BS-X Satellaview Datapak's

Discussion of hardware and software development for Super NES and Super Famicom. See the SNESdev wiki for more information.

Moderator: Moderators

Forum rules
  • For making cartridges of your Super NES games, see Reproduction.
nocash
Posts: 1405
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: BS-X Satellaview Datapak's

Post by nocash »

LuigiBlood wrote:Radio ON: Clear bit7 of $2197
Radio OFF: Set bit7 of $2197
Thanks, good to know! I had only figured out that it was somehow related to powerdown and/or soundlink.
So it seems to be simply soundlink related (assuming that the "radio" is the same as the "soundlink" feature).
DaveyPocket
Posts: 11
Joined: Mon Aug 28, 2017 6:00 pm

Re: BS-X Satellaview Datapak's

Post by DaveyPocket »

Here are two photos of a BSC-1J5M-01 with the Datapak connector removed, for reference.
(Needed the connector for something, figured I’d photograph the board)
Attachments
back.jpg
front.jpg
blurayno
Posts: 18
Joined: Sat Apr 28, 2012 7:22 am

Re: BS-X Satellaview Datapak's

Post by blurayno »

A photo of the SameGame character cartridge PCB. Fullsnes.htm seemed to be missing verified info on these, so uploading if it's of any help.
Attachments
BSMC-CR-01 PCB.jpg
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: BS-X Satellaview Datapak's

Post by LuigiBlood »

nocash wrote:
LuigiBlood wrote:Radio ON: Clear bit7 of $2197
Radio OFF: Set bit7 of $2197
Thanks, good to know! I had only figured out that it was somehow related to powerdown and/or soundlink.
So it seems to be simply soundlink related (assuming that the "radio" is the same as the "soundlink" feature).
I actually didn't say it much, but bit 0 of $2194 does enable the stream registers. In fact, I heard even a static sound when I enabled it (when SPC700 is unmuted... which I did).
Reading $218B (or $2191), because it isn't initialized properly, reads garbage, and the data is ORed at $218D (or $2193), that's done no matter what... but when I read it when $2194.0 is set, it does read once and then resets itself to 0x00. But when it isn't, when that bit is unset, it does not reset. That bit is simply the one that enables stream registers.
blurayno
Posts: 18
Joined: Sat Apr 28, 2012 7:22 am

Re: BS-X Satellaview Datapak's

Post by blurayno »

sanmaiwashi released a specialized SRAM dumper for Superufo Pro 8 just a few days ago so here's another fresh BS-X SRAM dump incoming.
This one's got a few SRAM patches too but I'm unable to tell if they differ from the previously discovered ones.
The player's got a ton of money and items with interesting descriptions and dialog boxes.
Maybe worth of translating, since the file seems to have lots of save data from different games.
Attachments
bsx-blurayno.zip
(4.64 KiB) Downloaded 350 times
nocash
Posts: 1405
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: BS-X Satellaview Datapak's

Post by nocash »

Thanks for the dump! Concerning SRAM Patches, it seems to be the newest version: with 9 patches, as found in "bsx3.srm".
The checksum is okay (and the byte at offset 0AAAh isn't corrupted, unlike as in a handful of other dumps).
And the game positions, you have something at 13E4h-13FFh, which was NOT known to be used by any games yet.
Many of the other addresses are used by two or more games, so it's hard to tell if a dump contains game positions from one of those games - or from yet another unknown game.
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: BS-X Satellaview Datapak's

Post by LuigiBlood »

One mention about the header of Memory Pack contents:

Assuming 32-bit little endian:

Code: Select all

FFB2h 4  Program Type
      - 0x???????? = 65C816
      - 0x00000100 = BS-X Script Tokens
      - 0x00000200 = SA-1 (Itoi Bass Fishing No. 1)
Shigesato Itoi's Bass Fishing No. 1 literally just boots the content. If you can rewrite the Memory Pack you can actually mess with real SA-1 hardware :D
blurayno
Posts: 18
Joined: Sat Apr 28, 2012 7:22 am

Re: BS-X Satellaview Datapak's

Post by blurayno »

LuigiBlood wrote:

Code: Select all

FFB2h 4  Program Type
      - 0x???????? = 65C816
      - 0x00000100 = BS-X Script Tokens
      - 0x00000200 = SA-1 (Itoi Bass Fishing No. 1)
Is this the correct address? All mempak images I checked just now had the byte 00 at 7FB2/FFB2h.
Commercial games seem to have the first character of the release code (e.x. ZBSJ) at that address.
nocash
Posts: 1405
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: BS-X Satellaview Datapak's

Post by nocash »

LuigiBlood wrote:

Code: Select all

FFB2h 4  Program Type
      - 0x???????? = 65C816
      - 0x00000100 = BS-X Script Tokens
      - 0x00000200 = SA-1 (Itoi Bass Fishing No. 1)
Nice finding. I had spotted the [7FB3h]=02h check somewhere in Itoi - but didn't knew what it was intended for. Are there any existing games/datapaks using that feature?

