In previous post we show the Panasonic VW-KT300 and its internals. We saw that it have a Yamaha V9958 videochip and a Z80 compatible CPU, but we still couldn't say it's a hidden MSX: there is a lot of machines that shares the same CPU and VDP of MSX1 and aren't MSXs, this could be the case here (but with MSX2+ components). So, there is a need to look the ROM contents to see if this video titler follows the MSX architecture and not only makes use of MSX's related LSIs.
 |
| The FS-VA1 ROM placement have the "Program ROM" label on PCB |
Tabajara did read the ROM identified as FS-VA1 and sent to me the output file. Running "strings" on this ROM file, we didn't found any of the MSX character strings: no "Microsoft", nor "MSX", not even a "Copyright" notice. That file wasn't an MSX BIOS, but I still did need to determine what it was and how it works. How this ROM program drives the video titler hardware.
The VW-KT300 "BIOS"
The ROM dump had 256KB, as the Z80 have a 64KB address space, usually the disassemblers processes files with 64KB maximum size. So, the first thing that I did was to split the original 256KB file in many 16KB chunks. That size choice wasn't a technical one, it was more related with my bias towards MSX architecture, so I guessed that the MSX page size would be a good size to split the file. The next steps proved that, this time, I did a good choice :)
I ran "hexdump" on the first chunk and got this (removed spaces so it can fit on screen):
00000000 c3e0400000000000 0000000000000000 |Ãà@.............| 00000010 4544495430000000 0000000000000000 |EDIT0...........|
Hey, there is something different here. A label. I did the same in the other files and I found many labels. Some of the 16KB blocks didn't have any label, but most have. And one of them have a MSX cartridge header!
00000000 414232404d400000 0000000000000000 |AB2@M@..........| 00000010 0000000000000000 0000000000000000 |................|
After checked the labels in all 16 files, I made this map of the original ROM (the "size" is calculated with the distance to the next label):
00000000 |EDIT0...........| 16KB 00004000 |EDIT1...........| 16KB 00008000 |EDIT2...........| 32KB 00010000 |SYSTEM1.........| 16KB 00014000 |VA1DATA.........| 16KB 00018000 |AB2@M@..........| 32KB 00020000 |DESIGN..........| 32KB 00028000 |DEMO............| 32KB 00030000 |SYSTEM0.........| 16KB 00034000 |SAMPLE0.........| 16KB 00038000 |SAMPLE1.........| 32KB
A place with SYSTEM0 label seems to be a very promising place to begin the disassembler. And, indeed, it was a nice place to begin, the first bytes are:
l0000h:
di ;0000 f3 .
jp l0134h ;0001 c3 34 01 . 4 .
So, first the interrupts are disabled and the next step is a jump to address 0134h. And what is in 0134h?
l0134h:
in a,(0f4h) ;0134 db f4
and 080h ;0136 e6 80
jr z,l0153h ;0138 28 19
Hey! This is a check of bit 7 from port F4h! The MSX2+ BIOS check this bit to see if it was the boot was cold or warm. Following this code we have:
ld a,000h ;013a 3e 00
out (0ffh),a ;013c d3 ff
ld a,001h ;013e 3e 01
out (0feh),a ;0140 d3 fe
ld a,002h ;0142 3e 02
out (0fdh),a ;0144 d3 fd
ld a,003h ;0146 3e 03
out (0fch),a ;0148 d3 fc
Ports FCh, FDh, FEh and FFh are the ports to control the Memory Mapper in MSX. And if we still had doubts about the VW-KT300 architecture, the next code ends with them. It sets the slot map:
ld a,0fch ;014a 3e fc
out (0a8h),a ;014c d3 a8
ld a,000h ;014e 3e 00
ld (0ffffh),a ;0150 32 ff ff
There is nothing more MSX than those page-slot-subslot mapping.
The code that we read until now does: if it's a cold boot, initialize the memory mapper registers, activate page 0 on slot 0 and pages 1, 2, 3 in slot 3.0. The disassembled code follows the boot sequence and shows the PSG and VDP initialization, the filling of system variables in page 3 with the expected values, etc.
With this information, we can say the Panasonic VW-KT300 is a MSX compatible machine with a very customized BIOS. Tabajara confirmed that assumption using the Expert 1.3 ROM (MSX1 + Mapper initialization) and we can see the results on this video:
As we saw in the video, the boot runs OK and we end with the MSX-BASIC prompt on screen.
While the confirmation of this machine being MSX compatible is good news, it raises some questions about why it was built this way. We have good signs that this machine was designed and released in 1989/1990.
 |
| You can see the "MADE IN JAPAN - 1989" silk on PCB. And in FS-VA1 ROM the year of "1990" |
All the last MSX models from Panasonic (FS-A1FM, FS-A1FX, FS-A1WX, FS-A1WSX, FS-A1ST and FS-A1GT) uses versions of Toshiba T9769 MSX-Engine, which integrates the PSG, PPI, Mapper, glue logic and a high speed Z80. Why not use it in VW-KT300?
The inside machine looks like a mishmash of stuff that Matsushita had lying in their warehouse (the reused ROMs talks a story here). But, at same time, the VW-KT300 doesn't use the common platform of all last MSX models from Panasonic: it uses a Z80B from Zilog with a custom gate array instead of the T9769, and have a full rewritten BIOS! Why not follows the Sony's path and uses the MSX BIOS and the titler software over it?
