Gameboy Development Forum

Discussion about software development for the old-school Gameboys, ranging from the "Gray brick" to Gameboy Color
(Launched in 2008)

You are not logged in.

Ads

#1 2017-05-24 03:16:48

endrift
New member
Registered: 2017-05-24
Posts: 6

MBC7

Turns out that all emulators that implement MBC7 are based off of an original codebase, although later implementations are reversed out of the original implementation.

Turns out that implementation is not only wrong but it leaves out a lot of important details.

Gonna add some scattered notes here until I write up a proper page on the wiki:

- As with most MBCs, you need to write 0A to 0000 to enable the A000-BFFF range.
- Nothing in Axxx seems to read out anything other than FF without writing 40 to 4000. Needs more investigation.
- Bxxx never seems to read anything out (just FF).
- Write 55 to A000 and AA to A010 to latch the accelerometer -- needed to get new values in the registers.
- A000, A010 and A070 always read out FF afaict, contrary to existing code.
- A020/A030 and A040/A050 contain accelerometer values, but they appear to be 16 bit values centered at 81D0, although the range is about ±70 for 1g. Shaking the GB exposes a wider range of values.
- I have no idea what A060 is for yet but it always seems to read out 00.
- Values read/written to A080 are a bit field that controls a 16-bit EEPROM (93LC56, according to Tauwasser):
  - Bit 7 is chip select (CS)
  - Bit 6 is clock (SK in existing code, CLK on datasheet)
  - Bit 1 is data-in (DI)
  - Bit 0 is data-out (DO)
- Current state of the EEPROM pins is readable beyond just the data-out value, which is also perpetually readable (contrary to existing code).
- Games write commands to the EEPROM by writing 0x00, 0x80, 0xC0, 0x82, 0xC2, (i.e., /CS, CS, CS|CLK, CS|DI, CS|CLK|DI)  then writing the opcode and address as necessary (MSB first)
  - Datasheet says all opcodes are prefixed by a 1 start bit, and any other combination of CS/CLK/DI does not affect state until the start bit is hit. The initial 0 bit shift-in is unneeded.
- EEPROM has several commands, all 10 bits (according to datasheet) (x = don't care, AAAAAAA = 7-bit address/16-bit radix)
  - READ: 0b10xAAAAAAA (then shift out 16 bits)
  - EWEN (Erase/Write enable): 0b0011xxxxxx
  - EWDS (Erase/Write disable): 0b0000xxxxxx
  - WRITE: 0b01xAAAAAAA (then shift in 16 bits)
  - ERASE (fill address with 0xFFFF): 0b11xAAAAAAA
  - ERAL (fill EEPROM with 0xFFFF): 0b0010xxxxxx
  - WRAL (fill EEPROM with value): 0b0001xxxxxx (then shift in 16 bits)
- Many commands take time to settle.
- I have confirmed that the bits AND 0F0F in the address read/written don't actually matter for A080, etc (i.e. value at AF8F == value at A080).

More info is on the wiki now: http://gbdev.gg8.se/wiki/articles/MBC7

The only things that I have not tested so far are ERASE/ERAL/WRAL and all possible values being written to the registers that seem to only work with specific values.

Last edited by endrift (2017-05-29 17:35:16)

Offline

 

#2 2017-05-24 04:59:31

gekkio
New member
Registered: 2016-05-29
Posts: 4

Re: MBC7

Excellent job!
There's way too little documentation about the less common MBCs, so this is groundbreaking work.

Offline

 

#3 2017-05-24 05:02:22

nitro2k01
Administrator
Registered: 2008-02-22
Posts: 167

Re: MBC7

Interesting. So, as expected, the current emulation implementation for are done to make games work, not to emulate the exact behavior. I might have a go at MBC7... at some point. (Famous last words.)

For reference: These are the only games (in GoodGBX) that use MBC7 according to the ROM header. And the F1 versions are just "fixed" versions, probably for emulator/flashcart use, so that leaves a total of 3 distinct titles. Japanese Kirby TNT, international Kirby TNT, and Command Master. The fix is at 05:6857 where a ret opcode is inserted. Otherwise, the routine would wait in a loop for bit 0 of $A080 to become 1. This is after setting CS high, so maybe waiting for a pullup to settle?

Code:

MBC7    -       2048R   0A      YESBATT command_master_(j)_[c][!]
MBC7    -       1024R   0A      YESBATT kirby's_tilt_'n'_tumble_(u)_[c][!]
MBC7    -       1024R   0A      YESBATT kirby's_tilt_'n'_tumble_(u)_[c][f1]
MBC7    -       1024R   0A      YESBATT koro_koro_kirby_(j)_[c][!]
MBC7    -       1024R   0A      YESBATT koro_koro_kirby_(j)_[c][f1]

Blog: Gameboy Genius
"A journey of a thousand miles begins with one small step"
Old Chinese Proverb

Offline

 

#4 2017-05-24 08:09:57

Tauwasser
Member
Registered: 2010-10-23
Posts: 70

Re: MBC7

MBC7 is pretty special. The whole EEPROM-stuff is apparently just done via GPIOs and the cartridges used some library to save. There is also another 8-bit interface that is pulled up on the PCBs (SRAM maybe?) plus another input for the Z-switch (that's not populated). The acceleration values might be centered, because the accelerometer ADXL202E has 50% duty cycle at 0g for a given axis.

