blob: 0ea4c65ac31cada469b7d5f06c341cb2fc4f6628 [file] [log] [blame]
fvsmile_v103.bin
t00
n0000
Start of RAM.
This is of course all 0 in the cartridge dump, it is filled by the running code
.
z0000
l0000 magic_start
z0010
w07a2 slot_counter_something
w07a3 interrupt_nesting_counter_low
w07a4 interrupt_nesting_counter_high
z07a5
w07a7 fiq_nesting_counter
w07b9 irq2_nesting_counter
w07bf irq5_nesting_counter
w07ce irq6_nesting_counter
w07d7 irq7_nesting_counter
w07dd irq1_nesting_counter
w07e0 irq3_nesting_counter
w07e3 irq4_nesting_counter
z07e5 slot_buffer_something
n07e5
In blocks of 6 bytes, with the one at offset 5 being some kind of ID?
.
w0842 tmb2CounterLow
n0842
Increment by 4 every timer 2 interrupt, which result in approximately a milliseconds counter.
.
w0843 tmb2CounterHigh
w0844 INT_COUNTER_LOW
w0845 INT_COUNTER_HIGH
w0846 INT_FLAGS_BACKUP
n0846
The CPU provides no instruction to get the interrupt status, so this flag in RAM is used to keep
track of the current state. This allows code to disable interrupts and then restore them to the
previous state.
Bit 1 indicates if IRQ is enabled
Bit 2 indicates if FIQ is enabled
.
w0847 skipVCounterIncrease
n0847
Blocks incrementation of VBL counter by interrupts. This allows "atomic" access to the counter
without completely disabling interrupts.
.
w0848 int_something848
w0849 int_something849
w084a int_something84a
n084b
The BIOS routes interrupt here in RAM, this area is initialized with jumps to the ROM but can be
modified at runtime to re-route the interrupts to different routines if needed.
.
l084B BREAK
l084D FIQ
l084F IRQ0_PPU
l0851 IRQ1
l0853 IRQ2
l0855 IRQ3
l0857 IRQ4
l0859 IRQ5
l085B IRQ6
l085D IRQ7
w085f PPU_INTERRUPT_SEMAPHORE
k085f Set to FFFF when the interrupt handler is already running
n0878
Pointer to an array of layer descriptor structures (10 words each).
Each struct content:
0 Offset to attributes
1 Segment to attributes
2 Offset to tilemap
3 Segment to tilemap
4
5
6
7
8
9
.
w0878 screens_address
k0878 Init to 687D
w0879 screens_ds
k0879 Init to 1
w087a colors_address
w987b colors_ds
w087c LAYERA_TILEMAP_PTR
n087c
Init to 0x16F
000-200 is BG1 tilemap (to fill the whole 512x256 screen with 16x16 tiles)
200-300 is color attributes
.
w087d LAYERA_ATTRS_PTR
z087e LAYERB_TILEMAP
w0888 SPRITE_ATTR_PTR
k0888 sprite attribute when drawing a letter, init to 1051.
w0889 SPRITE_TILEBASE_PTR
k0889 Pointer to first tile of font (init to DA0C)
w088a isTVSys
k088A set to 1 for TV output (not internal LCD), -1 otherwise
n090e
Controllers state: buttons, color buttons, Y and X positions
Somehow repeated 3 times?
First controller A, then controller B
.
w090e CTRLRA_BUTTON
w090f CTRLRA_COLOR
w0910 CTRLRA_UPDOWN
w0911 CTRLRA_LEFTRIGHT
w0914 CTRLRA_Buffer1
w091a CTRLRA_Buffer2
w0920 CTRLRB_BUTTON
w0921 CTRLRB_COLOR
w0922 CTRLRB_UPDOWN
w0923 CTRLRB_LEFTRIGHT
w0936 UART_TX_BUFFER
w0937 CTRLRA_SPECIAL
k0937 Store special commands from controller A (starting with Bx or 7x)
w0938 CTRLRB_SPECIAL
n0939
Synchronization tracking of both controllers. Compute the expected reply from the controller after
the last 7x/Bx command sent to it.
w0939 CTRLRA_ExpectedSyncByte
w093a CTRLRB_ExpectedSyncByte
w093b syncAKey
w093d CtrlA_resyncTry
k093D Counts attempts at synchronizing with controller A
w093f syncACounter
k093f Sync controller if > 0x400
w0940 syncBCounter
w0941 LastASyncFrame
w0942 LastBSyncFrame
w0943 LastUARTType
k0943 Last time we interacted with UART
w0944 tx_StartTime
n0945
Bit 0: actve controller (0 for B, 1 for A)
Bit 1: (1 for A, 0 for B)
Bit2-5: controller is sending data
Bit3-4: controller is receiving data
Bit6: CtrlA_buffer1 is valid
BitB: CtrlB_buffer1 is valid
Bit8: define buffer in use by controller A (0=buffer1, 1= buffer2)
Bit9: define buffer in use by controller B (0=buffer1, 1= buffer2)
Bit10: CtrlA_buffer2 is valid
Bit11: CtrlB_buffer2 is valid
.
w0945 controller_settings
n0946
Bit 0: controller A enabled
Bit 1: controller B enabled
Bit 3: waiting for controller B data
Bit 6: Controller A is idle (received 0x55 in the previous frame)
Bit 7: Controller B is idle (received 0x55 in the previous frame)
.
w0946 controller_flags
w0947 CtrlA_lastInteractTime
k0947 When controllerA RTS changed
w0948 CtrlB_lastInteractTime
n0949
Buffers for controller communication
Initialized with 60, E6, D6
.
