Image Map Image Map
Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Getting Tandy 1000HX Dos-in-Rom to work on a Tandy 1000A

  1. #1
    Join Date
    Oct 2016
    Location
    Oregon, USA
    Posts
    220

    Default Getting Tandy 1000HX Dos-in-Rom to work on a Tandy 1000A

    Arguably there's better ways of doing this (xt-ide-cf, diskonchip, etc), but I wanted to see if I could get the actual Tandy 1000 DOS-In-ROM to work on a Tandy 1000A that didn't include it.

    DOS-in-ROM on a HX is stored in two places:
    0xE0000: (64KB) this looks like part of a virtual filesystem. No option rom signature, just data.
    0xF0000: (32KB) there is a bios option block here.

    Looking at the option block:

    Code:
    ; 0xF000:0x0000
    ; bios extension signature
    db 55
    db aa
    ; extension is 512 bytes long
    db 1
    ; jump to start
    jmp 0x102:
    
    ; 0xF000:0x0102
    PUSH AX,
    PUSH DX
    PUSH ES
    CLI
    XOR AX, AX
    MOV DS, AX
    ; Load ES:AX with a far pointer at 0000:004C
    LES AX,[004C]
    ; Store the far pointer that was originally in 0000:004C into 0000:04B8
    MOV [04B8], AX
    MOV [04BA], ES
    ; Store far pointer CS:0030 into 0000:004C
    ; This is int 13h - storage devices
    MOV WORD PTR [004C], 0030
    MOV [004E], CS
    ; Store far pointer CS:00DD into 0000:0060
    ; This is int 18h - ROM Basic
    MOV WORD PTR [0060], 00DD
    MOV [0062], CS
    STI
    POP ES
    POP DS
    POP AX
    RETF
    So I burned this to a ROM, stuck the relevant parts at 0xE0000 and 0xF0000, verified with DEBUG that my ROM is where I think it is, and rebooted.

    No Change. It executes the original int 18h handler, which is to ask the user to insert a disk.

    After boot, looking at 0:4C and 0:60 the interrupt vectors still point to the BIOS at 0xF8000, not into the option ROM at 0xF0000. The memory address at 0:4B8 where the option ROM would have saved the original int13h vector is empty. So it looks like the option ROM never executed.

    Can anyone see where I'm going wrong here? Taking the ROMs out of a 1000HX and plopping them into a 1000A (minus the F8000 part which remains original) should have worked, shouldn't it?

  2. #2
    Join Date
    May 2011
    Location
    Outer Mongolia
    Posts
    2,403

    Default

    Going through a dump of the HX's ROM it looks to me like stuff related to the virtual drive extends all the way to nearly FC000, it doesn't stop at F8000. The Phoenix ROM BIOS messages start at the FC000; only a few hundred bytes lower down you can see the data for the disk menu the HX displays and various user prompts/error messages/etc.

    I don't have an original 1000/1000A but I do have an EX, which also uses a "1.x" BIOS instead of the HX's 2.0. The other day I was actually spelunking around with peeks and pokes over the F000 mark because I was curious if it might be possible to land an option ROM at F000 since the schematic for the EX says it only accommodates a 32kbyte ROM, and here's what I discovered: the ROM in an EX at least is actually only 16k. It looks like there's a pull-up on A14, because the same 16k of code appears at both F4000 and FC000; the other two 16k sections at F0000 and F8000 are just full of garbage. Unfortunately more looking at the manual convinced me it's probably a bad idea to try to put a ROM there, at least one that's hanging off the bus and not replacing the original in its socket, because the PAL equations for chip select say that the on-motherboard buffer in front of the ROM chip and the ROM chip itself is selected with this formula:

    romcs = memr & !refresh & a19 & a18 & a17 & a16;

    IE, Tandy decoded the entire top 64k for a 32k socket with a 16k chip in it, which is why I see those two shadows of the code at F4000 and FC000. I'm kind of wondering now about putting the code I want along with a copy of the Tandy BIOS into a 32k EPROM and replacing the onboard BIOS, but I'm not sure if it would cause problems if the XTIDE BIOS showed up at both F0000 and F8000...

