TRS-80 Model 4 ROM - XDROM Diagnostic 1.1 Disassembled

XDROM Diagnostic 1.1

Other Navigation

3000H - Copyright Stamp and Unused Bytes

The Diagnostic's first 21 bytes are not code. The CPU reaches the Diagnostic through two jumps in ROM A, which stays at 0000H-1FFFH: the reset entry 0000H-0004H (DI / XOR A / JP 3015H) and the NMI entry 0066H (JP 3039H). Nothing jumps to 3000H-3014H, so the copyright stamp and the five zero bytes after it are never executed.

3015H - Cold Start: Stack, Clock, NMI Mask and Drive Number

After a reset ROM A runs DI / XOR A / JP 3015H (0000H-0004H), so the Diagnostic starts here with interrupts disabled. It never executes an EI, so maskable interrupts stay off for the whole program; the only interrupt it uses is the NMI the floppy disk controller raises at the end of a sector read (3609H, 3629H).

302BH - Program the CRT Controller for 64 x 16

The 16 bytes 33F8H-3407H are written to the CRT controller's registers R15 down to R0, so 33F8H holds R0 and 3407H holds R15. Port 88H selects the register, port 89H takes its value.

3039H - NMI Entry

ROM A's NMI entry 0066H holds JP 3039H, so a non-maskable interrupt comes here. The only NMI the Diagnostic enables is the one for the end of a sector read (port E4H = 80H at 3609H); its handler is at 3629H.

303CH - Video RAM Failure: Show Static RAM Bad and Stop

Reached from 304BH when 3C00H does not read back the space the clear at 3082H wrote. Register Pair DE still holds 3C00H, so the message goes to the top left of the screen, and the CPU halts with interrupts disabled until the machine is reset.

3045H - Check Video RAM, Show the Menu

The screen has just been filled with spaces. One byte, 3C00H, is read back; if it is not a space the video RAM (static RAM) is reported bad. Otherwise the banner and the menu are copied to the top four lines of the screen.

3057H - Scan the Keyboard for a Test Key

Polls three rows of the keyboard matrix until one of the six keys is down. The rows read 1 for a key that is down. D, M and the screen clear: Register Pair HL is loaded with the test's address and 3082H clears the screen and jumps there. B, V, P and S jump straight to their test.

3082H - Clear the Screen and Jump through HL

Fills the 1024 bytes of video RAM 3C00H-3FFFH with spaces, working in the alternate register set so that Register Pairs BC, DE and HL of the caller are kept, then jumps to the address in Register Pair HL. Callers: 3036H (HL = 3045H), 305FH (HL = 3322H) and the fall from 307FH (HL = 31C8H).

3092H - Message Text: Static RAM Bad, Banner and Menu

Text the Diagnostic copies to the screen with LDIR, by count, with no end byte: Static RAM Bad (14 bytes, 303CH) and the 225 bytes of banner and menu (304DH), laid out as lines of 64 characters, so 30A0H, 30E0H, 3120H and 3160H start the first four lines of the screen (3C00H, 3C40H, 3C80H, 3CC0H).

3181H - Video Test (V)

Selected with V. For each character in the list at 31C1H-31C6H the test fills both pages of video RAM with it (33D0H) and waits for the space bar, then sets the display to 80 x 24 (port 84H bit 2 and the CRT controller values at 31B7H-31C0H) and waits again, then puts the CRT controller back to its 64 x 16 values (33E9H). After the last character it starts again with the first. The pointer into the list is kept in the alternate register set while the helpers run. RESET ends the test.

31A3H - Wait for the Space Bar

Used by the video test between its steps. It waits until the space bar (bit 7 of keyboard row 3840H) is up, waits a fixed delay of 2560 DJNZ steps, then waits until the space bar is down and returns. Uses Register Pairs BC and HL and Register A.

31B7H - CRT Controller Values for 80 x 24

Ten values for the CRT controller registers R0-R9 that the video test writes with 33ECH (Register Pair HL = 31C0H, the routine writes R9 first and works down to R0 at 31B7H). The display has 80 characters a line and 24 lines of 10 scan lines. Data, not code.

31C1H - Fill Characters of the Video Test

The characters the video test fills the screen with, in order, ending with 00H, which sends the test back to the first one (3186H). Data, not code.

31C8H - Memory Test (M)

Selected with M; 3082H has cleared the screen and Register Pair DE is 0000H. All 64K of main RAM is tested, so the test keeps its stack (3FFEH), its pass counter (3C2FH) and its result block (3C30H-3C34H) in video RAM. Each pass tests the upper 32K (8000H-FFFFH) with the routine at 32B7H run from the ROM, then copies the routine to 8100H and runs the copy to test the lower 32K (0000H-7FFFH), which needs the ROMs switched out of the memory map. Passes repeat until an error is found; then the counts are shown and the CPU halts.

