Notes on the Saturn BIOS

GO TO ADMIN PANEL > ADD-ONS AND INSTALL VERTIFORO SIDEBAR TO SEE FORUMS AND SIDEBAR

slinga

Member
Joined
Apr 17, 2001
Messages
1,063
Points
36
Age
35
Website
Visit site
Hey all,

I'm doing a little research in the Saturn BIOS in my free time. Anybody have any notes, doc, etc to get started? Some things I'm still murky on:

1) After power on, what's the first address executed? The BIOS is located at 0x00000000 - 0x00800000. Address 0 is not the starting address. According to Yabause source, execution starts at 0x06001088, but that doesn't make sense as that's located in the Work RAM, not the BIOS. Setting a breakpoint on SH2Exec() it looks like the first address is 0x20000200 which is the area immediately following the BIOS.

2) When attaching an action replay, the whole things get mapped to CSO (0x02000000 - 0x04000000) and not the Work RAM area correct?

Thanks in advance, I appreciate any pointers in getting started.
 

ExCyber

Staff member
Joined
Aug 8, 2001
Messages
4,014
Points
36
Age
37
slinga said:
Hey all,

I'm doing a little research in the Saturn BIOS in my free time. Anybody have any notes, doc, etc to get started? Some things I'm still murky on:

1) After power on, what's the first address executed? The BIOS is located at 0x00000000 - 0x00800000. Address 0 is not the starting address. According to Yabause source, execution starts at 0x06001088, but that doesn't make sense as that's located in the Work RAM, not the BIOS. Setting a breakpoint on SH2Exec() it looks like the first address is 0x20000200 which is the area immediately following the BIOS.
Upon a hardware reset, the CPU fetches the word at 0x00000000 and uses that as the entry point. That is, 0x00000000 isn't the entry point itself, but it's a pointer to the entry point. Keep in mind that 0x20000200 is still the BIOS ROM, just with the cache bypassed (in other words, be careful not to confuse the first and second digits of the address, because they have very different practical meanings). 0x20000200 refers to the same physical address as 0x00000200.

2) When attaching an action replay, the whole things get mapped to CSO (0x02000000 - 0x04000000) and not the Work RAM area correct?
Right, but the firmware does end up running from work RAM; the BIOS first copies the header/AIP to work RAM (IIRC, at 0x06002000, with the AIP entry point probably being 0x06002F00), and then the AIP code copies the AR firmware into work RAM and jumps to it.
 

slinga

Member
Joined
Apr 17, 2001
Messages
1,063
Points
36
Age
35
Website
Visit site
Thanks for the pointers. It's beginning to make sense now.

Any idea on how reads to 0x25818000 work? It seems like its some sort of hardware register memory mapped to the cd-rom drive. Basically I can see them repeatedly reading from that address, and returning different bytes from my ISO (yes I'm a 100% software guy).
 

ExCyber

Staff member
Joined
Aug 8, 2001
Messages
4,014
Points
36
Age
37
slinga said:
Any idea on how reads to 0x25818000 work? It seems like its some sort of hardware register memory mapped to the cd-rom drive. Basically I can see them repeatedly reading from that address, and returning different bytes from my ISO (yes I'm a 100% software guy).
I'm not familiar with CD block programming, but it's definitely plausible for that address to be a memory mapped CD block data port. You might want to have a look at CWX's CDC library and see if anything in there appears to be following a similar pattern.
 

Runik

Staff member
Joined
Apr 17, 2001
Messages
889
Points
16
Age
41
Website
www.runik.info
slinga said:
Thanks for the pointers. It's beginning to make sense now.

Any idea on how reads to 0x25818000 work? It seems like its some sort of hardware register memory mapped to the cd-rom drive. Basically I can see them repeatedly reading from that address, and returning different bytes from my ISO (yes I'm a 100% software guy).
TyRaNiD's made this comment about those registers :

The data transfer registers position is not fixed. It changes depending on the current operation. I think it is based on the buffer partion number but dont hold me to that.
On the other hand, I'm using this address as the fetch data pointer in Saturnin, and the cdblock seems to work ... of course my cdblock isn't working at 100%, but so far it's enough
 

slinga

Member
Joined
Apr 17, 2001
Messages
1,063
Points
36
Age
35
Website
Visit site
Some weird trivia, if the disk does not start with "SEGA SEGASATURN", the Sega Player (the OS) will then check for either "PPPPHHHHOOOOTTTTOOO____CCCCDDDD" (photo_cd) and then "VIDEO_CD" (at some fixed offset within the disk). If the string is there, it'll display the message "Disc requires system application".

Definitely odd that these disk types are hard-coded into the BIOS. I'm assuming that they require hardware support which is why it's failing.
 

CyberWarriorX

New Member
Joined
May 27, 2001
Messages
390
Points
18
Website
www.cyberwarriorx.com
slinga said:
Some weird trivia, if the disk does not start with "SEGA SEGASATURN", the Sega Player (the OS) will then check for either "PPPPHHHHOOOOTTTTOOO____CCCCDDDD" (photo_cd) and then "VIDEO_CD" (at some fixed offset within the disk). If the string is there, it'll display the message "Disc requires system application".

Definitely odd that these disk types are hard-coded into the BIOS. I'm assuming that they require hardware support which is why it's failing.
They require the MPEG card. Basically the way it works is that the MPEG card has a built-in ROM containing SH2 code that the BIOS fetches and executes when a video or photo cd is inserted.
 
Top