!lm10
!rm76
Commented Listing of DOS 3.3 Boot ROM

The P5A ROM on your Apple Disk II Controller has a 256-byte program in it which reads track 0 sector 0 into memory and starts executing it.

The data in track 0 sector 0 is read into memory from $0800-08FF.  Location $0800 contains a value indicating how many sectors to boot in.  This is usually zero, meaning to read only sector zero.  However, it could be as high as $0F, meaning to read all 16 sectors of track 0 into memory from $0800-17FF.  (The BASICS diskette uses this feature.)  Once the selected number of sectors has been read, the boot ROM jumps to $0801 to start execution.  At this point (in a normal DOS boot) the rest of DOS is loaded.

My listing starts at $C600, which is where it will be if your controller is in slot 6.  The code is all independent of position, so that it can be plugged into any slot.  In fact, you can move the code into RAM if you like, just so the second digit of the address is the same as the controller card slot number.  I do this some times when I am trying to crack locked disks.  I go to the monitor, type 8600<C600.C6FFM, and then patch a BRK opcode on top of the JMP $0801 at $86F8.  Then 8600G will read in track 0 sector 0 and BRK back to the monitor, and I can analyze the code to see how the rest is read in.

Enough of that, let's get into the code!  Lines 1510-1690 are an esoteric loop which generate the nybble conversion table.  The table is built in page 3, from $36C through $3D5.  I tried out the loop after storing FF bytes throughout page 3, and got this:

0368- FF FF FF FF 00 01 FF FF   03A0- FF 1B FF 1C 1D 1E FF FF
0370- 02 03 FF 04 05 06 FF FF   03A8- FF 1F FF FF 20 21 FF 22
0378- FF FF FF FF 07 08 FF FF   03B0- 23 24 25 26 27 28 FF FF
0380- FF 09 0A 0B 0C 0D FF FF   03B8- FF FF FF 29 2A 2B FF 2C
0388- 0E 0F 10 11 12 13 FF 14   03C0- 2D 2E 2F 30 31 32 FF FF
0390- 15 16 17 18 19 1A FF FF   03C8- 33 34 35 36 37 38 FF 39
0398- FF FF FF FF FF FF FF FF   03D0- 3A 3B 3C 3D 3E 3F FF FF


These bytes are referred to at lines 2670 and 2740, indexed from a base of $02D6.  This makes a disk code of $96 give a $00 value, and a code of $FF give a value of $3F.

Lines 1710-1790 determine the slot number and multiply it by 16.  The JSR MON.RTS is to an RTS instruction in the monitor ROM.  The only purpose of this JSR is to put its own address on the stack.  Then lines 1720 and 1730 lift up the high byte of the address from the stack.  The second digit of this address is the slot number, and 4 ASL's will isolate it and multiply it by 16.  Lines 1800-1830 select drive 0 and turn on the motor.  (If you want to boot from drive 2, you can copy this code into RAM at $8600 and change the byte at $8636 from $8A to $8B.)

Lines 1880-1990 move the head to track 0 from wherever it was.  If you were already at track 0, it just sits there making a racket as it bangs against the stop.  Lines 2030-2070 initialize the track and sector numbers and the memory address to read into.
!np
Lines 2090-2480 read a sector into the input area.  Lines 2110-2290 are used two different ways, depending on the CARRY status upon entry.  The first time CARRY is clear, and we look for an address header (D5 AA 96).  After finding an address header the sector and track are check in lines 2300-2480; if they are the ones we want, CARRY is set and we do lines 2110-2290 over again.  This time they look for a data header.  If one is found, it's time to read the data.

Lines 2530-2880 read in the sector.  First 86 bytes are read into a little buffer at the bottom of page 3 ($0300-0355).  Then 256 bytes are read into the target memory area (normally $0800-08FF).  A checksum is computed and checked; if it doesn't match, we start all over.  Lines 2770-2880 put the bits from $0300-0355 together with those in the main buffer, in the same way discussed two months ago in the listing of DOS 3.3 B800-BCFF.

Lines 2900-2950 check whether we have read all the sectors specified by the first byte of track 0 sector 0.  If not, loop back to read the next sector one page higher in memory.  When they have all been read, control branches to $0801.  The normal DOS boot only reads one sector before branching to $0801.
