Gameboy Development Forum

Discussion about software development for the old-school Gameboys, ranging from the "Gray brick" to Gameboy Color
(Launched in 2008)

You are not logged in.

Ads

#1 2017-07-12 01:58:12

endrift
Member
Registered: 2017-05-24
Posts: 16

TAMA5 (WIP)

- $A000: Register nybble
- $A001: Register number

TAMA5 has a series of registers that can be accessed one nybble a time. First you must unlock the MBC by writing $0A to $A001. Wait until $A000 replies with $F1 (the high four bits are hi-z), then select the register with $A001.
Before initialization, $Axxx/$Bxxx read out a repeating pattern of $F0 $FF (and it varies which value is first depending on how many bytes you read in a row, but that might be my tool being broken)

Registers (undivided):
- $0: ROM bank low (RA14-17)
- $1: ROM bank high (RA18)
- $4: Data in low
- $5: Data in high
- $6: Address/command high
- $7: Address/command low
- $A?: Constant 1?
- $C: Data out low
- $D: Data out high

- ROM banks are as they say
- Data in is written by CPU/read by TAMA5 before issuing commands.
- Data out is written by TAMA5/read by CPU after issuing commands.
- RAM is 32 bytes
    - Written by writing $4:L, $5:H, $6:Y, $7:X -- HL is the byte to be written, Y is $2 OR the high bit of address. X is low 4 bits of address. Write takes place at the end.
    - Read by writing $6:Y, $7:X then reading $C:L, $D:H — HL is the byte being read, Y is the high bit of address, X is low 4 bits of address. Inverse of previous command with $2 clear.
- RTC is selected with $6:8
    - RTC register number is selected with the value of the $4 register
    - RTC operation is selected with the $7 register
        - Bit 0: Clear for write, set for read
        - Bits 1-2: Page to access (0 = Timer, 1 = Alarm, 2/3 = Free pages)
    - RTC register value (when writing) is passed in the $5 register
    - RTC registers only have a certain number of bits wired up, so writing to bits that aren't used during normal function won't do anything and will read out as zero.
- TAMA6 is selected with $6:4 (or $6:5 if the number below is greater than 0xF)
    - Values are passed to the commands as a two digit BCD value stored with the 10s digit in the $5 register and the 1s digit in the $4 register
    - TAMA6 seems to cache the minutes and hours, so if you bypass it and set the hours or minutes directly, the TAMA6 will not update the value when using commands $46/$47 (see below) until it thinks they might have rolled over.

Address/command ranges:
- $00–$1F: RAM write
- $20–$3F: RAM read
- $40–$6F?: TAMA6 commands
- $70-$7F: Open bus? Just echoes the address back at you
- $80–$BF: RTC registers
- $C0-$FF: Untested

The TAMA6 commands (OR'd with $40):
- $40: Disable "TIMER ENABLE" in PAGE register
- $41: Enable "TIMER ENABLE" in PAGE register and resets seconds to 00
- $43: Observed, but unknown behavior currently
- $44: Atomically set minutes
- $45: Atomically set hours
- $46: Atomically get minutes
- $47: Atomically get hours
- $50: Disable "ALARM ENABLE" in PAGE register
- $51: Enable "ALARM ENABLE" in PAGE register

The RTC is a TC8521AM part with 4 pages of registers, each page has 13 of its own 4-bit registers and 3 registers are shared between all pages, at the end.
- Unmapped bits always read out as zero.
- In 24-hour mode, the hour 10s digit goes from 0-2, but in 12 hour mode, the high bit signals PM, so 11 PM/23 10s digit would be 0b10 in 24 hour mode, but 0b11 in 12 hour mode, as it's 1X:XX PM.
- Page 0 is the TIMER page
    - 0: 1-sec digit (4-bit. 0-9)
    - 1: 10-sec digit (3-bit, 0-6)
    - 2: 1-min digit (4-bit, 0-9)
    - 3: 10-min digit (3-bit, 0-6)
    - 4: 1-hour digit (4-bit, 0-9)
    - 5: 10-hour digit (2-bit, see also 12/24 hour modes)
    - 6: Day of week digit (3-bit, 0-6)
    - 7: 1-day digit (4-bit 0-9)
    - 8: 10-day digit (2-bit, 0-3)
    - 9: 1-month digit (4-bit, 0-9)
    - A: 10-month digit (1-bit, 0-1)
    - B: 1-year digit (4-bit, 0-9)
    - C: 10-year digit (4-bit, 0-9)
- Page 1 is the ALARM page
    - 0: 0-bit
    - 1: 0-bit
    - 2: 1-min digit (4-bit, 0-9)
    - 3: 10-min digit (3-bit, 0-6)
    - 4: 1-hour digit (4-bit, 0-9)
    - 5: 10-hour digit (2-bit, see also 12/24 hour modes)
    - 6: Day of week digit (3-bit, 0-6)
    - 7: 1-day digit (4-bit 0-9)
    - 8: 10-day digit (2-bit, 0-3)
    - 9: 0-bit
    - A: 24-hour mode when set (1-bit)
    - B: Leap year bits (2-bit, 0-3, the year is treated as a leap year if 0; this can be set separately from the year so software can still treat year 00 as a non-leap year, as it would be in 2100)
    - C: 0-bit
- Pages 2 and 3 are free pages, which are effectively just 13 4-bit RAM addresses each
- Writing to the shared registers directly is filtered out by TAMA6--you have to use indirect means to write to them.
    - D: PAGE register (4-bit)
        - Bits 0-1: Page select
        - Bit 2: ALARM ENABLE (force-enable the alarm, ignoring the timer)
        - Bit 3: TIMER ENABLE
    - E: TEST register (4-bit, not used, reads out as 0s)
    - F: RESET register (4-bit, write-only, reads out as 0s)
        - Bit 0: Set to reset alarm
        - Bit 1: Set to reset timer
        - Bit 2: Clear to use 16 Hz ALARM signal
        - Bit 3: Clear to use 1 Hz ALARM signal

