Mapping extra hardware
Posted: Sat Oct 27, 2012 6:48 am
I wanted to get an idea of where a cartridge can map extra hardware after notaz had a good idea about using $A20000+, so I did some experiments using this circuit on a Genesis 2:
http://i.imgur.com/RQQpw.png
Depending on which signal you hook up, it triggers a bus error if the system hasn't responded to a bus cycle, or triggers DTACK to forcibly end the cycle in progress. You can pick a different output on the counter to shorten the interval; I was surprised that using Q7 to generate DTACK was too short on games like Aladdin which had graphical corruption.
Anyway it was interesting to read all the unreadable areas to find mirrors. This is what I found out:
$A00000-$A0FFFF : Z80 area
$A10000-$A100FF : I/O chip
$A11000-$A110FF : DRAM control reg.
$A11100-$A111FF : Z80 bus request control reg.
$A11200-$A112FF : Z80 reset control reg.
$A11300-$A113FF : ??? (I see a 2008 post from Graz wondering about it)
$A12000-$A120FF : Expansion area for Sega CD (is this /FDC or /FDWR?)
$A13000-$A130FF : /TIME area
$A14000-$A14003 : TMSS register
$A14100-$A14101 : TMSS register
It seems logical as the bus control chip only gets VA23-VA8 so you get these pages of 256 bytes, though on a Genesis 2 they could have done it differently as there's just a single 315-5660-02.
All other addresses from $A10000 to $BFFFFF are unused, excluding the TMSS registers. So it looks like you could map extra stuff in there and not cause a conflict; taking into account locations used by the 32X. Maybe $B00000+ would be safest as we know nothing uses it.
We already know this from before but I confirmed the VDP is accessible when (address & 0xE700E0)==0xC00000) by dumping the entire 2MB range and scanning through it.
TMSS doesn't work like how I thought. If you clear $A14000 and touch any address within $C00000-$DFFFFF (regardless of the condition mentioned above), the 68000 has /RESET and /HALT asserted. Hitting the reset button to trigger VRES does nothing. So even with the DTACK circuit you still can't use the VDP. I was wrong about TMSS simply withholding DTACK.
In the case of writing to the VDP with $A14000 cleared the write seems to go through before the 68000 is reset; I wrote $8C8F to the control port and the screen was interlaced but the 68000 was put into the reset state immediately afterwards. Not really useful, just an edge case for accurate TMSS emulation.
http://i.imgur.com/RQQpw.png
Depending on which signal you hook up, it triggers a bus error if the system hasn't responded to a bus cycle, or triggers DTACK to forcibly end the cycle in progress. You can pick a different output on the counter to shorten the interval; I was surprised that using Q7 to generate DTACK was too short on games like Aladdin which had graphical corruption.
Anyway it was interesting to read all the unreadable areas to find mirrors. This is what I found out:
$A00000-$A0FFFF : Z80 area
$A10000-$A100FF : I/O chip
$A11000-$A110FF : DRAM control reg.
$A11100-$A111FF : Z80 bus request control reg.
$A11200-$A112FF : Z80 reset control reg.
$A11300-$A113FF : ??? (I see a 2008 post from Graz wondering about it)
$A12000-$A120FF : Expansion area for Sega CD (is this /FDC or /FDWR?)
$A13000-$A130FF : /TIME area
$A14000-$A14003 : TMSS register
$A14100-$A14101 : TMSS register
It seems logical as the bus control chip only gets VA23-VA8 so you get these pages of 256 bytes, though on a Genesis 2 they could have done it differently as there's just a single 315-5660-02.
All other addresses from $A10000 to $BFFFFF are unused, excluding the TMSS registers. So it looks like you could map extra stuff in there and not cause a conflict; taking into account locations used by the 32X. Maybe $B00000+ would be safest as we know nothing uses it.
We already know this from before but I confirmed the VDP is accessible when (address & 0xE700E0)==0xC00000) by dumping the entire 2MB range and scanning through it.
TMSS doesn't work like how I thought. If you clear $A14000 and touch any address within $C00000-$DFFFFF (regardless of the condition mentioned above), the 68000 has /RESET and /HALT asserted. Hitting the reset button to trigger VRES does nothing. So even with the DTACK circuit you still can't use the VDP. I was wrong about TMSS simply withholding DTACK.
In the case of writing to the VDP with $A14000 cleared the write seems to go through before the 68000 is reset; I wrote $8C8F to the control port and the screen was interlaced but the 68000 was put into the reset state immediately afterwards. Not really useful, just an edge case for accurate TMSS emulation.