It is currently Fri Oct 20, 2017 4:42 pm

All times are UTC - 7 hours



Forum rules


Related:



Post new topic Reply to topic  [ 83 posts ]  Go to page 1, 2, 3, 4, 5, 6  Next
Author Message
PostPosted: Tue Mar 01, 2016 6:51 pm 
Offline

Joined: Mon Mar 27, 2006 5:23 pm
Posts: 1338
Hope it's okay to post; image available here: http://bsxproj.superfamicom.org/snes/

Initial analysis: http://hastebin.com/evodajoxas.coffee

The cartridge is boring and is just a regular program.
Command interface is $21e0-$21e5, which is the BIOS talking to the SuperDisc hardware.

Code:
w$21e0 = ???

r$21e1 = status?
  d7 => 0 = ready, 1 = busy ??

w$21e1 = ???

w$21e2 = command select

r$21e3 = read command (see below)
w$21e3 = write command (see below)

w$21e4 = enable? (writes #$0e at boot-up; #$00 after failing to detect drive)
  d0 = ???
  d1 = ???
  d2 = ???
  d3 = ???

w$21e5 = ???


The BIOS helpfully contains cryptic names for all commands.

Code:
[Write Mode]
w$21e2 = command select
w$21e3 = send
  01    = DRIF
  02    = CHCT (#$10 written here to exist SFX-100 MONITOR MENU)
  03    = DECT
  04    = INMS
  05    = INCL
  06    = CI
  07,08 = DMAD  (ex: $21e2=#$07, $21e3=#$00, $21e3=#$10 => DMA = #$1000)
  09,0A = DMXF
  0B,0C = DRAD
  0D    = PLBA

[Read Mode]
w$21e2 = command select
r$21e3 = receive (called once or twice)
  00    = DMA
  01    = INST
  02    = STS
  03    = HFLG
  X4    = HMIN (04 ... guessing the X means "there's more than one of these", eg 14, 24, etc)
  X5    = HSEC (05)
  X6    = HBLK (06)
  X7    = HMOD (07)
  08    = SFIL
  09    = SCH
  0A    = SMOD
  0B    = SCI
  0C,0D = CMAD
  XE    = MDFM (0E)
  XF    = ADPC (0F)
  18,19 = DMXF
  1A,1B = DMAD
  1C,1D = DRAD


The IRQ vector points to RAM in the BIOS, and for good reason: it doesn't seem to bother reading out results to any of its diagnostic tests or power-on test. There's nothing one can return from $21ex that will get any of that stuff to pass. Looks like the expansion port unit is firing off IRQs, and the BIOS then waits for bits in WRAM to be set by the IRQ routines to proceed.

I'm going to wire up a skeleton emulation of the device so that I can trigger IRQs in response to writes, but I'm very unlikely to try and emulate the entire thing. Really kind of pointless, just something to do for fun I guess.

Really need to find a patent or tech sheet on the CXD18000.


Top
 Profile  
 
PostPosted: Wed Mar 02, 2016 6:46 am 
Offline

Joined: Mon Mar 27, 2006 5:23 pm
Posts: 1338
The 128KiB expansion RAM is located at $80-87:8000-ffff
The 8KiB backup RAM is located at $90:8000-9fff
Thus, the ROM is only mapped to $00-7d:8000-ffff

The self-test writes #$00 to $40-6f,c0-ef:0000-ffff, which is kind of insane. That's why it takes so long to run.

With that, I can pass the RAM tests.

On boot-up, it only writes to $21ex registers, waits a bit, then says the CD drive isn't present.

I rigged things up to fire off IRQs from the expansion port ... doesn't appear that they do anything except write more commands to the $21ex registers.

http://hastebin.com/adigihatih.pl

As such, I don't know how to make the BIOS think the CD drive is there.

If it helps:

Here is the cartridge => http://40.media.tumblr.com/2f1a7bf00401 ... e_1280.jpg
Nothing special at all. Very boring.

