SPC7110 Info, Reverse Engineered by & (c) Dark Force New data added by The Dumper SPC7110 Rom Map (far east of eden zero) 40mb total: 8mb program rom (000000-0FFFFF) + 32mb data rom (100000-4FFFFF) program rom mapped to $C0:0000-$CF:FFFF/$80:0000-$8F:FFFF data rom in 8mb chunks can be mapped to hirom areas using the bank mapping regs default mapping: data rom 000000-2FFFFF mapped to $D0:0000-$FF:FFFF data decompressed from data rom by spc7110 mapped to $50:0000-$50:FFFF SPC7110 Sram Map $006000 - $007FFF sram 8k (slow rom?) $306000 - $307FFF mirrored sram from $006000 - $007FFF (fast rom?) defval: = default power-on/reset register value SPC7110 Registers, banks $00/$80 $4800 DECOMPRESSED DATA CONTINUOUS READ PORT: returns a decompressed value from bank $50 and decrements 16 bit counter value at $4809/A by 1 $4801 COMPRESSED DATA TABLE POINTER: ($0000FF) low offset, defval:00 $4802 COMPRESSED DATA TABLE POINTER: ($00FF00) high offset, defval:00 $4803 COMPRESSED DATA TABLE POINTER: ($FF0000) bank, defval:00 $4804 COMPRESSED DATA TABLE INDEX: index of 32 bit compressed data pointer (big-endian), defval:00 $4805 DECOMPRESSED DATA OFFSET: ($00FF) low byte of offset in bank $50, defval:00 $4806 DECOMPRESSED DATA OFFSET: ($FF00) high byte of offset in bank $50, defval:00 $4807 DMA CHANNEL FOR DECOMPRESSION, set to match snes dma channel used for compressed data, defval:00 $4808 C r/w option, unknown, defval:00 $4809 COMPRESSION LENGTH COUNTER: ($00FF) low byte, defval:00 write: set start counter value low byte read: get counter value low byte $480A COMPRESSION LENGTH COUNTER: ($FF00) high byte, defval:00 write: set start counter value high byte read: get counter value high byte $480B DECOMPRESSION COMMAND MODE: see decompression command modes, defval:00 $480C DECOMPRESSION FINISHED STATUS: high bit set = done, high bit clear = processing, cleared after successful read, high bit is cleared after writing to $4806, $4809/A is set to compressed data length, defval:00 ;---------- My testing leads me to believe that the direct ROM read section starts out as inactive. One of the ways to activate direct reads is to write a non-zero value to $4813. No other action need be taken. You can write a non-zero value and immediately write a zero to it and that's OK. The order of writes to $4811/2/3 don't seem to matter so long as $4813 has been written to once with a non-zero value. There may be a way to deactivate the direct reads again (maybe a decompression cycle?) but I haven't tested that. There appears to be another way to activate direct reads that is more complex but I haven't quite pinned that down yet. ;---------- $4810 DATA ROM CONTINUOUS READ PORT: returns a byte from data rom at data rom pointer location, defval:00 $4811 DATA ROM POINTER: ($0000FF) r/w low offset, defval:00 ( $4811/2/3 may increment on a $4810 read depending on data rom command mode byte ) $4812 DATA ROM POINTER: ($00FF00) r/w high offset, defval:00 $4813 DATA ROM POINTER: ($FF0000) r/w bank offset, defval:00 bank offset is zero based from start of data rom: banks $00-$3f data rom -> $10-$4f full rom ; The $4814/$4815 pair is sometimes incremented on $4810 reads (depending on data rom command mode byte) $4814 DATA ROM POINTER ADJUST: ($00FF) low byte, defval:00 (Pointer is 16-bits - wraps at 16-bits) $4815 DATA ROM POINTER ADJUST: ($FF00) high byte, defval:00 (Addition with $4811/2/3 is 24-bits) $4816 DATA ROM POINTER INCREMENT: ($00FF) low byte, defval:00 $4817 DATA ROM POINTER INCREMENT: ($FF00) high byte, defval:00 $4818 DATA ROM COMMAND MODE: bit field control of data rom pointer (see data rom command mode byte), defval:00 write: set command mode, read: performs action instead of returning value, unknown purpose, command mode is loaded to $4818 but only set after writing to both $4814 and $4815 in any order $481A DATA ROM READ AFTER ADJUST PORT: returns a byte from data rom at data rom pointer location + adjust value ($4814/5), defval:00 $4820 16 BIT MULTIPLICAND: ($00FF) low byte, defval:00 32 BIT DIVIDEND: ($000000FF) low byte of low word, defval:00 $4821 16 BIT MULTIPLICAND: ($FF00) high byte, defval:00 32 BIT DIVIDEND: ($0000FF00) high byte of low word, defval:00 $4822 32 BIT DIVIDEND: ($00FF0000) low byte of high word, defval:00 $4823 32 BIT DIVIDEND: ($FF000000) high byte of high word, defval:00 $4824 16 BIT MULTIPLIER: ($00FF) low byte, defval:00 $4825 16 BIT MULTIPLIER: ($FF00) high byte, defval:00 $4826 16 BIT DIVISOR: ($00FF), defval:00 $4827 16 BIT DIVISOR: ($FF00), defval:00 $4828 32 BIT PRODUCT: ($000000FF) low byte of low word, defval:00 32 BIT QUOTIENT:($000000FF) low byte of low word, defval:00 $4829 32 BIT PRODUCT: ($0000FF00) high