Changes between Version 7 and Version 8 of TeradriveHardwareNotes

Timestamp:

08/05/2024 07:39:48 AM (9 months ago)

Author:

Mike Pavone

Comment:

--

TeradriveHardwareNotes

@@ -107 +107 @@
           bit 3: Returns value written to 1163 bit 7\\
           bit 4: Appears to be used by TMSS firmware to detect cold boot (0 = cold boot, 1 = warm reset)\\
-          bit 7: Maps PC side memory at $0 when set as long as AF1164 bit 1 is clear\\
+          bit 5: Appears to be used by TMSS firmware to keep track of whether there's a non-TERA286 cart (0 = cart present)\\
+          bit 6: Unclear. Set late during cold boot process if MD/PC switch is set to PC mode\\
+          bit 7: Maps PC side memory at $0 when set as long as 1164 bit 1 is clear\\
 
 `AE0003`: `XXXXXXXX`\\
           Selects 1 MiB bank of 286 address space visible at $B00000\\
-          
+
+== TMSS Firmware ==
+
+The TMSS firmware is located at offset $43000 and is 4 KiB in size. To boot with this firmware, register 1164 bit 1 must be zero and page $21 must be selected in register 1162. Page $21 starts at offset $42000 in the ROM, but only the upper 4 KiB of a page is mapped into the 68K's address space.
+
+The first time the firmware is run, it checks for the presence of a ROM in the cartridge or expansion slots by comparing both the $0-$3FFF and $400000-$403FFF regions to $FF to check for open bus. If any other values are found it checks for `SEGA` at $200 or $201. If this check fails, it sets bit 6 of register 1164, clears all bits of AE0001 except bit 4 (cold boot detect) which it sets and purposely wedges the 68K by attempting to read from the VDP data port while writes are configured.
+
+If the cart passes the `SEGA` check, the firmware will check for two special values following the `SEGA` text: ` TERA286` or ` TERA68K`. These checks are combined to produce a single cart type from 0-3 where 0 is no cartridge, 1 is a normal cartridge, 2 is a TERA68K cartridge and 3 is a TERA286 cartridge. After the cartridge check, the firmware checks for the `PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.` string in the PC option ROM address range. If found, it records the address it was found at and adds $100 to the cart type.
+
+If a cart was found and it's not a TERA286 cart, then bit 5 is set in AE0001. This bit will be checked on subsequent boots of the 68K and will prevent unlocking the MD hardware. This is presumably intended to prevent using a Teradrive as a cart dumper.
+
+Next the Sega logo is displayed. If a cart is present or an option ROM with the "PRODUCED BY..." text, then the "PRODUCED BY..." text is shown below the logo. What happens after the logo displayed depends on the cart type detected earlier.
+
+TERA68K carts are booted directly without returning control to the 286 first. This is done regardless of the MD/PC switch setting. The next highest priority is an option ROM. The 10 lowest bits of the "PRODUCED BY..." string end address are cleared. A pointer is then loaded from offset 4 from this truncated address and jumped to.
+
+For the 3 other cases (none, normal and TERA286), the firmware simply locks the TMSS register and returns control to the 286. On subsequent 68K boots, it looks at the word passed via the 1166 and 1167 registers (MSB in 1167) to decide what to do. There area few special values that are treated as commands and the rest of the range is treated as a pointer for the unlock process. The special values are:
+
+* FFE -> does the MD hardware init part of the cold boot process and returns to the 286
+* FFC -> locks TMSS and returns to the 286
+* FFA -> displays the SEGA logo, locks TMSS and returns to the 286
+* FF8 -> locks the machine in the same way as a cart TMSS failure
+* (value >= $A0 && value < $100) || (value >= $FE0 && value < $FF8) -> jump to work RAM address FF0100
+
 
 == IC List