___________________________________________________________________________
Contents:
0. Introduction
1. Overview of the TX16W
2. Memory map of the TX16W
2.1 Overview
2.2 SYSRAM: System RAM (128kB)
2.3 ROM: System ROM (16kB)
2.4 TGBD: Tone generator board memory and I/O space
2.5 DM: 68000 Motherboard I/O ports
2.6 Some asynchronous ports (old 800kHz bus circuits)
2.7 WRAM: Wave memory (1.5MB .. 6MB)
3. Interrupts
4. T8WSYS.SYS File format
5. Hello world, a programming example
6. The disk format (low level)
7. Yamaha Wave format
___________________________________________________________________________
0.0 Introduction
The TX16W is indeed a powerful sampler with its 16 voices, its digital filters
and its ability to produce high pitched notes with remarkably low distortion.
It is also remarkable that nearly all chips used in the design are standard
industry circuits. This makes it possible to analyse the design and make your
own programs that makes your TX16W into a standard midi file player, a midi
dump to file converter, a small audio effect processor or a telecomunication
modem! As far as I know noone has done any of the mentioned things yet and
I'm sure there are more ideas out there about what to do of this excellent
piece of hardware.
This file contains the results of my own studies of the circuit diagram
of the TX16W. Some are verified experimentally and some are yet to be tested.
I have tried to put comments where I'm not 100% sure. I hope that someone will
find this information useful and that we will see some interesting utility
programs for the TX16W pop up on internet in the future. I am interested in any
experiences from programming the TX16W, so if you have anything to add to this
text, or if you discover any errors, or if you can confirm that something is
correct, please let me know. I will try to update this list when new experiences
are added.
I would be very glad if the Typhoon guys could fill in the gaps in this
information concerning the GEW chip and the ADF chips. I have tried to make
Yahama send me papers on this but without success. I don't see any other
way than to analyse the old OS and try to figure out how it works, which is
a terrible lot of work. I understand that Magnus, the typhoon hacker, has
done this. Please take the time to share this knownledge with us!
What you need to program the TX16W is:
- A 68000 cross assembler for the system you are using (GNU macro assembler
should be just fine even though I haven't used it)
- A 6809 cross assembler if you are going to use the real time digital filters.
(There are such assemblers on the net too, ask in the newsgroup comp.sys.M6809
for example)
- A system to compile on with 3,5" disk drive capable of writing 720 kB
MSDOS format. (I myself use a PC-compatible)
- Knownledge of programming 68000 assembler (and possibly 6809 assembler if
you want to use the filter circuits)
The functions I have tested are the following:
- Floppy disk operations
- LCD display
- Buttons and lamps on the front panel
I haven't used the following devices:
- MIDI and RS422 ports (This is not very difficult though)
- The 6809 microcontroller
- The Sound and filter circuits
- The sample input
In this first version I haven't included information on many standard industry
chips. This info can be ordered from the manufacturer (for free in most cases)
If someone is interested, I can add info on how to program the serial ports,
the floppy controller and the LCD in the next update.
___________________________________________________________________________
1. Overview of the TX16W:
The most important chips inside the TX16W are:
- The 68000 CPU This powerful microprocessor has the overall control
of the system. 8 MHz
- The 68B09E CPU This microcontroller controls the digital filter
circuits in real time. 2 MHz
- The YM2409 GEW This special Yamaha chip generates all the voices
from the wave memory
- The two YM2412 ADF These chips are also specially designed by yamaha
and they perform the real time filtering
- Floppy circuit Western Digital 1702 (though I'm not precisely sure)
It is however not possible to install
an 1.4 MB drive, since the floppy circuit
only can handle 720k such.
- RS422 Maximum (theoretically) speed is 1 MBit/s.
In practice 150 KB/s due to the speed of
the 68000 processor.
