Sonic and Sega Retro Message Board: Sega Virtua Processor Research - Sonic and Sega Retro Message Board

Jump to content

Hey there, Guest!  (Log In · Register) Help
Page 1 of 1
    Locked
    Locked Forum

Sega Virtua Processor Research

#1 User is offline Ralakimus 

Posted 11 November 2018 - 11:42 PM

  • Posts: 292
  • Joined: 16-April 13
  • Gender:Male
Hello, as some of you may know, I have been reverse engineering Virtua Racing to see how the SVP works myself. It is currently known that it's an SSP1601 chip running a custom ROM that generates Mega Drive tile data from model data and that the 68000 can directly access the SVP's DRAM (which is mapped at $300000 on the 68000 side). The chip's XST register can also be directly written to at $A15000.

However, I wanted to see how this specific ROM worked. Here are my current findings:

$300000-$305FFF - Tile buffer #1
$306000-$30BFFF - Tile buffer #2
$30EC00-$30FBFF - Model/camera data
$30FC00-$30FDFF - Sprite data
$30FE00 - Screen mirror flag
$30FE02 - Command finished flag
$30FE04 - Tile buffer address
$30FE06 - Command sent flag
$30FE08 - Command ID
$30FE10 - SEGA sequence value

The SVP is initialized by clearing DRAM and setting the XST to the string "OH" and disabling the chip's so called "halt flag" (referenced from the current SVP documentation as of November 2018).

A command is handled by setting the "sent flag" to a nonzero value and then setting the command ID and then checking the "finished flag" to see if it's nonzero.

Here are the command I have documented:

0 - Invalid
1 - Communication test
2 - Render models and sprites (with camera, used by Virtua Racing mode and Free Run mode in Virtua Racing)
3 - Render models and sprites (with camera, used by during Virtua Racing mode when the goal is reached or a game over has happened)
4 - Renders models and sprites (with camera and split screen, used by the 2P VS. mode in Virtua Racing)
5 - Render SEGA sequence (Used by the SEGA screen in Virtua Racing)
6 - Render models (with camera, used by the title screen in Virtua Racing)
7 - Unknown (causes a glitchy mess afaik)
8 - Render models and sprites (with camera and course ranking table taking up the first 6 sprite slots, used by the title screen in Virtua Racing)
9 - Render models (Has smaller position range, but more precision, used by the mode select screen in Virtua Racing)
$A - Render models and sprites (with camera, used by the instant replay in Virtua Racing)
$B - Render models and sprites (with a fixed camera, used by the instant replay in Virtua Racing)
$C - Render models (with camera, has smaller position range, but more precision)
$D - Invalid
$E - Invalid
$F - Invalid

When a command is sent and completed, a DMA transfer can be done directly from DRAM to VRAM. Virtua Racing uses double buffering using the tile buffers as seen above so after each transfer, it swaps the buffer to use. The buffer is not cleared by the SVP, so it must be done manually by the 68000.

As for model data, in commands 4 and 6, the first model slot is generally the main camera and can also render the main map. Commands 5 treats the first slot like any other model.

Command 5 is special, as the placement of the SEGA models are done by the SVP itself and where they are is determined by $30FE10, which gets constantly incremented every frame. In command 5, the only other movement that can be applied is Z axis rotation.

For each model, it uses $40 bytes of DRAM for its variables, and this is what I have found so far (it also applies to the camera):
$00 - Visible flag
$02 - X position
$04 - Y position
$06 - Z position
$08 - X angle
$0A - Y angle
$0C - Z angle
$26 - Model data pointer (which is divided by 2 because the SVP handles things by words instead of bytes, and typically OR'd with $8000000 to handle autoincrement on the SVP's side)

For each sprite, it uses $10 bytes of DRAM for its variables, and this is what I have documented:
$00 - Visible flag
$04 - X and Y position (00YY YYXX XXXY YYYX in binary, note X position is divided by 4 here)
$06 - Sprite data pointer (same format as a model data pointer)

The model format is very simple. The first word is just the poly count minus 1, and what follows is the actual poly data. The first 2 bytes for each poly are a set of flags. The high byte handles the colors of the poly. A poly can have up to 2 colors, which are dithered together. Each nibble is a palette index. The low byte is a set of flags with the following bitfield:

0CDS0000

S - Shape (0 = square, 1 = triangle)
D - Dithering pattern (0 = vertical line, 1 = checkerboard)
C = Backface culling flag (0 = off, 1 = on)

Then for each vertex, it's just its X position, Y position, and Z position, all being signed word values. 4 vertices for a square poly and 3 for a triangle poly.

