/
viper.cpp
3374 lines (2767 loc) · 126 KB
/
viper.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// license:BSD-3-Clause
// copyright-holders:Ville Linde, Angelo Salese
/*
Konami Viper System
Driver by Ville Linde
Software notes (as per Police 911)
-- VL - 01.06.2011
IRQs:
IRQ0: ??? (Task 4)
IRQ1: unused
IRQ2: ??? Possibly UART? Accesses registers at 0xffe00008...f
IRQ3: Sound (Task 5)
IRQ4: Voodoo3 Currently only for User Interrupt Command, maybe a more extensive handler gets installed later?
I2C: ??? (no task switch) what drives this? network? U13 (ADC838) test fails if I2C doesn't work
DMA0: unused
DMA1: unused
IIVPR3: unused
Memory:
0x000001E0: Current task
0x000001E1: Current FPU task
0x000001E4: Scheduled tasks bitvector (bit 31 = task0, etc.)
0x00000A00...BFF: Task structures
0x00-03: unknown
0x04: unknown
0x05: if non-zero, this task uses FPU
0x06-07: unknown
0x08: unknown mem pointer, task stack pointer?
0x0c: pointer to task PC (also top of stack?)
Sound:
0x00001320: A flag that's used when sound effects(?) are being played
0x00001324: Pointer to the data cache buffer to be used for loading and mixing BGM/SE.
Each buffer is 0x800 bytes in size and the game will switch between the two every IRQ3(?).
The original audio typically seems to be ADPCM which is then decoded and mixed in software.
0x00001330: L/R channel PCM data when a sound effect is played? Seems to be the last result when mixing down buffers.
0x00000310: Global timer 0 IRQ handler
0x00000320: Global timer 1 IRQ handler
0x00000330: Global timer 2 IRQ handler
0x00000340: Global timer 3 IRQ handler
0x00000350: IRQ0 handler
0x00000360: IRQ1 handler
0x00000370: IRQ2 handler
0x00000380: IRQ3 handler
0x00000390: IRQ4 handler
0x000003a0: I2C IRQ handler
0x000003b0: DMA0 IRQ handler
0x000003c0: DMA1 IRQ handler
0x000003d0: Message Unit IRQ handler
0x000004e4: Global timer 0 IRQ handler function ptr
0x000004e8: Global timer 1 IRQ handler function ptr
0x000004ec: Global timer 2 IRQ handler function ptr
0x000004f0: Global timer 3 IRQ handler function ptr
IRQ0: Vector 0x0004e020 Stack 0x000d4fa4
IRQ1: Vector 0x0000a5b8 Stack 0x0001323c (dummy)
IRQ2: Vector 0x000229bc Stack 0x000d4fa4
IRQ3: Vector 0x006a02f4 Stack 0x006afeb0
IRQ4: Vector 0x0068c354 Stack 0x0068cc54
I2C: Vector 0x00023138 Stack 0x000d4fa4
Functions of interest:
0x0000f7b4: SwitchTask()
0x0000c130: ScheduleTask()
0x00009d00: LoadProgram(): R3 = ptr to filename
TODO:
- needs a proper way to dump security dongles, anything but p9112 has placeholder ROM for
ds2430.
- Voodoo 3 has issues with LOD minimums, cfr. mocapglf where card check don't display a bar
near the percentage;
- convert i2c to be a real i2c-complaint device;
- hookup adc0838, reads from i2c;
- convert epic to be a device, make it input_merger/irq_callback complaint;
- (more intermediate steps for proper PCI conversions here)
- xtrial: hangs when coined up;
- gticlub2: throws NETWORK ERROR after course select;
- jpark3: attract mode demo play acts weird, the dinosaur gets submerged
and camera doesn't really know what to do, CPU core bug?
- jpark3: crashes during second attract cycle;
- sscopex, thrild2: attract mode black screens (coin still works), sogeki/sscopefh are unaffected;
- thrild2: no BGMs;
- wcombat: black screen when entering service mode;
- mocapglf, sscopefh, sscopex: implement 2nd screen output, controlled by IP90C63A;
\- sscopex/sogeki desyncs during gameplay intro, leaves heavy trails in gameplay;
- ppp2nd: hangs when selecting game mode from service (manages to save);
- code1db: crashes when selecting single course type;
- wcombatj: gets stuck on network check;
- thrild2c: blue screen;
- thrild2ac: black screen;
- all games needs to be verified against factory settings
(game options, coin options & sound options often don't match "green colored" defaults)
Other notes:
- "Distribution error" means there's a region mismatch.
- Hold TEST while booting (from the very start) to initialize the RTC for most games.
- It seems that p911 has 3 unique regional images: U/E, K/A, and J. If you try booting, for example, U region on a K/A image, it won't find some files and will error out with "distribution error".
- mocapglf: enable "show diag" at boot then disable it once the diag text appears.
This will allow game to bypass the I/O SENSOR error later on.