The heart of the TX16W is the 68000 microprocessor. There are two CPUs in TX16W
but the 68000 performs all tasks except control of the digital filters, which
is performed by the 6809 microcontroller. The system program which is loaded
from disk by the boot ROM must be written for 68000 (for further information
about the file format of T8WSYS.SYS, see the separate section on this).
The following figure is an overview of the TX16W. The boxes represent different
functional blocks, for example a CPU, a communication chip or the LCD display.
The blocks are further described below.
EXT Sample Floppy MIDI EXT.COM
TRIG in drive In/Out In/Out
v v I I I
v v I I I
v v<<<<>>>I ADF I
I I I 64kB I I 63B09 I I I I I
I I ----x--- ----x---- ----x----- ----x-----
I I I I I V I V
-------- -----x----------x-----------x-------------x- V
I Bus I 6809 Address/ Data/ Control bus V
I Ctrl I -------------------------------------------- V
-------- V V
V V
-------------- ----------
I Individual I I Stereo I
I Out I I out I
-------------- ----------
68000 CPU: The 68000 microprocessor is manufactured by Motorola and is a
16 bit processor which (in the TX16W) runs at 8 MHz. This
powerful processor is also the heart of computers like
Macintosh, Amiga and Atari ST, and information about how to
program it is widely spread.
A/D converter: This is actually a large block of standard logic and a D/A
converter. The resolution is 12 bits.
FDC: (Floppy disk Controller) The WD1772 chip controlling the disk
drive. The full name is WD1772PH-2 and it is manufactured by
Western Digital. (This chip can also be found inside an Atari
ST computer, info on how to program it can be found in most
atari ST programming references)
UARTS: The HD63B50 chips controlling serial input/output via MIDI and
RS422. (It works exactly as the 6850 chips found for example
inside an atari ST. The 6850 is manufactured by Motorola).
LCD: The text screen. The full name is DMC40267UV-YGR, however I
have programmed it using a datasheet on a display called
LM40255M and it seems to work exactly the same.
switches and LEDs: The buttons and lamps on the front panel.
ROM: The 16kB EPROM containing the bootstrap sequence
SYSRAM: The 128kB working memory of the 68000
WaveRAM: The 1.5 .. 6 MB wave memory RAM
Bus Arbiter: Shares the WaveRAM between 68000 and the voice generation
(GEW) chip
GEW: The digital chip producing the output sound, specially designed
by Yamaha and named YM2409.
63B09E CPU: (same as 6809E)
This is the CPU that controls the digital filters. It is a
8-bit microcontroller designed specially for shared memory
systems. It is manufactured by motorola and runs at 2 MHz
clock speed.
FRAM: (Filter RAM) The 64 kB working memory of the 6809 processor
ADF: (Advanced Digital Filter) The digital filter circuits,
designed by Yamaha and named YM2412.
Individual out: A separate circuit board with the individual out D/A converters
and LP filters
Stereo out: The stereo D/A converters and LP filters.
___________________________________________________________________________
2.1 Memory map for the 68000, Overview:
Address range What's there
-------------- ------------
000000..01FFFF SYSRAM: System RAM 128kB
040000..043FFF ROM: System ROM 16kB
080000..0BFFFF TGBD: Tone Generator board memory and I/O space
0C0000..0FFFFF DM: Digital Motherboard I/O-ports
100000..17FFFF Some asynchronous I/O-ports
800000..FFFFFF Wave memory (8Mb)
Maybe someone thinks it is odd that there is RAM at address 000000. The
68000 processor always starts reading from address 000000 after reset, so
the reset vector must be at this location.
The answer is that the memory map listed above does not apply at bootup,
beacause the ROM memory is swapped into the space 000000..003FFF by
hardware when a reset is forced (for example at power up). However Yamahas
ROM program switches this back almost immediately and there is no way to
change it again except by forcing a reset, so you don't have to think about
this unless you are reprogramming the ROM (This can be done though, it is
just an ordinary 16kB EPROM which is easy to remove and replace)
The wave memory takes 8Mb of address space even though it actually contains
only 6Mb. This is because only 12 of the 16 databus bits are used.
