Sega Dreamcast System RAM 16MB+ & JTAG hack

Ola chaps

To pass the time and maybe have some fun along the way I've started to experiment with different Sega Dreamcast mods.

I figure the long term goal is to be able to play some Sega Naomi games using a Sega Dreamcast. It *isn't* about hacking Naomi games to work on a Sega Dreamcast, but hacking Sega Dreamcast games to use the Sega Naomi's higher quality textures.

More textures = more memory and in the case of more memory, it can also mean more pins used on 86 pin TSOP-II on the System RAM and the 50 Pin for the Video and sound RAM.

I have found replacement memory up to 32MB in size which at first glances appears compatible. The Dreamcast has 2 System RAM chips, so that's upto 64MB of installable memory. It may sound a lot, in fact it is a lot compared to the Standard 16MB, but the Naomi only has 32MB (2x 16MB?) of system RAM. The Hikaru and Naomi 2 both have 64MB of system RAM, but then again they have dual SH4 CPU's too so I'm guessing it is 2x (2x 16MB) ie the same size and chips asthe Naomi per CPU, but at is has more CPU's it has more RAM microchips.

AFAIK The Sega Dreamcast Memory Map Unit is usually disabled with support for upto 64MB RAM into several key areas mapped out already, just less is installed at the factory. The MMU can also be enabled so the system can look for the extra memory all by itself, but then I guess if you get too much RAM in there CPU or bus speed bottleneck issues may crop up.

Anyhow I digress. The replacement larger 86 pin TSOP-II ram for all intents and purposes looks and works the same as lesser RAM, but with a catch. There is an extra address line on pin 21 called A11. Now the system could work fine without it, the only way to know for sure is to just buy the stuff and test it, but I'm skint at the minute, I'll need to rebuy equipment to replace the stuff I broke ages ago and I have other priorities for my money at present but someone else may find the information helpful.

With the help of the Tec Toy VA0 CPU and DRAM schematic posted by l_oliviera, various microchip PDF's, a VA1 motherboard, a screwdriver, snippers and time and effort I managed to strip my Sega Dreamcast motherboard, albeit crudely, and map the traces for the most relevant pins from the system RAM to the SH4 CPU.



There is no connection from pin 21 on the DRAM to any of the three spare address pins on the SH4 CPU (Y5, W6 and Y14 circled in white) and if I had a Naomi or Hikaru it would really help finding some clues, BUT the hope is should a connection be made the new, larger memory should take to the SH4 like a duck to water. The only way to know for sure is to test it and see what happens, the problem is finding a trace.



With the map I made of the top side of the motherboard, I was able to make out some landmarks (which was a pain at first due to mirror image and other complications!) eventually finding the spots where the relevant SH4 CPU pins lie. As you can see, Y5 and W6 are probably a no go due to obstructions, but Y14 could prove useable if drilled through the back. Yes, I could have saved hours mapping if I just drilled through the top, then looked at the bottom and known for sure, but I couldn't find my small drill bits so



Alternatively I think someone who is sneaky could perhaps slide a wire through the top side straight to the SH4 pins Y5 or Y14 as there is sufficient clearance, but it will be difficult to check for correct contact or shorts.

Anyhow it may be some time before I get rolling, by the time I'm in a position to do so, I'll probably have forgot all about it, given up, or been distracted by other things so hopefully someone else will either pick up where I left off and experiment some more, or provide help and advice to help keep the ball rolling! I think I'll end up buying an SPCO switch and wiring pins 21 to Y5 on one end, Y14 on the other and of course off in the middle so I can experiment and see exactly what happens with the larger RAM in either state.


Also, it looks like the Sega Dreamcast can be Jtagged using the ARM7/AICA in Serial Wire Debug mode.