Game status (potentially outdated, to be moved on top):
boxingm Goes in-game. Controllers are not emulated. Various graphical glitches.
jpark3 Goes in-game. Controllers are not emulated. Various graphical glitches.
mocapb,j Goes in-game. Controllers are not emulated. Various graphical glitches. Random crashes.
ppp2nd,a Fully playable with graphical glitches. No network or DVD support. Crashes when returning to game mode from test menu.
p911(all) Goes in-game. Controllers are not emulated. Various graphical glitches.
tsurugi,j Goes in-game. Controllers are not emulated. Various graphical glitches.
p9112 Goes in-game. Controllers are not emulated. Various graphical glitches.
gticlub2,ea Attract mode works. Coins up. Hangs in various places. Will crash with "network error" after stage is selected.
thrild2,a Attract mode with partial graphics. Coins up. Hangs in various places.
sscopefh Graphics heavily glitched. Gun controller is not emulated. Sensor error and hopper error stop it from working.
mfightc,c Requires touch panel emulation. Gets stuck at "Waiting for central monitor, checking serial...".
xtrial Hangs at "Please set the time for the bookkeeping" message.
code1d,b,a Can boot but crashes randomly and quickly so it's hard to do anything.
mocapglf Gets stuck at "SENSOR I/O ERROR" though test menu can still be entered.
sscopex,sogeki Graphics very heavily glitched. Gun controller is not emulated.
wcombat Can boot into a test menu by using a combination of dipswitches, but it says "serial check bad". Can't boot normally.
wcombatu Bootable when dipsw 4 is set to on. Controls not implemented so it's not possible to pass nickname selection screen. Freezes when test button is pressed.
thrild2c,ac Inf loop on blue screen
===================================================================================================
Konami Viper Hardware Overview (last updated 5th June 2011 10:56pm)
Games on this hardware include:
Konami
Game ID Year Game
--------------------------------------------------------------------------------------------------------------------
GK922 2000 Code One Dispatch
G???? 2001 ParaParaParadise 2nd Mix
GM941 2000 Driving Party: Racing in Italy (World) / GTI Club: Corso Italiano (Japan) / GTI Club 2 (USA?)
G?A00 2000 Police 911 (USA) / Police 24/7 (World) / The Keisatsukan: Shinjuku 24-ji (Asia/Japan/Korea)
GKA13 2001 Silent Scope EX (USA/World) / Sogeki (Japan)
G?A29 2001 Mocap Boxing
G?A30 2002 Blade of Honor (USA) / Tsurugi (World/Japan)
GMA41 2001 Thrill Drive 2
G?A45 2001 Boxing Mania
G*B11 2001 Police 911 2 (USA) / Police 24/7 2 (World) / The Keisatsukan 2: Zenkoku Daitsuiseki Special (Japan)
G?B33 2001 Mocap Golf
G?B41 2001 Jurassic Park III
G?B4x 2002 Xtrial Racing
G?C09 2002 Mahjong Fight Club
G?C22 2002 World Combat (USA/Japan/Korea) / Warzaid (Europe)
PCB Layout
----------
Early revision - GM941-PWB(A)B (CN13/15/16 not populated and using 941A01 BIOS)
Later revision - GM941-PWB(A)C (with 941B01 BIOS)
Copyright 1999 KONAMI
|----------------------------------------------------------|
| LA4705 6379AL |
|-| TD62064 14.31818MHz CN15|
| 3793-A |
| |------| |--------| |
|J |056879| |3DFX |MB81G163222-80
|A | |PQR0RV21 |355-0024| |
|M |------| XC9572XL |-030 |MB81G163222-80
|M |--------| |
|A MB81G163222-80 |
| ADC0838 |------------| MB81G163222-80|
| LM358 |MOTOROLA | |
| XPC8240LZU200E 33.868MHz CN13|
|-| PC16552 | | |
| PQ30RV21 | | CY7C199 |
|-| | | |
| |------------| XCS10XL |
| 48LC2M32B2 48LC2M32B2 |
|2 |
|8 CN17 |
|W XC9536(1) XC9536(2) |-------------| |
|A | DUAL | |
|Y | PCMCIA | |
| M48T58Y.U39 | SLOTS | |
| | | |
| 29F002 | | CN16|
|-| DS2430.U37 | | |
| DIP(4) CN4 CN5 CN7 CN9 | | CN12 |
|----------------------------------|-------------|---------|
Notes:
XPC8240LZU200E - Motorola XPC8240LZU200E MPC8420 PPC603e-based CPU (TBGA352 @ U38). Clock input is 33.868MHz
Chip rated at 200MHz so likely clock is 33.868 x6 = 203.208MHz
3DFX - 3DFX Voodoo III 3500 graphics chip with heatsink (BGA @ U54). Clock input 14.31818MHz
Full markings: 355-0024-030 F26664.10C 0025 20005 TAIWAN 1301
48LC2M32B2 - Micron Technology 48LC2M32B2-6 2M x32-bit (512k x 32 x 4 banks = 64MB) 166MHz Synchronous
DRAM (TSOP86 @ U28 & U45)
MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Graphics DRAM (TQFP100 @ U53, U56, U59 & U60)
CY7C199 - Cypress Semiconductor CY7C199-15VC 32k x8 SRAM (SOJ28 @ U57)
PC16552 - National Semiconductor PC16552D Dual Universal Asynchronous Receiver/Transmitter with FIFO's (PLCC44 @ U7)
XC9536(1) - Xilinx XC9536 In-System Programmable CPLD stamped 'M941A1' (PLCC44 @ U17)
XC9536(2) - Xilinx XC9536 In-System Programmable CPLD stamped 'M941A2' (PLCC44 @ U24)
XC9572XL - Xilinx XC9572XL High Performance CPLD stamped 'M941A3A' (PLCC44 @ U29)
XCS10XL - Xilinx XCS10XL Spartan-XL FPGA (TQFP100 @ U55)
056879 - Konami 056879 custom IC (QFP120 @ U15)
PQ30RV21 - Sharp PQ30RV21 low-power voltage regulator (5 Volt to 3 Volt)
LA4705 - Sanyo LA4705 15W 2-channel power amplifier (SIP18)
LM358 - National Semiconductor LM358 low power dual operational amplifier (SOIC8 @ U14)
6379AL - NEC uPC6379AL 2-channel 16-bit D/A converter (SOIC8 @ U30)
ADC0838 - National Semiconductor ADC0838 Serial I/O 8-Bit A/D Converters with Multiplexer Options (SOIC20 @ U13)
DS2430 - Dallas DS2430 256-bits 1-Wire EEPROM.
