Neo Myth MD V11 Hardware

[ChillyWilly]

This thread will attempt to specify the hardware as much as info is available so that programmers can use the hardware effectively. At the moment, most of the info comes from the Neo Myth Menu source released by Dr. Neo, and the NDS Menu code for the Neo2 and older flash carts. Both can be found on the resources page.

Let's start with the hardware itself. Here's a picture of the front of the circuit board.



The small chip in the upper left is a low-power dual op-amp. The larger chip beside it is a 4Mx16 PSRAM. The big chip in the middle is the ASIC. The small chip in the upper right is a 1024 bit serial EEPROM. The chip below it is a linear regulator. The chip on the opposite side is the YM2413. Note the 3.579545 MHz crystal. The glaring white thingy is a connector for the GBA/NDS flash carts.

Here's a picture of the back of the circuit board.



The chip on the back is the USB interface.

The Myth ASIC maps two spaces to the flash cart - flash space, and sram space. It has bank registers to allow for the fact that the flash is larger than cart space, and the sram can be larger than a game may require. GBA flash cart sram is up to 64 KB of space (but can itself also be banked by the flash cart asic if the sram is larger).

The flash cart has its own ASIC that looks for particular operations on the bus to allow you to control the bank selection, as well as onboard features like the RTCs and such. We will look at this in more detail in another post.

You have TWO flash roms in the flash cart: a smaller "menu" flash, and a larger "game" flash. The menu flash can hold up to 16 Mbit of code/data, and is presented on the bus by default. The MD boot menu goes into this flash. The game flash is the main storage, and MD games are copied from this flash to the PSRAM in the Neo Myth. The Neo Myth ASIC can do SSF2 bank selection on the PSRAM, not the flash; hence the need to copy the flash to PSRAM.

Theoretically, the Neo2-SD should work with the Neo Myth cart. I am ordering one to play around with. The Neo2-SD has all the features of the Neo2 flash carts, but only has 256Mbit of game flash; in addition, it has 128Mbit of "zip" ram, and of course the SD interface. The zip ram is to allow code/data to be copied from the SD card, then presented as if it were flash to the GBA/NDS (or the Neo Myth - MD in our case). The code for the first version of the NDS SD card driver for the Neo2-SD is available, so it should be possible to make a driver for the MD.

I don't want posts to get too long, so I'll split this info into multiple posts. It will make it easier to edit as info becomes available.

[ChillyWilly]

Okay, let's start with the Neo Myth hardware. There are three regions of interest in the Neo Myth: 0x000000, 0x200000, and 0xA13000. The first can be mapped to flash rom from the flash cart, or to PSRAM. This is where the MD expects ROMs to be located. The second region is where the MD expects most SRAM to be located. In the Neo Myth, it can be mapped to sram from the flash cart, or to PSRAM. The final location is the base of the control registers for the ASIC in the Neo Myth.

From the Neo Myth menu:

Code: [Select]

OPTION_IO EQU     $0A13000
GBAC_LIO  EQU     $0A13002
GBAC_HIO  EQU     $0A13004
GBAC_ZIO  EQU     $0A13006
GBAS_BIO  EQU     $0A13008 ;GBA SRAM BANK
GBAS_ZIO  EQU     $0A1300A ;GBA SRAM SIZE
PRAM_BIO  EQU     $0A1300C
PRAM_ZIO  EQU     $0A1300E
RUN_IO    EQU     $0A13010
RST_IO    EQU     $0A13018
WE_IO     EQU     $0A13020
EXTM_ON   EQU     $0A13028
USB_ON    EQU     $0A13014

There are two additional registers used by the menu without defining a label. I define them as:

Code: [Select]

