Previous

199869 Revisions

Next

r25403 Tuesday 24th September, 2013 at 00:05:58 UTC by R. Belmont
cps3: improved readme with more hardware detail [Guru]

[src/mame/drivers]

cps3.c

trunk/src/mame/drivers/cps3.c

r25402	r25403
11	11
12	12	SCSI code by ElSemi
13	13
14		ToDo: (in order or priority?)
	14	To-Do/Issues:
15	15
16	16	Street Fighter 3 2nd Impact uses flipped tilemaps during flashing, emulate this.
17	17
18	18	Figure out proper IRQ10 generation:
19		If we generate on DMA operations only then Warzard is OK, otherwise it hangs during attract
20		HOWEVER, SFIII2 sometimes has messed up character profiles unless we also generate it periodicly.
21		I think the corrupt background on some of the lighning effects may be realted to this + the DMA
22		status flags.
	19	If we generate on DMA operations only then Warzard is OK, otherwise it hangs during attract
	20	HOWEVER, SFIII2 sometimes has messed up character profiles unless we also generate it periodically.
	21	I think the corrupt background on some of the lighting effects may be related to this + the DMA
	22	status flags.
23	23
24	24	Alpha Blending Effects
25	25	These are actually palette manipulation effects, not true blending.  How the values are used is
r25402	r25403
32	32	Verify them, they might not be 100% accurate at the moment
33	33
34	34	Verify Full Screen Zoom on real hardware
35		Which is which, x & y registers, how far can it zoom etc.
	35	Which is which, x & y registers, how far can it zoom etc.
36	36
37	37	Verify CRT registers
38		Only SFIII2 changes them, for widescreen mode.  What other modes are possible?
	38	Only SFIII2 changes them, for widescreen mode.  What other modes are possible?
39	39
40	40	Sprite positioning glitches
41		Some sprites are still in the wrong places, seems the placement of zooming sprites is imperfect
42		eg. warzard intro + cutscenes leave the left most 16 pixels uncovered because the sprite is positioned incorrectly,
43		the same occurs in the sf games.  doesn't look like the origin is correct when zooming in all cases.
	41	Some sprites are still in the wrong places, seems the placement of zooming sprites is imperfect
	42	eg. warzard intro + cutscenes leave the left most 16 pixels uncovered because the sprite is positioned incorrectly,
	43	the same occurs in the sf games.  doesn't look like the origin is correct when zooming in all cases.
44	44
45	45	Gaps in Sprite Zooming
46		probably cause by use of drawgfx instead of processing as a single large sprite, but could also be due to the
47		positioning of each part of the sprite.  Warzard is confirmed to have gaps during some cutscenes on real hardware.
	46	probably caused by use of drawgfx instead of processing as a single large sprite, but could also be due to the
	47	positioning of each part of the sprite.  Warzard is confirmed to have gaps during some cut-scenes on real hardware.
48	48
49	49	---
50	50
r25402	r25403
120	120
121	121	* NOT DUMPED but known to exist
122	122
123		Each game consists of a Cart and a CD having various codes needed to identify them. Carts and CDs have
124		both a different Part # printed on their front/top side that includes the game Cart/CD code and ends
	123	Each game consists of a cart and a CD having various codes needed to identify them. Carts and CDs have
	124	both a different Part # printed on their front/top side that includes the game cart/CD code and ends
125	125	respectively with 00F/000 for all Japan releases and with A0F/0A0 for all the other ones. Therefore,
126		the Part # can be used only to identify Japan releases and further parameters need to be introduced.
127		The Cart is responsible for the game Region that can be identified by a Label with coloured characters
128		and a code printed on back side. The antepenultimate character of the Label code and the colour of the
129		sticker vary by Region, exactly as happens on the boot screen when the board is powered on. There are two
130		types of Carts. Some require the CD to boot, some don't since the game is already loaded into the SIMMs.
131		Both types are externally identical and use the same codes, so the only way to distinguish them is dump
132		the BIOSes. The game Region and CD/NO CD flags are controlled by two different bytes in the BIOS rom.
133		The CD (and SIMMs too if the Cart is of type NO CD) contains the game Revision that can be identified
134		by two codes, the Catalog # and the Label. The Catalog # is the identifying code printed in the mirror
