- Thread starter goguelnikov
- Start date
I never found anything wider than 16bit when researching flash for any of my projects.
I was wondering, can you interleave reads from multiple/wider busses into a single flash with an FPGA, similar to how NeoGeo handles the two audio busses? I guess that depends on bandwidth requirements...
I was wondering, can you interleave reads from multiple/wider busses into a single flash with an FPGA, similar to how NeoGeo handles the two audio busses? I guess that depends on bandwidth requirements...
A
Apocalypse
Thought about it (and it's actually how work some systems, with latches to hold data signals) but if you need a FPGA that kills the benefit.
rockbottom
Enthusiast
Yes, that's it, imagine the entire rom space as having a set number of hard-coded "slots" of different sizes. Any game can be replaced with any other game of the same size or less. And by size I mean each region (P,C,V,M,S) has to be the same or smaller. It would've been nice to remove the many clones, hacks etc. to gain space but sadly it's not so simple as they all re-use assets from the original games. For example, removing CTHD would just free up a little P and S space, all the other stuff (C,V,M) comes from KOF2001 so all that has to stay.
Example:
I've mapped out where everything is in each rom, here is an extract from the start of P:
Code:
0000000 800000 0271 The King of Fighters 2003
0800000 500000 0263 Metal Slug 4
0d00000 200000 0081 Super Sidekicks 3
0f00000 100000 0263 Metal Slug 4
1000000 700000 0264 Rage of the Dragons
1700000 100000 0264 Rage of the Dragons
1800000 500000 0222 Samurai Shodown IV
1d00000 200000 0219 Pleasure Goal
1f00000 100000 0222 Samurai Shodown IV
2000000 500000 2265 The King of Fighters 2002 ?
2500000 100000 0265 The King of Fighters 2002
2600000 100000 0083 Bust-A-Moveeg. Pleasure Goal is 2MB total P so any game of 2MB or smaller can be put in that 2MB slot #8 starting at 0x1d00000.
The minimum chunk is 1MB, the cpld basically sets the upper 8 address lines according to the game number its given, this sets the start address in rom for that game. Which lines it needs to set are hard-coded within it for each game, in other words it has its own knowledge of the size and start position for each game.
For clones, hacks etc. things are more complex, eg. note the two Metal Slug 4's. The first at 0x0800000 (slot 2) is the full original game (1MB P1 + 4MB P2). The second at 0x0f00000 (slot 4) is the "+" hacked version. It has just its own hacked 1MB P1 but re-uses the originals 4MB P2. So for that game the cpld also knows to direct any P2 region reads to slot 2 + 1MB, so starting at 0x0900000.
For now it's only possible to work within these limitations, but hopefully in future the cpld can be coded to allow anything to be put anywhere as desired
rockbottom
Enthusiast
There's brokers claiming to have stock of these chips. Of course all in China and about as far from "reliable sources" as one can get
Here's one. I'm going to try ordering some and see what happens.I guess you guys know as well as I that NOR flash over 512Mbit just isn't that easily available to the general public (and expensive). Some one on here had a theory these chips where specially made for Excite (a former Japanese Pachislot manufacturer), I think that's probably true (or some other company), when it folded the unused parts stock found it's way to the Chinese brokers. There's certainly no off-the-shelf parallel NOR 8Gbit/1GB parts that I can find, I think it's just the case that any high capacity NOR is made to order for big high-volume customers (large companies). In which case, like these chips, they just make up unique multi-die modules (using multiples of pre-existing smaller dies).
Just the way the world is I guess, would love to be proven wrong though
A
Apocalypse
@rockbottom wouldn't it be simpler to arrange data in the flashes in a "better" way and program new CPLDs accordingly. From what you say they seem to be used as one dimension arrays (a specific combination of inputs, here the game number, generates a specific combination on the outputs to point to the correct address offset in flashes).
