Monday, June 13, 2016

Panasonic Video Titler VW-KT300 - part 2

In previous post we show the Panasonic VW-KT300 and its internals. We saw that it have a Yamaha V9958 videochip and a Z80 compatible CPU, but we still couldn't say it's a hidden MSX: there is a lot of machines that shares the same CPU and VDP of MSX1 and aren't MSXs, this could be the case here (but with MSX2+ components). So, there is a need to look the ROM contents to see if this video titler follows the MSX architecture and not only makes use of MSX's related LSIs.

The FS-VA1 ROM placement have the
"Program ROM" label on PCB

Tabajara did read the ROM identified as FS-VA1 and sent to me the output file. Running "strings" on this ROM file, we didn't found any of the MSX character strings: no "Microsoft", nor "MSX", not even a "Copyright" notice. That file wasn't an MSX BIOS, but I still did need to determine what it was and how it works. How this ROM program drives the video titler hardware.

The VW-KT300 "BIOS"

The ROM dump had 256KB, as the Z80 have a 64KB address space, usually the disassemblers processes files with 64KB maximum size. So, the first thing that I did was to split the original 256KB file in many 16KB chunks. That size choice wasn't a technical one, it was more related with my bias towards MSX architecture, so I guessed that the MSX page size would be a good size to split the file. The next steps proved that, this time,  I did a good choice :)

I ran "hexdump" on the first chunk and got this (removed spaces so it can fit on screen):

00000000 c3e0400000000000 0000000000000000 |Ãà@.............|
00000010 4544495430000000 0000000000000000 |EDIT0...........|

Hey, there is something different here. A label. I did the same in the other files and I found many labels. Some of the 16KB blocks didn't have any label, but most have. And one of them have a MSX cartridge header!

00000000 414232404d400000 0000000000000000 |AB2@M@..........|
00000010 0000000000000000 0000000000000000 |................|

After checked the labels in all 16 files, I made this map of the original ROM (the "size" is calculated with the distance to the next label):

00000000  |EDIT0...........| 16KB
00004000  |EDIT1...........| 16KB
00008000  |EDIT2...........| 32KB

00010000  |SYSTEM1.........| 16KB
00014000  |VA1DATA.........| 16KB
00018000  |AB2@M@..........| 32KB

00020000  |DESIGN..........| 32KB
00028000  |DEMO............| 32KB

00030000  |SYSTEM0.........| 16KB
00034000  |SAMPLE0.........| 16KB
00038000  |SAMPLE1.........| 32KB

A place with SYSTEM0 label seems to be a very promising place to begin the disassembler. And, indeed, it was a nice place to begin, the first bytes are:

        di            ;0000   f3              .
        jp l0134h     ;0001   c3 34 01        . 4 .

So, first the interrupts are disabled and the next step is a jump to address 0134h. And what is in 0134h?

        in a,(0f4h)   ;0134   db f4  
        and 080h      ;0136   e6 80
        jr z,l0153h   ;0138   28 19 

Hey! This is a check of bit 7 from port F4h! The MSX2+ BIOS check this bit to see if it was the boot was cold or warm. Following this code we have:

        ld a,000h     ;013a   3e 00       
        out (0ffh),a  ;013c   d3 ff  
        ld a,001h     ;013e   3e 01  
        out (0feh),a  ;0140   d3 fe  
        ld a,002h     ;0142   3e 02  
        out (0fdh),a  ;0144   d3 fd  
        ld a,003h     ;0146   3e 03  
        out (0fch),a  ;0148   d3 fc

Ports FCh, FDh, FEh and FFh are the ports to control the Memory Mapper in MSX. And if we still had doubts about the VW-KT300 architecture, the next code ends with them. It sets the slot map:

        ld a,0fch     ;014a   3e fc  
        out (0a8h),a  ;014c   d3 a8
        ld a,000h     ;014e   3e 00
        ld (0ffffh),a ;0150   32 ff

There is nothing more MSX than those page-slot-subslot mapping.

The code that we read until now does: if it's a cold boot, initialize the memory mapper registers, activate page 0 on slot 0 and pages 1, 2, 3 in slot 3.0. The disassembled code follows the boot sequence and shows the PSG and VDP initialization, the filling of system variables in page 3 with the expected values, etc.

With this information, we can say the Panasonic VW-KT300 is a MSX compatible machine with a very customized BIOS. Tabajara confirmed that assumption using the Expert 1.3 ROM (MSX1 + Mapper initialization) and we can see the results on this video:

As we saw in the video, the boot runs OK and we end with the MSX-BASIC prompt on screen.

While the confirmation of this machine being MSX compatible is good news, it raises some questions about why it was built this way. We have good signs that this machine was designed and released in 1989/1990.

You can see the "MADE IN JAPAN - 1989" silk on PCB.
And in FS-VA1 ROM the year of "1990"

All the last MSX models from Panasonic (FS-A1FM, FS-A1FX, FS-A1WX, FS-A1WSX, FS-A1ST and FS-A1GT) uses versions of Toshiba T9769 MSX-Engine, which integrates the PSG, PPI, Mapper, glue logic and a high speed Z80. Why not use it in VW-KT300?

The inside machine looks like a mishmash of stuff that Matsushita had lying in their warehouse (the reused ROMs talks a story here). But, at same time, the VW-KT300 doesn't use the common platform of all last MSX models from Panasonic: it uses a Z80B from Zilog with a custom gate array instead of the T9769, and have a full rewritten BIOS! Why not follows the Sony's path and uses the MSX BIOS and the titler software over it?