135		ring on top side close to the CD's center while the Label is the code appearing on the CD icon when
136		it's inserted into a PC CD reader. It has been verified that the Catalog # and Label are the same for
	126	the part # can be used only to identify Japan releases and further parameters need to be introduced.
	127	The cart is responsible for the game region that can be identified by a label with colored characters
	128	and a code printed on the back side. The antepenultimate character of the label code and the colour of the
	129	sticker vary by region, exactly as happens on the boot screen when the board is powered on. There are two
	130	types of carts. Some require the CD to boot, some don't since the game is already loaded into the SIMMs.
	131	Both types are externally identical and use the same codes, so the only way to distinguish them is to dump
	132	the flashROMs. The game region and CD/NO CD flags are controlled by two different bytes in the flashROM.
	133	The CD (and SIMMs too if the cart is of type NO CD) contains the game revision that can be identified
	134	by two codes, the catalog # and the label. The catalog # is the identifying code printed in the mirror
	135	ring on the top side close to the CD's center while the label is the code appearing on the CD icon when
	136	it's inserted into a PC CD drive. It has been verified that the catalog # and label are the same for
137	137	some games but quite different for some others, so it's better to check both to avoid confusion. It
138		has also been verified that the Catalog # and Label (and the data on CDs) don't change between Regions,
139		only between Revisions. However, knowing one of them and comparing it with the table above will help
140		to understand if a new game Revision has been discovered. Current CD dumps have been documented using
141		the Catalog # as name, since the Label is already included into the images used to generate CHDs.
	138	has also been verified that the catalog # and label (and the data on CDs) don't change between regions,
	139	only between revisions. However, knowing one of them and comparing it with the table above will help
	140	to understand if a new game revision has been discovered. Current CD dumps have been documented using
	141	the catalog # as name, since the label is already included into the images used to generate CHDs.
142	142
143	143	The CP SYSTEM III comprises a main board with several custom ASICs, custom 72-pin SIMMs for program
144	144	and graphics storage (the same SIMMs are also used in some CPS2 titles), SCSI CDROM and CDROM disc,
145		and a plug-in security cart containing a boot ROM, an NVRAM and another custom ASIC containing vital
146		decryption information held by a [suicide] battery.
	145	and a plug-in security cart containing a boot flashROM, an NVRAM and a custom Capcom CPU containing
	146	battery-backed decryption keys.
147	147
148		Not much is known about the actual CPU used in this system due to the extensive use of encryption,
149		and the volatile nature of the security information. There appears to be a custom Hitachi SH-2 CPU on
150		the mainboard and there has been confirmed to be one in the cart. Tests were done by decrypting the
151		BIOS and code and running it on the PCB. It is known that neither of these CPU's will run standard
152		(i.e. unencrypted) SH2 code.
	148	Not much is known about the actual CPU used in this system due to the extensive use of encryption and the volatile
	149	nature of the security information. It is known that the CPU inside the security cart is the main CPU. It is known to
	150	be a Hitachi SH-2 derivative thought to be based on a Hitachi HD6417099 SH2 variant with built-in encryption.
	151	Tests were done by decrypting the security cart flashROM code and running it on the PCB with a dead cart with a zero
	152	key and it didn't run so it is known that the custom CPU will not run standard (i.e. unencrypted) SH2 code.
153	153
154		The security cart works like this: the flashROM in the cart contains a program BIOS which is
155		decrypted by the CPU in the cart (the CPU has built-in decryption) then executed by that CPU to boot the
156		BIOS code. Even though the code in the flashROM is encrypted, the cart can run it even if it is dead/suicided
157		because it has been discovered that the BIOS contains a hidden security menu allowing the cart to be loaded
158		with the security data. This proves the cart runs the BIOS even if it is dead. The special security menu is
