SPONSORED LINKS
***********************************************************************
***************************** ROM HEADER ****************************
***********************************************************************
0000h (1 byte): initial PI_BSB_DOM1_LAT_REG value (0x80)
0001h (1 byte): initial PI_BSB_DOM1_PGS_REG value (0x37)
0002h (1 byte): initial PI_BSB_DOM1_PWD_REG value (0x12)
0003h (1 byte): initial PI_BSB_DOM1_PGS_REG value (0x40)
0004h - 0007h (1 dword): ClockRate
0008h - 000Bh (1 dword): Program Counter (PC)
000Ch - 000Fh (1 dword): Release
0010h - 0013h (1 dword): CRC1
0014h - 0017h (1 dword): CRC2
0018h - 001Fh (2 dwords): Unknown (0x0000000000000000)
0020h - 0033h (20 bytes): Image name
Padded with 0x00 or spaces (0x20)
0034h - 0037h (1 dword): Unknown (0x00000000)
0038h - 003Bh (1 dword): Manufacturer ID
0x0000004E = Nintendo ('N')
003Ch - 003Dh (1 word): Cartridge ID
003Eh - 003Fh (1 word): Country code
0x4400 = Germany ('D')
0x4500 = USA ('E')
0x4A00 = Japan ('J')
0x5000 = Europe ('P')
0x5500 = Australia ('U')
0040h - 0FFFh (1008 dwords): Boot code
***********************************************************************
************************* MEMORY MAP OVERVIEW ***********************
***********************************************************************
0x0000 0000 to 0x03EF FFFF RDRAM Memory
0x03F0 0000 to 0x03FF FFFF RDRAM Registers
0x0400 0000 to 0x040F FFFF SP Registers
0x0410 0000 to 0x041F FFFF DP Command Registers
0x0420 0000 to 0x042F FFFF DP Span Registers
0x0430 0000 to 0x043F FFFF MIPS Interface (MI) Registers
0x0440 0000 to 0x044F FFFF Video Interface (VI) Registers
0x0450 0000 to 0x045F FFFF Audio Interface (AI) Registers
0x0460 0000 to 0x046F FFFF Peripheral Interface (PI) Registers
0x0470 0000 to 0x047F FFFF RDRAM Interface (RI) Registers
0x0480 0000 to 0x048F FFFF Serial Interface (SI) Registers
0x0490 0000 to 0x04FF FFFF Unused
0x0500 0000 to 0x05FF FFFF Cartridge Domain 2 Address 1
0x0600 0000 to 0x07FF FFFF Cartridge Domain 1 Address 1
0x0800 0000 to 0x0FFF FFFF Cartridge Domain 2 Address 2
0x1000 0000 to 0x1FBF FFFF Cartridge Domain 1 Address 2
0x1FC0 0000 to 0x1FC0 07BF PIF Boot ROM
0x1FC0 07C0 to 0x1FC0 07FF PIF RAM
0x1FC0 0800 to 0x1FCF FFFF Reserved
0x1FD0 0000 to 0x7FFF FFFF Cartridge Domain 1 Address 3
0x8000 0000 to 0xFFFF FFFF External SysAD Device
***********************************************************************
************************* MEMORY MAP DETAILED ***********************
***********************************************************************
0x0000 0000 to 0x03EF FFFF RDRAM memory:
-----------------------------------------
0x0000 0000 to 0x001F FFFF RDRAM range 0
0x0020 0000 to 0x003F FFFF RDRAM range 1
0x0040 0000 to 0x03EF FFFF Unused
0x03F0 0000 to 0x03FF FFFF RDRAM registers:
--------------------------------------------
RDRAM_BASE_REG - 0x03F00000
0x03F0 0000 to 0x03F0 0003 RDRAM_CONFIG_REG or
RDRAM_DEVICE_TYPE_REG
0x03F0 0004 to 0x03F0 0007 RDRAM_DEVICE_ID_REG
0x03F0 0008 to 0x03F0 000B RDRAM_DELAY_REG
0x03F0 000C to 0x03F0 000F RDRAM_MODE_REG
0x03F0 0010 to 0x03F0 0013 RDRAM_REF_INTERVAL_REG
0x03F0 0014 to 0x03F0 0017 RDRAM_REF_ROW_REG
0x03F0 0018 to 0x03F0 001B RDRAM_RAS_INTERVAL_REG
0x03F0 001C to 0x03F0 001F RDRAM_MIN_INTERVAL_REG
0x03F0 0020 to 0x03F0 0023 RDRAM_ADDR_SELECT_REG
0x03F0 0024 to 0x03F0 0027 RDRAM_DEVICE_MANUF_REG
0x03F0 0028 to 0x03FF FFFF Unknown
0x0400 0000 to 0x0400 FFFF SP registers:
-----------------------------------------
SP_BASE_REG - 0x04040000
0x0400 0000 to 0x0400 0FFF SP_DMEM read/write
0x0400 1000 to 0x0400 1FFF SP_IMEM read/write
0x0400 2000 to 0x0403 FFFF Unused
0x0404 0000 to 0x0404 0003 SP_MEM_ADDR_REG
Master, SP memory address
(RW): [11:0] DMEM/IMEM address
[12] 0=DMEM,1=IMEM
0x0404 0004 to 0x0404 0007 SP_DRAM_ADDR_REG
Slave, SP DRAM DMA address
(RW): [23:0] RDRAM address
0x0404 0008 to 0x0404 000B SP_RD_LEN_REG
SP read DMA length
(RW): [11:0] length
[19:12] count
[31:20] skip
direction: I/DMEM <- RDRAM
0x0404 000C to 0x0404 000F SP_WR_LEN_REG
SP write DMA length