The EEPROM is 93LC56 for 2k and is indeed connected for x16 organization (clock less than 1 MHz, but that's easy with how slow the GB operates). This might have been chose to make saving faster and not incur twice the number of address cycles.

Last edited by Tauwasser (2017-05-24 08:13:09)

Offline

 

#5 2017-05-25 15:14:14

endrift
New member
Registered: 2017-05-24
Posts: 6

Re: MBC7

I've been writing a Python utility for bitbanging the serial protocol over parallel port for use with the GBlinkDL ROM, and I wrote some support code for MBC7 operations, including save game dumping: https://github.com/endrift/gblinkpy

Will be writing up my findings in a few hours, as well as possibly adding more MBC7 stuff. I'll probably add MBC1, 3 and 5 later on, assuming I have cartridges with all of those (I think I do). I also want to fix up my writeup to align more with what Tauwasser says, as I've confirmed that the EEPROM is actually only 128x16 bits. (I haven't opened up my cart yet to confirm the model, but the command protocol aligns.)

Last edited by endrift (2017-05-25 15:24:04)

Offline

 

#6 2017-05-28 20:10:53

endrift
New member
Registered: 2017-05-24
Posts: 6

Re: MBC7

I started filling out the wiki page: http://gbdev.gg8.se/wiki/articles/MBC7 but there's still stuff missing I won't have a chance to investigate for a bit. I also ordered a game with TAMA5 that I will investigate once I receive it in a week or two.

Last edited by endrift (2017-05-28 20:18:36)

Offline

 

#7 2017-05-29 10:10:08

Shonumi
New member
Registered: 2016-07-03
Posts: 6

Re: MBC7

Great work! About time we got this kind of documentation. Almost everything out there (for emulators) relies on the same codebase, mine too. But literally nothing in the original codebase was explained, even if it wasn't totally accurate (I had to add comments myself just to make heads or tails of it).

Really looking forward to rewriting my MBC7 code based on this new info big_smile

Offline

 

#8 2017-06-17 18:21:24

kikiwunder
New member
Registered: 2017-06-03
Posts: 5

Re: MBC7

Super awesome that you're hacking away on this!

Dunno if you saw this, but Command Master has a hidden MBC7 test screen you can access with a game genie:
https://tcrf.net/Command_Master

The stuff you've marked as "unknown" might be what they list as ”けいしゃ” which translates to inclination. On that page it lists inclination as "0 / neutral / neutral".  I wonder if there's some way to write to the MBC to make it register the current orientation as neutral?

Hope that helps, if you hadn't seen it. smile

Offline

 

#9 2017-06-27 19:22:42

Tag365
Member
Registered: 2016-06-01
Posts: 36

Re: MBC7

Didn't know that there was a controller called MBC7. Why did they skip number 6 in the counting, is that another bad number like number 4?

Offline

 

#10 2017-06-27 19:44:58

AntonioND
Member
Registered: 2014-06-17
Posts: 97

Re: MBC7

MBC6 does exist. It's just even weirder and only used by a Japanese game.

Offline

 

#11 2017-07-01 16:04:11

endrift
New member
Registered: 2017-05-24
Posts: 6

Re: MBC7

kikiwunder wrote:

Super awesome that you're hacking away on this!

Dunno if you saw this, but Command Master has a hidden MBC7 test screen you can access with a game genie:
https://tcrf.net/Command_Master

The stuff you've marked as "unknown" might be what they list as ”けいしゃ” which translates to inclination. On that page it lists inclination as "0 / neutral / neutral".  I wonder if there's some way to write to the MBC to make it register the current orientation as neutral?

Hope that helps, if you hadn't seen it. smile

Turns out Command Master was broken in my previous implementations. Thanks!

As for re-centering the accelerometer, this is done by software, not hardware. Whenever the game starts it asks you to hold the GBC flat before pressing A. This is used by the calculations as a baseline, but is not stored back into hardware.

Offline

 

#12 2017-10-18 01:48:50

skaman
New member
Registered: 2017-10-18
Posts: 1

Re: MBC7

Thanks for posting the info.

I've been working off and on on a GB cart reader.  The last items on my TO-DO list were MBC7 and TAMA5 saves.  I captured a bunch of EEPROM data from Kirby TNT and Command Master using my logic analyzer but I never completed the analysis.  Looking at the data, it all makes sense.  I'll have to finish off the MBC7 code for my reader now.

Thanks for the help!

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2005 Rickard Andersson