IBM Music Feature Card/Yamaha FB-01

Developer's Forum, for discussion of bugs, code, and other developmental aspects of DOSBox.

Re: IBM Music Feature Card/Yamaha FB-01

Postby Cloudschatze » 2017-7-10 @ 14:32

Scali wrote:I think I may have found another unsupported, or at least undocumented SysEx on the FB-01...
If you look at page 6-20 in the IMFC Technical Reference, it describes Node Messages.
They have the form F0 43 75 0s 00 0f 0d ... F7

The bolded '00' is what I can't seem to find in the FB-01 documentation (only in their documentation of the data you can receive from a dump, but not sending it... then again, I suppose the idea of a dump would be that you can save it back as-is).

This is better described in the FB-01 service notes, but "00" in this particular context identifies the string as being a "Bulk Data System Message," where the following byte then defines a particular "Operation." For whatever reason, the terminology is different with the IMFC, where it's a "Node Message," followed by a "Format Number," but the usage is the same, except for the "Configuration-2" discrepancy.

It looks like the following four bulk (receive) operations pertaining to the "00" message are compatible with both the FB-01 and IMFC:
Code: Select all
F0 43 75 0s 00 00 0x <data> F7 - Voice Bank x (x = 0 - 1)
F0 43 75 0s 00 01 00 <data> F7 - Current Configuration Buffer
F0 43 75 0s 00 02 xx <data> F7 - Configuration Memory (xx = 0 - 15)
F0 43 75 0s 00 03 00 <data> F7 - All Configuration Memory
User avatar
Cloudschatze
Oldbie
 
Posts: 953
Joined: 2005-6-16 @ 14:32

Re: IBM Music Feature Card/Yamaha FB-01

Postby carlostex » 2017-7-10 @ 22:38

Somewhat unrelated, but anyone thinks that IMFC drivers for Sierra games (that don't have a FB-01 driver) could be patched to work with the FB-01?
User avatar
carlostex
Oldbie
 
Posts: 1951
Joined: 2010-4-03 @ 21:39
Location: Portugal

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-11 @ 07:20

carlostex wrote:Somewhat unrelated, but anyone thinks that IMFC drivers for Sierra games (that don't have a FB-01 driver) could be patched to work with the FB-01?


Possible, yes, but probably quite a bit of work.
For 386+ we could do something SoftMPU-like: virtualize the IMFC interface and output the MIDI data to an MPU-401 or SB MIDI port.
Or you could just use DOSBox, which already does that currently. It's how I am testing the FB-01 emulator, and comparing to a real IMFC (connecting the MIDI out of DOSBox to the MIDI in of a real IMFC).
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-11 @ 08:28

Cloudschatze wrote:This is better described in the FB-01 service notes, but "00" in this particular context identifies the string as being a "Bulk Data System Message," where the following byte then defines a particular "Operation." For whatever reason, the terminology is different with the IMFC, where it's a "Node Message," followed by a "Format Number," but the usage is the same, except for the "Configuration-2" discrepancy.


Yes, it's very annoying that the two manuals use vastly different ways to name and describe the SysEx commands.

Cloudschatze wrote:It looks like the following four bulk (receive) operations pertaining to the "00" message are compatible with both the FB-01 and IMFC:
Code: Select all
F0 43 75 0s 00 00 0x <data> F7 - Voice Bank x (x = 0 - 1)
F0 43 75 0s 00 01 00 <data> F7 - Current Configuration Buffer
F0 43 75 0s 00 02 xx <data> F7 - Configuration Memory (xx = 0 - 15)
F0 43 75 0s 00 03 00 <data> F7 - All Configuration Memory


Yes, this was more or less my assumption. Thanks for the verification.

