Continue disassembling and annotating the V.Smile BIOS
diff --git a/vsmile/listfile b/vsmile/listfile
index 4860389..c27fcfb 100644
--- a/vsmile/listfile
+++ b/vsmile/listfile
@@ -1,15 +1,31 @@
 fvsmile_v103.bin
 t00
-w0000
+n0000
+Start of RAM.
+This is of course all 0 in the cartridge dump, it is filled by the running code
+.
+z0000
 l0000 magic_start
-w0010
+
+z0010
 w07a3 interrupt_nesting_counter_low
 w07a4 interrupt_nesting_counter_high
-w07a5
+z07a5
 w0842
 w0844 INT_COUNTER_LOW
 w0845 INT_COUNTER_HIGH
+
 w0846 INT_FLAGS_BACKUP
+n0846
+The CPU provides no instruction to get the interrupt status, so this flag in RAM is used to keep
+track of the current state. This allows code to disable interrupts and then restore them to the
+previous state.
+.
+
+n084b
+The BIOS routes interrupt here in RAM, this area is initialized with jumps to the ROM but can be
+modified at runtime to re-route the interrupts to different routines if needed.
+.
 l084B BREAK
 l084D FIQ
 l084F IRQ0
@@ -20,6 +36,11 @@
 l0859 IRQ5
 l085B IRQ6
 l085D IRQ7
+
+l087c LAYERA_TILEMAP_PTR
+l087d LAYERA_ATTRS_PTR
+z087e LAYERB_TILEMAP
+
 w090e CTRLRA_BUTTON
 w090f CTRLRA_COLOR
 w0910 CTRLRA_UPDOWN
@@ -42,13 +63,36 @@
 w094c UART_VAR2b
 w094d UART_VAR3b
 w094e UART_VAR4b
-l27d1 G_MAGIC_IS_INSTALLED
-l27d2 G_IS_COMPUTER_ON
-l27f0 magic_end
+
+z094f
+
+w27d1 G_MAGIC_IS_INSTALLED
+w27d2 G_IS_COMPUTER_ON
+w27f0 magic_end
+
+n2800
+Registers start
+These are the hardware registers
+.
+z2800
+
+l2812 PPU_LAYERA_ATTRS
 l2813 PPU_LAYERA_CONTROL
+l2814 PPU_LAYERA_TILEMAP
+
+l2818 PPU_LAYERB_ATTRS
 l2819 PPU_LAYERB_CONTROL
+l281A PPU_LAYERB_TILEMAP
+
+l2820 PPU_LAYERA_SEGMENT
+l2821 PPU_LAYERB_SEGMENT
+l2822 PPU_SPRITE_SEGMENT
 l2842 PPU_SPRITES_ENABLE
 l2854 PPU_LCD_CTRL
+l2862 PPU_IRQ_CONTROL
+l2863 PPU_IRQ_STATUS
+l2872 PPU_DMA_WORDCOUNT
+
 l3400 SPU_CHANNEL_ENABLE
 l3401 SPU_MASTER_VOLUME
 l340F SPU_CHANNEL_STATUS
@@ -85,16 +129,21 @@
 l3D34 R_UART_BAUD_H
 l3D35 R_UART_TX
 l3D36 R_UART_RX
-p7bd5 BREAK_INTERRUPT
-p7be3 FIQ_INTERRUPT
-p7bf1 IRQ0_INTERRUPT
-p7c59 IRQ1_INTERRUPT
-p7c67 IRQ2_INTERRUPT
-p7c95 IRQ3_INTERRUPT
-p7cd4 IRQ4_INTERRUPT
-p7ce2 IRQ5_INTERRUPT
-p7d0b IRQ6_INTERRUPT
-p7d43 IRQ7_INTERRUPT
+l3e02 R_GPDMA_WORDCOUNT
+n4000
+Start of ROM area
+.
