Gameboy Development Forum

- $A000: Register nybble
- $A001: Register number

TAMA5 has a series of registers that can be accessed one nybble a time. First you must unlock the MBC by writing $0A to $A001. Wait until $A000 replies with $F1 (the high four bits are hi-z), then select the register with $A001.
Before initialization, $Axxx/$Bxxx read out a repeating pattern of $F0 $FF (and it varies which value is first depending on how many bytes you read in a row, but that might be my tool being broken)

Registers (undivided):
- $0: ROM bank low (RA14-17)
- $1: ROM bank high (RA18)
- $4: Data in low
- $5: Data in high
- $6: Address/command high
- $7: Address/command low
- $A?: Constant 1?
- $C: Data out low
- $D: Data out high

- ROM banks are as they say
- Data in is written by CPU/read by TAMA5 before issuing commands.
- Data out is written by TAMA5/read by CPU after issuing commands.
- RAM is 32 bytes
    - Written by writing $4:L, $5:H, $6:Y, $7:X -- HL is the byte to be written, Y is $2 OR the high bit of address. X is low 4 bits of address. Write takes place at the end.
    - Read by writing $6:Y, $7:X then reading $C:L, $D:H — HL is the byte being read, Y is the high bit of address, X is low 4 bits of address. Inverse of previous command with $2 clear.
- RTC is selected with $6:8
    - RTC register number is selected with the value of the $4 register
    - RTC operation is selected with the $7 register
        - Bit 0: Clear for write, set for read
        - Bits 1-2: Page to access (0 = Timer, 1 = Alarm, 2/3 = Free pages)
    - RTC register value (when writing) is passed in the $5 register
    - RTC registers only have a certain number of bits wired up, so writing to bits that aren't used during normal function won't do anything and will read out as zero.
- TAMA6 is selected with $6:4 (or $6:5 if the number below is greater than 0xF)
    - Values are passed to the commands as a two digit BCD value stored with the 10s digit in the $5 register and the 1s digit in the $4 register
    - TAMA6 seems to cache the minutes and hours, so if you bypass it and set the hours or minutes directly, the TAMA6 will not update the value when using commands $46/$47 (see below) until it thinks they might have rolled over.

Address/command ranges:
- $00–$1F: RAM write
- $20–$3F: RAM read
- $40–$6F?: TAMA6 commands
- $70-$7F: Open bus? Just echoes the address back at you
- $80–$BF: RTC registers
- $C0-$FF: Untested

The TAMA6 commands (OR'd with $40):
- $40: Disable "TIMER ENABLE" in PAGE register
- $41: Enable "TIMER ENABLE" in PAGE register and resets seconds to 00
- $43: Observed, but unknown behavior currently
- $44: Atomically set minutes
- $45: Atomically set hours
- $46: Atomically get minutes
- $47: Atomically get hours
- $50: Disable "ALARM ENABLE" in PAGE register
- $51: Enable "ALARM ENABLE" in PAGE register

The RTC is a TC8521AM part with 4 pages of registers, each page has 13 of its own 4-bit registers and 3 registers are shared between all pages, at the end.
- Unmapped bits always read out as zero.
- In 24-hour mode, the hour 10s digit goes from 0-2, but in 12 hour mode, the high bit signals PM, so 11 PM/23 10s digit would be 0b10 in 24 hour mode, but 0b11 in 12 hour mode, as it's 1X:XX PM.
- Page 0 is the TIMER page
    - 0: 1-sec digit (4-bit. 0-9)
    - 1: 10-sec digit (3-bit, 0-6)
    - 2: 1-min digit (4-bit, 0-9)
    - 3: 10-min digit (3-bit, 0-6)
    - 4: 1-hour digit (4-bit, 0-9)
    - 5: 10-hour digit (2-bit, see also 12/24 hour modes)
    - 6: Day of week digit (3-bit, 0-6)
    - 7: 1-day digit (4-bit 0-9)
    - 8: 10-day digit (2-bit, 0-3)
    - 9: 1-month digit (4-bit, 0-9)
    - A: 10-month digit (1-bit, 0-1)
    - B: 1-year digit (4-bit, 0-9)
    - C: 10-year digit (4-bit, 0-9)
- Page 1 is the ALARM page
    - 0: 0-bit
    - 1: 0-bit
    - 2: 1-min digit (4-bit, 0-9)
    - 3: 10-min digit (3-bit, 0-6)
    - 4: 1-hour digit (4-bit, 0-9)
    - 5: 10-hour digit (2-bit, see also 12/24 hour modes)
    - 6: Day of week digit (3-bit, 0-6)
    - 7: 1-day digit (4-bit 0-9)
    - 8: 10-day digit (2-bit, 0-3)
    - 9: 0-bit
    - A: 24-hour mode when set (1-bit)
    - B: Leap year bits (2-bit, 0-3, the year is treated as a leap year if 0; this can be set separately from the year so software can still treat year 00 as a non-leap year, as it would be in 2100)
    - C: 0-bit
- Pages 2 and 3 are free pages, which are effectively just 13 4-bit RAM addresses each
- Writing to the shared registers directly is filtered out by TAMA6--you have to use indirect means to write to them.
    - D: PAGE register (4-bit)
        - Bits 0-1: Page select
        - Bit 2: ALARM ENABLE (force-enable the alarm, ignoring the timer)
        - Bit 3: TIMER ENABLE
    - E: TEST register (4-bit, not used, reads out as 0s)
    - F: RESET register (4-bit, write-only, reads out as 0s)
        - Bit 0: Set to reset alarm
        - Bit 1: Set to reset timer
        - Bit 2: Clear to use 16 Hz ALARM signal
        - Bit 3: Clear to use 1 Hz ALARM signal

Some stuff seems to write to low ROM areas, but I don't know what those do.

The game polls the RTC very strangely, usually only polling the seconds, but cascading to the higher counters when it thinks they've changed, so it can be hard to test properly from just the emulation point of view.

Last edited by endrift (2022-09-04 04:46:59)