• Please review our updated Terms and Rules here

Model II Boot ROM Analysis

pski

Moderator
Staff member
Joined
Nov 26, 2014
Messages
1,910
Location
New York
Our discussion on another thread has encouraged me to dive into Model II boot ROM analysis.

There have been previous efforts in this area with very good results. Here are some examples:

http://www.vcfed.org/forum/showthread.php?30044-TRS-80-model-II-Roms
http://www.vcfed.org/forum/showthread.php?19188-TRS-80-Model-II-ROM-dump

The Model II boot rom is referred to as a shadow rom since it shadows the RAM from 0-2K. Once the boot process has completed, the ROM is replaced by RAM giving true 64K RAM available to the Z80 subsystem. You can read the Model II Technical Reference Manual, Page 19 or the Tandy 6000 Service Manual, Page 129, Section 2 for more details on how this works.

The boot rom on the Model II/16 CPU card is U11. It is a 2716 compatible 2k x 8 ROM. I’ve seen many different manufacturers, part numbers, etc. used in the MII.

M2-U11.jpg


On the Model 12/16B/6000 the boot rom is U54 and is the same type of chip.

M12-U54.jpg


I went ahead and grabbed my little TL866CS chip reader and pulled several of my Model II and M12 ROMS. So, far I’ve found 3 different versions and they match identically to the ones dumped and described in the the older threads. This is a good first step.

IMG_1713.jpgIMG_1714.jpg


One issue I see immediately is that the checksums derived by the chip readers do not match those computed by Tandy’s MEMII diagnostic tool and the ROMs themselves. MEMII is an indispensable testing tool and is available in the model2archive in either of the diagnostic disks. This is important to know because the Tandy documentation uses the MEMII checksums when referring to the different ROMs. So, my first job will be to match up the Tandy checksums with the reader checksums so that we will be able to definitively to know which ROM we have in our machines by simply running MEMII and without pulling chips.

Here are the steps I will be taking in my analysis that I will detail in this thread over time:

1. Match up Tandy checksums with reader checksums.

2. Burn new 2716 EPROMS with the TL866CS and test the different boot ROMS in various machines to make sure I can properly create new ROMs. The newer ROMS are supposed to be backwards compatible so I’d like to see if we can run the latest 6000 ROM in the earliest Model IIs. These are the EPROMS I will use.

3. Test the different ROMS with the following combinations of hardware to get a definitive idea of which ROM supports which hardware. I will test with TRSDOS II 4.2 first.
a. No HDA
b. Type 1 HDA with 8MB harddrive
c. Type 2 HDA with 8x300 controller
d. Type 2 HDA with WD1010 controller
e. Type 4 HD controller

4. Time for fun. Start hacking the ROMs to do interesting things like display custom boot messages and more!


I invite everyone here to join in and submit your observations or corrections.


 
During my analysis of my own ROMs, I came across an EPROM in a 16B board. It has a MEMII checksum of BFC0, which does not appear in Tech Bulletin II:33. I'm thinking it is a hacked ROM.

Does anyone know if Tandy ever used EPROMs for the boot rom chip?

EDIT: I just ran a diff on it and it is identical to the FC86 and has a reader checksum of FC86. So no hack, but still interesting that its an EPROM.
 
Here's what I have so far

TRS-80 Model II ROM Checksum Mappings

Tandy -> Reader

0A79 -> C8FF
4A6A -> 2BFF
88E2 -> 2119
C9AC -> 9733
BFC0 -> FC86

Have yet to find these:

432F ->
F42A ->
E996 ->
-> 1BBE

However, I suspect that

432F will only be found in very, very early Model IIs and were probably upgraded during service. There may be almost none of these out there.
F42A -> 1BBE
E996 or BFC0 -> FC86 (This one confuses me. There should be only 2 12/16B/6000 ROMS. The BFC0 is really throwing me.)
 
First M2 boot rom hack in MESS :)

Ir0UW7g.png
 
I'll point to Eric Smith's reversed source archive ( http://www.brouhaha.com/~eric/retrocomputing/radio_shack/trs80_model_ii/trs80m2boot.zip ) as a good place to start for customization. With zmac doing the assembly you could assemble the ROM directly to a .hex file that you can burn with the TL866CS.

