*********************************************************************** ***************************** ROM HEADER **************************** *********************************************************************** 0000h (1 byte): initial PI_BSB_DOM1_LAT_REG value (0x80) 0001h (1 byte): initial PI_BSB_DOM1_PGS_REG value (0x37) 0002h (1 byte): initial PI_BSB_DOM1_PWD_REG value (0x12) 0003h (1 byte): initial PI_BSB_DOM1_PGS_REG value (0x40) 0004h - 0007h (1 dword): ClockRate 0008h - 000Bh (1 dword): Program Counter (PC) 000Ch - 000Fh (1 dword): Release 0010h - 0013h (1 dword): CRC1 0014h - 0017h (1 dword): CRC2 0018h - 001Fh (2 dwords): Unknown (0x0000000000000000) 0020h - 0033h (20 bytes): Image name Padded with 0x00 or spaces (0x20) 0034h - 0037h (1 dword): Unknown (0x00000000) 0038h - 003Bh (1 dword): Manufacturer ID 0x0000004E = Nintendo ('N') 003Ch - 003Dh (1 word): Cartridge ID 003Eh - 003Fh (1 word): Country code 0x4400 = Germany ('D') 0x4500 = USA ('E') 0x4A00 = Japan ('J') 0x5000 = Europe ('P') 0x5500 = Australia ('U') 0040h - 0FFFh (1008 dwords): Boot code *********************************************************************** ************************* MEMORY MAP OVERVIEW *********************** *********************************************************************** 0x0000 0000 to 0x03EF FFFF RDRAM Memory 0x03F0 0000 to 0x03FF FFFF RDRAM Registers 0x0400 0000 to 0x040F FFFF SP Registers 0x0410 0000 to 0x041F FFFF DP Command Registers 0x0420 0000 to 0x042F FFFF DP Span Registers 0x0430 0000 to 0x043F FFFF MIPS Interface (MI) Registers 0x0440 0000 to 0x044F FFFF Video Interface (VI) Registers 0x0450 0000 to 0x045F FFFF Audio Interface (AI) Registers 0x0460 0000 to 0x046F FFFF Peripheral Interface (PI) Registers 0x0470 0000 to 0x047F FFFF RDRAM Interface (RI) Registers 0x0480 0000 to 0x048F FFFF Serial Interface (SI) Registers 0x0490 0000 to 0x04FF FFFF Unused 0x0500 0000 to 0x05FF FFFF Cartridge Domain 2 Address 1 0x0600 0000 to 0x07FF FFFF Cartridge Domain 1 Address 1 0x0800 0000 to 0x0FFF FFFF Cartridge Domain 2 Address 2 0x1000 0000 to 0x1FBF FFFF Cartridge Domain 1 Address 2 0x1FC0 0000 to 0x1FC0 07BF PIF Boot ROM 0x1FC0 07C0 to 0x1FC0 07FF PIF RAM 0x1FC0 0800 to 0x1FCF FFFF Reserved 0x1FD0 0000 to 0x7FFF FFFF Cartridge Domain 1 Address 3 0x8000 0000 to 0xFFFF FFFF External SysAD Device *********************************************************************** ************************* MEMORY MAP DETAILED *********************** *********************************************************************** 0x0000 0000 to 0x03EF FFFF RDRAM memory: ----------------------------------------- 0x0000 0000 to 0x001F FFFF RDRAM range 0 0x0020 0000 to 0x003F FFFF RDRAM range 1 0x0040 0000 to 0x03EF FFFF Unused 0x03F0 0000 to 0x03FF FFFF RDRAM registers: -------------------------------------------- RDRAM_BASE_REG - 0x03F00000 0x03F0 0000 to 0x03F0 0003 RDRAM_CONFIG_REG or RDRAM_DEVICE_TYPE_REG 0x03F0 0004 to 0x03F0 0007 RDRAM_DEVICE_ID_REG 0x03F0 0008 to 0x03F0 000B RDRAM_DELAY_REG 0x03F0 000C to 0x03F0 000F RDRAM_MODE_REG 0x03F0 0010 to 0x03F0 0013 RDRAM_REF_INTERVAL_REG 0x03F0 0014 to 0x03F0 0017 RDRAM_REF_ROW_REG 0x03F0 0018 to 0x03F0 001B RDRAM_RAS_INTERVAL_REG 0x03F0 001C to 0x03F0 001F RDRAM_MIN_INTERVAL_REG 0x03F0 0020 to 0x03F0 0023 RDRAM_ADDR_SELECT_REG 0x03F0 0024 to 0x03F0 0027 RDRAM_DEVICE_MANUF_REG 0x03F0 0028 to 0x03FF FFFF Unknown 0x0400 0000 to 0x0400 FFFF SP registers: ----------------------------------------- SP_BASE_REG - 0x04040000 0x0400 0000 to 0x0400 0FFF SP_DMEM read/write 0x0400 1000 to 0x0400 1FFF SP_IMEM read/write 0x0400 2000 to 0x0403 FFFF Unused 0x0404 0000 to 0x0404 0003 SP_MEM_ADDR_REG Master, SP memory address (RW): [11:0] DMEM/IMEM address [12] 0=DMEM,1=IMEM 0x0404 0004 to 0x0404 0007 SP_DRAM_ADDR_REG Slave, SP DRAM DMA address (RW): [23:0] RDRAM address 0x0404 0008 to 0x0404 000B SP_RD_LEN_REG SP read DMA length (RW): [11:0] length [19:12] count [31:20] skip direction: I/DMEM <- RDRAM 0x0404 000C to 0x0404 000F SP_WR_LEN_REG SP write DMA length (RW): [11:0] length [19:12] count [31:20] skip direction: I/DMEM to RDRAM 0x0404 0010 to 0x0404 0013 SP_STATUS_REG SP status (W): [0] clear halt (R): [0] halt [1] set halt [1] broke [2] clear broke [2] dma busy [3] clear intr [3] dma full [4] set intr [4] io full [5] clear sstep [5] single step [6] set sstep [6] interrupt on break [7] clear intr on break [7] signal 0 set [8] set intr on break [8] signal 1 set [9] clear signal 0 [9] signal 2 set [10] set signal 0 [10] signal 3 set [11] clear signal 1 [11] signal 4 set [12] set signal 1 [12] signal 5 set [13] clear signal 2 [13] signal 6 set [14] set signal 2 [14] signal 7 set [15] clear signal 3 [16] set signal 3 [17] clear signal 4 [18] set signal 4 [19] clear signal 5 [20] set signal 5 [21] clear signal 6 [22] set signal 6 [23] clear signal 7 [24] set signal 7 0x0404 0014 to 0x0404 0017 SP_DMA_FULL_REG SP DMA full (R): [0] valid bit dma full 0x0404 0018 to 0x0404 001B SP_DMA_BUSY_REG SP DMA busy (R): [0] valid bit dma busy 0x0404 001C to 0x0404 001F SP_SEMAPHORE_REG SP semaphore (R): [0] semaphore flag (set on read) (W): [] clear semaphore flag 0x0404 0020 to 0x0407 FFFF Unused 0x0408 0000 to 0x0408 0003 SP_PC_REG SP PC (RW): [11:0] program counter 0x0408 0004 to 0x0408 0007 SP_IBIST_REG SP IMEM BIST REG (W): [0] BIST check (R): [0] BIST check [1] BIST go [1] BIST go [2] BIST clear [2] BIST done [6:3] BIST fail 0x0408 0008 to 0x040F FFFF Unused 0x0410 0000 to 0x041F FFFF DP command registers: ------------------------------------------------- DPC_BASE_REG - 0x04100000 0x0410 0000 to 0x0410 0003 DPC_START_REG DP CMD DMA start (RW): [23:0] DMEM/RDRAM start address 0x0410 0004 to 0x0410 0007 DPC_END_REG DP CMD DMA end (RW): [23:0] DMEM/RDRAM end address 0x0410 0008 to 0x0410 000B DPC_CURRENT_REG DP CMD DMA end (R): [23:0] DMEM/RDRAM current address 0x0410 000C to 0x0410 000F DPC_STATUS_REG DP CMD status (W): [0] clear xbus_dmem_dma (R): [0] xbus_dmem_dma [1] set xbus_dmem_dma [1] freeze [2] clear freeze [2] flush [3] set freeze [3] start gclk [4] clear flush [4] tmem busy [5] set flush [5] pipe busy [6] clear tmem ctr [6] cmd busy [7] clear pipe ctr [7] cbuf ready [8] clear cmd ctr [8] dma busy [9] clear clock ctr [9] end valid [10] start valid 0x0410 0010 to 0x0410 0013 DPC_CLOCK_REG DP clock counter (R): [23:0] clock counter 0x0410 0014 to 0x0410 0017 DPC_BUFBUSY_REG DP buffer busy counter (R): [23:0] clock counter 0x0410 0018 to 0x0410 001B DPC_PIPEBUSY_REG DP pipe busy counter (R): [23:0] clock counter 0x0410 001C to 0x0410 001F DPC_TMEM_REG DP TMEM load counter (R): [23:0] clock counter 0x0410 0020 to 0x041F FFFF Unused 0x0420 0000 to 0x042F FFFF DP span registers: ---------------------------------------------- DPS_BASE_REG - 0x04200000 0x0420 0000 to 0x0420 0003 DPS_TBIST_REG DP tmem bist (W): [0] BIST check (R): [0] BIST check [1] BIST go [1] BIST go [2] BIST clear [2] BIST done [10:3] BIST fail 0x0420 0004 to 0x0420 0007 DPS_TEST_MODE_REG DP span test mode (RW): [0] Span buffer test access enable 0x0420 0008 to 0x0420 000B DPS_BUFTEST_ADDR_REG DP span buffer test address (RW): [6:0] bits 0x0420 000C to 0x0420 000F DPS_BUFTEST_DATA_REG DP span buffer test data (RW): [31:0] span buffer data 0x0420 0010 to 0x042F FFFF Unused 0x0430 0000 to 0x043F FFFF MIPS interface (MI) registers: ---------------------------------------------------------- MI_BASE_REG - 0x04300000 0x0430 0000 to 0x0430 0003 MI_INIT_MODE_REG or MI_MODE_REG MI init mode (W): [6:0] init length (R): [6:0] init length [7] clear init mode [7] init mode [8] set init mode [8] ebus test mode [9/10] clr/set ebus test mode [9] RDRAM reg mode [11] clear DP interrupt [12] clear RDRAM reg [13] set RDRAM reg mode 0x0430 0004 to 0x0430 0007 MI_VERSION_REG or MI_NOOP_REG MI version (R): [7:0] io [15:8] rac [23:16] rdp [31:24] rsp 0x0430 0008 to 0x0430 000B MI_INTR_REG MI interrupt (R): [0] SP intr [1] SI intr [2] AI intr [3] VI intr [4] PI intr [5] DP intr 0x0430 000C to 0x0430 000F MI_INTR_MASK_REG MI interrupt mask (W): [0/1] clear/set SP mask (R): [0] SP intr mask [2/3] clear/set SI mask [1] SI intr mask [4/5] clear/set AI mask [2] AI intr mask [6/7] clear/set VI mask [3] VI intr mask [8/9] clear/set PI mask [4] PI intr mask [10/11] clear/set DP mask [5] DP intr mask 0x0430 0010 to 0x043F FFFF Unused 0x0440 0000 to 0x044F FFFF Video interface (VI) registers: ----------------------------------------------------------- VI_BASE_REG - 0x04400000 0x0440 0000 to 0x0440 0003 VI_STATUS_REG or VI_CONTROL_REG VI status/control (RW): [1:0] type[1:0] (pixel size) 0: blank (no data, no sync) 1: reserved 2: 5/5/5/3 ("16" bit) 3: 8/8/8/8 (32 bit) [2] gamma_dither_enable (normally on, unless "special effect") [3] gamma_enable (normally on, unless MPEG/JPEG) [4] divot_enable (normally on if antialiased, unless decal lines) [5] reserved - always off [6] serrate (always on if interlaced, off if not) [7] reserved - diagnostics only [9:8] anti-alias (aa) mode[1:0] 0: aa & resamp (always fetch extra lines) 1: aa & resamp (fetch extra lines if needed) 2: resamp only (treat as all fully covered) 3: neither (replicate pixels, no interpolate) [11] reserved - diagnostics only [15:12] reserved 0x0440 0004 to 0x0440 0007 VI_ORIGIN_REG or VI_DRAM_ADDR_REG VI origin (RW): [23:0] frame buffer origin in bytes 0x0440 0008 to 0x0440 000B VI_WIDTH_REG or VI_H_WIDTH_REG VI width (RW): [11:0] frame buffer line width in pixels 0x0440 000C to 0x0440 000F VI_INTR_REG or VI_V_INTR_REG VI vertical intr (RW): [9:0] interrupt when current half-line = V_INTR 0x0440 0010 to 0x0440 0013 VI_CURRENT_REG or VI_V_CURRENT_LINE_REG VI current vertical line (RW): [9:0] current half line, sampled once per line (the lsb of V_CURRENT is constant within a field, and in interlaced modes gives the field number - which is constant for non-interlaced modes) - Writes clears interrupt line 0x0440 0014 to 0x0440 0017 VI_BURST_REG or VI_TIMING_REG VI video timing (RW): [7:0] horizontal sync width in pixels [15:8] color burst width in pixels [19:16] vertical sync width in half lines [29:20] start of color burst in pixels from h-sync 0x0440 0018 to 0x0440 001B VI_V_SYNC_REG VI vertical sync (RW): [9:0] number of half-lines per field 0x0440 001C to 0x0440 001F VI_H_SYNC_REG VI horizontal sync (RW): [11:0] total duration of a line in 1/4 pixel [20:16] a 5-bit leap pattern used for PAL only (h_sync_period) 0x0440 0020 to 0x0440 0023 VI_LEAP_REG or VI_H_SYNC_LEAP_REG VI horizontal sync leap (RW): [11:0] identical to h_sync_period [27:16] identical to h_sync_period 0x0440 0024 to 0x0440 0027 VI_H_START_REG or VI_H_VIDEO_REG VI horizontal video (RW): [9:0] end of active video in screen pixels [25:16] start of active video in screen pixels 0x0440 0028 to 0x0440 002B VI_V_START_REG or VI_V_VIDEO_REG VI vertical video (RW): [9:0] end of active video in screen half-lines [25:16] start of active video in screen half-lines 0x0440 002C to 0x0440 002F VI_V_BURST_REG VI vertical burst (RW): [9:0] end of color burst enable in half-lines [25:16] start of color burst enable in half-lines 0x0440 0030 to 0x0440 0033 VI_X_SCALE_REG VI x-scale (RW): [11:0] 1/horizontal scale up factor (2.10 format) [27:16] horizontal subpixel offset (2.10 format) 0x0440 0034 to 0x0440 0037 VI_Y_SCALE_REG VI y-scale (RW): [11:0] 1/vertical scale up factor (2.10 format) [27:16] vertical subpixel offset (2.10 format) 0x0440 0038 to 0x044F FFFF Unused 0x0450 0000 to 0x045F FFFF Audio interface (AI) registers: ----------------------------------------------------------- AI_BASE_REG - 0x04500000 0x0450 0000 to 0x0450 0003 AI_DRAM_ADDR_REG AI DRAM address (W): [23:0] starting RDRAM address (8B-aligned) 0x0450 0004 to 0x0450 0007 AI_LEN_REG AI length (RW): [14:0] transfer length (v1.0) - Bottom 3 bits are ignored [17:0] transfer length (v2.0) - Bottom 3 bits are ignored 0x0450 0008 to 0x0450 000B AI_CONTROL_REG AI control (W): [0] DMA enable - if LSB == 1, DMA is enabled 0x0450 000C to 0x0450 000F AI_STATUS_REG AI status (R): [31]/[0] ai_full (addr & len buffer full) [30] ai_busy Note that a 1to0 transition in ai_full will set interrupt (W): clear audio interrupt 0x0450 0010 to 0x0450 0013 AI_DACRATE_REG AI DAC sample period register (W): [13:0] dac rate - vid_clock/(dperiod + 1) is the DAC sample rate - (dperiod + 1) >= 66 * (aclockhp + 1) must be true 0x0450 0014 to 0x0450 0017 AI_BITRATE_REG AI bit rate (W): [3:0] bit rate (abus clock half period register - aclockhp) - vid_clock/(2*(aclockhp + 1)) is the DAC clock rate - The abus clock stops if aclockhp is zero 0x0450 0018 to 0x045F FFFF Unused 0x0460 0000 to 0x046F FFFF Peripheral interface (PI) registers: ---------------------------------------------------------------- PI_BASE_REG - 0x04600000 0x0460 0000 to 0x0460 0003 PI_DRAM_ADDR_REG PI DRAM address (RW): [23:0] starting RDRAM address 0x0460 0004 to 0x0460 0007 PI_CART_ADDR_REG