Flash
Flash memory provides games with 1 Mebibit (= 128 kibibyte) of non volatile memory to keep game progress saved after console shutdown. This is the biggest capacity offered among save types. Contrary to SRAM this kind of memory doesn't require an external battery to keep data saved. Similar to SRAM, it is accessed using the PI bus at address 0x0800_0000 (eg. with Domain 2 timings).
Trivia: the Ultra SDK offered a way to access multiple Flash chips and mapped them at address 0x0800_0000 | (chip_num << 17). But no known game used more than 1 Flash chip.
Note: The flash chip is a custom design (manufactured by Macronix and Matsushita), but it seems at least similar in part to the MX29L1611 model which has a public datasheet.
PI Configuration
PI BSD Dom2 should be configured with the following values to access Flash memory :
| Value | Meaning | Comment | |
|---|---|---|---|
| Latency | 0x5 | (5+1)*16 = 96ns | |
| Pulse | 0xC | (12+1)*16 = 208ns | |
| Page Size | 0xF | 2^(15+2) = 128KiB | Send the address only once at the beginning of transfer |
| Release | 0x2 | (2+1)*16 = 48ns |
Chip layout: Sectors & Pages
The 1Mebibit Flash memory is organized as 8 sectors, each composed of 128 pages, with each pages being 128 bytes.
| Sector | Range (bytes) | Range (pages) |
|---|---|---|
| 0 | 0x0000_0000 - 0x0000_3FFF | 0x000 - 0x07F |
| 1 | 0x0000_4000 - 0x0000_7FFF | 0x080 - 0x0FF |
| 2 | 0x0000_8000 - 0x0000_BFFF | 0x100 - 0x17F |
| 3 | 0x0000_C000 - 0x0000_FFFF | 0x180 - 0x1FF |
| 4 | 0x0001_0000 - 0x0001_3FFF | 0x200 - 0x27F |
| 5 | 0x0001_4000 - 0x0001_7FFF | 0x280 - 0x2FF |
| 6 | 0x0001_8000 - 0x0001_BFFF | 0x300 - 0x37F |
| 7 | 0x0001_C000 - 0x0001_FFFF | 0x380 - 0x3FF |
Silicon_Id - 0x0800_0000 - 0x0800_0007
| SILICON_ID - 0x0800_0000 | |
|---|---|
| 63:32 | FLASH_TYPE_ID (0x1111_8001) |
| 31:16 | MANUFACTURER_ID |
| 15:0 | DEVICE_ID |
Extra Details:
- Read-only register that identify the chip model. Only mapped when in Id mode. Known combination of Manufacturer / Device ID is given in the table below.
| Name | Manufacturer ID | Device ID | |
|---|---|---|---|
| MX29L0000 | 0x00C2 (Macronix) | 0x0000 | OLD |
| MX29L0001 | 0x00C2 | 0x0001 | OLD |
| MX29L1100 | 0x00C2 | 0x001E | OLD |
| MX29L1101_A | 0x00C2 | 0x001D | NEW |
| MX29L1101_B | 0x00C2 | 0x0084 | NEW |
| MX29L1101_C | 0x00C2 | 0x008E | NEW |
| MN63F8MPN | 0x0032 (Matsushita) | 0x00F1 | NEW |
Status Register - 0x0800_0000
| STATUS - 0x0800_0000 | |
|---|---|
| 31:8 | unused |
| 7 | reserved |
| 6 | unknown (maybe some kind of suspend) |
| 5-4 | reserved |
| 3 | ERASE_OK |
| 2 | PROGRAM_OK |
| 1 | ERASE_BUSY |
| 0 | PROGRAM_BUSY |
Extra Details:
- Read-Write register that exposes chip status. Only mapped when in Status mode. Clearing status can be done by writing zero.
Internal Page Buffer - 0x0800_0000 - 0x0800_007F
Buffer used to program a single page. Only mapped when in Load Byte Page mode.
Flash Data Array - 0x0800_0000 - 0x0801_FFFF
Only mapped when in Data Array mode.
