Version 12 (modified by 6 weeks ago) ( diff ) | ,
---|
Hardware Overview
The Sega Teradrive consists of a 286 IBM PC integrated with a Sega Megadrive. The PC side is fairly standard and is built around a Western Digital chipset found in a number of other 286 and 386 systems, including the IBM PS/55 5510Z which has some additional similarities to the Teradrive. The main components of the PC chipset are the WD76C10LP system controller (DRAM controller, memory map, etc.), the WD76C30 peripheral controller (serial and parallel ports), the WD76C20 floppy controller (also provides the RTC and NVRAM) and WD90C10 VGA. While the chipset supports more, the motherboard can only handle 2.5 MiB of RAM without modification.
The Mega Drive side is most similar to a MD1 VA3 or VA4, but has some important differences. The Z80 has 16 KiB of RAM instead of the normal 8 KiB and the VDP has 128 kiB instead of the normal 64 kiB. It has a discrete YM3438 instead of a YM2612 as found in other pre-VA7 MD1 systems. It has the same "fix" for incorrect status port reads as found in MD systems with an integrated YM3438, but implemented as discrete logic. For the 68K it has a 10MHz rated 68HC000 which runs at either the standard speed or 10MHz depending on the mode.
Joining the two is the IBM 79F2661 "bus switch". In addition to providing a bridge between the MD-side 68K bus and the ISA bus on the PC side, this chip also manages access to an extra 512 KiB ROM. This ROM contains a Kanji font, a ROM disk image for the boot menu and some firmware for the MD-side that implements a Teradrive specific variant of TMSS. This chip is also found in the PS/55 5510Z where it presumably is also used for Kanji ROM management.
286 Memory Map
This uses physical addresses rather than the more traditional segment:offset format since the latter has multiple representations for the same physical address and can't represent addresses above 1 MiB. Since the chipset is fairly flexible, a lot of this map can be changed, but this is the config set by the BIOS.
000000 - 09FFFF
: conventional memory
0A0000 - 0BFFFF
: VGA memory (only part of this may be used depending on VGA register settings)
0CE000 - 0CFFFF
: bus switch memory window into extra firmware ROM or 68K address space (note address is configurable in settings menu)
0E0000 - 0FFFFF
: combined VGA BIOS and main BIOS (in shadow memory)
100000 - XXXXXX
: additional RAM
68K Memory Map
000000 - 3FFFFF
: cartridge or expansion port or PC memory or firmware
400000 - 7FFFFF
: expansion port or cartridge (need to verify what happens here when PC memory or firmware is enabled at 0)
800000 - 9FFFFF
: unmapped (32X)
A00000 - A07EFF
: Z80 address space
A07F00 - A07FFF
: freeze (Z80 VDP port window)
A08000 - A0FFFF
: mirror of A00000
A10000 - A100FF
: IO registers
A11000 - A110FF
: memory mode register
A11100 - A111FF
: Z80 BUSREQ/BUSACK
A11200 - A112FF
: Z80 RESET
A11300 - A113FF
: open bus
A11400 - A11FFF
: unmapped (!DTACK not asserted, will freeze without additional hardware)
A12000 - A120FF
: !FDC (Sega CD)
A12100 - A12FFF
: unmapped (!DTACK not asserted, will freeze without additional hardware)
A13000 - A130FF
: !TIME (cart mapper registers, also MARS
at A130EC when a 32X is attached)
A13100 - A13FFF
: unmapped (!DTACK not asserted, will freeze without additional hardware)
A14000 - A14003
: TMSS lock, write only (note this functions differently from the standard TMSS lock register)
A14004 - A150FF
: unmapped (!DTACK not asserted, will freeze without additional hardware)
A15100 - A153FF
: normally unmapped (no !DTACK), 32X registers if 32X present
A15400 - ADFFFF
: unmapped (!DTACK not asserted, will freeze without additional hardware)
AE0000 - AE0003
: MD-side Teradrive bus switch registers
AE0004 - AEFFFF
: unmapped (!DTACK not asserted, will freeze without additional hardware)
AF0000 - AFFFFF
: PC IO space (including PC-side bus switch registers)
B00000 - BFFFFF
: 1 MiB window into PC address space
C00000 - DFFFFF
: VDP/PSG registers (with holes)
E00000 - FFFFFF
: Work RAM
PC Side Bus Switch Registers
Key: X = writable by both CPUS, M = writable by M68K only, R = read-only, 1 = read-only, always 1, 0 = read only, always 0
1160: XXXXXXXX