I think I found the relevant contacts (with the aid of the VA0 schematics once again) on the back of the board, but again I have no way to test this until I rebuy some equipment -_-. The reason I started snooping for this was because I saw a G2_RQDEV# pin on the ext port schematic whilst lookjing to map it to a PCMCIA port. A little snooping around and most of the G2 external bus for the modem etc went to the Sound chip. After some more snooping I noticed the chip has an AICA TRST, AICA TDI, AICA TCK (SWCLK!) and AICA TMS (SWDIO!), then the alarm bells were ringing



I'm pretty sure I found the correct pads to JTAG, but it's late and I'm tired so I may have drawn them in the wrong order due to one of the resistors being labelled out of the expected sequence, but you should have no problem finding a source for ground or current for your 20 pin connector yourself. It is definitely these 4 connections though! The AICA TDO leads to IC401 pin 46 but I'm off to bed and I'll follow the end route when I wake up, but a full 5 pin JTAG Sega Dreamcast would rock hehe.


In the meantime, I have been struggling to find a link to linux DC that actually works. Many of the old project pages are full of dead links or years out of date. It would be useful to load it simply because it may be possible to view the memory availability states with or without the MMU enabled, or perhaps someone more famiilar with homebrew tools etc could write a short selfbootable app to report on the memory size and used space etc?

 

Which distro do you want to mess with?

I have archives of the bits needed to jumpstart the NetBSD distro seen here http://www.puresimplicity.net/~hemi/dreamcast/
I can also hook you up with self contained Disc Juggler bootable disc.

Let me know the best way to get it to you.

 

Eh I've actually got a version of DC Linux here somewhere. You're lucky I didn't toss it out when I moved.

I'll see about imaging it.

 

What do you think the JTAG connections are going to allow you to do?

 

The ARM7 is the last in the chain before the video DAC so I'm hoping it would allow ICE/IDE etc to most chips, similar to the Katana DA (Cross Products Debug Adapter). It probably won't, or at least not to all of the IC's but there is only one way to find out. Also I've found what look to be more JTAG traces but I'm yet to start mapping them - I've only just crawled out of bed!

 

Hi,

I tried doing some JTAG on the SH4 a few weeks back by using urjtag and a simple parallel port "wiggler".

Apparently the SH4 doesn't have a device ID, and just shows up as 00000000, so keep that in mind.

Also, it seems that although it's "electrically compatible" with the JTAG standard, it actually uses Hitachi's own protocol for control.
So I don't think standard JTAG software will work with it.

EDIT: Oh yeah, Hitachi call their protocol H-UDI (bottom of page 1)...
http://dcemulation.org/1-newsdump/QRandom/DC stuff/info/SH stuff/sh4_prod.pdf
(they just had to go and be "clever" didn't they! :rolleyes-new

When I did a scan of the port, it seemed to be finding some of the registers, but the Hitachi protocol uses a couple of registers in a custom way.
I couldn't find much info about this on the Web, apart from the mega-expensive Hitachi debug tools.

You can see on the VA0 schematic that the SH4 JTAG signals are available on one end of resistors R108 to R112, and /TRST is on R117.

You might have better luck with the AICA, but from what I can see, it's JTAG chain only loops through to the video encoder.
The HOLLY chip has it's own JTAG on test pins TP634 to TP637. The HOLLY's /TRST pin is tied to Ground with 0-ohm resistor R624, so you'll have to lift it to enable the JTAG port.
(top-right of "CONNECTORS" VA0 schematic).

There is some hope though...

It would be very interesting to see if the HOLLY JTAG will work, but I never tried it.
The software can do a scan for the boundary registers, you then just need to work out which bits correspond to each IO pin.

The HOLLY controls the GD drive / BIOS of course, so it might prove a handy (and cheap) debug tool if some software could be made for it.

btw, the E_DC_HW_outline shows how the extra 16MB RAM could be hooked up (pages 8 + 9).

The normal two chips share 32-bits of the 64-bit data bus (the order is a bit weird though).
The /CS3 signal (/Chip Select) enables the SDRAM chips, but the /CS2 and /CS6 signals are spare (they are apparently available on test pins TP104 and TP105 respectively).