M48T58Y - ST Microelectronics M48T58Y Timekeeper RAM (DIP28 @ U39).
29F002 - Fujitsu 29F002 256k x8 EEPROM stamped '941B01' (PLCC44 @ U25). Earlier revision stamped '941A01'
CN4/CN5 - RCA-type network connection jacks
CN7 - 80 pin connector (unused in all games?)
CN9 - DIN5 socket for dongle. Dongle is a DIN5 male plug containing a standard DS2430 wired to
DIN pins 2, 3 & 4. Pin 1 NC, Pin 2 GND, Pin 3 DATA, Pin 4 NC, Pin 5 NC. If the dongle is
required and plugged in it overrides the DS2430 on the main board. Without the (on-board)
DS2430 the PCB will complain after the CF check with HARDWARE ERROR. If the DS2430 is not
correct for the game the error given is RTC BAD even if the RTC is correct. Most games don't require
a dongle and accept any DS2430 on the main board.
CN12 - 4 pin connector (possibly stereo audio output?)
CN13 - Power connector for plug-in daughterboard
CN15/CN16 - Multi-pin IDC connectors for plug-in daughterboard (see detail below)
CN17 - Dual PCMCIA slots. Usually only one slot is used containing a PCMCIA to CF adapter. The entire game
software resides on the CF card. Games use 32M, 64M and 128M CF cards. In many cases a different
CF card version of the same game can be swapped and the existing RTC works but sometimes the RTC data
needs to be re-initialised to factory defaults by entering test mode. Sometimes the game will not boot
and gives error RTC BAD meaning the RTC is not compatible with the version or the dongle is required.
See DS2430 below for more info.
28-WAY - Edge connector used for connecting special controls such as guns etc.
DIP(4) - 4-position DIP switch. Switch 1 skips the CF check for a faster boot-up. The others appear unused?
[DS2430] Has 256 bits x8 EEPROM (32 bytes), 64 bits x8 (8 bytes)
one-time programmable application register and unique factory-lasered and tested 64-bit
registration number (8-bit family code + 48-bit serial number + 8-bit CRC) (TO-92 @ U37)
The OTP application register on the common DS2430 and the Police 911 2 DS2430 are not programmed
(application register reads all 0xFF and the status register reads back 0xFF), so it's probably safe
to assume they're not used on any of them.
It appears the DS2430 is not protected from reading and the unique silicon serial number is
included in the 40 byte dump. This serial number is used as a check to verify the NVRAM and DS2430.
In the Police 911 2 NVRAM dump the serial number of the DS2430 is located at 0x002A and 0x1026
If the serial number in the NVRAM and DS2430 match then they are paired and the game accepts the NVRAM.
If they don't match the game requires an external DS2430 (i.e. dongle) and flags the NVRAM as 'BAD'
The serial number is not present in the CF card (2 different Police 911 2 cards of the same version
were dumped and matched).
When the lasered ROM is read from the DS2430, it comes out from LSB to MSB (family code, LSB of
S/N->MSB of S/N, CRC)
For Police 911 2 that is 0x14 0xB2 0xB7 0x4A 0x00 0x00 0x00 0x83
Family code=0x14
S/N=0x0000004AB7B2
CRC=0x83
In a DS2430 dump, the first 32 bytes is the EEPROM and the lasered ROM is 8 bytes and starts at 0x20h
For Police 911 2 that is....
00000000h CB 9B 56 EC A0 4C 87 53 51 46 28 E7 00 00 00 74
00000010h 30 A9 C7 76 B9 85 A3 43 87 53 50 42 1A E7 FA CF
00000020h 14 B2 B7 4A 00 00 00 83
It may be possible to hand craft a DS2430 for a dongle-protected version of a game simply by using
one of the existing DS2430 dumps and adjusting the serial number found in a dump of the NVRAM to pair them
or adjusting the serial number in the NVRAM to match the serial number found in one of the dumped DS2430s.
This Police 911 2 board was upgraded from Police 911 by plugging in the dongle and changing the CF card.
The NVRAM had previously died and the board was dead. Normally for a Viper game that is fatal. Using
the NVRAM from Police 911 allowed it to boot and then the NVRAM upgraded itself with some additional
data (the original data remained untouched). This means the dongle does more than just protect the game.
Another interesting fact about this upgrade is it has been discovered that the PCB can write to the
external DS2430 in the dongle. This has been proven because the serial number of the DS2430 soldered
on the PCB is present in the EEPROM area of the Police 911 2 DS2430.
Here is a dump of the DS2430 from Police 911. Note the EEPROM area is empty and the serial number (from 0x20 onwards)
is present in the above Police 911 2 DS2430 dump at locations 0x11, 0x10 and 0x0F
00000000h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000010h FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000020h 14 A9 30 74 00 00 00 E7
This proves that the EEPROM area in the DS2430 is unused by an unprotected game and in fact the on-board
DS2430 is completely unused by an unprotected game. That is why any unprotected game will work on any
Viper PCB regardless of the on-board DS2430 serial number.
The existing DS2430 'common' dump used in the unprotected games was actually from a (dongle-protected)
Mahjong Fight Club PCB but that PCB was used to test and run all of the unprotected Viper games.
[M48T58Y] When this dies (after 10 year lifespan)
the game will complain with error RTC BAD then reset. The data inside the RTC can not be hand created
(yet) so to revive the PCB the correct RTC data must be re-programmed to a new RTC and replaced
on the PCB.
Regarding the RTC and protection-related checks....