Command Internal Register (CIR) - 0x0801_0000
Flash chip exposes a Command Internal Register (32bits, write only), mapped at 0x0801_0000 to serve as an interface between the CPU and internal Flash operations.
Note that, CIR is write only and cannot be read. Otherwise it's address would conflict with "regular" data addresses when reading.
Commands recognized by CIR are given below.
Trivia: For all commands bits 31-28 are the inverse of bits 27-24.
0x3C00_0000 - Chip Erase Setup
First phase of chip erase cycle. Must be followed by erase command to perform full chip erasure.
0x4B00_XXXX - Sector Erase Setup
First phase of sector erase cycle. Must be followed by erase command to perform sector erasure.
With XXXX being a page number belonging to the sector to erase.
example: XXXX = 0123, will erase sector 2 (eg. pages [0x100 - 0x17F])
Warning: Almost all emulator (and maybe some flashcarts) only erase a single page and not the full sector.
0x7800_0000 - Erase
Second phase of sector/chip erase cycle.
Will start the actual sector or chip erasure (eg. reset bits to "1").
Status erase_busy bit (0x02) will be set during the operation, and cleared once finished.
Status erase_ok bit (0x08) will be set if operation was done successfully.
Upon completion, chip will transition to status register mode.
0xA500_XXXX - Program Page
Second phase of page programming cycle.
With XXXX being the page to be programmed with bytes loaded after "load byte page" command.
Status program_busy bit (0x01) will be set during the operation and cleared once finished.
Status program_ok bit (0x04) will be set if operation was done successfully.
Upon completion, chip will transition to status register mode.
Warning: before programming a page, it must be in an erased state.
Note: flash models (NEW) may need to be in "load byte page" mode before sending program page command to CIR.
0xB400_0000 - Load Byte Page
First phase of page programming cycle.
Internal page buffer will be accessible at address 0x0800_0000
Setting it's content is usually done using a 128-byte DMA at address 0x0800_0000.
0xD200_0000 - Status Register Mode
status register is now accessible at address 0x0800_0000
Can be read using 32-bit MMIO read and keeping only least significant byte.
Can be cleared using 32-bit MMIO zero-write.
0xE100 0000 - Id Mode
silicon_id content is now accessible at address 0x0800_0000.
Can be read using a 8-byte length DMA.
0xF000_0000 - Read Mode
flash array data is now accessible at address 0x0800_0000.
A dummy 32bit read at 0x0800_0000 may be required before doing DMA to read full pages.
Also a single DMA may not cross 256 page boundaries. It must be splitted at these boundaries.
For older models, read addresses are divided by 2:
OLD: address = 0x0800_0000 + page_num * 64
NEW: address = 0x0800_0000 + page_num * 128
Programming notes
Reading flash memory is done using DMA and reads full pages (eg. blocks of 128 bytes).
A DMA read operation may not cross a 256 page boundary, it must be splitted to avoid crossing 256*128 bytes addresses. Consequently this also means that a single DMA can only be at most 256 pages long, and only if it is aligned at a 256-page boundary. Example: reading pages 254 to 520 should be splitted in 3 DMA : pages 254-255 in the first DMA, 256-511 in the second, and 512-520 in the last.
A dummy IO at 0x0800_0000 may also be required after setting flash into ReadArray mode an before doing the DMAs.
Also, cart address for DMA depends on the flash model: 0x0800_0000 + page_num * 128 (for models XXX) and 0x0800_0000 + page_num * 64 (for models 0x00 (ProtoA), 0x01(A) and 0x1E(C)).
Writing flash memory also has specificities. Before writing a page (this is called "programming a page"), it must be in erased state (eg. all bits reset to '1'). Indeed, programming a page can only flip bits from '1' to '0' (the other way '0' to '1' can only be done during erasure).
Erasing can be done either by sector (eg. 128 pages at a time), or for the full chip.
Programming is done page by page (eg. in blocks of 128 bytes) and is a 2 step process:
1. send "load page data" command, then DMA 128 bytes using cart_address == 0x0800_0000
2. send "program page N" command, and wait for completion by busy polling program busy bit.