(RW): [11:0] length
[19:12] count
[31:20] skip
direction: I/DMEM to RDRAM
0x0404 0010 to 0x0404 0013 SP_STATUS_REG
SP status
(W): [0] clear halt (R): [0] halt
[1] set halt [1] broke
[2] clear broke [2] dma busy
[3] clear intr [3] dma full
[4] set intr [4] io full
[5] clear sstep [5] single step
[6] set sstep [6] interrupt on break
[7] clear intr on break [7] signal 0 set
[8] set intr on break [8] signal 1 set
[9] clear signal 0 [9] signal 2 set
[10] set signal 0 [10] signal 3 set
[11] clear signal 1 [11] signal 4 set
[12] set signal 1 [12] signal 5 set
[13] clear signal 2 [13] signal 6 set
[14] set signal 2 [14] signal 7 set
[15] clear signal 3
[16] set signal 3
[17] clear signal 4
[18] set signal 4
[19] clear signal 5
[20] set signal 5
[21] clear signal 6
[22] set signal 6
[23] clear signal 7
[24] set signal 7
0x0404 0014 to 0x0404 0017 SP_DMA_FULL_REG
SP DMA full
(R): [0] valid bit
dma full
0x0404 0018 to 0x0404 001B SP_DMA_BUSY_REG
SP DMA busy
(R): [0] valid bit
dma busy
0x0404 001C to 0x0404 001F SP_SEMAPHORE_REG
SP semaphore
(R): [0] semaphore flag (set on read)
(W): [] clear semaphore flag
0x0404 0020 to 0x0407 FFFF Unused
0x0408 0000 to 0x0408 0003 SP_PC_REG
SP PC
(RW): [11:0] program counter
0x0408 0004 to 0x0408 0007 SP_IBIST_REG
SP IMEM BIST REG
(W): [0] BIST check (R): [0] BIST check
[1] BIST go [1] BIST go
[2] BIST clear [2] BIST done
[6:3] BIST fail
0x0408 0008 to 0x040F FFFF Unused
0x0410 0000 to 0x041F FFFF DP command registers:
-------------------------------------------------
DPC_BASE_REG - 0x04100000
0x0410 0000 to 0x0410 0003 DPC_START_REG
DP CMD DMA start
(RW): [23:0] DMEM/RDRAM start address
0x0410 0004 to 0x0410 0007 DPC_END_REG
DP CMD DMA end
(RW): [23:0] DMEM/RDRAM end address
0x0410 0008 to 0x0410 000B DPC_CURRENT_REG
DP CMD DMA end
(R): [23:0] DMEM/RDRAM current address
0x0410 000C to 0x0410 000F DPC_STATUS_REG
DP CMD status
(W): [0] clear xbus_dmem_dma (R): [0] xbus_dmem_dma
[1] set xbus_dmem_dma [1] freeze
[2] clear freeze [2] flush
[3] set freeze [3] start gclk
[4] clear flush [4] tmem busy
[5] set flush [5] pipe busy
[6] clear tmem ctr [6] cmd busy
[7] clear pipe ctr [7] cbuf ready
[8] clear cmd ctr [8] dma busy
[9] clear clock ctr [9] end valid
[10] start valid
0x0410 0010 to 0x0410 0013 DPC_CLOCK_REG
DP clock counter
(R): [23:0] clock counter
0x0410 0014 to 0x0410 0017 DPC_BUFBUSY_REG
DP buffer busy counter
(R): [23:0] clock counter
0x0410 0018 to 0x0410 001B DPC_PIPEBUSY_REG
DP pipe busy counter
(R): [23:0] clock counter
0x0410 001C to 0x0410 001F DPC_TMEM_REG
DP TMEM load counter
(R): [23:0] clock counter
0x0410 0020 to 0x041F FFFF Unused
0x0420 0000 to 0x042F FFFF DP span registers:
----------------------------------------------
DPS_BASE_REG - 0x04200000
0x0420 0000 to 0x0420 0003 DPS_TBIST_REG
DP tmem bist
(W): [0] BIST check (R): [0] BIST check
[1] BIST go [1] BIST go
[2] BIST clear [2] BIST done
[10:3] BIST fail
0x0420 0004 to 0x0420 0007 DPS_TEST_MODE_REG
DP span test mode
(RW): [0] Span buffer test access enable
0x0420 0008 to 0x0420 000B DPS_BUFTEST_ADDR_REG
DP span buffer test address
(RW): [6:0] bits
0x0420 000C to 0x0420 000F DPS_BUFTEST_DATA_REG
DP span buffer test data
(RW): [31:0] span buffer data
0x0420 0010 to 0x042F FFFF Unused
0x0430 0000 to 0x043F FFFF MIPS interface (MI) registers:
----------------------------------------------------------
MI_BASE_REG - 0x04300000
0x0430 0000 to 0x0430 0003 MI_INIT_MODE_REG or MI_MODE_REG
MI init mode
(W): [6:0] init length (R): [6:0] init length
[7] clear init mode [7] init mode
[8] set init mode [8] ebus test mode
[9/10] clr/set ebus test mode [9] RDRAM reg mode
[11] clear DP interrupt
[12] clear RDRAM reg
[13] set RDRAM reg mode
0x0430 0004 to 0x0430 0007 MI_VERSION_REG or MI_NOOP_REG
MI version
(R): [7:0] io
[15:8] rac
[23:16] rdp
[31:24] rsp
0x0430 0008 to 0x0430 000B MI_INTR_REG
MI interrupt
(R): [0] SP intr
[1] SI intr
[2] AI intr
[3] VI intr
[4] PI intr
[5] DP intr
0x0430 000C to 0x0430 000F MI_INTR_MASK_REG
MI interrupt mask
(W): [0/1] clear/set SP mask (R): [0] SP intr mask
[2/3] clear/set SI mask [1] SI intr mask