"RTC OK" checks 0x0000->0x0945 (i.e. I can clear the contents after 0x0945 and the game will still
happily boot). The NVRAM contents are split into chunks, each of which are checksummed. It is a 16-bit checksum,
computed by summing two consecutive bytes as a 16-bit integer, where the final sum must add up to 0xFFFF (mod
65536). The last two bytes in the chunk are used to make the value 0xFFFF. There doesn't appear to be a
complete checksum over all the chunks (I can pick and choose chunks from various NVRAMs, as long as each chunk
checksum checks out). The important chunks for booting are the first two.
The first chunk goes from 0x0000-0x000F. This seems to be a game/region identifier, and doesn't like its
contents changed (I didn't try changing every byte, but several of the bytes would throw RTC errors, even with a
fixed checksum). I'd guess that the CF verifies this value, since it's different for every game (i.e. Mocap
Boxing NVRAM would have a correct checksum, but shouldn't pass Police 911 checks).
The second chunk goes from 0x0010-0x0079. This seems to be a board identifier. This has (optionally)
several fields, each of which are 20 bytes long. I'm unsure of the first 6 bytes, the following 6
bytes are the DS2430A S/N, and the last 8 bytes are a game/region/dongle identifier. If running
without a dongle, only the first 20 byte field is present. With a dongle, a second 20 byte field will
be present. Moving this second field into the place of the first field (and fixing the checksum)
doesn't work, and the second field will be ignored if the first field is valid for the game (and in
which case the dongle will be ignored). For example, Police 911 will boot with a valid first field,
with or without the second field, and with or without the dongle plugged in. If you have both fields,
and leave the dongle plugged in, you can switch between Police 911 and Police 911/2 by simply swapping
CF cards.
The PCB pinout is JAMMA but the analog controls (pots for driving games mostly) connect to pins on the JAMMA connector.
The 2 outer pins of each pot connect to +5V and GND. If the direction of control is opposite to what is expected simply
reverse the wires.
The centre pin of each pot joins to the following pins on the JAMMA connector.....
Pin 25 Parts side - GAS POT
Pin 25 Solder side - STEERING POT
Pin 26 Parts side - HANDBRAKE POT (if used, for example Xtrial Racing)
Pin 26 Solder side - BRAKE POT
For the gun games (Jurassic Park III and Warzaid) the gun connects to the 28 way connector like this......
Pin 1 Parts side - Gun optical input
Pin 2 Parts side - Ground
Pin 3 Parts side - +5V
Jamma pin 22 parts side - Gun trigger
Player 2 gun connects to the same pin numbers on the solder side.
Jurassic Park III also uses 2 additional buttons for escaping left and right. These are wired to buttons on the Jamma
connector.
Additionally on the 28-WAY connector is...
Pin 7 parts side - Serial TX
Pin 7 solder side - Serial RX
Pin 8 solder side - GND (used by serial)
Pin 9 parts side - SP_LP (outputs to SP-F, front speaker)
Pin 9 solder side - SP_LN
Pin 9 parts side - SP_RP (output splits into SP-BL and SP-BR, rear speaker(s))
Pin 9 solder side - SP_RN
Measurements
------------
X1 - 33.86803MHz
X2 - 14.31700MHz
HSync - 24.48700kHz
VSync - 58.05630Hz
Additional PCBs
---------------
GQA13-PWB(D)
Copyright 2000 KONAMI
|--------------------|
| MB81G163222-80 |
| 40MHz|
| CN4|
| IP90C63A |
|----| CN2|
| |
| |
| |
| CN3|
| |
|--------------| |
| |-|
| IP90C63A |
| |-|
| MB81G163222-80 |
|----------| XC9536XL CN1 |
|----------------| |
| |
| |
| *|
| |
| |
| |
| |
| |
| |
| |
|CN5
|--|
Notes:
This PCB is used with Mocap Golf only and drives the 2 external monitors.
An almost identical PCB is used with Silent Scope EX but the sticker says '15KHz x2' and the
CPLD is likely different. This most likely drives the small monitor inside the gun sight.
XC9536XL - Xilinx XC9536 In-System Programmable CPLD stamped 'QB33A1' (PLCC44)
* - sticker '24KHz x2'
MB81G163222-80 - Fujitsu MB81G163222-80 256k x 32-bit x 2 banks Synchronous Graphics DRAM (TQFP100)
IP90C63A - i-Chips IP90C63A Video Controller chip (QFP144)
CN1 - Power connector, plugs into CN13 on main board
CN2/CN3 - Video output connector to external monitors
CN4/CN5 - Multi-pin IDC connectors joining to main board CN15/CN16
I/O Board for Mocap Golf
----------------------------------
Board#: OMZ-3DCPU
The I/O board and hook-up is very similar to the gun board used on
House Of The Dead 2 (NAOMI).
The I/O board talks to the main board via a MAX232 TX/RX connection.
The MCU is a ROM-less NEC D784031GC.
EPROM is common 27C512 EPROM. End of the ROM shows plain text
'COPYRIGHT(C) OHMIC 1997-1998'
The rest of the board just contains lots of opamps, logic, a DC-DC converter,
resistors/caps/diodes/inductors, LM7805 5V regulator, MAX232, 2MHz XTAL,
some pots, 2-position dipsw (both on, pulls MCU pins 77 & 78 to ground),
VCO (2x BA7042), dual frequency synthesizer (BU2630) and a bunch of
connectors.
The monitor has a lot of LED sensors around the edge. The sensors
are the same type used by Sega gun games like Too Spicy, HOTD2 etc.
The sensors are linked together (like Christmas tree lights) and plug into the
I/O board. The gun/golf club plugs into the gun connectors.
There are 2 gun connectors on the board but as far as I know Mocap Golf is
a single player game, although network/e-Amusement might be possible.