A
Apocalypse
I can't believe they're only $1.65/pc!There's brokers claiming to have stock of these chips. Of course all in China and about as far from "reliable sources" as one can get
rockbottom
Enthusiast
I know, crazy, considering a 512MBit chip from a reputable source here in the UK is about £6, of which i'd need 16 to match the capacity of these chips
At least not much to lose if it turns out to be fake
Indeed, if custom code for the cplds can be written then anything/everything is possible
Butter Meister
Student
Now that I have more info on the chips, I'm going to try using TopJTAG Flash Programmer to see if contents can be read and written in an easier way.
I always assumed hacked games were reusing assets from their non hacked counterparts (it all wouldn't fit otherwise). If games are called at their specific start and end addresses, assuming there's no other checks, then full games could possibly be replaced. Are the address calls done by the menu ROM or the CLPD?
So for now the most impressive thing we understand how to do is physically erase the program files of rom hacks. A bit of a challenge in the meantime would be to fix SNK vs Capcom, which only has hacked versions and not the official version. The official programming could replace the hacked programming's address space
@rockbottom Didn't you say earlier that Waku and Windjammers were in there but unused? How does that work?
I always assumed hacked games were reusing assets from their non hacked counterparts (it all wouldn't fit otherwise). If games are called at their specific start and end addresses, assuming there's no other checks, then full games could possibly be replaced. Are the address calls done by the menu ROM or the CLPD?
So for now the most impressive thing we understand how to do is physically erase the program files of rom hacks. A bit of a challenge in the meantime would be to fix SNK vs Capcom, which only has hacked versions and not the official version. The official programming could replace the hacked programming's address space
@rockbottom Didn't you say earlier that Waku and Windjammers were in there but unused? How does that work?
A
Apocalypse
Maybe I missed something, arent' the CPLDs used on the cart off the shelf parts?Indeed, if custom code for the cplds can be written then anything/everything is possible
Butter Meister
Student
They are, but their dumps are encrypted. Rewriting the CPLD code from scratch might be the only way
As I'm less experienced with this, what is the problem with NAND Flash? Too slow? You seem to get quite high capacity ones.I know, crazy, considering a 512MBit chip from a reputable source here in the UK is about £6, of which i'd need 16 to match the capacity of these chips
At least not much to lose if it turns out to be fake
A
Apocalypse
Then I'd abandon the efforts to dump them and just write new code. I don't see that being a problem at all but rather a solution.
Butter Meister
Student
Yep, it's gonna have to be new code. I woulda liked to have seen the original code to get an idea, but oh well.
rockbottom
Enthusiast
They're old, original MAX 3000A series, which were the last true 5v tolerant cpld range from Altera. Been obsolete a fair while now, so unless any NOS pop up anywhere it's gonna be ebay/china recovered stuff
Obviously the originals can be reprogrammed but I don't want to kill them just yet as i've got more testing to do and only have the one cart to play with. As soon as they're erased there's no going back as we have no backup dumps of the original code
rockbottom
Enthusiast
Can't use NAND directly in an application like this, it needs to be "managed" by a controller of some sort due to the more complex bus, lack of random-access etc. It's only really used in stuff with an OS and a proper file system to manage bad blocks etc. Parallel NOR on the other hand is super simple, single byte full random-access, interface wise it's basically unchanged since the first ever mask/eproms were made way back in the dawn of time
rockbottom
Enthusiast
Yes, there's a few extra games in the P dump, there's no graphics or sound and no way to select them, so not of any use. Just an interesting curiosity
There's masses of empty space in the P chip, only about 400MB is used, less than half the chip, so I guess they didn't really need to worry too much.
A
Apocalypse
The EPM70xx are also true 5V tolerant but I think Altera doesn't make them anymore. But Atmel still manufactures equivalent parts (ATF15xx).
Butter Meister
Student
Well we won't need to replace the CPLD's will we? At that point you might as well make a new board from scratch.
And don't forget about the STC chip nobody's talked about yet
A
Apocalypse
Won't need? Dunno, if we can't dump them and don't want to erase them what are the remaining possibilities?
No because the 70xx are pin compatible with the MAX3000.
