docs/DSP/unlockmemcard.ds

   1 ; This is the ucode used to "unlock" memcards
   2 ; RE purely out of interest, and hunch that it does trickies
   3
   4 IROM_BASE:      equ     0x8000
   5
   6 ; Exception vectors
   7         nop
   8         nop
   9         nop
  10         nop
  11         nop
  12         nop
  13         nop
  14         nop
  15         nop
  16         nop
  17         nop
  18         nop
  19         nop
  20         halt    ; Exception 0-6 nop slide to here
  21         rti             ; Exception 7
  22         halt
  23
  24 ; Entry point
  25 ; Standard init stuff
  26         sbset   #0x06
  27         sbclr   #0x03
  28         sbclr   #0x04
  29         sbset   #0x05
  30         lri             $CR, #0x00ff
  31         lri             $WR0, #0xffff
  32         lri             $WR1, #0xffff
  33         lri             $WR2, #0xffff
  34         lri             $WR3, #0xffff
  35         set40
  36
  37 ; 0xdcd10000 is the init mail
  38         call    wait_for_dsp_mbox
  39         si              @DMBH, #0xdcd1
  40         si              @DMBL, #0x0000
  41         si              @DIRQ, #0x0001
  42 ; Wait for cpu to say "go!" - i think
  43 wait_for_start_cmd:
  44         call    wait_for_cpu_mbox
  45         lrs             $AC1.L, @CMBL
  46         cmpi    $AC1.M, #0xff00
  47         jnz             wait_for_start_cmd
  48
  49 dma_dram_and_prepare_for_crazy_irom_func:
  50         call    wait_for_cpu_mbox
  51         mrr             $AC0.M, $AC1.M
  52         lrs             $AC0.L, @CMBL   ; main ram addr.l
  53         andi    $AC0.M, #0x0fff ; main ram addr.h & 0x0fff
  54         lri             $AX0.L, #0x0400 ; dsp addr
  55         lri             $AX0.H, #0x0010 ; length (bytes)
  56         lri             $AX1.L, #0x0000 ; dsp dram to cpu
  57         set16
  58         call    do_dma
  59         call    IROM_BASE+0x0644; holy mother of jesus that func is gonna be hard
  60
  61 ; 0xdcd10003 means finished unlocking?
  62         call    wait_for_dsp_mbox
  63         si              @DMBH, #0xdcd1
  64         si              @DMBL, #0x0003
  65         si              @DIRQ, #0x0001
  66         set40
  67         call    wait_for_cpu_mbox
  68         cmpi    $AC1.M, #0xcdd1
  69         jnz             dma_dram_and_prepare_for_crazy_irom_func
  70         lrs             $AC1.M, @CMBL
  71         cmpi    $AC1.M, #0x0001
  72         jz              _005afunc
  73         cmpi    $AC1.M, #0x0002
  74         jz              IROM_BASE               ; End of this ucode, wait for a new one
  75         jmp             dma_dram_and_prepare_for_crazy_irom_func
  76         halt    ; Prolly never reached
  77
  78 ; 10 mails from cpu then irom func - looks interesting
  79 _005afunc:
  80         set16
  81         call    wait_for_cpu_mbox
  82         lrs             $AC1.L, @CMBL
  83         call    wait_for_cpu_mbox
  84         lrs             $AC1.L, @CMBL
  85         call    wait_for_cpu_mbox
  86         lrs             $AC1.L, @CMBL
  87         call    wait_for_cpu_mbox
  88         lr              $IX1, @CMBL
  89         andi    $AC1.M, #0x0fff
  90         mrr             $IX0, $AC1.M
  91         call    wait_for_cpu_mbox
  92         lr              $IX3, @CMBL
  93         call    wait_for_cpu_mbox
  94         lr              $IX2, @CMBL
  95         call    wait_for_cpu_mbox
  96         lr              $AR0, @CMBL
  97         call    wait_for_cpu_mbox
  98         lrs             $AX0.L, @CMBL
  99         andi    $AC1.M, #0x0fff
 100         mrr             $AX0.H, $AC1.M
 101         call    wait_for_cpu_mbox
 102         lrs             $AX1.L, @CMBL
 103         call    wait_for_cpu_mbox
 104         lrs             $AX1.H, @CMBL
 105         sbclr   #0x05
 106         sbclr   #0x06
 107         jmp             IROM_BASE+0x00b5; IROM - can dma stuff
 108         halt
 109
 110 wait_for_dsp_mbox:
 111         lrs             $AC1.M, @DMBH
 112         andcf   $AC1.M, #0x8000
 113         jlz             wait_for_dsp_mbox
 114         ret
 115
 116 wait_for_cpu_mbox:
 117         lrs             $AC1.M, @CMBH
 118         andcf   $AC1.M, #0x8000
 119         jlnz    wait_for_cpu_mbox
 120         ret
 121
 122 do_dma:
 123         srs             @DSMAH, $AC0.M
 124         srs             @DSMAL, $AC0.L
 125         sr              @DSPA, $AX0.L
 126         sr              @DSCR, $AX1.L
 127         sr              @DSBL, $AX0.H
 128 wait_dma:
 129         lrs             $AC0.M, @DSCR
 130         andcf   $AC0.M, #0x0004
 131         jlz             wait_dma
 132         ret
 133
 134 ; Trailing nops...pad to 32bytes
 135         nop
 136         nop
 137         nop
 138         nop
 139         nop
 140         nop
 141         nop
 142         nop
 143         nop
 144         nop
 145         nop
 146         nop
 147         nop
 148         nop
 149
 150 ; uCode is 0xb0 words