31D5H - One Pass: Count It, Test Both Halves

Adds one to the pass counter, shows it, tests 8000H-FFFFH from the ROM, then 0000H-7FFFH from the copy at 8100H. Index Register IX points at the five-byte result block that 32B7H clears and fills: +00H the number of wrong reads, +01H the number that were wrong again when read a second time, +02H-+03H the address of the last error (high byte first), +04H the data bits that were ever wrong.

3215H - Show the Error Counts and Halt

Reached when a half of RAM had an error; Index Register IX points at the result block at 3C30H. Line 2 of the screen (3C80H) gets the labels and three values: the number of wrong reads after Intr Errors= (3C8CH), the number that were wrong again after Hard Errors= (3C9CH) and the address of the last error at 3CADH-3CB0H, after Last Error @ and one blank column. Line 4 (3D00H) gets Failing Rows: and the number (7 down to 0) of every data bit that was ever wrong, a digit at every second column. The CPU then halts.

3261H - Memory Test Text

The text strings of the memory test, each ending with 00H for 345EH.

32B3H - Test 32K of RAM

The routine 31FEH copies to 8100H-8158H (89 bytes). The copy is entered at 8100H, the first two instructions, which switch the ROMs out (port 84H = 02H); the ROM itself enters it at 32B7H for the upper 32K. On entry Register Pair HL is the first byte of the 32K and Index Register IX the result block. For each of 255 rounds (Register B = FFH down to 01H) every byte of the 32K is written with a value that starts at the round number and goes up by one per byte, then the whole 32K is read back and compared. A wrong byte is recorded at 32EDH and the reading goes on. At the end port 84H is set back to 00H. All jumps in it are relative, so the copy runs at 8100H as it is: 32B7H is 8104H there, 32D6H is 8123H and 32EDH is 813AH.

32EDH - Record a Wrong Byte

Register A is the byte read, Register D the value written, Register Pair HL its address and Index Register IX the result block. The bits that differ are added to +04H, the wrong reads are counted in +00H (the test stops when that would pass FFH), the byte is read again and counted in +01H if it is still wrong, and its address is stored in +02H-+03H.

330CH - Show a Byte as Two Hexadecimal Digits

Writes Register A as two hexadecimal digits (0-9, A-F) at Register Pair HL and HL + 1, high digit first, and returns with Register Pair HL past them. Register D is used to keep the byte. Used by the memory test (31DEH, 322DH-3242H) and the disk test (3375H, 337BH).

3322H - Disk Test (D): Choose the Drive

Selected with D; 3082H has cleared the screen and Register Pair DE is 0000H. The labels Cylinder Sector Drive: go on the top line and the test waits for one of the keys 0-3, the drive to test. The drive is restored to track 0 (3453H); if that fails the error is shown and the CPU halts (3439H).

3344H - Disk Test: Step the Head Across the Disk

Reads one sector at each track: tracks 0 up to 39, then 39 down to 1, then pairs that close in from the two ends (0 and 39, 1 and 38, up to 38 and 1), then starts again, until RESET. Register B is the track and Register C the sector, which goes up by one on every read (00H-11H, 18 sectors) whatever the track. Index Register IY is the screen line that shows the track and sector being read; it moves down a line only after an error, so the lines above it keep the errors found.

3371H - Disk Test: Read One Sector and Show It

Shows the track (Register B) in columns 0-1 and the sector (Register C) in columns 10-11 of the line at Index Register IY, under Cylinder and Sector, then reads that sector into 4300H. After an error the message for its code goes in column 16 of the line, the drive is restored to track 0 and the line moves down one, or, on line 14 (3F80H), the lines above are moved up one instead. Register C then goes to the next sector (00H after 11H). Register B is kept.

33CEH - Fill Both Video Pages

Video RAM has two pages of 1024 bytes; port 84H bit 7 chooses the one the CPU sees at 3C00H-3FFFH. 33CEH fills both with spaces (the floppy boot 3426H, its error 343AH, the RS-232 boot 365EH and its error 36D5H); 33D0H fills both with the character in Register A (the video test, 318AH). Page 1 is filled first, then page 0, and port 84H is left at 00H: memory map 0, 64 x 16, page 0. 33E2H is the fill loop itself, also used by the disk test (33C3H). Uses Register Pairs AF', BC, DE and HL.

33E9H - Write the CRT Controller Registers R9 to R0

33E9H writes the 64 x 16 values 33F8H-3401H; 33ECH writes the ten bytes that end at Register Pair HL (the video test, 3197H, with HL = 31C0H for 80 x 24). The byte at Register Pair HL goes to R9, the one below it to R8, down to R0. Register B is changed by the OUTD.