    Anyway, I just downloaded a ROM dump of version 01.01.00, which appears to be the version from the Tandy 1000A, and, interestingly, the unzipped file is 64k in length and the contents look just like what I saw on the EX, two 16k blocks of code interleaved with two 16k blanks. If that was actually dumped from a real 1000A then it looks like its ROM decoding might be similarly messy. The service manual for the original 1000 seems to *imply* that ROMCS has a higher resolution because it lists address lines all the way down to A13, but the A has a different motherboard, doesn't it?
    My Retro-computing YouTube Channel (updates... eventually?): Paleozoic PCs

  3. #3
    Join Date
    Aug 2006
    Location
    Chicagoland, Illinois, USA
    Posts
    6,546
    Blog Entries
    1

    Default

    Quote Originally Posted by smbaker View Post
    Can anyone see where I'm going wrong here? Taking the ROMs out of a 1000HX and plopping them into a 1000A (minus the F8000 part which remains original) should have worked, shouldn't it?
    The boot process starts at F000:FFF0 and is certainly going to JMP somewhere inside the original ROM which isn't going to know anything about the new code. Were I doing this, I would have completely replaced all of the Tandy 1000a ROM data with the HX ROM data. They're similar machines under the hood, and I feel this has a high likelyhood of working.

    If it doesn't work, you'll need to trace the HX ROM's startup to see where it's going (this is the JMP at the end of the ROM), and then alter the 1000A's startup to go to the same place.
    Offering a bounty for:
    - A working Sanyo MBC-775, Olivetti M24, or Logabax 1600
    - Music Construction Set, IBM Music Feature edition (has red sticker on front stating IBM Music Feature)

  4. #4
    Join Date
    May 2011
    Location
    Outer Mongolia
    Posts
    2,403

    Default

    Quote Originally Posted by Trixter View Post
    The boot process starts at F000:FFF0 and is certainly going to JMP somewhere inside the original ROM which isn't going to know anything about the new code. Were I doing this, I would have completely replaced all of the Tandy 1000a ROM data with the HX ROM data. They're similar machines under the hood, and I feel this has a high likelyhood of working.
    I remember at some point someone here tried testing a Tandy 1000A ROM in an EX and it "worked", at least well enough to POST, so apparently the extremely minor differences between the "Big Blue" ASIC machines and the discrete models don't trip up going forward. (Although it didn't do everything right, like it only recognized 128k of RAM.) The only major issues I think you might run into if you went the other way from an HX to an earlier machine are:

    1: The HX has a 256k of video-owned RAM, not 128k. No idea if that's a dealbreaker. According to the Tandy 1000 FAQ the SX (128k) and EX (256k) use the same "version" of the Tandy BIOS, but I don't know if they actually use a binary identical version of it that sniffs out what box it's in, or two differently configured ones that take the differences into account. If the BIOS from the HX hard-assumes 256k of video RAM that'll probably cause problems.

    2: Maybe something will freak out if the NVRAM chip the HX stores its Easter Eggs in is missing.

    I do have a question about the 32k of ROM that was mapped starting at F0000: did you confirm with debug that *everything* was kosher there? The dump I have of the 1000A BIOS which, again, is a 64k overdump of a 16k ROM, has FF's from F0000-F3FFF (and F8000-FBFFF) and a copy of the code from FC000-FFFFF at F4000-F7FFF. If the ROM decoding of the 1000A is the same as described in the EX's manual, which this dump implies, then the first 16k of an option ROM you hung off an expansion slot might be fine, but the second 16k would probably be arm-wrestling with the contents of the built-in ROM. Is that duplication of FC000 at F4000 actually present?
    My Retro-computing YouTube Channel (updates... eventually?): Paleozoic PCs

  5. #5
    Join Date
    Mar 2011
    Location
    Atlanta, GA, USA
    Posts
    1,593

    Default

    I had disassembled, annotated and dumped the ROM code and the FAT12 file system from the HX ROM before. You can find more details starting here in this thread:

    http://www.vcfed.org/forum/showthrea...978#post361978

    The HX ROM portion that implements the disk functionality is entirely located from F0000 to FC000. The first 512 bytes is the option BIOS code (like any other adapter ROM) with a 47.5K bootable FAT12 image that follows.

