Network code

[Ian]

I know there existed network code before that seems to have been lost forever ..
Nik if you reading this what have you done with it
Is there any other code that can be ported over? Ie from mame or the model2 project?

[Jiterdomer]

My heart is ready for this.
If Nik didn't contact us, then it's back to square one

[Bart]

Nik never sent over the code. Pretty sure he still has it somewhere but it's next to impossible to get a hold of him. I'm sure it'll see the light of day at some point or if I find time I can take a look at it. We should loop SailorSat into these discussions because she has done a lot of work on the Model 1 and 2 networking which, although not equivalent, is very similar. She's by far the most knowledgeable on this subject.

[Kacperas]

I know there existed network code before that seems to have been lost forever ..
Nik if you reading this what have you done with it
Is there any other code that can be ported over? Ie from mame or the model2 project?

There's some code at MAME's github. Thanks to it, games passes comm board detection check, but hangs at detecting other game instances.
https://github.com/mamedev/mame/blob/ma ... m3comm.cpp

There's also a topic about Model 1 comm board by SailorSat at MAMEWORLD forums.
http://www.mameworld.info/ubbthreads/sh ... ber=297577

[Ian]

Nik never sent over the code. Pretty sure he still has it somewhere but it's next to impossible to get a hold of him. I'm sure it'll see the light of day at some point or if I find time I can take a look at it. We should loop SailorSat into these discussions because she has done a lot of work on the Model 1 and 2 networking which, although not equivalent, is very similar. She's by far the most knowledgeable on this subject.

Do you still have the binaries for it? Worst case scenario it might be possible for me to simply decompile it with IDA pro.

[SailorSat]

I don't have any information on the model 3 comm boards yet, so I just write down what I know of the "older" ones.

There are several older comm boards which I did tinker around with.
( images at http://images.arianchen.de/?x=sega-comm )

System Y
- Power Drift Link

System X
- GP Rider*

System H1
- Cool Riders

System 32
- Air Rescue*, F1 Exhaust Note*, F1 Super Lap, Rad Rally

System Multi32
- OutRunners, Stadium Cross

Model-1
- Virtua Racing, WingWar

Model-2/2A/2B/2C
- 2o: Daytona USA, 2a: Sega Rally, 2b: Indy 500, 2c: Sega Touring Car Challenge

*not a real comm boards

---

They all share a similar setup.
For the host system they appear as shared memory that they can read from / write to.
They have an eeprom, a Z80 cpu, internal RAM and some HDLC chip.
Memory size increased over time.

System 32 (Air Rescue, F1 Exhaust Note)
- uses 4k "shared" dual-port SRAM. (0x810000, 0x810fff)
- MASTER / SLAVE register; tied to gnd on MASTER and +5V on SLAVE. (0x818000)
- a bridge board between two boardsets

System 32, Multi32:
- uses 4k "shared" dual-port SRAM. (0x00800000, 0x00800fff - only odd addresses)
- CN and FG register. (0x00801000, 0x00801002)
- 4 "active" comm boards max.

Model-1:
- uses 4k "shared" dual-port SRAM. (0x00B00000 - 0x00B00fff)
- CN and FG register. (0x00b01000, 0x00b01002)
- 8 "active" comm boards max.

Model-2:
- uses two 16k SRAM "pages". (0x01a10000 - 0x01a13fff)
- CN and FG register. (0x01a14000, 0x01a14002)
- 8 "active" comm boards max.

The CN register controls the "RESET"-line on the comm boards cpu. A basic "On/Off"-switch.
The FG register is a bit more complicated:
- On System 32, Multi32 and Model-1 this is used to communicate between host cpu and comm cpu. Each CPU can set 1 bit and read the other ones 1 bit. Does not seem to be used though.
- On Model2 this is ALSO used to indicate which page is visible to each CPU.

---

The comm boards each have a TX and RX line which use TOSLINK cables to connect.
There are three modes of operation: Master, Slave and Relay.
They get connected in a ring. Unit 1 TX goes to Unit 2 RX and so on.

Master and Slave behave similar with the exception that the slaves will NOT start communication by themselves. Each board gets a unique node id.
Relay is just a passive reader which will be "invisible" on the network. (Used for spectator units)

At least on Model-2 the "slot size" can be set:
- Daytona uses 9 slots with 448 byte each. = 4032 bytes
- VirtuaOn uses 2 much larger slots.

Daytona writes it's own data to slot 1, then sends slot 1 through 8 as 3584 byte packet "on the line".
Daytona reads 3584 bytes of data to slot 2 though 9.

---

Comm Boards also have a connection called "DOP" which is used to delay the video boards - This is used to synchronize the V-Sync on all machines during boot.

---

Based on what I've read the first obvious difference from the older comm boards to the m3comm would be that the Z80 was replaced by a MC68000 cpu.
Another difference is - Model-3 is PCI based, while the older boards are ISA based.

It appears the Model3 comm board uses address 0xc0000000 to 0xc003ffff on the host side.
If the MAME source is correct the "shared" memory size is 64k - most likely banked.

Sadly I seem unable to compile MAME at the moment, so I cannot step debug the host code...

[SailorSat]

Another obvious difference seems to be the model 3 comm board has no ROM - the code for the 68k most likely gets uploaded by the host.

[Bart]

I can confirm that the 68K program does indeed get loaded up into the network board RAM. We know where that is, too. I think we just have to emulate it as a memory region and the PowerPC will attempt to write the 68K program to it.

[Spindizzi]

Hello,
I don't know if it worth it but months ago, I've made a look to hook a network card in supermodel
No success, of course
This is a really early working copy, no more, and given as is. I'm sure of nothing (address mapping, r/w, ...). It's only a test to implant the card, no protocol yet
I've abandonned because I've not enough skill
May be it'll give some ideas for those who have great talent ...
I only work with daytona2 in this test case
you need to launch supermodel with -no-threads switch else there is a melting pot with the 68k cpu soundboard and the 68k cpu netboard registers. This is due to Musashi doesn't not accept multi threaded 68k cpu (see discussion here https://www.supermodel3.com/Forum/viewtopic.php?f=7&t=1363). I've tested thread with the netboard like the soundboard but I had to remove the code because of that
I separate netrom netram, not sure it's correct. And I must say I'm a little lost (commram = netram ?). There are several sections of code (multiple program ?) inside with multiple org (origine)
The 68k network code seems to run. In the debugger, we see it waits for some events and we can poke values to advance in the code (68k and ppc side)
We can easily follow the code with the dump dissassembled in IDA
Also, it crashes when quit, I certainly forgot something (bad pointers, bad memory management....)

https://yadi.sk/d/uK7sIc-B3McD6g

Is Nik's graphical debugger private tool ? Could it help for netboard card or it's just for graphical debug part ?

Is it me, or the forum have no more working certificate ?
++

[SailorSat]

I'll try to figure out a proof-of-concept using daytona 2. I actually ordered a model3 comm board on ebay to dump the PALs... (and eventually interface it with a PC)
For the time being I'll ignore anything that is already known.

Didn't spend too much time yet, but SEGA most likely did not change the network code (host side) much.
From what I've seen in MAME so far everything seems kinda familiar.

>> Set CN-register to ZERO to disable the 68k followed by a read/write memory check on the 64k shared ram.