The registers a program reaches in the 68000’s memory map apart from the video chip (see VDP ports and registers). Sources are Plutiedev’s guides and the Genesis Plus GX emulator’s source; Sega’s own manuals were not read, so bits that neither source states are marked as inferred. Most of these registers are byte-wide and sit at odd addresses (the 68000’s low byte of a word) or at even ones as listed; Genesis Plus GX ignores a byte write to the wrong half of a register.
Version register ($A10001)
A read-only byte. Genesis Plus GX builds its value as region | $20 | (TMSS present), with the region bits as below
($00 Japan NTSC, $40 Japan PAL, $80 overseas NTSC, $C0 overseas PAL), and
clears bit 5 when it emulates a Mega CD.
| Bit | Meaning |
|---|---|
| 7 | 0 = domestic (Japan), 1 = overseas |
| 6 | 0 = NTSC (60 Hz), 1 = PAL (50 Hz) |
| 5 | 1 = no Mega CD attached (Genesis Plus GX sets it unless it emulates a Mega CD) |
| 4 | Not described by the sources read. |
| 3–0 | The console’s hardware version. Genesis Plus GX uses only bit 0, which it sets when it emulates a console with the TMSS boot ROM; what the four bits count on real consoles is inferred from common knowledge and not confirmed by a source read here. |
I/O ports ($A10003–$A1001F)
Three ports, two for the controllers (player 1 and player 2) and a third, the “modem” or EXT port, present only on early consoles. Each has seven pins that can be inputs or outputs. Every register is a byte, and each port’s addresses are two bytes apart.
| Port | Data port | Control port | Serial: TxData | Serial: RxData | Serial control |
|---|---|---|---|---|---|
| Player 1 | $A10003 | $A10009 | $A1000F | $A10011 | $A10013 |
| Player 2 | $A10005 | $A1000B | $A10015 | $A10017 | $A10019 |
| Modem (EXT) | $A10007 | $A1000D | $A1001B | $A1001D | $A1001F |
Parallel mode (the normal one)
Writing the control port sets the direction of each pin: bit 0–6 = 1 makes the pin an output, 0 an input. Bit 7 is 0 unless external
interrupts are used (see below). Controllers need $40 there (TH as an output). Writing the data port sets the pins that are outputs;
reading it returns the level of every pin. Genesis Plus GX documents the bits of both (data: bit 6 TH, bit 5 TR, bit 4 TL, bits 3–0 the D3–D0 pins; control: bit 7
“/HL output control”, bit 6 TH, bit 5 TR, bit 4 TL, bits 3–0 D3–D0 as output or input).
While the 68000 accesses the I/O ports a Z80 that is reading the 68000’s bus can be given wrong data, so the usual advice is to halt the Z80 around the access (Plutiedev, “Hardware issues”, citing the official documentation).
External interrupt
An interrupt at 68000 level 2 happens when pin 6 (TH) is an input and goes from high to low (light guns use it). To enable it: set bit 7 in the port’s control
register, set bit 3 of VDP register $0B (see the registers) and allow interrupts on the 68000.
Serial mode (modem, rarely used)
The serial control register selects the speed and turns serial mode on:
| Bits | Meaning |
|---|---|
| 7–6 | Speed: 00 4800 bps, 01 2400 bps, 10 1200 bps, 11 300 bps |
| 5 | 1 = TR (pin 9) works as the serial input (RxData), 0 = parallel |
| 4 | 1 = TL (pin 6) works as the serial output (TxData), 0 = parallel |
| 3 | 1 = raise the external interrupt when a byte has been received |
| 2 | Read-only: 1 = error receiving the current byte |
| 1 | Read-only: 1 = a received byte is ready to read |
| 0 | Read-only: 1 = the transmit buffer is full |
Turning serial mode on means setting bits 5–4 to 11. To send, wait for bit 0 to read 0 and write TxData; to receive, bits 2–1 reading 01
mean a byte is ready in RxData. Plutiedev adds that the serial control register must be read before each send or receive, even when the result is known,
or the hardware may not send the right data or may return the previous byte; it notes this is not in the official documentation.
Z80 bus control ($A11100, $A11200)
Two 16-bit registers (also usable as bytes at the even address). The 68000 can reach Z80 RAM and the YM2612 only while it holds the Z80’s bus.
| Address | Name | Write | Read |
|---|---|---|---|
$A11100 | Z80 bus request | $0100 requests the bus (the Z80 stops), $0000 gives it back. Genesis Plus GX uses bit 8 of a word write, or bit 0 of a byte write at the even address. | Bit 0 (of the even byte) reads 0 once the 68000 has the bus; it reads 1 while the Z80 has it or while the Z80 is in reset. Other bits are open bus. |
$A11200 | Z80 reset | $0000 holds the Z80 in reset, $0100 releases it. | Not described by the sources read. |
The sequence Plutiedev gives for starting a Z80 program: write $0000 to the reset register; write $0100 to the bus request; write $0100 to reset
(Z80 RAM cannot be accessed while the Z80 is in reset); copy the program into Z80 RAM at $A00000 using byte accesses; write $0000 to reset and wait at least 192
cycles (waiting less may leave the YM2612 not working); write $0100 to reset and $0000 to the bus request. To talk to a running Z80, request the bus and keep
reading the request register until it reads back as granted, then access Z80 RAM and release the bus. The Z80 can be interrupted in the middle of a 16-bit access, so the only atomic access is a byte.