[4/5] clear/set AI mask [2] AI intr mask
[6/7] clear/set VI mask [3] VI intr mask
[8/9] clear/set PI mask [4] PI intr mask
[10/11] clear/set DP mask [5] DP intr mask
0x0430 0010 to 0x043F FFFF Unused
0x0440 0000 to 0x044F FFFF Video interface (VI) registers:
-----------------------------------------------------------
VI_BASE_REG - 0x04400000
0x0440 0000 to 0x0440 0003 VI_STATUS_REG or VI_CONTROL_REG
VI status/control
(RW): [1:0] type[1:0] (pixel size)
0: blank (no data, no sync)
1: reserved
2: 5/5/5/3 ("16" bit)
3: 8/8/8/8 (32 bit)
[2] gamma_dither_enable (normally on, unless "special effect")
[3] gamma_enable (normally on, unless MPEG/JPEG)
[4] divot_enable (normally on if antialiased,
unless decal lines)
[5] reserved - always off
[6] serrate (always on if interlaced, off if not)
[7] reserved - diagnostics only
[9:8] anti-alias (aa) mode[1:0]
0: aa & resamp (always fetch extra lines)
1: aa & resamp (fetch extra lines if needed)
2: resamp only (treat as all fully covered)
3: neither (replicate pixels, no interpolate)
[11] reserved - diagnostics only
[15:12] reserved
0x0440 0004 to 0x0440 0007 VI_ORIGIN_REG or VI_DRAM_ADDR_REG
VI origin
(RW): [23:0] frame buffer origin in bytes
0x0440 0008 to 0x0440 000B VI_WIDTH_REG or VI_H_WIDTH_REG
VI width
(RW): [11:0] frame buffer line width in pixels
0x0440 000C to 0x0440 000F VI_INTR_REG or VI_V_INTR_REG
VI vertical intr
(RW): [9:0] interrupt when current half-line = V_INTR
0x0440 0010 to 0x0440 0013 VI_CURRENT_REG or VI_V_CURRENT_LINE_REG
VI current vertical line
(RW): [9:0] current half line, sampled once per line (the lsb of
V_CURRENT is constant within a field, and in
interlaced modes gives the field number - which is
constant for non-interlaced modes)
- Writes clears interrupt line
0x0440 0014 to 0x0440 0017 VI_BURST_REG or VI_TIMING_REG
VI video timing
(RW): [7:0] horizontal sync width in pixels
[15:8] color burst width in pixels
[19:16] vertical sync width in half lines
[29:20] start of color burst in pixels from h-sync
0x0440 0018 to 0x0440 001B VI_V_SYNC_REG
VI vertical sync
(RW): [9:0] number of half-lines per field
0x0440 001C to 0x0440 001F VI_H_SYNC_REG
VI horizontal sync
(RW): [11:0] total duration of a line in 1/4 pixel
[20:16] a 5-bit leap pattern used for PAL only (h_sync_period)
0x0440 0020 to 0x0440 0023 VI_LEAP_REG or VI_H_SYNC_LEAP_REG
VI horizontal sync leap
(RW): [11:0] identical to h_sync_period
[27:16] identical to h_sync_period
0x0440 0024 to 0x0440 0027 VI_H_START_REG or VI_H_VIDEO_REG
VI horizontal video
(RW): [9:0] end of active video in screen pixels
[25:16] start of active video in screen pixels
0x0440 0028 to 0x0440 002B VI_V_START_REG or VI_V_VIDEO_REG
VI vertical video
(RW): [9:0] end of active video in screen half-lines
[25:16] start of active video in screen half-lines
0x0440 002C to 0x0440 002F VI_V_BURST_REG
VI vertical burst
(RW): [9:0] end of color burst enable in half-lines
[25:16] start of color burst enable in half-lines
0x0440 0030 to 0x0440 0033 VI_X_SCALE_REG
VI x-scale
(RW): [11:0] 1/horizontal scale up factor (2.10 format)
[27:16] horizontal subpixel offset (2.10 format)
0x0440 0034 to 0x0440 0037 VI_Y_SCALE_REG
VI y-scale
(RW): [11:0] 1/vertical scale up factor (2.10 format)
[27:16] vertical subpixel offset (2.10 format)
0x0440 0038 to 0x044F FFFF Unused
0x0450 0000 to 0x045F FFFF Audio interface (AI) registers:
-----------------------------------------------------------
AI_BASE_REG - 0x04500000
0x0450 0000 to 0x0450 0003 AI_DRAM_ADDR_REG
AI DRAM address
(W): [23:0] starting RDRAM address (8B-aligned)
0x0450 0004 to 0x0450 0007 AI_LEN_REG
AI length
(RW): [14:0] transfer length (v1.0) - Bottom 3 bits are ignored
[17:0] transfer length (v2.0) - Bottom 3 bits are ignored
0x0450 0008 to 0x0450 000B AI_CONTROL_REG
AI control
(W): [0] DMA enable - if LSB == 1, DMA is enabled
0x0450 000C to 0x0450 000F AI_STATUS_REG
AI status
(R): [31]/[0] ai_full (addr & len buffer full)
[30] ai_busy
Note that a 1to0 transition in ai_full will set interrupt
(W): clear audio interrupt
0x0450 0010 to 0x0450 0013 AI_DACRATE_REG