I am now studying the code in the ROM to see which values it sends to the YM2164, and when.
First focus is to get the voice data working correctly (the note frequencies and volumes seem to be 'okay' at this point, based on the VFB-01 code). Once the voice data works, I will study the remaining YM2164 commands, which should be the note on/off commands and related things. To see if we can get all the code I currently borrowed from VFB-01 as accurate as possible.
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby Cloudschatze » 2017-7-11 @ 21:38

Not particularly significant, but here's an undocumented FB-01 bulk request message:

F0 43 75 0s 20 05 00 F7

It returns a 16-byte, "rel. M002.00.009" ASCII string on one of my units, presumably relating to the ROM version.
User avatar
Cloudschatze
Oldbie
 
Posts: 953
Joined: 2005-6-16 @ 14:32

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-11 @ 22:39

Cloudschatze wrote:Not particularly significant, but here's an undocumented FB-01 bulk request message:

F0 43 75 0s 20 05 00 F7

It returns a 16-byte, "rel. M002.00.009" ASCII string on one of my units, presumably relating to the ROM version.


I suppose.
In the IMFC rom there are these strings:
YAMAHA IBM MUSIC
rel. M102.00.010

The FB-01 rom has these strings in the same place:
rel. M002.00.009
YAMAHA COM FB-01

Note that the order of the two is reversed, which makes me wonder whether there are SysEx commands to get both strings, and if so, if the IMFC would return them in reverse order as well.
Does it return "YAMAHA COM FB-01" for the identification number command? (F0 43 75 0s 20 05 00 F7).
In the IMFC ROM I also find this one: F0 43 75 0s 20 06 00 F7
I don't think I see that particular one in the FB-01 ROM.

So if Yamaha did proper version management, then the FB-01 ROM we are examining is exactly the one in your unit.
The IMFC rom implies that it is a newer revision. I wonder if we should read the '102' as the '1' signaling it's an IMFC, and the remaining number is the 'regular' revision.
That would make sense, as in, perhaps Yamaha was planning to include the extra parameter list in newer FB-01 models anyway. In fact, perhaps there are newer units that do. But we only have 'old' manuals, by the looks of things.

Interestingly enough, as I reverse engineered further, I think I found a part in the ROM that lists the SysEx messages.
lchiocca had already found the voice ROM banks, and I've also found the 4 ROM configurations now. Slowly but surely, the ROM is starting to reveal its secrets.
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby Cloudschatze » 2017-7-12 @ 02:44

F0 43 75 0s 20 04 00 F7 does indeed return the 16-byte "identification" string, as documented for both the IMFC and FB-01 in their respective technical manuals. I was specifically testing the FB-01 for the "Source 06," "Configuration-2" function/operation specific to the IMFC though, which led to checking for the in-between, but undocumented "05" string.

I've looked/hoped for a newer FB-01 that might incorporate some of the IMFC additions, but have yet to come across one.

lchiocca wrote:It's really amazing how many bugs I already found! How could it have been that complicated?! There's a sysex command to dump a source memory (Node Dump Request Message with Source 1 and 6). Source 1 and 6 represent the configuration buffer 1 and 2. It's nice to see that DumpSource1 and DumpSource6 actually point to the same config!

This doesn't seem like a bug. The way the IMFC manual describes it, there is a single configuration buffer, but two separate means of sending bulk data to it, differing in the application of settings relative to the Combine function. This being the case, it makes sense that the same configuration buffer data would be sent for the separate corresponding dump requests (perhaps just leaving the question of why a specific dump request for "Source 06" exists at all, if perhaps only to maintain consistency).
User avatar
Cloudschatze
Oldbie
 
Posts: 953
Joined: 2005-6-16 @ 14:32

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-12 @ 07:25

I have found one instance already where the code writes to register 0, which is in the undocumented range of the YM2151, and presumably also of the YM2164 (well, everything is undocumented there).
I suppose I'll have to figure out when exactly it calls that particular code, then perhaps we can deduce what it is trying to achieve there. My first impression is that it was only called at initialization time, so perhaps it's not something to worry about.

