PCW boot ROM disassembly
Jacob Nevins
including pulling out the contents of the 256-byte boot ROM.
Full details are at
<http://www.chiark.greenend.org.uk/~jacobn/cpm/pcwboot.html>.
This is for an 8000-series PCW; I believe the boot ROMs will differ
slightly on different models. The good news is that it probably isn't
actually necessary to use a scope to get the ROM contents, as they're
copied to RAM and left lying around when the boot sector from the
floppy runs, so a modified boot sector could save the ROM contents to
disc.
(This information is probably of interest to about three people.
Perhaps really pedantic emulator authors can make use of it.)
MikePcw
Hello Jacob,
The PCW is always surprising!
Good work!
Regards,
Miguel
John Elliott
: (This information is probably of interest to about three people.
: Perhaps really pedantic emulator authors can make use of it.)
I don't plan to put it in JOYCE, but the MESS authors might like to know
of this, since they seem to set some store by genuine original ROM dumps.
--
John Elliott
Prodatron / SymbiosiS
CU,
Prodatron
jba...@gmail.com
Thank you Jacob.
Kevin Thacker
> I recently used a scope to investigate the PCW's boot-up sequence,
> including pulling out the contents of the 256-byte boot ROM.
> (This information is probably of interest to about three people.
> Perhaps really pedantic emulator authors can make use of it.)
Good job!
Regards,
Kev
John Elliott
: I recently used a scope to investigate the PCW's boot-up sequence,
: including pulling out the contents of the 256-byte boot ROM.
I've finally got around to writing a custom boot sector that can display
the contents of the 256-byte boot loader. I've tested it on the only PCW I
have to hand (a 9512); the result is identical to the 8512 except for two
bytes.
If anyone wants to try this on other PCW models, the disc images can be
found at <http://www.seasip.info/Misc/bootdump.zip>.
The program will display a 16-bit CRC for the ROM. So far the ROM images
I've got are:
- 8512 from the disassembly on Jacob's site: CRC = 5EDC
- 9512 from my PCW: CRC = 4A75
So if your PCW comes out with one of these CRCs, there's a good chance
that its boot ROM is identical to one of the known ROMs.
--
John Elliott
Thinks: This is what a nice clean life leads to. Hmm, why did I ever lead one?
-- Bluebottle, in the Goon Show
Jacob Nevins
>Last year, Jacob Nevins <jac...@chiark.greenend.org.uk> wrote:
>: I recently used a scope to investigate the PCW's boot-up sequence,
>: including pulling out the contents of the 256-byte boot ROM.
>
> I've finally got around to writing a custom boot sector that can display
>the contents of the 256-byte boot loader.
Ooh, good show. I'm not set up to try this on a real PCW at the moment,
but I've stuck a link on the relevant web page.
Frank van Empel
<j...@seasip.demon.co.uk> wrote:
>Last year, Jacob Nevins <jac...@chiark.greenend.org.uk> wrote:
>: I recently used a scope to investigate the PCW's boot-up sequence,
>: including pulling out the contents of the 256-byte boot ROM.
>
> I've finally got around to writing a custom boot sector that can display
>the contents of the 256-byte boot loader. I've tested it on the only PCW I
>have to hand (a 9512); the result is identical to the 8512 except for two
>bytes.
>
> If anyone wants to try this on other PCW models, the disc images can be
>found at <http://www.seasip.info/Misc/bootdump.zip>.
>
> The program will display a 16-bit CRC for the ROM. So far the ROM images
>I've got are:
>
>- 8512 from the disassembly on Jacob's site: CRC = 5EDC
>- 9512 from my PCW: CRC = 4A75
>
> So if your PCW comes out with one of these CRCs, there's a good chance
>that its boot ROM is identical to one of the known ROMs.
>
>--
>John Elliott
>
I just downloaded the images and will look into it on Wednesday during
the club meeting of the JCC. I will probably try out a PcW 10 (my
personal favorite) and return the results later. I have access to the
full range and will dump the loaders of the other models later.
Guess it is not meant for the PcW 16 Anne?
Regards,
Frank van Empel
John Elliott
: I just downloaded the images and will look into it on Wednesday during
: the club meeting of the JCC. I will probably try out a PcW 10 (my
: personal favorite) and return the results later. I have access to the
: full range and will dump the loaders of the other models later.
: Guess it is not meant for the PcW 16 Anne?
Correct. There's a copy of the PCW16 boot ROM in PCW045.SYS on the rescue
diskette.
Frank van Empel
I am afraid that is am running into problems with DSKTRANS.EXE. All it
generates is an error file STDERR.TXT with the error:
"Identifying disc: Disc rejected by driver."