From what I can see, it's checking the byte at 7FB3h only. So it should work for LoROM only. And it should work with any "xxxx02xxh" value.

And if the 02h byte is there... then it's just booting the file as normal 65C816 code (which may then use SA-1 hardware if it wants to (provided that the cart does really contain SA-1 hardware), or leave the SA-1 stuff unused if it doesn't need it), right?
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: BS-X Satellaview Datapak's

Post by LuigiBlood »

blurayno wrote:Is this the correct address? All mempak images I checked just now had the byte 00 at 7FB2/FFB2h.
Commercial games seem to have the first character of the release code (e.x. ZBSJ) at that address.
It is. Satellaview Content does not use the header the same way as commercial cartridge games.
nocash wrote:Nice finding. I had spotted the [7FB3h]=02h check somewhere in Itoi - but didn't knew what it was intended for. Are there any existing games/datapaks using that feature?

From what I can see, it's checking the byte at 7FB3h only. So it should work for LoROM only. And it should work with any "xxxx02xxh" value.

And if the 02h byte is there... then it's just booting the file as normal 65C816 code (which may then use SA-1 hardware if it wants to (provided that the cart does really contain SA-1 hardware), or leave the SA-1 stuff unused if it doesn't need it), right?
We don't have any content that uses this feature yet.
I assume there must be some kind of check at first to make sure it isn't Itoi booting it and simply tell the player "Please insert the Memory Pack into Itoi Bass Fishing cartridge" or something like that.
blurayno
Posts: 18
Joined: Sat Apr 28, 2012 7:22 am

Re: BS-X Satellaview Datapak's

Post by blurayno »

LuigiBlood wrote:
blurayno wrote:Is this the correct address? All mempak images I checked just now had the byte 00 at 7FB2/FFB2h.
Commercial games seem to have the first character of the release code (e.x. ZBSJ) at that address.
It is. Satellaview Content does not use the header the same way as commercial cartridge games.
My bad. The value you gave was a little endian dword and I wasn't paying enough attention on what I was reading and looking at...
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: BS-X Satellaview Datapak's

Post by LuigiBlood »

According to patent JP3734532B2

Here is the full Time Channel format (including header AND using official terms):

Code: Select all

Offset - Size (in bytes) - Description
0x00 - 1 - Data Group ID 1 (upper 4 bits) / Data Group Repetition (lower 4 bits)
0x01 - 1 - Data Group Link (bit7) / Data Group Continuity
0x02 - 3 - Data Group Size
0x05 - 1 - TYPE
0x06 - 1 - DGN
0x07 - 3 - Address

0x0A - 1 - Second
0x0B - 1 - Minute
0x0C - 1 - Hour (0-23)
0x0D - 1 - Day of Week (1-7) [1 = Monday, 7 = Sunday]
0x0E - 1 - Day
0x0F - 1 - Month
0x10 - 2 - Year
0x12 - 2 - Unused (Preliminary)
0x14 - 2 - CRC [Does not count in the Data Group Size]
Also, difference between time at 1.1.0.8 and 1.2.0.48:
- 1.1.0.8 is an absolute time. (1.1.X.X are all BS-X related, so it makes sense)
- 1.2.0.48 is relative to the start of the broadcast. (1.2.X.X are all game related)
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: BS-X Satellaview Datapak's

Post by LuigiBlood »

So I've done a bit of research about Satellaview register $2198. While I did notice about the serial number being found, I admit I didn't try to find the nature of all the BIOS functions dedicated for it.
And eventually I found something in the Satellaview patents. Because Nintendo is nice to the people who reads those, they actually put the ID of chips used for a bunch of things, and all of them did correspond to what we got so far.

So I found that $2198 talks to a EEP-ROM chip manufactured by Seiko under the ID of "S-2913CR". While I did not find this specific chip, I found "2913C", and it fits the description completely, it is a 16-bit Serial EEPROM, manufactured by SEEQ Technology. A datasheet can be found here: http://datasheet.datasheetarchive.com/o ... 047710.pdf
When I tried to read the EEPROM's content, I needed bit7 to be set. This 100% corresponds to the read opcode.