AI DAC sample period register
(W): [13:0] dac rate
- vid_clock/(dperiod + 1) is the DAC sample rate
- (dperiod + 1) >= 66 * (aclockhp + 1) must be true
0x0450 0014 to 0x0450 0017 AI_BITRATE_REG
AI bit rate
(W): [3:0] bit rate (abus clock half period register - aclockhp)
- vid_clock/(2*(aclockhp + 1)) is the DAC clock rate
- The abus clock stops if aclockhp is zero
0x0450 0018 to 0x045F FFFF Unused
0x0460 0000 to 0x046F FFFF Peripheral interface (PI) registers:
----------------------------------------------------------------
PI_BASE_REG - 0x04600000
0x0460 0000 to 0x0460 0003 PI_DRAM_ADDR_REG
PI DRAM address
(RW): [23:0] starting RDRAM address
0x0460 0004 to 0x0460 0007 PI_CART_ADDR_REG
PI pbus (cartridge) address
(RW): [31:0] starting AD16 address
0x0460 0008 to 0x0460 000B PI_RD_LEN_REG
PI read length
(RW): [23:0] read data length
0x0460 000C to 0x0460 000F PI_WR_LEN_REG
PI write length
(RW): [23:0] write data length
0x0460 0010 to 0x0460 0013 PI_STATUS_REG
PI status
(R): [0] DMA busy (W): [0] reset controller
[1] IO busy (and abort current op)
[2] error [1] clear intr
0x0460 0014 to 0x0460 0017 PI_BSD_DOM1_LAT_REG or PI_DOMAIN1_REG
PI dom1 latency
(RW): [7:0] domain 1 device latency
0x0460 0018 to 0x0460 001B PI_BSD_DOM1_PWD_REG
PI dom1 pulse width
(RW): [7:0] domain 1 device R/W strobe pulse width
0x0460 001C to 0x0460 001F PI_BSD_DOM1_PGS_REG
PI dom1 page size
(RW): [3:0] domain 1 device page size
0x0460 0020 to 0x0460 0023 PI_BSD_DOM1_RLS_REG
PI dom1 release
(RW): [1:0] domain 1 device R/W release duration
0x0460 0024 to 0x0460 0027 PI_BSD_DOM2_LAT_REG or PI_DOMAIN2_REG
PI dom2 latency
(RW): [7:0] domain 2 device latency
0x0460 0028 to 0x0460 002B PI_BSD_DOM2_PWD_REG
PI dom2 pulse width
(RW): [7:0] domain 2 device R/W strobe pulse width
0x0460 002C to 0x0460 002F PI_BSD_DOM2_PGS_REG
PI dom2 page size
(RW): [3:0] domain 2 device page size
0x0460 0030 to 0x0460 0033 PI_BSD_DOM2_RLS_REG
PI dom2 release
(RW): [1:0] domain 2 device R/W release duration
0x0460 0034 to 0x046F FFFF Unused
0x0470 0000 to 0x047F FFFF RDRAM interface (RI) registers:
-----------------------------------------------------------
RI_BASE_REG - 0x04700000
0x0470 0000 to 0x0470 0003 RI_MODE_REG
RI mode
(RW): [1:0] operating mode
[2] stop T active
[3] stop R active
0x0470 0004 to 0x0470 0007 RI_CONFIG_REG
RI config
(RW): [5:0] current control input
[6] current control enable
0x0470 0008 to 0x0470 000B RI_CURRENT_LOAD_REG
RI current load
(W): [] any write updates current control register
0x0470 000C to 0x0470 000F RI_SELECT_REG
RI select
(RW): [2:0] receive select
[2:0] transmit select
0x0470 0010 to 0x0470 0013 RI_REFRESH_REG or RI_COUNT_REG
RI refresh
(RW): [7:0] clean refresh delay
[15:8] dirty refresh delay
[16] refresh bank
[17] refresh enable
[18] refresh optimize
0x0470 0014 to 0x0470 0017 RI_LATENCY_REG
RI latency
(RW): [3:0] DMA latency/overlap
0x0470 0018 to 0x0470 001B RI_RERROR_REG
RI error
(R): [0] nack error
[1] ack error
0x0470 001C to 0x0470 001F RI_WERROR_REG
RI error
(W): [] any write clears all error bits
0x0470 0020 to 0x047F FFFF Unused
0x0480 0000 to 0x048F FFFF Serial interface (SI) registers:
------------------------------------------------------------
SI_BASE_REG - 0x04800000
0x0480 0000 to 0x0480 0003 SI_DRAM_ADDR_REG
SI DRAM address
(R/W): [23:0] starting RDRAM address
0x0480 0004 to 0x0480 0007 SI_PIF_ADDR_RD64B_REG
SI address read 64B
(W): [] any write causes a 64B DMA write
0x0480 0008 to 0x0480 000B Reserved
0x0480 000C to 0x0480 000F Reserved
0x0480 0010 to 0x0480 0013 SI_PIF_ADDR_WR64B_REG
SI address write 64B
(W): [] any write causes a 64B DMA read
0x0480 0014 to 0x0480 0017 Reserved
0x0480 0018 to 0x0480 001B SI_STATUS_REG
SI status
(W): [] any write clears interrupt
(R): [0] DMA busy
[1] IO read busy
[2] reserved
[3] DMA error
[12] interrupt
0x0480 001C to 0x048F FFFF Unused
Unused:
-------
0x0490 0000 to 0x04FF FFFF Unused
Cartridge Domain 2(Address 1):
------------------------------
0x0500 0000 to 0x05FF FFFF Cartridge Domain 2
0x0500 0508 - some roms read from this address.