PI pbus (cartridge) address (RW): [31:0] starting AD16 address 0x0460 0008 to 0x0460 000B PI_RD_LEN_REG PI read length (RW): [23:0] read data length 0x0460 000C to 0x0460 000F PI_WR_LEN_REG PI write length (RW): [23:0] write data length 0x0460 0010 to 0x0460 0013 PI_STATUS_REG PI status (R): [0] DMA busy (W): [0] reset controller [1] IO busy (and abort current op) [2] error [1] clear intr 0x0460 0014 to 0x0460 0017 PI_BSD_DOM1_LAT_REG or PI_DOMAIN1_REG PI dom1 latency (RW): [7:0] domain 1 device latency 0x0460 0018 to 0x0460 001B PI_BSD_DOM1_PWD_REG PI dom1 pulse width (RW): [7:0] domain 1 device R/W strobe pulse width 0x0460 001C to 0x0460 001F PI_BSD_DOM1_PGS_REG PI dom1 page size (RW): [3:0] domain 1 device page size 0x0460 0020 to 0x0460 0023 PI_BSD_DOM1_RLS_REG PI dom1 release (RW): [1:0] domain 1 device R/W release duration 0x0460 0024 to 0x0460 0027 PI_BSD_DOM2_LAT_REG or PI_DOMAIN2_REG PI dom2 latency (RW): [7:0] domain 2 device latency 0x0460 0028 to 0x0460 002B PI_BSD_DOM2_PWD_REG PI dom2 pulse width (RW): [7:0] domain 2 device R/W strobe pulse width 0x0460 002C to 0x0460 002F PI_BSD_DOM2_PGS_REG PI dom2 page size (RW): [3:0] domain 2 device page size 0x0460 0030 to 0x0460 0033 PI_BSD_DOM2_RLS_REG PI dom2 release (RW): [1:0] domain 2 device R/W release duration 0x0460 0034 to 0x046F FFFF Unused 0x0470 0000 to 0x047F FFFF RDRAM interface (RI) registers: ----------------------------------------------------------- RI_BASE_REG - 0x04700000 0x0470 0000 to 0x0470 0003 RI_MODE_REG RI mode (RW): [1:0] operating mode [2] stop T active [3] stop R active 0x0470 0004 to 0x0470 0007 RI_CONFIG_REG RI config (RW): [5:0] current control input [6] current control enable 0x0470 0008 to 0x0470 000B RI_CURRENT_LOAD_REG RI current load (W): [] any write updates current control register 0x0470 000C to 0x0470 000F RI_SELECT_REG RI select (RW): [2:0] receive select [2:0] transmit select 0x0470 0010 to 0x0470 0013 RI_REFRESH_REG or RI_COUNT_REG RI refresh (RW): [7:0] clean refresh delay [15:8] dirty refresh delay [16] refresh bank [17] refresh enable [18] refresh optimize 0x0470 0014 to 0x0470 0017 RI_LATENCY_REG RI latency (RW): [3:0] DMA latency/overlap 0x0470 0018 to 0x0470 001B RI_RERROR_REG RI error (R): [0] nack error [1] ack error 0x0470 001C to 0x0470 001F RI_WERROR_REG RI error (W): [] any write clears all error bits 0x0470 0020 to 0x047F FFFF Unused 0x0480 0000 to 0x048F FFFF Serial interface (SI) registers: ------------------------------------------------------------ SI_BASE_REG - 0x04800000 0x0480 0000 to 0x0480 0003 SI_DRAM_ADDR_REG SI DRAM address (R/W): [23:0] starting RDRAM address 0x0480 0004 to 0x0480 0007 SI_PIF_ADDR_RD64B_REG SI address read 64B (W): [] any write causes a 64B DMA write 0x0480 0008 to 0x0480 000B Reserved 0x0480 000C to 0x0480 000F Reserved 0x0480 0010 to 0x0480 0013 SI_PIF_ADDR_WR64B_REG SI address write 64B (W): [] any write causes a 64B DMA read 0x0480 0014 to 0x0480 0017 Reserved 0x0480 0018 to 0x0480 001B SI_STATUS_REG SI status (W): [] any write clears interrupt (R): [0] DMA busy [1] IO read busy [2] reserved [3] DMA error [12] interrupt 0x0480 001C to 0x048F FFFF Unused Unused: ------- 0x0490 0000 to 0x04FF FFFF Unused Cartridge Domain 2(Address 1): ------------------------------ 0x0500 0000 to 0x05FF FFFF Cartridge Domain 2 0x0500 0508 - some roms read from this address. SRAM could be here Cartridge Domain 1(Address 1): ------------------------------ 0x0600 0000 to 0x07FF FFFF Cartridge Domain 1 This address seems to be where the n64ddrive would be addressed 0x0800 0000 to 0x0FFF FFFF Cartridge Domain 2 SRAM could be here Cartridge Domain 1(Address 2): ------------------------------ 0x1000 0000 to 0x1000 003F ROM header: --------------------------------------- 0x1000 0000 initial PI_BSB_DOM1_LAT_REG value 0x1000 0001 initial PI_BSB_DOM1_PGS_REG value 0x1000 0002 initial PI_BSB_DOM1_PWD_REG value 0x1000 0003 initial PI_BSB_DOM1_PGS_REG value 0x1000 0004 to 0x1000 0007 Clock Rate 0x1000 0008 to 0x1000 000B Boot address offset 0x1000 000C to 0x1000 000F Release offset 0x1000 0010 to 0x1000 0013 CRC1 0x1000 0014 to 0x1000 0017 CRC2 0x1000 0018 to 0x1000 001F Unused 0x1000 0020 to 0x1000 0033 Image name 0x1000 0034 to 0x1000 003A Unused 0x1000 003B Manufacturer ID 0x1000 003C to 0x1000 