From f36add394175d65a5c75f46ba315c56efd21f5d5 Mon Sep 17 00:00:00 2001 From: MetalliC <0vetal0@gmail.com> Date: Sun, 1 Jan 2017 15:06:54 +0200 Subject: atvtrack.cpp: extract CPU initial boot from FPGA bitsream [MetalliC] yep, its possible, at least for such FPGA family --- src/mame/drivers/atvtrack.cpp | 63 ++++++++++++++++++++++++++++++------------- 1 file changed, 45 insertions(+), 18 deletions(-) diff --git a/src/mame/drivers/atvtrack.cpp b/src/mame/drivers/atvtrack.cpp index 398200c7fff..e7b08f6e31c 100644 --- a/src/mame/drivers/atvtrack.cpp +++ b/src/mame/drivers/atvtrack.cpp @@ -384,30 +384,54 @@ uint32_t atvtrack_state::screen_update_atvtrack(screen_device &screen, bitmap_rg return 0; } -void atvtrack_state::machine_start() +void get_altera10ke_eab(u8* dst, u8 *pof, int eab) { - uint8_t *src, *dst; + // extract Altera FLEX 10KE 4kbit Embedded Array Block (EAB) + u32 startbit = 0x45b * 8 + 1 + (0x25e6 * 8) * eab; // base ofsset actually depends on POF header size, however this EPC1PC8 dump havent it (bad dumper software?) + + for (u32 bit = 0; bit < 4096; bit++) + { + u32 tbit = BITSWAP16(bit, 15, 14, 13, 12, + 9, 8, 7, 6, 5, 4, 3, + 11, 10, + 2, 1, 0); + tbit ^= 0x0fc0; + u32 pofbit = startbit + (tbit & 0x1f) + (((tbit >> 5) & 1) * 63) + (((tbit >> 6) & 0x3f) * 0x4D * 8); + dst[bit / 8] &= ~(1 << (bit & 7)); + dst[bit / 8] |= ((pof[pofbit / 8] >> (pofbit & 7)) & 1) << (bit & 7); + } +} +void atvtrack_state::machine_start() +{ m_nandaddressstep = 0; m_nandregion = memregion("maincpu"); - address_space &as = m_maincpu->space(AS_PROGRAM); - dst = (uint8_t *)(as.get_write_ptr(0x0c7f0000)); - src = m_nandregion->base()+0x10; - // copy 0x10000 bytes from region "maincpu" offset 0x10 to 0x0c7f0000 - memcpy(dst, src, 0x10000); } void atvtrack_state::machine_reset() { - // Probably just after reset the cpu executes some bootsrtap routine from a memory inside the fpga. - // The routine initializes the cpu, copies the boot program from the flash memories into the cpu sdram - // and finally executes it. - // Here there is the setup of the cpu, the boot program is copied in machine_start - address_space &as = m_maincpu->space(AS_PROGRAM); - // set cpu PC register to 0x0c7f0000 - m_maincpu->set_pc(0x0c7f0000); - // set BCR2 to 1 - m_maincpu->sh4_internal_w(as, 0x3001, 1, 0xffffffff); + std::vector tdata(1024); + u8 *pof = memregion("fpga")->base(); + + // first 2 Altera's EABs is 2xSH4s shared RAM, its initial content is boot loader + // extract EABs 0 and 1 from POF + get_altera10ke_eab(&tdata[0], pof, 0); + get_altera10ke_eab(&tdata[512], pof, 1); + + // deshuffle data bits and put it to shared RAM + u8 *dst = (u8*)(m_maincpu->space(AS_PROGRAM).get_write_ptr(0)); + for (u32 i = 0; i < 256; i++) + { + u16 lword = tdata[i * 2 + 512] | (tdata[i * 2 + 513] << 8); + u16 hword = tdata[i * 2] | (tdata[i * 2 + 1] << 8); + lword = BITSWAP16(lword, 7, 9, 0, 10, 3, 11, 4, 12, 2, 15, 1, 13, 6, 8, 5, 14); + hword = BITSWAP16(hword, 5, 10, 7, 9, 6, 13, 3, 15, 2, 11, 1, 8, 0, 12, 4, 14); + dst[i * 4 + 0] = lword & 0xff; + dst[i * 4 + 1] = lword >> 8; + dst[i * 4 + 2] = hword & 0xff; + dst[i * 4 + 3] = hword >> 8; + } + m_subcpu->set_input_line(INPUT_LINE_RESET, ASSERT_LINE); } @@ -533,8 +557,8 @@ ROM_START( atvtrack ) ROM_LOAD32_BYTE("14.bin", 0x0000002, 0x1080000, CRC(67983453) SHA1(05389a0ffc1a1bae9bac16a53a97d78b6eccc626) ) ROM_LOAD32_BYTE("19.bin", 0x0000003, 0x1080000, CRC(9fc5c579) SHA1(8829329ef229564952aea2108ef1750dc226cbac) ) - ROM_REGION( 0x20000, "eeprom", ROMREGION_ERASEFF) - ROM_LOAD("epc1pc8.ic23", 0x0000000, 0x1ff01, CRC(752444c7) SHA1(c77e8fcfcbe15b53eda25553763bdac45f0ef7df) ) // contains configuration data for the fpga, maybe used for some form of protection + ROM_REGION( 0x20000, "fpga", ROMREGION_ERASEFF) + ROM_LOAD("epc1pc8.ic23", 0x0000000, 0x1ff01, CRC(752444c7) SHA1(c77e8fcfcbe15b53eda25553763bdac45f0ef7df) ) // contains configuration data for the fpga ROM_END ROM_START( atvtracka ) @@ -543,6 +567,9 @@ ROM_START( atvtracka ) ROM_LOAD32_BYTE("k9f2808u0b.ic20", 0x0000001, 0x1080000, CRC(b0c34433) SHA1(852c79bb3d7082cd2c056140071ae7d71679ec1d) ) ROM_LOAD32_BYTE("k9f2808u0b.ic14", 0x0000002, 0x1080000, CRC(02a12085) SHA1(acb112c9c7b29d92610465fb92268ce787ca06f4) ) ROM_LOAD32_BYTE("k9f2808u0b.ic19", 0x0000003, 0x1080000, CRC(856c1e6a) SHA1(a6b2839120d61811c36cc6b4095de9cefceb394b) ) + + ROM_REGION( 0x20000, "fpga", ROMREGION_ERASEFF) + ROM_LOAD("epc1pc8.ic23", 0x0000000, 0x1ff01, CRC(752444c7) SHA1(c77e8fcfcbe15b53eda25553763bdac45f0ef7df) ) // contains configuration data for the fpga ROM_END /* -- cgit v1.2.3