== Hardware Overview The Sega Teradrive consists of a 286 IBM PC integrated with a Sega Megadrive. The PC side is fairly standard and is built around a Western Digital chipset found in a number of other 286 and 386 systems, including the IBM PS/55 5510Z which has some additional similarities to the Teradrive. The main components of the PC chipset are the [wiki:WD76C10LP] system controller (DRAM controller, memory map, etc.), the [wiki:WD76C30] peripheral controller (serial and parallel ports), the [wiki:WD76C20] floppy controller (also provides the RTC and NVRAM) and [wiki:WD90C10] VGA. While the chipset supports more, the motherboard can only handle 2.5 MiB of RAM without modification. The Mega Drive side is most similar to a MD1 VA3 or VA4, but has some important differences. The Z80 has 16 KiB of RAM instead of the normal 8 KiB and the VDP has 128 kiB instead of the normal 64 kiB. It has a discrete YM3438 instead of a YM2612 as found in other pre-VA7 MD1 systems. It has the same "fix" for incorrect status port reads as found in MD systems with an integrated YM3438, but implemented as discrete logic. For the 68K it has a 10MHz rated 68HC000 which runs at either the standard speed or 10MHz depending on the mode. Joining the two is the IBM [wiki:79F2661] "bus switch". In addition to providing a bridge between the MD-side 68K bus and the ISA bus on the PC side, this chip also manages access to an extra 512 KiB ROM. This ROM contains a Kanji font, a ROM disk image for the boot menu and some firmware for the MD-side that implements a Teradrive specific variant of TMSS. This chip is also found in the PS/55 5510Z where it presumably is also used for Kanji ROM management. == 286 Memory Map This uses physical addresses rather than the more traditional segment:offset format since the latter has multiple representations for the same physical address and can't represent addresses above 1 MiB. Since the chipset is fairly flexible, a lot of this map can be changed, but this is the config set by the BIOS. `000000 - 09FFFF`: conventional memory\\ `0A0000 - 0BFFFF`: VGA memory (only part of this may be used depending on VGA register settings)\\ `0CE000 - 0CFFFF`: bus switch memory window into extra firmware ROM or 68K address space (note address is configurable in settings menu)\\ `0E0000 - 0FFFFF`: combined VGA BIOS and main BIOS (in shadow memory)\\ `100000 - XXXXXX`: additional RAM\\ == 68K Memory Map `000000 - 3FFFFF`: cartridge or expansion port or PC memory or firmware\\ `400000 - 7FFFFF`: expansion port or cartridge or PC memory or firmware\\ `800000 - 9FFFFF`: unmapped (32X)\\ `A00000 - A07EFF`: Z80 address space\\ `A07F00 - A07FFF`: freeze (Z80 VDP port window)\\ `A08000 - A0FFFF`: mirror of A00000\\ `A10000 - A100FF`: IO registers\\ `A11000 - A110FF`: memory mode register\\ `A11100 - A111FF`: Z80 BUSREQ/BUSACK\\ `A11200 - A112FF`: Z80 RESET\\ `A11300 - A113FF`: open bus\\ `A11400 - A11FFF`: unmapped (!DTACK not asserted, will freeze without additional hardware)\\ `A12000 - A120FF`: !FDC (Sega CD)\\ `A12100 - A12FFF`: unmapped (!DTACK not asserted, will freeze without additional hardware)\\ `A13000 - A130FF`: !TIME (cart mapper registers, also `MARS` at A130EC when a 32X is attached)\\ `A13100 - A13FFF`: unmapped (!DTACK not