Page 1 of 1
Undocummented address ranges
Posted: Wed Apr 08, 2009 10:22 pm
by notaz
I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:
download here
Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
The noised memory locations are changing randomly.
- same thing applies for A00000-A0FFFF without BUSREQ. However unused A100xx addresses don't seem to have that noise:
note that reading A10100-A10FFF locks up the machine.
- the "MEMORY MODE" register (see official docs) seems to affect data line noise, "non-noisy" unused areas become noisy and values read become more random:
vs
note that bit8 is always 0 regardless of value set.
- "MEMORY MODE" register can be accessed on any A110xx address, likewise BusReq and Z80Reset at A111xx and A112xx. A113xx is readable/writeable too (bit8 always 0 on reads though), but I haven't noticed any effect it could have.
A11400-A11FFF locks up.
My tests were performed on TMSS PAL MD1 machine. Everyone who can run code on real hardware is welcome to check how their machines behave.
HardwareMan: can you test this on your DTACK modded MD?
Re: Undocummented address ranges
Posted: Thu Apr 09, 2009 3:43 am
by HardWareMan
notaz wrote:HardwareMan: can you test this on your DTACK modded MD?
What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting. But, as for reading system registers I can help.
Re: Undocummented address ranges
Posted: Thu Apr 09, 2009 8:26 am
by notaz
HardWareMan wrote:
What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting.
Ah, I thought you haven't. Nevermind then.
Posted: Thu Apr 09, 2009 8:27 am
by Eke
Interesting...
have you tried to run Charles
memtestprogram on your hardware ?
according to this test ROM, unused areas are supposed to always return 00 in the lower byte
Posted: Thu Apr 09, 2009 8:41 am
by notaz
Eke wrote:Interesting...
have you tried to run Charles
memtestprogram on your hardware ?
Hm, wasn't aware of that test. Will run it today after work.
Maybe this stuff is hardware revision dependent.
Re: Undocummented address ranges
Posted: Thu Apr 09, 2009 10:24 am
by HardWareMan
notaz wrote:Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted).
It is clear when read the manual for the M68K. My MD mirored $000000-$3FFFFF to $400000-$7FFFFF (maybe it is becouse I use TA-04 clone chip, when repair it). Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?
I remind you memory map, wich I got with my research.
Re: Undocummented address ranges
Posted: Thu Apr 09, 2009 11:08 am
by notaz
HardWareMan wrote:
Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?
Well you can check if we get different results. According to my tests, "unsafe" locations are:
Code: Select all
800000-9FFFFF
A10100-A10FFF
A11400-A11FFF
A12100-A12FFF
A13100-A13FFF
A14004-A140FF
A14102-BFFFFF
VDP area (C00000-DFFFFF) can be accessed as Charle's doc describes.
Posted: Thu Apr 09, 2009 1:54 pm
by HardWareMan
OK, I'll do that at weekend.
Posted: Thu Apr 09, 2009 4:42 pm
by Huge
Neba-neba?
Posted: Thu Apr 09, 2009 8:15 pm
by notaz
Eke wrote:
according to this test ROM, unused areas are supposed to always return 00 in the lower byte
Not on my machine:
Posted: Fri Apr 10, 2009 1:38 am
by Nemesis
Eke wrote:Interesting...
have you tried to run Charles
memtestprogram on your hardware ?
according to this test ROM, unused areas are supposed to always return 00 in the lower byte
That depends on the model. IIRC, I observed the lower byte being fixed to 0 on my MD2, but not on my MD1. I didn't check individual revisions though. There may be some revisions of the MD1 and MD2 which differ from this.
Posted: Fri Apr 10, 2009 8:05 am
by Eke
well, that clear up some stuff, thanks ... I remember that the infamous Time Killer would hang on emulator if you return 0 in the A111xx lower byte (it tests the wrong bit for bus request).
Re: Undocummented address ranges
Posted: Sat Aug 13, 2022 4:27 am
by Ti_
notaz wrote: ↑Wed Apr 08, 2009 10:22 pm
I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:
Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
I got different values than 4eba for all areas:
here's videos:
sega md2
sega md2 with segacd being off
sega md2 with segacd being on
sega md:
0x200000 - 4EXX, 6EXX, 7EXX, where XX is sram (8bit).
0x400000 - 7EBA, FFFE, FFFF
0x600000 - 7EBA, FFFE, FFFF
0xA00000 - FFFA, FFFE
0xA10020 - 7EBA, FEBA
0xA11100 - FFFA, FFFE
0xA12000 - FEBA, FEFA
0xA13000 - FEBA, FEFA
0xC00018 - 4EBA (stable)
sega md with segacd but not powered:
0x200000 - 00XX
0x400000 - prg-ram very unstable
0x600000 - word-ram unstable
0xA00000 - 0000
0xA10020 - 0000
0xA11100 - 0100
0xA12000 - comm-regs unstable
0xA13000 - 0000
0xC00018 - 4EBA (stable)
sega md with segacd:
0x200000 - 00XX, 40XX
0x400000 - prg-ram
0x600000 - word-ram
0xA00000 - 0000
0xA10020 - 4000, 4002
0xA11100 - 4180, 4182
0xA12000 - comm-regs
0xA13000 - 4000, 4002
0xC00018 - 4EBA (stable)