SRAM could be here
Cartridge Domain 1(Address 1):
------------------------------
0x0600 0000 to 0x07FF FFFF Cartridge Domain 1
This address seems to be where
the n64ddrive would be addressed
0x0800 0000 to 0x0FFF FFFF Cartridge Domain 2
SRAM could be here
Cartridge Domain 1(Address 2):
------------------------------
0x1000 0000 to 0x1000 003F ROM header:
---------------------------------------
0x1000 0000 initial PI_BSB_DOM1_LAT_REG value
0x1000 0001 initial PI_BSB_DOM1_PGS_REG value
0x1000 0002 initial PI_BSB_DOM1_PWD_REG value
0x1000 0003 initial PI_BSB_DOM1_PGS_REG value
0x1000 0004 to 0x1000 0007 Clock Rate
0x1000 0008 to 0x1000 000B Boot address offset
0x1000 000C to 0x1000 000F Release offset
0x1000 0010 to 0x1000 0013 CRC1
0x1000 0014 to 0x1000 0017 CRC2
0x1000 0018 to 0x1000 001F Unused
0x1000 0020 to 0x1000 0033 Image name
0x1000 0034 to 0x1000 003A Unused
0x1000 003B Manufacturer ID
0x1000 003C to 0x1000 003D Cartridge ID
0x1000 003E Country code
0x1000 003F Unused
0x1000 0040 to 0x1000 0B6F RAMROM_BOOTSTRAP_OFFSET
0x1000 0B70 to 0x1000 0FEF RAMROM_FONTDATA_OFFSET
0x1000 0FF0 to 0x1000 0FFF Unused
0x1000 1000 to 0x10FF 9FFF RAMROM_GAME_OFFSET
0x10FF A000 to 0x10FF AFFF RAMROM_APP_READ_ADDR
0x10FF B000 to 0x10FF BFFF RAMROM_APP_WRITE_ADDR
0x10FF C000 to 0x10FF CFFF RAMROM_RMON_READ_ADDR
0x10FF D000 to 0x10FF DFFF RAMROM_RMON_WRITE_ADDR
0x10FF E000 to 0x10FF EFFF RAMROM_PRINTF_ADDR
0x10FF F000 to 0x10FF FFFF RAMROM_LOG_ADDR
0x1100 0000 to 0x17FF FFFF Unused
0x1800 0000 to 0x1800 0003 GIO Interrupt Register (R)
0x1800 0004 to 0x1800 03FF Unused
0x1800 0400 to 0x1800 0403 GIO Sync Register (R/W)
0x1800 0404 to 0x1800 07FF Unused
0x1800 0800 to 0x1800 0803 Cartridge interrupt Register (R)
0x1800 0804 to 0x1F39 FFFF Unused
PIF Boot ROM:
-------------
0x1FC0 0000 PIF_ROM_START
0x1FC0 07BF PIF_ROM_END
PIF (JoyChannel) RAM:
---------------------
0x1FC0 07C0 PIF_RAM_START
0x1FC0 07C4 (16 low bits) Status of controller:
%X X X X X X X X X X X X X X X X
A B Z ST U D L R ? ? PL PR CU CD CL CR
A,B,Z,ST = A,B,Z, Start buttons
U,D,L,R = Joypad directions
?,? = Unknown
PL,PR = Pan left, Pan right buttons
CU,CD,CL,CR = C buttons (up,down,left,right)
0x1FC0 07FF PIF_RAM_END
Reserved:
---------
0x1FC0 0800 to 0x1FCF FFFF Reserved
Cartridge Domain 1(Address 3):
------------------------------
0x1FD0 0000 to 0x7FFF FFFF Unknown
0x8000 0000 to 0xffff ffff external SysAD device
-------------------------------------------------
0x8000 0000 to 0x9FFF FFFF kseg0 (Mirror of 0x0000 0000 to 0x1FFF FFFF)
0xA000 0000 to 0xBFFF FFFF kseg1 (Mirror of 0x0000 0000 to 0x1FFF FFFF)
0xC000 0000 to 0xDFFF FFFF ksseg (TLB mapped)
0xE000 0000 to 0xFFFF FFFF kseg3 (TLB mapped)
***********************************************************************
***************************** REGISTERS *****************************
***********************************************************************
Main CPU registers:
-------------------
00h = r0/reg0 08h = t0/reg8 10h = s0/reg16 18h = t8/reg24
01h = at/reg1 09h = t1/reg9 11h = s1/reg17 19h = t9/reg25
02h = v0/reg2 0Ah = t2/reg10 12h = s2/reg18 1Ah = k0/reg26
03h = v1/reg3 0Bh = t3/reg11 13h = s3/reg19 1Bh = k1/reg27
04h = a0/reg4 0Ch = t4/reg12 14h = s4/reg20 1Ch = gp/reg28
05h = a1/reg5 0Dh = t5/reg13 15h = s5/reg21 1Dh = sp/reg29
06h = a2/reg6 0Eh = t6/reg14 16h = s6/reg22 1Eh = s8/reg30
07h = a3/reg7 0Fh = t7/reg15 17h = s7/reg23 1Fh = ra/reg31
COP0 registers:
---------------
00h = Index 08h = BadVAddr 10h = Config 18h = *RESERVED*
01h = Random 09h = Count 11h = LLAddr 19h = *RESERVED*
02h = EntryLo0 0Ah = EntryHi 12h = WatchLo 1Ah = PErr
03h = EntryLo1 0Bh = Compare 13h = WatchHi 1Bh = CacheErr
04h = Context 0Ch = Status 14h = XContext 1Ch = TagLo
05h = PageMask 0Dh = Cause 15h = *RESERVED* 1Dh = TagHi
06h = Wired 0Eh = EPC 16h = *RESERVED* 1Eh = ErrorEPC
07h = *RESERVED* 0Fh = PRevID 17h = *RESERVED* 1Fh = *RESERVED*
****************************************************************************
** Explanations **
****************************************************************************
rs = 5-bit source register specifier
rt = 5-bit target (source/destination) register or branch condition
rd = 5-bit destination register specifier
sa = 5-bit shift amount
fs = 5-bit floating point source register specifier
ft = 5-bit floating point target (source/destination)
register or branch condition
fd = 5-bit floating point destination register specifier
base = 5-bit value
imm = 16 bit immediate value