Someone might notice that there are a lot of "holes" in the memory space.
This is actually not true, the memory locations are "mirrored" and fills
up allmost all the space. For example the ROM memory of 16 kB can be found
at addresses 040000, 044000, 048000, ... , 07C000. Thus there is not much
room for adding more hardware stuff or memory (at least not without modifying
the circuitboard). There are some true holes though:
180000..1FFFFF 512 kB of free memory area
380000..3FFFFF ""
580000..5FFFFF ""
780000..7FFFFF ""
Hardware wizards are welcome to use these addresses. VPA is generated
automatically for these areas though, so as I understand it the transfer must
be synchronized to the E-clock (800kHz) which limits the transfer speed.
___________________________________________________________________________
2.2 000000..01FFFF SYSRAM: System RAM (128 kB)
This is where programs execute. The system program T8WSYS.SYS is loaded into
this memory by Yamaha's boot ROM. This memory is fast, there are no wait states,
except at some rare occasions when refresh is performed by the hardware.
The type of memory is "Pseudo-static" which means that it is dynamic memory
with internal refresh counter (The memory chips are called HM65256BSP-12).
___________________________________________________________________________
2.3 040000..043FFF ROM: System ROM (16kB)
The ROM contains only a simply boot-
strap that loads the file "T8WSYS.SYS" into memory and starts it. The
actual drive routines are located in system RAM and they are NOT that easy
to comprehend.
In this area you will find Yamaha's Boot ROM. I haven't examined all of it,
but it seems to contain some hardware tests and initialisation plus the floppy
boot sequence and nothing more. Because this memory is rather slow (there are
several wait states) the first thing that happens at bootup is that the contents
of the ROM is copied into SYSRAM at address 018000. So most ROM routines are
written to execute in RAM, so don't try to call them at the ROM address (if
you would find any useful procedures, which I haven't). If you want to exchange
the EPROM, use a 16 kB, eight bit EPROM, those chips are usually called 27128
or something like that.
___________________________________________________________________________
2.4 080000..0BFFFF TGBD: Tone generator board memory and I/O space
This area contains all memory and I/O ports of the tone generator circuit board,
except the wave memory.
080000..09FFFF R/W FRAM: Filter circuit RAM (64kB)
This memory is the RAM memory which the filter
controller circuit 63B09E uses for programs and
data. When accessed from the 68000 processor
only even addresses apply, odd addresses are not
connected. This is why the address space is 128kB
even though the memory is only 64kB large.
0A0000 Write MGEW: Control register 1 of the voice generator (GEW)
0A0002 Write MGEW: Control register 2 of the voice generator (GEW)
It seems that these registers can only be written
to, not read. I do not know anything about the
format of the commands that apparently must be
written here, but this is where the sound
generation is controlled !!! Only the lowest
byte of the databus is connected.
0A4000 Write SCCNT: "Halt filter controller" write register
Bit0: 1 asserts the halt input on the 63B09E micro-
controller that controls the filters. The halt
input is asserted until a 0 is written in this
bit.
Bits 1..7: Not connected
0AC000 Write GABC: ??? I don't fully understand this register.
Bit0: EGOFF: A logical 1 in this bit makes the
wave memory inaccessible from the GEW which
increases the transfer rate between the 68000
and the wave memory. 0 in this bit means
that the wave memory bandwidth is shared between
68000 and the voice generator (GEW) and this is
of cource necessary for any sounds to be produced.
I have confirmed this with a test program. The
results are in the section on WRAM.
Bit1: 1 in this bit enables the eight individual outputs
and 0 means that stereo outputs should be used.
Of some reason one of the two filter circuits is
bypassed when this bit is 1. Why ???
