







                              4P Boot ROM Disassembled
                              -- ---- --- ------------

                                   by Adam Rubin




               If you use a TRS-80 Model 4P, or even if you don't, you've

       probably heard about its mysterious inhabitant known as the bootstrap

       read-only memory, usually called the boot ROM.  When you start up

       your computer, how can it read the Disk Operating System (DOS) into

       memory, when it can't yet use the DOS to do this?  That's what the

       boot ROM is for.  Contained in it is the program your computer runs

       when it's turned on, or when the RESET switch is pressed.  This

       little program sets up the computer's hardware, and reads the first

       sector ("boot sector") of the DOS from the disk.  In that sector,

       there's a short program to read in more of the DOS, and that program

       reads in still more of the DOS, and eventually we arrive at the "DOS

       Ready" prompt.


               The 14K of ROM in the Models III, 4, and 4D contains cassette

       BASIC and its operating system, and a short routine to boot from a

       floppy disk.  The boot ROM in the 4P is only 4K, but as it doesn't

       have ROM BASIC, there's enough room for routines to allow the 4P to

       boot from several different devices, and a short memory test as well.


               When the 4P is booted, various keys can be pressed to force a

       particular boot method:  from the hard disk, the floppy disk, a Model

       III boot (loading the ROM image if it's not already there), or from

       the RS-232 port.  If no keys are pressed, it first tries to boot from









        4P Boot ROM Disassembled                                      Page 2



       the ARCNET board, then from the hard disk, floppy disk, and Model III

       boot, in that order.  (Although the 4P is able to boot directly from

       the hard disk, I gather Radio Shack never asked Logical Systems,

       Inc., author of the Radio Shack hard disk drivers, to include this

       capability.)


               The RS-232 and (non-existent) ARCNET boot methods are not

       very well known.  The RS-232 boot feature is presumably for Radio

       Shack's Network III system, which connects up to 16 non-disk student

       stations to the host (teacher's) system over the RS-232 port.  Since

       Network III runs in the Model III mode, the RS-232 boot would allow

       the 4P to be used as a student station without using the 4P's disk

       drives at all.


               The ARCNET boot feature, for Datapoint's local area network,

       is even more obscure.  If no keys are pressed when the 4P is booted,

       it first looks for an ARCNET board ("Resource Interface Module").  If

       that's not found, the other methods above are tried.  If the board is

       found, however, the message "Arcnet Boot Is Not Available" is

       displayed, as a special boot ROM is required for ARCNET.  Although

       ARCNET was available for other Radio Shack computers, I believe the

       4P version was never even announced.



                           A Word About the Documentation
                           ------------------------------


               The official documentation for the Model 4P boot ROM is in

       the 4P Service Manual.  This, and other volumes useful in under-

       standing the boot ROM, are listed at the end of this introduction.









        4P Boot ROM Disassembled                                      Page 3



               The "Theory of Operation" section from the 4P Service Manual

       is reprinted in the "Model 4/4P Technical Reference Manual", and if

       you have either of those books I'd recommend reading the description

       of the boot ROM in "Theory of Operation" before studying the dis-

       assembly.  It's a reasonably thorough description of what's involved,

       and I've only found two inaccuracies worth mentioning.  First, the

       flowchart is not strictly correct, although it does convey the gener-

       al idea of what's going on.  Second, the description of the keyboard

       scanner omitted the <V> key from "Function Group."  Holding the <V>

       key down during the keyboard scan will display the boot ROM version

       number on the screen.  Also, note that the only documented addresses

       in the boot ROM are the five RST vectors and seven RAM locations

       explicitly documented in this section.



                             The Beginning of the Boot
                             -------------------------


               Since the focus here is the disassembly itself, this intro-

       duction isn't intended to be a tutorial, and some familiarity with

       Z80 assembly language, the 4P's hardware design, and the controllers

       for the peripherals is assumed.


