Anyone know where the Cherryroms forums went? I'm trying to figure out what CPU core the GDSF7's weird ASIC uses, and if anyone has determined the pinout of it yet. Mainly I just care about A0-7 (-15 if it's a 816), D0-7 and IRQ.
http://www.cherryroms.com normally, i was reading the forums last week so i guess they are just down. Edit: I've seen a fair few Cherryroms forums members around here so someone might be able to help you.
CPU core? I don't think so... I don't know why it wouldn't be 100% logic, it's only used for memory mapping and glue. As far as I know, nobody has traced the ASIC for a pinout, what's the point really? I'm not positive but I'm pretty sure a semi-accurate pinout of the SNES cartridge bus is available floating around the 'net, you could always continuity test to find your pins.
For some reason I was under the impression that it ran its own BIOS, but I may be confusing it with the Doctor V64 (another Bung product, that uses a 65816). If there's no CPU, is there a register map available? Specifically for the FD controller and the MKE CD interface. I have the rom out and was ready to dump it when I found the existing dumps on the net.
The V64 has a NMOS 6502 compatible CPU (with an almost NES compatible PPU IIRC.) The V64 runs in parallel with the N64 and hardware switches from the V64's composite video to the N64's, this is Bung's only device with a CPU (other than Dr PC Jr of course) and the only reason why IT is CPU based is because the V64 can be used as a standalone VCD/CD & more player. The GDSF7's BIOS on the other hand is written purely in '816 and controls every aspect of the unit. Sorry but I don't know of anyone's attempt to document the system's registers. If you're friendly with 65816 could you disassemble the BIOS yourself? Likely the floppy controller and CDROM port will be pretty obvious, memory stuff will not. You should talk to Neviksti about this, he has looked through the BIOS and is probably the most knowledgeable around about the SF7.
I don't know if you are still interested, but I can help you if you'd like. I have a rough memory map for the SF7. (I know where all the registers are, and what most do ... but a decent chunk still need identifying.) I even know a couple tricks to allow you access to them from a running program (SNES "rom"). One is a BIOS exploit of the "super mode" features, while another is a rom header trick I discovered while reading through the BIOS code. Even though the BIOS is quite small, I never finished reading through all the code. Of all the SNES programs I've disassembled, this one is the most frustrating. Routines don't even return with the same reg sizes set, etc. I don't know how the programmer kept track of it all. But some good info and a memory map to get you started is better than nothing, right? BTW, may I enquire what you're working on?
Yeah, that's one of the things I was wondering, if the registers could be accessed after the BIOS has launched a program. The main reason being so that I could just run my experimental BIOS as any other SNES program instead of having to burn a new one each time or get a romulator. I'm mainly wanting to play around with disabling the floppy controller and replacing it with a crude ATA interface through the existing address/data and IRQ lines. (For CF at first.) I was also wondering how much control the code had over the CD port. If it can control the pins individually, maybe it could be wired as a parallel port with an adapter to use something like a zip disk. Obvious no plans are set in stone, I was just wanting to play around a bit.
Argg... I just wrote a long post and the browser ate it. -------------- Short version. I have the following if you want it: - my "not so great" disassembly of the BIOS (contains my current knowledge of the registers) - the datasheet for the diskcontroller (for programming reasons, or if you just want to know what lines are attached to which pins) I don't have everything with me right now (I'm not at my computer), but here's a rundown of the memory map: The "BIOS mode" map is basically: $00:8000-807F ... BIOS regs, so $80 bytes of the ROM is never accessible (so there is no need to worry about it). $00:8080-FFFF .... first 32kBytes of ROM $01:8000-FFFF .... second 32kBytes of ROM $02:8000-FFFF .... unused $03:8000-FFFF .... unused $04:8000-FFFF .... BRAM $05:8000-FFFF .... SRAM for real time save data (4kByte) $06:8000-FFFF .... SRAM for copier settings (4kByte) $07:8000-FFFF .... 32kB page of DRAM And then this is just repeated for all banks $00-$7F. It can also be in $80-$FF depending on some register settings. When playing a game you are in "cartridge mode" and you can control the memory map with the header of the game. (Definitely get TheDumper's SF3 header document if you don't already have it.) ============== Means of accessing BIOS regs in "cartridge mode" - Exploit I found a bug in the SF7 ver 7.11 BIOS code dealing with "SuperMode". Here's a page with code and a memory viewer to play with the registers. (I believe this is an old version, I can recompile my current code if you want... but this is fine to get you started.) http://forums.cherryroms.com/viewtopic.php?t=1804&start=42 - Header Long story short, I noticed in the BIOS code that $C0 is a special byte for the cartridge header (and the associated registers). Put this in the header for the region you want the "BIOS mode" memory to be mapped in, and you can have direct access to the copier memory and regs. Unfortunately, I'm not sure if you really have write access to all the regs this way. I haven't played with it enough to know. Here's a thread with a program to test that. http://forums.cherryroms.com/viewtopic.php?t=2831&start=2 ================== other comments: I'm not sure what you are referring to as the "CD port". Do you just mean the DB25 connector on the back? That is just a parallel port and not a specialize interface or anything. So you could add support for a ZipDisk or ... you could even write "server" code for the PC as well and allow "remote browsing" of the PC hard drive from the copier. Heck, you could do a lot with that port if you so wished. Good luck on your projects, and keep us updated -neviksti...