Bits 2..7: Not connected
___________________________________________________________________________
2.5 0C0000..0FFFFF DM: 68000 Motherboard I/O ports
This space contains some I/O ports that use the fast 68000 memory bus
Most ports use only the lowest byte of the databus, those can be read/written
either by a byte access to the given address or a word access. In the latter
case the lowest byte contains the byte read.
Warning: By the way, there is a serious error in the text I wrote concerning
I/O port read/writes. If you read/write bytes you have to add 1 to all
addresses. I only read/write words and (using the lowest byte), and then
there is no problem. Sorry about that!
0C0000 Read ADC: reads analogue sampling input
Bit 0 : 1: Left sample, 0: Right sample
(doesn't apply at mono sampling)
Bit 1 : 1: Sample is available, 0: Sample is not ready
(you should poll this pin!)
Bits 2..3: Always 0
Bits 4..15: A/D value
I'm not quite sure how this works. It seems that a read initiates an
Analogue to digital conversion and also reads the results of the previous one.
Also I don't know if the read word is in 2-complemented form, or if it is
an 11 bit integer with a sign bit, but that should be easy to test.
0D0000 PNL: Front panel buttons and LEDs.
0D0000 Read PSW1: Read button group 1 (0 means button is pressed)
Bit0: "1"
Bit1: "2"
Bit2: "3"
Bit3: "-1"
Bit4: "0"
Bit5: "<"
Bit6: ">"
Bit7: "Enter"
0D0002: Read PSW2: Read button group 2 (0 means button is pressed)
Bit0: "7"
Bit1: "8"
Bit2: "9"
Bit3: "-"
Bit4: "4"
Bit5: "5"
Bit6: "6"
Bit7: "+1"
0D0004: Read PSW3: Read button group 3 (0 means button is pressed)
Bit0: "Perform select"
Bit1: "System setup"
Bit2: "Performance edit"
Bit3: "Voice edit"
Bit4: "Filter edit"
Bit5: "Wave edit"
Bit6: "Sample"
Bit7: "Utility"
0D0010: Write Write LED (0 makes the LED turn on)
Bit0: "Perform select"
Bit1: "System setup"
Bit2: "Performance edit"
Bit3: "Voice edit"
Bit4: "Filter edit"
Bit5: "Wave edit"
Bit6: "Sample"
Bit7: "Utility"
The LEDs are funny and easy to play around with! My first program (that worked)
contained a loop which incremented a register and copied the highest byte
to the LEDs. Try it, and you'll notice the speed of the 68000!
0E0000: Read FSW: Read foot switch and detect floppy disk
Bit0: DSKC: If 1 then the disk has been ejected during
the current disk operation (?)
Bit1..6: Not connected
Bit7: Foot switch input
I'm not 100% sure of the function of bit 0, but it is connected to the floppy
drive. The pin is named DSKC in the circuit diagram and is active low.
0F0000: ATT: Some miscellaneous I/O ports
0F0000: Write LVOL: Left channel volume in lowest byte (unsigned)
0F0002: Write RVOL: Right channel volume in lowest byte (unsigned)
0F0004: Write SRT: Write various hardware settings
Bit 7 MONI: Sample input is mixed with the stereo
outputs if this bit is set to 1.
Bit 6 TRIG: The trigger input is disabled if this bit
is set to 0
Bit 5 SH16K: 16kHz LP-filter is enabled if this bit is
set to 1
Bit 4 FREQ: 33kHz stereo LP-filter is enabled and double
(stereo) sampling rate is selected if this
bit is set to 0
Bit 3 SH50K: 50kHz LP-filter is enabled if this bit is
set to 1
Bits 3..0: Selects Frequency or sampling speed, I haven't
figured out how this works yet, but the higher
number the higher speed it seems. Note that bit 3
has another function too (see above)!
0F0006: Write BRT: Sets some features of the RS422 interface
Bits 7..4 Not connected.
