SuperDisc BIOS released + analysis [attn: nocash]

Discussion of hardware and software development for Super NES and Super Famicom. See the SNESdev wiki for more information.

Moderator: Moderators

Forum rules
  • For making cartridges of your Super NES games, see Reproduction.
Near
Founder of higan project
Posts: 1553
Joined: Mon Mar 27, 2006 5:23 pm

SuperDisc BIOS released + analysis [attn: nocash]

Post by Near »

Hope it's okay to post; image available here: http://bsxproj.superfamicom.org/snes/

Initial analysis: http://hastebin.com/evodajoxas.coffee

The cartridge is boring and is just a regular program.
Command interface is $21e0-$21e5, which is the BIOS talking to the SuperDisc hardware.

Code: Select all

w$21e0 = ???

r$21e1 = status?
  d7 => 0 = ready, 1 = busy ??

w$21e1 = ???

w$21e2 = command select

r$21e3 = read command (see below)
w$21e3 = write command (see below)

w$21e4 = enable? (writes #$0e at boot-up; #$00 after failing to detect drive)
  d0 = ???
  d1 = ???
  d2 = ???
  d3 = ???

w$21e5 = ???
The BIOS helpfully contains cryptic names for all commands.

Code: Select all

[Write Mode]
w$21e2 = command select
w$21e3 = send
  01    = DRIF
  02    = CHCT (#$10 written here to exist SFX-100 MONITOR MENU)
  03    = DECT
  04    = INMS
  05    = INCL
  06    = CI
  07,08 = DMAD  (ex: $21e2=#$07, $21e3=#$00, $21e3=#$10 => DMA = #$1000)
  09,0A = DMXF
  0B,0C = DRAD
  0D    = PLBA

[Read Mode]
w$21e2 = command select
r$21e3 = receive (called once or twice)
  00    = DMA
  01    = INST
  02    = STS
  03    = HFLG
  X4    = HMIN (04 ... guessing the X means "there's more than one of these", eg 14, 24, etc)
  X5    = HSEC (05)
  X6    = HBLK (06)
  X7    = HMOD (07)
  08    = SFIL
  09    = SCH
  0A    = SMOD
  0B    = SCI
  0C,0D = CMAD
  XE    = MDFM (0E)
  XF    = ADPC (0F)
  18,19 = DMXF
  1A,1B = DMAD
  1C,1D = DRAD
The IRQ vector points to RAM in the BIOS, and for good reason: it doesn't seem to bother reading out results to any of its diagnostic tests or power-on test. There's nothing one can return from $21ex that will get any of that stuff to pass. Looks like the expansion port unit is firing off IRQs, and the BIOS then waits for bits in WRAM to be set by the IRQ routines to proceed.

I'm going to wire up a skeleton emulation of the device so that I can trigger IRQs in response to writes, but I'm very unlikely to try and emulate the entire thing. Really kind of pointless, just something to do for fun I guess.

Really need to find a patent or tech sheet on the CXD18000.
Near
Founder of higan project
Posts: 1553
Joined: Mon Mar 27, 2006 5:23 pm

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Near »

The 128KiB expansion RAM is located at $80-87:8000-ffff
The 8KiB backup RAM is located at $90:8000-9fff
Thus, the ROM is only mapped to $00-7d:8000-ffff

The self-test writes #$00 to $40-6f,c0-ef:0000-ffff, which is kind of insane. That's why it takes so long to run.

With that, I can pass the RAM tests.

On boot-up, it only writes to $21ex registers, waits a bit, then says the CD drive isn't present.

I rigged things up to fire off IRQs from the expansion port ... doesn't appear that they do anything except write more commands to the $21ex registers.

http://hastebin.com/adigihatih.pl

As such, I don't know how to make the BIOS think the CD drive is there.

If it helps:

Here is the cartridge => http://40.media.tumblr.com/2f1a7bf00401 ... e_1280.jpg
Nothing special at all. Very boring.

Here is part of the base unit => http://36.media.tumblr.com/8a6ebfe6a100 ... e_1280.jpg
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by lidnariq »

It looks like at least one, if not both, of the on-cartridge S-WRAMs are also mapped into PA addresses... but I haven't yet looked to see if the cartridge tests that.
Near
Founder of higan project
Posts: 1553
Joined: Mon Mar 27, 2006 5:23 pm

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Near »

> It looks like at least one, if not both, of the on-cartridge S-WRAMs are also mapped into PA addresses

The two S-RAM chips are mapped to $80-87:8000-ffff. That's 128KiB of RAM. The 8KiB CMOS RAM chip is mapped to $90:8000-9fff. I mentioned this already but, now I mentioned it twice.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by lidnariq »

No, no, to addresses in the $21xx range. Pins 43-58 are connected to something.
AWJ
Posts: 433
Joined: Mon Nov 10, 2008 3:09 pm

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by AWJ »

Those S-WRAMs look like the same chip as the one in the base SNES unit. If they are, then each of them should have its own data and address ports (equivalent to $2180-$2183) mapped somewhere on the B-bus.

$80-87:8000-ffff is 256K, not 128K. That's further evidence that each of the RAMs is the same chip as the one in the SNES.
Sik
Posts: 1589
Joined: Thu Aug 12, 2010 3:43 am

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Sik »

You know, the second pic mentions S-PPU memory... does that mean it would expand it to 128KB?
Near
Founder of higan project
Posts: 1553
Joined: Mon Mar 27, 2006 5:23 pm

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Near »

Oh, sorry. Was thinking the WRAM was two chips like VRAM for some reason. Should have just done the math, 32K*8=256K.

Yeah okay then, 80-87:8000-ffff is 256KiB RAM, and 90:8000-9fff is 8KiB RAM. Apparently the test passes even if you treat it as 128KiB.