Z80 bank register (Z80 $6000, 68000 $A06000)
The Z80 reaches the 68000’s memory through a 32 KiB window at Z80 $8000–$FFFF. Which 32 KiB is chosen by a 9-bit bank register that is written
one bit at a time: each write to $6000 shifts bit 0 of the byte in as the new top bit. Genesis Plus GX’s code is
zbank = ((zbank >> 1) | ((data & 1) << 23)) & $FF8000, so nine writes, least significant bit first, set bits 23–15 of the 68000 address that the window starts at.
The window can show ROM (so a sound program can stream samples) and, per Plutiedev, a bank that changes while the Z80 uses it must be coordinated with the Z80 (see
mappers).
TMSS ($A14000)
The Trademark Security System is a boot ROM inside later consoles (which models have it is not stated in the sources read). Two things are documented in the sources read:
- The header check. The only part of the cartridge header a console looks at is the system type. If it does not find “SEGA” there, a console with the TMSS refuses to start the game (Plutiedev).
Sega’s own “TMSS” notes are said to allow
SEGAat$100or a space andSEGAat$101; that is not stated in the sources read here and is marked inferred. The viewer accepts both without a warning. - The register. The VDP is locked until the program writes the four letters
SEGAto$A14000(as a long word$53454741or as two words). In Genesis Plus GX, while the four bytes written there are not exactlySEGA, every access to$C00000–$DFFFFFlocks the machine up; writing the right bytes makes the VDP reachable. The Super Street Fighter II notes (Trzynadlowski) say the game “writes the SEGA message to the Trademark Security System register” at start-up, before it does anything else.
A console without a TMSS does not need the write and ignores it. A program that wants to run on both writes it unconditionally. The serial-number software type OS
(see serial number) is the TMSS ROM’s own.
The other bytes of $A14000–$A14FFF are not described by the sources read, and neither is how the boot ROM is switched out of the way of the cartridge.
Sound chips on the Z80 bus
The YM2612 (FM) is reached at $A04000–$A04003 from the 68000 (while it holds the Z80 bus) and at $4000–$4003 from the Z80: address and data for part 0 at
+0 and +1, address and data for part 1 at +2 and +3. Its status register must be read at $A04000 / $4000, and only bits 7, 1 and 0 are meaningful
(Plutiedev, “Hardware issues”). The PSG (SN76489) is written at $C00011 from the 68000 and at Z80 $7F11; it is on the 68000 bus, so the Z80 writing it can clash with a DMA. The sound
chips’ own registers are not described on this site.
Cartridge registers ($A130xx)
The range $A13000–$A130FF belongs to the cartridge. The Sega mapper’s registers ($A130F1 to $A130FF), the 32X signature ($A130EC–$A130EF) and the other known users are on
mappers and bank switching.
The names the viewer uses
The disassembly names an operand that is exactly one of these addresses. Mirrors and other bytes are not named.
| Address | Name | See |
|---|---|---|
$A00000 | z80_ram | Z80 RAM |
$A04000–$A04003 | ym2612_a0, ym2612_d0, ym2612_a1, ym2612_d1 | sound chips |
$A06000 | z80_bank_register | bank register |
$A10001 | io_version | version register |
$A10003, $A10005, $A10007 | io_data1, io_data2, io_data_ext | I/O ports |
$A10009, $A1000B, $A1000D | io_ctrl1, io_ctrl2, io_ctrl_ext | I/O ports |
$A1000F, $A10011, $A10013 | io_txdata1, io_rxdata1, io_sctrl1 (player 1 serial) | serial mode |
$A10015, $A10017, $A10019 | io_txdata2, io_rxdata2, io_sctrl2 (player 2 serial) | serial mode |
$A1001B, $A1001D, $A1001F | io_txdata_ext, io_rxdata_ext, io_sctrl_ext (modem port serial) | serial mode |
$A11100 | z80_busreq | Z80 bus control |
$A11200 | z80_reset | Z80 bus control |
$A130F1 | sram_control | SRAM switch |
$A130F3–$A130FF (odd) | ssf2_bank1, ssf2_bank2, ssf2_bank3, ssf2_bank4, ssf2_bank5, ssf2_bank6, ssf2_bank7 | SSF2 mapper |
$A14000 | tmss_sega | TMSS |
$C00000, $C00002 | vdp_data, vdp_data_2 | VDP ports |
$C00004, $C00006 | vdp_control, vdp_control_2 | VDP ports |
$C00008, $C0000C | vdp_hv_counter, vdp_hv_counter_2 | HV counter |
$C00011 | psg | sound chips |
$FF0000 | work_ram | memory map |
Sources
- I/O ports – Plutiedev: addresses, parallel and serial mode, the external interrupt (read in full)
- Using the Z80 – Plutiedev: the bus request and reset sequences, byte accesses, YM2612 access
- Hardware issues – Plutiedev: the I/O-port and Z80 clash, the YM2612 status register, the PSG on the 68000 bus
- ROM header – Plutiedev: the system type is the only header field a console checks, and the TMSS refuses a cartridge without “SEGA”
- io_ctrl.c, mem68k.c, genesis.c – Genesis Plus GX: the version register value, the I/O register bits, the bus request and reset decoding, the Z80 bank register shift and the TMSS lock
- SSFII Genesis technical information – Bart Trzynadlowski (Wayback copy): the game writes “SEGA” to the TMSS register at start-up