Trying to dump Yamaha SKW-01

بواسطة mcolom

Champion (316)

09-01-2023, 10:21

theNestruo wrote:

No idea about what they do, though

Doesn't seem to be easy!

I've been looking at it this morning, and there are some interesting routines.
The one at 409A seems to read a value after configuring the address at 7FC8 and 7FC9:

Yamaha_read_addr:
	ld a,h			;409a
	ld (l7fc9h),a		;409b
	ld a,l			;409e
	ld (l7fc8h),a		;409f
	ld a,(l7fcah)		;40a
	ret			        ;40a5

Then there are some other parts of the code which are loops which read data from the device and copy to RAM, using that function:

l009eh:
	ld hl,(lf10ah)		;009e
	ld b,020h		;00a1
l00a3h:
	push bc			;00a3
	call Yamaha_read_addr		;00a4
	ld (de),a			;00a7
	inc de			;00a8
	inc hl			;00a9
	pop bc			;00aa
	djnz l00a3h		;00ab

Or this other function:

sub_099ch:
	push bc			;099c
	ld b,004h		;099d
	ld de,lf1b4h		;099f
l09a2h:
	call Yamaha_read_addr		;09a2
	ld (de),a			;09a5
	inc hl			;09a6
	inc de			;09a7
	djnz l09a2h		;09a8
	pop bc			;09aa
	ret			        ;09ab

My bet is that 7FC8 and 7FC9 are used to configure the reading address, and the other addresses are for other functions, hopefully not needed to read the contents, but who knows...

بواسطة cjs

Expert (106)

10-01-2023, 02:33

Well, you guys have done as much or more as I probably would have done. Good work!

So the 32K ROM is mapped to page 0 and 1 instead of pages 1 and 2? Interesting, but I suppose not unreasonable if there's a large pile of code that doesn't need the BIOS.

mcolom wrote:

I've been looking at it this morning, and there are some interesting routines.
The one at 409A seems to read a value after configuring the address at 7FC8 and 7FC9....

Using bits of a cartridge ROM address space for memory-mapped I/O seems to be a normal thing on MSX; external MSX-MUSIC carts do this as well. (The YM2413 registers are mapped to $7FF4 and $7FF5; if you want also to access them via the I/O address space at $7C and $7D, you need to write bit 1 = 1 to $7FF6.) It makes sense, since it helps avoid collisions in the (very limited) I/O address space.

The technique of writing an address to a latch to trigger a kanji ROM read and then reading the data from another latch is pretty standard; the Fujitsu FM-7 also did it this way. The ROMs tend to be large (128 KB in the FM-7 case) so this is easier overall than trying to bank switch them into the CPU's address space.

The routine at $009E reads $20 (32 decimal) bytes of data from the ROM; this is consistent with reading a 16×16 bitmap of a kanji glyph (2 bytes per row, 16 rows). Again, the FM-7 is the same, except that it is 16 bits wide, so you write a kanji ROM address to $FD20 and $FD21 and then read the left half of the row from $FD22 and the right half of the row from $FD23. This is convenient for the FM-7s bitmap display, but I'd bet that the MSX one is ordered differently: four 8×8 quadrants would be the natural organisation for placing the data into four entries in the VDP's pattern tables.

Quote:

...7FC8 and 7FC9 are used to configure the reading address, and the other addresses are for other functions, hopefully not needed to read the contents...

From the gist it appears that the 128 bytes from $7F80 to $7FFF are I/O address space. I'm betting that the I/O for the printer port is also in that range, and it's quite probable that some or many of these addresses are mirrors of each other just to reduce the amount of decoding logic.

(Sorry if I'm restating stuff that's totally obvious to people here; I'm not sure how familiar everybody is with these general techniques.)

