WIP: CPS 1.5 on CPS2 hardware

PCB problems and fixes
Post Reply
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

Need to put effort on finding these special versions, really. Better than have people hoard those on dark storage rooms... 8-)

Btw I really enjoy your stuff Jed. :awe:
Image
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

Took a stab at getting punisher to boot up.
Bypassed most memtests by jumping to 7D2 at reset, but the game still gives me a purple screen.
The only differences i could come up with are the memtests, compared to say, DDTOD which tests a lot less.

What is the proper layout for the cps2 multigame '02' file? right now i have 03 + 04 + 05 + 06 and then repeating this pattern.
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

Asure wrote:What is the proper layout for the cps2 multigame '02' file? right now i have 03 + 04 + 05 + 06 and then repeating this pattern.
03+04+05+06 and fill the rest with 0xFFFF. Do not mirror stuff. :awe:
Image
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

Mirror would not cause the game to hang/not boot up right?

Debugging and following up on Punisher, compared the code to punisherbz (cps1 version with no qsound. -> sound is patched..)
The original game seems to have a sound-subroutine at $4DB4. (look at 0x0b16 for the jsr).
The bootleg has this patched into $1C11E8 and just sticks data into $800180 (cps1 sound latch).

I'm just running some scenarios here, as the original Punisher game would not boot (on 1.5 hardware) when the qsound cpu was dead (suicided). So i assume black screen/purple screen on CPS2 when something goes wrong there as well. Also leo gets to run Ghouls on real hw, so cps1 style or 'bypass' style might work..
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

The problem is, with the sound roms I sent you, the Q-SOUND hardware is actually working properly and no checks need patching.


I'd guess the game is writing to a memory region which in CPS2 has no DTACK and that is stalling the game.
Image
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

leonardoliveira wrote:The problem is, with the sound roms I sent you, the Q-SOUND hardware is actually working properly and no checks need patching.
I'll leave the z80 out of the equation for now then.
leonardoliveira wrote:I'd guess the game is writing to a memory region which in CPS2 has no DTACK and that is stalling the game.
Do you ever write into 0x700000 with GnG (which runs)?
(I need to look at my current solution, but the writes must always go to 708000 and the latch at 8040e0 controls where the written data ends up.)

AM_RANGE(0x700000, 0x701fff) AM_WRITE(cps2_objram1_w) AM_SHARE("objram1") /* Object RAM, no game seems to use it directly */
AM_RANGE(0x708000, 0x709fff) AM_MIRROR(0x006000) AM_READWRITE(cps2_objram2_r, cps2_objram2_w) AM_SHARE("objram2") /* Object RAM */
AM_RANGE(0x900000, 0x92ffff) AM_RAM_WRITE(cps1_gfxram_w) AM_SHARE("gfxram") /* Video RAM */
AM_RANGE(0xff0000, 0xffffff) AM_RAM

On CPS1 there is also some ram at the f1xxxx region used for qsound which i already patched mostly, but i just noticed some writes to f1c006 from a subroutine 0x6f36 that i missed.Obviously these end up nowhere right now in my current hacked-up rom. (it's a mess..)

AM_RANGE(0xf1e000, 0xf1ffff) AM_READWRITE(qsound_sharedram2_r, qsound_sharedram2_w) /* Q RAM */
AM_RANGE(0xff0000, 0xffffff) AM_RAM AM_SHARE("mainram")

That might be the problem there (this sub 6f36 is called at boot/reset but not ingame, i missed it before..)
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

Hm... Maybe the Z80 is stalled. Because that routine is supposed to reset the Z80. Writing to the QSOUND RAM with the Z80 stopped will stall the CPU as the DTACK will be generated after a handshake with the Z80 (for having it release the bus for the 68000 access) happen.

Likely that's why the 68000 is stalling. No DTACK when the game writes to QSOUND RAM.


Edit: Looking at other games, they write 0x00f0 to 0x804040, wait a couple of cycles doing other stuff then write 0x00f8 to 0x804040.

