NAOMI / AW possible ROM Emu project....

Damn, took me a long time to find the AW G2 / coin mech stuff. Don't know how I missed it tbh?...

http://codeviewer.org/view/code:385d
EDIT: Is it possible to add code tags to this forum? Pretty please?

p1pkin already mentioned this too. It's just a few registers at 0x00600280 in the G2 ("Modem") space, but I missed the above snippet of code somehow?
The code is in src/mame/drivers/naomi.c in the MAME source.

I don't think that would be stopping it booting the AW BIOS on the DC, so I'm thinking of modding a DC mobo with the required 128KB Flash and 128KB SRAM.
I then have to see what the G1 bus stuff is doing regarding reading the status, or triggering a DMA etc.

Now that I've got demofist running under MAME (albeit VERY slowly), it's giving me something to work with.

Just a bit of fun to play with while I'm waiting for the Naomi cart + IO board.
It might arrive today with any luck.

OzOnE.

 

Interesting findings

 

Progress report...

I have the Virtua Tennis cart now, and the FPGA board is "spying" on the data transfer.

The FPGA is also passing through the BIOS from it's Flash chip, so I can change that at will.

As expected, the BIOS loads a big chunk of the EPR code into RAM first (socketed EPROM on the cart board).
After that point, it rarely accesses the EPR code, and instead transfers the main MPR game data via DMA.

Problem is, I now see that it sometimes accesses some data with the "encryption" bit asserted.
Looks like Virtua Tennis and a lot of other carts use M2 encryption. This is most definitely something I won't be tackling atm.

You can see the list of carts in MAME and their associated encryption type here (line 8000 onwards)...
http://mamedev.org/source/src/mame/drivers/naomi.c.html

(eg. the encryption type is selected by "naomi", "naomim1" "naomim2" and so on.)

M1 encryption looks easy enough. I could probably handle those carts.
A lot of the carts have a small internal buffer as well though, and the game code can write some data to it, then request unencrypted data back.

According to the MAME source, M1 encryption is mainly based around this (the XOR thing I've seen mentioned a few times)...

res = key ^ (((b^d) << 24) | ((a^c) << 16) | (b << 8) | a);

Where a,b,c,d are the four bytes of data requested from the cart. The key is also 4 bytes (the ROM images usually include it).
I think this method can be called "obfuscation" rather than "encryption", 'cos even I can get my head around it. lol

So, once I have the PIO and DMA stuff working, I'll have to try a non-encrypted image like Dynamite Baseball.

I've found in the SignalTap captures that the IORDY signal on the G1 bus does go Low when each Word is requested via PIO.
This is good, as it means I should be able to pause the transfer if the SD card can't quite keep up (highly likely, since I'm only using an SPI interface atm).

Should be possible to pause DMA transfers just by de-asserting the DMA_REQ on 16-Word boundaries.

I'll have to see if an unencrypted Naomi GD disk image will run as a cart too?

The pinouts are coming along. I've mapped most of the address bits on the "cart" bus on CN3.
I can see where the F138 address decoders on the V Tennis cart select each chip too.

I'll map the data bus pins today and the last other unknown pins (most of which go to the Flex FPGA).

OzOnE.

 

Hmmm, found a "gotcha" with the Sega IO board....

I hooked up some 130ohm resistors between the Coin Counter pins (pins 49 and 50 on the 60-way connector CN3) and +5V.
This is supposed to get the Coin Switch inputs working, but they didn't?

I'm powering the IO board with +5V on connector CN7, and to get the player inputs working properly with no other connections, I had to join pins 1 + 3 on the 60-way connector CN3.

This makes the board enable pull-ups for all the user input pins and gets the Coin Switch inputs working.
I only found this out after reading the Naomi Uni cab manual, which has shows pins 1 + 3 bridged on CN3.

Usually, with the proper Sega 60-way harness connected, I guess it would join all the +5V pins together (pins 1 to 8 on CN3), so wouldn't have this issue.

Now I can at least start Virtua Tennis, and all my player inputs are working in the test menu.
No joystick or buttons yet, but it's nice to confirm the IO board as working.

Oh dear - I can see a new addiction in my life.
I usually buy a lot of retro consoles / computers, but I've been bitten by the arcade bug. lol

Really want a proper steering wheel now.

OzOnE.

 

An example of a PIO transfer with the Virtua Tennis cart running. (I'm only spying on the data atm)...




DMA transfer...



Interestingly, a PIO transfer happens when it first boots which writes some data TO the cart?
I think this is writing to the cart's internal buffer?

When data is being written to the cart, it (or the Flex FPGA) brings the IORDY signal low for a short time before going High again, and the Naomi latches the data.
I'm hoping this will work for PIO reads as well, so I can pause the transfer.

The PIO transfer above is reading data from 0x003FF800 near the top of EPROM (IC22).
The DMA transfer above is reading data from 0x02000000 at the start of chip MPR-22919 (IC4).

(ignore the top four bits of the offsets on the capture, they do special magical sorcery).

You can find the different offsets here...
http://www.mamedb.com/game/vtennis

Now I just need to get into the mindset of coding the state machine.

A good technique is that I can run the cart emulation in parallel to the real cart running before I enable it for real.
At least then I can see if anything is drastically wrong.

OzOnE.