byte of low word, defval:00 32 BIT QUOTIENT:($0000FF00) high byte of low word, defval:00 $482A 32 BIT PRODUCT: ($00FF0000) low byte of high word, defval:00 32 BIT QUOTIENT:($00FF0000) low byte of high word, defval:00 $482B 32 BIT PRODUCT: ($FF000000) high byte of high word, defval:00 32 BIT QUOTIENT:($FF000000) high byte of high word, defval:00 $482C 16 BIT REMAINDER: ($00FF) low byte, defval:00 $482D 16 BIT REMAINDER: ($FF00) high byte, defval:00 $482E MUL/DIV RESET, write = reset $4820 to $482D, defval:00 $482F MUL/DIV FINISHED STATUS: high bit, on = processing, off = finished, high bit is set after a write to multiplier or divisor regs $4825/$4827, defval:00 $4830 SRAM CHIP ENABLE/DISABLE: high bit, on = enable, off = disable, defval:00 $4831 ROM BANK MAPPING A $D0:0000-$DF:FFFF, see bank mapping modes, defval:00 $4832 ROM BANK MAPPING B $E0:0000-$EF:FFFF, see bank mapping modes, defval:01 $4833 ROM BANK MAPPING C $F0:0000-$FF:FFFF, see bank mapping modes, defval:02 $4834 SRAM BANK MAPPING?, workings unknown, defval:00 $4840 RTC CHIP ENABLE/DISABLE: low bit, on = enable, off = disable, defval:00 $4841 RTC INDEX/DATA PORT: first write after rtc enable: rtc command mode byte (see rtc command modes) subsequent writes: index of rtc register to read/write (00-0f) read: returns value of indexed rtc register auto-increment of register index occurs after each subsequent read/write $4842 RTC READY STATUS: high bit set = ready, high bit clear = processing, tested before reading rtc data high bit cleared after successful read Decompression Command Modes: 00 - manual decompression, $4800 is used to read directly from the data rom ( really - disable offset modes x2/x4 (x8?) ) 02 - hardware decompression, decompressed data is mapped to $50:0000, $4800 can be used to read sequentially from bank $50 ( enable offset modes based on first byte in table index? offset_mode/addr-h/addr-m/addr-l offset mode: offset start by $4805/6 times value 00 = x1 offset 01 = x2 offset ? 02 = x4 offset ? 03 = ??? ) Note: decompression mode is activated after writing to $4806 and finishes after reading the high bit of $480C Note: The $4814-$4815 pair can optionally be used as an offset to the base address in $4811/$4812/$4813 The $4816-$4817 pair can optionally be used as an increment value Data Rom Command Mode Byte: X6543210 |||||||| ||||||||__ : 0 - use 1 as the increment value, add immediately after reading $4810 ||||||| : 1 - use $4816 as increment value, add immediately after reading $4810 |||||||___ : 0 - disable $4814/5 offset addition |||||| : 1 - enable $4814/5 addition as an offset to the base address in $4811/2/3 ||||||____ : 0 - unsigned calculation for $4816 ||||| 1 - signed calculation for $4816 |||||_____ : 0 - unsigned calculation for $4814 |||| 1 - signed calculation for $4814 ||||______ : 0 - increment value gets added to $4811/2/3 ||| 1 - increment value gets added to $4814/5 | \_______ : 00 - disable exceptions to $4814/5 offset addition (listed below) | : 01 - 8 bit offset addition using $4814, immediately after writing to $4814/5 | : 10 - 16 bit offset addition using $4814/5, immediately after writing to $4814/5 | : 11 - 16 bit offset addition using $4814/5, only after reading $481A |_________ : unused Note: the data rom command mode is activated only after registers $4814 and $4815 have been written to, regardless of the order they were written to Bank Mapping Modes: 00 - use data rom 000000-0FFFFF for mapping 01 - use data rom 100000-1FFFFF for mapping 02 - use data rom 200000-2FFFFF for mapping 03 - use data rom 300000-3FFFFF for mapping RTC Command Modes: 03 - normal sequential read/write mode 0c - sequential read/write mode also other commands unknown as of yet RTC Registers (8 bit values): [default values] 00 - seconds 1's digit 00 01 - seconds 10's digit 00 02 - minutes 1's digit 00 03 - minutes 10's digit 00 04 - hours 1's digit 00 05 - hours 10's digit 00 06 - day of month 1's digit 01 07 - day of month 10's digit 00 08 - month 1's digit 01 09 - month 10's digit 00 0a - year 1's digit 00 0b - year 10's digit 00 0c - day of week 00 0d - control register 01 0e - control register 0F 0f - control register 06 RTC Control Register Bits: Register 0d XXXXXX10 ||_ : 0 - normal timer operation | 1 - pause rtc registers updating, time still increments normally |__ : 0 - disable rtc interrupts 1 - enable rtc interrupts Register 0e XXXX3210 \\\|_ : unknown Register 0f XXXXX210 |||_ : 0 - normal || 1 - stops timer and resets seconds to 00 (date set to 01/01/00 00:00:00 ?) ||__ : 0 - normal timer operation | 1 - stop timer |___ : 0 - 12 hour time, bit 2 of "hours 10's digit" register contains am/pm bit (am=0,pm=1) 1 - 24 hour time