Total MD TMSS reverse engineering

HardWareMan · Post by **HardWareMan** » Wed Oct 29, 2008 3:34 am

I think it is simply stops generating !DTACK signal. That is more easy, than using HALT signal. Just masking !DTACK signal when VDP address decoded and no "SEGA" @A14000. Look in schematic: HALT signal goes from TA-04 (315-5364).

And one more thing: there 2 SRAMS on M68K bus, but one of them using VA14, but other one using IA14 (goes from pin 46 TA-04/315-5364). Why?

Nemesis · Post by **Nemesis** » Wed Oct 29, 2008 7:38 am

And one more thing: there 2 SRAMS on M68K bus, but one of them using VA14, but other one using IA14 (goes from pin 46 TA-04/315-5364). Why?

I never noticed that. I have absolutely no idea what purpose that could serve.

HardWareMan · Post by **HardWareMan** » Wed Oct 29, 2008 8:08 am

Nemesis wrote:
And one more thing: there 2 SRAMS on M68K bus, but one of them using VA14, but other one using IA14 (goes from pin 46 TA-04/315-5364). Why?
I never noticed that. I have absolutely no idea what purpose that could serve.

Maybe it used for some mirroring process in M3 mode?
BTW It is low-byte (VD0-VD7) SRAM.

TmEE co.(TM) · Post by **TmEE co.(TM)** » Wed Oct 29, 2008 10:16 am

Z80 continues to run after the VDP lock out and ROM access is not restricted in any way to it.

Oliver_A · Post by **Oliver_A** » Sun Nov 02, 2008 10:59 pm

What happens when the Z80 accesses VDP registers in this state? Could the Z80 somehow set up a working display either before or after the 68k is locked?

TmEE co.(TM) · Post by **TmEE co.(TM)** » Mon Nov 03, 2008 11:24 am

Any access will lock up the system, and Z80 isn't very effective when doing VDP writes in MD mode.

Oliver_A · Post by **Oliver_A** » Mon Nov 03, 2008 1:01 pm

TmEE co.(TM) wrote:Any access will lock up the system

This is not very specific, as you mentioned earlier, the Z80 apparently doesn't lock up. So, does Z80 access to VDP registers lock up the 68k? Does the VDP accept Z80 accesses? What role could the SMS mode play here in this scheme?

, and Z80 isn't very effective when doing VDP writes in MD mode.

Maybe, but that's not the point.

TmEE co.(TM) · Post by **TmEE co.(TM)** » Mon Nov 03, 2008 1:22 pm

I need to see what happens when I try some VDP access from my sound engine (which runs on Z80)... I do expect that the write is ineffective then. I'm going to test it shortly.

TmEE co.(TM) · Post by **TmEE co.(TM)** » Mon Nov 03, 2008 2:20 pm

I did some quick tests and :

Any access will lock the system, either 68K or Z80 side. If 68K locks, Z80 will continue to run until it touches VDP.

Again some useless info

Oliver_A · Post by **Oliver_A** » Mon Nov 03, 2008 3:47 pm

Cool, thanks for the info!

Eke · Post by **Eke** » Thu Jun 03, 2010 3:51 pm

monthly post gravedigging

Nemesis wrote:I wonder exactly how TMSS halts the system on a VDP access, in hardware terms. If the VDP was removed from the bus, the system would lock up by itself if VDP access was attempted, since the M68000 wouldn't get a response. The VDP does its own address decoding though, so it wouldn't be as simple as masking a CE line. Perhaps like Eke said, it might be asserting the M68000 HALT line. In this case though, maybe it's possible to get one write through to the VDP before the M68000 is halted? Or maybe there's another line running to the VDP which modifies its memory base, or disables it entirely? It couldn't completely disable the chip though, since the VDP generates the LWR and UWR lines, in the Model 1 system anyway, which would block access to virtually everything if it wasn't generated, including ROM and RAM.

About that, there is a pin (VDPM) on the VDP schematic which is connected to the Bus Arbiter with no known purpose.

It could be very likely that this is Chip Enable for VDP, which is controlled by Bus Arbiter/TMSS & asserted only when the 'SEGA' word is written in the TMSS register. It could be interesting to spy this signal on a TMSS MD and see if its value change during the BIOS sequence

TmEE co.(TM) · Post by **TmEE co.(TM)** » Fri Jun 04, 2010 12:09 pm

I got no TMSS and TMSS MD's around... must see about it, but when I get home

Charles MacDonald · Post by **Charles MacDonald** » Tue Jun 08, 2010 1:16 am

Hey TmEE, I have a MegaDrive that works regardless of writing SEGA or not, even though it is Ver. 1 and the A14000 register is there and read/writable.

It's a real unit (HAA-2605 or whatever) though I was always suspicious as it has no internal shielding at all and no cartridge 'lock' mechanism. Maybe the former is only needed in the US to be FCC compliant and the latter was removed for cost cutting measures? Or the previous owner took it (and the shielding while he was at it) out to play US games?

Excuse me if we already discussed it, otherwise I can get chip numbers and PCB markings, etc. if you need them.

Nemesis wrote:I wonder exactly how TMSS halts the system on a VDP access, in hardware terms.

If you don't write SEGA to $A14000 then the VDP will not generate DTACK for the C00000-DFFFFF range. Software still works but as soon as you touch the VDP everything locks up.

I wonder if a unlicensed cart could defeat this behavior by checking for the C00000-DFFFFF range and asserting DTACK on the cartridge port anyway. It wouldn't be accurate (e.g. the VDP can pause the 68000 by delaying DTACK assertion when the write FIFO is filled but the cart would never be able to do that), though it could be enough. ;D

TmEE co.(TM) · Post by **TmEE co.(TM)** » Tue Jun 08, 2010 2:13 am

board model and chip markings would be cool to know

...and JP machines have no shielding and VA5 boards do not show TMSS in JP setting but do in EN setting.

Charles MacDonald · Post by **Charles MacDonald** » Tue Jun 08, 2010 2:30 am

...and JP machines have no shielding and VA5 boards do not show TMSS in JP setting but do in EN setting.

I'd say you just solved it!

Will dig up the numbers as quick as I can.