TRS-80 DOS - NEWDOS/80 v2.0 for the Model III - BOOT/SYS Disassembled

BOOT PROCESS OVERVIEW

1. ROM Boot (Model III ROM at 34E0H):
   • ROM loads Track 0, Sector 1 to address 4300H
   • ROM jumps to 4300H to begin bootstrap execution
2. Bootstrap Initialization (4300H-430BH):
   • Disables interrupts
   • Sets up stack at 41E0H
   • Initializes buffer pointer to 51FFH
   • Preserves state in shadow registers (EXX)
3. Relocatable Block Loader (430EH-433EH):
   • Reads control byte from buffer
   • If control byte < 20H: Process load block
   • If control byte >= 20H: End of blocks, verify signature
   • For each block: reads count, destination address, and data
   • Copies data bytes to destination address
   • Repeats until end marker found
   • Verifies signature A5H
   • Jumps to DOS entry point
4. Buffer Management (4345H-43A0H):
   • Reads bytes from buffer at 5200H-52FFH
   • When buffer exhausted, loads next sector
   • Uses shadow registers (EXX) to maintain disk position
   • Implements sector read with FDC commands:
   • SEEK (1BH)
   • position head on track
   • READ SECTOR (88H)
   • read 256 bytes
   • Transfers data using INI instruction
   • Installs NMI handler for interrupt-driven completion
5. NMI Handler and Error Recovery (43A2H-43D5H):
   • Triggered when sector read completes
   • Checks FDC status for errors
   • Success: advances to next sector, handles track boundaries
   • Error: issues RESTORE (0BH) command, retries up to 10 times
   • Fatal error: displays error message and halts
6. Support Routines:
   • 43D7H: Wait for FDC not busy
   • 43E2H: Short timing delay
   • 43E8H: Error messages ("ERROR", "NO SYS")
7. Load Block Data (4407H-45FFH):
   • Relocatable block format with headers and data
   • Contains bootstrap code and DOS modules
   • Specifies destination addresses for each block
   • Simple copy operation, NO compression
8. Sector Padding (4600H-47FFH):
   • Filled with 5BH bytes (LD E,E)
   • Ensures 512-byte sector size

KEY FEATURES

• Relocatable block loader (NOT compression)
• Self-modifying (overwrites bootstrap with loaded code)
• Port-based FDC I/O (F0H-F4H)
• WD1793 controller support
• NMI interrupt handling
• 10-retry error recovery
• Track boundary management (18 sectors/track)

[LOAD BLOCK PROCESSING LOOP START] The following code processes relocatable load blocks from the buffer. Each block specifies where to copy data in memory. The format is: control byte, byte count, destination address (2 bytes), then data bytes.

[LOAD BLOCK HEADER PROCESSING] When the control byte is less than 20H, it indicates a valid load block follows. The loader reads the block descriptor: byte count and destination address.

[DATA COPY OPERATION] This section copies data bytes from the buffer to the destination address specified in the block header. The number of bytes to copy is in Register C.

[ALTERNATE BLOCK PROCESSING PATH] This section handles special block processing when the control byte indicates a different mode (when DJNZ at 431FH branches here).

[ERROR PATH - SIGNATURE VERIFICATION FAILED] If the signature verification fails, execution continues here to display an error message and halt the system.

[FDC PREPARATION AND SEEK OPERATION] The following code prepares the WD1793 Floppy Disk Controller for a sector read operation. The Model III uses port-based I/O to communicate with the FDC chip.

[NMI INTERRUPT HANDLER INSTALLATION] Before starting the critical sector read operation, the code installs a custom NMI (Non-Maskable Interrupt) handler. This ensures that if an interrupt occurs during the tight timing loop of the disk read, execution can be recovered properly.

[SECTOR READ COMMAND AND DATA TRANSFER] The following code issues a READ SECTOR command to the FDC and transfers the 256-byte sector data into memory at 5100H using a tight timing loop. The DRQ (Data Request) bit must be serviced quickly to avoid Lost Data errors.

[DRQ POLLING LOOP] This tight loop waits for the FDC to set the DRQ (Data Request) bit, indicating a byte is ready in the Data Register. The timing is critical - if the CPU doesn't read the byte within about 24 microseconds, a "Lost Data" error will occur and the sector read will fail.