+z4000
+z7bd5 BREAK_INTERRUPT
+z7be3 FIQ_INTERRUPT
+z7bf1 IRQ0_INTERRUPT
+z7c59 IRQ1_INTERRUPT
+z7c67 IRQ2_INTERRUPT
+z7c95 IRQ3_INTERRUPT
+z7cd4 IRQ4_INTERRUPT
+z7ce2 IRQ5_INTERRUPT
+z7d0b IRQ6_INTERRUPT
+z7d43 IRQ7_INTERRUPT
 w8000 DATA_PAIRS
 n8000
 First word is the number of entries in the DATA init table (there's only 1)
@@ -222,10 +271,19 @@
 kAE56 Is the ON button pressed?
 kAE5B Is the OFF button pressed?
 wAE64
-wAE82 BSS_PAIRS
-wAE90
+wae82
+lAE82 BSS_PAIR
+nae82
+Area of RAM to clear. Defined by an address followed by a size.
+.
+
+wae84 default_waitstate_config
+kae84 For setting the EXT_MEM_CTRL register
+wae85 copied_to_27e0
 wAE95 INITIAL_SP
-wAE96
+uAE96 Copyright_message
+waea8
+waee0 defaut_extaddr_mode_config
 pAEE2 RESET
 kAEE3 Clear watchdog
 kAEE7 Configure RAM to 2 waitstates
@@ -257,6 +315,7 @@
 .
 kAF20 Set all port A pins as inputs
 kAF29 Initialize stack pointer so we can use CALL
+laf2f clear_bss
 kAF2F Clear the BSS areas in RAM
 kAF3C Copy the data area to RAM
 lAF40 data_init_loop
@@ -279,13 +338,30 @@
 wAFEA
 pe76a
 pe775
+pe94b OR_088B_1
+pe957 AND_08BB_NOT2
+pe963 WAIT_UNTIL_08BB_EQUAL_0
+pe96e
 pe98a
 peaf4
 peaff
-wFBF7
+pf606
+wfaea
+pfbb7
+lfbc0
+pfbc4
+lfbc7
+lfbc9
+lfbcf
+zFBF7
 vFFF5 INTERRUPT_VECTORS
 w10000
 p1221b
+l12238
+l1223a
+l12304 ret_neg1_1221b
+l12307 ret_1221b
+p1230a
 p13a1c
 p15fed GENERATE_MULTIPLIERS_TABLE
 l15ff6 loop_start
@@ -306,6 +382,10 @@
 l16072 end_loop
 k16094 Enable interrupts (both IRQ and FIQ)
 p1609f
+l1638c
+l1645c ret_0_1609f
+l1645f ret_1609f
+p16462
 p166b7
 p16716
 p16785 MEMCLEAR_16_WORDS
@@ -329,12 +409,153 @@
 k16865 [BP+1] = [0844]
 l16866 loop_start
 w1687d
-p17928
+p1729d Something_SpriteX
+k172af R4 = Sprite number
+k172B1 R4 = Sprite X pos register
+p172bd Something_SpriteY
+p172dd Something_SpriteTile
+p172fd Something_SpriteAttrs
+p1731f
+p1732b
+p17371 ENABLE_27MHZ_CLOCK
+p17379 DISABLE_27MHZ_CLOCK
+p17382
+p17397
+p173ab
+
+p17437 MEMSET_V_R1_DEST_R2_COUNT_R3
+n17437
+Set all bytes in an area to a given value
+R1 = Value to set
+R2 = Pointer to area
+R3 = Number of words
+.
+p1743f SET_PALETTE
+p17457 SET_PARTIAL_PALETTE
+p17472
+l17481
+k1749d Clear "Text horizontal control" table
+k174c9 Disable both tile layers
+k174d5 Enable sprites
+
+p174f4
+l174fb
+l17502
+l17504
+l1750d
+
+p17518 LOAD_888_AND_889_FROM_879_878_TABLE
+p17542 HEX2DEC_TENS
+w1754d
+p17551
+w1755c
+p17560
+w1756c
+p17570
+w1757c
+
+p17580
+p175af
+p175d7 SET_PALETTE_FROM_LAYER_STRUCT
+p175e5 LAYERATTRS_GENERATE_PALETTE_INDIRECTJUMP
+k175f0 Generate a CALL/POP sequence to call the routine above
+l175fb
+p175fd
+p17625
+p1767a
+
+p176a2 PALETTE_COLOR_TRANSPARENT
+n176a2
+Set the transparent bit on a palette color.