> You know, the second pic mentions S-PPU memory

For unknown reasons, they merged the SNES and the expansion port CD drive into one unit here. Would have thought even their prototypes would have targeted piggybacking on a standard SNES unit, but nope.

If it went to retail as one merged unit, that'd be quite ridiculous since everyone would have to rebuy the SNES guts. And you'd be limiting the architecture hardware by 4-6 years when you could just use newer stuff, and lose the cartridge entirely.

But, who knows what they were thinking. This was early enough in that it could have gone in any direction. I would be really surprised if they didn't end up with some coprocessor power in the BIOS cartridge (or at least the base unit) for a final version, had the product made it to market.
User avatar
koitsu
Posts: 4201
Joined: Sun Sep 19, 2004 9:28 pm
Location: A world gone mad

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by koitsu »

Not sure if this is helpful, but you can hold down X and A at startup or the "NO CD-ROM SYSTEM" screen to get access to some internal testing features that correlate with bits shown so far. This might help in debugging emulation efforts. If folks already knew this, apologies for wasting time.
Sik
Posts: 1589
Joined: Thu Aug 12, 2010 3:43 am

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Sik »

byuu wrote:For unknown reasons, they merged the SNES and the expansion port CD drive into one unit here.
Oh right, forgot that this isn't an add-on but actually a self-contained thing.
Last edited by Sik on Sun Mar 06, 2016 7:38 am, edited 1 time in total.
Near
Founder of higan project
Posts: 1553
Joined: Mon Mar 27, 2006 5:23 pm

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Near »

Research for today:

https://twitter.com/byuu_san/status/706409922339041280

Still not really sure of things, but if I treat $21e4 bits as some sort of IRQ enable, it looks like the "CD-ROM Decoder" is checking for 70 - 80 IRQs in one second (60 video frames) worth of time. Ryphecha pointed out that this matches 75 frames (sectors) per second for a 1X CD-ROM drive. This is actually the only thing that test actually checks. It's not actually validating the decoding in any way.

The boot-up sequence needs $21e3.d4 set for read command 0x01, and then it checks $21e4 and expects d7 to be set. This is tricky because if d7 is set on power-on, it'll hang forever waiting for the bit to be clear. After avoiding that issue, it checks d3-d0 and treats that as "disc status" or something. It can be "no disc, press start (super disc), musc disc, tray open, not defined" A lot of seemingly duplicate entries, especially for music disc. Whatever.

The music disc mode doesn't seem to do anything. Boo.

The press start -> now loading sequence executes an obscene amount of commands to the $21ex interface, and ultimately fails with disc error for now. But it seems pretty obvious that this is our disc loading routine. If we can figure out how to tell where it's trying to seek to on the disc, and what it's trying to read back, we should be able to ultimately get it to load data off a virtual disc, and I would presume execute it.

Will likely be a lot of work for very little reward.

Also, no idea why, but the timer test starts failing if the boot menu does anything but detect the cd-rom system is not present. Even though it's not touching $21ex at all, and not firing any IRQs at all. Going to have to trace out the routine and see why it's failing :/
Sik
Posts: 1589
Joined: Thu Aug 12, 2010 3:43 am

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Sik »

byuu wrote:A lot of seemingly duplicate entries, especially for music disc.
All the music disc ones need bit 0 to be clear. Maybe that bit is used to tell apart data tracks from audio tracks or something like that?
tepples
Posts: 22708
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by tepples »

One of the bits in each sector's Q subcode channel is turned off for music discs and on for data. Very old audio CD players ignore this bit; later players silence the DAC when it is true.

Once, back when Time Warner owned AOL, MAD magazine issue 350 distributed a 3-song CD single titled MAD Bytes It!. The track listing:
  1. Moment of Silence in Memory of the Thousands of Jokes that appeared in the Pages of MAD
  2. Barely Alive
  3. Blind Date
  4. It's a Gas
One could be forgiven for thinking that track 1 was analogous to the minute of silence that opened Follow the Leader by Korn. But it was actually the AOL client installer, with the Q channel's data bit turned on. One player I owned would play the usual digital noise for the AOL installer part (track 1); the rest silenced it.
Sik
Posts: 1589
Joined: Thu Aug 12, 2010 3:43 am

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by Sik »

OK, going by the assumption that bit 0 indicates whether there's an appropriate data track or not, that reduces the list like this:

Code: Select all

000x = no disc / push start
001x = music disc / push start
010x = music disc / not defined
011x = music disc / not defined
100x = music disc / not defined
101x = access / access
110x = tray open / not defined
111x = music disc / not defined
Now, I haven't checked the code, but I have a gut feeling that the actual possible values are more like this:

Code: Select all

000x = no disc / push start
001x = music disc / push start
101x = access / access
110x = tray open / not defined
Which would give us:
  • 000x = no disc inserted
  • 001x = disc inserted and ready
  • 101x = disc inserted and in use
  • 110x = tray is opened
I'd assume you can't rely on bit 0 being of any use in the last two cases. Given how tray open is only mentioned with bit 0 being clear, and that the drive really can't even access tracks when the disc isn't inserted =P I wouldn't be surprised if bit 0 is forced clear while the tray is open.

Take this with a grain of salt since this is all pure guesswork, but it could be a good starting point to check if it's actually true.
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: SuperDisc BIOS released + analysis [attn: nocash]

Post by LuigiBlood »

What I'm thinking about the music disc: This might be when the controls on the unit itself may come in handy if the BIOS doesn't do anything.

It should be mentioned that we've also found that it MAY use $21D0. But it always writes 0x00 to it. (STZ $21D0)
No idea what it is.
Post Reply