Well, continuing our journey to understand this machine's BIOS, next step was to find the slot layout to boot this machine in MSX2+ mode :). First we modified the CBIOS to include a small subroutine to look each page in each slot and show the contents of the first bytes on screen. We got that chart:

        PAGE0   PAGE1   PAGE2   PAGE3
SLOT1   -       -       -
SLOT2   -       -       -
SLOT3.0 RAM     RAM     RAM     RAM
SLOT3.2 -       -       -

Probably I did something wrong in my page switching code and the test hangs when reading data from PAGE3. Well, at least, with the chart we rebuild the EPROM with the ROMs from  A1FX, the BIOS+BASIC in place of SYSTEM0 and SAMPLE0, MSX2+ SUBROM instead of SAMPLE1 and KANJI-ROM Driver where we have DEMO in original ROM.

And... that new ROM doesn't works :(

The layout of SLOT3.3, with all pages mapped to EDIT0, is a clue that there is a custom mapper that needs to be configured somehow. No ideas here. Need to go back to disassembler to search for exotic code, like the one that begins in 0221h which sends some data to switching ports (comments and label names by me):

  ld hl,STRING1 ;0221 21 7e 06 Set pointer
                ;              to STRING1 (067e)
  ld c,000h     ;0224 0e 00 
  ld a,010h     ;0226 3e 10    10h ->
                ;              0001 0000b -> 16d
  out (043h),a  ;0228 d3 43    Switched port 43
  xor a         ;022a af       00h ->
                ;              0000 0000b -> 00d
  out (044h),a  ;022b d3 44    Switched port 44
  ld a,030h     ;022d 3e 30    30h ->
                ;              0011 0000b -> 48d
  out (045h),a  ;022f d3 45    Switched port 45

  ld b,(hl)     ;0231 46       Read how many bytes
  xor a         ;0232 af       needs to be read
                ;              from port 45
  cp b          ;0233 b8
  jr z,l0258h   ;0234 28 22    If EOF (00)

After this ports configuration, it reads N bytes from port 45, comparing it with two strings: 'MOUF1' and FFhFFh'GOT48'. I didn't found those strings in main ROM, maybe that read from port 45 reads one of the Kanji-ROMs or the dictionary?

Then the things got even weirder, this is what we have in 0258h:

  ld a,000h             ;0258   3e 00
  ld (0ed00h),a         ;025a   32 00 ed
  ld h,040h             ;025d   26 40
  ld (0ed03h),hl        ;025f   22 03 ed
  ld a,0a0h             ;0262   3e a0
  ld (0ed01h),a         ;0264   32 01 ed
  ld a,(0ed01h)         ;0267   3a 01 ed
  cp 0a0h               ;026a   fe a0
  jp c,CHPAGES01_SLOT3  ;026c   da d8 02
  inc a                 ;026f   3c     
  ld (0ed02h),a         ;0270   32 02 ed
  ld a,(0ee2fh)         ;0273   3a 2f ee
  and a                 ;0276   a7
  jr z,CHPAGES12_SLOT3  ;0277   28 08
  ld a,(0ed01h)         ;0279   3a 01 ed
  cp 0c0h               ;027c   fe c0
  jp nc,CHPAGES01_SLOT3 ;027e   d2 d8 02
  call PAGE12SLOTBLOCK  ;0281   cd 69

These jumps and subroutine calls shuffles the ROM's pages between the  frames and subslots of SLOT3, writing in not usual memory locations inside these subroutines. After the initial shuffle, the BIOS reads the N bytes from 4010h and compares with some strings:

  ld hl,STRING3      ;0284 21 8d 06
  ld ix,0edf4h       ;0287 dd 21 f4 ed
  ld de,04010h       ;028b 11 10 40  

  ld b,(hl)          ;028e 46    Read how many  
                     ;           characters
  xor a              ;028f af      
  cp b               ;0290 b8      
  jr nz,l029dh       ;0291 20 0a If NOT EOF (00)

  ld a,(0ed01h)      ;0293 3a 01 ed  
  inc a              ;0296 3c      
  inc a              ;0297 3c      
  ld (0ed01h),a      ;0298 32 01 ed
  jr CHPAGES_TOSLOT3 ;029b 18 ca    

The character strings to be compared are SYSTEM0, SYSTEM1, VA1DATA, EDIT0, EDIT1, EDIT2, EDIT3, SAMPLE0, SAMPLE1, SAMPLE2, SAMPLE3, SAMPLE4, SAMPLE5, SAMPLE6, SAMPLE7, SAMPLE8, SAMPLE9, DEMO, DESIGN, AUTOSTART and SCENARIO. Some of those strings are the labels that we found in the ROM blocks. And others... are from the IC Card? The SRAM? From other equipment?

Just below the labels, there are a few more strings that doesn't seem to be used by or called anywhere in the code:


My guess is that these are the names of creators of this machine and BIOS.

At the end, this code to scramble and reallocate the pages left me very confused. After many attempts, I threw in the towel and stopped my efforts to understand what is happening in this code. If you want to try to continue, the tarball with all the ROMs (the full dump and split in blocks) can be downloaded from here, you can also download SYSTEM0 already disassembled and partially commented by me. Maybe it helps.

I hope someone can understand this page mapping code. It would be nice to boot this machine in MSX2+ mode and read games from the IC Card :D

No comments:

Post a Comment