+Parameters on stack:
+- Color number
+.
+
+p176b0 PALETTE_SETCOLOR
+n176b0
+Set a color in the palette.
+Parameters on stack:
+- Color number
+- Value to set (in 15 bit RGB)
+.
+
+p176be LAYERA_DISABLE
+p176c7 LAYERA_ENABLE
+p176cf LAYERB_DISABLE
+p176d8 LAYERB_ENABLE
+
+p176e0 LAYER_SETDEPTH
+n176e0
+Configure layer depth
+Parameters on stack:
+- Layer number (1 or 2)
+- Layer depth (0 to 3, back to front)
+.
+l176ea configure_layerb
+l176f9 configure_layera
+
+p17708 LOAD_LAYERB_TILEMAP
+p17713 SPRITE_dosomething
+l17724
+l17746
+l1774d
+l1774f
+l1775d
+
+p17760
+p177a9
+l177c4
+p177da
+l177e4
+l177ea
+l177eb
+l177ee
+p177f1
+p17860
+p1787f
+l17893
+l178a2
+l178a6
+w178ab
+
+p17928 GET_FAR_WORD_TO_R1
+n17928
+Read word from address passed as parameter on the stack
+Parameters on stack:
+- 32-bit address
+Return value in R1
+.
+
+p17932 MEMCPY_FROM_FAR
+n17932
+Copy bytes from far pointer to RAM
+Parameters on stack:
+- Far pointer (32 bits)
+- Destination pointer
+- Word count
+.
+
+p17944
+p1795c STORE_BYTES_IN_SOME_BUFFER
+p17973
+p17995
+p179a6
+
+p179ca PALETTE_SINGLECOLOR
+n179ca
+Clear the whole palette with a single color
+Parameters on stack:
+- Color to set
+.
+
+p179d6
 p17a03 INIT_GPIOs
 k17a04 Select "special 1" mode for IOA (STN LCD interface)
 k17a11 Set IOA0-IOQ11 to "special" mode
 k17a15 Prepare IOB special mode (external cart select pins)
 p17a34 INIT_LCD_OUTPUT
+l17a48
+l17a75
 p17ac3 RESTORE_INTERRUPT_FLAGS
 p17ad5 IS_IRQ_ENABLED
 p17AD9 IS_FIQ_ENABLED
@@ -360,10 +581,11 @@
 k17ba2 Clear all interrupt bits
 k17bac Disable and clear PPU interrupts
 p17bba INIT_EXMEM_AND_DISABLE_FIQ
-k17bc1 R2 = [RESET - 2] = AEE2
-k17bc4 R1 = EXTMEM & F000 | [RESET - 2] | 40
-k17bc7 R2 = [ae84] & 3 = 2
-k17bc9 R1 = EXTMEM & F000 | AEE2 | 40 | 1 = ?EE3
+k17bbf Points to RESET - 2 = AEE0
+k17bc1 Address mode 2 (0x80), use CSB1, 2, and 3
+k17bc4 Bus arbitration default value
+k17bc7 Waitstates configuration
+k17bc9 Final value of EXT_MEM_CTRL register
 p17bd5 interrupt_exit
 p17be3
 p17bf1
@@ -372,7 +594,18 @@
 p17dbf IS_ON_BUTTON_PRESSED
 p17dc6 GET_WORD_FROM_FAR
 p17dd0 PUT_WORD_TO_FAR
-p17ddb
+p17ddb INDIRECT_CALL
+
+p17df3 GET_WORD_FROM_FAR_PRESHIFTED_SEGMENT
+n17df3
+Get a word from a far pointer, but the segment part of the pointer is already shifted to go in SR
+As a result, this manipulates SR directly instead of using the "magic" DS register in memory
+.