Which probably is because the source image is CF2 and my target a
real CF2DD disk (a 3.5" for use with a PcW 10)? Any tips would be
appreciated...
Regards,
Frank
jba...@gmail.com
Empel) wrote:
> On Mon, 12 May 2008 17:31:59 GMT, 0106277DELETET...@REMOVEkader.hcc.nl
I used cpcdiskxp ( http://www.cpcmania.com/cpcdiskxp/CPCDiskXP%20v1.6.zip
) for exactly the same task, it allows you to write a CF2 disk on a
3.5 720kb disk using a 1.44 drive, I don't know if the PCW10 will boot
with it, my PCW8512 does it (with a swichable A 3" 3 1/2" drive).
Regards, Javier
John Elliott
: generates is an error file STDERR.TXT with the error:
: "Identifying disc: Disc rejected by driver."
: Which probably is because the source image is CF2 and my target a
: real CF2DD disk (a 3.5" for use with a PcW 10)? Any tips would be
: appreciated...
Sounds like you're using libdsk under Windows. I don't know how well it
will cope with writing a CF2 image to a 3.5" floppy. If you've got Simon
Owen's floppy driver installed, then maybe
dsktrans -last 1 -otype ntwdm dump8.dsk A:
will work better.
Frank van Empel
<j...@seasip.demon.co.uk> wrote:
>Last year, Jacob Nevins <jac...@chiark.greenend.org.uk> wrote:
>: I recently used a scope to investigate the PCW's boot-up sequence,
>: including pulling out the contents of the 256-byte boot ROM.
>
> I've finally got around to writing a custom boot sector that can display
>the contents of the 256-byte boot loader. I've tested it on the only PCW I
>have to hand (a 9512); the result is identical to the 8512 except for two
>bytes.
>
> If anyone wants to try this on other PCW models, the disc images can be
>found at <http://www.seasip.info/Misc/bootdump.zip>.
>
> The program will display a 16-bit CRC for the ROM. So far the ROM images
>I've got are:
>
>- 8512 from the disassembly on Jacob's site: CRC = 5EDC
>- 9512 from my PCW: CRC = 4A75
>
> So if your PCW comes out with one of these CRCs, there's a good chance
>that its boot ROM is identical to one of the known ROMs.
>
Right, by now I have dumped the PcW10 loader (using both Javier's and
John's methods to get the image to CF2DD disk, thank you both for the
support) and found that it is 5EDC as well.
Although this is a non-binaries group I guess that listing this loader
will not freak out people. Below is the copy of the dump: a type-over.
Note that I did not verify the CRC-checks either (indeed John: I have
Windows, not Unix).
If you are interested I will also check the PcW 9256 and PcW 9512+
models.
Regards,
Frank
The listing of the Amstrad PcW 10:
0000 0E 00 01 F3 83 ED 41 0D
78 05 87 20 F8 31 F0 FF 370F
0010 3E 09 D3 F8 11 32 07 06
C8 DC B1 00 CD 84 00 1D EEFF
0020 F2 17 00 3E 80 D3 F7 0E
09 0C 79 D3 F8 06 21 CD 7CCB
0030 B1 00 CB 51 20 F1 15 20
F0 21 F5 FF 77 CB 7E 28 FBE4
0040 FC 3C D3 F8 1D 1D 3E 06
D3 F8 CD E4 00 09 66 00 5AD8
0050 00 00 01 02 01 2A FF 21
00 F0 DB 00 87 30 FB 87 5424
0060 F2 6B 00 ED A2 20 F3 7C
1F 38 EF 3E 05 D3 F8 CD 16DC
0070 C7 00 E6 CB C0 47 21 10
F0 24 86 25 86 2C 10 F9 D6C3
0080 3C 20 A0 E9 0E 80 CD DB
00 05 03 0F FF 07 00 CD 0BA6
0090 A5 00 06 C8 38 1B CD 44
00 CD 44 00 0E 00 CD DB D106
00A0 00 03 0F 00 14 CD BD 00
30 FB 17 3B F8 17 D8 06 BBFF
00B0 14 3E B3 E3 E3 E3 E3 3D
20 F9 10 F5 C9 DB F8 E6 1143
00C0 20 C8 CD E9 00 01 08 21
02 01 DB 00 87 30 FB 3A 1D9B
00D0 02 01 F0 ED A2 E3 E3 E3
E3 18 EF DB F8 E6 40 28 C0CE
00E0 FA 79 D3 F7 CD BD 00 3B
FB E3 46 23 E3 0E 01 E3 AB53
00F0 DB 00 87 30 FB FA FB 00
7E ED 79 23 E3 E3 E3 10 0446
0100 EE C9 00 00 00 01 00 01
02 00 FF 00 00 FF 00 FF DD31
John Elliott
: will not freak out people. Below is the copy of the dump: a type-over.