Selects an 8 KiB page from kanji/romdisk/MD ROM (note only the upper 4 KiB of the page is visible on the MD side when MD firmware is enabled)
Set to 21h when unlocking MD side and in BIOS boot
Set to 0 by BIOS after initial 68K boot
1161: 11111111
1162: 110XXXX0
Controls address of memory window in 286 address space
Effectively top byte of real mode segment address or physical address >> 12
Normally initialized from a value stored in CMOS
Set to CE if value in CMOS is invalid
Window is 8KiB in size and is used for both PC-side access to MD hardware and the Kanji/romdisk ROM
1163: XXRRXXXX
bit 0: Enables auxiliary ROM on 68K side
bit 1: Enable 286 memory window into 68K address space (must be clear when booting 68K)
bit 2: unknown
bit 3: unknown
bit 4: Returns value written by 68K to AE0001 bit 0
bit 5: Returns value written by 68K to AE0001 bit 1
bit 6: Value written here is readable by 68K at AE0001 bit 2
bit 7: Value written here is readable by 68K at AE0001 bit 3
Set to 1 by BIOS and during MD unlock procedure
1164: MXXXXXXX
bit 0: Setting bit from 286 side pauses the 286 and releases 68K from reset
Clearing bit from 68K side puts 68K into reset and releases 286
Making certain other reg changes seems to make clearing this bit have no effect
bit 1: 0 = Tera drive boot ROM mapped at 0 on 68K, 1 = cart mapped at 0
bit 2: Controls video switch - 0 = PC video, 1 = MD video
bit 3: Dual boot bit. When both this and bit 1 are set, bit 0 is ignored and both CPUs run independently.
bit 4: Unclear function. When set bits 4 & 5 become 10 in AE0003 and 1165 returns a fixed sequence (D5,7F,00,AA,55,FF,80,2A)
bit 5: Unknown
bit 6: Set on TMSS failure immediately before wedging 68K by reading from VDP while configured for writes
bit 7: Seems to start as 1, clearable on 68K but not on 286
1165: 0000RR0R
bit 0: Indicates PC/MD switch setting, 0 = MD boot, 1 = PC boot
bit 2: Indicates video switch setting, 0 = "Video", 1 = "RGB"
bit 3: 1 indicates bus timeout on 286 access to 68K bus, cleared on read
bit 5: indicates MD hardware has been "unlocked" ('SEGA' has been written to $A14000)
1166: XXXXXXX0
low bits of selected 8K page for access to 68K memory from 286
1167: 0000XXXX
high bits of selected 8K page for access to 68K memory form 286
when taken together with 1166, holds68K address >> 12
Also used along with 1166 for passing params from PC side to MD-side firmware
MD Side Bus Switch Registers
Note: The 68K can also access the PC-side registers via the AFXXXX region which gives access to PC IO space unless the Teradrive is in dual boot mode. This section only lists registers that are directly accessible by the 68K.
A14000
: TMSS unlock, write-only.
Seems to treat all writes as word-wide so byte-writes can't be used to unlock.
WritingSEGA
here unlocks PC access to MD hardware via the bus switch
AE0001
: XXXXRRXX
bit 0: Value written here is readable at 1163 bit 4
bit 1: Value written here is readable at 1163 bit 5
bit 2: Returns value written to 1163 bit 6
bit 3: Returns value written to 1163 bit 7
bit 4: Appears to be used by TMSS firmware to detect cold boot (0 = cold boot, 1 = warm reset)
bit 5: Appears to be used by TMSS firmware to keep track of whether there's a non-TERA286 cart (0 = cart present)
bit 6: Unclear. Set late during cold boot process if MD/PC switch is set to PC mode
bit 7: Maps PC side memory at $0 when set as long as 1164 bit 1 is clear
AE0003
: XXXXXXXX
Selects 1 MiB bank of 286 address space visible at $B00000
TMSS Firmware
The TMSS firmware is located at offset $43000 and is 4 KiB in size. To boot with this firmware, register 1164 bit 1 must be zero and page $21 must be selected in register 1162. Page $21 starts at offset $42000 in the ROM, but only the upper 4 KiB of a page is mapped into the 68K's address space.
The first time the firmware is run, it checks for the presence of a ROM in the cartridge or expansion slots by comparing both the $0-$3FFF and $400000-$403FFF regions to $FF to check for open bus. If any other values are found it checks for SEGA
at $200 or $201. If this check fails, it sets bit 6 of register 1164, clears all bits of AE0001 except bit 4 (cold boot detect) which it sets and purposely wedges the 68K by attempting to read from the VDP data port while writes are configured.
If the cart passes the SEGA
check, the firmware will check for two special values following the SEGA
text: TERA286
or TERA68K
. These checks are combined to produce a single cart type from 0-3 where 0 is no cartridge, 1 is a normal cartridge, 2 is a TERA68K cartridge and 3 is a TERA286 cartridge. After the cartridge check, the firmware checks for the PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.
string in the PC option ROM address range. If found, it records the address it was found at and adds $100 to the cart type.
If a cart was found and it's not a TERA286 cart, then bit 5 is set in AE0001. This bit will be checked on subsequent boots of the 68K and will prevent unlocking the MD hardware. This is presumably intended to prevent using a Teradrive as a cart dumper.
Next the Sega logo is displayed. If a cart is present or an option ROM with the "PRODUCED BY..." text, then the "PRODUCED BY..." text is shown below the logo. What happens after the logo displayed depends on the cart type detected earlier.
TERA68K carts are booted directly without returning control to the 286 first. This is done regardless of the MD/PC switch setting. The next highest priority is an option ROM. The 10 lowest bits of the "PRODUCED BY..." string end address are cleared. A pointer is then loaded from offset 4 from this truncated address and jumped to.
For the 3 other cases (none, normal and TERA286), the firmware simply locks the TMSS register and returns control to the 286. On subsequent 68K boots, it looks at the word passed via the 1166 and 1167 registers (MSB in 1167) to decide what to do. There area few special values that are treated as commands and the rest of the range is treated as a pointer for the unlock process. The special values are:
- FFE -> does the MD hardware init part of the cold boot process and returns to the 286
- FFC -> locks TMSS and returns to the 286
- FFA -> displays the SEGA logo, locks TMSS and returns to the 286
- FF8 -> locks the machine in the same way as a cart TMSS failure
(value >= $FE0 && value < $FF8) -> jump to work RAM address FF0100 |
A commented disassembly of this firmware is available here: https://github.com/mikepavone/teradrive_tmss_disassembly
Unlock Process
You can use the following snippet of x86 real mode assembly to unlock the MD hardware from the PC side
TD_BASE equ 0x1100 TD_FW_PAGE equ 0x60 TD_TMSS_FW_PAGE equ 0x21 TD_WINDOW_CTRL equ 0x63 TD_FW_TO_MD equ 1 TD_SWITCH equ 0x64 TD_SWITCH_TO_68K equ 1 TD_SWITCH_BASE equ 0x80 md_unlock: mov dx, TD_BASE|TD_M68K_PAGE ;0x1166 mov ax, cs shr ax, 8 ; you can also just clear ax here, but the unlock takes a little longer out dx, ax mov dl, TD_FW_PAGE mov al, TD_TMSS_FW_PAGE out dx, al mov dl, TD_WINDOW_CTRL mov al, TD_FW_TO_MD out dx, al inc dl mov al, TD_SWITCH_BASE|TD_SWITCH_TO_68K out dx, al mov ax, 0xFFFF ;unclear exactly why this busy loop is needed .waitlp: dec ax jnz .waitlp retn align 2 db "PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.", 0
Expansion Port Pinout
B1 = pin on the front side of the system closest to the drive bays. A1 = pin on the backside also closest to the drive bays
Note: this has not been thoroughly checked. Highly recommend you double-check any pin mappings before relying on this.
B1 VCC B2 SR2 B3 VA0 B4 VA11 B5 VA7 B6 VA12 B7 VA6 B8 VA13 B9 VA5 B10 VA14 B11 VA4 B12 VA15 B13 VA3 B14 VA16 B15 VA2 B16 VA17 B17 VA1 B18 GND B19 VD7 B20 VD0 B21 VD8 B22 VD6 B23 VD1 B24 VD9 B25 VD5 B26 VD2 B27 VD10 B28 VD4 B29 VD3 B30 VD11 B31 SL2 B32 VCC A1 GND A2 !MRES A3 VA9 A4 VA10 A5 VA18 A6 VA19 A7 VA20 A8 VA21 A9 VA22 A10 VA23 A11 !ROM A12 !RAS2 A13 !FDC A14 !FRES A15 !DISK A16 !FDWR A17 !CAS0 A18 !CE0 A19 !AS A20 VCLK A21 !DTACK A22 !CAS2 A23 VD15 A24 VD14 A25 VD13 A26 VD12 A27 !ASEL A28 !LWR A29 !UWR A30 !TIME A31 !CART A32 GND
IC List
U1: D42264V-10 (64Kx4 dual port VRAM)
U2: Sega 315-5313/Yamaha YM7101 (MD VDP)
U3: D42264V-10 (64Kx4 dual port VRAM)
U4: Toshiba TMP68HC000N-10 (10Mhz CMOS 68000)
U5: Sega 315-5309 (MD IO)
U6: D42264V-10 (64Kx4 dual port VRAM)
U7: 74HC4066 (Quad single-pole single-throw analog switch)
U8: D42264V-10 (64Kx4 dual port VRAM)
U9: 74HC4066 (Quad single-pole single-throw analog switch)
U10: IMSG179P (VGA palette RAM/DAC)
U11: Sega 315-5364 (MD bus arbiter)
U12: Sony CXA1145 (composite video encoder)
U13: 256Kx4 DRAM (VGA video RAM)
U14: 256Kx4 DRAM (VGA video RAM)
U15: 84C00AM-6 (Z80)
U16: Western Digital WD90C61-JE (VGA dual clock generator)
U17: 74HC4066 (Quad single-pole single-throw analog switch)
U18: IBM 79F2661 (labeled BUS SW)
U19: Western Digital WD90C10-LR (VGA chipset)
U20: 79F2662 (Display Switch, branded NEC but has an IBM part number)
U21: 74F245 (Octal bus transceiver)
U22: 74HC4066 (Quad single-pole single-throw analog switch)
U23: ALS257 (Quad 2-input multiplexer with tri-state outputs)
U24: M5M5165FP-10L (8KB SRAM for Z80)
U25: 74LS14 (Hex Schmitt-Trigger inverters)
U26: 74LS508 (Quad 2-input NAND gate)
U27: 74F245 (Octal Bidirectional transceiver with tri-state outputs)
U28: Sony CXA1145 (composite video encoder)
U29: ALS240 (Octal inverter buffer)
U30: ALS138 (3 to 8-line decoder/de-multiplexer)
U31: ALS151 (1 of 8 selector/multiplexer)
U32: M5M5165FP-10L (8KB SRAM for Z80)
U33: ALS32 (Quad 2-input OR gate)
U34: AMD N80L286-10/S (286 CPU)
U35: ALS00 (Quad 2-input NAND gate)
U36: ALS273 (Octal D-Type Edge-Triggered Flip-flop)
U37: ALS373 (Octal transparent latch)
U38: HN62414FPD80 (additional firmware)
U39: ALS244A (octal buffer and line driver with 3-state outputs)
U40: ALS157 (Quad 2-input data selector/multiplexer, non-inverting)
U41: Western Digital WD76C10LP-LR (system controller)
U42: Western Digital WD76C30-JU (peripheral controller, Serial & Parallel ports)
U43: ALS373 (Octal transparent latch)
U44: Yamaha YM3438 (MD FM chip)
U45: IBM 89X8922 (128Kx4 DRAM)
U46: 27C010 (BIOS)
U47: TL7705 (Single Supply Voltage Supervisor for 5V Systems with Programmable Time Delay)
U49: 74F125D (Quad buffer tri-state)
U50: ALS04B (Hex inverter)
U51: TL431 (Three-terminal adjustable shunt regulator)
U52: IBM 89X8922 (128Kx4 DRAM)
U53: ALS245A (Octal bus transceiver)
U54: ALS04 (Quad 2-input OR gate)
U55: Intel 8042 (keyboard controller)
U56: Sony CXA1034 (Headphone amp)
U57: 74LS06 (Hex inverter)
U58: ALS32 (Quad 2-input OR gate)
U59: IBM 89X8922 (128Kx4 DRAM)
U60: Western Digital WD76C20-JU (floppy controller)
U61: LM386 (audio amplifier)
U62: ALS245A (Octal bus transceiver)
U63: NEC D4714 (RS-232 Line Driver)
U64: ALS373 (Octal transparent latch)
U65: ALS244A (octal buffer and line driver with 3-state outputs)
U66: IBM 89X8922 (128Kx4 DRAM)
U67: ALS245A (Octal bus transceiver)
U68: ALS244A (octal buffer and line driver with 3-state outputs)
U69: ALS373 (Octal transparent latch)
U70: SP1?(maybe 8) (unpopulated)
U71: 32Kx8 PSRAM
U72: 32Kx8 PSRAM
U73: 74LS74 (Dual D-Type Positive-Edge triggered flip-flops)
U74: SP14 (unpopulated)
U75: SP16 (unpopulated)
U76: ALS32 (Quad 2-input OR gate)
U77: SP16 (unpopulated)
U78: SP20 (unpopulated)