+k17df6 R1 = arg0 = New DS value
+k17dfa R4 = arg1 = Offset
+
+p17dfe PUT_WORD_TO_FAR_PRESHIFTED_SEGMENT
+
 p17e0a MEMCPY_FROM_FAR
 n17e0a
 Parameters:
@@ -383,17 +616,66 @@
 .
 p17e1c MEMCPY_TO_FAR
 p17e2e
+k17e31 Some kind of memcpy from far memory, again...
+k17e4a Push new values for SR and PC to the stack and use RETF to go there
+k17e37 Set DS, the old and complicated way...
+w17e52
+
 p17e55
+l17e6c
+l17e6a
+p17e7c
+l17e83
+l17e86
+l17e99 dma_wait
+l17eab dma_wait2
+l17eb0 dma_wait3
 p17ed4 SHUTDOWN_IF_016D_GT_10
 p17edd HARDWARE_INIT
 p17eec
+l17efe
+l17f18
+l17f29
+l17f32
+l17f38
+l17f3c
+l17f69
+p17f6d SET_080d
+p17f75 GET_080d
+p17f78
+p17f7d
+p17f80
+p17f83 ENABLE_WATCHDOG
 p17f90 DISABLE_WATCHDOG
 p17f99 CLEAR_WATCHDOG
 p17fa0 READ_IOC4_BOOTLOGO
 p17fa4 READ_IOC_LANGUAGE_SANITIZED
-w17fb1
+n17fa4
+Reads the language settings from IOC, but replace invalid values by either US or UK english
+Allowed values are 7 to F
+7: Chinese
+8: Polish
+9: Dutch
+A: Italian?
+B: German
+C: Spanish
+D: French
+E: UK English
+F: US English
+
+Result is returned in R1. DS is modified.
+.
+w17fb1 language_validation_table
 p17fc1 READ_IOC_LANGUAGE_RAW
+n17fc1
+Reads IOC0-3 to determine the language setting. Returns the value directly with no validation.
+So this may return values 0-6 if your console is such wired.
+.
 p17fc5 READ_IOC5
+n17fc5
+Read pin IOC5.
+This shows as unused on the V.Smile Motion schematics, what was it used for in earlier consoles?
+.
 p17fc9 WAIT_ALL_DMAS_AND_RESET
 k17fe0 Call reset vector
 k17ffb R1 = EXTMEM & F000
@@ -402,11 +684,24 @@
 p17ff7 CONFIGURE_TIMER2_512HZ
 p18006 ENABLE_BLANKING_INTERRUPT
 p1800e find_slot_something
-p18020
+l18020 return_1
+
+p18023
+p1807b CLEAR_0848
 p18081 DELAY_23A0000
-p18090
-p182ac
+
+p18090 EXTMEM_SELECT_MODE
+n18090
+Select external memory configuration
+Param on stack:
+- Mode to select (0 to 3)
+.
+
+p180a0
+p180a7
 w186c8
+p18b71
+p18f58
 p19010 STUB_RETURN_0_a
 p1901a STUB_RETURN_0_b
 p19024 IS_016D_GREATER_THAN_10
@@ -455,8 +750,30 @@
 w19bff PPU_SPU_initialvalues
 w19c66 PPU_inittables
 w19c7a
+p19fc3 LCD_ENABLE_BACKLIGHT
+p19fd9 LCD_DISABLE_BACKLIGHT
+p19fef
+p1a047
 p1a0a7
-p1a20a
+p1a10f SHOULD_SHOW_BOOTLOGO
+n1a10f
+Test IOC5 to decide if boot logo should be shown or not
+Same as READ_IOC4_BOOTLOGO
+.
+p1a113
+p1a20a READ_IOC_LANG_RAW_ALT
+k1a20a Same as READ_IOC_LANGUAGE_RAW
+p1a20e SET_EXTROM_CONFIG
+p1a21e GET_EXTROM_CONFIG
+w1a224
 p1a4d6
+p1a526
 w1A533 RAM_DATA_SECTION
+w1a604
+z1a847
+w1c000
 e20000
+
+c0FFFDA
+w0FFFDA
+e100000