Therefore, according to this information, I'll use nocash's documentation as a base and change the BIOS function names, while checking the disassembled routines that I got:

Code: Select all

Port 2198h (serial port 1 to SPR-BSA EEPROM) (unused)
  1059B8 read_multiple_eeprom             [In: A = 6bit address, Out: read 16 bytes to [DB:0000h+Y]]
  1059BC read_single_eeprom               [In: A = 6bit address, Out: A]
  1059C0 write_verify_multiple_eeprom     [In: A = 6bit address, X = amount of words, [D+00h+Y] = data]
  1059C4 write_verify_single_eeprom       [In: A = 6bit address, X = word]
  1059C8 write_word_eeprom                [In: A = 6bit address, X = word]
  1059CC write_verify_first_word_eeprom   [In: X = word] (kinda weird, it does Write All opcode, but only writes and checks one word)
  1059D0 erase_word_eeprom                [In: A = 6bit address]
  1059D4 erase_all_eeprom
  1059D8 verify_address_20h_to_3Fh_eeprom [In: X = word, Out: Carry flag (if set = wrong, if clear = verified)]
  1059DC verify_single_eeprom             [In: A = 6bit address, X = word, Out: Carry flag (if set = wrong, if clear = verified)]
  1059E0 program_enable_eeprom
  1059E4 program_disable_eeprom
  1059E8 send_byte_eeprom                 [In: A = byte]
  1059EC wait_eeprom_ready
And because of that, I'm suspecting that $2199 has nothing to do with any audio output. I'm suspecting that $2199 is what manages that was supposed to be the hard drive for the EXT port which records audio and data as well, as the patent suggests.
Last edited by LuigiBlood on Sat Jul 14, 2018 11:00 am, edited 1 time in total.
nocash
Posts: 1405
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: BS-X Satellaview Datapak's

Post by nocash »

Good finding!

What is the "serial number being found"? Is there a serial number stored in the eeprom... and is it used for something?

Now that you've discovered the SPR-BSA being a Seiko S-2913CR chip... there's also a Seiko datasheet for it
http://datasheet.datasheetarchive.com/o ... 144153.pdf - so no need to use the Seeq datasheet.

The read/write multiple functions don't do anything with 7E0000h. The source/dest address in RAM is in Y register.
For read_multiple it's using [DB:0000h+Y], with DB needed to be a "lorom" bank, as it's also used for [DB:2198h].
For write_multiple it's using [D+00h+Y], with the direct page... I guess it should be zero (or maybe the related functions survive other values).
If the D, DB, Y registers are all zero then it will use address 000000h, which will actually mirror to RAM at 7E0000h.

So well, there's an EEPROM and the BSX-BIOS has functions for accessing it - but I don't know of any games that would use that functions (nor does the BSX-BIOS itself use that functions (nor do any known games access 2198h directly)). If I didn't miss something: The EEPROM is there, but it was never ever actually used?

For the other serial port at 2199h: That port is actually used: by the BSX-BIOS, by BSX-BIOS patches, and by Itoi, and by BS Dragon Quest 1, and in respect to data in the Town Status packet. Being used that often, I have some doubts that it was used for any kind of yet unreleased expansion hardware.
I would have assumed that it goes to the MN88821 chip (there's a datasheet for a similar chip, which has a serial port). You do have a BSX unit, don't you? What happens when executing the 2199h reading functions? Does it return any data - despite of not having a HDD or whatever attached at the EXT port?
Or if it goes to the EXT port, if you attach an oscilloscope, a logic analyzer, a multimeter, or a bloody LED... can you see a pin getting toggled when toggling the 2199h clock bit by software? Going by DaveyPocket's findings, the five candidates for serial or other unknown features would be EXT pins 29, 30, 31, 33, 34.
User avatar
LuigiBlood
Posts: 62
Joined: Thu Jul 29, 2010 2:24 pm

Re: BS-X Satellaview Datapak's

Post by LuigiBlood »

The serial number I was talking about that's in the EEPROM is something like this that I found:

Code: Select all

BSA00???????   A4h FFh FFh FFh and so on...
Each byte is repeated twice on each 16-bit word. The ??????? matches my Satellaview's serial number.

Also I only gave a quick look and I admit that while Direct Bank and stuff crossed my mind I didn't quite bother...
I have never seen anything that uses 2198h so far. It's just there.

2199h is totally used, that I definitely saw. And considering the EEPROM access was treated as a bus in the patent, there's also a EX Bus, linked to the EXT port. There's potentially other registers directly linked to it as well according to that.
When I use it, I got it to return E00000h. Any command does not seem to change that. Also, unsetting 2194h.bit0 actually disables that register (alongside the streams that are stuck). Not 2198h however. I'll try to check with a LED at some point.
Post Reply