Esot's Analysis of Ziggurat29's Boot Disassembly... -- video initialization

A project log for OMNI 4 - a Kaypro 2x Logic Analyzer

A while back I acquired a rare logic-analyzer, whose lone system-diskette needed backing-up. Now this page is all things OMNI 4

Eric HertzEric Hertz 11/03/2017 at 07:330 Comments

Update 11-6-17-2: Notes on I/O addressing thrown at the bottom.

Updated 11-6-17: Revision with some new understanding...


Ziggurat29 has done some amazing work disassembling the OMNI4's Boot-ROM and OS(?!).

(Note that we've determined the motherboard is a pretty-much stock KayPro 2x, but it has a custom Boot-ROM and Character-ROM, both of which are available in the "Files" section of this project).

Herein, I'm gonna throw up some notes, as I read-through his work...

(Note that I currently have Zero experience with Z80 assembly-language, and am pretty slow with assembly-language in general, and am unfamiliar with the unit's registers/peripherals... So, this is a great learning-opportunity. Interestingly, this is the same approach I took in learning about the IBM PC/XT architecture, by looking at the BIOS Assembly-listings and schematics in order to determine how to initialize and make use of its peripherals.)

You might want to take a look at the KayPro Service Manual, which contains schematics of the KayPro 2x motherboard.


First interesting note...

The BootROM appears to launch right into external (to the Z80 chip) register-setup... Apparently not much configuration needs to be done within the Z80 CPU, itself.

There is a "system port" register at 0x14 consisting of quite-literally a byte's worth of TTL Flip-Flops whose outputs are fed to various peripherals, most-notably the Floppy-Controller, but also the Character-Generator ROM (and more?). Setting up the "system port" register is the second operation, the first being setting up the stack-pointer, and both are accomplished in only a small handful of instructions. Wild.

UPDATE: The system port (address 0x14), from the schematic:

D0 - /DRV_A              (Floppy)
D1 - /DRV_B /HD_CTRL_RST (Floppy)
D2 - /SIDE_ONE           (Floppy)
        (Parallel Printer Strobe)
D4 - /MTR_ON             (Floppy)
        (via inverter)
D5 - /DDEN               (Floppy)
        (Double-Density Enable)
D6 - A12CH (Write), [PBUSY (Read)]
        (Selects the character-set)
        (See notes in previous log)
D7 - BANK                (RAM vs ROM?)

(Side-Note: Appears that the parallel-printer port is output-only, and reading the written values is not possible... wouldn't take much modification to make it bidir... strap a '244 atop that '373, and some glue...)

Immediately thereafter, is the version-string "2.01", which gets loaded into RAM. This version-string appears on several screens... E.G. When the unit is turned on, as I recall, it says something like "Omni 4 version 2.01" and also, upon loading CP/M, something like "Omni 4 CP/M version 2.01". (TODO: verify... I thought we had CP/M 2.2..?)

It's interesting to me that these two things are in the Boot-ROM, as I'd've thought CP/M was loaded from the disk (and therefore its version would be dependent on that which was on the disk... like, e.g. DOS 3.3 vs. DOS 6... Or Windows XP vs. Windows 10).

(To-Ponder... The RAM is already being filled with data, including the version-string and the stack, at this point... More, surely, to come... But doesn't this system use DRAM? Doesn't it need refreshing? How about column vs. row-addressing? Is that *all* handled via dedicated circuitry?! (UPDATE: Looking at the schematic, it appears U29, a custom chip numbered 81-194, takes care of this. This chip appears to handle only interfacing with the DRAM and generating a few clock-signals, from 4.9KHz to 4MHz. As (Actually, it has a couple other outputs I'm working out). Ziggurat29 has pointed-out, this custom chip is a new thing as of the '84 versions of KayPro systems like the 2x, the prior versions used discrete logic, which I've yet to look into. Interesting that, at the time, designing and manufacturing a custom 40-pin chip is cheaper than just replacing the DRAM with a 64K SRAM). (An aside: I began looking at the Z80 timing charts, earlier, and noted that there's a "refresh" portion of *every* instruction-fetch bus-transaction... haven't wrapped my head around that one yet... UPDATE: Apparently the /REFRESH output on the Z80 is N/C... hmmmm.... more at the bottom).)


Next comes the bit I, personally, would be most-interested in attacking as quickly-as-possible, and here it is, being attacked as quickly-as-possible... initializing the video-system.

It appears to load 16 values to 16 registers in the video-controller IC... These values are hard-coded in the ROM... And the procedure for writing these registers appears to be to load address 0x1C with a register-select value (0x00-0x0f), then to load address 0x1D with the new value for the selected register... repeat 16 times.

Ziggurat29 notes that apparently register 0x1f is selected (but never loaded with a value?). This, apparently, is not a register on the video-controller IC... Not sure what it does... (Maybe it's a method to assure that should address 0x1D be written, later, it won't accidentally overwrite whatever last-register was selected?)