I am doing that on Ghouls'n Ghosts hence why it doesn't stall.
Image
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

Yay!
Great success with some new init code. Game now boots on real hw.
But, crashes after attract mode, and some gfx in the bg are wrong for some reason. Maybe i should not skip the memtest, ram could be in unknown state.
(Seems some kind of debugger is also present in the game as it spits out errors.)

https://www.dropbox.com/s/2iojndickqu55 ... 3.jpg?dl=0

Code: Select all

1800a0:
    move.w #$0, $8040a0.l
    move.w #$7080, $fffff0.l
    move.w #$807d, $fffff2.l
    move.w #$2355, $fffff4.l
    move.w #$0, $fffff6.l
    move.w #$40, $fffff8.l
    move.w #$10, $fffffa.l
    move.w #$f00, $804040.l
    nop    
    nop
    move.w #$400, D0
    dbra d0, $1800e8
    move.w #$f08, $804040.l
    nop
    nop
    move.w #$400, D0
    dbra d0, $1800fc
    move.w #$f08, $804040.l
    nop
    nop
    nop
    move.b #$0, $619ffb.l
    cmpi.b #$77, $619fff.l
    bne $1800F4
    jmp $7d2.l
    nop
    nop
    nop
    nop
jedpossum
Please Continue...
Posts: 22
Joined: June 25th, 2015, 9:37 pm
Location: WV
Initials: JLH

Re: WIP: CPS 1.5 on CPS2 hardware

Post by jedpossum »

I decided to work on the debug switches some more there is a byte that it reads that which is just a copy of the last switch, and is placed at FF8085.

Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.

Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

jedpossum wrote:I decided to work on the debug switches some more there is a byte that it reads that which is just a copy of the last switch, and is placed at FF8085.

Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.

Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
I decrypted SFA3 980616 sample version and delivered the results a couple of days ago. I am taking one of my scrap CPS2 B boards to check where the "MIF" chip is outputting a chip enable for the dipswitch memory address. If it is, it should not be hard to add a real hardware debug switch to a board with a CPS2multi installed in.

I remember seeing photos of a board with debug switches and they were part of the B-Board. Which actually makes sense, since the CPU is on the B-Board, not on A-Board like on earlier systems.

Having dips on B-Board would allow them to have only one A-Board design but have means to use dedicated hardware where situations require (development, debugging and playtesting)...
Image
jedpossum
Please Continue...
Posts: 22
Joined: June 25th, 2015, 9:37 pm
Location: WV
Initials: JLH

Re: WIP: CPS 1.5 on CPS2 hardware

Post by jedpossum »

leonardoliveira wrote:
jedpossum wrote:I decided to work on the debug switches some more there is a byte that it reads that which is just a copy of the last switch, and is placed at FF8085.

Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.

Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
I decrypted SFA3 980616 sample version and delivered the results a couple of days ago. I am taking one of my scrap CPS2 B boards to check where the "MIF" chip is outputting a chip enable for the dipswitch memory address. If it is, it should not be hard to add a real hardware debug switch to a board with a CPS2multi installed in.

I remember seeing photos of a board with debug switches and they were part of the B-Board. Which actually makes sense, since the CPU is on the B-Board, not on A-Board like on earlier systems.

Having dips on B-Board would allow them to have only one A-Board design but have means to use dedicated hardware where situations require (development, debugging and playtesting)...
I wouldn't be surprised if there is other A board types for development that are closer to the black boards with 4mb SIMM since some of these tools have a save feature and not a memory dump like neo geo games.
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

Lots of hacking on punisher, i could not get it to boot consistently. I also screwed up by not properly documenting my hex edits (oops) so i had a bunch of jmp and nops i forgot about. Sorted that out a bit, and now by killing the RAM checks in the FF0000-FFFFFF range (0x7e8) now gives me an (upside down) screen with an address error which reads
303c001B, but no clue yet what that means :)

Edit: Pressing some buttons also gives me memory on screen
jedpossum
Please Continue...
Posts: 22
Joined: June 25th, 2015, 9:37 pm
Location: WV
Initials: JLH

Re: WIP: CPS 1.5 on CPS2 hardware

Post by jedpossum »

Asure wrote:Lots of hacking on punisher, i could not get it to boot consistently. I also screwed up by not properly documenting my hex edits (oops) so i had a bunch of jmp and nops i forgot about. Sorted that out a bit, and now by killing the RAM checks in the FF0000-FFFFFF range (0x7e8) now gives me an (upside down) screen with an address error which reads
303c001B, but no clue yet what that means :)

Edit: Pressing some buttons also gives me memory on screen
You gotta find what reads the dipswitches and what reads them. At one point Capcom's code reads the switches performs a neg command on them and then moves it to some where around A5(0xFF8000).
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

I'm skipping a lot of stuff atm but now it boots always, with some mem tests still enabled, and credits inserted to the player start screen. I think EEPROM needs some fixing. Also Z80/sound not working, but again i jmp straight into the 'all done, lets run the game' spot at 07d4 after setting some base values. Flying blind here, no debugger on the real hw is a bit annoying hehe.. :)

Sorted out the address error. (d1 was not set properly, fixed this.)