               Nevertheless, a few comments may be helpful.  When the Model

       4P is first powered up, or when the reset switch is pressed, the 4P

       is set to the Model III memory map and video display, the boot ROM is

       switched in, and execution starts at address 0000H in the boot ROM.


               When the DOS's BOOT command is used, some of this work must

       be done by the DOS instead.  DOS 6.x must first set the hardware to









        4P Boot ROM Disassembled                                      Page 4



       the Model III configuration.  Both 5.x and 6.x then jump to location

       0000H.  In the Model III ROM image for the 4P, and in TRSDOS 6.1.1

       and later, the instructions through address 0004H switch in the boot

       ROM, and when the Z80 gets around to reading the instruction from

       address 0005H, the boot ROM has been switched into place.  For this

       reason, the boot ROM was intentionally written to have no code of

       importance until address 0005H.



                               Notes on the Hardware
                               ---------------------


               When the hardware is in memory mode 0 or 1, an output to port

       9CH switches the boot ROM into (if bit 0 is set) or out of (bit 0

       reset) the address space from 0000H to 0FFFH.  Note that if the hard-

       ware is in mode 1 with the boot ROM in, any accesses to memory from

       0000H to 0FFFH are read from the boot ROM, but written into RAM.

       This allows the 4P to execute the program in the ROM while it loads

       the Model III ROM image file into RAM at the same address space.


               The Winchester Disk Controller (WDC) operates somewhat

       differently from the Floppy Disk Controller (FDC).  While the FDC

       supplies the data to the CPU one byte at a time (and invokes an NMI

       when it's done), the WDC reads an entire sector into an internal

       buffer, and sets any error flags.  The entire sector can then be

       transferred to the CPU (and from there to memory) with one block

       input instruction.


               The CRT controller (CRTC) used in the Models 4, 4P, and 4D is

       called a 68045 in Radio Shack's documentation, although the spec









        4P Boot ROM Disassembled                                      Page 5



       sheet reprinted in the 4/4P Technical Reference Manual is for the

       Motorola MC6835.  The similar MC6845 CRTC, used in many other

       computers, has 16 programmable registers, but the 6835 has two sets

       of values for registers R0-R11 permanently programmed in.  Here, of

       course, they are the values for the Model III and Model 4 display

       formats.


               Although the only registers that can be changed in the 6835

       are R12 through R15, the boot ROM initializes registers R1 through

       R15.  (The 6845 does have R0, which seems to have been forgotten both

       here and in the Model 4 ROM.)  The table contains all zeros, which

       don't matter for R1 through R11, and are the appropriate values for

       R12 through R15.


               Incidentally, the special characters available in the 4P (and

       used in the error messages) are not necessarily the same ones avail-

       able in a Model 4, as two different character generator ROMs have

       been used.  The first, I believe, is found in early Model 4s, and the

       special characters 0 to 31 of the that set are shown in older DOS

       manuals and both Technical Reference Manuals.  The newer characters

       are in newer Model 4s and all 4Ps, and are shown in the manual for

       TRSDOS 6.2.0.


               In the comments for the disassembly, the floppy drives are

       numbered 0 through 3, to correspond to the drive select lines.  The

       only portion of any hard drive accessed is the first head of the

       first drive, designated in the controller's specifications as drive

       1, head 0.










        4P Boot ROM Disassembled                                      Page 6



                              Comments on the Comments
                              ------------------------


               To determine whether the Model III ROM image needs to be

       loaded, the boot ROM looks for a call to page zero (CALL 00xxH) in

       the disk's boot sector.  Nearly all Model III disks use one or more

       of the ROM routines there, and that tells the 4P it's a Model III

       disk.  (Versions of TRSDOS 6 produced before the 4P was available

       also CALLed addresses in page zero, as the Model 4's Model III ROMs

       were accessible at that point.  That's why the <N> key needs to be

       used when booting TRSDOS 6.1.0 and earlier.)  If the boot sector

       happens to be 512 bytes in length, the boot ROM assumes it's a Model

       III disk, regardless of the contents of the boot sector.