Bit 3 Selects configuration: 1=Terminal, 0=Controller
Bit 2..0 Selects clock rate (has no effect if bit 3 is 1
(terminal) because the clock rate is then determined
by the attached (controller) device)
0: 19,2kHz
1: 38,4kHz
2: 76,7kHz
3: 153kHz
4: 307kHz
5: 614kHz
6: 1,23MHz
7: 2,46MHz
This frequency is internally divided by 1, 16 or
64 by the UART chip to form the baud transfer rate.
An interesting "feature" is that software can enable more than one filter at
the same time. The result is that the outputs are mixed together (... perhaps
not very useful ...:-)
It seems to be possible to have transfer rates of up to 2.46 Mbaud !!! But
maybe the 68000 can't read the data stream at that speed ...
___________________________________________________________________________
2.6 100000..17FFFF Some asynchronous ports (old 800kHz bus circuits)
In this area you will find the LCD display, some miscellanous ports and the
two 63B50 (same as 6850) UARTs used for RS422 and MIDI communication aswell
as the WD1772 floppy disk interface circuit. An interesting thing is that both
these chips can be found inside an Atari ST computer and you will find all the
information on how to program them in any good atari-programmers-handbook.
100000 R/W LCD port command/status register.
100002 R/W LCD port data read/write register
If you read 100000 you get a status byte from the LCD display. Writing
to this address initiates a command to the LCD display. The LCD is called
DMC40267UV-YGR and is produced by DMC systems incorporated, I think. They
will probably send you the datasheets (with info on the meaning of status
bits and the command format) for free if you phone them up (I did that).
100020 R/W FDC port command/status register
100022 R/W FDC port track register
100024 R/W FDC port sector register
100026 R/W FDC port data read/write register
The floppy disk controller (FDC) is called WD1772PH-02 and is produced by
Western digital. As with the display, the manufacturer will most certainly
give you the information you need to program it if you call him up. As
mentioned before you can also look in any atari programmers reference book.
100040 Write FDD port
Bit7: Side select (0 or 1)
Bit5: Select drive 2 (1 to select)
Bit4: Select drive 1 (1 to select)
Drive 1 is the one to select (because there is only one drive present)
Apparently it is possible to connect another drive, but the 1772 does only
work with 720 kB disk drives (not 1.44 MB) so I can't see any purpose of
connecting more disk drives. I have heard of pin compatible chips that
handles 1.44 Mbyte drives though. Maybe this chip can be replaced?
100060 Read Timer reset
A read at this address acknownledges a timer interrupt (which occurs every
2.56 ms) and must be performed by the timer interrupt handler (see the info
on interrupts). No data are read.
100080 MIDI UART Command/Status port
100082 MIDI UART Data read/write port
1000A0 RS422 UART Command/Status port
1000A2 RS422 UART data read/write port
Both MIDI and RS422 are handled by 63B50 chips as mentioned above. They are
produced by Motorola and are used in a number of other systems, including
the ATARI ST as mentioned.
___________________________________________________________________________
2.7 800000..FFFFFF WRAM: Wave memory (1.5MB .. 6MB)
This memory is the four banks of dynamic ram memory used for storing the
sample waves. It is not as fast as the SYSRAM because it is shared with the
voice generator chip (see also the info on I/O port 0AC000 bit 0) as well as
refresh logic. The word size of the memory is 12 bits which means that a word
read/write operation from the 68000 produces the following result:
68000 data bus WRAM data
-------------- ---------
Bits 0..3 Not connected
Bits 4..15 Bits 0..11 of wave ram word
Byte write operations are not supported! If you try to write a byte, the
other byte in the word you are accessing will be cleared!
The memory chips are called TC511000J-12. Any 120ns (or less), 1Mx1bit dynamic
memory chips should be OK to use if you want to expand your memory yourself.