The golf club acts like a LED gun. PCB power input is 12V.
*/
#include "emu.h"
#include "cpu/powerpc/ppc.h"
#include "cpu/upd78k/upd78k4.h"
#include "bus/ata/ataintf.h"
#include "bus/ata/hdd.h"
#include "machine/ds2430a.h"
#include "machine/ins8250.h"
#include "machine/lpci.h"
#include "machine/timekpr.h"
#include "machine/timer.h"
#include "sound/dmadac.h"
#include "video/voodoo_banshee.h"
#include "emupal.h"
#include "screen.h"
#include "speaker.h"
// configurable logging
//#define LOG_WARN (1U << 1)
#define LOG_I2C (1U << 2)
#define LOG_IRQ (1U << 3)
#define LOG_TIMER (1U << 4)
#define VERBOSE (LOG_GENERAL)
//#define LOG_OUTPUT_STREAM std::cout
#include "logmacro.h"
#define LOGI2C(...) LOGMASKED(LOG_I2C, __VA_ARGS__)
#define LOGIRQ(...) LOGMASKED(LOG_IRQ, __VA_ARGS__)
#define LOGTIMER(...) LOGMASKED(LOG_TIMER, __VA_ARGS__)
namespace {
#define PCI_CLOCK (XTAL(33'868'800))
#define SDRAM_CLOCK (PCI_CLOCK * 3) // Main SDRAMs run at 100 MHz
#define TIMER_CLOCK (SDRAM_CLOCK / 8)
class viper_state : public driver_device
{
public:
viper_state(const machine_config &mconfig, device_type type, const char *tag)
: driver_device(mconfig, type, tag),
m_voodoo(*this, "voodoo"),
m_maincpu(*this, "maincpu"),
m_screen(*this, "screen"),
m_duart_com(*this, "duart_com"),
m_ata(*this, "ata"),
m_lpci(*this, "pcibus"),
m_ds2430(*this, "ds2430"),
m_ds2430_ext(*this, "ds2430_ext"),
m_workram(*this, "workram"),
m_io_ports(*this, "IN%u", 0U),
m_analog_input(*this, "AN%u", 0U),
m_gun_input(*this, "GUN%u", 0U),
m_io_ppp_sensors(*this, "SENSOR%u", 1U),
m_dmadac(*this, { "dacr", "dacl" })
{
}
void viper(machine_config &config);
void viper_ppp(machine_config &config);
void viper_omz(machine_config &config);
void viper_fullbody(machine_config &config);
void viper_fbdongle(machine_config &config);
void init_viper();
void init_vipercf();
void init_viperhd();
int ds2430_combined_r();
protected:
virtual void machine_start() override;
virtual void machine_reset() override;
virtual uint32_t screen_update(screen_device &screen, bitmap_rgb32 &bitmap, const rectangle &cliprect);
required_device<voodoo_3_device> m_voodoo;
private:
void mpc8240_soc_map(address_map &map);
void unk2_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t voodoo3_io_r(offs_t offset, uint64_t mem_mask = ~0);
void voodoo3_io_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t voodoo3_r(offs_t offset, uint64_t mem_mask = ~0);
void voodoo3_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t voodoo3_lfb_r(offs_t offset, uint64_t mem_mask = ~0);
void voodoo3_lfb_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint8_t input_r(offs_t offset);
void output_w(offs_t offset, uint8_t data);
uint8_t ds2430_r();
void ds2430_w(uint8_t data = 0);
uint8_t ds2430_ext_r();
void ds2430_ext_w(uint8_t data = 0);
void unk1a_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
void unk1b_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t pci_config_addr_r();
void pci_config_addr_w(uint64_t data);
uint64_t pci_config_data_r();
void pci_config_data_w(uint64_t data);
uint64_t cf_card_data_r(offs_t offset, uint64_t mem_mask = ~0);
void cf_card_data_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t cf_card_r(offs_t offset, uint64_t mem_mask = ~0);
void cf_card_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t ata_r(offs_t offset, uint64_t mem_mask = ~0);
void ata_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint64_t unk_serial_r(offs_t offset, uint64_t mem_mask = ~0);
void unk_serial_w(offs_t offset, uint64_t data, uint64_t mem_mask = ~0);
uint16_t ppp_sensor_r(offs_t offset);
void uart_int(int state);
void voodoo_vblank(int state);
void voodoo_pciint(int state);
//the following two arrays need to stay public til the legacy PCI bus is removed
uint32_t m_voodoo3_pci_reg[0x100];
uint32_t m_mpc8240_regs[256/4];
void viper_map(address_map &map);
void viper_ppp_map(address_map &map);
void omz3d_map(address_map &map);
TIMER_CALLBACK_MEMBER(epic_global_timer_callback);
TIMER_CALLBACK_MEMBER(i2c_timer_callback);
int m_cf_card_ide = 0;
int m_unk_serial_bit_w = 0;
uint16_t m_unk_serial_cmd = 0U;
uint16_t m_unk_serial_data = 0U;
uint16_t m_unk_serial_data_r = 0U;
uint8_t m_unk_serial_regs[0x80]{};
uint32_t m_sound_buffer_offset = 0U;
bool m_sound_irq_enabled = false;
TIMER_DEVICE_CALLBACK_MEMBER(sound_timer_callback);
// MPC8240 EPIC, to be device-ified
enum
{
MPC8240_IRQ0 = 0,
MPC8240_IRQ1,
MPC8240_IRQ2,
MPC8240_IRQ3,
MPC8240_IRQ4,
MPC8240_IRQ5,
MPC8240_IRQ6,
MPC8240_IRQ7,
MPC8240_IRQ8,
MPC8240_IRQ9 ,
MPC8240_IRQ10,
MPC8240_IRQ11,
MPC8240_IRQ12,
MPC8240_IRQ13,
MPC8240_IRQ14,
MPC8240_IRQ15,
MPC8240_I2C_IRQ,
MPC8240_DMA0_IRQ,
MPC8240_DMA1_IRQ,
MPC8240_MSG_IRQ,
