a few oldies...

Hello there, starlord here.

This is my first message and the first thing I wanted to do was to say thank you for your admirable efforts in the preservation of computing history: future generations will thank you for this endeavour.

I'm part of a french community called my silicium where several persons are endeavouring to work on the dumping and preservation of the excelvision EXL100 computer and the haminex pencil 2.

I was woundering if possibly those machines could be supported by mess one day (at least the haminex pencil 2 should prove easy as it's based on a Z80 zilog, but the EXL100 is a real beast based on very obscure components such as the infamous TMS7041 and TMS7020: Yet this machine really deserves to be preserved).

Could I have your advice on this?

Best regards.

mike.

It would be advantageous to have schematics, manuals, bios rom dumps, sample games and anything else you could offer.

Oooh, EXL 100.

Do you also have contacts with an exeltel ?

We need (verification of) bios dumps from both machines. There is a testdriver for these machines in MESS. The code as is is not working. I played with the code a little bit last weekend and got the core to complain a little less, but it is absolutely not working yet. Any information regarding memory maps, schematics, part names is welcome. I know that there is a bit of information available on www.ti99.com.

As to dumped cassettes/images, I can patch you through to a guy who's dumping cassettes and disks (not difficult according to him) for both the EXL and the pencil. However, things are hard regarding the EXL, especially since we have no dumps for the TMS7041 and 7020.

My tms7000 core is know not to be perfect (or anywhere near perfect). The one machine I use it for (the Speech/Sound Pak for the Color Computer) doesn't execute the code well enough to do text to phonem translation.

From a real machine the 0xF800 - 0xFFFF area needs to printed/saved/whatever to get a dump of the real thing.

I think I have something which might be the bios of an EXL 100 but I am not sure. The file is 2048 bytes has a crc of 049109a3 and a sha1 hash of 98a07297dcdacef41c793c197b6496dac1e8e744.

Regarding cpu cores, everything can be fixed

As a first step I cleaned up the exeltel/exl100 driver file a bit.

Aha, it looks like we need a dump of what is inside that tms7041 as well. It takes care of reading the joystick ports, accessing the tms5220 for speech and probably a couple of other things as well.

Regarding dumping the tms704x, this information from the mess source code might be interesting:

Code:

    I/O CPU protocol (WIP):

    I do not have a dump of the I/O CPU ROMs.  The I/O CPU CRC command should
    enable to dump them, but don't take my word for it.

    * port B bit >01 is asserted on reset and after a byte is sent to the I/O
      CPU.
    * port B bit >02 is asserted after a byte is read from the I/O CPU.  When
      the I/O  CPU sees this line asserted, it asserts port A bit >01.
    * port A bit >01 is asserted after a byte is sent to CPU (condition
      cleared when port B bit >01 is cleared after being asserted) and when
      port B bit >02 is asserted.
    * I/O CPU pulses the main CPU INT1 line when ready to send data; data can
      be read by the main CPU on the mailbox port (P48).  The data is a
      function code optionally followed by several bytes of data.  Function
      codes are:
        >00: unused
        >01: joystick 0 receive
        >02: joystick 1 receive
        >03: speech buffer start
        >04: speech buffer end
        >05: serial
        >06: unused
        >07: introduction screen (logo) (EXL 100 only?) or character
          definitions
            data byte #1: data length - 1 MSB
            data byte #2: data length - 1 LSB
            data bytes #3 through (data length + 3): graphic data
        >08: I/O cpu initialized
        >09: I/O cpu serial interface ready
        >0a: I/O cpu serial interface not ready
        >0b: screen switched off
        >0c: speech buffer start (EXELTEL only?)
        >0d: speech ROM or I/O cpu CRC check (EXELTEL only?)
            data byte #1: expected CRC MSB
            data byte #2: expected CRC LSB
            data byte #3: data length - 1 MSB
            data byte #4: data length - 1 LSB
            data bytes #5 through (data length + 5): data on which effective
                CRC is computed
        >0e: mailbox test, country code read (EXELTEL only?)
        >0f: speech ROM read (data repeat) (EXELTEL only?)
    * The main CPU sends data to the I/O CPU through the mailbox port (P48).
      The data byte is a function code; some function codes ask for extra data
      bytes, which are sent through the mailbox port as well.  Function codes
      are:
        >00: I/O CPU reset
        >01: NOP (EXELTEL only?)
        >02: read joystick 0 current value
        >03: read joystick 1 current value
        >04: test serial interface availability
        >05: transmit a byte to serial interface
        >06: initialization of serial interface
        >07: read contents of speech ROM (EXELTEL only?)
        >08: reset speech synthesizer
        >09: start speech synthesizer
        >0a: synthesizer data
        >0b: standard generator request
        >0c: I/O CPU CRC (EXELTEL only?)
        >0d: send exelvision logo (EXL 100 only?), start speech ROM sound (EXELTEL only?)
        >0e: data for speech on ROM (EXELTEL only?)
        >0f: do not decode joystick 0 keys (EXELTEL only?)
        >10: do not decode joystick 1 keys (EXELTEL only?)
        >11: decode joystick 0 keys (EXELTEL only?)
        >12: decode joystick 1 keys (EXELTEL only?)
        >13: mailbox test: echo sent data (EXELTEL only?)
        >14: enter sleep mode (EXELTEL only?)
        >15: read country code in speech ROM (EXELTEL only?)
        >16: position I/O CPU DSR without initialization (EXELTEL only?)
        >17: handle speech ROM sound with address (EXELTEL only?)
        other values: I/O CPU reset?