Some stuff seems to write to low ROM areas, but I don't know what those do.

The game polls the RTC very strangely, usually only polling the seconds, but cascading to the higher counters when it thinks they've changed, so it can be hard to test properly from just the emulation point of view.

Last edited by endrift (2022-09-04 04:46:59)

Offline

 

#2 2017-07-13 12:31:39

Tauwasser
Member
Registered: 2010-10-23
Posts: 160

Re: TAMA5 (WIP)

The TAMA cartridge has four main components:

- the RTC IC: TC8521AM
- a 4-bit microcontroller with mask ROM: TMP47C243M (TAMA6)
- the interface IC to the Game Edge Connector logic, TAMA5
- the game mask ROM: TAMA7

The MCU handles the RTC logic, buzzer and SRAM access. The TAMA5 handles upper ROM address bits and ROM #CS, resetting the MCU, and acts as a shift register to translate MCU logic to/from GEC logic.

A schematic of the cartridge can be found here. I just noticed that I got the polarity of ESCLK wrong on TAMA5.

cYa,

Tauwasser

Offline

 

#3 2017-07-24 13:43:56

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: TAMA5 (WIP)

https://i.imgur.com/sTW9f1d.png

It boots!

Offline

 

#4 2018-02-10 19:47:42

skaman
New member
Registered: 2017-10-18
Posts: 5

Re: TAMA5 (WIP)

Got the TAMA5 save read and write working on my cart reader.

One thing I should mention is that to read the RAM, you use 0x20-0x3F but when you write the RAM, you use 0x00-0x1F. 

When writing to Register 6, Bit 0 controls the upper address and Bit 1 sets to read RAM.

For example,
Reading the first byte is:
Write 0xA001, 0xA
Read 0xA000 should return 0xA1 (mask with 0x3 looking for 0x1)
Write 0xA001, 0x6
Write 0xA000, 0x2 (address high nibble)
Write 0xA001, 0x7
Write 0xA000, 0x0 (address low nibble)
Check TAMA5 Status
Write 0xA001, 0xD
Read 0xA000 for data upper nibble
Write 0xA001, 0xC
Read 0xA000 for data lower nibble
Check TAMA5 Status

To write the first byte:
Write 0xA001, 0xA
Read 0xA000 should return 0xA1 (mask with 0x3 looking for 0x1)
Write 0xA001, 0x4
Write 0xA000, (data low nibble)
Write 0xA001, 0x5
Write 0xA000, (data high nibble)
Write 0xA001, 0x6
Write 0xA000, 0x0 (address high nibble)
Write 0xA001, 0x7
Write 0xA000, 0x0 (address low nibble)
Check TAMA5 Status

I really hate Tamagotchi but it works.

Nice to finally finish support for all of the mappers!

Last edited by skaman (2018-02-11 01:22:17)

Offline

 

#5 2020-08-11 23:23:18

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: TAMA5 (WIP)

I found the datasheet for the RTC (a Toshiba TC8521AM): https://pdf1.alldatasheet.net/datasheet … asheet.pdf but communication with it is processed through TAMA6.

VBA-M, surprisingly, has a partially working TAMA5 RTC, but a lot of it looks wrong.

E] TAMA6 appears to be a Toshiba TMP47C243M (Toshiba TLCS-47 4-bit MCU with 2 kilobytes of program ROM), which has a datasheet here: https://pdf1.alldatasheet.net/datasheet … asheet.pdf (The ISA is documented here, but that's useless without the program ROM: https://datasheet.datasheetarchive.com/ … X54362.pdf)

Last edited by endrift (2020-08-12 03:04:29)

Offline

 

#6 2022-08-28 07:09:27

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: TAMA5 (WIP)

I've got RTC support partially working in mGBA--seems the two different "types" of RTC commands are because one is just transparent access to the RTC, while the other is the MCU acting as a command layer to handle the RTC while the game does other things. I've only figured out a handful of the commands so far, though, and there are still some unknowns about that transparent access, but this is major progress. It's enough to get the game moderately well behaved in mGBA, too, though it's still not perfect.