offset = 16 bit branch displacement or address displacement
target = 26 bit jump target address
= Equal to > Greater than >= Greater than or equal to
<> Not equal to < Less than <= Less than or equal to
****************************************************************************
** Load and Store Instructions **
****************************************************************************
LB rt,offset(base) Load Byte
LBU rt,offset(base) Load Byte Unsigned
LD rt,offset(base) Load Doubleword
LDL rt,offset(base) Load Doubleword Left
LDR rt,offset(base) Load Doubleword Right
LH rt,offset(base) Load Halfword
LHU rt,offset(base) Load Halfword Unsigned
LL rt,offset(base) Load Linked word
LLD rt,offset(base) Load Linked Doubleword
LW rt,offset(base) Load Word
LWL rt,offset(base) Load Word Left
LWR rt,offset(base) Load Word Right
LWU rt,offset(base) Load Word Unsigned
SB rt,offset(base) Store Byte
SC rt,offset(base) Store Conditional word
SCD rt,offset(base) Store Conditional Doubleword
SD rt,offset(base) Store Doubleword
SDL rt,offset(base) Store Doubleword Left
SDR rt,offset(base) Store Doubleword Right
SH rt,offset(base) Store Halfword
SW rt,offset(base) Store Word
SWL rt,offset(base) Store Word Left
SWR rt,offset(base) Store Word Right
SYNC SYNChronize shared memory
****************************************************************************
** Atithmetic Instructions **
****************************************************************************
ADD rd,rs,rt ADD word
ADDI rt,rs,imm ADD Immediate word
ADDIU rt,rs,imm Add Immediate Unsigned word
ADDU rd,rs,rt Add Unsigned word
AND rd,rs,rt AND
ANDI rt,rs,imm AND Immediate
DADD rd,rs,rt Doubleword ADD
DADDI rt,rs,imm Doubleword ADD Immediate
DADDIU rt,rs,imm Doubleword ADD Immediate Unsigned
DADDU rd,rs,rt Doubleword ADD Unsigned
DDIV rs,rt Doubleword DIVide
DDIVU rs,rt Doubleword DIVide Unsigned
DIV rs,rt DIVide word
DIVU rs,rt DIVide Unsigned word
DMULT rs,rt Doubleword MULTiply
DMULTU rs,rt Doubleword MULTiply Unsigned
DSLL rd,rt,sa Doubleword Shift Left Logical
DSLL32 rd,rt,sa Doubleword Shift Left Logical +32
DSLLV rd,rt,rs Doubleword Shift Left Logical Variable
DSRA rd,rt,sa Doubleword Shift Right Arithmetic
DSRA32 rd,rt,sa Doubleword Shift Right Arithmetic +32
DSRAV rd,rt,rs Doubleword Shift Right Arithmetic Variable
DSRL rd,rt,sa Doubleword Shift Right Logical
DSRL32 rd,rt,sa Doubleword Shift Right Logical +32
DSRLV rd,rt,rs Doubleword Shift Right Logical Variable
DSUB rd,rs,rt Doubleword SUBtract
DSUBU rd,rs,rt Doubleword SUBtract Unsigned
LUI rt,imm Load Upper Immediate
MFHI rd Move From HI register
MFLO rd Move From LO register
MTHI rd Move To HI register
MTLO rd Move To LO register
MULT rs,rt MULTiply word
MULTU rs,rt MULTiply Unsigned word
NOR rd,rs,rt Not OR
OR rd,rs,rt OR
ORI rt,rs,imm OR Immediate
SLL rd,rt,sa Shift word Left Logical
SLLV rd,rt,rs Shift word Left Logical Variable
SLT rd,rs,rt Set on Less Than
SLTI rt,rs,imm Set on Less Than Immediate
SLTIU rt,rs,imm Set on Less Than Immediate Unsigned
SLTU rd,rs,rt Set on Less Than Unsigned
SRA rd,rt,sa Shift word Right Arithmetic
SRAV rd,rt,rs Shift word Right Arithmetic Variable
SRL rd,rt,sa Shift word Right Logical
SRLV rd,rt,rs Shift word Right Logical Variable
SUB rd,rs,rt SUBtract word
SUBU rd,rs,rt SUBtract Unsigned word
XOR rd,rs,rt eXclusive OR
XORI rt,rs,imm eXclusive OR Immediate
****************************************************************************
** Jump and Branch Instructions **
****************************************************************************
BEQ rs,rt,offset Branch on =
BEQL rs,rt,offset Branch on EQual Likely
BGEZ rs,offset Branch on >= Zero
BGEZAL rs,offset Branch on >= Zero And Link
BGEZALL rs,offset Branch on >= Zero And Link Likely
BGEZL rs,offset Branch on >= Equal to Zero Likely
BGTZ rs,offset Branch on > Zero
BGTZL rs,offset Branch on > Zero Likely
BLEZ rs,offset Branch on <= Equal to Zero
BLEZL rs,offset Branch on <= Zero Likely
BLTZ rs,offset Branch on < Zero
BLTZAL rs,offset Branch on < Zero And Link
BLTZALL rs,offset Branch on < Zero And Link Likely
BLTZL rs,offset Branch on < Zero Likely
BNE rs,rt,offset Branch on <>
BNEL rs,rt,offset Branch on <> Likely
J target Jump
JAL target Jump And Link
JALR rs,rd Jump And Link Register
JR rs Jump Register
****************************************************************************
** Special Instructions **
****************************************************************************
BREAK offset BREAKpoint