MPC8240_GTIMER0_IRQ,
MPC8240_GTIMER1_IRQ,
MPC8240_GTIMER2_IRQ,
MPC8240_GTIMER3_IRQ,
MPC8240_NUM_INTERRUPTS
};
enum
{
I2C_STATE_ADDRESS_CYCLE = 1,
I2C_STATE_DATA_TRANSFER
};
struct MPC8240_IRQ
{
uint32_t vector = 0U;
int priority = 0;
int destination = 0;
int active = 0;
int pending = 0;
int mask = 0;
};
struct MPC8240_GLOBAL_TIMER
{
uint32_t base_count = 0U;
int enable = 0;
emu_timer *timer = nullptr;
};
struct MPC8240_EPIC
{
uint32_t iack = 0U;
uint32_t eicr = 0U;
uint32_t svr = 0U;
uint8_t pctpr = 0x0U;
int active_irq = 0;
MPC8240_IRQ irq[MPC8240_NUM_INTERRUPTS];
MPC8240_GLOBAL_TIMER global_timer[4];
};
MPC8240_EPIC m_epic{};
void epic_update_interrupts();
void mpc8240_interrupt(int irq);
void mpc8240_epic_init();
void mpc8240_epic_reset(void);
struct MPC8240_I2C {
uint8_t adr = 0U;
int fdr = 0, dffsr = 0;
uint8_t cr = 0U;
uint8_t sr = 0U;
int state = 0;
uint8_t addr_latch = 0U;
bool rw = 0;
emu_timer *timer = nullptr;
};
MPC8240_I2C m_i2c;
uint8_t i2cdr_r(offs_t offset);
void i2cdr_w(offs_t offset, uint8_t data);
required_device<ppc_device> m_maincpu;
required_device<screen_device> m_screen;
required_device<pc16552_device> m_duart_com;
required_device<ata_interface_device> m_ata;
required_device<pci_bus_legacy_device> m_lpci;
required_device<ds2430a_device> m_ds2430;
optional_device<ds2430a_device> m_ds2430_ext;
required_shared_ptr<uint64_t> m_workram;
required_ioport_array<8> m_io_ports;
required_ioport_array<4> m_analog_input;
required_ioport_array<4> m_gun_input;
optional_ioport_array<4> m_io_ppp_sensors;
required_device_array<dmadac_sound_device, 2> m_dmadac;
uint32_t mpc8240_pci_r(int function, int reg, uint32_t mem_mask);
void mpc8240_pci_w(int function, int reg, uint32_t data, uint32_t mem_mask);
uint32_t voodoo3_pci_r(int function, int reg, uint32_t mem_mask);
void voodoo3_pci_w(int function, int reg, uint32_t data, uint32_t mem_mask);
};
class viper_subscreen_state : public viper_state
{
public:
viper_subscreen_state(const machine_config &mconfig, device_type type, const char *tag)
: viper_state(mconfig, type, tag)
{}
protected:
virtual uint32_t screen_update(screen_device &screen, bitmap_rgb32 &bitmap, const rectangle &cliprect) override;
virtual void video_start() override;
private:
std::unique_ptr<bitmap_rgb32> m_voodoo_buf;
std::unique_ptr<bitmap_rgb32> m_ttl_buf;
};
uint32_t viper_state::screen_update(screen_device &screen, bitmap_rgb32 &bitmap, const rectangle &cliprect)
{
return m_voodoo->update(bitmap, cliprect) ? 0 : UPDATE_HAS_NOT_CHANGED;
}
void viper_subscreen_state::video_start()
{
m_voodoo_buf = std::make_unique<bitmap_rgb32>(1024, 1024);
m_ttl_buf = std::make_unique<bitmap_rgb32>(1024, 1024);
}
// TODO: multiscreen games enables TV out in Voodoo core specifically for these games,
// then drives what to actually draw thru overlay regs.
// [:voodoo] ':maincpu' (000205C8):internal_io_w(vidInFormat) = 00008000 & FFFFFFFF
// sscopex (sub screen 320x240, current m_ttl_buf cuts off picture)
// [:voodoo] ':maincpu' (0002A424):internal_io_w(vidOverlayStartCoords) = 00000000 & FFFFFFFF
// [:voodoo] ':maincpu' (0002A424):internal_io_w(vidOverlayEndScreenCoord) = 0017F3FF & FFFFFFFF
// [:voodoo] ':maincpu' (0002A424):internal_io_w(vidOverlayDudxOffsetSrcWidth) = 20000000 & FFFFFFFF
// [:voodoo] ':maincpu' (0002A424):internal_io_w(vidDesktopOverlayStride) = 00080008 & FFFFFFFF
// [:voodoo] ':maincpu' (000200DC):internal_io_w(vidOverlayStartCoords) = 0000004E & FFFFFFFF
// [:voodoo] ':maincpu' (000200DC):internal_io_w(vidOverlayEndScreenCoord) = 000FF289 & FFFFFFFF
// [:voodoo] ':maincpu' (000200DC):internal_io_w(vidOverlayDudxOffsetSrcWidth) = 11E00000 & FFFFFFFF
// [:voodoo] ':maincpu' (000200DC):internal_io_w(vidDesktopOverlayStride) = 00050008 & FFFFFFFF
// mocapglf (sub screen 512x384, ROT90 like main)
// [:voodoo] ':maincpu' (0102A4AC):internal_io_w(vidOverlayStartCoords) = 00000000 & FFFFFFFF
// [:voodoo] ':maincpu' (0102A4AC):internal_io_w(vidOverlayEndScreenCoord) = 0017F3FF & FFFFFFFF
// [:voodoo] ':maincpu' (0102A4AC):internal_io_w(vidOverlayDudxOffsetSrcWidth) = 20000000 & FFFFFFFF
// [:voodoo] ':maincpu' (0102A4AC):internal_io_w(vidDesktopOverlayStride) = 00080008 & FFFFFFFF
// [:voodoo] ':maincpu' (010200DC):internal_io_w(vidOverlayStartCoords) = 00000000 & FFFFFFFF
// [:voodoo] ':maincpu' (010200DC):internal_io_w(vidOverlayEndScreenCoord) = 0017F3FF & FFFFFFFF
// [:voodoo] ':maincpu' (010200DC):internal_io_w(vidOverlayDudxOffsetSrcWidth) = 20000000 & FFFFFFFF
// [:voodoo] ':maincpu' (010200DC):internal_io_w(vidDesktopOverlayStride) = 00080008 & FFFFFFFF
// Stereo video seems disabled (no writes to rightOverlayBuf) so a 30 Hz TTL demuxer may still be
// used here.
