Maybe, is the 3rd RAM chip dedicated to the DMA capabilities of the R800?
This feature was advertised on MSX magazines in those days.
The DMARQ pins are connected to ground, so don’t count on that being possible.
However, despite that I still wonder where the control registers are.
Grauw wrote:
However, despite that I still wonder where the control registers are.
If we are able to compare the contents of the ROM of the 2-ROM ST machines with the 3-ROM machines we may either find the registers that control the ROM mapping in the S1990 or that the ROMs are different in a way to find the firmware in a different location.
Now, regarding the DMA, if they are the same style as used in the PC (what was common at the time) they do not perform memory to memory transfers. Only memory to something that responds to DMARQs. In that case the DMA in the R800 would be useless... unfortunately.
I saw that the Panasonic machines have a custom mapping mechanism that allow them to see all(?) memory contents RAM/ROM in a secondary slot (3.3 I believe). I wonder if the ROM dumps we have from the turbo-r machines were taken this way or not. I mean, this method could allow to observe the entire ROMs and check if R800/Z80 really start at the slot 0.0 address 0, or if some code is run before that.
Another option to look for, is that the S1990 may have a small amount or ROM used to initialize the computer/R800. I guess I'll have to hook-up a logic analyzer to the thing to check if any initialization happens before control is given to the BIOS.
Edevaldo, erpirao... I kind of like these ROM "conspiracy theories", but I think they are quite a far fetched... 
You can't really compare BlueMSX with real hardware... It is not really any news that a lot of stuff is missing from those BlueMSX ROM dumps and real tR does not have things like XBASIC ROM... The tR emulation is more like glued to top of existing MSX emulator in order to run MSX tR programs instead of accurately trying to emulate the real thing. I would say it is better to look at OpenMSX ROM dumps... How ever then you get puzzled again as you see that those used ROM dumps are 4MB System + 256KB Kanji font ROM... I think OpenMSX dump has quite a bit duplication... + RAM dump as well.
I don't think all of the hardware functionality is 100% clear, but I think the reality is anyway much more dull than you think... but I agree that as long as we don't have direct dumps of those ROMs we just can't know for sure.
Hi, Nyyrikki.
We know some facts:
- R800 has at least 2 DMA channels and a number of other interesting hardware that has to be accessible somehow. Either instructions we are not aware, ports/addresses or modes. There has to be a way to access those and cause a noticeable side-effect.
- The turbo-r ST machines appear in two ROM configurations, 3 512k ROMs and 2 ROMs, one 512k and the other 1M. The second seems the most common. The 3 ROM versions use an extra chip-select pin & ROM output enable. This means that either the ROM address decoding made by the S1990 is programable or the ROM program is written to look for the last 512k in a different address.
Those are facts and logic conclusions. From those come theories that we need to test. But there is nothing far fetched about it. It is very possible that the R800/S1990 already exits reset in a way that no further initialization is needed (dull but vey likely). But we do not know for a fact that this is the case. It is another theory.
Emulators are not a good reference for any of this because they can only do what we already know about the machines. And ROM dumps that are significative smaller than the chips in the machine increase the suspicion that there may be initialization code in those ROMs that may uncover undocumented behavior.
Those are all interesting avenues for investigation and the more ideas the better. Even if they are far-fetched. As long as they explain the known facts well.
It seems to me that the natural course would be to look into the turbo-r power up. Check assumptions about which processor starts first, check the first addresses in those ROMs that get accessed and things like that. Then attempt to dump those ROMs, ideally the 2 ROM version and the 3 ROM version.
I guess I'll have to hook-up a logic analyzer to the thing to check if any initialization happens before control is given to the BIOS.
I think that’s a very interesting thing to try out.
The turbo-r ST machines appear in two ROM configurations, 3 512k ROMs and 2 ROMs, one 512k and the other 1M. The second seems the most common. The 3 ROM versions use an extra chip-select pin & ROM output enable. This means that either the ROM address decoding made by the S1990 is programable or the ROM program is written to look for the last 512k in a different address.
If you take a look how much AND/OR logic gates are used to decode ROM select pins in A1GT, I think you will agree that it does not look like there is much programmable logic in S1990 to map the ROM area to "Panasonic mapper". As I've not seen the 3x512KB version, can you tell where this "extra chip-select pin" is connected to?
