Chihiro bios questions

Discussion in 'Chihiro Development' started by obcd, May 9, 2016.

  1. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    I stumbled trough some of the forum sections. I read a lot of information, of which some likely is wrong.
    The idea is to use a retail xbox board as replacement chihiro board. So, to my knowledge, the differences are:

    MCPX 2 versus MCPX 3.
    128MB ram versus 64MB ram.
    512KB flash versus 1MB flash or 256KB flash.
    EEPROM contents.
    PIC reboot (frag) challenge.
    Conexant video chip versus conexant, focus or excalibur.


    I read somewhere in these forums that it's possible to reflash a debug board and use it as a chihiro board.
    Debug boards are almost as hard to find as chihiro boards. That's why I am considering a normal retail.

    So, MCPX2 has no hidden bootrom and boots from the upper 512bytes of flash. Chihiro bios uses different Xcodes which won't work in the MCPX3 (hidden) startup code.

    Chihiro bios 2bl is not encrypted. The startup code simply copies the code to ram and calculates a TEA hash. When that hash is correct, it jumps to the 2bl entry point in ram.

    Xbox bios 2bl is different between 1.0 and 1.1 or up xboxes. 1.1 also uses a TEA hash. 1.0 used RC4.

    So, for the conversion, I should install 4 additional ramchips to create a retail 128MB unit.

    I should modify the chihiro bios so that the MCPX3 start code understands it's xcodes. I should add some xcodes to let execution continue from addresss 0 when the TEA hashing fails.

    I should alter the eeprom contents.

    What's bugging me, will the pic shutdown the system, or will the chihiro bios properly inform it to stay quiet?

    Some other things that confuse me, and that maybe the forum has an answer 4:

    The chihiro has 2 additional boards. The base board and the dimm board with the network board.

    The base board is connected 2 the xbox mobo power connector and 2 of the gameport connectors.

    The dimmboard is mostly connected 2 the xbox ide connector and 2 the lpc connector. (I could be wrong about this last thing)

    So, how is the bios seeing this 2 boards? It looks like it's mounting the dimm board as a drive, and the baseboard as an usb device. The LPC bus is also used to identify the boards. How does this work? I see that it's reading some port addresses for this queries.

    If I remember correctly, the cypress chip on the baseboard is indeed a 8032 derivate with buildin usb. It first enumerates as a specific usb device requesting the 8032 firmware. After it received that firmware over usb, it resets and re enumerated as a new device with the new usb descriptors being set in that firmware.

    On outrun II cabinets, the force feedback interface is specified as midi. The hardware indeed uses some high speed optocouplers for it's interfaces, the same as specified in the midi specification. I don't see how a conversion from midi to gamepad would possibly work. Maybe the midi port is implemented as an lpc device on the lpc bus? There also are the eeprom chips on the baseboard. How should the chihiro bios interact with those? There also is a CR2032 on that board and a goldcap as well. So, it looks like the baseboard is storing some data in non volatile ram.
    On the other hand, some settings and the high scores are stored in the dimm board ram for outrun 2. If you remove the battery from that module, all high scores are reset.

    The next thing that is totally unclear is the dimm board network interface. It can be used for netbooting, but once the game is running (outrun 2 again), the game code takes posession of that interface and uses it for it's game networking. The original xbox network interface isn't used. How would that additional network card be interfaced to the xbox mobo? Ide doesn't make sense for such a device.
    I assume it will be difficult to run chihiro games on xbox without at least partial emulation of some of the 2 additional chihiro boards. For instance, outrun 2 doesn't run if you disconnect the Steering Force Feedback interface (midi) or the JVS interface.
    Sorry for the long post. Hope you made it till here and find it interesting.
     
    GoTeamScotch and Armorant like this.
  2. Nidge

    Nidge Spirited Member

    Joined:
    Apr 13, 2015
    Messages:
    163
    Likes Received:
    42
    Hi I don't know too much techy stuff about the chihro, but my N64 freak 1ghz, 128mb mobo will play the patched chihro games :)
    xman over on XBMC4xbox forums works with arcade machines, including the chihiro ones :) he may be able to help? I'm not sure if he's here on AG as well? I'm sure he will pop up if he is :cool:
     
  3. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    Thanks for the answer. I have a look and post my question over there.
     
