Gameboy Development Forum

Discussion about software development for the old-school Gameboys, ranging from the "Gray brick" to Gameboy Color
(Launched in 2008)

You are not logged in.

Ads

#1 2017-07-12 01:58:12

endrift
New member
Registered: 2017-05-24
Posts: 6

TAMA5 (WIP)

Starting research on TAMA5 as I did for MBC7. Will post preliminary findings in here as I get them:

- Uninitialized, Axxx/Bxxx reads out a repeating pattern of F0h FFh (and it varies which value is first depending on how many bytes you read in a row, but that might be my tool being broken)
- Starts off by writing 0Ah to A001h and reading out A000h. It waits until [A000] & 3 == 1. It does not perform any writes to the ROM region beforehand (i.e. the usual writing 0Ah to ROM bank 0 to enable RAM is absent).
- Writing 0Ah to A001h causes the F0h FFh pattern to become F1h FFh

What happens next appears to be a handshake writing values to to A000h and A001h based on values that are in memory. Haven't figured out what this means yet. Will investigate more later. Got sidetracked and now it's late, so I wanna save this somewhere before it gets lost.

UPDATE:

- A000h: Register nybble
- A001h: Register number

TAMA5 has a series of registers that can be accessed one nybble a time. First you must unlock the MBC by writing 0Ah to A001h. Wait until A000h replies with F1h (the high four bits are hi-z), then select the register with A001h.

Registers (undivided):
- 00: ROM bank low (RA14-17)
- 01: ROM bank high (RA18)
- 04: Data in low
- 05: Data in high
- 06: Register select
    - 01: RAM address high bit?
    - 02: RAM read
    - 04: Alarm?
    - 08: RTC registers
- 07: Register select/address low?
- 0A?: Constant 1?
- 0C: Data out low
- 0D: Data out high

- ROM banks are as they say
- Data in is written by CPU/read by TAMA5 before issuing commands.
- Data out is written by TAMA5/read by CPU after issuing commands.
- RAM is 32 bytes
    - Written by writing 04:0L, 05:0H, 06:0Y, 07:0X -- HLh is the byte to be written, Y is 02h OR high bit of address. X is low 4 bits of address. Write takes place at the end.
    - Read by writing 06:0Y, 07:0X then reading 0C:FL, 0D:FH -- HLh is the byte being read, Y is 00h or high bit of address, X is low 4 bits of address. Inverse of previous command with 02h clear.
- RTC is selected with 06:04 or 06:08?
    - Data in bit 0 is used as a clock sometimes

Some stuff seems to write to a region around 0221h - 0320h but I don't know what.

E] Here's a log of register reads/writes with associated registers (excluding 00/01): https://hastebin.com/akowikunaz.http

Last edited by endrift (2017-07-24 18:13:40)

Offline

 

#2 2017-07-13 12:31:39

Tauwasser
Member
Registered: 2010-10-23
Posts: 70

Re: TAMA5 (WIP)

The TAMA cartridge has four main components:

- the RTC IC: TC8521AM
- a 4-bit microcontroller with mask ROM: TMP47C243M (TAMA6)
- the interface IC to the Game Edge Connector logic, TAMA5
- the game mask ROM: TAMA7

The MCU handles the RTC logic, buzzer and SRAM access. The TAMA5 handles upper ROM address bits and ROM #CS, resetting the MCU, and acts as a shift register to translate MCU logic to/from GEC logic.

A schematic of the cartridge can be found here. I just noticed that I got the polarity of ESCLK wrong on TAMA5.

cYa,

Tauwasser

Offline

 

#3 2017-07-24 13:43:56

endrift
New member
Registered: 2017-05-24
Posts: 6

Re: TAMA5 (WIP)

http://i.imgur.com/sTW9f1d.png

It boots!

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2005 Rickard Andersson