159		not normally available but is likely accessed with a special key/button combination which is unknown ATM.
160		The cart contains a FM1208S NVRAM which appears to either be unused or holds game settings.
161
162		There are 4 types of CPS3 carts. They have a label on the custom CPU that can be either A,B,C or D.
163		Cartidge types A and B are identical and both have extra space on the back side to solder a 29F400 in PSOP-44
164		package, which is much easier to assemble as compared to the default TSOP-48 package.
165		A and B cartridges also contain a FM1208S NVRAM which appears to be used or holds game settings.
166		C and D cartridges lack the extra space to solder a PSOP-44 Flash Rom and instead of the FM1208
167		it has a MACH111 which is a EE CMOS CPLD. C and D cartridge still have a space to solder a FM1208.
168
169		Because the CPU in the cart is always powered by a battery, it has stealth capability that allows it to
170		continually monitor the situation. If the custom CPU detects any tampering (generally things such as voltage
171		fluctuation or voltage dropping or even removal of the cart with the power on), it immediately erases the SRAM
172		inside the CPU (and thus the key) which effectively kills the security cart dead. When a cartridge goes dead,
173		it will set the decryption keys identical to the ones of SFIII-2nd Impact, so removing the battery and changing
174		the content of the BIOS (if it's not a 2nd Impact) will make it run as a normal SFIII-2nd Impact cartridge.
175		It is known (from decapping it) that the CPU in the security cart does contain an amount of static RAM
176		for data storage and a SH2 core.
	154	The flashROM in the cart contains an encrypted program which is decrypted by the CPU in the cart. The CPU has built-in
	155	decryption and the key is held in some static RAM on the CPU die and kept there by a battery. The code is executed by
	156	the CPU to boot the system. Even though the code in the flashROM is encrypted, the cart can run it even if it is
	157	dead/suicided because it has been discovered that the program contains a hidden security menu allowing the cart to be
	158	loaded with the security data. This proves the cart runs the code even if the battery is dead. The special security
	159	menu is not normally available but is likely accessed with a special key/button combination which is currently unknown.
177	160
178		The main board uses the familiar Capcom SIMM modules to hold the data from the CDROM so that the life of
179		the CD drive is maximized. The SIMMs don't contain RAM, but instead TSOP48 surface mounted flashROMs that
180		can be updated with different games on bootup using a built-in software updating system.
	161	Because the CPU in the cart is always powered by the battery, it has stealth capability that allows it to continually
	162	monitor the situation. If the custom CPU detects any tampering (generally things such as voltage fluctuation or voltage
	163	dropping or even removal of the cart with the power on), it immediately erases the SRAM (i.e. the decryption key)
	164	inside the CPU which effectively kills the security cart. This also suggests that the custom Capcom CPU contains some
	165	additional internal code to initiate the boot process because in order to re-program a cart using the hidden security
	166	menu the CPU must execute some working code. It is known (from decapping it) that the CPU in the security cart contains
	167	an amount of static RAM for data storage and a SH2 core based on the Hitachi SH7010-series (SH7014) SuperH RISC engine
	168	family of Microprocessors.
	169
	170	It is thought that when a cartridge dies it will set the decryption keys identical to the ones of SFIII-2nd Impact, so
	171	removing the battery and changing the content of the flashROM (if it's not a 2nd Impact) will make it run as a normal
	172	SFIII-2nd Impact cartridge (is this verified on real hardware?)
	173
	174	The main board uses the familiar Capcom SIMM modules to hold the data from the CDROM so that the life of the CD drive
	175	is maximized. The SIMMs don't contain RAM, but instead TSOP48 surface mounted flashROMs that can be updated with
	176	different games on bootup using a built-in software updating system.
181	177	The SIMMs that hold the program code are located in positions 1 & 2 and are 64MBit.
182		The SIMMs that hold the graphics are located in positions 3, 4, 5, 6 & 7 and are 128MBit.
183		The data in the SIMMs is not decrypted, it is merely taken directly from the CDROM and shuffled slightly