: Note that I did not verify the CRC-checks either (indeed John: I have
: Windows, not Unix).
You got a couple of bytes wrong, I think, because when I feed your typing
through my CRC utilities a couple of lines have different checksums from the
ones the boot image generated :-)
Anyway, assuming the obvious corrections (if I change the bytes at offsets
A9 and E5 from 3B to 38 the checksums match) that ends up identical to the
8512 boot image. I suspect, therefore, that there are only two boot images,
one for dot-matrix PCWs and one for daisywheel PCWs.
Frank van Empel
<j...@seasip.demon.co.uk> wrote:
>Frank van Empel <0106277D...@removekader.hcc.nl> wrote:
>: Although this is a non-binaries group I guess that listing this loader
>: will not freak out people. Below is the copy of the dump: a type-over.
>: Note that I did not verify the CRC-checks either (indeed John: I have
>: Windows, not Unix).
>
> You got a couple of bytes wrong, I think, because when I feed your typing
>through my CRC utilities a couple of lines have different checksums from the
>ones the boot image generated :-)
>
> Anyway, assuming the obvious corrections (if I change the bytes at offsets
>A9 and E5 from 3B to 38 the checksums match) that ends up identical to the
>8512 boot image. I suspect, therefore, that there are only two boot images,
>one for dot-matrix PCWs and one for daisywheel PCWs.
>
>--
>John Elliott
>
I took another look at the listing and take your word for it. I
suddenly remember why I preferred the PCW 8000's to the PCW/PcW
9000's...
I also can confirm your suspicion: I took the PcW 9512+ and PcW 9256
out for a test drive and they state, indeed, 4A75 and 5EDC
respectively.
Now, I guess (hope) you will not need a copy of the dumps itself...
Regards,
Frank
John Elliott
its own boot ROM) tricks the original boot ROM into disgorging its contents.
It starts thus:
xor a
ld r, a
ld bc, 80f3h ;Presumably having the top bit of B set
ld a, 3 ;here is significant.
out (c), a ;Select bank 3 for write
ld hl,0D080h ;Destination for original ROM image
ld de, 80h
ld bc, 0EDD3h ;All will become clear
loop: ld a,(de) ;Fetch byte from instruction stream
cp b ;Was the instruction ED? If so, it's an LDI
jp nz, not_ED
ld a,(de) ;Read second byte of LDI
ld a,(de) ;Read data byte
ld (hl),a
inc hl
ld a, l ;For some reason, the ROM goes to D080-FF
or a ;and D180-FF.
jp nz, loop
ld l, 80h
jp loop
;
not_ED: cp c ;Was the instruction D3? (OUT)
jp nz, loop
ld a,(de)
cp 0F8h ;Was it OUT (0F8h), A, i.e. end of boot?
jp nz, loop
xor a
ld bc,80F8h
out (c),a ;Mimic it.
;
; Hard drive boot sequence now continues...
;
John Elliott
controller. Here's the code that sends the boot image to the Z80:
X0192: mov r2,#6 ;Send 6 bytes
mov r3,#0beh ;from 0BEh
call X01ab ;(AF D3 F0 11 02 00)
mov r0,#0
X019a: mov a,#0edh ;Send ROM contents:
call X01b3
mov a,#0a0h ;ED A0 (LDI)
call X01b3
mov a,r0
movp3 a,@a ;Byte from ROM image (0300h-03FFh in
call X01b3 ;the controller ROM)
inc r0
djnz r2,X019a
mov r2,#5 ;Send 5 bytes from 0C4h
X01ab: mov a,r3
movp a,@a
call X01b3 ;(C3 00 00 D3 F8)
inc r3
djnz r2,X01ab
ret
;
X01b3: mov r1,#0 ;Write the byte in A to the Z80
movx @r1,a
mov a,#0ffh
anld p7,a
inc r1
X01ba: movx a,@r1
jb0 X01ba
ret
I can't make a lot of sense of the rest of it, because I don't speak 8041.
John Elliott
: AF XOR A ; OK
: D3F0 OUT (F0h),A ; Enable something?
: 110200 LD DE,0002h ; Where to dump the code
The write to port 0F0h pages the first 16k of physical memory in at
0000h-3FFFh.
: One assumes that the 256 bytes transferred are just enough code to read
: the boot information off the system floppy?
Yes. A couple of years ago, Jacob Nevins studied the boot sequence from
the Z80 end by using an oscilloscope to monitor the bus:
<http://www.chiark.greenend.org.uk/~jacobn/cpm/pcwboot.html>
I just thought it would be interesting to show what happens at the 8041
end as well.