w0949 CTRLA_TX_BUF0
w094a CTRLA_TX_BUF1
w094b CTRLA_TX_BUF2
w094c CTRLB_TX_BUF0
w094d CTRLB_TX_BUF1
w094e CTRLB_TX_BUF2
z094f
w0964 APU_Channel
w0969 CtrlA_keepalive_step
k0969 7=E6, 4=D6, 2=60
w096A CtrlB_kepalive_step
w27d1 IsOffPressed
w27d2 IsOnPressed
k27e0 Init to 'MAIN UNIT'
w27f0 magic_end
n2800
Registers start
These are the hardware registers
.
z2800
l2810 PPU_LAYERA_X
l2811 PPU_LAYERA_Y
l2812 PPU_LAYERA_ATTRS
l2813 PPU_LAYERA_CONTROL
l2814 PPU_LAYERA_TILEMAP
l2815 PPU_LAYERA_ATTRMAP
l2816 PPU_LAYERB_X
l2817 PPU_LAYERB_Y
l2818 PPU_LAYERB_ATTRS
l2819 PPU_LAYERB_CONTROL
l281A PPU_LAYERB_TILEMAP
l281B PPU_LAYERB_ATTRMAP
l281C PPU_VERT_COMPRESS_AMOUNT
l281D PPU_VERT_COMPRESS_OFFSET
l2820 PPU_LAYERA_SEGMENT
l2821 PPU_LAYERB_SEGMENT
l2822 PPU_SPRITE_SEGMENT
l282A PPU_BLEND_LEVEL
l2830 PPU_FADE_CTRL
l2836 PPU_IRQ_POS_X
l2837 PPU_IRQ_POS_Y
l2838 PPU_CURRENT_LINE
l2839 PPU_LIGHTPEN_LATCH
l283C PPU_TV_CTRL1
l283D PPU_TV_CTRL2
l283E PPU_LIGHTPEN_X
l283F PPU_LIGHTPEN_Y
l2842 PPU_SPRITES_CTRL
l2854 PPU_LCD_CTRL
l2862 PPU_IRQ_CONTROL
l2863 PPU_IRQ_STATUS
l2870 PPU_DMA_SRC
l2871 PPU_DMA_DEST
l2872 PPU_DMA_WORDCOUNT
l2900 PPU_LINE_SCROLL_MEM
l2A00 PPU_LINE_COMPRESS_MEM
l2B00 PPU_PALETTE_MEM
l2C00 PPU_SPRITE_MEM
l3200 SPU_CHANNEL_PHASE
l3206 SPU_CHANNEL_TARGET_PHASE
l3400 SPU_CHANNEL_ENABLE
l3401 SPU_MASTER_VOLUME
l3403 SPU_FIQ_STATUS
l340F SPU_CHANNEL_STATUS
l3410 SPU_LEFT_MIXER
l3411 SPU_RIGHT_MIXER
l3415 SPU_CHANNEL_ENV_MODE
l3D00 R_GPIO_CTRL
l3D01 R_IOA_DATA
l3D02 R_IOA_BUFFER
l3D03 R_IOA_DIRECTION
l3D04 R_IOA_ATTR
l3D05 R_IOA_MASK
l3D06 R_IOB_DATA
l3D07 R_IOB_BUFFER
l3D08 R_IOB_DIRECTION
l3D09 R_IOB_ATTR
l3D0A R_IOB_MASK
l3D0B R_IOC_DATA
l3D0C R_IOC_BUFFER
n3D0C
Bit 0-3: language settings
Bit 4: Show logo
Bit 6: Audio output enable
Bit 7: Power control?
Bit 8: CTS A
Bit 9: CTS B
Bit 10: RTS A
Bit 12: RTS B
Bit 13: UART RX
Bit 14: UART TX
.
l3D0D R_IOC_DIRECTION
l3D0E R_IOC_ATTR
l3D0F R_IOC_MASK
l3D10 R_TIMEBASE_SETUP
l3D11 R_TIMEBASE_CLEAR
l3D12 TIMER_A_DATA
l3D13 TIMER_A_CTRL
l3D14 TIMER_A_ENABLE
l3D15 TIMER_A_IRQCLR
l3D16 TIMER_B_DATA
l3D17 TIMER_B_CTRL
l3D18 TIMER_B_ENABLE
l3D19 TIMER_B_IRQCLR
l3d20 R_SYSTEM_CTRL
n3D20
Bit 0: Audio DAC output disable
Bit 1: Audio DAC disable
Bit 2: Video DAC disable
Bit 3: Strong/Weak mode
Bit 4: 32KHz clock disable
Bit 5-6: LVD voltage select
Bit 7: LVD enable
Bit 8: LVR enable
Bit 9: LVR output enable
Bit 11: system clock enable
Bit 12-13: system clock control
Bit 14: sleep enabled
Bit 15: watchdog enabled
.
l3d21 R_INTERRUPT_CTRL
l3d22 R_INTERRUPT_STATUS
l3d23 R_EXT_MEM_CTRL
l3d24 R_WDG_CLEAR
n3d24
Watchdog must be cleard with a 0x55AA every 0.75 seconds
Otherwise a RESET IRQ is generated
.