The WRAM memory is somewhat slower than the PSRAM memory when accessed by the
processor. According to a test program I made, each access to the WRAM memory
takes about 7 clock cycles (0.873 us measured) more than the same access in
PSRAM, or 10 clock cycles (1.26 us measured) if bit 0 of port AC000 is 1.
___________________________________________________________________________
3. Interrupts
The 68000 interrupt levels are the following:
Level 1: Timer (Lowest priority)
Level 2: MIDI
Level 3: RS422
Level 4..7: Not connected
Timer interrupt:
This interrupt is produced every 2.56 ms by hardware according to the circuit
diagram. The interrupt signal comes from a divide-by-128 counter which in
turn is connected to an output named SYW from the GEW (voice generator) chip. I
don't know what this is or if it can be turned off by programming the GEW, but
the timer signal is marked "2.56m" in the circuit diagram, and I have verified
that it is normally asserted every 2.56 ms. The interrupt input is asserted until
the interrupt service routine acknownledges the interrupt by reading the
address 100060.
MIDI and RS422 interrupt:
These interrupts are generated by the 63B50 UART chips. Software can program
these chips to generate interrupts when a character has been recieved and
optionally also when a character has been transmitted.
At higher baudrates (RS422, more than say 200 kBaud) it is wise to turn off
all interrupts and poll the port instead, because otherwise data may be lost.
___________________________________________________________________________
4. T8WSYS.SYS file format
You can use this format of the T8WSYS.SYS file to make it boot your program:
WORD Contents
---- --------
0,1 Long word (32bit) offset to the code entry point of this
file. This is where you put the address to wherever you want
execution to begin (relative to the start of the file).
2,3 Long word (32bit) length of the t8wsys.sys file.
4, ... Code and Data
The file seems to be loaded at address 000400 (hex), at least with my BIOS
version.
To generate the two first longwords I have made a small C-program for my PC
that converts motorola standard output file (that is the output format of my
68000 compiler) to the t8wsys.sys format. I will send that to anyone
interested, just send me a mail.
___________________________________________________________________________
5. Hello world, a programming example
This is a short example of a program that prints the text "Hello World" on
the LCD screen.
*******************************************************************************
NAME hello_world
TITL 'This program prints on TX16W'
* Some status and command codes and addresses for the LCD
lcd_clear = $1
lcd_busy = $80
lcd_instr = $100000
lcd_status = $100000
lcd_data = $100002
rseg main
* This is the programs entry point. The offset to this position in the
* t8wsys.sys file must be in the first longword of the file.
start:
bsr F_LCDclr
pea text(pc)
bsr F_LCDprint
addq #4,sp
* Eternal loop! This is where you have to turn off and reboot the TX16W.
suicide:
bra suicide
* This procedure clears the LCD-screen, positions cursor at upper left corner
* and restores all display shifts.
F_LCDclr:
bsr.s F_LCDwait
move.w #lcd_clear,lcd_instr
rts
* This function waits until busy-flag goes low.
F_LCDwait:
move.w d0,-(a7)
wait_loop1:
move.w lcd_status,d0
and.w #lcd_busy,d0
bne.s wait_loop1
move.w (a7)+,d0
rts
* This procedure prints a string to the current cursor position.
*
* !!! String must be NULL-terminated.
*
* Uses:
* F_LCDputc
*
* Parameters:
* L : Address to string.
F_LCDprint:
move.l a0,-(a7)
move.l 8(a7),a0
print_loop1:
bsr F_LCDwait
move.b (a0)+,d0
beq.s print_eos
move.w d0,lcd_data
bra.s print_loop1
print_eos:
move.l (a7)+,a0
rts
text:
dc.w 'Hello World',0
end
********************************************************************************
This is the uu-encoded compiled file (92 bytes long). Just uudecode it and
copy it to a TX16W formatted disk and boot your TX16W with it.