003D Cartridge ID 0x1000 003E Country code 0x1000 003F Unused 0x1000 0040 to 0x1000 0B6F RAMROM_BOOTSTRAP_OFFSET 0x1000 0B70 to 0x1000 0FEF RAMROM_FONTDATA_OFFSET 0x1000 0FF0 to 0x1000 0FFF Unused 0x1000 1000 to 0x10FF 9FFF RAMROM_GAME_OFFSET 0x10FF A000 to 0x10FF AFFF RAMROM_APP_READ_ADDR 0x10FF B000 to 0x10FF BFFF RAMROM_APP_WRITE_ADDR 0x10FF C000 to 0x10FF CFFF RAMROM_RMON_READ_ADDR 0x10FF D000 to 0x10FF DFFF RAMROM_RMON_WRITE_ADDR 0x10FF E000 to 0x10FF EFFF RAMROM_PRINTF_ADDR 0x10FF F000 to 0x10FF FFFF RAMROM_LOG_ADDR 0x1100 0000 to 0x17FF FFFF Unused 0x1800 0000 to 0x1800 0003 GIO Interrupt Register (R) 0x1800 0004 to 0x1800 03FF Unused 0x1800 0400 to 0x1800 0403 GIO Sync Register (R/W) 0x1800 0404 to 0x1800 07FF Unused 0x1800 0800 to 0x1800 0803 Cartridge interrupt Register (R) 0x1800 0804 to 0x1F39 FFFF Unused PIF Boot ROM: ------------- 0x1FC0 0000 PIF_ROM_START 0x1FC0 07BF PIF_ROM_END PIF (JoyChannel) RAM: --------------------- 0x1FC0 07C0 PIF_RAM_START 0x1FC0 07C4 (16 low bits) Status of controller: %X X X X X X X X X X X X X X X X A B Z ST U D L R ? ? PL PR CU CD CL CR A,B,Z,ST = A,B,Z, Start buttons U,D,L,R = Joypad directions ?,? = Unknown PL,PR = Pan left, Pan right buttons CU,CD,CL,CR = C buttons (up,down,left,right) 0x1FC0 07FF PIF_RAM_END Reserved: --------- 0x1FC0 0800 to 0x1FCF FFFF Reserved Cartridge Domain 1(Address 3): ------------------------------ 0x1FD0 0000 to 0x7FFF FFFF Unknown 0x8000 0000 to 0xffff ffff external SysAD device ------------------------------------------------- 0x8000 0000 to 0x9FFF FFFF kseg0 (Mirror of 0x0000 0000 to 0x1FFF FFFF) 0xA000 0000 to 0xBFFF FFFF kseg1 (Mirror of 0x0000 0000 to 0x1FFF FFFF) 0xC000 0000 to 0xDFFF FFFF ksseg (TLB mapped) 0xE000 0000 to 0xFFFF FFFF kseg3 (TLB mapped) *********************************************************************** ***************************** REGISTERS ***************************** *********************************************************************** Main CPU registers: ------------------- 00h = r0/reg0 08h = t0/reg8 10h = s0/reg16 18h = t8/reg24 01h = at/reg1 09h = t1/reg9 11h = s1/reg17 19h = t9/reg25 02h = v0/reg2 0Ah = t2/reg10 12h = s2/reg18 1Ah = k0/reg26 03h = v1/reg3 0Bh = t3/reg11 13h = s3/reg19 1Bh = k1/reg27 04h = a0/reg4 0Ch = t4/reg12 14h = s4/reg20 1Ch = gp/reg28 05h = a1/reg5 0Dh = t5/reg13 15h = s5/reg21 1Dh = sp/reg29 06h = a2/reg6 0Eh = t6/reg14 16h = s6/reg22 1Eh = s8/reg30 07h = a3/reg7 0Fh = t7/reg15 17h = s7/reg23 1Fh = ra/reg31 COP0 registers: --------------- 00h = Index 08h = BadVAddr 10h = Config 18h = *RESERVED* 01h = Random 09h = Count 11h = LLAddr 19h = *RESERVED* 02h = EntryLo0 0Ah = EntryHi 12h = WatchLo 1Ah = PErr 03h = EntryLo1 0Bh = Compare 13h = WatchHi 1Bh = CacheErr 04h = Context 0Ch = Status 14h = XContext 1Ch = TagLo 05h = PageMask 0Dh = Cause 15h = *RESERVED* 1Dh = TagHi 06h = Wired 0Eh = EPC 16h = *RESERVED* 1Eh = ErrorEPC 07h = *RESERVED* 0Fh = PRevID 17h = *RESERVED* 1Fh = *RESERVED* **************************************************************************** ** Explanations ** **************************************************************************** rs = 5-bit source register specifier rt = 5-bit target (source/destination) register or branch condition rd = 5-bit destination register specifier sa = 5-bit shift amount fs = 5-bit floating point source register specifier ft = 5-bit floating point target (source/destination) register or branch condition fd = 5-bit floating point destination register specifier base = 5-bit value imm = 16 bit immediate value offset = 16 bit branch displacement or address displacement target = 26 bit jump target address = Equal to > Greater than >= Greater than or equal to <> Not equal to < Less than <= Less than or equal to **************************************************************************** ** Load and Store Instructions ** **************************************************************************** LB rt,offset(base) Load Byte LBU rt,offset(base) Load Byte Unsigned LD rt,offset(base) Load Doubleword LDL rt,offset(base) Load Doubleword Left LDR rt,offset(base) Load Doubleword Right LH rt,offset(base) Load Halfword LHU rt,offset(base) Load Halfword Unsigned LL rt,offset(base) Load Linked word LLD rt,offset(base) Load Linked Doubleword LW