l3d25 R_ADC_CTRL
l3d26 R_ADC_PAD
l3d27 R_ADC_DATA
l3d28 R_SLEEP_MODE
l3d29 R_WAKEUP_SRC
l3D2A R_WAKEUP_TIME
l3d2B R_TV_SYSTEM
k3d2B 1 = PAL, 0 = NTSC
l3d2c R_RANDOM1
l3D2D R_RANDOM2
l3d2e R_FIQ_SEL
l3d2f DS
l3D30 R_UART_CTRL
l3D31 R_UART_STATUS
l3D32 R_UART_RESET
l3D33 R_UART_BAUD_L
l3D34 R_UART_BAUD_H
l3D35 R_UART_TX
l3D36 R_UART_RX
l3D37 R_UART_RXFIFO
l3e00 R_GPDMA_SRC_OFFSET
l3e01 R_GPDMA_SRC_SEGMENT
l3e02 R_GPDMA_WORDCOUNT
l3e03 R_GPDMA_TARGET
n4000
Start of ROM area
.
z4000
z7bd5 BREAK_INTERRUPT
z7be3 FIQ_INTERRUPT
z7bf1 IRQ0_INTERRUPT
z7c59 IRQ1_INTERRUPT
z7c67 IRQ2_INTERRUPT
z7c95 IRQ3_INTERRUPT
z7cd4 IRQ4_INTERRUPT
z7ce2 IRQ5_INTERRUPT
z7d0b IRQ6_INTERRUPT
z7d43 IRQ7_INTERRUPT
w8000 DATA_PAIRS
n8000
First word is the number of entries in the DATA init table (there's only 1)
Then each entry contains:
- A destination address in RAM
- A long source address in ROM (DS + offset)
- A size
.
w8005
pA239 SPUBeat_update
pA24E
pA819 sendToController
ka828 disable interrupts
ka82d reset controller ID
la83d controller_unavailable
la83f
la841 already_transmitting
la843 controller_B
la847
la85c
la861
la866
la86a send_to_controllerA
la86d
la87b
la880
la885
ka889 Set controller B CTS
lA889 send_to_controllerB
la88b send_data
la893 wait_uart_tx
ka895 TX busy?
la89c
la8a2
la8a6
la8a7
ka8b0 Clear interrupts
ka8bd Clear both CTS
ka8c3 disable interrupts
la8c4 reset_interrupts_and_return
la8c9 return
pA8CB READ_CONTROLLER_DATA_FROM_UART
ka8ce Tx ready?
la8d1 TxEnded
ka8d1 Rx data available?
la8d6 txInProgress
la8d8 rxDataAvailable
ka8d9 Which controller is active?
la8de receiveCtrlrAData
ka8e3 See what type of input we received...
la8fc setIdleA
la904 storeAcommnd
la908 storeADirY
la90b storeADirX
la90e storeAColorButtons
la911 storeAButtons
la913 storeAData
la914 rxAEmpty
ka918 controllerA doesn't request to send, no new data available
la922 copyAInBuffer2
la92d copyAInBuffer1
ka92d Mark buffer 1 as valid
la937 saveControllerAData
la93c
la943 dataA_copied
la945 noNewAData
la947 recvCtrlrBData
la965 setIdleB
la96d storeBCommand
la971 controllerb_updown
la974 controllerb_leftright
la977 controllerb_color
la97a controllerb_button
la97c controllerb_store_input
la97d controllerb_no_more_rx_data
la996 update_controller_buffer
la9a0 saveControllerBData
la9ac endRX
ka9b0 Clear CTS A and B
ka9b3 clear bits 2-5
la9b7 controllerb_no_rts
la9b9 endTX
ka9bd clear CTS A and B
ka9c0 clear bits 3 and 4
la9c4 exit
nA9CD
Controller A RTS change
If 0, controller is requested to send data
If 1, controller is no longer requested to send data
.
pA9CD ControllerA_Handle_RTS_Change
ka9d8 8ms delay
ka9dc Set controller A clear to send
ka9eb Check controller A request to send
la9ee clearRequest
ka9f0 Remove controller A CTS
la9f9
ka9fc Mark controller A as alive
kAA04 Same as above, but using controller B RTS and CTS
pAA04 ControllerB_Something
laa0b
kaa13 Set B CTS
laa24 Check B RTS
laa27 clearRequest
laa32 exit
naa3d
Disable no longer talking controllers
.
pAA3D checkIfControllerAlive
laa45 disableCtrlrA
laa64 endControllerA
laa68 controllerA_stillEnabled
kaa6f disable interrupts
kaa8c Clean CTS bits
laa8e endControllerB
laa92 controllerB_stillEnabled
pAA94 Controller_UART_Setup
kAA97 Enable UART, both external interrupts, and ADC
kAA9F Configure UART: Tx and Rx active, 8N1
kAAA5 4800 baud
kAAAD clear status register
pAB25 CONTROLLER_GPIO_CONFIG
kAB26 Disable both external interrupts
kAB2e UART Rx and Tx as inputs
kAB46 Configure RTS/CTS
pAB5E
uABBA
wac90
pacd3 FIQ_update
pace6 DMA_wait_previous
nace7
R4 = Number of words to transfer
R3 = Destination offset
R2 = Source segment
R1 = Source offset
.
pace7 DMA_start
pacf3
pad61
pADBE
pADDA getSecuredOffValue
nADDA
If magic was installed: return 1 if we should poweroff.
If magic was not installed: install it and return 1 always
.
lade1 signature_installed
pADE4 install_signature
nADE4
Copy the magic bytes at start and end of RAM
.
nADEE
Write signature bytes at address pointed by R2
.
pADEE write_signature
pAE07 CHECK_MAGIC_START_END
nAE07
Check for signature at start and end of RAM
Output: R1=0 of both of them match. R1=1 otherwise.
