How Flux work

For anything related to cart (SRAM, SF2 mapper, audio, CD mode 1, ...)

Moderator: BigEvilCorporation

Post Reply
ElBarto
Very interested
Posts: 160
Joined: Wed Dec 13, 2006 10:29 am
Contact:

How Flux work

Post by ElBarto » Tue Aug 19, 2008 10:05 pm

Yup guys,

I got Flux this week (http://www.guardiana.net/?game_id=1199) and I was wondering how can it use the megacd ?

For those who have seen a Flux cart in action here is the boot process :
- Turn on the md
- You got a sega image with stars in background
- Then the megacd power-on (but you don't see the bios or whatever)
- Then flux start to play the music on the cd in the megacd.

I've opened the cart and it's a standart SEGA 171-5978B (http://dump.megadrive.org/?page=cart_db&id=24) so the cart cannot "play" with the B32 pin.

I've traced the read/write on the control (0xa11000 -> 0xa12000) section to see where and what it could write.
Here is the result :

Code: Select all

SEGA CONTROL Read #a11901
SEGA CONTROL Write #a11901 data 0000 mem_mask ffff
SEGA CONTROL Read #a11902
SEGA CONTROL Write #a11902 data 0000 mem_mask ffff
SEGA CONTROL Read #a11904
SEGA CONTROL Write #a11904 data fd0c mem_mask ffff
SEGA CONTROL Write #a11909 data 0000 mem_mask ff00
SEGA CONTROL Write #a11909 data 0000 mem_mask 00ff
SEGA CONTROL Write #a11909 data 0000 mem_mask ffff
SEGA CONTROL Write #a1190a data 0000 mem_mask ffff
SEGA CONTROL Write #a1190b data 0000 mem_mask ffff
SEGA CONTROL Write #a1190c data 0000 mem_mask ffff
SEGA CONTROL Write #a1190d data 0000 mem_mask ffff
SEGA CONTROL Write #a1190e data 0000 mem_mask ffff
SEGA CONTROL Write #a1190f data 0000 mem_mask ffff
SEGA CONTROL Write #a11910 data 0000 mem_mask ffff
SEGA CONTROL Write #a11902 data ff00 mem_mask ffff
SEGA CONTROL Write #a11901 data 0003 mem_mask 00ff
SEGA CONTROL Write #a11901 data 0002 mem_mask 00ff
SEGA CONTROL Write #a11901 data 0000 mem_mask 00ff
SEGA CONTROL Read #a11901
SEGA CONTROL Write #a11901 data 0002 mem_mask 00ff
SEGA CONTROL Read #a11901
SEGA CONTROL Write #a11901 data 0002 mem_mask 00ff
The last two line repeat indefinitly.

I don't have the possibility now to test if I could powered-on the megacd on HW so if there is anybody interested to test ...

I don't think I've seen those control address in the md or mcd manual and the explication.[/url]

Nemesis
Very interested
Posts: 791
Joined: Wed Nov 07, 2007 1:09 am
Location: Sydney, Australia

Post by Nemesis » Tue Aug 19, 2008 11:45 pm

What the Flux cart will be doing is bypassing the MegaCD bios and directly talking to the hardware. Essentially, they will have disassembled the MegaCD bios, checked what hardware calls the bios was making in order to play a cd track, and made the same calls directly from their code. I'm not sure exactly what's in the 0xA11900-0xA119FF range (I thought the MegaCD registers were in the 0xA12000-0xA12FFF range), but it'll be some kind of control register for the MegaCD I assume. As long as the MegaCD is connected to the system, the hardware is accessible. Booting from the MegaCD BIOS isn't technically required in order to make use of the hardware.

Christuserloeser
Very interested
Posts: 145
Joined: Sun Jan 28, 2007 2:01 am
Location: DCEvolution.net
Contact:

Post by Christuserloeser » Wed Aug 20, 2008 2:03 am

Flux is great. A homebrew version (update/remake/hack) would be sweet :D
http://www.DCEvolution.net - Gigabytes of free Dreamcast software for you

Image

TascoDLX
Very interested
Posts: 262
Joined: Tue Feb 06, 2007 8:18 pm

Post by TascoDLX » Wed Aug 20, 2008 5:55 am

Nemesis wrote:What the Flux cart will be doing is bypassing the MegaCD bios and directly talking to the hardware. Essentially, they will have disassembled the MegaCD bios, checked what hardware calls the bios was making in order to play a cd track, and made the same calls directly from their code.
Not quite.

Flux boots with !CART_IN signaled, so the ROM appears in the usual ROM area at $000000 thru $3FFFFF and the MegaCD sections appear at $400000 thru $7FFFFF. That means the main BIOS is at $400000, PRG-RAM is at $420000, and Word RAM is at $600000.

In order to load the sub BIOS, Flux checks the main BIOS header -- basically to figure out if it's v1 or v2 -- and locates the compressed sub BIOS within the main BIOS (hint: it's in one of two locations). Then Flux decompresses the sub BIOS into PRG-RAM and loads its own SP (system program)... generally what the main BIOS would do if it were running.

Except for the decompression routine, Flux doesn't take much from the main BIOS. Disregarding the CD player and BRAM manager, the main BIOS is little more than a boot ROM anyway.

ElBarto, when you say the MegaCD powers on, that happens when the sub BIOS starts. The sub BIOS controls the LEDs on the MegaCD unit.

As for the addresses at 0xa11900, that just doesn't happen. This is a piece of code from Flux that you can see in the trace:

Code: Select all

move.w #$ff00, $a12002
move.b #$03, $a12001
move.b #$02, $a12001
move.b #$00, $a12001
Based on Flux's code, this is what that trace should look like:

Code: Select all

SEGA CONTROL Read #a12000
SEGA CONTROL Write #a12000 data 0000 mem_mask ffff
SEGA CONTROL Read #a12002
SEGA CONTROL Write #a12002 data 0000 mem_mask ffff
SEGA CONTROL Read #a12006
SEGA CONTROL Write #a12006 data fd0c mem_mask ffff
SEGA CONTROL Write #a12010 data 0000 mem_mask ff00
SEGA CONTROL Write #a12010 data 0000 mem_mask 00ff
SEGA CONTROL Write #a12010 data 0000 mem_mask ffff
SEGA CONTROL Write #a12012 data 0000 mem_mask ffff
SEGA CONTROL Write #a12014 data 0000 mem_mask ffff
SEGA CONTROL Write #a12016 data 0000 mem_mask ffff
SEGA CONTROL Write #a12018 data 0000 mem_mask ffff
SEGA CONTROL Write #a1201a data 0000 mem_mask ffff
SEGA CONTROL Write #a1201c data 0000 mem_mask ffff
SEGA CONTROL Write #a1201e data 0000 mem_mask ffff
SEGA CONTROL Write #a12002 data ff00 mem_mask ffff
SEGA CONTROL Write #a12000 data 0003 mem_mask 00ff
SEGA CONTROL Write #a12000 data 0002 mem_mask 00ff
SEGA CONTROL Write #a12000 data 0000 mem_mask 00ff
SEGA CONTROL Read #a12000 (low byte)
SEGA CONTROL Write #a12000 data 0002 mem_mask 00ff
SEGA CONTROL Read #a12000 (low byte)
SEGA CONTROL Write #a12000 data 0002 mem_mask 00ff

Post Reply