Gameboy Development Forum

Discussion about software development for the old-school Gameboys, ranging from the "Gray brick" to Gameboy Color
(Launched in 2008)

You are not logged in.

Ads

#1 2017-05-24 03:16:48

endrift
Member
Registered: 2017-05-24
Posts: 16

MBC7

Turns out that all emulators that implement MBC7 are based off of an original codebase, although later implementations are reversed out of the original implementation.

Turns out that implementation is not only wrong but it leaves out a lot of important details.

Gonna add some scattered notes here until I write up a proper page on the wiki:

- As with most MBCs, you need to write 0A to 0000 to enable the A000-BFFF range.
- Nothing in Axxx seems to read out anything other than FF without writing 40 to 4000. Needs more investigation.
- Bxxx never seems to read anything out (just FF).
- Write 55 to A000 and AA to A010 to latch the accelerometer -- needed to get new values in the registers.
- A000, A010 and A070 always read out FF afaict, contrary to existing code.
- A020/A030 and A040/A050 contain accelerometer values, but they appear to be 16 bit values centered at 81D0, although the range is about ±70 for 1g. Shaking the GB exposes a wider range of values.
- I have no idea what A060 is for yet but it always seems to read out 00.
- Values read/written to A080 are a bit field that controls a 16-bit EEPROM (93LC56, according to Tauwasser):
  - Bit 7 is chip select (CS)
  - Bit 6 is clock (SK in existing code, CLK on datasheet)
  - Bit 1 is data-in (DI)
  - Bit 0 is data-out (DO)
- Current state of the EEPROM pins is readable beyond just the data-out value, which is also perpetually readable (contrary to existing code).
- Games write commands to the EEPROM by writing 0x00, 0x80, 0xC0, 0x82, 0xC2, (i.e., /CS, CS, CS|CLK, CS|DI, CS|CLK|DI)  then writing the opcode and address as necessary (MSB first)
  - Datasheet says all opcodes are prefixed by a 1 start bit, and any other combination of CS/CLK/DI does not affect state until the start bit is hit. The initial 0 bit shift-in is unneeded.
- EEPROM has several commands, all 10 bits (according to datasheet) (x = don't care, AAAAAAA = 7-bit address/16-bit radix)
  - READ: 0b10xAAAAAAA (then shift out 16 bits)
  - EWEN (Erase/Write enable): 0b0011xxxxxx
  - EWDS (Erase/Write disable): 0b0000xxxxxx
  - WRITE: 0b01xAAAAAAA (then shift in 16 bits)
  - ERASE (fill address with 0xFFFF): 0b11xAAAAAAA
  - ERAL (fill EEPROM with 0xFFFF): 0b0010xxxxxx
  - WRAL (fill EEPROM with value): 0b0001xxxxxx (then shift in 16 bits)
- Many commands take time to settle.
- I have confirmed that the bits AND 0F0F in the address read/written don't actually matter for A080, etc (i.e. value at AF8F == value at A080).

More info is on the wiki now: http://gbdev.gg8.se/wiki/articles/MBC7

The only things that I have not tested so far are ERASE/ERAL/WRAL and all possible values being written to the registers that seem to only work with specific values.

Last edited by endrift (2017-05-29 17:35:16)

Offline

 

#2 2017-05-24 04:59:31

gekkio
Member
Registered: 2016-05-29
Posts: 16

Re: MBC7

Excellent job!
There's way too little documentation about the less common MBCs, so this is groundbreaking work.

Offline

 

#3 2017-05-24 05:02:22

nitro2k01
Administrator
Registered: 2008-02-22
Posts: 249

Re: MBC7

Interesting. So, as expected, the current emulation implementation for are done to make games work, not to emulate the exact behavior. I might have a go at MBC7... at some point. (Famous last words.)

For reference: These are the only games (in GoodGBX) that use MBC7 according to the ROM header. And the F1 versions are just "fixed" versions, probably for emulator/flashcart use, so that leaves a total of 3 distinct titles. Japanese Kirby TNT, international Kirby TNT, and Command Master. The fix is at 05:6857 where a ret opcode is inserted. Otherwise, the routine would wait in a loop for bit 0 of $A080 to become 1. This is after setting CS high, so maybe waiting for a pullup to settle?