    I've added disk-in-rom routines to the jr-ide's new option bios. I can clean them up and post them, but there is a lot of clutter in how the page frame window is panned inside a larger 498KB ROM disk and how the disk parameter table is currently setup for the constructed fictional hard disk; it may make things confusing but it does work. There are a few action items remaining around boot disk order and some other LBA/CHS translation issue for the IDE side being the only hold up for release. But I think I can push the work in progress to the public side of my repo.

    My code to programaticly construct bootable FAT12 dos-in-rom image in a simple C utility is already on my repo.
    "Good engineers keep thick authoritative books on their shelf. Not for their own reference, but to throw at people who ask stupid questions; hoping a small fragment of knowledge will osmotically transfer with each cranial impact." - Me

  6. #6
    Join Date
    Oct 2016
    Location
    Oregon, USA
    Posts
    220

    Default

    Played with it tonight a bit more. If I move my ROM from F0000 to D0000, the bios extension loads, and it attempts to start DOS 2.11. I see the line of text output from command.com and then it hangs. If I put the BIOS extension at F0000, it is not executed. I don't get this ... I'm looking at the disassembly of the 1000A BIOS and it clearly checks for BIOS option ROM signatures all the way up to F4000. So it should see the one at F0000 and execute it. I can verify with debug that the BIOS is there.

    I will look around at F4000 and F8000 and see if it's empty or if the ROM is duplicated. If it is duplicated then I'll need to move the ROM somewhere else. If it's actually interfering with F0000 in some way then that might explain why it's not being detected. I took a casual look at it to verify the 0x55AA signature is there and looked at the code that's executed. I didn't verify the whole 512 bytes to ensure the checksum is correct.

    Anyhow, back to the D0000 experiment. It does find the extension there and almost works. My problem may be that I only enabled 32K of the ROM. Sounds like I need to enable 48K worth of it and try again.

    So if F0000 - FC000 contains the DOS-in-ROM, what does the HX have in the E0000 ROM?

    ETA: Without my ROM board installed, F0000 decodes to all FF, F4000 decodes to a shadow copy of the BIOS. F8000 decodes to all FF.

    Scott
    Last edited by smbaker; May 28th, 2020 at 09:09 PM.

  7. #7
    Join Date
    Oct 2016
    Location
    Oregon, USA
    Posts
    220

    Default

    Yay! I have a frankentandy. Picture is attached! Enabled the whole 48K and left the ROM sitting at D0000.

    I'm assuming the E0000 ROM must be for the personal deskmate option.

    frankentandy.JPG

  8. #8
    Join Date
    Mar 2011
    Location
    Atlanta, GA, USA
    Posts
    1,593

    Default

    Quote Originally Posted by smbaker View Post
    Yay! I have a frankentandy. Picture is attached! Enabled the whole 48K and left the ROM sitting at D0000.

    I'm assuming the E0000 ROM must be for the personal deskmate option.
    I explained all this in the thread I linked above.... sigh.
    "Good engineers keep thick authoritative books on their shelf. Not for their own reference, but to throw at people who ask stupid questions; hoping a small fragment of knowledge will osmotically transfer with each cranial impact." - Me

  9. #9
    Join Date
    Oct 2016
    Location
    Oregon, USA
    Posts
    220

    Default

    Quote Originally Posted by eeguru View Post
    I explained all this in the thread I linked above.... sigh.
    Sorry, read the post but didn't realize the link covered the E0000 ROM.

  10. #10
    Join Date
    Mar 2016
    Location
    Georgia, USA
    Posts
    623

    Default

    That's pretty nifty, dos-in-rom on 1000a successfully (apparantly?)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •