Undocummented address ranges

[notaz]

I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:


download here

Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):

The noised memory locations are changing randomly.

- same thing applies for A00000-A0FFFF without BUSREQ. However unused A100xx addresses don't seem to have that noise:

note that reading A10100-A10FFF locks up the machine.

- the "MEMORY MODE" register (see official docs) seems to affect data line noise, "non-noisy" unused areas become noisy and values read become more random:

vs

note that bit8 is always 0 regardless of value set.

- "MEMORY MODE" register can be accessed on any A110xx address, likewise BusReq and Z80Reset at A111xx and A112xx. A113xx is readable/writeable too (bit8 always 0 on reads though), but I haven't noticed any effect it could have.

A11400-A11FFF locks up.

My tests were performed on TMSS PAL MD1 machine. Everyone who can run code on real hardware is welcome to check how their machines behave.

HardwareMan: can you test this on your DTACK modded MD?

[HardWareMan]

HardwareMan: can you test this on your DTACK modded MD?

What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting. But, as for reading system registers I can help.

[notaz]

What kind of tests you request? I already done scan all restricted areas (as Sega2.doc says) many years ago. And do not find there something interesting.

Ah, I thought you haven't. Nevermind then.

[Eke]

Interesting...

have you tried to run Charles memtestprogram on your hardware ?

according to this test ROM, unused areas are supposed to always return 00 in the lower byte

[notaz]

Interesting...

have you tried to run Charles memtestprogram on your hardware ?

Hm, wasn't aware of that test. Will run it today after work.

Maybe this stuff is hardware revision dependent.

[HardWareMan]

Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted).

It is clear when read the manual for the M68K. My MD mirored $000000-$3FFFFF to $400000-$7FFFFF (maybe it is becouse I use TA-04 clone chip, when repair it). Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?
I remind you memory map, wich I got with my research.

[notaz]

Nevermind, DTACK is formed by VDP, so bus arbiter (TA-04) can't affect to it. So, if you need, I can rescan whole 16MB space and clarify lockup restricted areas. Should I?

Well you can check if we get different results. According to my tests, "unsafe" locations are:

Code: Select all

800000-9FFFFF
A10100-A10FFF
A11400-A11FFF
A12100-A12FFF
A13100-A13FFF
A14004-A140FF
A14102-BFFFFF

VDP area (C00000-DFFFFF) can be accessed as Charle's doc describes.

[HardWareMan]

OK, I'll do that at weekend.

[Huge]

Neba-neba?

[notaz]

according to this test ROM, unused areas are supposed to always return 00 in the lower byte

Not on my machine:

[Nemesis]

Interesting...

have you tried to run Charles memtestprogram on your hardware ?

according to this test ROM, unused areas are supposed to always return 00 in the lower byte

That depends on the model. IIRC, I observed the lower byte being fixed to 0 on my MD2, but not on my MD1. I didn't check individual revisions though. There may be some revisions of the MD1 and MD2 which differ from this.

[Eke]

well, that clear up some stuff, thanks ... I remember that the infamous Time Killer would hang on emulator if you return 0 in the A111xx lower byte (it tests the wrong bit for bus request).

[Ti_]

I've just finished writing hex-editor-like tool for MegaDrive, to be used for realtime memory inspection:

Here are some findings:
- memory which has no device associated (open bus) returns next instruction word, but there seems to be some occasional random noise on data lines (here I have 4MB flashcart inserted):

I got different values than 4eba for all areas:

here's videos:
sega md2
sega md2 with segacd being off
sega md2 with segacd being on

sega md:
0x200000 - 4EXX, 6EXX, 7EXX, where XX is sram (8bit).
0x400000 - 7EBA, FFFE, FFFF
0x600000 - 7EBA, FFFE, FFFF
0xA00000 - FFFA, FFFE
0xA10020 - 7EBA, FEBA
0xA11100 - FFFA, FFFE
0xA12000 - FEBA, FEFA
0xA13000 - FEBA, FEFA
0xC00018 - 4EBA (stable)

sega md with segacd but not powered:
0x200000 - 00XX
0x400000 - prg-ram very unstable
0x600000 - word-ram unstable
0xA00000 - 0000
0xA10020 - 0000
0xA11100 - 0100
0xA12000 - comm-regs unstable
0xA13000 - 0000
0xC00018 - 4EBA (stable)

sega md with segacd:
0x200000 - 00XX, 40XX
0x400000 - prg-ram
0x600000 - word-ram
0xA00000 - 0000
0xA10020 - 4000, 4002
0xA11100 - 4180, 4182
0xA12000 - comm-regs
0xA13000 - 4000, 4002
0xC00018 - 4EBA (stable)