I don't know if any of you has already tried to do this on a real machine. Might be worth a shot.

It is also possible that there may be different roms for different regions/countries. So that's going to be a lot of fun ...

So how can we dump the TMS7041 bios? one can still find EXL100s so why is it so difficult?

If we can't, could it be workable to reverse engineer this thing?

I'll link this thread to the my silicium topic: Perhaps some persons can help.

I think it's just one of those things that no one has simply done before.

Perhaps there are other ways to get the rom data out of a tms7041; for instance some microcontrollers allow you to read back the rom data if you apply a certain combination of signals to certain pins. Such a thing may be described in a tms704x manual though or in a patent somewhere.

As a workaround it might be possible to reverse engineer the operation, part of that work is already done in the mess source code. Of course, we prefer to work with the real roms.

If someone on the silicium forum with an EXL100 feals adventureous perhaps they can try how far they can get with the I/O CPU commands listed above.

The data manual for the tms7xxx series mentions no ROM reading magic. For the TMS7040 inside the CoCo's S/SC Frank Palazzolo removed the chip from the board and created a rig to trojan the ROM from the microcontroller.

I detailed it here http://groups.google.com/group/bit.listserv.coco/msg/091b018c65b82e8d

Oh, wow! I am now very hopelessly left behind as far as the technical expertise level is concerned.LOL

I'll try to see what the silicium team make of this.

Originally Posted By tlindner

The data manual for the tms7xxx series mentions no ROM reading magic. For the TMS7040 inside the CoCo's S/SC Frank Palazzolo removed the chip from the board and created a rig to trojan the ROM from the microcontroller.

I detailed it here http://groups.google.com/group/bit.listserv.coco/msg/091b018c65b82e8d

Hrm, does he still have that set up? Maybe it can be used to dump tms7041's as well.

I wonder what the 1 in 7041 means though; an additional feature, a special instruction, or protection of the internal rom?

I've added the tms7041 cpu to the exl100 and exeltel drivers plus placeholders for the undumped tms7041 roms.

Originally Posted By starlord

Oh, wow! I am now very hopelessly left behind as far as the technical expertise level is concerned.LOL

Why ask this, then?

Originally Posted By starlord

So how can we dump the TMS7041 bios? one can still find EXL100s so why is it so difficult?

Originally Posted By judge

I wonder what the 1 in 7041 means though; an additional feature, a special instruction, or protection of the internal rom?

The '1' means it has a real UART (rs-232) on chip.

Simply because I never thought it would be so difficult. Another reason to bow to your efforts!