Code:

MBC7    -       2048R   0A      YESBATT command_master_(j)_[c][!]
MBC7    -       1024R   0A      YESBATT kirby's_tilt_'n'_tumble_(u)_[c][!]
MBC7    -       1024R   0A      YESBATT kirby's_tilt_'n'_tumble_(u)_[c][f1]
MBC7    -       1024R   0A      YESBATT koro_koro_kirby_(j)_[c][!]
MBC7    -       1024R   0A      YESBATT koro_koro_kirby_(j)_[c][f1]

Blog: Gameboy Genius
"A journey of a thousand miles begins with one small step"
Old Chinese Proverb

Online

 

#4 2017-05-24 08:09:57

Tauwasser
Member
Registered: 2010-10-23
Posts: 160

Re: MBC7

MBC7 is pretty special. The whole EEPROM-stuff is apparently just done via GPIOs and the cartridges used some library to save. There is also another 8-bit interface that is pulled up on the PCBs (SRAM maybe?) plus another input for the Z-switch (that's not populated). The acceleration values might be centered, because the accelerometer ADXL202E has 50% duty cycle at 0g for a given axis.

The EEPROM is 93LC56 for 2k and is indeed connected for x16 organization (clock less than 1 MHz, but that's easy with how slow the GB operates). This might have been chose to make saving faster and not incur twice the number of address cycles.

Last edited by Tauwasser (2017-05-24 08:13:09)

Offline

 

#5 2017-05-25 15:14:14

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: MBC7

I've been writing a Python utility for bitbanging the serial protocol over parallel port for use with the GBlinkDL ROM, and I wrote some support code for MBC7 operations, including save game dumping: https://github.com/endrift/gblinkpy

Will be writing up my findings in a few hours, as well as possibly adding more MBC7 stuff. I'll probably add MBC1, 3 and 5 later on, assuming I have cartridges with all of those (I think I do). I also want to fix up my writeup to align more with what Tauwasser says, as I've confirmed that the EEPROM is actually only 128x16 bits. (I haven't opened up my cart yet to confirm the model, but the command protocol aligns.)

Last edited by endrift (2017-05-25 15:24:04)

Offline

 

#6 2017-05-28 20:10:53

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: MBC7

I started filling out the wiki page: http://gbdev.gg8.se/wiki/articles/MBC7 but there's still stuff missing I won't have a chance to investigate for a bit. I also ordered a game with TAMA5 that I will investigate once I receive it in a week or two.

Last edited by endrift (2017-05-28 20:18:36)

Offline

 

#7 2017-05-29 10:10:08

Shonumi
New member
Registered: 2016-07-03
Posts: 8

Re: MBC7

Great work! About time we got this kind of documentation. Almost everything out there (for emulators) relies on the same codebase, mine too. But literally nothing in the original codebase was explained, even if it wasn't totally accurate (I had to add comments myself just to make heads or tails of it).

Really looking forward to rewriting my MBC7 code based on this new info big_smile

Offline

 

#8 2017-06-17 18:21:24

kikiwunder
New member
Registered: 2017-06-03
Posts: 5

Re: MBC7

Super awesome that you're hacking away on this!

Dunno if you saw this, but Command Master has a hidden MBC7 test screen you can access with a game genie:
https://tcrf.net/Command_Master

The stuff you've marked as "unknown" might be what they list as ”けいしゃ” which translates to inclination. On that page it lists inclination as "0 / neutral / neutral".  I wonder if there's some way to write to the MBC to make it register the current orientation as neutral?

Hope that helps, if you hadn't seen it. smile

Offline

 

#9 2017-06-27 19:22:42

Tag365
Member
Registered: 2016-06-01
Posts: 44

Re: MBC7

Didn't know that there was a controller called MBC7. Why did they skip number 6 in the counting, is that another bad number like number 4?

Offline

 

#10 2017-06-27 19:44:58

AntonioND
Member
Registered: 2014-06-17
Posts: 134
Website

Re: MBC7

MBC6 does exist. It's just even weirder and only used by a Japanese game.

Offline

 

#11 2017-07-01 16:04:11

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: MBC7

kikiwunder wrote:

Super awesome that you're hacking away on this!

Dunno if you saw this, but Command Master has a hidden MBC7 test screen you can access with a game genie:
https://tcrf.net/Command_Master

The stuff you've marked as "unknown" might be what they list as ”けいしゃ” which translates to inclination. On that page it lists inclination as "0 / neutral / neutral".  I wonder if there's some way to write to the MBC to make it register the current orientation as neutral?