  4. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    I know this is old, but if you happen to read it...
    force feedback in the chihiro outrun game can be disabled by setting the cabinet to upright instead of normal.
    xbox 1.3 and 1.4 mobo's have the lframe signal removed from the LPC header pins.
    The dimm board is connected to the LPC port so likely will not work on such a mobo.
    The baseboard has 2 AN2131 microcontrollers with an usb interface. Those are connected to gameport 3 and 4.
    The one is an AN2131QC and the other an AN2131SC. They provide the JVS interface and the force fedback midi interface.
    They also interface to the real time clock and some eeprom memory chips used to store the region code and the high scores of some games.
     
    Conte Zero likes this.
  5. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    So game runs?
     
  6. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    On a ram upgraded retail xbox mobo, in a chihiro setup (with baseboard and dimm board) yes, they run.
    No progres so far in emulating the dimm and baseboard functionallity.
     
  7. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    Thx. Do you think is it possible to use mame code about baseboard and mediaboard emulation ? And Phoenix BIOS loader to load Chihiro BIOS?
     
  8. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    Phoenix Bios Loader works fine. Using the mame code, maybe. The leaked barnabas bios has an example that emulates an xbox controller using a network connection and another xbox or pc. (So I heared)
    The games however look for the usb devices on the bus.
    I also heared you need a physical gamepad connected as well. If that truly is the case, you have a problem.

    Considering the dimm board, mame seems to emulate a model 1 and not a model 3. They probably reused some code they had for naomi dimm emulation (just a guess). You can run pretty much all chihiro games on a model 3 but not on a model 1.

    The first step that needs to be taken is fully understanding the communication between the chihiro main board and it's base board / dimm board. So we basically needs some chihiro homebrew program that can access the devices on the base board so that we can debug that communication if we try to emulate those devices. I am planning to work on that, but real life is getting in the way a little. (Like shortage of spare time.)
     
  9. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    Really you succes to run Chihiro BIOS with PBL. I try one time but rend green led...hardware missing I assume m├ędia and base board...
     
  10. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    Chihiro bios launches segaboot.xbe from a partition "mbrom" that is part of the dimm. It's the dimm flash chip that is mapped and is seen as a partition. Besides segaboot.xbe, it also contains a bunch of other files that segaboot.xbe needs to run properly. For instance, it contains the firmware.bin and firmware2.bin that are uploaded to the baseboard cpu and the dimm software microcontroller (part of the fpga)
    segaboot.xbe does not use the xbox retail or debug xor keys. It uses a different set specific to chihiro. It's true that the dimm flash chip is split into 2 banks and that only the files in bank 2 are updated, but it's untrue that it can start from either bank. Only bank 1 contains some of the resources that segaboot.xbe needs to run. It's still unclear what file system sega uses in their dimm flash chip.
     
  11. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    Is it possible with debug connector from dev lit DVT4 to make debug kernel with chihiro hardware? it will be help us to understand?
     
  12. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    Not sure. The serial debug port is a device that connects to the LPC port. The chihiro dimm board connects to that same LPC port. Previous tests I did with a modchip (to ease bios testing) were not successfull. As soon as I connected the dimm board as well to the LPC port, the modchip didn't work anymore. Maybe it's because modern modchips generate their own lframe signal so that they can be used on 1.3+ mobo's. Maybe multiple LPC devices simply can't be connected together on one master LPC bus.
    As solution, I connected an arduino to the SMC IIC bus. The xbox can send bytes to that arduino using the SMC bus as long as no other program starts using that bus as well. It's only one way communication but it's helpfull. At the same time, that arduino can be used as hardware programmer for the eeprom on the mobo. What exactly don't you understand and would you like to know more about?
     
    dark ricardo likes this.
  13. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    THX

    For VC3 and Ghost squad I would know the addrees about the files stock the information from services menu (dificulty, language, gun calibration....) and the format (.txt,....). When you launch vc3_t.xbe (I assume that the xbe run when you press services button) you can change setting but xbox crash.
    And I would like know how to by pass hardware check for OR2, OR2SP, midnight....
     
