Changes between Version 9 and Version 10 of TeradriveHardwareNotes

Timestamp:

08/07/2024 07:11:19 AM (9 months ago)

Author:

Mike Pavone

Comment:

--

TeradriveHardwareNotes

@@ -47 +47 @@
 == PC Side Bus Switch Registers
 
-Key: X = writeable by both CPUS, M = writeable by M68K only, R = read-only, 1 = read-only, always 1, 0 = read only, always 0
+Key: X = writable by both CPUS, M = writable by M68K only, R = read-only, 1 = read-only, always 1, 0 = read only, always 0
 
 1160: `XXXXXXXX`
@@ -57 +57 @@
       Controls address of memory window in 286 address space\\
       Effectively top byte of real mode segment address or physical address >> 12\\
-      Normally initialzied from a value stored in CMOS\\
+      Normally initialized from a value stored in CMOS\\
       Set to CE if value in CMOS is invalid\\
       Window is 8KiB in size and is used for both PC-side access to MD hardware and the Kanji/romdisk ROM\\
 1163: `XXRRXXXX`
-      bit 0: Enables auxilliary ROM on 68K side\\
-      bit 1: Enable 286 memory window into 68K addres space (must be clear when booting 68K)\\
+      bit 0: Enables auxiliary ROM on 68K side\\
+      bit 1: Enable 286 memory window into 68K address space (must be clear when booting 68K)\\
       bit 2: unknown\\
       bit 3: unknown\\
@@ -89 +89 @@
       low bits of selected 8K page for access to 68K memory from 286\\
 1167: `0000XXXX`
-      high bits of selected 8K page for acces to 68K memory form 286\\
+      high bits of selected 8K page for access to 68K memory form 286\\
       when taken together with 1166, holds `68K address >> 12`\\
       Also used along with 1166 for passing params from PC side to MD-side firmware\\
@@ -137 +137 @@
 
 A commented disassembly of this firmware is available here: https://github.com/mikepavone/teradrive_tmss_disassembly
+
+== Unlock Process
+
+You can use the following snippet of x86 real mode assembly to unlock the MD hardware from the PC side
+
+{{{
+TD_BASE equ 0x1100
+TD_FW_PAGE equ 0x60
+TD_TMSS_FW_PAGE equ 0x21
+TD_WINDOW_CTRL equ 0x63
+TD_FW_TO_MD equ 1
+TD_SWITCH equ 0x64
+TD_SWITCH_TO_68K equ 1
+TD_SWITCH_BASE equ 0x80
+
+md_unlock:
+        mov dx, TD_BASE|TD_M68K_PAGE ;0x1166
+        mov ax, cs
+        shr ax, 8 ; you can also just clear ax here, but the unlock takes a little longer
+        out dx, ax
+        
+        mov dl, TD_FW_PAGE
+        mov al, TD_TMSS_FW_PAGE
+        out dx, al
+        
+        mov dl, TD_WINDOW_CTRL
+        mov al, TD_FW_TO_MD
+        out dx, al
+        
+        inc dl
+        mov al, TD_SWITCH_BASE|TD_SWITCH_TO_68K
+        out dx, al
+        
+        mov ax, 0xFFFF ;unclear exactly why this busy loop is needed
+.waitlp:
+        dec ax
+        jnz .waitlp
+        retn
+        
+        
+        align 2
+        db "PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.", 0
+}}}
 
 == Expansion Port Pinout
@@ -244 +287 @@
 U29: ALS240 (Octal inverter buffer)\\
 U30: ALS138 (3 to 8-line decoder/de-multiplexer)\\
-U31: ALS151 (1 of 8 selector/multilplexer)\\
+U31: ALS151 (1 of 8 selector/multiplexer)\\
 U32: M5M5165FP-10L (8KB SRAM for Z80)\\
 U33: ALS32 (Quad 2-input OR gate)\\