[DATA TRANSFER LOOP] Once DRQ is set, this loop reads 256 bytes from the FDC Data Register into memory at 5100H. The INI instruction provides efficient I/O-to-memory transfers. The loop alternates between reading data and refreshing the drive select to maintain reliable operation.

[SUCCESS PATH - ADVANCE TO NEXT SECTOR] If the read completed successfully (no error bits set in the FDC status), advance to the next sector on the disk. This handles sequential reading of the boot loader data across multiple consecutive sectors.

[TRACK BOUNDARY CROSSING] When we've read all 18 sectors on the current track (sector numbers 0-17 or 1-18), we need to advance to track number and reset the sector number back to 0 or 1 for the beginning of the next track.

[ERROR RETRY LOGIC] This section handles read errors by performing a RESTORE operation (returning the head to track 0) and then retrying the read from the beginning. The Model III bootstrap allows up to 10 retry attempts (counter set at 4349H) before giving up.

[FATAL ERROR - ALL RETRIES EXHAUSTED] If we reach this point, all 10 retry attempts have failed to successfully read the sector. The code prepares to display an error message and enter an infinite loop, effectively halting the system. The user must power cycle or reset the computer.

[RELOCATABLE BLOCK LOADER FORMAT]

The loader at 430EH-433EH processes blocks in this format:

Block Structure:
1. Control Byte: If < 20H, it's a valid block; if ≥ 20H, end of blocks
2. Byte Count: Number of bytes in this block
3. Destination Low: Low byte of destination address
4. Destination High: High byte of destination address
5. Data Bytes: The actual code/data to copy to destination

The loader reads blocks sequentially from the 5100H-51FFH buffer,
copying each block's data to its specified destination address in RAM.
This continues until a control byte >= 20H is encountered, then the
loader verifies the signature byte A5H and transfers control to the
DOS entry point.

[DATA AT 4407H - ACTUAL BOOTSTRAP CODE]

Looking at the bytes at 4407H, we see they match the bootstrap code at 4300H+:

4407H: D9H = EXX instruction (same as 4307H)
4408H: 31H E0H 41H = LD SP,41E0H (same as 4308H-430AH)
440BH: 21H FFH 51H = LD HL,51FFH (same as 430BH-430DH)

This is the bootstrap loader code itself being stored in relocatable block format!
The data represents load blocks that will write the bootstrap code (and additional
DOS modules) to their proper locations in memory.

[HOW THE BLOCKS ARE PROCESSED]

[BUFFER MANAGEMENT]

The buffer at 5100H-51FFH is filled by reading sectors from disk.

At 4218H: LD HL,51FFH - Initialize buffer pointer
At 4345H: INC L - First increment makes L=00H, so HL=5200H
Wait, that would make it 5200H not 5100H...

Actually looking more carefully at the Model III code vs Model I:
- Model I: LD HL,51FFH makes buffer 5200H-52FFH (after first INC L)
- Model III: LD HL,51FFH at 430BH, same logic applies

So the Model III buffer is also 5200H-52FFH (256 bytes).

When the buffer is exhausted (L wraps to 00H), the page boundary
handler at 4348H loads another sector from disk into the buffer.

[SELF-LOADING BOOTSTRAP]

The bootstrap process:

1. ROM loads Track 0, Sector 1 (512 bytes) to 4300H
2. ROM jumps to 4303H (DI instruction)
3. Bootstrap initializes, sets up buffer pointer to 51FFH
4. Bootstrap begins processing load blocks from buffer
5. When buffer empties, page handler loads next sector from disk
6. Load blocks specify where to write code in memory
7. This includes rewriting the bootstrap area itself (4300H+)
8. Additional blocks load SYS0/SYS and other DOS modules
9. When control byte >= 20H found, verify signature A5H
10. Jump to DOS entry point

The bootstrap OVERWRITES ITSELF as it loads the DOS system!

The data continues with more bootstrap code bytes that will be copied to their destinations. The actual block headers (control byte, count, address) are interspersed with this data in the proper format.

The boot sector padding continues with 5BH bytes through to the end of the 512-byte sector at 47FFH. These padding bytes ensure the sector is the correct size. The 5BH byte (LD E,E) was chosen as it's a harmless instruction that loads E into itself - if execution accidentally reaches this area, the instructions do nothing harmful.