.
pAE13 read_signature
nAE13
Input: R2 points to area to check
Output: R1=0 if the magic pattern matches. R1=1 if it doesn't
The magic pattern is: 55AA, AA55, 5A5A, A5A5, 5456, 4345, 5448, 4756
.
lae35 signature_mismatch
pAE37 DELAY_LONG
pAE50 SHOULD_POWER_OFF
nAE50
Test ON and OFF buttons.
Output: R1=0 if ON is pressed or OFF is not pressed (we should turn or stay on)
R1=1 if OFF is pressed and ON is not pressed (we should turn off)
.
kAE50 Call DELAY_LONG 96 times to make a super long delay
kAE56 Is the ON button pressed?
kAE5B Is the OFF button pressed?
wAE64
wae82
lAE82 BSS_PAIR
nae82
Area of RAM to clear. Defined by an address followed by a size.
.
wae84 default_waitstate_config
kae84 For setting the EXT_MEM_CTRL register
wae85 copied_to_27e0
wAE95 INITIAL_SP
uAE96 Copyright_message
waea8
waee0 defaut_extaddr_mode_config
pAEE2 RESET
kAEE3 Clear watchdog
kAEE7 Configure RAM to 2 waitstates
kAEEE Disable watchdog
nAEF4
Configure system:
Watchdog - disabled
Sleep - enabled
Voltage regulators - all disabled
32KHz clock - enabled
Video DAC - enabled
Audio DAC - disabled
.
kAEF8 Power off ADC (CSB=1)
kAEFB Configure IOB to trigger wakeup interrupts when ON is pressed
kAEFE Configure special pins for IOB (CSB1, CSB2, CSB3)
kAF03 IOB5 as output, all other pins as inputs
nAF16
Configure IOC pins: 88C0
1000 1000 1100 0000
- IOC0,1,2,3,4 as input to read system configuration
- IOC5: TBD
- IOC6: enable audio output (as output)
- IOC7: power control (as output)
- IOC8,9: CTS to controller (should be output, it's input for now)
- IOC10,11: RTS from controller (one is input, the other is output?)
- IOC13, 14: UART Rx/Tx (both as inputs?)
- IOC15: Controller power? as output
.
kAF20 Set all port A pins as inputs
kaf27 Vsmile pocket LCD?
kAF29 Initialize stack pointer so we can use CALL
laf2f clear_bss
kAF2F Clear the BSS areas in RAM
kAF3C Copy the data area to RAM
lAF40 data_init_loop
laf48 next_byte
laf4b check_block_end
laf4f copy_block
lAF57 endless_loop
pAF58 EMPTY_INTERRUPT
paf59 WAKEUP_handler
pAFA9 CLEAR_3WORDS_AT_27D0
pAFB6 INIT_GLOBALS_FROM_MAGIC_AND_POWERBUTTONS
kAFBE Spin for a little while...
kAFC5 Check if ON button is pressed
lafce notOn
kAFD5 Clear 16 words at 27e0
kAFDB Clear 16 words at 27f0 (note this erases the magic)
pAFE2 MEMSET
nAFE2
Set a section of RAM to a single value:
Inputs:
R1: value to write
R2: pointer to area to set
R3: word count
.
wAFEA
pe76a
pe775
pe94b OR_088B_1
pe957 AND_08BB_NOT2
pe963 WAIT_UNTIL_08BB_EQUAL_0
pe96e
pe98a
peaf4
peaff
pf606
pf616
lf61f
lf623
lf635
lf640
lf64f
lf693
lf6f3
wfaea
pfbb7
lfbc0
pfbc4
lfbc7
lfbc9
lfbcf
zFBF7
vFFF5 INTERRUPT_VECTORS
w10000
p1221b
l12238
l1223a
l12304 ret_neg1_1221b
l12307 ret_1221b
p1230a
p13a1c
p137b4 syncControllers
k137bb Sync controller A
l137c3 checkCtrlA
l137cb ctrlAAvailable
l137d2 controlAUnsync
l137e0 ctrlAResync
k137ef BP <- 0X7x | (counter & 0x0F)
l137f0 sendResyncARetry
l137fb sendResyncAOK
l137fd sendResyncAError
l137ff computeResyncAReply
k13806 refValue = sendCommand ^ FFFF + 1
k13818 var2 = refValue & FF
k13825 var1 = 0xB0 | ((refValue ^ 0A) & 0F)
l13831 CtrlrA_lost
l13855 syncAStart
l13882 sendSyncARetry
l1388d sendSyncAOK
l1388f sendSyncAError
l13891 computeSyncAReply
k13898 refValue = sendCommnd ^ FFFF + 1
k138aa var2 = refValue & FF
k138bb var1 = B0 | (refValue + key) ^ 0A & 0F
k138c3 key = var2
l138c5 syncAEnd
n138ea
Controller B
.