  14. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    If you extract a chihiro image, you will normally find 2 xbe's in it and a boot.id file. In that boot.id you find the names of the xbe that should be launched as game and the one that should be launched when you enter the "ingame" test menu. So basically, if you press the test button you first enter the main test menu that is part of segaboot.xbe (let's call it the chihiro dashboard). In that test menu, you can select the "game" test menu which is different for every game. I assume by hardware check you mean the JVS check and steering force feedback check.? The midnight games also have some cardreader hardware connected. On outrun, you can disable the steering force feedback check by selecting the upright cabinet as that wasn't having steering force feedback. Disabling or patching out the JVS board check isn't an option as those games ignore a normal xbox controller. I can enter the segaboot.xbe test mode with a normal controller and I can scroll trough the different selections, but as soon as I select the game test menu, things stop working and only the JVS can be used to control the system.
    VC3 and Ghost squad (most other chihiro games as well) don't use files to store their calibration values and high score settings. They use the eeprom memory chips on the chihiro baseboard. Those chips are connected to the baseboard microcontrollers that are connected using usb on gameport 3 and 4. They have nothing in common with a normal controller / memory device and the protocol those are using. The only game working differently (that i know) is outrun 2 special tours that uses a partition on the dimm board to store it's settings. It's mapped as mbsys: to the system. That's the reason why it looses it's settings when the dimm battery runs flat. (usually after a couple of days when not powering it up) In my opinion, the best option to run those games is to emulate the missing hardware so that the game code doesn't notice it's missing. I know they managed to run some triforce games on the wii, but that one is having a separate arm processor for most of it's io, so it's easier on that platform to emulate the missing hardware.
     
    dark ricardo likes this.
  15. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    THX
    How to open it. I try with notetext or wordpad but some character dont appears correctly.

    With my XBOX debug or XBOX 128 mb ram modded I can navigate in test menu about OR2 prototype, VC3 and ghost squad with xbox classic controller. But when I exit game run but crach. When I launch the .xbe game , it run well with this 3 example, I assume that it's possible to run game with classic xbox controller but I dont know how.

    For eeprom emulation it's seems very difficul, we know ref it's a Microchip 24LC024 2K I2C Serial EEPROM (SOIC8) contain system/game configuration data and we have a MAME code:
    https://github.com/mamedev/mame/blob/master/src/mame/drivers/chihiro.cpp


    Why please?
     
  16. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    boot.id is a binary file. If you open it with a hex editor you can see the xbe's in ascii at some locations. Jayrayfox created some chihiro tools (check his github for chihiro tools) I think one of them was also designed to read boot.id and get the known information out of it.

    Some chihiro games run without the additional chihiro boards and can be controlled with a normal controller, others probably don't.
    I assume it depends what libraries the games are linked against (can be seen by observing the startup on a debug bios) and obvious, the normal controller functionallity needs to be programmed in the game. If it's not there, you can't enable it. Comparing the static lib's that are linked in the xbe's might already teach something about it. I don't know if they used the normal xdk's to create chihiro games (probably did), but I do know there is at least one additional lib

    Xbox image loaded: \Device\Cdrom0\OUTRUN2.XBE
    This XBE was linked with XAPILIB.LIB version 1.00.5659.01
    This XBE was linked with D3D8.LIB version 1.00.5659.04
    This XBE was linked with D3DX8.LIB version 1.00.5659.01
    This XBE was linked with XGRAPHC.LIB version 1.00.5659.01
    This XBE was linked with DSOUND.LIB version 1.00.5659.01
    This XBE was linked with XBOXKRNL.LIB version 1.00.5659.01
    This XBE was linked with LIBCMT.LIB version 1.00.5659.01
    This XBE was linked with LIBCPMT.LIB version 1.00.5659.01
    So the 5659 was an xdk from august 2003 All the libraries are part of the normal xdk.

    This means my library assumption was incorrect. It's still possible that the normal controller code isn't active in those games.

    segaboot.xbe on the other hand is linked against a special library:
    arcddash.lib version 1.00.5209.01 which is one sega probably created.

    The eeprom that stores the configuration and high scores is connected to a microcontroller on the base board. That microcontroller presents itself as an usb device to the xbox. The xbox can load other firmware into that microcontroller and can program it to wathever it likes. Since mame doesn't seem to care about this we can assume that the firmwares that come with the games only are small bug fixes and that the basic functionallity remains.
    So basically, you need to emulate some usb devices and redirect the commands that would normally read and write the eeprom to some files.
    The xbox kernel is designed to run just 1 xbe. On the wii there is a separate arm processor that handles all the input. So you can change the code that runs on that without the game code noticing it's not running on a triforce.
     
    dark ricardo likes this.
  17. nonosto

    nonosto Intrepid Member

    Joined:
    Jan 5, 2012
    Messages:
    659
    Likes Received:
    49
    Maybe make an "external eeprom" with arduino tool conect via an adpter with plug 3 & 4.
     
    dark ricardo likes this.
  18. obcd

    obcd Rapidly Rising Member

    Joined:
    Dec 14, 2009
    Messages:
    96
    Likes Received:
    32
    That could work but you will need 2 arduino's as an arduino only has 1 usb port. You will need something like a leonardo that has the usb interface embedded in the microcontroller. The uno uses a ftdi chip for it's usb communication and can only represent itself as an usb serial port.
     
    dark ricardo likes this.

Share This Page