begin 644 t8wsys.sys
M````"````%QA```.2'H`0&$``"183V#^80HS_``!`!```$YU/P`P.0`0``#`
M?`"`9O0P'TYU+P@@;P`(8>80&&<(,\``$``"8/(@7TYU2&5L;&\@5V]R;&0`
"````
`
end
********************************************************************************
__________________________________________________________________________
6.0 The disk format
The physical format of a TX16W disk is:
* 80 Tracks
* Double sided
* Double density
* 9 sector per track and side
* 512 bytes per sector
Each track concists of the following:
(All values are in hex, nnxmm means nn repeated bytes of mm)
Gap 1: Ca 82x4E
Nine sector groups containing:
{
Gap 2: 0Cx00
03xCRC-Null
Index: 01xFE (Index)
01xTrack nr (0 - 4F)
01xSide (0 or 1)
01xSector (1 - 9)
01x02 (Sector size 512 bytes)
02xCRC-Sum
Gap 3: 16x4E
0Cx00
03xCRC-Null
Data: 01xFB (Data mark)
200x00 (Actual data!)
02xCRC-Sum
Gap 4: 36x4E
}
Gap 5: Ca 200x4E (Until next index pulse)
Each CRC-Null byte is written as F5 (hex) when formatting, while the
doublet of CRC-Sum bytes is written F7 (hex). (Thus one F7 byte creates
two CRC bytes on the disk!)
To format a disk you use the "write track" command of the floppy controller
chip and write the above data. After that you write the correct information
to sectors 1,2 and 5 as described below, using the "write sector" command.
There are two sectors on track 0, side 1 that can't be accessed (a
primitive copy-protection !?). The secret is simply that the sector
number 0 has been written in the index field of those two sectors!
This must be done for Yamaha OS to accept the disk.
The logical disk format:
* MSX-DOS (very close related to MS-DOS and Atari-DOS)
* 12 bit FAT
1.) Sectors 1/2 on track 0,side 1 are both renumbered as sector "0". The
TX refuses to operate if it cannot find a sector "0" on this
track. The cluster that is lost by these sectors is marked bad in the FAT.
2.) The disk has two FATs ( File Allocation Tables ), but the TX reads and
writes only the first one. This is the reason why a TX disk is unreadable
by an Atari ST computer, which usually uses the 2nd FAT.
You can read and write the disks on IBM compatibles, Amigas,
Macintoshes and Ataris (with standard MSDOS emulators).
Sector 1 is the Bootsector containing information about the
disk format and a small bootstrap program. The disk format is contained in
the BPB (BIOS Parameter Block) which starts at position 0B (hex) in
sector 1.
BPB valid entries: (Offsets are from BPB start at offset 0B in sector 1)
Offset: Value: MS-DOS value Meaning:
00 0200 Same 200 bytes per sector
02 02 Same 2 sectors per cluster
03 0001 Same Number of reserved sectors
05 02 Same Number of FAT copies
06 0070 Same Maximum nr of root directry entries
08 05A0 Same Total nr of sectors on disk
0A FE FD Media descriptor
0B 0003 0002 Nr of sectors per FAT
0D 0009 Same Nr of sectors per track
Sectors 2-4 contain the first copy of the 12-bit FAT.
Sectors 5-7 contain the second copy of the 12-bit FAT.
FAT format:
The FAT keeps track of the use of all clusters on the disk and how they
are chained together. Each FAT entry is 12-bit long. It works like this:
Two entries: (Three bytes) AB CD EF
First cluster entry: DAB
Second cluster entry: EFC
Meaning of a FAT entry: 000 Not used
002..FF6 Pointer to the next cluster
in the chain
FF7 Bad cluster
FF8..FFF Last cluster in chain
Sectors 8-14 contain the root directory ("almost" MSDOS compatible)
Clusters 0 and 1 are reserved and cannot be used. Cluster 2 is marked
bad in the FAT (the bad sectors 15 and 16). Cluster 3 - 714 can be used.