Here is part of the base unit => http://36.media.tumblr.com/8a6ebfe6a100 ... e_1280.jpg


Top
 Profile  
 
PostPosted: Wed Mar 02, 2016 12:31 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6288
Location: Seattle
It looks like at least one, if not both, of the on-cartridge S-WRAMs are also mapped into PA addresses... but I haven't yet looked to see if the cartridge tests that.


Top
 Profile  
 
PostPosted: Wed Mar 02, 2016 1:18 pm 
Offline

Joined: Mon Mar 27, 2006 5:23 pm
Posts: 1338
> It looks like at least one, if not both, of the on-cartridge S-WRAMs are also mapped into PA addresses

The two S-RAM chips are mapped to $80-87:8000-ffff. That's 128KiB of RAM. The 8KiB CMOS RAM chip is mapped to $90:8000-9fff. I mentioned this already but, now I mentioned it twice.


Top
 Profile  
 
PostPosted: Wed Mar 02, 2016 1:57 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6288
Location: Seattle
No, no, to addresses in the $21xx range. Pins 43-58 are connected to something.


Top
 Profile  
 
PostPosted: Wed Mar 02, 2016 3:24 pm 
Offline

Joined: Mon Nov 10, 2008 3:09 pm
Posts: 429
Those S-WRAMs look like the same chip as the one in the base SNES unit. If they are, then each of them should have its own data and address ports (equivalent to $2180-$2183) mapped somewhere on the B-bus.

$80-87:8000-ffff is 256K, not 128K. That's further evidence that each of the RAMs is the same chip as the one in the SNES.


Top
 Profile  
 
PostPosted: Wed Mar 02, 2016 8:52 pm 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
You know, the second pic mentions S-PPU memory... does that mean it would expand it to 128KB?


Top
 Profile  
 
PostPosted: Thu Mar 03, 2016 1:18 am 
Offline

Joined: Mon Mar 27, 2006 5:23 pm
Posts: 1338
Oh, sorry. Was thinking the WRAM was two chips like VRAM for some reason. Should have just done the math, 32K*8=256K.

Yeah okay then, 80-87:8000-ffff is 256KiB RAM, and 90:8000-9fff is 8KiB RAM. Apparently the test passes even if you treat it as 128KiB.

> You know, the second pic mentions S-PPU memory

For unknown reasons, they merged the SNES and the expansion port CD drive into one unit here. Would have thought even their prototypes would have targeted piggybacking on a standard SNES unit, but nope.

If it went to retail as one merged unit, that'd be quite ridiculous since everyone would have to rebuy the SNES guts. And you'd be limiting the architecture hardware by 4-6 years when you could just use newer stuff, and lose the cartridge entirely.

But, who knows what they were thinking. This was early enough in that it could have gone in any direction. I would be really surprised if they didn't end up with some coprocessor power in the BIOS cartridge (or at least the base unit) for a final version, had the product made it to market.


Top
 Profile  
 
PostPosted: Thu Mar 03, 2016 6:51 am 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Not sure if this is helpful, but you can hold down X and A at startup or the "NO CD-ROM SYSTEM" screen to get access to some internal testing features that correlate with bits shown so far. This might help in debugging emulation efforts. If folks already knew this, apologies for wasting time.


Top
 Profile  
 
PostPosted: Thu Mar 03, 2016 8:07 am 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
byuu wrote:
For unknown reasons, they merged the SNES and the expansion port CD drive into one unit here.

Oh right, forgot that this isn't an add-on but actually a self-contained thing.


Last edited by Sik on Sun Mar 06, 2016 7:38 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sun Mar 06, 2016 2:42 am 
Offline

Joined: Mon Mar 27, 2006 5:23 pm
Posts: 1338
Research for today:

https://twitter.com/byuu_san/status/706409922339041280

Still not really sure of things, but if I treat $21e4 bits as some sort of IRQ enable, it looks like the "CD-ROM Decoder" is checking for 70 - 80 IRQs in one second (60 video frames) worth of time. Ryphecha pointed out that this matches 75 frames (sectors) per second for a 1X CD-ROM drive. This is actually the only thing that test actually checks. It's not actually validating the decoding in any way.

