Thanks for dumping!
I am a bit late... but I just had a look at the EPROM contents.
It's almost 1:1 identical to the early HC05 versions with the same logic & program flow, just using SPC700 opcodes instead of HC05 opcodes.
There are a couple of minor differences, like checking (or not checking) this or that bits for error handling, and oddly, a different error code when reaching lead-out.
And some different features, some of them are related to using the DTL-H2010 cdrom drive,
viewtopic.php?f=59&t=604
Minute Table
The SPC700 verson is using a 71-minute table for sector seeking. The HC05 versions do also have that 71-minute table, but they do never use it, and are instead using a 77-minute table.
I had assumed that the different tables are matched to different disc-types (with tighter spiral windings), but then why is the SPC700 version expecting different discs? Maybe it does actually do so because it's for CDR's. Or maybe the tables are matched to different drives with different stepping motors.
SCEx
There seems to be no SCEx check, so it't region free and works with CDRs. The test command for reading the 4-letter SCEx string seems to return four 00h bytes.
Eject Button
The DTL-H2010 is a front-loading drive with Eject button, and the SPC700 firmware contains some code for handling that. Apart from internal handling, it's also allowing to read an eject-related bit via Test command:
Code: Select all
19h,21h --> INT3(flags)
Returns the current status of the POS0 and DOOR switches.
Bit0 = HeadIsAtPos0 (0=No, 1=Pos0)
Bit1 = DoorIsOpen (0=No, 1=Open)
Bit2 = EjectButtonOrOutSwOrSo? (DTL-H2000 only) (always 0 on retail)
Bit3-7 = AlwaysZero
I am not sure what is in Bit2. The drive should have four switches/buttons: POS0, IN SW, OUT SW, and EJECT.
But the Test command returns only 3 of those 4 bits.
8-button Keyboard
There seems to be support for an 8-button keyboard, with (I think) these functions: FastFwd, FastRev, PrevTrack, NextTrack, Stop, Pause, Play, Eject.
Is that a known DTL-H2000 feature? Does it include a keyboard, or an external connector for such keyboards?
The SNES CDROM prototype did have a (somewhat) similar 6-button keyboard.
As for the DTL-H2000 keyboard, I am not sure how it is supposed to be wired up, but I've two theories:
- Analog input: Each button having a different pull-up/down resistor (the controller input function looks as if it's reading Analog values in that fashion... though the code is confusing... it seems to read 6 analog channels, compare all of them against the expected button values... and then ignores most of the results and recurses only 1 of the 6 channels).
- Infra-red: The CXP82316/82320/82324 datasheet mentions support for Remote control receiver circuit with "On-chip 6 stage FIFO 8-bit pulse measurement counter" (maybe the supposed 6 analog channels are actually those 6 fifo stages... but the controller function doesn't really look like an IR signal handler... unless it's a weird IR protocol that encodes the buttons as "number of pulses" instead of as specific "bit sequences").
Either way, a possibly existing keyboard connector would require only 1 pin for the "analog-or-infrared" signal (plus 1-2 supply pins).
Version
The version test command returns: 94h,11h,28h,01h (28 Nov 1994, version v01). The 01h is a bit odd (other/retail versions are C0h and up).
And that SPC700 date is slighly newer than early HC05 retail firmwares. On the other hand, the DTL-H2000 MIPS kernel looks older than retail BIOSes (it lacks memory card support).
So, I guess the SPC700 EPROM was updated on 28 Nov 1994, and there must have been older versions before then. Are there any DTL-H2000 boards with dates other than '94 11/28 on the EPROM sticker?
RAM Read
The SPC700 version allows to read the whole 64Kbyte memory space (without mirroring everything to first 300h bytes as happening in HC05 versions). I/O Ports and Variables are at:
Code: Select all
000h..0DFh RAM Part 1 (C0h bytes)
0E0h..0FFh I/O Area
100h..1DFh RAM Part 2 (C0h bytes)
1E0h..1FFh I/O Area
200h..2DFh RAM Part 3 (100h bytes)
2E0h..7FFFh Unknown
8000h-BFFFh Unknown (lower 16K of 32K EPROM) (or unused?)
C000h-FFFFh Firmware (upper 16K of 32K EPROM)
In so far, it should be possible to dump the firmware "per software" without needing an EPROM reader (of course, using an EPROM reader may be much easier than writing and using a custom "raw software" dumping program for ISA bus PCs).
7-segment Display
This firmware can display "Track MM SS FF" on a 7-segment display with 8 digits. The digit pairs are output at CF93h, and then later translated to actual segments using this table:
Code: Select all
;--- ; _______
@@seven_segment_table: ; . / bit8 \..
C1FC C0 1B dw 1BC0 ;0 ; / \\_______// \.
C1FD C0 00 dw 00C0 ;1 ; | | | |
C1FF 80 1D dw 1D80 ;2 ; bit9 | | | | bit7
C201 C0 15 dw 15C0 ;3 ; | |_______| |
C203 C0 06 dw 06C0 ;4 ; \.// bit10 \\./
C205 40 17 dw 1740 ;5 ; / \\_______// \.
C207 40 1F dw 1F40 ;6 ; | | | |
C209 C0 01 dw 01C0 ;7 ; bit11| | | | bit6
C20B C0 1F dw 1FC0 ;8 ; | |_______| |
C20D C0 07 dw 07C0 ;9 ; \.// bit12 \\./
C20F C0 0F dw 0FC0 ;A ; \_______/
The function at C11Ah displays "-HELLOUU" on power-up... Hello Uu?
Datasheets
There is a CXP82300 datasheet (that merely contains the EPROM pinout) and a CXP82316/82320/82324 datasheet (that contains a few more details about the supported hardware features, like mentioning the Analog and Infrared inputs).
But none of those datasheets is describing the exact bits & addresses of the hardware registers... is there a separate Programmer's Manual or software devkit somehwere?