1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
; This is the ucode used to "unlock" memcards
; RE purely out of interest, and hunch that it does trickies
IROM_BASE: equ 0x8000
; Exception vectors
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
halt ; Exception 0-6 nop slide to here
rti ; Exception 7
halt
; Entry point
; Standard init stuff
sbset #0x06
sbclr #0x03
sbclr #0x04
sbset #0x05
lri $CR, #0x00ff
lri $WR0, #0xffff
lri $WR1, #0xffff
lri $WR2, #0xffff
lri $WR3, #0xffff
set40
; 0xdcd10000 is the init mail
call wait_for_dsp_mbox
si @DMBH, #0xdcd1
si @DMBL, #0x0000
si @DIRQ, #0x0001
; Wait for cpu to say "go!" - i think
wait_for_start_cmd:
call wait_for_cpu_mbox
lrs $AC1.L, @CMBL
cmpi $AC1.M, #0xff00
jnz wait_for_start_cmd
dma_dram_and_prepare_for_crazy_irom_func:
call wait_for_cpu_mbox
mrr $AC0.M, $AC1.M
lrs $AC0.L, @CMBL ; main ram addr.l
andi $AC0.M, #0x0fff ; main ram addr.h & 0x0fff
lri $AX0.L, #0x0400 ; dsp addr
lri $AX0.H, #0x0010 ; length (bytes)
lri $AX1.L, #0x0000 ; dsp dram to cpu
set16
call do_dma
call IROM_BASE+0x0644; holy mother of jesus that func is gonna be hard
; 0xdcd10003 means finished unlocking?
call wait_for_dsp_mbox
si @DMBH, #0xdcd1
si @DMBL, #0x0003
si @DIRQ, #0x0001
set40
call wait_for_cpu_mbox
cmpi $AC1.M, #0xcdd1
jnz dma_dram_and_prepare_for_crazy_irom_func
lrs $AC1.M, @CMBL
cmpi $AC1.M, #0x0001
jz _005afunc
cmpi $AC1.M, #0x0002
jz IROM_BASE ; End of this ucode, wait for a new one
jmp dma_dram_and_prepare_for_crazy_irom_func
halt ; Prolly never reached
; 10 mails from cpu then irom func - looks interesting
_005afunc:
set16
call wait_for_cpu_mbox
lrs $AC1.L, @CMBL
call wait_for_cpu_mbox
lrs $AC1.L, @CMBL
call wait_for_cpu_mbox
lrs $AC1.L, @CMBL
call wait_for_cpu_mbox
lr $IX1, @CMBL
andi $AC1.M, #0x0fff
mrr $IX0, $AC1.M
call wait_for_cpu_mbox
lr $IX3, @CMBL
call wait_for_cpu_mbox
lr $IX2, @CMBL
call wait_for_cpu_mbox
lr $AR0, @CMBL
call wait_for_cpu_mbox
lrs $AX0.L, @CMBL
andi $AC1.M, #0x0fff
mrr $AX0.H, $AC1.M
call wait_for_cpu_mbox
lrs $AX1.L, @CMBL
call wait_for_cpu_mbox
lrs $AX1.H, @CMBL
sbclr #0x05
sbclr #0x06
jmp IROM_BASE+0x00b5; IROM - can dma stuff
halt
wait_for_dsp_mbox:
lrs $AC1.M, @DMBH
andcf $AC1.M, #0x8000
jlz wait_for_dsp_mbox
ret
wait_for_cpu_mbox:
lrs $AC1.M, @CMBH
andcf $AC1.M, #0x8000
jlnz wait_for_cpu_mbox
ret
do_dma:
srs @DSMAH, $AC0.M
srs @DSMAL, $AC0.L
sr @DSPA, $AX0.L
sr @DSCR, $AX1.L
sr @DSBL, $AX0.H
wait_dma:
lrs $AC0.M, @DSCR
andcf $AC0.M, #0x0004
jlz wait_dma
ret
; Trailing nops...pad to 32bytes
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
; uCode is 0xb0 words
|