33F8H - CRT Controller Values for 64 x 16

The values for registers R0-R15 of the CRT controller: 64 characters a line and 16 lines of 12 scan lines. The cold start writes all 16 (3024H-3030H, from 3407H down); 33E9H writes R0-R9 again after the video test's 80 x 24 step. Data, not code.

3408H - Printer Test (P)

Selected with P; the menu stays on the screen. Prints the characters 20H to 7FH and a carriage return, over and over, until RESET. Each character waits until the printer status port reports the printer ready.

3419H - Send a Character to the Printer

Waits until the printer status read from port F8H, bits 7-4, is 0011: not busy (bit 7 = 0), paper (bit 6 = 0), selected (bit 5 = 1) and no fault (bit 4 = 1). Then writes the character in Register A to port FAH, one of the ports F8H-FBH the printer latch answers to. Register A and the flags are kept on the stack while the status is read.

3426H - Boot from Floppy Disk Drive 0 (B)

Selected with B. Both video pages are cleared, drive 0 is restored to track 0 and sector 1 of track 0 is read into 4300H-43FFH in double density; if it is read without error the Diagnostic jumps to 4300H and leaves the program it has loaded to run. The drive number at 42FCH is the 00H stored at 3021H: the menu is reached only through a reset, and the disk test, the only code that changes 42FCH, never returns to it.

3439H - Show a Disk Error and Halt

Reached from the disk test (3341H) and the floppy boot (342CH, and after a failed read at 3436H) with the error code in Register A (00H-0BH). Both video pages are cleared, the message for the code (table 346AH) goes to the top left of the screen and the CPU halts. 344FH (DI / HALT) is also the end of the memory test (325EH).

3453H - Select the Drive and Restore It to Track 0

Selects the drive whose number is at 42FCH and restores it to track 0 (3546H with Register B = 04H). The error code comes back in Register A (00H with the Z FLAG set when there is none) and is also stored at 42FFH, which nothing reads. Register C is written to the controller's sector register on the way (354DH). Callers: the disk test (333EH, 339EH) and the floppy boot (3429H).

345EH - Put a Text on the Screen

Copies the text at Register Pair HL, up to the 00H that ends it, to the screen at Register Pair DE. Register D is ORed with 3CH first, so the callers can give the screen offset 0000H-03FFH (or the screen address itself). Returns with Register Pair HL at the 00H and Register Pair DE after the last character. Uses Register A.

346AH - Error Message Table and Disk Texts

Twelve two-byte addresses, low byte first, one for each error code 00H-0BH that the disk routine 3546H returns; 3385H and 343EH double the code to find the entry. The error texts and the other texts of the disk and RS-232 tests follow, each ending with 00H for 345EH. The texts Drive Not Available (3503H) and the RS-232 texts at 3482H and 3491H are not in the table.

3546H - Floppy Disk Routine: Select the Drive

The one routine of the Diagnostic that drives the WD1793 floppy disk controller (ports F0H-F3H) and the drive select latch (port F4H). Called with Register B = the operation (04H, restore the drive to track 0, from 3453H; 0CH, read a sector, from 3765H and 3767H), Register C = the sector, Register E = the track (read) and Register Pair HL = the buffer (read). It returns the error code in Register A (00H-0BH, see the table at 346AH) with the Z FLAG set when it is 00H. The drive number comes from 42FCH and is always selected in double density.

356AH - Restore the Drive to Track 0

Operation 04H. The controller steps the head out to track 0 and checks the track number there. 364AH returns early when the status shows not ready while the controller is still busy. When that status is exactly 81H (bit 5 ignored) the status read just before it, in Register C, chooses the code: 05H, 03H or 06H. Every other status, including an early return with more bits set, is turned into a code from 35C7H.

3585H - Return the Error Code

All the error exits of the disk routine come here with the code in Register D.

3588H - Operations of 05H and More

The read (0CH) goes on to 35AFH. The code from 358CH to 35AEH, for operation 32H, is never run: no caller passes 32H. It goes through drives 0-3 (select bits 01H-08H, single density) and restores, without a head load or a check, each drive whose status shows the head loaded.

35AFH - Seek to the Track

The read needs the head on the track in Register E. If the controller's track register already holds it nothing is done; otherwise a Seek (with the track checked) is issued, and a not ready, seek error or CRC error status ends the routine with its error code.

35C7H - Turn the Status into an Error Code

Entered at 35C7H after a restore or a seek (Register B = the status), and at 35CBH after a read. The bits are tested in turn and the first one set gives the code: lost data 0AH (read only), seek error or record not found 08H or 0BH, CRC error 07H, not ready 03H. When none is set the routine returns 00H with the Z FLAG set.