USB_ON    EQU     $0A13016
ID_ON    EQU     $0A1301A

The first register, OPTION_IO, controls the mappings of the Neo Myth regions. The value written is decoded into selects that are used in the ASIC to control the regions and what they can be mapped to.
0x0000 = menu/game flash in rom space
0x0001 = up to 16Mbit PSRAM in rom space, save ram in sram space
0x0002 = up to 24 Mbit PSRAM in rom space, save ram in sram space
0x0003 = up to 32 Mbit PSRAM in rom space, save ram in sram space
0x0004 = up to 40 Mbit PSRAM in rom space, no sram
0x0005 = up to 40 Mbit PSRAM in rom space, eeprom in sram space
0x0006 = up to 40 Mbit PSRAM in rom space, save ram in sram space
0x0007 = up to 8 Mbit of flash in rom space, up to 8 Mbit of PSRAM in sram space
0x0008 = 1 Mbit of PSRAM in rom space - CD BIOS mode
0x0009 = save ram in CD RAM space
0x000A = 1 Mbit of PSRAM in rom space - CD BIOS, save ram in CD RAM space
0x0012 = up to 1 Mbit of flash in rom space - SMS mode, no YM2413 FM
0x0013 = up to 1 Mbit of flash in rom space - SMS mode, YM2413 FM enabled

All other values are unknown.

The next three registers control the bank selection of the GBA/NDS flash rom. When the flash is mapped to 0x000000, it can only access 1 MB of space, or from 0x000000 to 0x0FFFFF. To access the entire flash, GBAC_HIO and GBAC_LIO hold the upper bits of the address to use when the MD accesses 0x000000 to 0x0FFFFF. LIO holds A16 - A23, and HIO holds A24 to A27. Two notes: First, regular GBA flash only supports up to A23; the extra lines from HIO are only output when EXTM_ON is set, and the flash has been commanded to enable the extra address lines (assuming it even support them - the Neo2/3 do). Second, the address lines for the flash go from A0 to A23, but the 68000 would call the lines A1 to A24 since it is a word bus. As far as the 68000 map is concerned, the lines A16 to 23 are really A17 to A24, and the lines A24 to 27 are really A25 to 28. This means the bank granularity is 128KB, and the maximum addressable flash (including HIO) is 512MB. Note that the largest Neo2/3 flash is 128MB, which is why all the menu code only mentions A24 and A25 instead of A24 to A27.  GBAC_ZIO is a mask for the upper bits of the MD address, thus setting the size of the bank the MD accesses. Mask values are: 0xFF = 128KB, 0xFE = 256KB, 0xFC = 512KB, and 0xF8 = 1MB (remember that you can only access 1MB of flash rom at 0x000000). When PSRAM is accessed at 0x000000, these three registers should be set to 0. Note that the bank since minimum of 128KB matches the bank offset granularity. Also, since up to 1MB of flash can be addressed at once, the MD address lines A17 to 19 are added to GBAC_LIO A16 to 18.

The next two registers set the GBA/NDS sram bank offset and size. This is added to the MD address offset from the base SRAM address of 0x200000. When the MD accesses 0x200000 to 0x21FFFF, GBAS_ZIO is used to mask the upper five bits, then GBAS_BIO is added to it to form the sram space address sent to the flash cart. Just from the menu code, I don't see how the 2C01 EEPROM is enabled. It doesn't seem to be used just yet, only the flash cart sram.

The next two registers set the Neo Myth PSRAM bank offset and size. The Neo Myth has 8MB of PSRAM in it. When mapped to either 0x000000 or to 0x200000, the upper bits are masked by PRAM_ZIO and then added with PRAM_BIO to form the address to access. PRAM_ZIO is the same as GBAC_ZIO, except that it can go to 4MB. 0xFF to 0xF8 are the same as GBAC_ZIO, then 0xF0 = 2MB, and 0xE0 = 4MB. PRAM_BIO is in blocks of 128KB; so 0x0000 is 0, 0x0008 is 1MB, 0x0010 is 2MB, 0x0020 is 4MB, and so on up to the max of 0x003F, which is 8MB-128KB.

RUN_IO and RST_IO are both set together to 0xFF right before running a MD/32X game. They apparently lock the Neo Myth into whatever mode it's in, and activate the SSF2 hardware at 0xA13000.

