From a real machine the 0xF800 - 0xFFFF area needs to printed/saved/whatever to get a dump of the real thing.
I think I have something which might be the bios of an EXL 100 but I am not sure. The file is 2048 bytes has a crc of 049109a3 and a sha1 hash of 98a07297dcdacef41c793c197b6496dac1e8e744.
Regarding cpu cores, everything can be fixed
As a first step I cleaned up the exeltel/exl100 driver file a bit.
Aha, it looks like we need a dump of what is inside that tms7041 as well. It takes care of reading the joystick ports, accessing the tms5220 for speech and probably a couple of other things as well.
Regarding dumping the tms704x, this information from the mess source code might be interesting:
I/O CPU protocol (WIP):
I do not have a dump of the I/O CPU ROMs. The I/O CPU CRC command should
enable to dump them, but don't take my word for it.
* port B bit >01 is asserted on reset and after a byte is sent to the I/O
* port B bit >02 is asserted after a byte is read from the I/O CPU. When
the I/O CPU sees this line asserted, it asserts port A bit >01.
* port A bit >01 is asserted after a byte is sent to CPU (condition
cleared when port B bit >01 is cleared after being asserted) and when
port B bit >02 is asserted.
* I/O CPU pulses the main CPU INT1 line when ready to send data; data can
be read by the main CPU on the mailbox port (P48). The data is a
function code optionally followed by several bytes of data. Function
>01: joystick 0 receive
>02: joystick 1 receive
>03: speech buffer start
>04: speech buffer end
>07: introduction screen (logo) (EXL 100 only?) or character
data byte #1: data length - 1 MSB
data byte #2: data length - 1 LSB
data bytes #3 through (data length + 3): graphic data
>08: I/O cpu initialized
>09: I/O cpu serial interface ready
>0a: I/O cpu serial interface not ready
>0b: screen switched off
>0c: speech buffer start (EXELTEL only?)
>0d: speech ROM or I/O cpu CRC check (EXELTEL only?)
data byte #1: expected CRC MSB
data byte #2: expected CRC LSB
data byte #3: data length - 1 MSB
data byte #4: data length - 1 LSB
data bytes #5 through (data length + 5): data on which effective
CRC is computed
>0e: mailbox test, country code read (EXELTEL only?)
>0f: speech ROM read (data repeat) (EXELTEL only?)
* The main CPU sends data to the I/O CPU through the mailbox port (P48).
The data byte is a function code; some function codes ask for extra data
bytes, which are sent through the mailbox port as well. Function codes
>00: I/O CPU reset
>01: NOP (EXELTEL only?)
>02: read joystick 0 current value
>03: read joystick 1 current value
>04: test serial interface availability
>05: transmit a byte to serial interface
>06: initialization of serial interface
>07: read contents of speech ROM (EXELTEL only?)
>08: reset speech synthesizer
>09: start speech synthesizer
>0a: synthesizer data
>0b: standard generator request
>0c: I/O CPU CRC (EXELTEL only?)
>0d: send exelvision logo (EXL 100 only?), start speech ROM sound (EXELTEL only?)
>0e: data for speech on ROM (EXELTEL only?)
>0f: do not decode joystick 0 keys (EXELTEL only?)
>10: do not decode joystick 1 keys (EXELTEL only?)
>11: decode joystick 0 keys (EXELTEL only?)
>12: decode joystick 1 keys (EXELTEL only?)
>13: mailbox test: echo sent data (EXELTEL only?)
>14: enter sleep mode (EXELTEL only?)
>15: read country code in speech ROM (EXELTEL only?)
>16: position I/O CPU DSR without initialization (EXELTEL only?)
>17: handle speech ROM sound with address (EXELTEL only?)
other values: I/O CPU reset?
I don't know if any of you has already tried to do this on a real machine. Might be worth a shot.
It is also possible that there may be different roms for different regions/countries. So that's going to be a lot of fun ...