It is very possible that the R800/S1990 already exits reset in a way that no further initialization is needed (dull but vey likely). But we do not know for a fact that this is the case. It is another theory.
Ok, here is my theory:
How I think it works is that first Z80 boots (from 0000#0-0) and then R800 boots (from 0000#0-0) All of the page copy, select etc is done by the standard BIOS (and the page 0 routine of Panasonic "cartridge" in slot 3-3)
Here is my best guess how physical signals of the A1GT ROMs (1MB+1MB) are mapped to Panasonic mapper:
- /CSROM1 maps to pages #000-#07F
- SRAM (/RAMOE & /RAMWE) is mapped to pages #080-#087 (Reserved #080-#09F)
- /CSROM0 maps to (KANJI FONT ROM & pages #0A0-#0BF) & (pages #0D0-10F == #110-#13F)
- Pages #140-#17F are mapped to unused signals /CSROM3 & /CSROM4 ???
- DRAM is mapped to pages #180-#1FF
A1ST is quite similar, but ROM pages #0C0 and later are missing and the SRAM is smaller.
As I said this is only guess how it might be mapped to physical chips, but at least "the math is right" as there is no any "hidden memory" or "extra memory".
It seems to me that the natural course would be to look into the turbo-r power up. Check assumptions about which processor starts first, check the first addresses in those ROMs that get accessed and things like that. Then attempt to dump those ROMs, ideally the 2 ROM version and the 3 ROM version.
Indeed, this would give us very valuable information... How ever I don't think there are enough brave men around to start testing with their MSX tR hardware... The electronics inside are very small, expensive and hard to replace.
Another fact to not lose sight is that the R800 generates RAS signals for 4 memory banks and provides A0-A10 address pins for those DRAM accesses. This means that the R800 probably supports 2048 row/column chips and 4 banks of those.
The two 256k x 4 chips in the STs use 1 bank of 512 row/columns using A0-A8. The GTs use 2 banks for the same memory type. 1M x 4 memories would require the use of A9 and 4M x 4s would use up to A10. If 4 banks of those are supported, that is 16M bytes of DRAM memory. Interestingly enough, FPM DRAMS were all standardized to be refreshed in 128 rows/2ms(16k/Z80), or 256 rows/4ms(64k), or 512 rows/8ms(256k), or 1024 rows/16ms(1M) and 2048 rows/32ms(4M). So a circuit that is designed to refresh 4M chips works with all smaller chips as well. No configuration needed.
I do not think the R800 would support 4 Mapper banks though. It is possible but not very plausible as it would run out of slots. It is more likely that all this memory is accessible only in a R800 extended mode with a more straightforward mapping mechanism, possibly based on the Z280 mechanism (but hopefully not). Another thing that hints at a mode like this it the fact that it is called a 16-bit CPU. Adding a couple multiply instructions do not promote a CPU to 16-bits.
The last thing that points in that direction, AFAIK, are the several interrupt pins that the R800 supplies. It does not make any sense to direct them to the same int38. Those are probably vectored inputs. But as the MSX uses all the obvious addresses already I wouldn't be surprised if this is either another 16-bit only thing or needs IM2.
NYYRIKKI wrote:
If you take a look how much AND/OR logic gates are used to decode ROM select pins in A1GT, I think you will agree that it does not look like there is much programmable logic in S1990 to map the ROM area to "Panasonic mapper". As I've not seen the 3x512KB version, can you tell where this "extra chip-select pin" is connected to?
In the STs the ROMs CS pins are connected directly to the S1990 without any decoding. There are places in the pcb for 4 ROMs and the CSs goes respectively to CSROM0(IC12), CSROM1(IC18), CSROM2 (IC19) and CSROM3(IC20) pins on the S1990. Schematic does not show ROM2 & 3, but show the CSROM2 & CSROM3 pins being connected on the S1990 side. CSROM4 is floating. PCB has markings saying that some of the ROMs could be either 2Megabit or 4Megabit chips. Finally the 3 ROM ST PCB that I saw in the internet has a different marker (DFUP0402ZAU2a and U1) than the more common version with 2 ROMs populated (DFUP0402ZAUa and U2). But I cannot spot a difference between the two PCBs besides the ones we already know.