Cool, I remembered some discussion on cherryroms but the forum was down when I went looking for it. I was under the impression the port was for a MKE CD interface, but I've never seen the actual CD drive. Do you know what registers/bits reflect which pins on the port, and how to float them when incoming data is expected? I'm curious about the port because I was getting ready to write an ATA/ATAPI layer and FAT/ISO/UDF parsers for my CD64 BIOS replacement. Since the SF7 follows the same design as the CD64 (BIOS runs on the console, registers mapped depending on mode), I should be able to share this code with both of them. The CD64 has a built in IDE interface and a register linked comms port, whereas here we have a built in floppy interface and a parallel port. I'm essentially looking for the most convenient way to interface IDE peripherals with the SF7.
Okay, here's a copy of my notes. I appologize for the "thrown together" nature of them. It explains the registers, some memory map info, as well as where the BIOS stores some info. Code: [size=2][size=2]BIOS mode memory map:[/size][/size] [size=2][size=2] $008000-$00807F registers[/size][/size] [size=2][size=2] Cartridge Mode memory map settings[/size][/size] [size=2][size=2] $008000-$008017 (read/write)[/size][/size] [size=2][size=2] each is a byte and holds the setting of a region of the memory map[/size][/size] [size=2][size=2] values have same meaning like in the header[/size][/size] [size=2][size=2] (gotten from code at 81/A1E3)[/size][/size] [size=2][size=2] $008018 write, "expansion mem" location settings ? [/size][/size] [size=2][size=2] $008019 write, "expansion mem" location settings ?[/size][/size] [size=2][size=2] Real Time Save information[/size][/size] [size=2][size=2] $008018 read, bit1 = $4016 bit0[/size][/size] [size=2][size=2] $00801A read word, latch settings for double write word registers[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$008018 read bit7 = ? , bit = ?[/size][/size] [size=2][size=2]$008019 read bit1 = ?[/size][/size] [size=2][size=2]$00801A write ?[/size][/size] [size=2][size=2]$00801B write ?[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2] BIOS memory map settings[/size][/size] [size=2][size=2] $00801D write, changes what is mapped into banks $80-$FF[/size][/size] [size=2][size=2] only bit0-bit1 seem to matter[/size][/size] [size=2][size=2] 0 = use cartridge banks $00-$7F[/size][/size] [size=2][size=2] 1 = use cartridge banks $80-$FF[/size][/size] [size=2][size=2] 2 = mirror banks $00-$7F (BIOS regs and all?)[/size][/size] [size=2][size=2] 3 = mirror banks $00-$7F (BIOS regs and all?)[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$00801E write ?[/size][/size] [size=2][size=2]$008020 bit7 = 1, means "ready" or "continue" (code waits for bit=1)[/size][/size] [size=2][size=2]$008022 write ?[/size][/size] [size=2][size=2]$008024 write ?[/size][/size] [size=2][size=2]$008028 write ?[/size][/size] [size=2][size=2]$00802A write ?[/size][/size] [size=2][size=2]$00802B write ?[/size][/size] [size=2][/size] [size=2][size=2] parallel port[/size][/size] [size=2][size=2] $00802C data pins [/size][/size] [size=2][size=2] $00802D status (not direct pin reading?)