The boot-up sequence needs $21e3.d4 set for read command 0x01, and then it checks $21e4 and expects d7 to be set. This is tricky because if d7 is set on power-on, it'll hang forever waiting for the bit to be clear. After avoiding that issue, it checks d3-d0 and treats that as "disc status" or something. It can be "no disc, press start (super disc), musc disc, tray open, not defined" A lot of seemingly duplicate entries, especially for music disc. Whatever.

The music disc mode doesn't seem to do anything. Boo.

The press start -> now loading sequence executes an obscene amount of commands to the $21ex interface, and ultimately fails with disc error for now. But it seems pretty obvious that this is our disc loading routine. If we can figure out how to tell where it's trying to seek to on the disc, and what it's trying to read back, we should be able to ultimately get it to load data off a virtual disc, and I would presume execute it.

Will likely be a lot of work for very little reward.

Also, no idea why, but the timer test starts failing if the boot menu does anything but detect the cd-rom system is not present. Even though it's not touching $21ex at all, and not firing any IRQs at all. Going to have to trace out the routine and see why it's failing :/


Top
 Profile  
 
PostPosted: Sun Mar 06, 2016 7:43 am 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
byuu wrote:
A lot of seemingly duplicate entries, especially for music disc.

All the music disc ones need bit 0 to be clear. Maybe that bit is used to tell apart data tracks from audio tracks or something like that?


Top
 Profile  
 
PostPosted: Sun Mar 06, 2016 8:23 am 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 19110
Location: NE Indiana, USA (NTSC)
One of the bits in each sector's Q subcode channel is turned off for music discs and on for data. Very old audio CD players ignore this bit; later players silence the DAC when it is true.

Once, back when Time Warner owned AOL, MAD magazine issue 350 distributed a 3-song CD single titled MAD Bytes It!. The track listing:
  1. Moment of Silence in Memory of the Thousands of Jokes that appeared in the Pages of MAD
  2. Barely Alive
  3. Blind Date
  4. It's a Gas
One could be forgiven for thinking that track 1 was analogous to the minute of silence that opened Follow the Leader by Korn. But it was actually the AOL client installer, with the Q channel's data bit turned on. One player I owned would play the usual digital noise for the AOL installer part (track 1); the rest silenced it.


Top
 Profile  
 
PostPosted: Sun Mar 06, 2016 11:49 am 
Offline

Joined: Thu Aug 12, 2010 3:43 am
Posts: 1589
OK, going by the assumption that bit 0 indicates whether there's an appropriate data track or not, that reduces the list like this:
Code:
000x = no disc / push start
001x = music disc / push start
010x = music disc / not defined
011x = music disc / not defined
100x = music disc / not defined
101x = access / access
110x = tray open / not defined
111x = music disc / not defined

Now, I haven't checked the code, but I have a gut feeling that the actual possible values are more like this:
Code:
000x = no disc / push start
001x = music disc / push start
101x = access / access
110x = tray open / not defined

Which would give us:
  • 000x = no disc inserted
  • 001x = disc inserted and ready
  • 101x = disc inserted and in use
  • 110x = tray is opened

I'd assume you can't rely on bit 0 being of any use in the last two cases. Given how tray open is only mentioned with bit 0 being clear, and that the drive really can't even access tracks when the disc isn't inserted =P I wouldn't be surprised if bit 0 is forced clear while the tray is open.

Take this with a grain of salt since this is all pure guesswork, but it could be a good starting point to check if it's actually true.


Top
 Profile  
 
PostPosted: Sun Mar 06, 2016 2:45 pm 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 37
What I'm thinking about the music disc: This might be when the controls on the unit itself may come in handy if the BIOS doesn't do anything.

It should be mentioned that we've also found that it MAY use $21D0. But it always writes 0x00 to it. (STZ $21D0)
No idea what it is.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 83 posts ]  Go to page 1, 2, 3, 4, 5, 6  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: melanokardios, Yahoo [Bot] and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group