 

Hey, that's my video

OzOnE. I'm kind of stuck in some of the games I'm converting and I could certainly use some help. What do you think?

 

Hi, darksoft,

Amazing work you've done on the AW stuff. I think we need to talk.
Did you code most of that software for the conversions?

I'd very much like to hear more info on your progress.

Just so you know though, I'm really not much of a coder.
I just do what I can to have fun and try to document this stuff.

I'm at a bit of a stalemate with the Naomi project (as usual), 'cos the SD card code is tricky to get right.
The next thing to try is to load the cart image into SDRAM first. Pretty much the smallest cart image I could find is Ikaruga (32MB), so that will fit perfectly into this new board's SDRAM.

I don't know if I'll ever be able to handle any of the encrypted carts, but I need to get something booting first.

@darksoft, what sort of process did you need to do for the conversions? It looks like it involves a ton of API redirect stuff and patching stuff?

OzOnE.

 

Oh, I see your blog post now.

Just having a read.
http://64darksoft.blogspot.co.uk/

 

Nice that you are interested. I'm finishing one AW game and I'll get back to you.

 

OzOne - Thank you for sharing this adventure with us all! - Not sure if I can be of much help, but can provide images, pictures, CF stuff, unencrypted test stuff or whatever else you might need.

 

Hi,

I haven't been checking the thread for a while.

Thanks for the offer, @Obiwantje - please let me know if you have any unencrypted stuff I could test.

Ok, I think I might as well post the Excel spreadsheet of the pinouts I've found on the NAOMI...

It should NOT be taken as 100% accurate, but I'm fairly confident about most of it.
If anyone uses these pinouts and damages their NAOMI or other stuff, I'm not responsible...

(might need to manually copy 'n' paste the URL)...
https://mega.co.nz/#!btBlFCoQ!dg1Gxi1g-r-3Aq3Ofy1LzF9TseEstvn_nuWqsHtRwug

I haven't finished mapping the "cart" bus pins on the Flex sheet to the CN1-3 sheet yet.
Those signals are my best guess though, and only based on what I can see on the carts themselves.

I did some testing with the Virtua Tennis cart, and you can see where the data bus is grouped together via some buffer ICs.
That doesn't necessarily mean that the NAOMI uses those signals unscrambled though, so don't take the signal names as gospel.

It looks like the game carts can be accessed directly via the "cart bus" on connector CN3 (via the Flex chip), but in many cases the cart itself has it's own chip which sits on the G1 bus and does encryption etc.
(Most of the G1 bus signals are available on CN1, and the G2 signals on CN2.)

CN2 also has the digital CDDA signals on it (not sure if this is an input or an output?), as well as the optical Link Tx / Rx signals and stereo audio signals (again, these could be an "input", to mix with the NAOMI's output?).

The last few pins on CN1 connect to the SH4 CPUs serial port pins, so it's possible they could be used for debug info on some games?
I've yet to hook anything up to those pins. It will be interesting to know if the BIOS itself outputs anything on there. I guess that can be checked under MAME though?

The CN3 pinouts show the connection to the X76F100 EEPROM on the cart too.

Please ignore the Sheet 1 / Sheet 3 tabs - Sheet 1 is just my notes from when I connected the NAOMI EPROM socket to my FPGA board.
Sheet 3 shows some of my progress on testing the Virtua Tennis cart itself.

Oh btw, does anyone know how to "overlay" the BGA pin numbers from the second Excel sheet onto the first sheet?
It would be nice to have the pin (ball) numbers in smaller text in the corner of each cell if that's possible?

I haven't finished typing in all the Holly chip signals either.
The service manual schematics are tricky to read, so it's quite long-winded.
The important half is done, just not the connections to the video DRAM etc.

OzOnE.

 

Oh, also...

I'm assuming the BGA ball / pin numbers spiral inwards in that fashion?
That's what I could glean from the NAOMI PCB itself at least, and also from where the expected signals went when I tested them with the Multimeter.

I couldn't find the exact BGA-500 footprint on the web, but it appears to be OK.

If anyone wants to finish off the Holly BGA pin names using the VA0 schematics, please feel free.
If you could then post any updates files on here, that would be best.

(The SH4 pinouts are available in the Hitachi hardware PDF anyway, so not much point adding it to the spreadsheet.)

Here is a slightly enhanced version of the GPU / VRAM diagram from the DC VA0 schematics...

EDIT: Changed from Tinypic to Mega, to preserve the mammoth image resolution...
https://mega.co.nz/#!C1JSlZTL!MtZeDg8Se_3WQe8FBgXaHE9FbdV4KXDB07Dh_kx4yrs

As you can see, the pin numbers aren't always clear to read, especially when there's a 0 / 5 / 6 / 8 / 9.


If only there was a decent hackspace anywhere near me - I could get tons of projects finished.
I'm still looking to get an HDMI output board made, which could be made to work with the N64 / DC / NAOMI / Jaguar, and many consoles / micros.

OzOnE.

 

Very cool stuff....heres to hoping to seeing fist of the north star running on dc haha

 

I don't suppose any of you fellows know where I could pick up a replacement Atomiswave ram chip? One of them in mine is faulty, and I wouldn't mind slapping a new one in there. The chip is an NEC D4516161AG5-A80-9N. Also interesting to know would be if this is the same chip used in the dreamcast (might be easier to pillage one rather than locate a supplier?)

Cheers