WE_IO is used to write enable or write protect the PSRAM on the Neo Myth and the GBA flash.
b0 = 1 = GBA flash write enable
b1 = 1 = Neo Myth PSRAM write enable
b2 = 1 = Remap Neo Myth PSRAM from 0x700000 to 0x300000

EXTM_ON is set to 0xFFFF to enable the high address bits from the GBAC_HIO bank.

USB_ON is used to enable or disable the USB interface. When enabled, the USB interface chip will directly access the flash rom in the slot. Set it to 0xFFFF to enable the USB, and 0x0000 to disable the USB.

LED_ON controls the state of the LED. It's either 0 = off and 1 = on, or vice versa.

ID_ON is set to 0xFFFF to allow the chip ID to be accessed at the sram space (0x200000). This is used to check the ASIC Magic signature, and access the ASIC resources. Clear this to allow regular usage of sram space.

EDIT: 2009/11/06 - changed comments on b0 of OPTION_IO
EDIT: 2009/11/09 - added info on WE_IO
EDIT: 2009/11/12 - added info on LED_ON and ID_ON
EDIT: 2009/11/14 - fixed info on address lines as relates to the flash bank
EDIT: 2009/11/29 - fixed info on OPTION_IO

[ChillyWilly]

Okay, now let's look at the flash cart. These follow the "standard" GBA flash cart rules - you have two spaces: a flash space, and an sram space. Without an ASIC, you can have up to 32MB of flash and 128KB of sram. Flash carts usually have an ASIC to allow you to have more flash or sram, and to add extra features. The ASIC is controlled by special accesses to flash space.

The Neo2 flash carts used with the Neo Myth follows the above description. The extras you get are RTCs, a 16 bit DMA channel, 8Kbit cache, a battery monitor, 16Mbit of "menu" flash, and 256 to 1024 Mbit of "game" flash. In addition, the Neo2-SD has only 256Mbit of game flash while adding 128 Mbit of "zip" ram and an SD card interface.

To control the Neo2 ASIC, you do an access to flash space where the address lines set an address and the data. Obviously, there must be a way to distinguish real flash accesses from ASIC commands. You do this by first doing a series of accesses which will never occur in the course of "real" flash accesses. This "unlocking" sequence then is followed by whatever command you need to do.

The unlocking sequence of the Neo2 is:

Code: [Select]

  NEO2_ASIC_COMMAND( 0xff, 0xd200 );
   NEO2_ASIC_COMMAND( 0x00, 0x1500 );
   NEO2_ASIC_COMMAND( 0x01, 0xd200 );
   NEO2_ASIC_COMMAND( 0x02, 0x1500 );
   NEO2_ASIC_COMMAND( 0xfe, 0x1500 );
where the first value is the address, and the second is the data value. The Neo2 takes the data on A0 to A15 in the flash space, and the address on A16 to A23 in the flash space. This will be shifted up one on the MD space as the bus is a word wide. Also, the bank registers must be set for the upper bits since the space in the MD map is limited as discussed in the previous post. So the procedure to do an ASIC operation on the Neo Myth is to set GBAC_LIO to the msn of the address, and then read the rom address equal to the lsn of the address plus the data, shifted left one.

There are three control/status registers in the flash cart ASIC: CR, CR1, and IOSR.

CR = control register 0
b15 = 1 = set RTC via writes to sram space at offsets 0x000 to 0x700, set GTC via writes to sram space at offsets 0x800 to 0xC00.
b14 = ?
b13 = 1 = enable writing to flash
b12 = ?
b11 = 1 = CS delay enable
b10 = 1 = SD card interface enable (if present)
b9 = 1 = select game flash, 0 = select menu flash
b8 = ?
b7 = 1 = SD card interface enable (if present)
b6 = ?
b5 = ?
b4 = ?
b3 = ?
b2 = ?
b1 = ?
b0 = ?