35E5H - Read the Sector

Sectors 00H-11H are on side 0; a sector of 12H or more would be read from side 1 as sector minus 12H (the callers pass only 00H-11H). The Read Sector command is issued with the NMI on the end of a command enabled. The first byte is waited for by polling; from then on the latch's wait state bit holds the CPU at each IN until the controller has the next byte, so the INI loop at 3623H takes the 256 bytes as fast as they come and never ends by itself: the controller's interrupt request at the end of the sector raises the NMI, which goes through 0066H and 3039H to 3629H.

3611H - Wait for the First Byte

Polls the status until the controller has the first byte (data request, bit 1) or the drive is not ready (bit 7).

3629H - NMI Handler: End of the Read

The NMI comes through ROM A 0066H (JP 3039H) and 3039H (JP 3629H) at the end of the command, with the address the CPU was at on the stack: in the INI loop after a full sector, or in the wait for the first byte (3611H-3621H) when the read ends without data, for instance with record not found. That address is dropped, the NMI mask is cleared, the status is read and the routine finishes with a RETN to its own next instruction, which ends the NMI for the CPU. The status is then turned into an error code at 35CBH.

363AH - Controller Helpers: Stop, Wait, Command

363AH stops any command of the controller (Force Interrupt D0H) and waits 256 DJNZ steps; 3643H waits 19 DJNZ steps; 364AH issues the command in Register A and waits until the controller is no longer busy or reports not ready. Register Pair BC is kept by the waits.

365CH - Boot from the RS-232 Port (S): Wait for the Host

Selected with S. Both video pages are cleared, the UART is set up and Host Not Ready is shown until bit 5 of the RS-232 status port E8H reads 0, then Host Is Ready. The UART is set for 8 data bits, odd parity and 1 stop bit; the baud rate is found at 3680H.

3680H - Find the Baud Rate

The host is to send the byte 55H over and over. The 16 rates of the baud rate port E9H are tried from FFH (19200 baud) down to 00H (50 baud), the same code in both halves of the byte; at each rate up to ten bytes are read, and a 55H then has to be followed by ten more 55H. When the rate is found, Found Baud Rate and a letter for it (A for 00H up to P for FFH) are shown on line 6. Bytes that arrive with an error count as bytes that are not 55H. There is no time limit: 36F1H waits for each byte.

36B1H - Load the Program and Run It

The letter of the rate goes after Found Baud Rate. Then bytes are read until an FFH arrives, Loading... is shown and sent, and the records that follow are loaded (3721H). When the transfer record has been read the program is run at its transfer address. A byte with an error at any point shows Load Error and a letter for the error, waits, and starts again at 3661H.

36F1H - RS-232 Helpers: Read a Byte, Send a Text

36F1H waits until the UART has a byte and returns it in Register A with the Z FLAG set, or, if it arrived with a parity, framing or overrun error, returns the error bits (status AND 38H) with the Z FLAG clear and leaves the byte unread. There is no time limit. 36FDH puts the text at Register Pair HL on the screen at Register Pair DE (345EH) and sends it to the host, each byte when the transmitter is empty, without the 00H that ends it.

3710H - RS-232 Text

The text 36ABH shows on line 6 and sends to the host when the baud rate has been found.

3721H - Load the Records

The program comes as records: a type byte, a length byte, then the bytes. Type 01H is a load record: the length is 2 more than the number of data bytes (a length of 02H means 256), then the load address (low byte first) and the data, stored from that address up. Type 02H is the transfer record: a length byte that is not used and the transfer address (low byte first), after which the routine returns with the Z FLAG set and the address in Register Pair HL. Any other type is skipped: a length byte and that many bytes (00H means 256). A byte with an error ends the routine with the NZ FLAG set.

3731H - Read an Address into HL

Reads two bytes, low byte first, into Register Pair HL. Used for the transfer address (from 372DH) and for the load address of a load record (3742H). The second byte's error is not tested here; the RET returns with its flags.

373BH - Load Record

Type 01H: the length byte, the load address and the data bytes, stored at the address and up.

3750H - Skip a Record

Any type other than 01H and 02H: the length byte, then that many bytes read and dropped. An error in the length byte is not tested; the error bits are then taken as the length.

375CH - Unused: Multiply by Adding

No instruction of the Diagnostic calls 375CH. It returns Register C times the count in Register A (the low byte of the product) in Register A, by adding Register C that many times; a count of 00H returns 00H at once.

3764H - Read a Sector into 4300H

Three entries into the disk routine 3546H with Register Pair HL = 4300H, the buffer, and Register B = 0CH, the read: 3765H for the disk test (3380H) and 3767H for the floppy boot (3433H), both with Register C = the sector and Register E = the track. 3764H, which would take the sector from Register A, is not used.

376FH - Unused Bytes to the End of the Diagnostic

The rest of the 2K, up to 37FFH, holds FFH, the value of EPROM bytes that were never programmed. Nothing jumps here or reads it.