asserted, will freeze without additional hardware)\\ `A14000 - A14003`: TMSS lock, write only (note this functions differently from the standard TMSS lock register)\\ `A14004 - A150FF`: unmapped (!DTACK not asserted, will freeze without additional hardware)\\ `A15100 - A153FF`: normally unmapped (no !DTACK), 32X registers if 32X present\\ `A15400 - ADFFFF`: unmapped (!DTACK not asserted, will freeze without additional hardware)\\ `AE0000 - AE0003`: MD-side Teradrive bus switch registers\\ `AE0004 - AEFFFF`: unmapped (!DTACK not asserted, will freeze without additional hardware)\\ `AF0000 - AFFFFF`: PC IO space (including PC-side bus switch registers)\\ `B00000 - BFFFFF`: 1 MiB window into PC address space\\ `C00000 - DFFFFF`: VDP/PSG registers (with holes)\\ `E00000 - FFFFFF`: Work RAM\\ == PC Side Bus Switch Registers Key: X = writable by both CPUS, M = writable by M68K only, R = read-only, 1 = read-only, always 1, 0 = read only, always 0 1160: `XXXXXXXX` Selects an 8 KiB page from kanji/romdisk/MD ROM (note only the upper 4 KiB of the page is visible on the MD side when MD firmware is enabled)\\ Set to 21h when unlocking MD side and in BIOS boot\\ Set to 0 by BIOS after initial 68K boot\\ 1161: `11111111`\\ 1162: `110XXXX0` Controls address of memory window in 286 address space\\ Effectively top byte of real mode segment address or physical address >> 12\\ Normally initialized from a value stored in CMOS\\ Set to CE if value in CMOS is invalid\\ Window is 8KiB in size and is used for both PC-side access to MD hardware and the Kanji/romdisk ROM\\ 1163: `XXRRXXXX` bit 0: Enables auxiliary ROM (must also be set for 286 window into 68K address space to function)\\ bit 1: Enable 286 memory window into 68K address space (also disables access to firmware by 68K)\\ bit 2: unknown\\ bit 3: unknown\\ bit 4: Returns value written by 68K to AE0001 bit 0\\ bit 5: Returns value written by 68K to AE0001 bit 1\\ bit 6: Value written here is readable by 68K at AE0001 bit 2\\ bit 7: Value written here is readable by 68K at AE0001 bit 3\\ Set to 1 by BIOS and during MD unlock procedure\\ 1164: `MXXXXXXX` bit 0: Setting bit from 286 side pauses the 286 and releases 68K from reset\\ Clearing bit from 68K side puts 68K into reset and releases 286\\ Making certain other reg changes seems to make clearing this bit have no effect\\ bit 1: 0 = Teradrive hardware at 0 (if also enabled elsewhere), 1 = cart mapped at 0\\ bit 2: Controls video switch - 0 = PC video, 1 = MD video\\ bit 3: Dual boot bit. When both this and bit 1 are set, bit 0 is ignored and both CPUs run independently.\\ bit 4: Unclear function. When set bits 4 & 5 become 10 in AE0003 and 1165 returns a stream of bytes.\\ Unclear circumstances will cause this to shift to a fixed sequence (D5,7F,00,AA,55,FF,80,2A) that\\ only updates on writes to the PC IO region (AFXXXX)\\ Setting this bit in "dual boot" mode tends to lead to 68K lockups\\ bit 5: Unknown\\ bit 6: Set on TMSS failure immediately before wedging 68K by reading from VDP while configured for writes\\ bit 7: Seems to start as 1, clearable on 68K but not on 286\\ Dual boot mode makes all Teradrive hardware except AE000X and A14000 inaccessible (no !DTACK) Switching between 68K exclusive and dual boot mode does NOT reset the 68K like switches to 286 exclusive mode 1165: `0000RR0R` bit 0: Indicates PC/MD switch setting, 0 = MD boot, 1 = PC boot\\ bit 2: Indicates video switch setting, 0 = "Video", 1 = "RGB"\\ bit 3: 1 indicates bus timeout on 286 access to 68K bus, cleared on read\\ bit 5: indicates MD hardware has been "unlocked" ('SEGA' has been written to $A14000)\\ 1166: `XXXXXXX0` low bits of selected 8K page for access to 68K memory from 286\\ 1167: `0000XXXX` high bits of selected 8K page for access to 68K memory from 286\\ when taken together with 1166, holds `68K address >> 12`\\ Also used along with 1166 for passing params from PC side to MD-side firmware\\ == MD Side Bus Switch Registers == Note: The 68K can also access the PC-side registers via the AFXXXX region which gives access to PC IO space unless the Teradrive is in dual boot mode. This section only lists registers that are directly accessible by the 68K. `A14000`: TMSS unlock, write-only.\\ Seems to treat all writes as word-wide so byte-writes can't be used to unlock.\\ Writing `SEGA` here unlocks PC access to MD hardware via the bus switch\\ `AE0001`: `XXXXRRXX`\\ bit 0: Value written here is readable at 1163 bit 4\\ bit 1: Value written here is readable at 1163 bit 5\\ bit 2: Returns value written to 1163 bit 6\\ bit 3: Returns value written to 1163 bit 7\\ bit 4: Appears to be used by TMSS firmware to detect cold boot (0 = cold boot, 1 = warm reset)\\ bit 5: Appears to be used by TMSS firmware to keep track of whether there's a non-TERA286 cart (0 = cart present)\\ bit 6: Unclear. Set late during cold boot process if MD/PC switch is set to PC mode\\ bit 7: Maps PC side memory at $0 when set as long as 1164 bit 1 is clear\\ `AE0003`: `XXXXXXXX`\\ Selects 1 MiB bank of 286 address space visible at $B00000\\ == TMSS Firmware == The TMSS firmware is located at offset $43000 and is 4 KiB in size. To boot with this firmware, register 1164 bit 1 must be zero and page $21 must be selected in register 1162. Page $21 starts at offset $42000 in the ROM, but only the upper 4 KiB of a page is mapped into the 68K's address space. The first time the firmware is run, it checks for the presence of a ROM in the cartridge or expansion slots by comparing both the $0-$3FFF and $400000-$403FFF regions to $FF to check for open bus. If any other values are found it checks for `SEGA` at $200 or $201. If this check fails, it sets bit 6 of register 1164, clears all bits of AE0001 except bit 4 (cold boot detect) which it sets and purposely wedges the 68K by attempting to read from the VDP data port while writes are configured. If the cart passes the `SEGA` check, the firmware will check for two special values following the `SEGA` text: ` TERA286` or ` TERA68K`. These checks are combined to produce a single cart type from 0-3 where 0 is no cartridge, 1 is a normal cartridge, 2 is a TERA68K cartridge and 3 is a TERA286 cartridge. After the cartridge check, the firmware checks for the `PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.