I also saw that it writes to the noise register at initialization time, it seems to disable the noise (if I understand correctly, the 32nd operator can be set to noise... so operator 4 of voice 8 ). I don't think there's anything in the SysEx messages to change this setting, so the noise feature can't be used. In which case it means you can't play every possible YM2151 song on an IMFC or FB-01. But I hope I'm wrong about that :)
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-17 @ 07:48

Still reverse-engineering the ROM. I did find a few small flaws in the structures of my C code. The layout should now be 1:1 with the real thing.
Looking at the way the ROM handles the voice data and such, it does things mostly 1:1 as well.
That is, on startup the configurations and voice banks are copied 1:1 to RAM, with only the names replaced as 'user 1' etc.
SysEx also seems to mostly just read/write these buffers 1:1, merely encoding and decoding them because of the 7-bit value requirement of MIDI.

I'm now trying to piece together how it actually selects a voice and initializes the YM2164 chip for that. But my first impression is that mostly the voice data is just sent to registers in batches. I haven't seen a lot of extensive bit juggling and such.
So I will need to map out each byte in the voice data and figure out which YM2164 register it goes to.
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-18 @ 07:11

I thought I had already posted this yesterday, but apparently not.
I've now located where the instrument and configuration parameters are set, so that gives clues for more of the internal structure.
I haven't quite had that 'aha-moment' yet where I see "Oh, here's the note data coming in, and this is where it sends it to the YM2164".
But I suspect that is because it is decoupled.
I suspect that there is some kind of timer interrupt, and the chip registers are just updated at every tick (this is more or less also how VFB-01 works). The MIDI data is processed asynchronously, and merely stored into the state machine as it comes in, but does not necessarily lead directly to reprogramming of the YM2164 (only in special cases).
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby Scali » 2017-7-20 @ 08:13

I think I've unraveled all the low-hanging fruit in terms of reverse-engineering... That is, code and data that could be explained either by what values were written to the YM2164 registers, or by what data was received or sent via a known SysEx command.

What is left is a lot of state-information where it isn't immediately apparent where the code stores what (it appears to use a few arrays of internal structs, loading the address into the ix or iy register, and then indexing off that).
It will take a lot of time to decypher everything.
But the primary focus at this point should be the voice data I suppose. I'll have to see if I know enough about that for now to get it working.
So far the theory that the voice data is a 1:1 mapping to the YM2164 registers seems to hold. It is also apparent that the SysEx commands to update individual values will reformat the value and combine it with the rest of the register value (there are often 2 or more values packed into a single 8-bit register value).
Scali
l33t
 
Posts: 2864
Joined: 2014-12-13 @ 14:24

Re: IBM Music Feature Card/Yamaha FB-01

Postby lchiocca » 2017-8-04 @ 04:10

Scali, I've gotten further as well in terms of reverse-engineering. I'm not completely done, but I've got a big portion as well. In the google drive https://drive.google.com/drive/folders/ ... 3RxeDdTX2M you'll find the "01-CODE (original clean enhanced).asm". It's a auto-gererated file based on the original disasm'ed version that's run through a python code analyser that I wrote for this purpose (imf-parser.py). I've got most of the functions and the data variables although there are still some things that are unclear. Just out of curiosity: could you send me your version? You probably found things I haven't yet and that I could merge in.

I'm still going to continue on. I'm in the mood to generate a full C-version of the ROM code :)
lchiocca
Newbie
 
Posts: 17
Joined: 2006-9-17 @ 22:35

Re: IBM Music Feature Card/Yamaha FB-01

Postby lchiocca » 2017-8-09 @ 12:50

Did you know: The (undocumented) system command message 1F6 allows you to write to the card memory (RAM - not the standard buffers). That also includes code! It's even intended to have code in 0xc000 that can be executed - Nice! But not emulatable :(.
lchiocca
Newbie
 
Posts: 17
Joined: 2006-9-17 @ 22:35

Previous

Return to DOSBox Development

Who is online

Users browsing this forum: No registered users and 2 guests