And, from there a handful of other operations, and... initialization of the video subsystem doesn't seem to be particularly-difficult. And, maybe more importantly, getting to the point of actually displaying a character on the screen is on the order of maybe 100 lines of assembly (maybe 20-50 lines of C code). Not bad, considering that's from the moment of power-up...

E.G. for the PC/XT, in my previous project, to display a character on the CGA card... Well, weeding out what was necessary to do-so from the BIOS listing was quite an ordeal... As I recall, there was easily 200 lines of (executed) assembly just to get to the point of initializing the CGA card, including things like setting up the DMA controller to refresh the DRAM, setting up the floppy controller, interrupts, and quite a bit more that technically aren't necessary for interaction with the video-card. Further, the PC/XT BIOS can handle several different types of video cards (including none), so a significant amount of the code determines (repeatedly!) which card is installed, and more. In the end, maybe it would've taken roughly the same amount of configuration (~100 lines of assembly) to get the PC/XT's video-card running, as the KayPro's, (if you know which card is installed).

(UPDATE: It appears that the Z80's /BUSRQ and /BUSACK pins are unused... No DMA here! This'll certainly make a brain-transplant easier)


Maybe this analysis seems like a strange approach... Well, what if you were writing your own custom ROM just for the sake of learning the system... Wouldn't the first thing you'd want to do be to make something blink? Here, the KayPro (or at least the OMNI4) BIOS apparently does exactly that as pretty much its first priority.

(In my PC/XT project, my goal was to replace the original 8088 chip with one I'm more familiar... an AVR, yahknow, basically an Arduino. That way, among other things, I could use my normal coding-habits to work with the PC/XT's motherboard/peripherals, rather than learning a new language (x86 assembly)... Here, it looks like substituting the Z80 CPU on a KayPro with, say, an AVR, and making use of the KayPro hardware may be *significantly* easier than on a IBM PC/XT... so may be a great learning-platform. (I never did get to interrupts or DMA on the PC/XT).

The big hurdle, still, will be making that AVR compatible with the Z80's bus... Doable, certainly.

(Oh, and, in no way is this suggesting to run the old KayPro's software on an AVR... this is about coming up with your own software to work with the hardware-level stuff... why? I dunno. But, yes, I'm willing to bet an AVR, cleverly-coded, could emulate a Z80, and possibly even execute instructions at roughly the same speed, maybe faster).


I got a bit side-tracked... And I'm stopping, here, with video-initialization, for now.

Please look at the *comments-sections* of the previous logs on this project... Ziggurat29 is apparently brilliant, but has a habit of posting what could be entire log-entries in the comments-sections of my otherwise bland log-entries. That is to say, you can learn a *lot* by scouring in deep dark recesses of this project-page for his comments!

Some highlights from the previous log's comments include a memory-map, and explanation of the interrupt-system. Also, apparently the BIOS ROM shares the same memory-space as the RAM, so when an application is loaded into RAM, the BIOS is effectively removed from the system (?!). Ziggurat29 goes into some detail as to how that may function. Also, it seems he's done quite a bit in disassembling higher-level things such as the operating-system, which I'm obviously a ways from analyzing.


A couple other notables upon browsing the schematics...

There appears to be a header for a light-pen. And apparently building one isn't too difficult. So... oy... I had one once, long before I knew how to program... and had no idea where to connect it on my old PC, so I never was able to use it, and managed losing it. But apparently they're pretty easy to make... and now I know a bit about programming... So an easy distraction to ponder. Though, I could do that just as easily with the PC/XT... and haven't yet. It's kinda curious, here, since this system doesn't do graphics (without some hackery).


The I/O ports are addressed with A2-7, leaving A0 and A1... not exactly unconnected, but almost. E.G. the "system port" D-latch chip is selected by 0x14, that's A4 and A2 high (the rest low). But, since the selection-circuitry doesn't make use of A0 and A1, I'm pretty certain the system port could just as easily be accessed at 0x15, 0x16, and 0x17, as well... The result would be the same.

At first this didn't make sense to me... wasting all those I/O addresses... But now I see, I think some other devices, themselves, make use of A0 (and possibly A1). E.G. the video-circuitry... So e.g. the video-chip's chip-enable is selected by A7-A2 = 0x1C, but then it's also selected when the address A7-A0 is 0x1C, 0x1D, 0x1E, and 0x1F. Its internal registers are chosen with A0/[A1], thus, we have different address-selections on the video card for 0x1C (register-select) and 0x1D (register-value). (Not sure, yet, whether it also makes use of A1 for other registers). Makes sense, and now that I've traced most of that out in the schematic seems totally obvious (haven't I seen the likes of this on other systems... for like... decades now?).

I guess the difference, here, is that the motherboard contains decoders for *all* the I/O devices (onboard, anyhow). Whereas, say, for a PC/XT, each ISA card has its own address-decoder circuitry... That's a lot of duplicate circuitry for a serial port, a parallel port, a floppy controller, a video-card, an RTC, etc. (I suppose why those multi-function cards became so popular, and eventually became a single chip).

Whereas on here, most of those devices are onboard, at fixed addresses, and therefore one set of address-decoder-chips (only two 3-to-8 demultiplexers) can select all those I/O devices.