` string in the PC option ROM address range. If found, it records the address it was found at and adds $100 to the cart type. If a cart was found and it's not a TERA286 cart, then bit 5 is set in AE0001. This bit will be checked on subsequent boots of the 68K and will prevent unlocking the MD hardware. This is presumably intended to prevent using a Teradrive as a cart dumper. Next the Sega logo is displayed. If a cart is present or an option ROM with the "PRODUCED BY..." text, then the "PRODUCED BY..." text is shown below the logo. What happens after the logo displayed depends on the cart type detected earlier. TERA68K carts are booted directly without returning control to the 286 first. This is done regardless of the MD/PC switch setting. The next highest priority is an option ROM. The 10 lowest bits of the "PRODUCED BY..." string end address are cleared. A pointer is then loaded from offset 4 from this truncated address and jumped to. For the 3 other cases (none, normal and TERA286), the firmware simply locks the TMSS register and returns control to the 286. On subsequent 68K boots, it looks at the word passed via the 1166 and 1167 registers (MSB in 1167) to decide what to do. There area few special values that are treated as commands and the rest of the range is treated as a pointer for the unlock process. The special values are: * FFE -> does the MD hardware init part of the cold boot process and returns to the 286 * FFC -> locks TMSS and returns to the 286 * FFA -> displays the SEGA logo, locks TMSS and returns to the 286 * FF8 -> locks the machine in the same way as a cart TMSS failure * (value >= $A0 && value < $100) || (value >= $FE0 && value < $FF8) -> jump to work RAM address FF0100 A commented disassembly of this firmware is available here: https://github.com/mikepavone/teradrive_tmss_disassembly == Unlock Process You can use the following snippet of x86 real mode assembly to unlock the MD hardware from the PC side {{{ TD_BASE equ 0x1100 TD_FW_PAGE equ 0x60 TD_TMSS_FW_PAGE equ 0x21 TD_WINDOW_CTRL equ 0x63 TD_FW_TO_MD equ 1 TD_SWITCH equ 0x64 TD_SWITCH_TO_68K equ 1 TD_SWITCH_BASE equ 0x80 md_unlock: mov dx, TD_BASE|TD_M68K_PAGE ;0x1166 mov ax, cs shr ax, 8 ; you can also just clear ax here, but the unlock takes a little longer out dx, ax mov dl, TD_FW_PAGE mov al, TD_TMSS_FW_PAGE out dx, al mov dl, TD_WINDOW_CTRL mov al, TD_FW_TO_MD out dx, al inc dl mov al, TD_SWITCH_BASE|TD_SWITCH_TO_68K out dx, al mov ax, 0xFFFF ;unclear exactly why this busy loop is needed .waitlp: dec ax jnz .waitlp retn align 2 db "PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.", 0 }}} == Expansion Port Pinout B1 = pin on the front side of the system closest to the drive bays. A1 = pin on the backside also closest to the drive bays This was first [http://piroxilin.narod.ru/sega/teradrive-slots_2.xls documented by piroxolin], but has been independently confirmed. {{{ B1 VCC B2 SR2 B3 VA8 B4 VA11 B5 VA7 B6 VA12 B7 VA6 B8 VA13 B9 VA5 B10 VA14 B11 VA4 B12 VA15 B13 VA3 B14 VA16 B15 VA2 B16 VA17 B17 VA1 B18 GND B19 VD7 B20 VD0 B21 VD8 B22 VD6 B23 VD1 B24 VD9 B25 VD5 B26 VD2 B27 VD10 B28 VD4 B29 VD3 B30 VD11 B31 SL2 B32 VCC A1 GND A2 !MRES A3 VA9 A4 VA10 A5 VA18 A6 VA19 A7 VA20 A8 VA21 A9 VA22 A10 VA23 A11 !ROM A12 !RAS2 A13 !FDC A14 !FRES A15 !DISK A16 !FDWR A17 !CAS0 A18 !CE0 A19 !AS A20 VCLK A21 !DTACK A22 !CAS2 A23 VD15 A24 VD14 A25 VD13 A26 VD12 A27 !ASEL A28 !LWR A29 !UWR A30 !TIME A31 !CART A32 GND }}} == IC List U1: D42264V-10 (64Kx4 dual port VRAM)\\ U2: Sega 315-5313/Yamaha