IROM_BASE: equ 0x8000 lri $CR, #0x00ff lri $SR, #0x2000 si @DMBH, #0x8071 si @DMBL, #0xfeed mainloop: clr $ACC1 clr $ACC0 call wait_for_cpu_mbox+#IROM_BASE ;mmem-addr param1: lr $AC1.M, @CMBL lri $AC0.M, #0xa001 cmp jnz param2+#IROM_BASE call wait_for_cpu_mbox+#IROM_BASE lr $IX0, @CMBH lr $IX1, @CMBL jmp mainloop+#IROM_BASE ;iram-addr param2: lri $AC0.M, #0xc002 cmp jnz param3+#IROM_BASE call wait_for_cpu_mbox+#IROM_BASE lr $IX2, @CMBL jmp mainloop+#IROM_BASE ;iram-length param3: lri $AC0.M, #0xa002 cmp jnz param4+#IROM_BASE call wait_for_cpu_mbox+#IROM_BASE lr $IX3, @CMBL jmp mainloop+#IROM_BASE ;dram-length param4: lri $AC0.M, #0xb002 cmp jnz param5+#IROM_BASE call wait_for_cpu_mbox+#IROM_BASE lr $AX0.L, @CMBL jmp mainloop+#IROM_BASE ;iram-start-addr param5: lri $AC0.M, #0xd001 cmp jnz mainloop+#IROM_BASE call wait_for_cpu_mbox+#IROM_BASE lr $AR0, @CMBL jmp 0x80b5 wait_dma: lrs $AC0.M, @DSCR andcf $AC0.M, #0x0004 jlz wait_dma+#IROM_BASE ret WARNPC 0x78 ORG 0x78 ; called by GBA ucode wait_for_cpu_mbox: lrs $AC0.M, @CMBH andcf $AC0.M, #0x8000 jlnz wait_for_cpu_mbox+#IROM_BASE ret WARNPC 0x7e ORG 0x7e ; called by GBA ucode wait_for_dsp_mbox: lrs $AC0.M, @DMBH andcf $AC0.M, #0x8000 jlz wait_for_dsp_mbox+#IROM_BASE ret WARNPC 0x8b ORG 0x8b ; called by GBA ucode dram_to_cpu: srs @DSMAH, $AX0.H srs @DSMAL, $AX0.L si @DSCR, #0x1 srs @DSPA, $AX1.H srs @DSBL, $AX1.L call wait_dma+#IROM_BASE ret WARNPC 0xb5 ORG 0xb5 bootucode: set16 clr $ACC0 mrr $AC0.M, $AX1.L andi $AC0.M, #0xffff jz bootucode_ix+#IROM_BASE WARNPC 0xbc ORG 0xbc ; called by GBA ucode bootucode_ax: lris $AC0.M, #0 srs @DSCR, $AC0.M srs @DSMAH, $AX0.H srs @DSMAL, $AX0.L srs @DSPA, $AX1.H srs @DSBL, $AX1.L call wait_dma+#IROM_BASE bootucode_ix: mrr $AC0.M, $IX3 andi $AC0.M, #0xffff jz bootucode_epilogue+#IROM_BASE lris $AC0.M, #0x2 srs @DSCR, $AC0.M sr @DSMAH, $IX0 sr @DSMAL, $IX1 sr @DSPA, $IX2 sr @DSBL, $IX3 call wait_dma+#IROM_BASE bootucode_epilogue: clr $ACC1 lr $AC1.M, @DSBL jmpr $AR0 WARNPC 0xe7 ORG 0xe7 ; Args: ; AR0 points to the 32 input 1 samples (s16) ; AR1 points to the volume data (init1, delta1, init2, delta2) ; AR2 points to the already mixed samples for output 1 (s32) ; AR3 points to where the output 1 should be stored (s32) ; IX0 points to the 32 input 2 samples (s16) ; IX1 points to where the output 2 should be stored (s32) ; ; Returns: ; AX0.L is the value of the last sample from input 1 ; AX1.H is the value of the last sample from input 2 mix_two_add: call mix_add+#IROM_BASE iar $AR1 mrr $AR0, $IX0 mrr $AR2, $IX1 mrr $AR3, $IX1 mrr $IX0, $AX0.L call mix_add+#IROM_BASE mrr $AX1.H, $AX0.L mrr $AX0.L, $IX0 ret WARNPC 0x1f4 ORG 0x1f4 ; used by GBA ucode for joyboot length and is the end of some mixing function ; (for an example of hitting the full function, try running the main menu of ; Metroid Prime using the Nintendo DSP ROM). sub_81f4: asr16'ir $ACC1 : $AR1 clr's $ACC0 : @$AR3, $AC1.M ; AC1.M is always #0x0 here. ; necessary both to match register state of official ROM, and for the ; following mul. could also be mrr $AX1.H, $AC0.M (before clearing ACC0). mrr $AX1.H, $AX0.H ; make the product register match. mul's $AX1.L, $AX1.H : @$AR3, $AC1.L ret WARNPC 0x1f9 ORG 0x1f9 ; Args: ; AR0 points to the 32 input samples (s16) ; AR1 points to the volume data (init, delta) ; AR2 points to the already mixed samples (s32) ; AR3 points to where the output should be stored (s32) ; ; Returns: ; AX0.L is the value of the last sample ; AX1.H is the first address after the output mix_add: lrri $AX1.L, @$AR1 bloopi #32, ____mix_add_end_loop+#IROM_BASE lrri $AC0.M, @$AR2 lrri $AC0.L, @$AR2 lsl16 $ACC0 lrri $AX0.H, @$AR0 mulx $AX0.H, $AX1.L addp $ACC0 asr16 $ACC0 srri @$AR3, $AC0.M ____mix_add_end_loop: srri @$AR3, $AC0.L movp $ACC0 mrr $AX0.L, $AC0.M mrr $AX1.H, $AR3 ret WARNPC 0x282 ORG 0x282 mix_two_add_ramp: call mix_add_ramp+#IROM_BASE mrr $AR0, $IX0 mrr $AR2, $IX1 mrr $IX1, $AX0.L call mix_add_ramp+#IROM_BASE mrr $AX1.H, $AX0.L mrr $AX0.L, $IX1 ret WARNPC 0x458 ORG 0x458 ; used by GBA ucode for joyboot length sub_8458: ; AC1.L after = AC1.M before + 7. this looks really stupid, but matches ; captured traces and seems to work. addis $AC1.M, #0x7 asr16 $ACC1 srri @$AR3, $AC1.M ; or just #0x0. srri @$AR3, $AC1.L ret WARNPC 0x45d ORG 0x45d mix_add_ramp: clr $ACC0 clr $ACC1 lrri $AC0.L, @$AR1 lrrd $AC1.L, @$AR1 mrr $IX2, $AR3 bloopi #32, ____mix_add_ramp_end_ramp+#IROM_BASE srri @$AR3, $AC0.L ____mix_add_ramp_end_ramp: add $ACC0, $ACC1 srri @$AR1, $AC0.L iar $AR1 mrr $IX3, $AR1 mrr $AR1, $IX2 mrr $AR3, $AR2 bloopi #32, ____mix_add_ramp_end_loop+#IROM_BASE lrri $AC0.M, @$AR2 lrri $AC0.L, @$AR2 lsl16 $ACC0 lrri $AX0.H, @$AR0 lrri $AX1.L, @$AR1 mulx $AX0.H, $AX1.L addp $ACC0 asr16 $ACC0 srri @$AR3, $AC0.M ____mix_add_ramp_end_loop: srri @$AR3, $AC0.L movp $ACC0 mrr $AX0.L, $AC0.M mrr $AX1.H, $AR3 mrr $AR1, $IX3 mrr $AR3, $IX2 ret WARNPC 0x723 ORG 0x723 ; called by GBA ucode sub_8723: ; in GBA-HLE, the nonce challenge is XOR'd with 0x6f646573, which happens ; to match the values of the AX1.H register across these two calls. xorr $AC1.M, $AX1.H ; the value of @AR2 is always the same as AC1.M after srrd @$AR2, $AC1.M ret WARNPC 0x809 ORG 0x809 ; called by GBA ucode sub_8809: ; AR2 is the only addressing register that corresponds to the dmem writes ; could be AC1.L or AX0.L in the second call, but can't be AX0.L in the ; third call. srr @$AR2, $AC1.L ; AC1.M after calling always look like either AC1.M | AC0.M or ; AC1.M | AX0.H. TODO: Why pick AX0.H? orr $AC1.M, $AX0.H ; the second dmem write is incremented only in calls #3A and #3B. There, ; IX2 is the only register set to 1, and it's specifically set to 1 in the ; ucode. It's set to 0 in the first two calls. addarn $AR2, $IX2 ; obvious srri @$AR2, $AC1.M ret WARNPC 0x8e5 ORG 0x8e5 ; used by GBA ucode for challenge nonce, logo palette/speed, and joyboot length sub_88e5: dar $AR1 ; always gets decremented, no effect on rest of function lrri $AC1.M, @$AR2 lrrd $AC1.L, @$AR2 add $ACC0, $ACC1 ; signed addition orr $AC0.M, $AX0.H srri @$AR2, $AC0.M srr @$AR2, $AC0.L ret WARNPC 0x1000 ORG 0x1000