l138ea syncNext
k14b94 Force idle bits
l149bf handleIdleControllers
l14ba7 ctrlA_idle
k14bdd remove bit "55 received"
k14bf9 Controller A keepalive
l14bf9 keepAliveUpdate
l14bff sendA_keepalive
l14c07 keepAliveA_step1
l14c26 keepAliveA_step2
l14c45 keepAliveA_step3
l14c68 controllerB_keepalive
l14cd5 handleSyncControllers
l14cdd noSync1
l14ce5 noSync2
l14ce7 doSync
l14ceb incSyncCounters
p14d21 BIOS_ScreenTest
k14d31 Disable audio and video DACs
k14d3d Disable audio output
l14d42 loop
l14d46 loop_start
l14d4a wait_controllertest
l14d4F end_controllertest
l14d51
l14d5b
l14d5f wait_ColorPatternTest
l14d64 end_ColorPatternTest
l14d72 Disable_clock_and_return_0
p14d7a Screen_ColorPatternTest
p14f25 Screen_ControllerTest
l14f2e reset_sprites
l14f34 reset_next_sprite
l14f3e sprites_resetted
l14f40 reset_sprite
l14f5a
k14f81 Get 4 sprites
k14fb9 Get 4 sprites
k14ff1 Get 5 sprites
k15029 Get 4 sprites
l150ff drawPower
l15121 drawJoyX0
l15133 drawJoyY0
l1514f drawChecksums
p15352 drawConrollerID(spriteID, controllerID)
l15363 drawLetterA
l15373 drawLetterB
l15381 end
p15384
p153aa initControllerSprites
k153aa draw 8 sprites
p154c8
p15df0
k15e16 I am confused because MEMCPY_FROM_FAR takes 4 arguments, where are the 2 other?
p15e28
p15fed GENERATE_MULTIPLIERS_TABLE
l15ff6 loop_start
k15ff6 loop 15 times (loop counter is in BP+0)
l15ffd loop_is_not_done
k16001 R3R4 = loop counter * 3
k16005 R1 = loop counter * 3 & 255 + 07A5
l16024 loop_is_done
p1602a
l16033 loop_start
l1603a loop_body
k1603c R4,R3 = loop_index * 6
k16040 R1 = loop_index * 6 + 7e9
k16043 Store -1 at loop_index * 6 + 7e9
k1604d Store -1 at loop_index * 6 + 7ea
k16058 Store 0 at loop_index * 6 + 7e7, 7e8
k16067 Store 0 at loop_index * 6 + 7e5, 7e6
l16072 end_loop
k16094 Enable interrupts (both IRQ and FIQ)
p1609f
l1638c
l1645c ret_0_1609f
l1645f ret_1609f
p16462
p164be saveTMB2Counter
p164cd
p166b7
p16716
p16785 MEMCLEAR_16_WORDS
l1678d loop_start
l16794 loop_do
l167a5 loop_done
p167a8
l167b9 magic_is_installed
l167c1 27d0_is_clear
k167c1 remove_magic
l167d3 27d0_is_not_clear
l167e6 magic_not_installed
p167e9
p1683b call_167a8_or_167e9
l16848 is1
l1684c isNot1
l16852 is2
l16854 return
p16857 WAIT_BLANKING
k1685f [BP] = [0844]
k16865 [BP+1] = [0844]
l16866 loop_start
l1686c counterChanged
w1687d
p1729d setSpriteXIndirect
k172af R4 = Sprite number
k172B1 R4 = Sprite X pos register
p172bd setSpriteYIndirect
p172dd setSpriteTileIndirect
p172fd setSpriteAttrsIndirect
p1731f ramCode_reset
p1732b Sprite_drawLetter(x,y,letter,spriteIdx)
k17330 Parameter 3: sprite number
k17332 R4 = Sprite address
k17335 Parameter 2: sprite char
k17338 Parameter 0: sprite X
k1733a Parameter 1: sprite Y
p17341 ALLOC_SPRITE
n17341
Find an unused sprite (character set to 0 and palette set to C)
Set palette to 0 to mark the sprite as allocated
Return sprite number in R1
.
l17346
l1734e
l17351 sprite_found
p17356 FREE_SPRITE
n17356
Reset all registers for a sprite to 0, except palette attribute which is set to C
Parameter on stack: sprite number
.
p17371 ENABLE_27MHZ_CLOCK
p17379 DISABLE_27MHZ_CLOCK
p17382 GET_ATTRIBUTE_FROM_LAYER_DESCRIPTOR
k17385 R1 = Param
k17387 R3 = Param * 10
k1738B R3 = Param * 10 + 2 + [0878]
p17397 GET_TILE_FROM_LAYER_DESCRIPTOR
p173ab SCREEN_DRAW
k173b6 CF for controller test, BA for color pattern test
k173BA r3 = CF * A = 816
k173C1 r3 += 0x687D = 0x7093
k173c2 Data address
k173c5 Data segment
l173e7 scrollX_not_needed
l173fc scrollY_not_needed
l17406 handleScroll
l17411 noscroll
l17423 copy_row
p17437 MEMSET_V_R1_DEST_R2_COUNT_R3
n17437
Set all bytes in an area to a given value
R1 = Value to set
R2 = Pointer to area
R3 = Number of words
.
p1743f SET_PALETTE_256
p17457 SET_PALETTE_16
p17472
l17481
k1749d Clear "Text horizontal control" table
k174ba RETF
k174bd RAMCODE[0x10] = RETF, see int_vblank2_pc
k174c5 RAMCODE[1] = dataFreeSpace
k174c9 Disable both tile layers
k174d5 Enable sprites
p174f4 BIOSSprites_Reset
l174fb
l17502 next_sprite
l17504 next_word
l1750d
w17510
w17511 Sprite count
w17512 Word count
w17513 Tile ID (transparent tile)
w17514 X pos
w17515 Y pos
w17516 palette
w17517 end flag
p17518 initFontData
p17542 LOOKUP_LSR4_28140A05
w1754d
p17551 GetTilesPerRow
w1755c
p17560 LOOKUP_LSR6_20100804
w1756c
p17570 GetTilesPerColumn
w1757c
p17580 ACTIVATE_LAYERB_BACKGROUND_FROM_DESCRIPTOR
k17589 USe single attribute register, enable "background" mode
k175aa Enable the layer
p175af SetSpriteIndirect(x,y,dataID,spriteID)
p175d7 SET_PALETTE_FROM_LAYER_STRUCT
p175e5 LAYERATTRS_GENERATE_PALETTE_INDIRECTJUMP
k175f0 Generate a CALL/POP sequence to call the routine above
l175fb
p175fd
p17625
p1767a
p176a2 PALETTE_COLOR_TRANSPARENT
n176a2
Set the transparent bit on a palette color.
