GitHub - dnewcome/mmt8: Alesis MMT-8 firmware disassembly and simulation

Alesis MMT-8 Firmware Reverse Engineering

Disassembly and decompilation of the Alesis MMT-8 MIDI sequencer firmware (v1.11) for the purpose of understanding the implementation and porting to another platform.

Hardware

• CPU: 80C31 (8051 family, no internal ROM) @ 12 MHz crystal
• EPROM: U12 — 27C256 (32KB, 0x0000–0x7FFF)
• RAM: U10, U9 — two 61256 (32KB each, 64KB total external data RAM)
• Address Latch: U11 — HC573 (demuxes Port 0 address/data bus)
• Address Decoder: U5 — HC138 (3-to-8 chip selects)
• I/O Latches: U8, U6, U7 — HC574 (keyboard columns, LEDs, LCD)
• LCD: HD44780-compatible, 2-line, 8-bit mode
• MIDI: UART at 31.25 kbaud via Timer 1 auto-reload

Memory Map

XDATA Page Mapping (via P2 register)

The firmware uses P2 as a page selector for 256-byte pages in XDATA, accessed via MOVX @R0 / MOVX @R1:

Memory-Mapped I/O Ports (XDATA via HC138 decode)

Interrupt Vectors

Note: Bytes between interrupt vectors contain ASCII padding strings ("12345", "1234567") — likely a version signature.

SFR Configuration at Init

Firmware Architecture

The firmware is structured as a single main init + event loop in main_init_and_loop (0x00FB, ~1000 bytes). After hardware init and LCD setup, it enters a while(1) loop:

scan_keyboard()
process_midi_input()         // with register bank 2/3 context
process_midi_realtime_msgs() // external sync (clock/start/stop)
if playing:
    sequence_playback_engine()
    process_recording_realtime() or process_recording_step()
handle button events (play, stop, record, copy, delete, etc.)
update_display()

Key Subsystems

1. Timing Engine — Timer 0 ISR + EXT INT0 provide a 96 PPQN (pulses per quarter note) sequencer clock. Timer reload values in IRAM 0x7E/0x7F are computed from tempo BPM by configure_tempo_timer / compute_tempo_reload.

2. MIDI I/O — The Serial ISR uses 8051 register bank switching for zero-overhead context saves. Bank 2 manages the TX ring buffer, bank 3 manages RX. The P2 register (XDATA page select) is saved/restored via IRAM 0x5C.

3. Keyboard Scanner — scan_keyboard drives a 6-column matrix via IO_KEY_COLUMN_SEL (0xFF06), reads rows from P1. Debounces by rejecting multiple simultaneous keys. Edge-detection via XOR with previous state. Auto-repeat after 0x80 ticks, then every 0x14 ticks.

4. Sequencer Playback Engine — sequence_playback_engine (0x0AF5, 1513 bytes) is the largest and most critical function. It iterates through all 8 tracks, reads timestamped MIDI events from XDATA, and outputs events whose timestamps match the current position. MIDI event dispatch by status byte type:

   • < 0x7A: Note On/Off (0x90/0xB0 | channel)
   • = 0x7A: Program Change (0xC0)
   • = 0x7B: Channel Pressure (0xD0)
   • = 0x7C: Pitch Bend (0xE0)
   • = 0x7D: System Exclusive (0xF0)

5. Recording — Realtime (process_recording_realtime) and step (process_recording_step) modes. Incoming MIDI is timestamped with the clock counter and appended to sequence data in XDATA.

6. Song Mode — Chains parts into songs. get_song_step_data reads the song step table, handle_song_part_change manages transitions between parts.

7. LCD Display — HD44780 driver with separate screens for track mode (display_track_mode_screen) and song mode (display_song_mode_screen). Init sequence: 0x38 (8-bit/2-line), 0x06 (entry mode), 0x0E (display on), 0x01 (clear).

8. SysEx Dump — sysex_dump_engine (598 bytes) handles bulk MIDI SysEx data transfer for backup/restore of sequence data.

9. Self-Test — Boot diagnostic mode activated by holding specific buttons at power-on. Tests RAM read/write (selftest_ram_rw), MIDI loopback, and external interrupt lines. Halts with error message on failure.

Key IRAM Variables

Porting Considerations

Key 8051-specific idioms that will need adaptation:

1. P2 page register — The MOVX @R0 / MOVX @R1 instructions use P2 as the upper address byte to access 256-byte pages in XDATA. Replace with flat memory addressing (e.g., xdata[page * 256 + offset]).

2. Register bank switching — ISRs use RS0/RS1 bits in PSW to switch between register banks 0–3 for zero-overhead context saves. Replace with normal interrupt save/restore or dedicated ISR variables.

3. Bit-addressable variables — Flags like _c_0 through _f_7 are individual bits in the 8051's bit-addressable IRAM area (0x20–0x2F). Map these to bool variables or bitfield structs.

4. Timing recalibration — Timer reload values are computed for a 12 MHz / 12 = 1 MHz timer clock. The compute_tempo_reload function will need recalculation for a different clock source.

5. MIDI baud rate — 31.25 kbaud is generated by Timer 1 auto-reload with TH1=0xFF at 12 MHz. Use your platform's UART peripheral configured for 31250 baud.

6. undefined1 / undefined2 — These are Ghidra placeholder types for unresolved data types. Treat undefined1 as uint8_t and undefined2 as uint16_t (usually a CODE or XDATA address).

Generated Files

Reference Documents

Tools Used

• dis51 — 8051 hex file disassembler (initial disassembly with code flow analysis)
• Ghidra 12.0 — Headless analysis, decompilation, and annotation via Jython scripts
• objcopy — Binary to Intel HEX format conversion