SYSCALL offset SYStem CALL
****************************************************************************
** Exception Instructions **
****************************************************************************
TEQ rs,rt Trap if =
TEQI rs,imm Trap if = Immediate
TGE rs,rt Trap if >=
TGEI rs,imm Trap if >= Immediate
TGEIU rs,imm Trap if >= Immediate Unsigned
TGEU rs,rt Trap if >= Unsigned
TLT rs,rt Trap if <
TLTI rs,imm Trap if < Immediate
TLTIU rs,imm Trap if < Immediate Unsigned
TLTU rs,rt Trap if < Unsigned
TNE rs,rt Trap if <>
TNEI rs,imm Trap if <> Immediate
****************************************************************************
** System Control Processor (COP0) Instructions **
****************************************************************************
CACHE op,offset(base) CACHE
ERET Return from Exception
MFC0 rt,fs Move Word From CP0
MTC0 rt,fs Move Word To CP0
TLBP Probe TLB for Matching Entry
TLBR Read Indexed TLB Entry
TLBWI Write Indexed TLB Entry
TLBWR Write Random TLB Entry
****************************************************************************
** Floating-point Unit, FPU (COP1) instructions **
****************************************************************************
ABS.fmt fd,fs floating-point ABSolute value
ADD.fmt fd,fs,ft floating-point ADD
BC1F offset Branch on FP False
BC1FL offset Branch on FP False Likely
BC1T offset Branch on FP True
BC1TL offset Branch on FP True Likely
C.cond.fmt fs,ft floating-point floating point Compare
CEIL.L.fmt fd,fs floating-point CEILing convert to Long fixed-point
CEIL.W.fmt fd,fs floating-point CEILing convert to Word fixed-point
CFC1 rt,fs Move control word From Floating-Point
CTC1 rt,fs Move control word To Floating-Point
CVT.D.fmt fd,fs floating-point ConVerT to Double floating-point
CVT.L.fmt fd,fs floating-point ConVerT to Long fixed-point
CVT.S.fmt fd,fs floating-point ConVerT to Single floating-point
CVT.W.fmt fd,fs floating-point ConVerT to Word fixed-point
DIV.fmt fd,fs,ft floating-point DIVide
DMFC1 rt,fs Doubleword Move From Floating-Point
DMTC1 rt,fs Doubleword Move To Floating-Point
FLOOR.L.fmt fd,fs floating-point FLOOR convert to Long fixed-point
FLOOR.W.fmt fd,fs floating-point FLOOR convert to Word fixed-point
LDC1 ft,offset(base) Load Doubleword to Floating-Point
LWC1 ft,offset(base) Load Word to Floating-Point
MFC1 rt,fs Move Word From Floating-Point
MOV.fmt fd,fs floating-point MOVe
MTC1 rt,fs Move Word To Floating-Point
MUL.fmt fd,fs,ft floating-point MULtiply
NEG.fmt fd,fs floating-point NEGate
ROUND.L.fmt fd,fs floating-point ROUND to Long fixed-point
ROUND.W.fmt fd,fs floating-point ROUND to Word fixed-point
SDC1 ft,offset(base) Store Doubleword from Floating-Point
SQRT.fmt fd,fs floating-point SQuare RooT
SUB.fmt fd,fs,ft floating-point SUBtract
SWC1 ft,offset(base) Store Word from Floating-Point
TRUNC.L.fmt fd,fs floating-point TRUNCate to Long fixed-point
TRUNC.W.fmt fd,fs floating-point TRUNCate to Word fixed-point
****************************************************************************
** Pseudo opcodes **
****************************************************************************
NOP Assembles to SLL r0, r0, 0
MOVE rd, rs Assembles to ADD rd, r0, rs
NEG rd, rt Assembles to SUB rd, r0, rt
NEGU rd, rs Assembles to SUBU rd, r0, rs
BNEZ rs, offset Assembles to BNE rs, r0, offset
BNEZL rs, offset Assembles to BNEL rs, r0, offset
BEQZ rs, offset Assembles to BEQ rs, r0, offset
BEQZL rs, offset Assembles to BEQL rs, r0, offset
B offset Assembles to BEQ r0, r0, offset
BAL offset Assembles to BGEZAL r0, offset
LI rt, imm Assembles to ORI rt, r0, imm (if imm is 16 bit)
or ADDIU rt, r0, imm
or LUI rt, high_16
ORI rt, rt, low_16 (if imm is 32 bit)
S.S ft, offset(base) Assembles to SWC1 ft, offset(base)
L.S ft, offset(base) Assembles to LWC1 ft, offset(base)
***********************************************************************
***************************** CONTROLLER ****************************
***********************************************************************
You first have to set 2 places in memory that contains 64 bytes of
certain values, lets call them pif1 and pif2.
they contain the values :
pif1: DW $FF010401
DW $00000000
DW $FF010401
DW $00000000
DW $FF010401
DW $00000000
DW $FF010401
DW $00000000
DW $FE000000
DW $00000000
DW $00000000
DW $00000000
DW $00000000
DW $00000000
DW $00000000
DW $00000001
pif2: DW 0,0,0,0,0,0,0,0 ;by words we mean 32bits!
DW 0,0,0,0,0,0,0,0 ;I think this is 64 bytes..
