Changes between Version 3 and Version 4 of vtech/cqfd-scientus

Timestamp:

Aug 11, 2021, 6:02:36 PM (3 years ago)

Author:

pulkomandy

Comment:

--

vtech/cqfd-scientus

@@ -18 +18 @@
 - 3x4 characters with borders on both the side and bottom
 
-Besides the ROM, soudchip, and CPU glob, there is an audio amplifier and a 74HC175 on board.
+Besides the ROM, soudchip, and CPU glob, there is an audio amplifier and a 74HC175 (quad flip flop) on board.
 
 The motherboard is behind the display, and connected with wires to the bottom part of the laptop with the keyboard, printer and mouse port, and audio output.
 
-Cartridge port pinout is apparently standardized for all VTech Z80 machines:
+Cartridge port pinout is apparently standardized for all VTech Z80 and 68HC05 machines:
 
 - A15, A12, A7,  A6, A5, A4,  A3,  A2,  D7, D6, D5, D4, D3, GND, GND, VCC, ??1, N/C
@@ -31 +31 @@
 ??1 is connected directly to the CPU
 ??2 and ??3 are also connected to the 74HC175 but it is not clear how that is used.
+
+(I have confirmed this wiring, and compared it with existing documentation of the Z80 machines which are more known).
+
+I suspect the 74HC175 could be used to convert from Motorola to Intel bus style, then? And provide separate /OE and /CE signals to the cartridge (and possibly /WE if a writable cartridge exists). But it's strange to use a flip flop gate for that?
+
+= A look at the ROM =
+
+The ROM dump is attached to this page (see attachment section at the bottom) and I'm in the process of disassembling and studying it.
+
+It is based on the 68HC05 CPU which is a ver simple CPU core. To workaround the limitations of the CPU, a set of short subroutines are used (for example to push and pop the A and X registers from a software managed stack), as well as code generation on the fly (usually writing generated code at addresses 5F to 62, which must be in some internal RAM).
+
+Registers have been identified that likely handle memory mapping. They are read-write, so it's possible to know the current bank number.
+
+- $29: Selects what is banked at 4000
+- $2A: Selects what is banked at 8000
+- $2B: Selects what is banked at D000
+- $2C: Selects what is banked at C000
+
+Page at 4000 is used to map 16K segments of the ROM. Each segment begins with a jumptable in the form of several JMP instructions.
+
+The section at 2000 onwards is always visible by the CPU and a large part of it is code that selects a bank and then jump to a specific routine inside it. It also contains the subroutines mentionned above (stack management, ...) and some other code (uppercase/lowercase ASCII detection).
+
+ASCII strings in the ROM are terminated with an FF byte.
+
+No 68HC05 style reset vector found in the ROM so far. I suspect (from MAME stub drivers) that there is an internal ROM in the 68HC05 that does the reset and early init. I don't know how much of it will be needed. So far I found nothing that appears to jump outside the ROM space or otherwise use the internal ROM, but I have only disassembled a couple kilobytes of code in the resident bank.