rt,offset(base) Load Word LWL rt,offset(base) Load Word Left LWR rt,offset(base) Load Word Right LWU rt,offset(base) Load Word Unsigned SB rt,offset(base) Store Byte SC rt,offset(base) Store Conditional word SCD rt,offset(base) Store Conditional Doubleword SD rt,offset(base) Store Doubleword SDL rt,offset(base) Store Doubleword Left SDR rt,offset(base) Store Doubleword Right SH rt,offset(base) Store Halfword SW rt,offset(base) Store Word SWL rt,offset(base) Store Word Left SWR rt,offset(base) Store Word Right SYNC SYNChronize shared memory **************************************************************************** ** Atithmetic Instructions ** **************************************************************************** ADD rd,rs,rt ADD word ADDI rt,rs,imm ADD Immediate word ADDIU rt,rs,imm Add Immediate Unsigned word ADDU rd,rs,rt Add Unsigned word AND rd,rs,rt AND ANDI rt,rs,imm AND Immediate DADD rd,rs,rt Doubleword ADD DADDI rt,rs,imm Doubleword ADD Immediate DADDIU rt,rs,imm Doubleword ADD Immediate Unsigned DADDU rd,rs,rt Doubleword ADD Unsigned DDIV rs,rt Doubleword DIVide DDIVU rs,rt Doubleword DIVide Unsigned DIV rs,rt DIVide word DIVU rs,rt DIVide Unsigned word DMULT rs,rt Doubleword MULTiply DMULTU rs,rt Doubleword MULTiply Unsigned DSLL rd,rt,sa Doubleword Shift Left Logical DSLL32 rd,rt,sa Doubleword Shift Left Logical +32 DSLLV rd,rt,rs Doubleword Shift Left Logical Variable DSRA rd,rt,sa Doubleword Shift Right Arithmetic DSRA32 rd,rt,sa Doubleword Shift Right Arithmetic +32 DSRAV rd,rt,rs Doubleword Shift Right Arithmetic Variable DSRL rd,rt,sa Doubleword Shift Right Logical DSRL32 rd,rt,sa Doubleword Shift Right Logical +32 DSRLV rd,rt,rs Doubleword Shift Right Logical Variable DSUB rd,rs,rt Doubleword SUBtract DSUBU rd,rs,rt Doubleword SUBtract Unsigned LUI rt,imm Load Upper Immediate MFHI rd Move From HI register MFLO rd Move From LO register MTHI rd Move To HI register MTLO rd Move To LO register MULT rs,rt MULTiply word MULTU rs,rt MULTiply Unsigned word NOR rd,rs,rt Not OR OR rd,rs,rt OR ORI rt,rs,imm OR Immediate SLL rd,rt,sa Shift word Left Logical SLLV rd,rt,rs Shift word Left Logical Variable SLT rd,rs,rt Set on Less Than SLTI rt,rs,imm Set on Less Than Immediate SLTIU rt,rs,imm Set on Less Than Immediate Unsigned SLTU rd,rs,rt Set on Less Than Unsigned SRA rd,rt,sa Shift word Right Arithmetic SRAV rd,rt,rs Shift word Right Arithmetic Variable SRL rd,rt,sa Shift word Right Logical SRLV rd,rt,rs Shift word Right Logical Variable SUB rd,rs,rt SUBtract word SUBU rd,rs,rt SUBtract Unsigned word XOR rd,rs,rt eXclusive OR XORI rt,rs,imm eXclusive OR Immediate **************************************************************************** ** Jump and Branch Instructions ** **************************************************************************** BEQ rs,rt,offset Branch on = BEQL rs,rt,offset Branch on EQual Likely BGEZ rs,offset Branch on >= Zero BGEZAL rs,offset Branch on >= Zero And Link BGEZALL rs,offset Branch on >= Zero And Link Likely BGEZL rs,offset Branch on >= Equal to Zero Likely BGTZ rs,offset Branch on > Zero BGTZL rs,offset Branch on > Zero Likely BLEZ rs,offset Branch on <= Equal to Zero BLEZL rs,offset Branch on <= Zero Likely BLTZ rs,offset Branch on < Zero BLTZAL rs,offset Branch on < Zero And Link BLTZALL rs,offset Branch on < Zero And Link Likely BLTZL rs,offset Branch on < Zero Likely BNE rs,rt,offset Branch on <> BNEL rs,rt,offset Branch on <> Likely J target Jump JAL target Jump And Link JALR rs,rd Jump And Link Register JR rs Jump Register **************************************************************************** ** Special Instructions ** **************************************************************************** BREAK offset BREAKpoint SYSCALL offset SYStem CALL **************************************************************************** ** Exception Instructions ** **************************************************************************** TEQ rs,rt Trap if = TEQI rs,imm Trap if = Immediate TGE rs,rt Trap if >= TGEI rs,imm Trap if >= Immediate TGEIU rs,imm Trap if >= Immediate Unsigned TGEU rs,rt Trap if >= Unsigned TLT rs,rt Trap if < TLTI rs,imm Trap if < Immediate TLTIU rs,imm Trap if < Immediate Unsigned TLTU rs,rt Trap if < Unsigned TNE rs,rt Trap if <> TNEI rs,imm Trap