Parameters on stack:
- Color number
.
p176b0 PALETTE_SETCOLOR
n176b0
Set a color in the palette.
Parameters on stack:
- Color number
- Value to set (in 15 bit RGB)
.
p176be LAYERA_DISABLE
p176c7 LAYERA_ENABLE
p176cf LAYERB_DISABLE
p176d8 LAYERB_ENABLE
p176e0 LAYER_SET_ZORDER
n176e0
Configure layer depth
Parameters on stack:
- Layer number (1 or 2)
- Layer depth (0 to 3, back to front)
.
l176ea configure_layerb
l176f9 configure_layera
p17708 LOAD_LAYERB_TILEMAP
p17713 printInRed
l17724
l17746
l1774d
l1774f
l1775d no_more_sprites
p17760
p177a9
l177c4
p177da word2HexString
l177e4
l177ea printABCDEF
l177eb
l177ee
p177f1
p17860 getFontInfo
l17872
p1787f testTVSys
l17893 next_char
l178a2
l178a6 not_equal
l178a8 exit
u178ab
w178b1
p17928 GET_FAR_WORD_TO_R1
n17928
Read word from address passed as parameter on the stack
Parameters on stack:
- 32-bit address
Return value in R1
.
p17932 MEMCPY_FROM_FAR
n17932
Copy bytes from far pointer to RAM
Parameters on stack:
- Far pointer (32 bits)
- Destination pointer
- Word count
.
p17944
p1795c STORE_BYTES_IN_SOME_BUFFER
p17973
p17995 Color_setTransparentIndirect
p179a6 testSomething179a6
l179ba next_ptr
l179c1 test_ptrs
l179c6 not_3rd_bank
p179ca PALETTE_SINGLECOLOR
n179ca
Clear the whole palette with a single color
Parameters on stack:
- Color to set
.
p179d6
p17a03 INIT_GPIOs
k17a04 Select "special 1" mode for IOA (STN LCD interface)
k17a11 Set IOA0-IOQ11 to "special" mode
k17a15 Prepare IOB special mode (external cart select pins)
k17a30 4096 colors, 320x240, LCD
p17a34 INIT_LCD_OUTPUT
l17a48
l17a75
p17ac3 RESTORE_INTERRUPT_FLAGS
p17ad5 IS_IRQ_ENABLED
p17AD9 IS_FIQ_ENABLED
p17add ENABLE_IRQ
p17ae8 DISABLE_IRQ
p17af5 ENABLE_FIQ
p17b00 DISABLE_FIQ
p17b0d DISABLE_IRQ_AND_FIQ
p17b14 ENABLE_IRQ_AND_FIQ
p17b1e GET_INTERRUPT_STATUS
p17b21 SAVE_AND_SET_INTERRUPTS
n17b21
Change interrupt state and return the previous state, which can be used later to restore them to
how they were
.
p17b2f INIT_INTERRUPT_VECTORS
n17b2f
Interrupt vectors from the BIOS are routed to RAM so they can be changed dynamically
This function initializes that RAM area with CALL instructions
.
p17b98 ACK_ALL_INTERRUPTS
k17b9a Clear all except ADC interrupt
k17b9d Clear PPUinterrupt register
p17ba0 CLEAR_INTERRUPTS
k17ba2 Clear all interrupt bits
k17bac Disable and clear PPU interrupts
p17bba INIT_EXMEM_AND_DISABLE_FIQ
k17bbf Points to RESET - 2 = AEE0
k17bc1 Address mode 2 (0x80), use CSB1, 2, and 3
k17bc4 Bus arbitration default value
k17bc7 Waitstates configuration
k17bc9 Final value of EXT_MEM_CTRL register
p17bd5 INT_RAMVEC_BREAK
l17be1 no_sub
p17be3 INT_RAMVEC_FIQ
l17bef no_sub
p17bf1 INT_RAMVEC_IRQ0_PPU
n17bf1
unSP 1.0 does not allow interrupt nesting. So the interrupt handlers are written in a way that
exits interrupt handling mode as soon as possible, and then jump to the interrupt processing
routine using a RETI instruction (to an address pushed on the stack). The interrupt handling is
then protected with a software semaphore to aovid calling the routine while it is already running.