184		then programmed to the flashROMs. The SIMMs hold the entire contents of the CDROM.
	178	The SIMMs that hold the graphics and sound data are located in positions 3, 4, 5, 6 & 7 and are 128MBit.
	179	The data in the SIMMs is not decrypted, it is merely taken directly from the CDROM and shuffled slightly then
	180	programmed to the flashROMs. The SIMMs hold the entire contents of the CDROM.
185	181
186		To swap games requires the security cart for the game, it's CDROM disc and the correctly populated type
187		and number of SIMMs on the main board.
188		On first power-up after switching the cart and CD, you're presented with a screen asking if you want to
189		re-program the SIMMs with the new game. Pressing player 1 button 2 cancels it. Pressing player 1 button 1
190		allows it to proceed whereby you wait about 25 minutes then the game boots up almost immediately. On
191		subsequent power-ups, the game boots immediately.
	182	To swap games requires the security cart for the game, it's CDROM disc and the correctly populated type and number of
	183	SIMMs on the main board.
	184	On first power-up after switching the cart and CD, you're presented with a screen asking if you want to re-program the
	185	SIMMs with the new game. Pressing player 1 button 2 cancels it. Pressing player 1 button 1 allows it to proceed whereby
	186	you wait about 25-30 minutes then the game boots up almost immediately. On subsequent power-ups, the game boots
	187	immediately.
192	188	If the CDROM is not present in the drive on a normal bootup, a message tells you to insert the CDROM.
193	189	Then you press button 1 to continue and the game boots immediately.
194		Note that not all of the SIMMs are populated on the PCB for each game. Some games have more, some less,
195		depending on game requirements, so flash times can vary per game. See the table below for details.
	190	Note that not all of the SIMMs are populated on the PCB for each game. Some games have more, some less, depending on
	191	game requirements, so flash times can vary per game. See the table below for details.
196	192
197	193	|----------- Required SIMM Locations & Types -----------|
198	194	Game                                                 1       2       3        4        5         6         7
r25402	r25403
211	207	No game uses a SIMM at 7
212	208	See main board diagram below for SIMM locations.
213	209
214		Due to the built-in upgradability of the hardware, and the higher frame-rates the hardware seems to have,
215		it appears Capcom had big plans for this system and possibly intended to create many games on it, as they
216		did with CPS2. Unfortunately for Capcom, CP SYSTEM III was an absolute flop in the arcades so those plans
217		were cancelled. Possible reasons include:
218		- the games were essentially just 2D, and already there were many 3D games coming out onto the market that
219		interested operators more than this,
220		- the cost of the system was quite expensive when compared to other games on the market,
221		- it is rumoured that the system was difficult to program for developers,
222		- these PCBs were not popular with operators because the security carts are extremely static-sensitive and most
223		of them failed due to the decryption information being zapped by simple handling of the PCBs or by touching
224		the security cart edge connector underneath the PCB while the security cart was plugged in, or by power
225		fluctuations while flashing the SIMMs. You will know if your cart has been zapped because on bootup, you get
226		a screen full of garbage coloured pixels instead of the game booting up, or just a black or single-coloured
227		screen. You should also not touch the inside of the security cart because it will be immediately zapped
228		when you touch it! The PCB can detect the presence of the security cart and if it is removed on a working game,
229		the game will freeze immediately and it will also erase the security cart battery-backed data.
	210	Due to the built-in upgradability of the hardware, and the higher frame-rates the hardware seems to have, it appears
	211	Capcom had big plans for this system and possibly intended to create many games on it, as they did with CPS2.
	212	Unfortunately for Capcom, CP SYSTEM III was an absolute flop in the arcades so those plans were cancelled. Possible
	213	reasons include:
	214	- the games were essentially just 2D, and already there were many 3D games coming out onto the market that interested