if <> Immediate **************************************************************************** ** System Control Processor (COP0) Instructions ** **************************************************************************** CACHE op,offset(base) CACHE ERET Return from Exception MFC0 rt,fs Move Word From CP0 MTC0 rt,fs Move Word To CP0 TLBP Probe TLB for Matching Entry TLBR Read Indexed TLB Entry TLBWI Write Indexed TLB Entry TLBWR Write Random TLB Entry **************************************************************************** ** Floating-point Unit, FPU (COP1) instructions ** **************************************************************************** ABS.fmt fd,fs floating-point ABSolute value ADD.fmt fd,fs,ft floating-point ADD BC1F offset Branch on FP False BC1FL offset Branch on FP False Likely BC1T offset Branch on FP True BC1TL offset Branch on FP True Likely C.cond.fmt fs,ft floating-point floating point Compare CEIL.L.fmt fd,fs floating-point CEILing convert to Long fixed-point CEIL.W.fmt fd,fs floating-point CEILing convert to Word fixed-point CFC1 rt,fs Move control word From Floating-Point CTC1 rt,fs Move control word To Floating-Point CVT.D.fmt fd,fs floating-point ConVerT to Double floating-point CVT.L.fmt fd,fs floating-point ConVerT to Long fixed-point CVT.S.fmt fd,fs floating-point ConVerT to Single floating-point CVT.W.fmt fd,fs floating-point ConVerT to Word fixed-point DIV.fmt fd,fs,ft floating-point DIVide DMFC1 rt,fs Doubleword Move From Floating-Point DMTC1 rt,fs Doubleword Move To Floating-Point FLOOR.L.fmt fd,fs floating-point FLOOR convert to Long fixed-point FLOOR.W.fmt fd,fs floating-point FLOOR convert to Word fixed-point LDC1 ft,offset(base) Load Doubleword to Floating-Point LWC1 ft,offset(base) Load Word to Floating-Point MFC1 rt,fs Move Word From Floating-Point MOV.fmt fd,fs floating-point MOVe MTC1 rt,fs Move Word To Floating-Point MUL.fmt fd,fs,ft floating-point MULtiply NEG.fmt fd,fs floating-point NEGate ROUND.L.fmt fd,fs floating-point ROUND to Long fixed-point ROUND.W.fmt fd,fs floating-point ROUND to Word fixed-point SDC1 ft,offset(base) Store Doubleword from Floating-Point SQRT.fmt fd,fs floating-point SQuare RooT SUB.fmt fd,fs,ft floating-point SUBtract SWC1 ft,offset(base) Store Word from Floating-Point TRUNC.L.fmt fd,fs floating-point TRUNCate to Long fixed-point TRUNC.W.fmt fd,fs floating-point TRUNCate to Word fixed-point **************************************************************************** ** Pseudo opcodes ** **************************************************************************** NOP Assembles to SLL r0, r0, 0 MOVE rd, rs Assembles to ADD rd, r0, rs NEG rd, rt Assembles to SUB rd, r0, rt NEGU rd, rs Assembles to SUBU rd, r0, rs BNEZ rs, offset Assembles to BNE rs, r0, offset BNEZL rs, offset Assembles to BNEL rs, r0, offset BEQZ rs, offset Assembles to BEQ rs, r0, offset BEQZL rs, offset Assembles to BEQL rs, r0, offset B offset Assembles to BEQ r0, r0, offset BAL offset Assembles to BGEZAL r0, offset LI rt, imm Assembles to ORI rt, r0, imm (if imm is 16 bit) or ADDIU rt, r0, imm or LUI rt, high_16 ORI rt, rt, low_16 (if imm is 32 bit) S.S ft, offset(base) Assembles to SWC1 ft, offset(base) L.S ft, offset(base) Assembles to LWC1 ft, offset(base) *********************************************************************** ***************************** CONTROLLER **************************** *********************************************************************** You first have to set 2 places in memory that contains 64 bytes of certain values, lets call them pif1 and pif2. they contain the values : pif1: DW $FF010401 DW $00000000 DW $FF010401 DW $00000000 DW $FF010401 DW $00000000 DW $FF010401 DW $00000000 DW $FE000000 DW $00000000 DW $00000000 DW $00000000 DW $00000000 DW $00000000 DW $00000000 DW $00000001 pif2: DW 0,0,0,0,0,0,0,0 ;by words we mean 32bits! DW 0,0,0,0,0,0,0,0 ;I think this is 64 bytes.. You need to initialize this register before starting (your program will run few a few seconds then die if not done) addiu t0,r0,8 lui at,$BFC0 sw t0,$07FC(at) ;CLEAR BUTTONS move #8,$BFC007FC now when you start your program and begin your main loop the begginning of the loop should begin with (if you want to read joysticks): START: lui t2,$0031 ;t2 = if org is 