You'd need to hook up all the signals of your extra SDRAM chips to the same pins as the originals, but then connect their /CS pins to /CS2 instead (sounds like a good candidate, 'cos it would map the new RAM at 0x08000000, directly below the original RAM.)

I'm not sure how using SDRAM chips with different address pins would work? Sometimes the controller needs access to all the address bits because the chips often have extra registers for refresh control etc.

This is good stuff though - always great to see some hardware hacking going on.

@LeGIt - try using a parallel port wiggler connected to the HOLLY JTAG pins (need to remove R624 first). It might show you the boundary scan regs, so you can mess with the pin states etc.


OzOnE.
Damn it! Just when I thought I'd shelved the DC stuff for a while.

 

I saw the Holly's own JTAG on the schematic too. Most of them have their own but I was hoping I could find a daisy chain, but mapping the test points on a real motherboard (VA1 at that) using a VA0 schematic is a long and arduos task hehe.

I stripped the motherboard bare (with a screwdriver ) and scanned both sides at 2400 DPI. My optical resolution is only 1200 DPI, but as a PCB circuit is basically line art, using the digital magic helped reduce the jaggies on some areas to make them clearer.

I'm basically starting one IC at a time and mapping the traces off it to wherever they go and from there I can label the test points quite easily. Many are straightforward and make sense but a good number bob and weave from top to bottom and back. It isn't too difficult, but it is very time consuming to get it done right.

I have since got a 1mm drill bit and drilled out some pins. I think it will also be possible to drill into the back of W6 too, but it means having to move C121 about 2mm north, plus the new hole may interfere slightly with the trace going to C122. It can be done though, but I think Y5 probably still needs to be done through the front and if it can be done, may as well do Y14 through the front too.

At first glance I think Y14 may be grounded, but I have been too busy to double check if it is actually grounded or otherwise engaged.

The plan is to drill out all 3 relevant pins from the top of the board, then place it under a working motherboard and use it as a jig to line up the hole(s) to drill into the back of the SH4 on the other board, hook them pin(s) up, and see which one works on SDRAM A11/pin 21 with the least problems.

Anyhow I'm glad I've coaxed at least one person out to give the DC another look. There is still some life in this little beastie yet!

 

The extra memory on Naomi is used only for better textures/sound? Anyone ever tried to "downgrade" a Naomi game to run it on Dreamcast?

 

Treasure did with Ikaruga. Not a bad starting point for comparison.

 

There are plenty of official Naomi to Dreamcast conversions released during the system's lifetime. But it does not seem feasible to attempt any sort of unofficial Naomi>DC conversion just from a Naomi rom, as Naomi games are designed to be loaded into a flash memory cart in their entirety (even Naomi GDrom games just have 2 or 3 huge files which get downloaded to the large flash mem dimm cart for access during gameplay), while DC games, including Naomi-DC conversions, have been reprogrammed to be read from the gdrom in short spurts designed to fit into the DC's 16MB main ram.

 

Yup.

 

Would it be possible to induce short-term non-volatility into the Dreamcast's memory to make it behave a little more similar to the NAOMI? A small amount of capacitance might allow for it to use the GD-ROM on more of a backup basis (and save the laser from constant work). Coupling that with additional memory, bank switching, and some logic to interface the two might make the Dreamcast a little bit closer to behaving like a NAOMI.

Maybe then we could flash it with a NAOMI or Atomiswave BIOS and see all the fun error screens from it running on slightly different hardware.

 

x

 

Ha, that would truly be the best practical solution. I just think abstract hardware hacking is interesting is all.

 

AFAIK DC Linux (and of the DC course port of NetBSD) must used the MMU.
NetBSD needs it (it cannot run on platform without MMU), and I think that only Linux (and not uLinux) have been ported to the DC.

 

It's late, I'm tired, I had a Chicken Vindaloo earlier and I may have an extra bit of cash when I wake up so I'm wired too!