.
k17bf3 Clear the hardware interrupt
k17bfa Check if the interrupt handling routine is already running
k17c01 Perform a "fake" RETI to re-enable interrupts and jump to the actual handling code
l17c06 alreadyInProgress
p17c08 handle_ppu_interrupt_normalmode
n17c08
Input: BP contains the 3 low bits of PPI_IRQ_STATUS/CONTROL (active interrupts)
.
k17c08 blanking interrupt handling
l17c0a vblank
k17c0d increase vblank counter
l17c16 inc_counter_nooverflow
k17c1c Request an ADC conversion every 16 frames
l17c20 not_multiple_of_16
l17c25 callVBlankHandler
l17c2a noVBlankHandler
l17c32 callVBlank2
l17c3c no_blanking_irq
k17c3c Video Timing IRQ handling
l17c43 callVDOsub
l17c48 no_vdo_irq
k17c48 Sprite DMA IRQ handling
l17c4F callDMAsub
l17c54 no_dma_irq
k17c54 Clear the interrupt semaphore so that the interrupt handler can be called again
p17c59 INT_RAMVEC_IRQ1
p17c67 INT_RAMVEC_IRQ2
l17c7a noTimerASub
l17c85 timerADisabled
l18c8f noTimerBSub
l17c93 timerBDisabled
p17c95 INT_RAMVEC_IRQ3
l17ca8 noSPISub
l17caE spiDisabled
l17cbf noUartSub
l17cc1 uartdisabled
p17cd4 INT_RAMVEC_IRQ4
l17cce noADCsub
l17cd2 ADCdisabled
p17ce2 INT_RAMVEC_IRQ5
l17cf5 clearExtInt1
l17cfb noExtInt1
l17d05 clearExitInt2
p17d0b INT_RAMVEC_IRQ6
l17d1d noHz1024Sub
l17d22 hz1024Disabled
l17d2e noHz2048Sub
l17d33 hz2048Disabled
l17d3d noHz4096Sub
p17d43 INT_RAMVEC_IRQ7
k17d4e invert timebase bits, bit0 = timebase1, bit1 = timebase2 interrupt
l17d4f noTimebase1
l17d52 timeBase1int
l17d5c noTMB1sub
l17d61 timebase2int
l17d79 noTMB2sub
l17d7e timebaseIntDisabled
l17d8c hz4NoSub
l17d91 hz4Disabled
l17d9e noKeyChangeSub
l17da4 keyChangeDisabled
l17dae noLowPowerSub
p17db3 IS_OFF_BUTTON_PRESSED
p17dba IS_RESET_BUTTON_PRESSED
p17dbf IS_ON_BUTTON_PRESSED
p17dc6 GET_WORD_FROM_FAR
p17dd0 PUT_WORD_TO_FAR
p17ddb INDIRECT_CALL
p17df3 GET_WORD_FROM_FAR_PRESHIFTED_SEGMENT
n17df3
Get a word from a far pointer, but the segment part of the pointer is already shifted to go in SR
As a result, this manipulates SR directly instead of using the "magic" DS register in memory
.
k17df6 R1 = arg0 = New DS value
k17dfa R4 = arg1 = Offset
p17dfe PUT_WORD_TO_FAR_PRESHIFTED_SEGMENT
p17e0a MEMCPY_FROM_FAR
n17e0a
Parameters:
BP+3: Source address
BP+4: DS
BP+5: Destination address
BP+6: Word count
.
p17e1c MEMCPY_TO_FAR
p17e2e COPY_TO_RAM_AND_EXECUTE_SRPC
n17e2e
Copy a piece of code to RAM (on the stack) and then execute it from there.
Parameters: Segment:Offset of routine to call, and routine size in bytes
.
k17e31 R4 = Param0 = Size
k17e35 R3 = Param1 = Src Offset
k17e36 R1 = Param2 = Src Segment
k17e37 Set DS, the old and complicated way...
k17e3f Copy the pointed data onto the stack
k17e4a Push SR:PC for the return thunk, the called function will return there
k17e4e Push SR:PC for the routine copied in RAM, then call it using RETF
p17e52 COPY_TO_RAM_RETURN_STUB
n17e52
Used by the routine above to return execution to the normal flow
.
p17e55 COPY_TO_RAM_AND_EXECUTE_PCSR
n17e55
Same as above, but the address to jump to is pushed as PC:SR instead of SR:PC on the stack?
.
l17e6c
l17e6a
p17e79 COPYTORAM_PCSR_RETSTUB
p17e7c MEMCPY_SIMPLE
n17e77
Simple memcpy from and to the current active segment.
Params: Source, Destination, Size in words
.
l17e83
l17e86
p17e89
p17e96 HWRNG_GET_RANDOM2
p17e99 DMA_COPY
n17e99
Perform a memory copy using GPDMA. Waits for the transfer to complete before returning.
Parameters on the stack:
- Source Segment:Offset
- Target
- Word count
.
l17eab dma_wait
p17eb0 DMA_COPY_ASYNC
n17eb0
Starts a DMA transfer, DOES NOT wait for it to terminate.
Parameters on the stack:
- Source Segment:Offset
- Target
- Word count
.
p17ec3 DMA_COPY_SYNC_REG
n17ec3
Sync DMA transfer (function waits for transfer to be completed)
Parameters from registers:
- R1:R2: Source Segment:Offset
- R3: Destination
- R4: Word count
.
p17ed4 SHUTDOWN_IF_016D_GT_10
p17edd HARDWARE_INIT
p17eec TEST_ONOFFRESET_BUTTONS
l17efe notOff
l17f08 notReset
l17f10 on_button_not_pressed
l17f18
l17f29 on_or_reset_pressed
l17f32
l17f38 without_input
l17f3c
l17f69 ret_17eec
p17f6d SET_VBlank2Mode
p17f75 GET_VBlank2Mode
p17f78
p17f7d
p17f80
p17f83 ENABLE_WATCHDOG
p17f90 DISABLE_WATCHDOG
p17f99 CLEAR_WATCHDOG
p17fa0 READ_IOC4_BOOTLOGO
p17fa4 READ_IOC_LANGUAGE_SANITIZED
n17fa4
Reads the language settings from IOC, but replace invalid values by either US or UK english
Allowed values are 7 to F
7: Chinese
8: Polish
9: Dutch
A: Italian?