The problem is somewhere between 0586 and 07d2.
Right now i do this
Boot -> jump to 1800A0
At 1800a0 a routine sets up some values, and toggles 804040, waits in loop to get 77 from the sound cpu.
Then it jumps to 7d2. at 7e8 there's a NOP to stop the game touching FF0000 -> FF3FFF (if it does, at this point the game will hang..)
Some writes happen in the ff8000 range, seems fine to do so, and the game does its thing. (ending up at player select w/ wierd credits cound ;) ..)

If i correct my jmp back to 'normal' say $0586 after doing my things, the game will never boot up completely.
If i patch it back to 7d2 it works again. All on real hw.

In MAME, jmp back to $0586 and qsound works, no crashes.. all seems ok.

Because of my skipping, the dips/eeprom is in a bad state, and there are credits, screen is flipped, etc.
Also, qsound is not working properly in this state, some commands are missed. It's either silenced or not initialized properly still.

So, i need to figure out where the crap happens to stop the cpu.. But now i can guestimate a bit where it happens. :)

Vid+ Pics are coming. Figured out the debug controls as well.

Image

Upside down debug..


Accidental 0-credit bootup, with no flipped screen bonus!
Second real-world (after the French) bootup of Punisher showing its attract mode on CPS-2 hardware!


No sprites yet: Because of sloppy work and no version control, there is no proper sprite code in these two vids. Yet.
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

jedpossum wrote:You gotta find what reads the dipswitches and what reads them. At one point Capcom's code reads the switches performs a neg command on them and then moves it to some where around A5(0xFF8000).
In hardware, all the button inputs are wired like this:

Image(shamelessly stolen from a MCU development blog)

Basically, the inputs need to be inverted because the buttons circuitry are wired so they assume the value "1" when the switch is open (notice how the high value resistor puts +5v potential on the line when the switch is open) and when the switch is pushed, you get a "0" as the line will be shorted with GND.

That's the reason why you negate what is read from the input ports. You want a pushed button to read as "1" for the game engine. It could be coded to work with inverted values but we know humans don't work like that. :lol:
Image
jedpossum
Please Continue...
Posts: 22
Joined: June 25th, 2015, 9:37 pm
Location: WV
Initials: JLH

Re: WIP: CPS 1.5 on CPS2 hardware

Post by jedpossum »

I'm actually surprised some of the editors don't freak out on with out the extra inputs though.
Image
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

Debug related (cps-1) for Carrier airwing.

- Turn on TEST dip when in play. *
- Some debug data in the upper left corner will appear
- Dips now have alternate options to what is described in manual.

SWC-1 Unused -> Turbo mode, game runs unthrottled at max speed..
SWC-2 Unused -> Invincible (properly. You can still collide with enemies, but no health deduction..)
SWC-3 Free Play -> Show Hitboxes

SWB-4 Strength Easy/Normal - Stop scrolling (forever, no restart possible. For photo moments i'd say.)

*Found this by accident from a post on n-g.com forums from use 'Benthrottle' (brazil)
zebow2002
Please Continue...
Posts: 14
Joined: June 16th, 2013, 8:21 pm
Location:

Re: WIP: CPS 1.5 on CPS2 hardware

Post by zebow2002 »

Just to curious if there is any progress on this, here or on another forum?
tnx
User avatar
leonardoliveira
Please Continue...
Posts: 692
Joined: August 30th, 2012, 5:53 am
Location: Brazil
Initials: leo

Re: WIP: CPS 1.5 on CPS2 hardware

Post by leonardoliveira »

Not that I know, sadly.

This is a hobby so we're all taken by other stuffs atm. But sure enough we will be looking back into this.

My hack of GnG has palette problems, so does the Punisher hack.
Image
Asure
Posts: 573
Joined: April 17th, 2013, 5:16 pm
Location: Netherlands
eBay: asure_nl

Re: WIP: CPS 1.5 on CPS2 hardware

Post by Asure »

I just thought about this whilst i was on the crapper yesterday.

Perhaps it would be good to release what there is so far (more of 'recap') the thread to the relative things that need to be done.
Main problem, i have too little time to get anything done, life is keeping me busy.

This also means that most of the stuff i did was done in a hacky, non-documented way :)
I cannot comment on Leo's work, he did the hard work on the sound code, sprites etc.
I just theorized stuff (reverse sprite order etc.) but he made it work :)

From what there is now, it seems in-game checks could be causing problems with the game mechanics. Some enemies are dying randomly, end bosses spawn with no energy and you do not fight them at all. I remember reading about the protection checks in french forums, dlfrsilver wrote about these before. I had assumed that the 'dead battery society' version had these checks patched, but it seems they are not 'NOP' out but modified to suit the dead battery roms.
Post Reply