// TODO: we need to read the secondary TV out for nothing atm, otherwise sscopefh (at least) will hang (???)
uint32_t viper_subscreen_state::screen_update(screen_device &screen, bitmap_rgb32 &bitmap, const rectangle &cliprect)
{
m_voodoo->update(screen.frame_number() & 1 ? *m_voodoo_buf : *m_ttl_buf, cliprect);
copybitmap(bitmap, *m_voodoo_buf, 0, 0, cliprect.min_x, cliprect.min_y, cliprect);
return 0;
}
static inline uint64_t read64be_with_32sle_device_handler(read32s_delegate handler, offs_t offset, uint64_t mem_mask)
{
mem_mask = swapendian_int64(mem_mask);
uint64_t result = 0;
if (ACCESSING_BITS_0_31)
result = (uint64_t)(handler)(offset * 2, mem_mask & 0xffffffff);
if (ACCESSING_BITS_32_63)
result |= (uint64_t)(handler)(offset * 2 + 1, mem_mask >> 32) << 32;
return swapendian_int64(result);
}
static inline void write64be_with_32sle_device_handler(write32s_delegate handler, offs_t offset, uint64_t data, uint64_t mem_mask)
{
data = swapendian_int64(data);
mem_mask = swapendian_int64(mem_mask);
if (ACCESSING_BITS_0_31)
handler(offset * 2, data & 0xffffffff, mem_mask & 0xffffffff);
if (ACCESSING_BITS_32_63)
handler(offset * 2 + 1, data >> 32, mem_mask >> 32);
}
/*****************************************************************************/
uint32_t viper_state::mpc8240_pci_r(int function, int reg, uint32_t mem_mask)
{
switch (reg)
{
}
return m_mpc8240_regs[reg/4];
}
void viper_state::mpc8240_pci_w(int function, int reg, uint32_t data, uint32_t mem_mask)
{
COMBINE_DATA(&m_mpc8240_regs[reg/4]);
}
uint64_t viper_state::pci_config_addr_r()
{
return m_lpci->read_64be(0, 0xffffffff00000000U);
}
void viper_state::pci_config_addr_w(uint64_t data)
{
m_lpci->write_64be(0, data, 0xffffffff00000000U);
}
uint64_t viper_state::pci_config_data_r()
{
return m_lpci->read_64be(1, 0x00000000ffffffffU) << 32;
}
void viper_state::pci_config_data_w(uint64_t data)
{
m_lpci->write_64be(1, data >> 32, 0x00000000ffffffffU);
}
/*****************************************************************************/
// MPC8240 Embedded Programmable Interrupt Controller (EPIC)
// TODO: timing calculation, comes from fdr / dffsr
// most if not all games in the driver sets fdr = 0x27 = 512, dffsr = 0x21
#define I2C_TIMER_FREQ (SDRAM_CLOCK / 512) / 10
uint8_t viper_state::i2cdr_r(offs_t offset)
{
u8 res = 0;
if (m_i2c.cr & 0x80 && !machine().side_effects_disabled()) // only do anything if the I2C module is enabled
{
if (m_i2c.state == I2C_STATE_ADDRESS_CYCLE)
{
LOGI2C("I2C address cycle read\n");
m_i2c.state = I2C_STATE_DATA_TRANSFER;
m_i2c.timer->adjust(attotime::from_hz(I2C_TIMER_FREQ));
}
else if (m_i2c.state == I2C_STATE_DATA_TRANSFER)
{
LOGI2C("I2C data read\n");
m_i2c.state = I2C_STATE_ADDRESS_CYCLE;
// set transfer complete in status register
m_i2c.sr |= 0x80;
if (m_i2c.rw)
{
if ((m_i2c.addr_latch & 0xf0) == 0x10)
{
// TODO: hackish direct read
// What should really happen here is that i2c initiates a transfer with
// connected devices in serial form, cycling thru the various devices.
// The hard part is to drive the adc (which has 4 write and 2 read lines)
// with only sda/scl, and assuming it is really adc and the Guru note doesn't
// refer to boxingm instead.
// 0x1c: voltage, assume 5v
if (m_i2c.addr_latch == 0x1c)
return 0x80;
const u16 adc_value = m_analog_input[m_i2c.addr_latch & 0x3]->read();
// FIXME: upper nibble is currently discarded in port defs
// is it expecting 7 bits of data and 1 of parity?
