vgmrips

ctr: in your disassembly, could you find where the UART of the CPU is initialized? The hardware manual (pg 251) suggests BRR (Bit Rate Register) at 0xFFD9 and SMR (Serial Mode Register) at 0xFFD8. It runs at most at 38400 baud, I'd like to increase that as much as possible, to decrease MIDI latency. In fact, I think the baud rate is set by reading the switch at the back of the unit, "HOST SELECT SW 2/2", which connects to pin 54 AN1 (analog input probably). I suspect it might be polling that analog pin occasionally, or perhaps generating an interrupt when its value changes. Either way, the baud rate can be either 31250 or 38400, and I'd like to modify the ROM so that when it's set to 38400, it would be much higher instead.

Edit: it looks like the SCK1 pin is just pulled low with a resistor, and not tied to anything else, so I could use it for synchronous communication, which is faster, though something tells me might have some snags when implementing. Still worth looking into IMO. Even with asynchronous mode, the table at pg 264 suggests it is easily possible to get 312500 baud with the 20MHz clock. That would be fine if it means just altering a couple of bytes in the ROM.

_________________
Follow me on twitter.

If you like this post, give it a big thumbs up and hit that subscribe button down below! And as always, thanks for reading, and see you next post.

Thanks, I think I see what I have to do.

In the meanwhile here's the demo song recorded digitally by intercepting the data sent to the DAC and streaming it through an USB device.



I used one of these cheap $2 blue pill STM32 boards for that:



Well, that and over a year's worth of learning and experience with STM32 and USB coding.

_________________
Follow me on twitter.

If you like this post, give it a big thumbs up and hit that subscribe button down below! And as always, thanks for reading, and see you next post.

I am getting ready to end this project. Researching and emulating the DSP chip will have to be someone else's task. I have gathered some service manuals of Yamaha devices that use it. It seems that the YM3413 "LDSP" usually comes paired with the "GEW8" YMW258-F. There is a serial send and receive signal on the YMW, and some more signals that connect them together. There would be a good start for data capture, an 8 channel logic analyzer would work fine. The LDSP seems to require its own RAM, and somehow the gate array is also involved. I am not sure what is up with that. I am also certain that it is possible to figure out what the CPU is sending in Test 10 mode, DSP test. It is probably sending a reverb program (that's what the test sounds like, especially when starting and stopping) to the LDSP and then playing a sine wave in the GEW8 and passing it through the LDSP.

Edward d-tech's page lists the following Yamaha products, some of which are easy to track down and cheap to get second hand, for anyone willing to get their hands on these chips and reverse engineer them all the way.

For GEW8: MU-5, PSS-51, PSR-200, PSR-210, PSR-215, PSR-300, PSR-310, PSR-400, PSR-410, PSR-500, PSR-510, PSR-600, QR-10, QY-20, TG-100
For LDSP: FX-900, PSR-220, PSR-230, PSR-500, PSR-510, PSR-5700, PSR-6700, R100, TG-33, TQ-5, EW-20, SY-22, SY-35, SY-55, SY-77, TG-100, TQ-5, V-50, YSS-100, YSS-200, CLARION DSP-959

I think someone with a 16 channel logic analyzer will have no trouble reversing these puppies, so good luck.

_________________
Follow me on twitter.

If you like this post, give it a big thumbs up and hit that subscribe button down below! And as always, thanks for reading, and see you next post.