Hope that helps, if you hadn't seen it. smile

Turns out Command Master was broken in my previous implementations. Thanks!

As for re-centering the accelerometer, this is done by software, not hardware. Whenever the game starts it asks you to hold the GBC flat before pressing A. This is used by the calculations as a baseline, but is not stored back into hardware.

Offline

 

#12 2017-10-18 01:48:50

skaman
New member
Registered: 2017-10-18
Posts: 5

Re: MBC7

Thanks for posting the info.

I've been working off and on on a GB cart reader.  The last items on my TO-DO list were MBC7 and TAMA5 saves.  I captured a bunch of EEPROM data from Kirby TNT and Command Master using my logic analyzer but I never completed the analysis.  Looking at the data, it all makes sense.  I'll have to finish off the MBC7 code for my reader now.

Thanks for the help!

Offline

 

#13 2018-02-09 19:42:02

skaman
New member
Registered: 2017-10-18
Posts: 5

Re: MBC7

Got the MBC7 EEPROM reading and writing successfully on my cart reader.  I ended up writing to A080 using 0x00, 0x80/0xC0, and 0x82/0xC2 like the cart does.

Nice to finally pull the Kirby TNT 100% save off the cart.

Anyone tested Command Master saves?

The EEPROM on my Command Master cart is always FFs.  I've only played the game to the first part of the tutorial and I fail the first challenge every time.  Maybe I need to reach further before it saves data to the EEPROM.  At least on the cart reader, I can write and read the Command Master EEPROM.  If anyone has a good save, then I'd love to get a copy to test on my cart. 

EDIT:  I finally got past the tutorial and was able to save my game.

I'm moving on to finish the TAMA5 save code.

Last edited by skaman (2018-02-11 08:55:40)

Offline

 

#14 2018-02-11 20:14:23

skaman
New member
Registered: 2017-10-18
Posts: 5

Re: MBC7

After I finally got the Command Master cart saving, I dumped the save file and tried writing it back to the cart with an erased EEPROM.  It didn't work.

I know the EEPROM read/write code works properly as I can directly write to the EEPROM so the save game must be invalid.

I opened up the Command Master cart and found that it uses an LC66 (4K) EEPROM instead of the Kirby TNT LC56 (2K) EEPROM.

I'll have to adjust the code for the larger EEPROM size and redump the save.

EDIT:  Modified the code to handle the LC66 (4K) addresses.  Both Command Master and Kirby TNT saves now fully work.  I switch the EEPROM size based on the ROM size.

Last edited by skaman (2018-02-12 02:24:27)

Offline

 

#15 2018-02-18 17:15:01

Tauwasser
Member
Registered: 2010-10-23
Posts: 160

Re: MBC7

Command Master and Kirby use different PCBs, DMG-A40 and DMG-A47, but both have options to populate 2k or 4k EEPROMs (as per silkscreen), so the only reliable way is to know which save type is populated beforehand. IIRC RAM sive is set to zero in both game's headers, because apparently only SRAM size is tracked there, not EEPROM size. You cannot even accurately know whether 8-bit or 16-bit organization is selected as there are ROMs with the same footprint that have ORG not connected and have a fixed organization.

Offline

 

#16 2018-02-18 19:31:24

skaman
New member
Registered: 2017-10-18
Posts: 5

Re: MBC7

There's only the 3 MBC7 carts - Command Master and the two versions of Kirby TNT.

When I read the cart type as MBC7 (0x22), I then check the ROM size.  If the ROM size is 8Mb, then it is Kirby TNT/Koro Koro Kirby with the LC56.  If the ROM size is 16Mb, then it is Command Master with the LC66.

Both EEPROM types are ORG 16 on the carts.  I'm not sure on the exact chip manufacturer but I found pics of old ROHM 93LC56/66 EEPROMs with the same markings.  If they are the old ROHM EEPROMs, then they came only configured as 16-bit.

Offline

 

#17 2018-02-20 16:50:20

Tauwasser
Member
Registered: 2010-10-23
Posts: 160

Re: MBC7

The configuration is done using a hardware pin, which is left unconnected on the boards. I was just mentioning it, because the save type/EEPROM type have nothing to do with the size of the ROM, really. It's kind of like the Game Boy Advance situation where people resort to reading string from ROM in order to determine the save type.

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2005 Rickard Andersson