Undocummented address ranges

Ask anything your want about Megadrive/Genesis programming.

Moderator: BigEvilCorporation

Post Reply
notaz
Very interested
Posts: 193
Joined: Mon Feb 04, 2008 11:58 pm
Location: Lithuania

Undocummented address ranges

Post by notaz » Wed Apr 08, 2009 10:22 pm

I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:
Image

download here

Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
Image
The noised memory locations are changing randomly.

- same thing applies for A00000-A0FFFF without BUSREQ. However unused A100xx addresses don't seem to have that noise:
Image
note that reading A10100-A10FFF locks up the machine.

- the "MEMORY MODE" register (see official docs) seems to affect data line noise, "non-noisy" unused areas become noisy and values read become more random:
Image
vs
Image
note that bit8 is always 0 regardless of value set.

- "MEMORY MODE" register can be accessed on any A110xx address, likewise BusReq and Z80Reset at A111xx and A112xx. A113xx is readable/writeable too (bit8 always 0 on reads though), but I haven't noticed any effect it could have.
Image
A11400-A11FFF locks up.

My tests were performed on TMSS PAL MD1 machine. Everyone who can run code on real hardware is welcome to check how their machines behave.

HardwareMan: can you test this on your DTACK modded MD?

HardWareMan
Very interested
Posts: 745
Joined: Sat Dec 15, 2007 7:49 am
Location: Kazakhstan, Pavlodar

Re: Undocummented address ranges

Post by HardWareMan » Thu Apr 09, 2009 3:43 am

notaz wrote:HardwareMan: can you test this on your DTACK modded MD?
What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting. But, as for reading system registers I can help.

notaz
Very interested
Posts: 193
Joined: Mon Feb 04, 2008 11:58 pm
Location: Lithuania

Re: Undocummented address ranges

Post by notaz » Thu Apr 09, 2009 8:26 am

HardWareMan wrote: What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting.
Ah, I thought you haven't. Nevermind then.

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Thu Apr 09, 2009 8:27 am

Interesting...

have you tried to run Charles memtestprogram on your hardware ?

according to this test ROM, unused areas are supposed to always return 00 in the lower byte

notaz
Very interested
Posts: 193
Joined: Mon Feb 04, 2008 11:58 pm
Location: Lithuania

Post by notaz » Thu Apr 09, 2009 8:41 am

Eke wrote:Interesting...

have you tried to run Charles memtestprogram on your hardware ?
Hm, wasn't aware of that test. Will run it today after work.

Maybe this stuff is hardware revision dependent.

HardWareMan
Very interested
Posts: 745
Joined: Sat Dec 15, 2007 7:49 am
Location: Kazakhstan, Pavlodar

Re: Undocummented address ranges

Post by HardWareMan » Thu Apr 09, 2009 10:24 am

notaz wrote:Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted).
It is clear when read the manual for the M68K. My MD mirored $000000-$3FFFFF to $400000-$7FFFFF (maybe it is becouse I use TA-04 clone chip, when repair it). Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?
I remind you memory map, wich I got with my research.
Image

notaz
Very interested
Posts: 193
Joined: Mon Feb 04, 2008 11:58 pm
Location: Lithuania

Re: Undocummented address ranges

Post by notaz » Thu Apr 09, 2009 11:08 am

HardWareMan wrote: Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?
Well you can check if we get different results. According to my tests, "unsafe" locations are:

Code: Select all

800000-9FFFFF
A10100-A10FFF
A11400-A11FFF
A12100-A12FFF
A13100-A13FFF
A14004-A140FF
A14102-BFFFFF
VDP area (C00000-DFFFFF) can be accessed as Charle's doc describes.

HardWareMan
Very interested
Posts: 745
Joined: Sat Dec 15, 2007 7:49 am
Location: Kazakhstan, Pavlodar

Post by HardWareMan » Thu Apr 09, 2009 1:54 pm

OK, I'll do that at weekend.

Huge
Very interested
Posts: 197
Joined: Sat Dec 13, 2008 11:50 pm

Post by Huge » Thu Apr 09, 2009 4:42 pm

Neba-neba?

notaz
Very interested
Posts: 193
Joined: Mon Feb 04, 2008 11:58 pm
Location: Lithuania

Post by notaz » Thu Apr 09, 2009 8:15 pm

Eke wrote: according to this test ROM, unused areas are supposed to always return 00 in the lower byte
Not on my machine:
Image

Nemesis
Very interested
Posts: 791
Joined: Wed Nov 07, 2007 1:09 am
Location: Sydney, Australia

Post by Nemesis » Fri Apr 10, 2009 1:38 am

Eke wrote:Interesting...

have you tried to run Charles memtestprogram on your hardware ?

according to this test ROM, unused areas are supposed to always return 00 in the lower byte
That depends on the model. IIRC, I observed the lower byte being fixed to 0 on my MD2, but not on my MD1. I didn't check individual revisions though. There may be some revisions of the MD1 and MD2 which differ from this.

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Fri Apr 10, 2009 8:05 am

well, that clear up some stuff, thanks ... I remember that the infamous Time Killer would hang on emulator if you return 0 in the A111xx lower byte (it tests the wrong bit for bus request).

Ti_
Very interested
Posts: 97
Joined: Tue Aug 30, 2011 7:50 am
Contact:

Re: Undocummented address ranges

Post by Ti_ » Sat Aug 13, 2022 4:27 am

notaz wrote:
Wed Apr 08, 2009 10:22 pm
I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:

Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
I got different values than 4eba for all areas:

here's videos:
sega md2
sega md2 with segacd being off
sega md2 with segacd being on

sega md:
0x200000 - 4EXX, 6EXX, 7EXX, where XX is sram (8bit).
0x400000 - 7EBA, FFFE, FFFF
0x600000 - 7EBA, FFFE, FFFF
0xA00000 - FFFA, FFFE
0xA10020 - 7EBA, FEBA
0xA11100 - FFFA, FFFE
0xA12000 - FEBA, FEFA
0xA13000 - FEBA, FEFA
0xC00018 - 4EBA (stable)

sega md with segacd but not powered:
0x200000 - 00XX
0x400000 - prg-ram very unstable
0x600000 - word-ram unstable
0xA00000 - 0000
0xA10020 - 0000
0xA11100 - 0100
0xA12000 - comm-regs unstable
0xA13000 - 0000
0xC00018 - 4EBA (stable)

sega md with segacd:
0x200000 - 00XX, 40XX
0x400000 - prg-ram
0x600000 - word-ram
0xA00000 - 0000
0xA10020 - 4000, 4002
0xA11100 - 4180, 4182
0xA12000 - comm-regs
0xA13000 - 4000, 4002
0xC00018 - 4EBA (stable)

Post Reply