B: German
C: Spanish
D: French
E: UK English
F: US English
Result is returned in R1. DS is modified.
.
w17fb1 language_validation_table
p17fc1 READ_IOC_LANGUAGE_RAW
n17fc1
Reads IOC0-3 to determine the language setting. Returns the value directly with no validation.
So this may return values 0-6 if your console is such wired.
.
p17fc5 READ_IOC5_TESTPOINT
n17fc5
Read pin IOC5.
This shows as unused on the V.Smile Motion schematics, what was it used for in earlier consoles?
.
p17fc9 do_nothing
k17fc9 The cmp will never be true here, so the wait DMA will never be called?
p17fcE WAIT_ALL_DMAS_AND_RESET
l17fd2 wait_spriteDMA
k17fd9 Enabe sleep, disable audo and video
k17fe3 get wakeup_handler address
k17fe0 Call reset vector
k17ffb R1 = EXTMEM & F000
p17fe8 CONFIGURE_EXTMEM
p17ff7 CONFIGURE_TIMER2_256HZ
k17ff7 (every 4 ms)
k17ffc TMB2 256Hz, TMB1 8Hz
k18001 TMB2 enable
p18006 ENABLE_BLANKING_INTERRUPT
p1800e find_slot_something
l18016 findslot_loop
l18020 return_1
p18023
p1807b CLEAR_0848
p18081 DELAY_23A0000
p18090 EXTMEM_SELECT_MODE
n18090
Select external memory configuration
Param on stack:
- Mode to select (0 to 3)
.
p180a0
p180a7
w186c8
p18b71
p18f58
p19010 STUB_RETURN_0_a
p1901a STUB_RETURN_0_b
p19024 IS_016D_GREATER_THAN_10
l19034 ret0_19024
l19037 ret_19024
p19039
p19073
p190b3
l190d0 controllerA
l190d2 resetControllerA
l190de resetADone
l190e0 resetAError
l190e2 controllerB
l190ec resetCOntrollerB
l190f8 resetBDone
l190fa resetBError
l1914d showLogo
l19187 noLogo
l1918b freeSprites
l191a0 spritesFreed
l191a5 exit
p192ac
p192dc
p19317 showBiosScreens
l1932e notOnPressed
l19336 notOffPressed
l1933c noTP5
l19344 noResetPressed
l19346 showTestBios
l19353 skipTestBiosScreen
w19356
p19632
p19676 getTimer
p19682
w198D9
p19ab9 CLEANUP_AND_SHUTDOWN
l19aba wait_dma_idle
l19abe wait_sprite_dma_idle
k19ac3 Copy 10 words from 0:ae85 to 27e0
k19ae3 Enable wakeup on register B
l19b0d wait_su_idle
p19b49 PPU_ERASE_ALL_SPRITES
p19b5f SPU_CLEAR_ALL_CHANNELS
p19b81 sleepmode_microcode
k19B81 Installed by 19B1C
p19b9a SPU_MAXIMIZE
n19b9a
Gradually increment SPU mixer outputs until they reach the maximal possible value
This is done to avoid a loud POP when they are initialized and suddenly set the speaker to the max
value.
.
p19bb5 SPU_BALANCE
n19bb5
Gradually increment or decrement SPU mixer outputs until they both reach the neutral value of 8000.
This avoids making a loud POP by setting them to a value directly from an unknown one.
.
p19bcf PPU_SPU_INIT_REGISTERS
p19bd4 PPU_SPU_LOAD_INITVALUES
p19be1 PPU_LOAD_INITTABLES
n19be1
Initialize large areas of PPU registers
Each data entry consists of:
- A target address,
- A number of repetitions to perform (number of entries to write)
- Size of an entry
- Values for each entry
This function loops over all of that and sets all the registers (palette, sprite data, etc) to the
correct default values
.
l19bea load_one_table
k19bea Load destination address from table
k19bec Load repeat count from table
k19bee Load value count from table
l19bf1 load_one_entry
l19bf3 load_one_value
k19bf3 Load value from table
w19bff PPU_SPU_initialvalues
w19c66 PPU_inittables
w19c7a
p19fc3 LCD_ENABLE_BACKLIGHT
p19fd9 LCD_DISABLE_BACKLIGHT
p19fef
l1a00d wait_20ms
l1a033 wait_33ms
p1a047
p1a0a7
l1a0b1 wait_200_TMB2
p1a10f SHOULD_SHOW_BOOTLOGO
n1a10f
Test IOC5 to decide if boot logo should be shown or not
Same as READ_IOC4_BOOTLOGO
.
p1a113
p1a20a READ_IOC_LANG_RAW_ALT
k1a20a Same as READ_IOC_LANGUAGE_RAW
p1a20e SET_EXTROM_CONFIG
p1a21e GET_EXTROM_CONFIG
w1a224
p1a336 ADC_update
p1a34f
p1a3cb GetTestValue
w1a3d3
u1a45b BIOS_VERSION
p1a460 GetChecksum
p1a47a PrintLanguageCode
w1a495 LanguageCodes
p1a4a5
p1a4b2 PrintBIOSVersion
l1a4be copy_bios_version
l1a4c5 nextChar
l1a4c9 zeroTerminated
p1a4d6
p1a4fc RSHIFT(value, shiftCount)
p1a511 LSHIFT(value, shiftCount)
p1a526
w1A533 RAM_DATA_SECTION
w1a604
z1a847
s1c000
w1c006
e20000
c0FFFDA
w0FFFDA
e100000