               The mysterious 'fdiv', found in several locations in the boot

       ROM (and other programs by Tandy), turns out to be the initials of

       the author of the boot ROM, Frank Durda IV, of Tandy Corporation.  If

       you look closely, you'll also find his name hidden in the error

       phrases.



                                Problems and Changes
                                --------------------


               Since the boot ROM can't be changed as easily as, say, the

       operating system, it's important that it work correctly.  The only

       problems I've noticed are relatively minor.  The omission of CRTC

       register R0 was covered above.  The only evident problem occurs in

       the memory test routine.  A 'LD A,D' instruction was inadvertently

       omitted (see disassembly comments), which results in the value

       displayed for 'Mask' appearing to cycle only up to 0FH, instead of








        4P Boot ROM Disassembled                                      Page 7



       0FFH.  The value actually used, however, is maintained correctly, and

       goes up to 0FFH before starting again at 00H.  If any problems with

       memory occur during this test, the 'Mask' value displayed in the

       on-screen table should be correct.


               The vast majority of 4Ps I've seen have boot ROM version

       1(16), dated 18-Oct-83.  The early machines, however, have version

       1(15), dated 11-Oct-83.  (I'm not aware of any other versions, but

       would be interested in hearing about them.)  The only difference

       between these is the message displayed (and transmitted) while the

       RS-232 boot is receiving the file, from 'Loading ROM Image' in the

       older version to merely 'Loading' in the newer.  I'm not familiar

       enough with Network III to know why this was changed; perhaps it had

       to do with the software for the host station.  Whichever of those two

       ROM versions you have, the instructions in ROMFILES/TXT explain how

       to match the comments with your disassembly.
































        4P Boot ROM Disassembled                                      Page 8





                                 Sources Consulted
                                 -----------------

       The following books are recommended for additional information:

               "TRS-80 Model 4P/4P Gate Array Service Manual" (Radio Shack
       part number MS-260-1080), for a description of the hardware and boot
       ROM of the 4P.

               "TRS-80 Model 4/4P Technical Reference Manual" (Radio Shack
       catalog number 26-2119), for reprints of the spec sheets for the
       Motorola MC6835 CRT Controller and other ICs used in the 4 and 4P,
       and the "Theory of Operation" sections from the 4P Service Manual.

               "June, 1984 Storage Management Products Handbook" (Western
       Digital Corporation), for the spec sheets and application notes for
       the FD179X-02 Floppy Disk Formatter/Controller Family, the WD1773
       5.25" Floppy Disk Controller/Formatter, and the WD1010-00, WD1010-05,
       and WD1000-05 Winchester Disk Controllers.

               "Programming the Z80", by Rodnay Zaks (Sybex), for an
       explanation of the Z80 microprocessor and timing of its instructions.


       Other items of possible interest include:

               "TRS-80 Model 4 Technical Reference Manual" (Radio Shack
       catalog number 26-2110, out of print), for the bit assignments of the
       ports used by the RS-232 circuit.

               "Introduction to your Disk System:  TRS-80 Model 4P" (Radio
       Shack), for a description of some of the keys used when booting
       (Appendix A), and an explanation of the boot ROM's error messages
       (Appendix B).

               "ARCNET:  Design and Implementation of a Local Network", in
       the Proceedings of IEEE Infocom 83, for a description of the ARCNET
       local area network.

               Motorola MC6845 CRTC spec sheet, for comparison with their
       MC6835.



       Radio Shack, TRS-80, and TRSDOS are registered trademarks of Tandy
       Corporation.
       LS-DOS is a trademark of Logical Systems, Inc.
       ARCNET is a trademark of Datapoint Corporation.
       Z80 is a registered trademark of Zilog, Inc.