For sprites, its format is also rather simple. The first word is the width of the sprite divided by 4 minus 1. The second word is the height of the sprite minus 1. This means sprites can only have widths that are multiples of 4. The rest is the actual pixel data, which is generally formatted like a bitmap, while also still using the same pixel format as the Genesis (meaning that each byte still represents 2 pixels with each nibble being a palette index).

The way I formatted the ROM to make this run was to change the header up a little and implement the DSP ROM and debugging functions. I changed the local and international names to be like in Virtua Racing and put "53 56 00 00 20 00 04 00" at $1C8 in the header as well. I then ripped the DSP ROM and debugging functions (located at $800 and ends at $1FFFF in Virtua Racing) and padded from the end of the header to $800 and put the data at $800.

And that's all I have for now. I think it's generally enough to get something working at least, but there's still work to do.
This post has been edited by Ralakimus: 12 November 2018 - 02:39 PM

#2 User is offline Ralakimus 

Posted 12 November 2018 - 12:30 PM

  • Posts: 292
  • Joined: 16-April 13
  • Gender:Male
So, command 2 is pretty much command 6, except it can render sprites!

See updated OP for more information.

#3 User is offline Aerosol 

Posted 15 November 2018 - 01:16 PM

  • FML and FU2
  • Posts: 10075
  • Joined: 27-April 08
  • Gender:Male
  • Location:Not where I want to be.
  • Project:Sonic (?): Coming summer of 2055...?
Thanks for your hard work

#4 User is offline biggestsonicfan 

Posted 15 November 2018 - 09:34 PM

  • Model2wannaB
  • Posts: 778
  • Joined: 09-May 07
  • Gender:Male
  • Project:Formerly Sonic the Fighters
How exactly does one research this? Are you using an emulator? Are you disassembling the binary? I'm curious to begin my Model2 research, and aside from what the emulator spits out as save states, I would like to investigate it further but do not know how to approach it, especially if I do it at the hardware level for increased accuracy.

#5 User is offline Ralakimus 

Posted 16 November 2018 - 09:41 AM

  • Posts: 292
  • Joined: 16-April 13
  • Gender:Male
I disassembled Virtua Racing and its SVP code using the SSP1601 module for IDA found on the Picodrive emulator website. Also used some previously existing documention to help out along with lots of experimenting with writing to certain addresses.
This post has been edited by Ralakimus: 16 November 2018 - 09:42 AM

#6 User is offline Hivebrain 

Posted 16 November 2018 - 09:47 AM

  • Posts: 2738
  • Joined: 15-January 03
  • Gender:Male
  • Location:53.4N, 1.5W
  • Project:HivePal 2.0
  • Wiki edits:6,176
I wonder if it's possible to make use of the SVP by plugging Virtua Racer into a homemade S&K-style cart.

#7 User is offline Overlord 

Posted 16 November 2018 - 01:58 PM

  • Substitute Meerkovo IT Chief
  • Posts: 17058
  • Joined: 12-January 03
  • Gender:Male
  • Location:Berkshire, England
  • Project:VGDB
  • Wiki edits:3,204
That was the original plan for the SVP, wasn't it? A separate cart with the chip on that SVP-compatible games could plug into so they could keep prices down. As it turned out, not needed as there was only ever one SVP game.

#8 User is offline biggestsonicfan 

Posted 16 November 2018 - 01:58 PM

  • Model2wannaB
  • Posts: 778
  • Joined: 09-May 07
  • Gender:Male
  • Project:Formerly Sonic the Fighters

View PostRalakimus, on 16 November 2018 - 09:41 AM, said:

I disassembled Virtua Racing and its SVP code using the SSP1601 module for IDA found on the Picodrive emulator website. Also used some previously existing documention to help out along with lots of experimenting with writing to certain addresses.

I guess it helps when the chip being researched is also dumped with the cart. This isn't the case for Model2 and Model2 requires IDA pro and a processor tweaking which I have no idea how to do.

Your method seems similar to what I've already done, and bit bashing is fun, no :specialed:?

#9 User is offline Lostgame 

Posted 25 November 2018 - 09:34 PM

  • resident geek girl + record label manager
  • Posts: 4021
  • Joined: 02-December 03
  • Gender:Female
  • Location:Toronto, ON
  • Project:The O.I.C.
  • Wiki edits:2
Neat anecdote about the SVP ‘cart’ - is this what the MARS/32X ended up becoming?

#10 User is offline Ralakimus 

Posted 25 November 2018 - 09:59 PM

  • Posts: 292
  • Joined: 16-April 13
  • Gender:Male
As far as I know, no it's not.

Page 1 of 1
    Locked
    Locked Forum

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users