// cfr. input tests returning different values for each nibble when both are equal.
const u8 adc_nibble = BIT(m_i2c.addr_latch, 2) ? 0 : 8;
res = (adc_value) >> adc_nibble;
}
else
LOG("I2C: unmapped read access %02x\n", m_i2c.addr_latch);
}
else
LOG("I2C: read access %02x in write mode!\n", m_i2c.addr_latch);
// generate interrupt if interrupt are enabled
/*if (m_i2c.cr & 0x40)
{
printf("I2C interrupt\n");
mpc8240_interrupt(MPC8240_I2C_IRQ);
// set interrupt flag in status register
m_i2c.sr |= 0x2;
}*/
}
}
return res;
}
void viper_state::i2cdr_w(offs_t offset, uint8_t data)
{
if (m_i2c.cr & 0x80) // only do anything if the I2C module is enabled
{
if (m_i2c.state == I2C_STATE_ADDRESS_CYCLE) // waiting for address cycle
{
//int rw = data & 1;
m_i2c.rw = bool(data & 1);
m_i2c.addr_latch = (data >> 1) & 0x7f;
LOGI2C("I2C address cycle %s, addr = %02X \n"
, m_i2c.rw ? "read" : "write"
, m_i2c.addr_latch
);
m_i2c.state = I2C_STATE_DATA_TRANSFER;
m_i2c.timer->adjust(attotime::from_hz(I2C_TIMER_FREQ));
}
else if (m_i2c.state == I2C_STATE_DATA_TRANSFER) // waiting for data transfer
{
LOGI2C("I2C data transfer, data = %02x\n", data);
m_i2c.state = I2C_STATE_ADDRESS_CYCLE;
m_i2c.timer->adjust(attotime::from_hz(I2C_TIMER_FREQ));
}
}
}
TIMER_CALLBACK_MEMBER(viper_state::i2c_timer_callback)
{
// set transfer complete in status register
m_i2c.sr |= 0x80;
// generate interrupt if interrupt are enabled
if (m_i2c.cr & 0x40)
{
LOGI2C("I2C interrupt\n");
mpc8240_interrupt(MPC8240_I2C_IRQ);
// set interrupt flag in status register
m_i2c.sr |= 0x2;
}
}
// NOTE: swapendian_int*/8-bit ports used as a temp measure
// handling with endianness can be done thru new PCI model later on (the EPIC is natively LE)
// NOTE: not everything is "EPIC" but rather is space from the SoC that includes the EPIC.
// Also a subset of I2O/DMAC/ATU/data path diags are mappable thru a 0x1000 window PCSRBAR,
// while this full range thru EUMBBAR.
void viper_state::mpc8240_soc_map(address_map &map)
{
// map(0x00000, 0x00fff) I2O
// map(0x01000, 0x01fff) DMAC
// map(0x02000, 0x02fff) ATU Address Translation Unit
// I2C
map(0x03000, 0x03000).lrw8(
NAME([this] (offs_t offset) {
return m_i2c.adr;
}),
NAME([this] (offs_t offset, u8 data) {
LOGI2C("I2CADR %02x\n", data);
m_i2c.adr = data;
})
);
map(0x03004, 0x03004).lrw8(
NAME([this] (offs_t offset) {
return m_i2c.fdr;
}),
NAME([this] (offs_t offset, u8 data) {
m_i2c.fdr = data & 0x3f;
LOGI2C("I2CFDR FDR %02x\n", m_i2c.fdr);
})
);
map(0x03005, 0x03005).lrw8(
NAME([this] (offs_t offset) {
return m_i2c.dffsr;
}),
NAME([this] (offs_t offset, u8 data) {
m_i2c.dffsr = data & 0x3f;
LOGI2C("I2CFDR DFFSR %02x\n", m_i2c.dffsr);
})
);
map(0x03008, 0x03008).lrw8(
NAME([this] (offs_t offset) {
return m_i2c.cr;
}),
NAME([this] (offs_t offset, u8 data) {
if ((m_i2c.cr & 0x80) == 0 && (data & 0x80) != 0)
{
m_i2c.state = I2C_STATE_ADDRESS_CYCLE;
}
if ((m_i2c.cr & 0x10) != (data & 0x10))
{
m_i2c.state = I2C_STATE_ADDRESS_CYCLE;
}
m_i2c.cr = data;
LOGI2C("I2CCR %02x\n", data);
})
);
map(0x0300c, 0x0300c).lrw8(
NAME([this] (offs_t offset) {
return m_i2c.sr;
}),
NAME([this] (offs_t offset, u8 data) {
// TODO: very wrong, only bits 4 & 2 writeable
m_i2c.sr = data;
LOGI2C("I2CSR %02x\n", data);
})
);
map(0x03010, 0x03010).rw(FUNC(viper_state::i2cdr_r), FUNC(viper_state::i2cdr_w));
// map(0x04000, 0x3ffff) <reserved>
// map(0x40000, 0x7ffff) EPIC
map(0x41030, 0x41033).lw32(
NAME([this] (offs_t offset, u32 data, u32 mem_mask) {
data = swapendian_int32(data);
m_epic.eicr = data;
LOG("EICR %08x\n", data);
if (BIT(data, 27))
throw emu_fatalerror("EPIC: serial interrupts mode not implemented\n");
})
);
map(0x41080, 0x41083).lr32(
NAME([this] (offs_t offset) {
if (!machine().side_effects_disabled())
LOG("EVI read\n");
// step = 1, device_id = 0, vendor_id = 0
return swapendian_int32(0x00010000);
})
);
map(0x410e0, 0x410e0).lw8(
NAME([this] (offs_t offset, u8 data) {
m_epic.svr = data;