You need to initialize this register before starting (your program will
run few a few seconds then die if not done)
addiu t0,r0,8
lui at,$BFC0
sw t0,$07FC(at) ;CLEAR BUTTONS
move #8,$BFC007FC
now when you start your program and begin your main loop the begginning
of the loop should begin with (if you want to read joysticks):
START:
lui t2,$0031 ;t2 = if org is 80310000 then $0031
; if org is 80200000 then $0020
;I myself am still confused bout
;how ram is mirrored in the system
;but this is how it is
ori t2,t2,pif1 ;lower 16 bits pointer to pif1
lui at,$A480 ;SI DRAM ADDR. at=$A4800000
sw t2,$0000(at) ; pif1
lui t2,$1FC0
ori t2,t2,$07C0 ;t2=$1fc007c0
lui at,$A480
sw t2,$0010(at) ;64B DRAM -> PIF ;poke them thar
;registers arrrrr
[...do your stuff in here, then when ready to
loop back do this to test josticks...]
lui t2,$0031 ;look familiar
ori t2,t2,pif2
lui at,$A480 ;SI DRAM ADDR
sw t2,$0000(at) ;$31pif2
lui t2,$1FC0
ori t2,t2,$07C0 ;PIF joychannel
lui at,$A480
sw t2,$0004(at) ;64B PIF->DRAM ;peek values to dram ? i
;guess this is necassary
lui t1,$BFC0
lbu t1,$07FF(t1) ;BYTE(JOY)-T1 ;for some reason this
;is done but I dont know why!
lui t0,$BFC0 ;the value is disregarded
lhu t0,$07C4(t0) ;**HWORD(JOY)->T0**
nop
beq t0,r0,START ;***we have our joystick value in t0***
nop ;if no buttons mashed then start over
andi t1,t0,$4000 ;each bit represents a button so
;start testing them
beq t1,r0,next1 ;I used to know what each bit represented
; (what button) but I lost the info
nop ;andi $4000 /$8000 A/B $100/$200 left/right etc...
; I think this is right I
[routine] ;might have it backwords or somethin
next1: etc.. etc..
;there are a couple of bits that i
;dont know what they do.
;havent figured out where the
;analog joy data is.
--------------------------------------------------------------------------
at 0x1FC0 07C4 - 07c5 is the status of the controller, each bit is 1 when
the button is mashed, 0 otherwise.
07C4 (HALFWORD-16 BITS) = STATUS OF CONTROLLER
%X X X X X X X X X X X X X X X X
A B Z ST U D L R ? ? PL PR CU CD CL CR
A,B,Z =BUTTONS
ST = START
U,D,L,R = JOYPAD
?,? = UNKNOWN
PL,PR = PAN LEFT , PAN RIGHT BUTTONS
CU,CD,CL,CR = C BUTTONS |UP,DOWN,LEFT,RIGHT
--------------------------------------------------------------------------
additional controller info:
init controller:
rdram -> pif
ff010300
ffffffff ... for each controller
fe000000 ... at the end (after controller 4)
than pif ram is set to:
????EE??
TTTTSS?? ... for each controller
?? ... ? zero (0x00)
EE ... error field
0x80: no response (no controller connected)
0x40: Overrun error (?)
0x00: no error (controller connected)
TTTT
... type field
0x0001 absolute
0x0002 relative
0x0004 joyport
0x8000 eeprom !!!
SS ... status field
0x01 card on
0x02 card pull
0x04 addr crc err
0x80 eeprom busy
get controller data:
rdram -> pif
ff010400
ffffffff ... for each controller
fe000000 ... at the end (after controller 4)
than pif ram is set to (!!!attention!!! pif ram is actualized every read):
0xbfc007c0: ????EE??
0xbfc007c4: BBBBXXYY
0xbfc007c8: |
0xbfc007cc: |_same as above but for controller 2
...
BBBB ... buttons (you have that in controll.txt)
XX ... stick x pos [-128..127] or 0x80 (left) .. 0x00 (middle) .. 0x7f (right)
YY ... stick y pos [-128..127] or 0x80 (down) .. 0x00 (middle) .. 0x7f (up)
!!!attention!!!
all pur versions seem NOT to have implemented the SIGNED XX and YY bytes
correct.
0x80 0x81 0x82 ... 0xff 0x00 0x01 .. 0x7c 0x7e 0x7f
-128 -127 -126 -1 0 1 125 126 127
left pos middle pos right pos
down pos middle pos up pos
!!!attention!!!
***********************************************************************
******************************* SOUND *******************************
***********************************************************************
Crazy nation trainer (xtremeG version)
[we tested button and its time to make sound!]
lui $t4,8031 ;make pointer to 'yes' sound
addiu $t4,$t4,4F10 ;80314f10 = start
addiu $t5,$zero,4A71 ;4A71=length
addiu $t6,$zero,1388 ;1388= DAC rate
addiu $t7,$zero,0001 ;1=BIT rate
jal here
nop
[draw yes]
......
[we tested button and time to make 'no' sound]
lui $t4,8031 ;make pointer to 'no' sound
addiu $t4,$t4,12C4 ;803112C4
addiu $t5,$zero,3C45 ;3C45=length
addiu $t6,$zero,1388 ;DAC rate
addiu $t7,$zero,0001 ;1=BIT rate
jal here
nop
[draw no]
.....
[...initialize vid, audio]
addiu $t4,$zero,0000 ;[blank out sound]
addiu $t5,$zero,0000 ;initialize
addiu $t6,$zero,0001
addiu $t7,$zero,0001
here: lui $t8,A450
sw $t4,0000($t8) ;start RDRAM address
sw $t5,0004($t8) ;length
addiu $t9,$zero,0001
sw $t9,0008($t8) ;1 = enable dma
sw $t6,0010($t8) ;dac rate
sw $t7,0014($t8) ;bit rate
jr $ra
nop