	215	operators more than this.
	216	- the cost of the system was quite expensive when compared to other games on the market.
	217	- it is rumoured that the system was difficult to program for developers.
	218	- these PCBs were not popular with operators because the security carts are extremely static-sensitive and most of them
	219	failed due to the decryption information being zapped by simple handling of the PCBs or by touching the security cart
	220	edge connector underneath the PCB while the security cart was plugged in, or by power fluctuations while flashing the
	221	SIMMs. You will know if your cart has been zapped because on bootup, you get a screen full of garbage coloured pixels
	222	instead of the game booting up, or just a black or single-colored screen. You should also not touch the inside of the
	223	security cart. The PCB can detect the presence of the security cart and if it is removed on a working game, the game
	224	will freeze immediately and it will also erase the security cart battery-backed decryption data.
230	225
231	226
232	227	PCB Layouts
r25402	r25403
236	231	CP SYSTEM III
237	232	95682A-4 (older rev 95682A-3)
238	233	|----------------------------------------------------------------------|
239		|= J1             HM514260     |------------|      |  |  |  |  |        |
	234	|= J1             HM514260(2)  |------------|      |  |  |  |  |        |
240	235	|                             |CAPCOM      |      |  |  |  |  |        |
241	236	|= J2     TA8201  TC5118160    |DL-2729 PPU |      |  |  |  |  |        |
242	237	|                             |(QFP304)    |      |  |  |  |  |        |
r25402	r25403
283	278	(unsecured) EEPROM so why it was covered is not known.
284	279	LM385      - National Semiconductor LM385 Adjustable Micropower Voltage Reference Diode (SOIC8)
285	280	33C93      - AMD 33C93A-16 SCSI Controller (PLCC44)
286		KM681002   - Samsung Electronics KM681002 128k x8 SRAM (SOJ32)
287		62256      - 8k x8 SRAM (SOJ28)
288		HM514260   - Hitachi HM514260CJ7 1M x16 DRAM (SOJ42)
289		TC5118160  - Toshiba TC5118160BJ-60 256k x16 DRAM (SOJ42)
	281	KM681002   - Samsung Electronics KM681002 128k x8 SRAM (SOJ32). This is the 'Color RAM' in the test mode memory
	282	test
	283	62256      - 8k x8 SRAM (SOJ28). This is the 'SS RAM' in the test mode memory test and is connected to the custom
	284	SSU chip.
	285	HM514260(1)- Hitachi HM514260CJ7 1M x16 DRAM (SOJ40). This is the 'Work RAM' in the test mode memory test and is
	286	connected to the custom CCU chip.
	287	HM514260(2)- Hitachi HM514260CJ7 1M x16 DRAM (SOJ40). This is the 'Sprite RAM' in the test mode memory test
	288	TC5118160  - Toshiba TC5118160BJ-60 or NEC 4218160-60 256k x16 DRAM (SOJ42). This is the 'Character RAM' in the
	289	test mode memory test
290	290	SW1        - Push-button Test Switch
291	291	VOL        - Master Volume Potentiometer
292	292	J1/J2      - Optional RCA Left/Right Audio Out Connectors
r25402	r25403
315	315	For SIMMs 3-7, the 8 FlashROMs are populated on both sides using a similar layout.
316	316
317	317	Capcom Custom ASICs -
318		DL-2729 PPU SD10-505   (QFP304). Decapping reveals this is the main graphics chip.
319		DL-2829 CCU SD07-1514  (QFP208). Decapping reveals this to be a custom Toshiba ASIC.
320		DL-2929 IOU SD08-1513  (QFP208). This is the I/O controller.
321		DL-3329 SSU SD04-1536  (QFP144). This is might be the main CPU. It appears to be a SH2
322		variant with built-in encryption. It is clocked at
323		21.47725MHz (42.9545/2)
324		DL-3429 GLL1 SD06-1537 (QFP144). Unknown, possibly a DMA or bus controller.
325		DL-3529 GLL2 SD11-1755 (QFP80).  This might be the sound chip (it has 32k SRAM connected to it).
	318	DL-2729 PPU SD10-505   (QFP304) - Graphics chip.
	319	DL-2829 CCU SD07-1514  (QFP208) - Probably a companion CPU or co-processor. Decapping
	320	reveals it is manufactured by Toshiba. The 'Work RAM' is
	321	connected to it.
	322	DL-2929 IOU SD08-1513  (QFP208) - I/O controller.
	323	DL-3329 SSU SD04-1536  (QFP144) - Sound chip, clocked at 21.47725MHz (42.9545/2). It has 32k
	324	SRAM connected to it.
	325	DL-3429 GLL1 SD06-1537 (QFP144) - DMA memory/bus controller.
	326	DL-3529 GLL2 SD11-1755 (QFP80)  - ROM/SIMM bank selection chip (via 3x FCT162244 logic ICs).
326	327
327	328
328	329	Connector Pinouts
r25402	r25403
365	366	Security Cartridge PCB Layout
366	367	-----------------------------
367	368