[/size][/size] [size=2][size=2] read[/size][/size] [size=2][size=2] bit7 = /S7 (direct pin11) = "write bit7" AND not "write bit0"[/size][/size] [size=2][size=2] bit6 = "write bit4"[/size][/size] [size=2][size=2] bit5 = "write bit4"[/size][/size] [size=2][size=2] bit4 = "write bit4"[/size][/size] [size=2][size=2] bit3 = "write bit3"[/size][/size] [size=2][size=2] bit2 = /C3 (direct pin17)[/size][/size] [size=2][size=2] bit1 = C2 (direct pin16)[/size][/size] [size=2][size=2] bit0 = /C1 (direct pin14)[/size][/size] [size=2][size=2] write[/size][/size] [size=2][size=2] bit3 => S3 (direct pin15)[/size][/size] [size=2][size=2] bit4 => S4 (direct pin13)[/size][/size] [size=2][size=2] bit5 => S5 (direct pin12)[/size][/size] [size=2][size=2] bit6 => S6 (direct pin10)[/size][/size] [size=2][size=2] bit7 ...[/size][/size] [size=2][size=2] bit7 AND /bit0 ==> /S7 (direct pin11)[/size][/size] [size=2][size=2] $00802E control (not direct control reg values)[/size][/size] [size=2][size=2] bit7 = /C0 (direct pin1)[/size][/size] [size=2][size=2] bit0 = /C1 (direct pin14)[/size][/size] [size=2][size=2] bit1 = C2 (direct pin16)[/size][/size] [size=2][size=2] bit2 = /C3 (direct pin17)[/size][/size] [size=2][size=2] bit3-bit6, read = bit3-bit6 of $00802D[/size][/size] [size=2][size=2] $00802F read same as $00802D[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2] DRAM control ??[/size][/size] [size=2][size=2] $008030 word, ?? controls what is mapped into $078000[/size][/size] [size=2][size=2] valid $0000 - $01FF = 32kB page (out of 128 MBits) that is mapped in[/size][/size] [size=2][size=2] (gotten from code at 81/A235)[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2][size=2] [/size]$008030-$00803D ... 7 word table??[/size][/size] [size=2][size=2] (gotten from code at 80/AE80)[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$008040-$00805F read same as $00802D[/size][/size] [size=2][size=2]$008060-$00807F read = $FF[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2] $0080xF (where x = 8 - F)[/size][/size] [size=2][size=2] any access to $00:80xF will cause a "switch to cartridge mode"[/size][/size] [size=2][/size] [size=2][size=2]$048000-$04FFFF 32k BRAM (not actually battery backed)[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$058000-$058FFF = 4k SRAM[/size][/size] [size=2][size=2]copier listens in on SNES register accesses and writes the results here[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$068000-$068FFF = 4k SRAM[/size][/size] [size=2][size=2]I believe the 8k SRAM chip is split between bank $05, $06[/size][/size] [size=2][size=2](gotten from code at 81/87B7)[/size][/size] [size=2][size=2]The BIOS seems to use this memory region to save copier settings.[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$078000-$07FFFF 32k DRAM[/size][/size] [size=2][size=2]everything appears to be mirrored to banks $2x[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$258000-$2585FF saved register settings ??,$21xx,$42xx,$43xx,$21xx,$21xx[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$068000 = [/size][/size] [size=2][size=2]66 ($42) byte entries for each DRAM "slot" ... 16 slots -> $420 bytes[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]routine at 81/A6C6 usually used[/size][/size] [size=2][size=2]$00-$11 ... 18 bytes, game name in slot[/size][/size] [size=2][size=2]$18-$22 ... 11 bytes, file name[/size][/size] [size=2][size=2]... 1st two bytes: $53,$46 to be "valid" ie start with SF[/size][/size] [size=2][size=2]$23,$24 ... word: $54,$53 if "invalid" or something[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]actual GD3 ROM header info[/size][/size] [size=2][size=2]$25 ... SRAM setting[/size][/size] [size=2][size=2]$26-$3D ... memory map bytes[/size][/size] [size=2][size=2]$3E-$3F ... expansion mem setting[/size][/size] [size=2][size=2]$40 ... word: sum of words $00-$3E of this entry[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$068420 = saved $06842E[/size][/size] [size=2][size=2]$068422 = saved X[/size][/size] [size=2][size=2]$068424 = saved Y[/size][/size] [size=2][size=2]$068426 = saved stack[/size][/size] [size=2][size=2]$068428 = saved D[/size][/size] [size=2][size=2]$06842E = saved A[/size][/size] [size=2][size=2]$068436-$068535 temporary storage of first $100 bytes of WRAM[/size][/size] [size=2][size=2]$068541-$0685D2 $92 bytes of "settings", includes tables of jump code[/size][/size] [size=2][size=2]$0685D5 = saved word $00801A[/size][/size] [size=2][size=2]$0685DB = bit0 used for $801D in BIOS mode[/size][/size] [size=2][size=2]$068600 = 16 bytes[/size][/size] [size=2][size=2] 4 x 4byte settings - 24bit pointer (MSB first), then temp holding of a WRAM byte[/size][/size] [size=2][size=2]$068610 = 16 bytes[/size][/size] [size=2][size=2] for each "slot" the DRAM page/2 which holds the beginning of the ROM[/size][/size] [size=2][size=2]$068620 = $40 bytes, a copy of the internal ROM header $7FC0-$7FFF[/size][/size] [size=2][size=2]$06FFB0,X ?? holds bank settings of some sort?[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]Data:[/size][/size] [size=2][size=2]$12 = (24bit pointer) stack pointer + 1 [/size][/size] [size=2][size=2]$1C = temporary delay counter[/size][/size] [size=2][size=2]$1D = "[/size][/size] [size=2][size=2]$1E = $10 * DRAM "slot" # that is start of game[/size][/size] [size=2][size=2]$20 = upper part of tilemap (settings)[/size][/size] [size=2][size=2]$23 = last byte sent to PC[/size][/size] [size=2][size=2]$25 = main menu #,[/size][/size] [size=2][size=2] 00 = PlayGame[/size][/size] [size=2][size=2] 01 = PlayDisk[/size][/size] [size=2][size=2] 02 = Utility[/size][/size] [size=2][size=2]$29 = word, frame number?[/size][/size] [size=2][size=2]$2E = 00,'D','X' depending on name in $0300[/size][/size] [size=2][size=2]$3E = transfer setting[/size][/size] [size=2][size=2] 80 = ROM[/size][/size] [size=2][size=2] 40 = SAVER[/size][/size] [size=2][size=2] 00 = BRAM[/size][/size] [size=2][size=2]$3F = non-zero if we need to wait for $802E bit7 == nonzero[/size][/size] [size=2][size=2] zero if we need to wait for $802E bit7 == zero[/size][/size] [size=2][size=2]$80 = old Joypad1 data[/size][/size] [size=2][size=2]$82 = current Joypad1 data[/size][/size] [size=2][size=2]$84 = button just pressed JoyPad1 data[/size][/size] [size=2][size=2]$86 = very important, so please note that this needs more investigation[/size][/size] [size=2][size=2] = which DRAM "slot" ?[/size][/size] [size=2][size=2]$9F = temporary backup of $86[/size][/size] [size=2][size=2]$C5-$C7 = RAM search findings ... see comments at 80/D842 for details[/size][/size] [size=2][size=2]$C8 = RAMsize setting (calculated when back up cart)[/size][/size] [size=2][size=2]$F5 = parallel port transfer mode/state ??[/size][/size] [size=2][size=2] bit0 = 1, use GD3[/size][/size] [size=2][size=2] = 0, use GD6[/size][/size] [size=2][size=2] for GD6[/size][/size] [size=2][size=2] bit1 = 1, read[/size][/size] [size=2][size=2] = 0, write[/size][/size] [size=2][size=2][/size][/size] [size=2][size=2]$0300 = $0B byte buffer to hold DRAM section name (file split names)[/size][/size] [size=2][size=2]$0312 = $04 byte buffer to hold transfer info[/size][/size] [size=2][size=2] 1st: 00[/size][/size] [size=2][size=2] 2nd: 02 if header included, 00 if not[/size][/size] [size=2][size=2] 3rd: number of 64k chunks ($10 = 8 MBit)[/size][/size] [size=2][size=2] 4th: 00[/size][/size] [size=2][size=2]$03B6 = $0B byte buffer ... intially a copy of $0300[/size][/size] [size=2][size=2]$0600 = $200 byte buffer for ROM headers[/size][/size]