Thus, the first three FAT entries of a formatted disk contain FF9, FFF, FF7,
which means that the first six bytes contain F9,FF,FF,F7,0F,00.
-------------------------------------------------------------------------------
Copy protection on Yamaha Disks ********************************************
The protection on the files is done by changing the 7th byte. The first couple
bytes of a protected file look like:
(character): L M 8 9 5 3 02
(hex): 4c 4d 38 39 35 33 02
The 7th byte is usually a "02" or "01". To unprotect, change this byte to 0.
Some disks have protection on the setup files only; others, the wave files as
well.
This c code will change the 7th byte to 0:
main(argc, argv)
int argc;
char **argv;
{
FILE *music;
if (argc != 2) {
exit(1);
}
if (!(music = fopen(argv[1], "r+b"))) {
printf("can't open %s\n", argv[1]);
exit(1);
}
fseek(music, 6L, SEEK_SET);
putc(0, music);
fclose(music);
}
_____________________________________________________________________________
7.0 TX Wave Format:
The file consists of a 32 byte header followed by the actual waveform
(the first 16 bytes only identifies the file type). In C syntax the
header would look like this:
char filetype[6] = "LM8953";
char nulls[10];
char dummy_aeg[6]; /* space for the AEG (never mind this) */
char format; /* 0x49 = looped, 0xC9 = non-looped */
char sample_rate; /* 1 = 33 kHz, 2 = 50 kHz, 3 = 16 kHz */
char atc_length[3]; /* I'll get to this... */
char rpt_length[3];
char unused[2]; /* set these to null, to be on the safe side */
The "atc_length" and "rpt_length" fields are quite complex. First of
all you should know that there is no such thing as a looping point in a
TX wave. Instead a wave is split into two parts, the attack part and
the repeat part (of course the actual wave data isn't split, this is
just a logical definition). As you might guess, the attack part is
played first and the repeat part is looped until the key is released.
Each of these parts are limited to a maximum of 128k words in length.
That is the reason why waves can't be longer than 256k words (4096
blocks).
The length of a part is stored LSB first (Intel). And only the least
significant _bit_ of the third byte (bit 0) is used (representing the
most significant bit of the length).
Are you confused yet? Then hold your breath. It seems that Yamaha has
chosen to squeeze in the sample rate(!) of the wave in the unused _bits_
of these last bytes. Although they already have a separate byte for the
sample rate, this isn't enough. I won't go into details on this now (or
you would be even more confused). You only need to know that the
possible values are:
0x06, 0x52 = 33 kHz
0x10, 0x00 = 50 kHz
0xF6, 0x52 = 16 kHz
(The first value is located in byte three of "atc_length" and the second
value is located in byte three of "rpt_length".)
To wrap it up, this is the format of the two length fields on a bit
level:
[0] [1] [2]
atc_length AAAAAAAA BBBBBBBB DDDDDDDC
rpt_length EEEEEEEE FFFFFFFF HHHHHHHG
A = LSB of the attack length
B = MSB of the attack length (except for one bit)
C = the utterly most significant _bit_ of the attack length
D = the first value of the magic sample rate constant (0x06, 0x10 or
0xF6)
E = LSB of the repeat length
F = MSB of the repeat length (except for one bit)
G = the utterly most significant _bit_ of the repeat length
H = the second value of the magic sample rate constant (0x52, 0x00)
Now for the most important (and probably most interesting) part. The
waveform data. As you certainly know the TX uses 12-bit sampling
resolution, and this requires some kind of encoding if we are not
willing to waste one fourth of our disk space. Yamaha has chosen to
group the samples two by two, making three bytes of data in the file for
each pair. I'll illustrate this on a bit level (as with the lengths
above):
AA CD BB
A = MSB of the first sample
B = MSB of the second sample
C = least significant nybble (oh, is that the correct spelling?) of the
first sample
D = least signiticant nybble of the second sample
|