	369	There are 4 types of CPS3 security carts. They have a label on the custom CPU that can be either A, B, C or D.
	370	Cartridge types A/B are identical and cartridge types C/D are identical.
	371	Type A/B have extra space on the back side to solder a 28F400 SOP44 flashROM which shares all electrical connections
	372	with the 29F400 TSOP48 flashROM on the front side of the PCB. Either chip can be used to store the 512k cart program,
	373	but no cart has been seen with a SOP44 flashROM populated, nor with both SOP44 and TSOP48 populated on one cart.
	374	A and B cartridges also contain a FM1208S NVRAM which holds game settings or other per-game data. It is definitely
	375	used. If the NVRAM data is not present when the game boots or the NVRAM is not working or inaccessible a message is
	376	displayed 'EEPROM ERROR' and the game halts. This error can also occur if the security cart edge connector is dirty
	377	and not contacting properly.
	378	C and D cartridges lack the extra space to solder a SOP44 flashROM. A space is available on the back side for a FM1208S
	379	NVRAM but it is not populated. A MACH111 CPLD is present on the back side and stamped 'CP3B1A'
	380
	381
	382	Type A and Type B
	383	-----------------
	384
368	385	CAPCOM 95682B-3 TORNADE
369	386	|------------------------------------------------|
370	387	|      BATTERY                                   |
r25402	r25403
386	403	FM1208S      - RAMTRON FM1208S 4k (512bytes x8) Nonvolatile Ferroelectric RAM (SOIC24)
387	404	28F400       - 28F400 SOP44 FlashROM (not populated)
388	405	*            - These components located on the other side of the PCB
389		The battery powers the CPU only. A small board containing some transistors is wired to the 74HC00
	406
	407	Note: The battery powers the CPU only. A small board containing some transistors/resistors is wired to the 74HC00
390	408	to switch the CPU from battery power to main power to increase the life of the battery.
391	409
392		*/
393	410
	411	Type C and Type D
	412	-----------------
	413
	414	CAPCOM 95682B-4 CP SYSTEM III
	415	|------------------------------------------------|
	416	|      BATTERY                                   |
	417	|                          |-------|             |
	418	|                          |CAPCOM |   29F400    |
	419	|                          |DL-3229|   *MACH111  |
	420	|                          |SCU    |     *FM1208S|
	421	| 74HC00                   |-------|             |
	422	|               6.25MHz                    74F00 |
	423	|---|     |-|                             |------|
	424	|     | |                             |
	425	|-----| |-----------------------------|
	426	Notes:
	427	74F00        - 74F00 Quad 2-Input NAND Gate (SOIC14)
	428	74HC00       - Philips 74HC00N Quad 2-Input NAND Gate (DIP14)
	429	29F400       - Fujitsu 29F400TA-90PFTN 512k x8 FlashROM (TSOP48)
	430	Custom ASIC  - CAPCOM DL-3229 SCU (QFP144). Decapping reveals this is a Hitachi HD6417099 SH2 variant
	431	with built-in encryption, clocked at 6.250MHz
	432	FM1208S      - RAMTRON FM1208S 4k (512bytes x8) Nonvolatile Ferroelectric RAM (not populated)
	433	MACH111      - AMD MACH111 CPLD stamped 'CP3B1A' (PLCC44)
	434	*            - These components located on the other side of the PCB
	435
	436	Note: The battery powers the CPU only. Some transistors/resistors present on the PCB and wired to the 74HC00
	437	switch the CPU from battery power to main power to increase the life of the battery.
	438
	439
	440	Security cart resurrection info
	441	-------------------------------
	442
	443	When the security cart dies the game no longer functions. The PCB can be brought back to life by doing the following
	444	hardware modification to the security cart.....
	445
	446	1. Remove the custom QFP144 CPU and replace it with a standard Hitachi HD6417095 SH-2 CPU
	447	2. Remove the 29F400 TSOP48 flashROM and re-program it with the decrypted and modified main program ROM from set
	448	'cps3nobatt' in MAME. A 28F400 SOP44 flashROM can be used instead and mounted to the back side of the security cart
	449	PCB. Do not mount both SOP44 and TSOP48 flashROMs, use only one TSOP48 flashROM or one SOP44 flashROM.
	450	3. Power on the PCB and using the built-in cart flashROM menu re-program the SIMMs for your chosen game using the CD
	451	from set 'cps3nobatt' in MAME.
	452	4. That is all. Enjoy your working PCB.
	453
	454	*/
	455
394	456	#include "emu.h"
395	457	#include "cdrom.h"
396	458	#include "cpu/sh2/sh2.h"

Previous

199869 Revisions

Next

---

© 1997-2024 The MAME Team