Mapping extra hardware

For anything related to cart (SRAM, SF2 mapper, audio, CD mode 1, ...)

Moderator: BigEvilCorporation

Post Reply
Charles MacDonald
Very interested
Posts: 292
Joined: Sat Apr 21, 2007 1:14 am

Mapping extra hardware

Post by Charles MacDonald » Sat Oct 27, 2012 6:48 am

I wanted to get an idea of where a cartridge can map extra hardware after notaz had a good idea about using $A20000+, so I did some experiments using this circuit on a Genesis 2:

http://i.imgur.com/RQQpw.png

Depending on which signal you hook up, it triggers a bus error if the system hasn't responded to a bus cycle, or triggers DTACK to forcibly end the cycle in progress. You can pick a different output on the counter to shorten the interval; I was surprised that using Q7 to generate DTACK was too short on games like Aladdin which had graphical corruption.

Anyway it was interesting to read all the unreadable areas to find mirrors. This is what I found out:

$A00000-$A0FFFF : Z80 area
$A10000-$A100FF : I/O chip
$A11000-$A110FF : DRAM control reg.
$A11100-$A111FF : Z80 bus request control reg.
$A11200-$A112FF : Z80 reset control reg.
$A11300-$A113FF : ??? (I see a 2008 post from Graz wondering about it)
$A12000-$A120FF : Expansion area for Sega CD (is this /FDC or /FDWR?)
$A13000-$A130FF : /TIME area
$A14000-$A14003 : TMSS register
$A14100-$A14101 : TMSS register

It seems logical as the bus control chip only gets VA23-VA8 so you get these pages of 256 bytes, though on a Genesis 2 they could have done it differently as there's just a single 315-5660-02.

All other addresses from $A10000 to $BFFFFF are unused, excluding the TMSS registers. So it looks like you could map extra stuff in there and not cause a conflict; taking into account locations used by the 32X. Maybe $B00000+ would be safest as we know nothing uses it.

We already know this from before but I confirmed the VDP is accessible when (address & 0xE700E0)==0xC00000) by dumping the entire 2MB range and scanning through it.

TMSS doesn't work like how I thought. If you clear $A14000 and touch any address within $C00000-$DFFFFF (regardless of the condition mentioned above), the 68000 has /RESET and /HALT asserted. Hitting the reset button to trigger VRES does nothing. So even with the DTACK circuit you still can't use the VDP. I was wrong about TMSS simply withholding DTACK.

In the case of writing to the VDP with $A14000 cleared the write seems to go through before the 68000 is reset; I wrote $8C8F to the control port and the screen was interlaced but the 68000 was put into the reset state immediately afterwards. Not really useful, just an edge case for accurate TMSS emulation. :P

Nemesis
Very interested
Posts: 791
Joined: Wed Nov 07, 2007 1:09 am
Location: Sydney, Australia

Post by Nemesis » Tue Nov 13, 2012 2:13 am

Nice work, I'm going to have to build that little circuit myself, could be handy to have around. Thanks for clarifying how TMSS works, that was on my list to test.

That's interesting about the $A11300-$A113FF area, I had no idea that existed. Did you get any apparent responce from reads or writes in this range?

For the $A12000-$A120FF region, I assume that FDC is asserted for all access in this area, and FDWR is only asserted for writes.

Charles MacDonald
Very interested
Posts: 292
Joined: Sat Apr 21, 2007 1:14 am

Post by Charles MacDonald » Tue Nov 13, 2012 2:56 am

Nemesis wrote:Nice work, I'm going to have to build that little circuit myself, could be handy to have around. Thanks for clarifying how TMSS works, that was on my list to test.
You may still want to test other models of the Genesis, for example I have a Mega Drive where the TMSS doesn't work like this. I'll try to update this thread with a description of it later. And there could be other variations of the TMSS behavior tied to which ASIC they used.
That's interesting about the $A11300-$A113FF area, I had no idea that existed. Did you get any apparent responce from reads or writes in this range?
The bus appeared to be undriven when reading, though I didn't have a way to pull data bits low to check if they were being driven high (the data bus gradually floats high the longer the bus isn't driven, so by the time the DTACK circuit fires to end a read cycle, the bus is always $FFFF).

Writes didn't do anything immediately noticeable; it might be worthwhile to check out the memory strobes on the cartridge and expansion ports to see if any of them change subtly (assuming this register does anything like $A11000 does).
For the $A12000-$A120FF region, I assume that FDC is asserted for all access in this area, and FDWR is only asserted for writes.
Cool, that seems reasonable enough. It's been a while, good to have you back!

Post Reply