Notes: b1-b0 usually set. b10 and b7 probably control different parts of the SD interface.

CR1 = control register 1
Not much is known other than the data value 0x0630 is written to CR1 to enable 1Gbit flash size.

IOSR = I/O status (and control) register
b3-b0 = direction control for bits b7-b4. 1 =  output, 0 = input
b4 = SD Detect. This is an input which indicates if an SD card is present.
b5 = Menu flash IO. This is an input.
b6 = IR IO. This is an output.
b7 = Menu flash IO. This is an input.
b8 = PSRAM enable (if has zip ram)
b11-9 = 111 = enable game flash, 000 = enable menu flash
b12 = IR enable (if has IR port)
b13 = 1 = enable game flash if type 0 flash, 0 if type 1
b14 = ?
b15 = 1 = enable game flash, 0 = enable menu flash

All the bits associated with game flash and menu flash are not know precisely. For example, b11-9 probably all enable different things, we just know they all need to be set for game flash, and cleared for the menu flash. Likewise, the difference between type 0 and type 1 flash isn't known.

Commands:
NEO2_ASIC_COMMAND( 0x37, value ) = set CR
NEO2_ASIC_COMMAND( 0xEE, value ) = set CR1
NEO2_ASIC_COMMAND( 0xDA, value ) = set IOSR
NEO2_ASIC_COMMAND( 0xC4, bank ) = set game flash bank
NEO2_ASIC_COMMAND( 0xE0, bank ) = set sram bank
NEO2_ASIC_COMMAND( 0xE2, value ) = set flash sram/psram options
NEO2_ASIC_COMMAND( 0x90, value ) = set ID mode

ID mode is how you identify the Neo2 ASIC, and how you access the goodies inside it. When you set ID mode to a value of 0x3500, you allow reading the goodies through the sram space. Some (like the cache) can also be written. The goodies are at offsets:

Code: [Select]

#define NEO2_MAGIC_OFFS 0

#define NEO2_VOLTAGE_BYTE_OFFS               5              
#define NEO2_CONSOLE_VOLTAGE_BYTE_OFFS   6  

#define NEO2_RTC_1_SEC_4BIT_OFFS            0x4000
#define NEO2_RTC_10_SEC_3BIT_OFFS            0x4100
#define NEO2_RTC_1_MIN_4BIT_OFFS            0x4200
#define NEO2_RTC_10_MIN_3BIT_OFFS            0x4300
#define NEO2_RTC_HOUR_5BIT_OFFS               0x4400
#define NEO2_RTC_DAY_LO_4BIT_OFFS         0x4500
#define NEO2_RTC_DAY_MD_4BIT_OFFS         0x4600
#define NEO2_RTC_DAY_HI_4BIT_OFFS         0x4700

#define NEO2_GTC_1_MIN_4BIT_OFFS            0x4800
#define NEO2_GTC_10_MIN_3BIT_OFFS            0x4900
#define NEO2_GTC_HOUR_5BIT_OFFS               0x4a00
#define NEO2_GTC_DAY_LO_4BIT_OFFS         0x4b00
#define NEO2_GTC_DAY_HI_4BIT_OFFS         0x4c00

#define NEO2_CR1_16BIT_REG_OFFS               0x8040
#define NEO2_GAME_SRAM_DEV_ID_OFFS         0x8050
#define NEO2_CR_16BIT_REG_OFFS               0x8070
#define NEO2_IOSR_16BIT_REG_OFFS            0x8080
#define NEO2_GAME_FLASH_BANK_OFFS            0x8090
#define NEO2_GAME_SRAM_BANK_OFFS            0x80A0

#define NEO2_CACHE_OFFS                           0xC000         // offset of NEO2 inner cache into SRAM

At offset 0 is the MAGIC value that tells you this is a Neo2 flash cart. It is 0x34, 0x16, 0x96, 0x24, and 0xF6.