Last edited by endrift (2022-08-28 07:10:47)

Offline

 

#7 2022-08-31 04:28:09

CasualPokePlayer
New member
Registered: 2022-03-28
Posts: 5

Re: TAMA5 (WIP)

endrift wrote:

(The ISA is documented here, but that's useless without the program ROM: https://datasheet.datasheetarchive.com/ … X54362.pdf)

A warning for those looking at this sheet. It seems to have numerous inconsistencies in it.

1. ST #k, @HL+'s description has SF marked with the C, indicating it is set with carry. However, the proceeding written description says it's set with inverted carry. The proceeding instruction table also marks SF with inverted carry symbol. This issue is also present in some other ST instructions.

2. The hex encoding of LD r, #k opcodes appears to be wrong in the description, with the binary encoding mismatching and the instruction table has hex encoding matching the binary encoding in the description.

3. INC and DEC opcodes show SF marked with inverted carry for INC and carry for DEC, while the instruction table has them all marked with inverted carry. The written description examples also seem to indicate inverted carry for INC and DEC is correct.

4. CMPR instructions are just a mess. The mnemonic intuitively should mean a compare with left side - right side. Yet the operation is stated to be right side - left side. Yet, the written description points to left side - right side being the correct operation, along with its examples. However, the written description seems to state left side == right side means a carry, although of course that doesn't make sense. The instruction table doesn't help here, as it repeats the same inconsistency as the description.

There's probably more I haven't caught yet, but this doesn't look super pretty for any emulator wanting to LLE the behavior if/when we have a TAMA6 rom dump.

EDIT: 3 and 4 are maybe not correct (or well, my analysis is flawed). The ALU treats substraction as the addition of 2's complement, and carry represents that there was no borrow of the MSB for that addition. So how it operates is not quite as you may expect compared to the GB's carry.

EDIT2: 3 and 4 probably have their written descriptions correct, and flags are probably wrong on the instruction able for 3. Carry for substract can more easily be seen as the inverse of carry when you assume carry in terms of the GB.

Last edited by CasualPokePlayer (2022-09-01 01:16:41)

Offline

 

#8 2022-08-31 20:37:53

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: TAMA5 (WIP)

The chip has been decapped and there's someone working on imaging the ROM: https://twitter.com/travisgoodspeed/sta … 8437443584

Hopefully we'll have a binary soon, though I have no idea how long it'll take to actually extract the ROM from images. Some CV could speed it up I imagine.

Offline

 

#9 2022-09-03 18:09:43

CasualPokePlayer
New member
Registered: 2022-03-28
Posts: 5

Re: TAMA5 (WIP)

Some info from gbdev Discord convo with endrift:

If a RTC register has 4 bits settable, you can write invalid BCD values to it (A-F).
How overflow/ticking works with invalid BCD RTC values is yet to be determined.
(Maybe test invalid RTC values in there too, e.g. 31 of February?)
0xE/0xF RTC registers are definitely not readable (as the manual says)
0xD/0xF writes are filtered by the TAMA6 before being sent to the RTC, TAMA6 commands need to be used to change them.
0x70-0x7F commands are unmapped and open bus

Offline

 

#10 2022-09-04 04:17:06

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: TAMA5 (WIP)

To be clear, some of this stuff we were talking about need to be confirmed. I might be misremembering the unmapped range mentioned, and I haven't confirmed that it's open bus; it just appears to echo the command back at you.

Anyway, here are some experiments writing to the 1s and 10s digits of minutes and how they ticked over (in BCD, so hex values are "invalid"):

1s digit:
09 -> 10
0A -> 0B
0B -> 16
0C -> 0D
0D -> 14
0E -> 0F
0F -> 12

10s digit:
0:59 -> 1:00
0:69 -> 0:70
0:79 -> 1:20

I expect the same thing happens with the seconds, but that's harder to test.

Offline

 

#11 2022-10-18 09:25:08

Lesserkuma
New member
Registered: 2022-10-18
Posts: 1

Re: TAMA5 (WIP)

I tried some RTC stuff with my real cartridge.

The year digits seem to be a counter.
I observed some weird stuff with it though.

If it's 1997 on save creation, the RTC year value is actually set to $F0.
It counts up "normally" until it reaches year $F9, but the next year it will roll over to $20.
The leap-year flag also seems to be glitchy in 1997; if the date is 12/31, it seems to erroneously set the leap-year-active value for that year?

If it's 1998 or 1999, the RTC value set to year $19. If it's 2000 or above, it's set to year $20.
It counts up by one each year until it reaches $99. It then rolls over to $00 the next year.

Offline

 

#12 2022-10-19 21:20:06

endrift
Member
Registered: 2017-05-24
Posts: 16

Re: TAMA5 (WIP)

The game doesn't set the 10s digit of the year at all.

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2005 Rickard Andersson