I need to look more into the GT schematic. But not today... I have to change a diaper. ;-)
Japanese MSX user Kinnoji managed to unearth a copy of the R800 User’s Manual and posted a few photos:
https://twitter.com/v9938/status/1124223395141308417
https://twitter.com/v9938/status/1124296770270351360
Translated text below.
----------------------------
R800 User’s Manual
Preliminary version
ASCII corporation
Systems division
1991-01-24
1 Features
1. A 16-bit ALU pass is adopted to speed up the arithmetic processing.
• Execute 16-bit arithmetic operation in one system clock.
2. Supports 24-bit wide address space.
• Built-in memory mapper of 9 entries and memory expansion is possible with 16 MB.
3. The built-in DRAM interface allows direct connection of DRAM.
• Direct connection of DRAM is possible.
• Built-in refresh controller (refresh is CAS before RAS method).
• Supports DRAM high-speed interface (page mode), so it can be accessed by computer.
4. Built-in clock generator (28 MHz).
5. Enhanced interrupt functionality.
• Indirect addressing interrupt with 7 levels of priority.
6. Built-in 2 channels of DMA controller.
7. CPU clock is about 7 MHz and most 1 byte instructions can be executed in 1 CPU clock.
8. Compatible with Zilog Z80 and instruction code upper.
• All Z80 instructions are supported.
• Supports 8-bit instructions in IX and IY registers.
• Supports multiplication instructions.
• FAST mode (performs block transfer of IO data in one instruction fetch).
9. Bidirectional mapper address pin.
• When the path is open, access can be made from the DRAM section by inputting all addresses and /ERAS from the outside.
7 Internal Extension Register
R800 has registers for interrupts, DMA, and memory mapper. Register bit assignments are shown below. The internal IO registers are accessed by bringing the /CSREG pin low. When the address signal A0 is “Low”, the pointer of the internal IO register is latched, and when it is “High”, the data is written. The pointer is auto-incremented at each data write, so high-speed data transfer to the memory mapper registers etc. is possible.
Internal register pointer register (/CSREG=L, A0=L, R/W)
B7 B6 B5 B4 B3 B2 B1 B0 - IRA6 IRA5 IRA4 IRA3 IRA2 IRA1 IRA0
IRA: Internal Register Address
Internal register write / read data register (/CSREG=L, A0=H)
B7 B6 B5 B4 B3 B2 B1 B0 DAT7 DAT6 DAT5 DAT4 DAT3 DAT2 DAT1 DAT0
8 Interrupt Operation
The R800 interrupts have the following 4 modes.
10 DMA Controller
In R800, the DMA controller has 2 channels of DMA0 and DMA1 built-in, and DMA0 loses its priority first. The transfer destination address and transfer source address can be set to 24 bits each and the transfer byte count can be set to 16 bits. There is no 64K byte boundary for the transmission byte count because a 24-bit counter is used.
It has a transfer source start address setting register (24 bits), transfer destination start address setting register (24 bits), transfer number setting register (16 bits) and mode register (8 bits) for each of the 2 channels of the DMA controller. Refer to the internal extension register section for details on register writing.
Transfer source start address setting register. (Write only)
Lower address setting register
B7 B6 B5 B4 B3 B2 B1 B0 A7 A6 A5 A4 A3 A2 A1 A0
Internal register address
Channel 0: 20H
Channel 1: 30H
Middle address setting register
B7 B6 B5 B4 B3 B2 B1 B0 MA15 MA14 MA13 A12 A11 A10 A9 A8
Internal register address
Channel 0: 21H
Channel 1: 31H
15 Instruction Execution
The R800 executes an instruction in SYSCLK units obtained by dividing the XTAL frequency by 1/4. Also, since instruction fetching and instruction execution are pipelined, the next instruction fetch is performed during instruction execution. (See figure below.) If the prefetched instruction can not be executed due to an interrupt or bus request, etc., the instruction that could not be executed will be fetched again after the service such as interrupt or bus request is finished.