Thanks, lowen. There are two reversed sources that I have. One is Eric Smith's trs80m2boot that you mentioned and the other one is F.J. Krann's (http://electrickery.xs4all.nl/comp/trs80m2/m2_cpu_roms.zip). Krann's assemble fine with zmac but are more difficult to work with compared to Eric's reversed assembly. However, Eric's don't assemble out of the box with zmac.

I've been playing with Krann's source but that code is very difficult to modify. It's definitely not a critique because I think he only disassembled it to understand how it works. Thanks a lot F.J. Krann! The code is extremely location dependent so adding new ops breaks everything.

I might try getting Eric's to work with zmac so that I can move forward with more robust hacking other than just replacing "INSERT DISKETTE".
 
Here's some past work referencing the boot code for the 6000:
https://groups.google.com/forum/#!topic/comp.sys.tandy/92xXqmz6aX0

just a script that could handle the boot sector on the 6000 xenix.

Nice find. It's interesting that this post mentions the 3.2 development system. Someone, somewhere must have a copy of this. AFAIK, the best we have right now is the 3.0 dev system, right?

Also, he mentions hacking z80ctl. That's also another future project. :)
 
Nice find. It's interesting that this post mentions the 3.2 development system. Someone, somewhere must have a copy of this. AFAIK, the best we have right now is the 3.0 dev system, right?

Also, he mentions hacking z80ctl. That's also another future project. :)
I have never seen the 3.2 dev system. I'm the one that posted the 3.0 dev system originally.
Back when I purchased the dev sys there wasn't one for 3.2 even though that was what I was running.
 
Last edited:
For those who want to take a crack at it, I've found 2 versions of z80ctl in the directions to use a model 2000 keyboard on a 6000. One is for using the keyboard (z80ctl) and one I think is used with the unreleased 4 port serial cards (I have 4 of them).

Here they are.
 

Attachments

Pete

Bit of thread archeology.

Given my Model 16A issued with DREM occurs when the HDC tried to boot a hard disk image but works when using diagnostic software booted from a floppy you indicate that the ROM is switched out.

Therefore could my CRC error on first read issue be ROM version issues where the type 4 board boot isn’t supported by the ROM image ?
 
Can you pull the CPU card out of your 16 and see if there is a label on the ROM? Some are labeled with a number that contains the checksum.

I run C9AC (9733) in my M16A and and it is likely the latest official BootROM.

If you have an eprom writer the binary for that ROM is here: https://github.com/pski/trs-xenix/tree/master/bootroms/pskiroms I use 28c16 (cat28c16a) eeproms in my machines without issue.
 
Ran the test, ROM reports back a checksum of F42A

Pete, I note this isn't on you're list of ROM's so when i pull it, i'll grab a copy and send it over.

I've no 2716's in stock at the moment, just 2732's and 27128's, so i'll have to order some, and thanks for the note that you're using 28c16's fine.

Steve
 
I've no 2716's in stock at the moment, just 2732's and 27128's...

Hi Steve,

You can usually get away doubling up your 2716 image and burning it into a 2732. The 2716 has vpp where the 2732 has address line A11, but it just means only one "half" of the 2732 will be accessed.

Steve
 
Ah good call, although I've ordered a couple from ebay.

I'll see if i can fix the video chain issues on my model 1 while i wait ;) The 74LS11's for that arrived yesteday.
 
Ran the test, ROM reports back a checksum of F42A

Steve

That's definitely an issue for you, Steve. F42A only supports the older 8x300 controller found in the 8MB, 5MB and 12MB drives. See Model II Tech Bulletin II:33.
 
Anecdotal but when I attempted to use my 16A with its stock boot rom (88E2) it acted like no HD interface was installed and presented the "INSERT DISK" message rather than a BOOT ERROR HC. After replacing the rom with C9AC (9733) it booted from HD without issue.
 
Thanks both, encouraging.

Given the DREM works when the shadow rom is paged out, and im in diagnostics, its certainly looking positive.
 
Back
Top