بواسطة acet

Supporter (12)

10-01-2023, 02:58


7FC0 PORT0 ADDRESS L(WRITE) / STATUS(READ) bit0=1:ready to read,0:not ready
7FC1 PORT0 ADDRESS H(WRITE) / DATA(READ)

7FC2 PORT1 ADDRESS L(WRITE) / STATUS(READ) bit0=1:ready to read,0:not ready
7FC3 PORT1 ADDRESS H(WRITE) / DATA(READ)

7FC4 PORT2 ADDRESS L(WRITE) / STATUS(READ) bit0=1:ready to read,0:not ready
7FC5 PORT2 ADDRESS H(WRITE) / DATA(READ)

7FC6 PORT3 ADDRESS L(WRITE) / STATUS(READ) bit0=1:ready to read,0:not ready
7FC7 PORT3 ADDRESS H(WRITE) / DATA(READ)

7FC8 PORT4 ADDRESS L(WRITE)
7FC9 PORT4 ADDRESS H(WRITE)
7FCA PORT4 DATA(READ/WRITE)
7FCB PORT4 DATA(mirror)


PORT0 jis1 kanji?(1/2)
PORT1 jis1 kanji?(2/2)
PORT2 unused?
PORT3 unused?
PORT4 8000-87FF:SRAM?

READPORT0_3 equ 407Dh
READPORT0_3JMPTBL equ 7EE8h

READPORT4 equ 409Ah
READPORT4JMPTBL equ 7EEBh

WRITEPORT4 equ 40A6h
WRITEPORT4JMPTBL equ 7EEEh

بواسطة sdsnatcher73

Prophet (3955)

10-01-2023, 05:16

Okay, so could we modify KANJIROM.BAS so it will dump the kanji font rom? Then Manuel can work on implementing the module (ROM + kanji + SRAM at first).

On the photo of the board we see 2 ROMs, the MB83256 will be the font ROM but it seems small at 32kB. TC5517APL is the SRAM chip, 2kB.

بواسطة acet

Supporter (12)

10-01-2023, 06:05

7FCC LPT STATUS(READ) bit1=0:ready to write,1:not ready / LPT CONTROL(WRITE)  
7FCE LPT OUTPUT DATA(WRITE)

H.LPTO(FFB6) 7D89 and 7F21(JMPTBL)
1. write data to 7FCE
2. write FFh to 7FCC
3. write 00h to 7FCC

H.LPTS(FFBB) 7DB7 and 7F24(JMPTBL)
1.read status form 7FCC

بواسطة acet

Supporter (12)

11-01-2023, 07:43

Steps 2 and 3 were reversed.

H.LPTO(FFB6) 7D89 and 7F21(JMPTBL)
1. write data to 7FCE
2. write 00h to 7FCC
3. write FFh to 7FCC

بواسطة acet

Supporter (12)

11-01-2023, 13:15

dump tool
https://github.com/uniabis/msxrawl/tree/main/dumpskw1

PORT0 0000-7FFF:32KB jis1 kanji font(1/4),8000-FFFF:mirror
PORT1 0000-7FFF:32KB jis1 kanji font(2/4),8000-FFFF:mirror
PORT2 0000-7FFF:32KB jis1 kanji font(3/4),8000-FFFF:mirror
PORT3 0000-7FFF:32KB jis1 kanji font(4/4),8000-FFFF:mirror
PORT4 0000-7FFF:32KB EXTRA ROM,8000-87FF:2KB SRAM,8800-FFFF:SRAM mirror

بواسطة Manuel

Ascended (19468)

11-01-2023, 13:30

I created https://github.com/openMSX/openMSX/issues/1476 for possible openMSX support of this cartridge.

بواسطة mcolom

Champion (316)

11-01-2023, 13:55

acet wrote:

dump tool
https://github.com/uniabis/msxrawl/tree/main/dumpskw1

Wow, that was fast! :)

بواسطة cjs

Expert (106)

14-01-2023, 01:15

Just as a note in case anybody's trying to acquire one of these: the CX5F with this cart currently on Yahoo Auctions (id x1077905524, if you're using a proxy site) ending in about 13 hours has gone past my ¥3300 limit, so I won't be bidding further. (Though sdsnatcher73 still seems to be around with his, so it look like we still have his hardware available for testing and dumping.)