Gameboy Development Forum

Discussion about software development for the old-school Gameboys, ranging from the "Gray brick" to Gameboy Color
(Launched in 2008)

You are not logged in.

Ads

#1 2017-07-12 01:58:12

endrift
New member
Registered: 2017-05-24
Posts: 7

TAMA5 (WIP)

Starting research on TAMA5 as I did for MBC7. Will post preliminary findings in here as I get them:

- Uninitialized, Axxx/Bxxx reads out a repeating pattern of F0h FFh (and it varies which value is first depending on how many bytes you read in a row, but that might be my tool being broken)
- Starts off by writing 0Ah to A001h and reading out A000h. It waits until [A000] & 3 == 1. It does not perform any writes to the ROM region beforehand (i.e. the usual writing 0Ah to ROM bank 0 to enable RAM is absent).
- Writing 0Ah to A001h causes the F0h FFh pattern to become F1h FFh

What happens next appears to be a handshake writing values to to A000h and A001h based on values that are in memory. Haven't figured out what this means yet. Will investigate more later. Got sidetracked and now it's late, so I wanna save this somewhere before it gets lost.

UPDATE:

- A000h: Register nybble
- A001h: Register number

TAMA5 has a series of registers that can be accessed one nybble a time. First you must unlock the MBC by writing 0Ah to A001h. Wait until A000h replies with F1h (the high four bits are hi-z), then select the register with A001h.

Registers (undivided):
- 00: ROM bank low (RA14-17)
- 01: ROM bank high (RA18)
- 04: Data in low
- 05: Data in high
- 06: Register select
    - 01: RAM address high bit?
    - 02: RAM read
    - 04: Alarm?
    - 08: RTC registers
- 07: Register select/address low?
- 0A?: Constant 1?
- 0C: Data out low
- 0D: Data out high

- ROM banks are as they say
- Data in is written by CPU/read by TAMA5 before issuing commands.
- Data out is written by TAMA5/read by CPU after issuing commands.
- RAM is 32 bytes
    - Written by writing 04:0L, 05:0H, 06:0Y, 07:0X -- HLh is the byte to be written, Y is 02h OR high bit of address. X is low 4 bits of address. Write takes place at the end.
    - Read by writing 06:0Y, 07:0X then reading 0C:FL, 0D:FH -- HLh is the byte being read, Y is 00h or high bit of address, X is low 4 bits of address. Inverse of previous command with 02h clear.
- RTC is selected with 06:04 or 06:08?
    - Data in bit 0 is used as a clock sometimes

Some stuff seems to write to a region around 0221h - 0320h but I don't know what.

E] Here's a log of register reads/writes with associated registers (excluding 00/01): https://hastebin.com/akowikunaz.http

Last edited by endrift (2017-07-24 18:13:40)

Offline

 

#2 2017-07-13 12:31:39

Tauwasser
Member
Registered: 2010-10-23
Posts: 77

Re: TAMA5 (WIP)

The TAMA cartridge has four main components:

- the RTC IC: TC8521AM
- a 4-bit microcontroller with mask ROM: TMP47C243M (TAMA6)
- the interface IC to the Game Edge Connector logic, TAMA5
- the game mask ROM: TAMA7

The MCU handles the RTC logic, buzzer and SRAM access. The TAMA5 handles upper ROM address bits and ROM #CS, resetting the MCU, and acts as a shift register to translate MCU logic to/from GEC logic.

A schematic of the cartridge can be found here. I just noticed that I got the polarity of ESCLK wrong on TAMA5.

cYa,

Tauwasser

Offline

 

#3 2017-07-24 13:43:56

endrift
New member
Registered: 2017-05-24
Posts: 7

Re: TAMA5 (WIP)

http://i.imgur.com/sTW9f1d.png

It boots!

Offline

 

#4 2018-02-10 19:47:42

skaman
New member
Registered: 2017-10-18
Posts: 5

Re: TAMA5 (WIP)

Got the TAMA5 save read and write working on my cart reader.

One thing I should mention is that to read the RAM, you use 0x20-0x3F but when you write the RAM, you use 0x00-0x1F. 

When writing to Register 6, Bit 0 controls the upper address and Bit 1 sets to read RAM.

For example,
Reading the first byte is:
Write 0xA001, 0xA
Read 0xA000 should return 0xA1 (mask with 0x3 looking for 0x1)
Write 0xA001, 0x6
Write 0xA000, 0x2 (address high nibble)
Write 0xA001, 0x7
Write 0xA000, 0x0 (address low nibble)
Check TAMA5 Status
Write 0xA001, 0xD
Read 0xA000 for data upper nibble
Write 0xA001, 0xC
Read 0xA000 for data lower nibble
Check TAMA5 Status

To write the first byte:
Write 0xA001, 0xA
Read 0xA000 should return 0xA1 (mask with 0x3 looking for 0x1)
Write 0xA001, 0x4
Write 0xA000, (data low nibble)
Write 0xA001, 0x5
Write 0xA000, (data high nibble)
Write 0xA001, 0x6
Write 0xA000, 0x0 (address high nibble)
Write 0xA001, 0x7
Write 0xA000, 0x0 (address low nibble)
Check TAMA5 Status

I really hate Tamagotchi but it works.

Nice to finally finish support for all of the mappers!

Last edited by skaman (2018-02-11 01:22:17)

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2005 Rickard Andersson