2 ;76016/10102 ;; Copy IP address, write to
mov r0, (r2)+ ;76020/10022 ;; IP to init & bump to SA
2$: tst (r2) ;76022/5712 ;; Test for error bit in SA
bmi 1$ ;76024/100770 ;; Error = start init again
bit (r2), r5 ;76026/31205 ;; Test step bit in SA
br 3$ ;76030/401 ;; ????, appears to skip next
bic (r1)+, (r5)+ ;76032/42125 ;; ????, seems to be skipped
3$: beq 2$ ;76034/1772 ;; Wait for next step ready
mov -(r4),(r2) ;76036/14412 ;; Next init param to SA
asl r5 ;76040/6305 ;; Move to next init step
bpl 2$ ;76042/100367 ;; Loop thru 4 steps
; Bring unit on-line, read bootstrap (block 0) from the disk and start it up.
4$: tstb -(r4) ;76044/105744 ;; Point to next cmd byte
bne 5$ ;76046/1002 ;; Loop thru commands
mov pc, r4 ;76050/10704 ;; Point r4 to "clr pc" and
clr pc ;76052/5007 ;; go start at location 0
5$: clr r2 ;76054/5002 ;; Init for clearing memory
6$: clr (r2)+ ;76056/5022 ;; Clear memory from loc 0
cmp r2, #17204 ;76060/20227 ;; thru loc 17202
;76062/17204
blo 6$ ;76064/103774 ;; Loop until done
incb @#17101 ;76066/105237 ;; Packet length = 400 bytes
;76070/17101
mov r0, @#17110 ;76072/10037 ;; Set unit number = 0
;76074/17110
movb (r4), @#17114 ;76076/111437 ;; Move command to cmd pkt
;76100/17114
movb -(r4), @#17121 ;76102/114437 ;; Set parameter from table
;76104/17121
mov #17004, (r2)+ ;76106/12722 ;; Set response packet de-
;76110/17004 ;; scriptor: low 16 address
mov r5, (r2)+ ;76112/10522 ;; bits & PortOwn bit
mov #17104, (r2)+ ;76114/12722 ;; Set command packet de-
;76116/17104 ;; scriptor: low 16 address
mov r5, (r2) ;76120/10512 ;; bits & PortOwn bit
cmp -(r2),-(r2) ;76122/24242 ;; Point back to resp desc
tst (r1) ;76124/5711 ;; Poll controller to start
7$: tst (r2) ;76126/5712 ;; Wait for resp desc PO bit
bmi 7$ ;76130/100776 ;; => 0 == response received
tst @#17016 ;76132/5737 ;; Status byte = success (0)?
;76134/17016
beq 4$ ;76136/1742 ;; Yes, go to next command
stop: halt ;76140/0 ;; No, stop here...
; NOTE: This table MUST be - immediately preceeded by a zero byte (the HALT
; instruction) because it is the "end-of-table" marker; and immediately
; precede the Initialization Step Parameter table since a single register
; points first to the IStep Params (1 word each) and then to the commands
; (1 byte for the command, 1 byte for the parameter), passing through them
; in reverse.
.byte 2 ;; Set byte count to 1000 for OP.RD
.byte 41 ;; OP.RD = ReaD
.byte 0 ;; 0 parameter for OP.ONL
.byte 11 ;; OP.ONL = ON Line
;; .word 20402 ;76142/20402
;; .word 4400 ;76144/4400
.word 1 ;76146/1 ;; IS4: GO bit
.word 0 ;76150/0 ;; IS3: Ring base high address
.word 17204 ;76152/17204 ;; IS2: Ring base low address
.word 100000 ;76154/100000 ;; IS1: bits-
;; [15] = 1, [14] (WR) = 0, [13:11] (cmd ring
;; size) = 0, [10:8] (resp ring size) = 0, [7]
;; (IE) = 0, [6:0] (int vect/4) = 0 :: command
;; and response rings = 1 element, no inter-
;; rupts and no interrupt vector.
itabl =: . ;need pointer to end of table
;76000g to start ODT
.end stop ;For RT-11 only, don't "toggle" in