YM7101 (MD VDP)\\ U3: D42264V-10 (64Kx4 dual port VRAM)\\ U4: Toshiba TMP68HC000N-10 (10Mhz CMOS 68000)\\ U5: Sega 315-5309 (MD IO)\\ U6: D42264V-10 (64Kx4 dual port VRAM)\\ U7: 74HC4066 (Quad single-pole single-throw analog switch)\\ U8: D42264V-10 (64Kx4 dual port VRAM)\\ U9: 74HC4066 (Quad single-pole single-throw analog switch)\\ U10: IMSG179P (VGA palette RAM/DAC)\\ U11: Sega 315-5364 (MD bus arbiter)\\ U12: Sony CXA1145 (composite video encoder)\\ U13: 256Kx4 DRAM (VGA video RAM)\\ U14: 256Kx4 DRAM (VGA video RAM)\\ U15: 84C00AM-6 (Z80)\\ U16: Western Digital WD90C61-JE (VGA dual clock generator)\\ U17: 74HC4066 (Quad single-pole single-throw analog switch)\\ U18: IBM 79F2661 (labeled BUS SW)\\ U19: Western Digital WD90C10-LR (VGA chipset)\\ U20: 79F2662 (Display Switch, branded NEC but has an IBM part number)\\ U21: 74F245 (Octal bus transceiver)\\ U22: 74HC4066 (Quad single-pole single-throw analog switch)\\ U23: ALS257 (Quad 2-input multiplexer with tri-state outputs)\\ U24: M5M5165FP-10L (8KB SRAM for Z80)\\ U25: 74LS14 (Hex Schmitt-Trigger inverters)\\ U26: 74LS508 (Quad 2-input NAND gate)\\ U27: 74F245 (Octal Bidirectional transceiver with tri-state outputs)\\ U28: Sony CXA1145 (composite video encoder)\\ U29: ALS240 (Octal inverter buffer)\\ U30: ALS138 (3 to 8-line decoder/de-multiplexer)\\ U31: ALS151 (1 of 8 selector/multiplexer)\\ U32: M5M5165FP-10L (8KB SRAM for Z80)\\ U33: ALS32 (Quad 2-input OR gate)\\ U34: AMD N80L286-10/S (286 CPU)\\ U35: ALS00 (Quad 2-input NAND gate)\\ U36: ALS273 (Octal D-Type Edge-Triggered Flip-flop)\\ U37: ALS373 (Octal transparent latch)\\ U38: HN62414FPD80 (additional firmware)\\ U39: ALS244A (octal buffer and line driver with 3-state outputs)\\ U40: ALS157 (Quad 2-input data selector/multiplexer, non-inverting)\\ U41: Western Digital WD76C10LP-LR (system controller)\\ U42: Western Digital WD76C30-JU (peripheral controller, Serial & Parallel ports)\\ U43: ALS373 (Octal transparent latch)\\ U44: Yamaha YM3438 (MD FM chip)\\ U45: IBM 89X8922 (128Kx4 DRAM)\\ U46: 27C010 (BIOS)\\ U47: TL7705 (Single Supply Voltage Supervisor for 5V Systems with Programmable Time Delay)\\ U49: 74F125D (Quad buffer tri-state)\\ U50: ALS04B (Hex inverter)\\ U51: TL431 (Three-terminal adjustable shunt regulator)\\ U52: IBM 89X8922 (128Kx4 DRAM)\\ U53: ALS245A (Octal bus transceiver)\\ U54: ALS04 (Quad 2-input OR gate)\\ U55: Intel 8042 (keyboard controller)\\ U56: Sony CXA1034 (Headphone amp)\\ U57: 74LS06 (Hex inverter)\\ U58: ALS32 (Quad 2-input OR gate)\\ U59: IBM 89X8922 (128Kx4 DRAM)\\ U60: Western Digital WD76C20-JU (floppy controller)\\ U61: LM386 (audio amplifier)\\ U62: ALS245A (Octal bus transceiver)\\ U63: NEC D4714 (RS-232 Line Driver)\\ U64: ALS373 (Octal transparent latch)\\ U65: ALS244A (octal buffer and line driver with 3-state outputs)\\ U66: IBM 89X8922 (128Kx4 DRAM)\\ U67: ALS245A (Octal bus transceiver)\\ U68: ALS244A (octal buffer and line driver with 3-state outputs)\\ U69: ALS373 (Octal transparent latch)\\ U70: SP1?(maybe 8) (unpopulated)\\ U71: 32Kx8 PSRAM\\ U72: 32Kx8 PSRAM\\ U73: 74LS74 (Dual D-Type Positive-Edge triggered flip-flops)\\ U74: SP14 (unpopulated)\\ U75: SP16 (unpopulated)\\ U76: ALS32 (Quad 2-input OR gate)\\ U77: SP16 (unpopulated)\\ U78: SP20 (unpopulated)\\