Before I blow my wad I've been having a reread of the SH4 documentation and the map I've made of the Dreamcast traces etc.

It seems DRAM pin 21 / A11 may need to be connected to the SH4 address registers in order. It may not need to be and work just fine regardless, but the address multiplexing gubbins will just be happier if everything was in a neat little line in number order.

The SH4 documentation memory multiplexing lists DRAM A11 and A12 on most modes. I am going to assume these are BA0 and BA1 respectively.

Y14 is the easiest pin to access, this is true, but it may also be the most unagreeable, unless every other address pin was shunted along for a 32 bit bus, which would be somewhat impractical but not impossible.

It seems the next best thing may be to solder the larger RAM, but lift up / bend pins 21-23 and wire them in manually. Pin 21 / A11 will have to go to the Pin 22 trace. Pin 22 / BA0 will have to go to the Pin 23 trace and as for Pin 23 / BA1, well, we will have to move C121 up by 2-3mm, drill into the back of the SH4's W6 and connect it up there for a 64 bit bus.

By the time I wake I intend to order a new iron and hope my intended chips are in stock. My favourite supplier doesn't have much variety for TSOP50 so no video or sound RAM experiment for now but it will cost a small fortune to get the system ram show on the road anyway -_- Maybe I'll cheap on the components, desolder an old SD RAM DIMM and make a mess of a hack job for lols instead.

The only issue I've noticed thus far is there is no immediate provision for an 11th address line in the documentation. Well there is, but normally it seems to be a bank select or address precharge pin, not as a plain address pin. Pins 21-23 may need to be redone regardless, but whether any more need doing, I guess time will tell

EDIT: Bugger it. Eyelids are getting heavy. Im off to sleep. Enjoy my ramblings
EDIT: Woke up and I may need to drill out B11 (SH4 A25, no connection on DC) to connect that up and possibly redirect B12/A13 too but only for 64MB RAM as 32MB looks fine without much more effort at first glance. I'll need to do more digging.

 

Thanks for the explanation. I didn't know Naomi GDrom games were build like that.

That explains how the GDrom just stop spinning after loading the game.

 

Remember HOLLY can do DMA, too - JTAG for that would allow really easy debug memory probing.

Also why not just add bigger SDRAM chips for the holly?

I am also aware of places with vast quantities of PC100 style SDRAM DIMMs... if you don't mind desoldering 'em

 

I had seen and not forgotten about the holly JTAG but it is much harder to map. I provisionally mapped it weeks ago, but cannot be 100% sure without the ability to test it.

Bigger RAM chips for the GPU & AICA are worth looking into too, but as my favourite supplier only has the Standard 2MB 50TSOP in stock and I haven't shopped around I have paid less attention to it for moment

As for the System RAM, my Dreamcast actually has 125MHz SDRAM installed. I am assuming the timings are altered to run at 100MHz to match the bus. Presumably any speed SDRAM 100MHz or over could be used provided one could adjust the timings in a similar manner.

I have an SMD rework station in the mail now so I should be able to strip a board without using a screwdriver for a cleaner, tidier scan, but of course it means I'll have to redraw my test point map all over again. At least the bits I have done in rough will help speed up the new map.

I also have some 0.5mm drill bits on shanks in the mail too. Whilst the 1mm bit I was using is much nicer than the 2mm bit I had originally, 1mm is still too big to drill into the back of the SH4 pins 100% accurately. 0.5mm should help ensure everything is neat, tidy and where it should be, plus I can also redrill the hole with a bigger bit to bore it out later if need be

EDIT: I just found a 168 pin SDRAM DIMM in an old PC. It is 64MB (2M x 8b x 4) x 8 @ 100MHz... I wonder...



Bad hack job to come along with DQ0-31 mapped to IC102 and DQ32-63 mapped to IC103 traces and drill into SH4 B11 for A25? Muahahaha

 

I was thinking if we added extra ram would it improve the lag we get on crazy taxi on the dreamcast?