Well, continuing our journey to understand this machine's BIOS, next step was to find the slot layout to boot this machine in MSX2+ mode :). First we modified the CBIOS to include a small subroutine to look each page in each slot and show the contents of the first bytes on screen. We got that chart:
PAGE0 PAGE1 PAGE2 PAGE3
SLOT0 SYSTEM0 SAMPLE0 -
SLOT1 - - -
SLOT2 - - -
SLOT3.0 RAM RAM RAM RAM
SLOT3.1 SAMPLE1 DEMO -
SLOT3.2 - - -
SLOT3.3 EDIT0 EDIT0 EDIT0
Probably I did something wrong in my page switching code and the test hangs when reading data from PAGE3. Well, at least, with the chart we rebuild the EPROM with the ROMs from A1FX, the BIOS+BASIC in place of SYSTEM0 and SAMPLE0, MSX2+ SUBROM instead of SAMPLE1 and KANJI-ROM Driver where we have DEMO in original ROM.
And... that new ROM doesn't works :(
The layout of SLOT3.3, with all pages mapped to EDIT0, is a clue that there is a custom mapper that needs to be configured somehow. No ideas here. Need to go back to disassembler to search for exotic code, like the one that begins in 0221h which sends some data to switching ports (comments and label names by me):
CMP_PORT45_DATA:
ld hl,STRING1 ;0221 21 7e 06 Set pointer
; to STRING1 (067e)
ld c,000h ;0224 0e 00
RDPORT45_START:
ld a,010h ;0226 3e 10 10h ->
; 0001 0000b -> 16d
out (043h),a ;0228 d3 43 Switched port 43
xor a ;022a af 00h ->
; 0000 0000b -> 00d
out (044h),a ;022b d3 44 Switched port 44
ld a,030h ;022d 3e 30 30h ->
; 0011 0000b -> 48d
out (045h),a ;022f d3 45 Switched port 45
ld b,(hl) ;0231 46 Read how many bytes
xor a ;0232 af needs to be read
; from port 45
cp b ;0233 b8
jr z,l0258h ;0234 28 22 If EOF (00)
After this ports configuration, it reads N bytes from port 45, comparing it with two strings: 'MOUF1' and FFhFFh'GOT48'. I didn't found those strings in main ROM, maybe that read from port 45 reads one of the Kanji-ROMs or the dictionary?
Then the things got even weirder, this is what we have in 0258h:
l0258h:
ld a,000h ;0258 3e 00
ld (0ed00h),a ;025a 32 00 ed
ld h,040h ;025d 26 40
;
ld (0ed03h),hl ;025f 22 03 ed
ld a,0a0h ;0262 3e a0
ld (0ed01h),a ;0264 32 01 ed
CHPAGES_TOSLOT3:
ld a,(0ed01h) ;0267 3a 01 ed
cp 0a0h ;026a fe a0
jp c,CHPAGES01_SLOT3 ;026c da d8 02
inc a ;026f 3c
ld (0ed02h),a ;0270 32 02 ed
ld a,(0ee2fh) ;0273 3a 2f ee
and a ;0276 a7
jr z,CHPAGES12_SLOT3 ;0277 28 08
ld a,(0ed01h) ;0279 3a 01 ed
cp 0c0h ;027c fe c0
jp nc,CHPAGES01_SLOT3 ;027e d2 d8 02
CHPAGES12_SLOT3:
call PAGE12SLOTBLOCK ;0281 cd 69 0b
These jumps and subroutine calls shuffles the ROM's pages between the frames and subslots of SLOT3, writing in not usual memory locations inside these subroutines. After the initial shuffle, the BIOS reads the N bytes from 4010h and compares with some strings:
CMP_BLOCK_HEADERS:
ld hl,STRING3 ;0284 21 8d 06
ld ix,0edf4h ;0287 dd 21 f4 ed
RDHEADER_START:
ld de,04010h ;028b 11 10 40
ld b,(hl) ;028e 46 Read how many
; characters
xor a ;028f af
cp b ;0290 b8
jr nz,l029dh ;0291 20 0a If NOT EOF (00)
ld a,(0ed01h) ;0293 3a 01 ed
inc a ;0296 3c
inc a ;0297 3c
ld (0ed01h),a ;0298 32 01 ed
jr CHPAGES_TOSLOT3 ;029b 18 ca
The character strings to be compared are SYSTEM0, SYSTEM1, VA1DATA, EDIT0, EDIT1, EDIT2, EDIT3, SAMPLE0, SAMPLE1, SAMPLE2, SAMPLE3, SAMPLE4, SAMPLE5, SAMPLE6, SAMPLE7, SAMPLE8, SAMPLE9, DEMO, DESIGN, AUTOSTART and SCENARIO. Some of those strings are the labels that we found in the ROM blocks. And others... are from the IC Card? The SRAM? From other equipment?
Just below the labels, there are a few more strings that doesn't seem to be used by or called anywhere in the code:
ASOH HIRONAKA NAKATA HAYASHI FURUKI
My guess is that these are the names of creators of this machine and BIOS.
At the end, this code to scramble and reallocate the pages left me very confused. After many attempts, I threw in the towel and stopped my efforts to understand what is happening in this code. If you want to try to continue, the tarball with all the ROMs (the full dump and split in blocks) can be downloaded from here, you can also download SYSTEM0 already disassembled and partially commented by me. Maybe it helps.
I hope someone can understand this page mapping code. It would be nice to boot this machine in MSX2+ mode and read games from the IC Card :D
No comments:
Post a Comment