Undocummented address ranges
Moderator: BigEvilCorporation
Undocummented address ranges
I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:
download here
Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
The noised memory locations are changing randomly.
- same thing applies for A00000-A0FFFF without BUSREQ. However unused A100xx addresses don't seem to have that noise:
note that reading A10100-A10FFF locks up the machine.
- the "MEMORY MODE" register (see official docs) seems to affect data line noise, "non-noisy" unused areas become noisy and values read become more random:
vs
note that bit8 is always 0 regardless of value set.
- "MEMORY MODE" register can be accessed on any A110xx address, likewise BusReq and Z80Reset at A111xx and A112xx. A113xx is readable/writeable too (bit8 always 0 on reads though), but I haven't noticed any effect it could have.
A11400-A11FFF locks up.
My tests were performed on TMSS PAL MD1 machine. Everyone who can run code on real hardware is welcome to check how their machines behave.
HardwareMan: can you test this on your DTACK modded MD?
download here
Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
The noised memory locations are changing randomly.
- same thing applies for A00000-A0FFFF without BUSREQ. However unused A100xx addresses don't seem to have that noise:
note that reading A10100-A10FFF locks up the machine.
- the "MEMORY MODE" register (see official docs) seems to affect data line noise, "non-noisy" unused areas become noisy and values read become more random:
vs
note that bit8 is always 0 regardless of value set.
- "MEMORY MODE" register can be accessed on any A110xx address, likewise BusReq and Z80Reset at A111xx and A112xx. A113xx is readable/writeable too (bit8 always 0 on reads though), but I haven't noticed any effect it could have.
A11400-A11FFF locks up.
My tests were performed on TMSS PAL MD1 machine. Everyone who can run code on real hardware is welcome to check how their machines behave.
HardwareMan: can you test this on your DTACK modded MD?
-
- Very interested
- Posts: 745
- Joined: Sat Dec 15, 2007 7:49 am
- Location: Kazakhstan, Pavlodar
Re: Undocummented address ranges
What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting. But, as for reading system registers I can help.notaz wrote:HardwareMan: can you test this on your DTACK modded MD?
Re: Undocummented address ranges
Ah, I thought you haven't. Nevermind then.HardWareMan wrote: What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting.
Interesting...
have you tried to run Charles memtestprogram on your hardware ?
according to this test ROM, unused areas are supposed to always return 00 in the lower byte
have you tried to run Charles memtestprogram on your hardware ?
according to this test ROM, unused areas are supposed to always return 00 in the lower byte
-
- Very interested
- Posts: 745
- Joined: Sat Dec 15, 2007 7:49 am
- Location: Kazakhstan, Pavlodar
Re: Undocummented address ranges
It is clear when read the manual for the M68K. My MD mirored $000000-$3FFFFF to $400000-$7FFFFF (maybe it is becouse I use TA-04 clone chip, when repair it). Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?notaz wrote:Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted).
I remind you memory map, wich I got with my research.
Re: Undocummented address ranges
Well you can check if we get different results. According to my tests, "unsafe" locations are:HardWareMan wrote: Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?
Code: Select all
800000-9FFFFF
A10100-A10FFF
A11400-A11FFF
A12100-A12FFF
A13100-A13FFF
A14004-A140FF
A14102-BFFFFF
-
- Very interested
- Posts: 745
- Joined: Sat Dec 15, 2007 7:49 am
- Location: Kazakhstan, Pavlodar
That depends on the model. IIRC, I observed the lower byte being fixed to 0 on my MD2, but not on my MD1. I didn't check individual revisions though. There may be some revisions of the MD1 and MD2 which differ from this.Eke wrote:Interesting...
have you tried to run Charles memtestprogram on your hardware ?
according to this test ROM, unused areas are supposed to always return 00 in the lower byte
Re: Undocummented address ranges
I got different values than 4eba for all areas:notaz wrote: ↑Wed Apr 08, 2009 10:22 pmI've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:
Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):
here's videos:
sega md2
sega md2 with segacd being off
sega md2 with segacd being on
sega md:
0x200000 - 4EXX, 6EXX, 7EXX, where XX is sram (8bit).
0x400000 - 7EBA, FFFE, FFFF
0x600000 - 7EBA, FFFE, FFFF
0xA00000 - FFFA, FFFE
0xA10020 - 7EBA, FEBA
0xA11100 - FFFA, FFFE
0xA12000 - FEBA, FEFA
0xA13000 - FEBA, FEFA
0xC00018 - 4EBA (stable)
sega md with segacd but not powered:
0x200000 - 00XX
0x400000 - prg-ram very unstable
0x600000 - word-ram unstable
0xA00000 - 0000
0xA10020 - 0000
0xA11100 - 0100
0xA12000 - comm-regs unstable
0xA13000 - 0000
0xC00018 - 4EBA (stable)
sega md with segacd:
0x200000 - 00XX, 40XX
0x400000 - prg-ram
0x600000 - word-ram
0xA00000 - 0000
0xA10020 - 4000, 4002
0xA11100 - 4180, 4182
0xA12000 - comm-regs
0xA13000 - 4000, 4002
0xC00018 - 4EBA (stable)