Initialize Sega CD in Mode 1

[tristanseifert]

I'm working on a little Sega CD backup RAM cart that features a flash memory that will allow one to manage the memory on the cart. When a switch is selected, the cart will boot to that flash memory. The flash memory contains some utilities to manage the RAM and use your Sega CD's hardware.

The Sega CD has this convenient feature called Mode 1, which lets code run from a regular Mega Drive cartridge, but make use of the Sega CD's additional hardware.

To really be able to access the Sega CD hardware, one needs to initialize the hardware and load the BIOS. How would I go about doing this? The documentation isn't very specific and only lists steps to take.

The only other software that I know of that uses the Sega CD in Mode 1 is Flux, a music visualizer. I've attempted to disassemble parts of it, but without much success so I still haven't been able to find the code to do this.

Any help would be greatly appreciated!

[Charles MacDonald]

The documentation isn't very specific and only lists steps to take.

You essentially have to do the same thing the BIOS does, copy the Sub CPU BIOS out of ROM to Program RAM and reset the Sub CPU so it starts up running the BIOS code, as well as initialize the registers in the same way the BIOS would have.

I think the Flux cart knows the right offset in the BIOS ROM to copy the data out of, rather that include copyrighted code in the cartridge ROM.

I'd run the Sega CD BIOS in a debugger, break at the point the main menu comes up, and just dump the RAM and registers values, then have your cartridge program write those same values and RAM data back in. Not that it is really quite that easy.

[Nemesis]

I just wanted to add that I am also interested in seeing some code which can successfully do this. I tried to get this working on the LaserActive with the goal of dumping the digital data from MegaLD disks, but after playing around with it for awhile, I wasn't able to initialize the CD system from the cartridge. I could talk to the hardware and apparently load data into the sub-cpu program memory, but I was never able to successfully start the sub-cpu bios after booting from the cartridge. After a number of unsuccessful attempts, I shelved the idea, planning to get back to it later.

As you said, Flux manages to do it, so it's obviously possible, but I don't think anything else does it, and I don't think anyone in this community has ever done it either, at least, not that I've ever heard of. I think the best thing to do is just keep trying to reverse-engineer the bootstrapper in the Flux cartridge. That'll probably yield answers more quickly than anything else. I've never seen any other documentation on this process other than what you linked to.

[tristanseifert]

Thanks for all the responses! I've looked through dumps of the Version 1 and 2 BIOS files of all regions, and it seems as if the sub-CPU BIOS is always at the same space, and is always padded out to the same exact spot, but the length of the Bios DOES vary.

Here's some code I whipped up that seems to do it's job at loading the BIOS, and not crashing the entire shebang (the green LED starts blinking after a while to indicate the disc drive is in standby, I'm pretty sure the sub-BIOS controls this):

Code: Select all

		lea	$A12001, a5								; Load the reset/bus request to a5.

@deassertResetWaitLoop:
		bclr	#0, (a5)							; Try to de-assert reset.
		bne.s	@deassertResetWaitLoop				; Keep looping until line is de-asserted.

		lea		1(a5), a6							; Set the offset to the memory mode byte to a6.
		move.w	(a6), d5							; Move the current memory mode to d5.
		andi.w	#2, d5								; AND the memory mode by #2. (Essentially makes sure that only
													; bit 6 can be set. (If input is 10101010, out is 00000010)
		move.w	d5, (a6)							; Load the manipulated memory mode to a6's address.


		lea		(subbios_part_1).l, a0
		lea		$420000, a1
		bsr.w	KosDec
		
		lea		(subbios_part_2).l, a0
		lea		$426000, a1
		bsr.w	KosDec
		
		lea		(subbios_part_3).l, a0
		lea		$438000, a1
		bsr.w	KosDec

	
		bclr	#1, $A12000							; Release the sub-CPU bus
		bset	#0, $A12000							; Let the sub-CPU run
		
		move.b	#0x2A, (a6) 						; Write a new memory mode to the register. (Bank 2 of Sub CPU RAM
													; for Main CPU, sets 2M mode?)

@assertResetWaitLoop:
		bset	#0, (a5)							; Try to assert reset.
		beq.s	@assertResetWaitLoop				; Keep looping until line is asserted.

@releaseSubCPUBusLoop:
		bclr	#1, (a5)							; Try to release the sub-CPU bus.
		bne.s	@releaseSubCPUBusLoop				; Keep looping until the bus is not the Main CPU's anymore.

This will just load the 3 chunks of the US firmware to the Sub-CPU RAM. I have no idea what to do after writing the Sub-CPU BIOS, especially where my Sub-CPU code would need to be written to, and how I'd get the Sub-CPU to run that code.

My suspicion is that I'd write the code I want theSub-CPU to execute into the second bank of it's program RAM, since the Main-CPU part of the BIOS sets the banking register thingamajig to the second bank after it finished writing the Sub-CPU BIOS.