80310000 then $0031 ; if org is 80200000 then $0020 ;I myself am still confused bout ;how ram is mirrored in the system ;but this is how it is ori t2,t2,pif1 ;lower 16 bits pointer to pif1 lui at,$A480 ;SI DRAM ADDR. at=$A4800000 sw t2,$0000(at) ; pif1 lui t2,$1FC0 ori t2,t2,$07C0 ;t2=$1fc007c0 lui at,$A480 sw t2,$0010(at) ;64B DRAM -> PIF ;poke them thar ;registers arrrrr [...do your stuff in here, then when ready to loop back do this to test josticks...] lui t2,$0031 ;look familiar ori t2,t2,pif2 lui at,$A480 ;SI DRAM ADDR sw t2,$0000(at) ;$31pif2 lui t2,$1FC0 ori t2,t2,$07C0 ;PIF joychannel lui at,$A480 sw t2,$0004(at) ;64B PIF->DRAM ;peek values to dram ? i ;guess this is necassary lui t1,$BFC0 lbu t1,$07FF(t1) ;BYTE(JOY)-T1 ;for some reason this ;is done but I dont know why! lui t0,$BFC0 ;the value is disregarded lhu t0,$07C4(t0) ;**HWORD(JOY)->T0** nop beq t0,r0,START ;***we have our joystick value in t0*** nop ;if no buttons mashed then start over andi t1,t0,$4000 ;each bit represents a button so ;start testing them beq t1,r0,next1 ;I used to know what each bit represented ; (what button) but I lost the info nop ;andi $4000 /$8000 A/B $100/$200 left/right etc... ; I think this is right I [routine] ;might have it backwords or somethin next1: etc.. etc.. ;there are a couple of bits that i ;dont know what they do. ;havent figured out where the ;analog joy data is. -------------------------------------------------------------------------- at 0x1FC0 07C4 - 07c5 is the status of the controller, each bit is 1 when the button is mashed, 0 otherwise. 07C4 (HALFWORD-16 BITS) = STATUS OF CONTROLLER %X X X X X X X X X X X X X X X X A B Z ST U D L R ? ? PL PR CU CD CL CR A,B,Z =BUTTONS ST = START U,D,L,R = JOYPAD ?,? = UNKNOWN PL,PR = PAN LEFT , PAN RIGHT BUTTONS CU,CD,CL,CR = C BUTTONS |UP,DOWN,LEFT,RIGHT -------------------------------------------------------------------------- additional controller info: init controller: rdram -> pif ff010300 ffffffff ... for each controller fe000000 ... at the end (after controller 4) than pif ram is set to: ????EE?? TTTTSS?? ... for each controller ?? ... ? zero (0x00) EE ... error field 0x80: no response (no controller connected) 0x40: Overrun error (?) 0x00: no error (controller connected) TTTT ... type field 0x0001 absolute 0x0002 relative 0x0004 joyport 0x8000 eeprom !!! SS ... status field 0x01 card on 0x02 card pull 0x04 addr crc err 0x80 eeprom busy get controller data: rdram -> pif ff010400 ffffffff ... for each controller fe000000 ... at the end (after controller 4) than pif ram is set to (!!!attention!!! pif ram is actualized every read): 0xbfc007c0: ????EE?? 0xbfc007c4: BBBBXXYY 0xbfc007c8: | 0xbfc007cc: |_same as above but for controller 2 ... BBBB ... buttons (you have that in controll.txt) XX ... stick x pos [-128..127] or 0x80 (left) .. 0x00 (middle) .. 0x7f (right) YY ... stick y pos [-128..127] or 0x80 (down) .. 0x00 (middle) .. 0x7f (up) !!!attention!!! all pur versions seem NOT to have implemented the SIGNED XX and YY bytes correct. 0x80 0x81 0x82 ... 0xff 0x00 0x01 .. 0x7c 0x7e 0x7f -128 -127 -126 -1 0 1 125 126 127 left pos middle pos right pos down pos middle pos up pos !!!attention!!! *********************************************************************** ******************************* SOUND ******************************* *********************************************************************** Crazy nation trainer (xtremeG version) [we tested button and its time to make sound!] lui $t4,8031 ;make pointer to 'yes' sound addiu $t4,$t4,4F10 ;80314f10 = start addiu $t5,$zero,4A71 ;4A71=length addiu $t6,$zero,1388 ;1388= DAC rate addiu $t7,$zero,0001 ;1=BIT rate jal here nop [draw yes] ...... [we tested button and time to make 'no' sound] lui $t4,8031 ;make pointer to 'no' sound addiu $t4,$t4,12C4 ;803112C4 addiu $t5,$zero,3C45 ;3C45=length addiu $t6,$zero,1388 ;DAC rate addiu $t7,$zero,0001 ;1=BIT rate jal here nop [draw no] ..... [...initialize vid, audio] addiu $t4,$zero,0000 ;[blank out sound] addiu $t5,$zero,0000 ;initialize addiu $t6,$zero,0001 addiu $t7,$zero,0001 here: lui $t8,A450 sw $t4,0000($t8) ;start RDRAM address sw $t5,0004($t8) ;length addiu $t9,$zero,0001 sw $t9,0008($t8) ;1 = enable dma sw $t6,0010($t8) ;dac rate sw $t7,0014($t8) ;bit rate jr $ra nop