At offset 5 is the current battery voltage for the flash cart. 0 is <= 0.8V, up to 63 which is 3.3V.

At offset 6 is the current voltage from the console. It is the same as the battery voltage.

At offset 0x4000 to 0x4700 is the main RTC.

At offset 0x4800 to 0x4C00 is a more limited RTC, probably meant for in-game time tracking.

Offsets 0x8070, 0x8040, and 0x8080 allow you to read the current contents of CR, CR1, and IOSR respectively. These are read one bit at a time from b0 of the offset given, to the offset + 15.

You can read the device ID of the SRAM in the flash cart through offset 0x8050 to 0x805F.

You can read the current flash and sram bank through offsets 0x8090 to 0x809F and 0x80A0 to 0x80AF.

There is an 8 Kbit (1 KB) cache in the ASIC that is at offset 0xC000 to 0xC3FF. You can read/write the cache directly a byte at a time. You don't have to do the bit-at-a-time like the registers above.

You disable ID mode by setting ID mode to value 0x4900.

The set flash sram/psram options take the following values:
0x1500 = psram write enable
0xD200 = psram write disable
0xDD00 = fat sram write enable
0x3900 = fat sram write disable
0x7E00 = fat sram read enable
0x9400 = fat sram read disable

I think "fat" sram read/write means it's a word wide instead of a byte wide.

You might wonder what the sram and flash bank registers are for - well, the GBA cart spec only allows for 16 address lines for sram space, and only 24 address lines for flash space. That limits the amount of flash or sram addressable as mention way back at the top of this post. Since flash carts tend to have more than that, you have to bank select the flash and sram to access it all. Considering the current Neo Flash menu doesn't bother, I think there will be problems trying to run games beyond the limits of the first bank of flash and sram.

EDIT: On further reflection, when CR1 is set to 0x0630, the comment is "SET 1G ROM". Further, EXTM_ON is then set to 0xFFFF with a comment on enabling A24 and A25. Even further, the high bank register holds A24 to A27. All that leads me to believe that the Neo2 flash cart has optional extra address lines for the flash space - enough for 1Gbit addressing. It must be enabled in the flash ASIC through CR1, and then the extra lines enabled through the Neo Myth ASIC by setting EXTM_IO. So I believe there's no problem addressing all the game flash in the menu. However, I don't see something similar for the sram. So maybe some of the sram issues people have been having in other threads are due to which bank the sram is set to in the menu entry. If it's within 128KB, it works, otherwise it fails.

EDIT: 2009/11/12 - Added more info about IOSR

[Conle]

Cool!! epic thread. This is extremely useful!!! 
I will have a long read later today 

[Conle]

I have added a reference to the wiki page ->
http://www.neoflash.com/wiki/

 

When i find some more time i will create a proper development wiki page 

[Dr.neo]

ChillyWilly you are our hero indeed 

[mic_]

Could you do an instantaneous bank switch on the 32X or would the new bank have to be loaded into some cartridge RAM?  I'm not talking about regular 32X bank switching where you switch the bank that will be visible on the 68k side. I'm talking about switching in a new 4MB ROM bank on the SH2 side to get around the ridiculously low ROM limit of the 32X. Could be useful for some FMV experiments for example.

[ChillyWilly]

Could you do an instantaneous bank switch on the 32X or would the new bank have to be loaded into some cartridge RAM?  I'm not talking about regular 32X bank switching where you switch the bank that will be visible on the 68k side. I'm talking about switching in a new 4MB ROM bank on the SH2 side to get around the ridiculously low ROM limit of the 32X. Could be useful for some FMV experiments for example.

If you made some homebrew that ran in "copy mode", you would have a bank of PSRAM at 0x200000 and a bank of flash at 0x000000. That bank of flash could be from anywhere in the entire game flash on a 128KB boundary up to a size of 1MB. So you could run the game from the PSRAM bank, and have the entire flash as the game rom which can be flipped with just two stores to the Neo Myth - one if you arrange the banks to be in the same 32MB range.