; ; 76C55 register map derived from MD04A source code - Work In Progress! ; J Holland ; 21 April 2020 ; ;;------------------- Registers ------------------------------------- ; In all other devices user RAM starts at 40h ; thise looks the same - 40 is not directly initialised; P1DDR equ 0x00 P2DDR equ 0x01 PORT1 equ 0x02 PORT2 equ 0x03 P3DDR equ 0x04 P4DDR equ 0x05 PORT3 equ 0x06 PORT4 equ 0x07 ; ; unknown registers - these could be control registers for the timer ; module at 0810 L0008 equ 0x08 ; 8-bit write to 00h twice (normal init code?) L0009 equ 0x09 ; 8-bit write to FFh twice (normal init code?) L000A equ 0x0A ; 8-bit Bitfield - (intvec15 -> 11) L000B equ 0x0B ; 8-bit write once to 00h (normal init code?) L000C equ 0x0C ; 8-bit read once not stored L000D equ 0x0D ; 8-bit read - never stored L000E equ 0x0E ; 8-bit read - not stored? ; ; F is P3 CSR in all other devices L000F equ 0x0F ; SCIRMC equ 0x10 SCSR equ 0x11 RXD equ 0x12 TXD equ 0x13 ; 14 is RAMCR in all other disassembled ; L0014 ; P5DDR equ 0x15 PORT5 equ 0x16 ; ; unknown registers L0017 ; initialised to 0x0E L0018 ; initialised to 0x0E L0019 ; 8-bit, initialised to 0x0E L001A ; 8-bit, initialised to 0x0E ; ; 1F,20,21 are connected - from line C2D0, ; in MH6211 1F and 20 are PORT6 and ; 20,21 are unused in EE88 code ; L001F ; 8-bit, initialised to 0x00 or 0x01 - bitfield L0020 ; only bit5 is read L0021 ; 8-bit write, 8/16-bit read ; L0023 ; timer for SCI? L0024 ; 8-bit, written to 3F in SCI code ; ; 26,27 are both read at start of interrupt vector 2 L0026 ; 8-bit, r/w could be RTI CR L0027 ; ; unknown registers L0028 ; init as double #$2800 L0029 ; 8-bit written twice to 00h L002A ; 8-bit written twice to 00h (not in same place as L0029) L002B ; 8-bit written 00 or 1F L002C ; 8-bit written to 00 or FF ; ; possible DDR init P6DDR, P7DDR? L002D ; 16-bit written once in DDR routine as #$C123 ; possible port init PORT6, PORT7? L002F ; init as double in Port routine - 8-bit bitfield L0030 ; 8-bit bitfield ; L0031 ; 8-bit bitfield init as 01 L0032 ; init as 00, no further r/w L0033 ; init as 11, no further r/w L0034 ; written as 16-bit 8001 or 0001, written as 8-bit from maths ; ADCCR1 equ 0x38 ADCCR2 equ 0x39 ADCRES equ 0x3D ; L003E ; init as 22, no further r/w ;---------------------------------------- RAM locations? ---------------------------------------- L0040 ; ; L0573 ;--------- bottom of stack area ------------------------------ ; ^ ; ! ; ! ; ^ L05B7 ;--------- top of stack - pointer initialised here ; ; ; More RAM above stack pointer - maybe external but odd address to start?? ; ; L0617 ; end of 1600 bytes of RAM including registers ; ; ; Timer module - interrupt vectors are internal? ; ; L080F ; OC? - add a number and store L0810 ; init then all in intvec9 OC? - add a number store here L0811 ; init then all in intvec8 - fetched and stored, also load 113 add 323 store 811 L0812 ; init then all in intvec10 L0813 ; init then load, add store here, also intvec6 L0814 ; init then load, add store here, also intvec5 L0815 ; init then intvec4, load 815 add 1FE0, store 815 L0816 ; init then load, add and store , controls PORT3 bits, also intvec3 L081F ; written twice to 00h L0820 ; written twice to E0h L0821 ; 16-bit write twice to 00h L0823 ; 16-bit write twice to 00h L0825 ; 16-bit write twice to 00h L0827 ; 16-bit write twice to 00h L082D ; 16-bit timer L082E ; read once in init and overwritten L082F ; read once in init and overwritten L0830 ; read once in init and overwritten L0831 ; read once in init and overwritten L0833 ; 16-bit read in intvec15 and stored L000A bit0 selects interrupt?? L0834 ; 16-bit read in intvec16 and stored, L000A bit1 selects interrupt?? L0835 ; 16-bit read in intvec13 and stored, L000A bit2 selects interrupt?? L0837 ; 16-bit read in intvec12 and stored, L000A bit3 is toggled = edge?? L0839 ; 16-bit read in intvec11 and stored, L000A bit4 is toggled = edge?? L083A ; read once in init ; L09BD ; once stored - disassembly error? lots of X and Y ; -------------------------- more code that hasn't been disassembled yet --------------------------------------- L1000 L1487 ;------------------------ end of non-disassembled code ---------------------------------- ; ; ; some random , maybe external addresses - there is no data from 2000h to 2FFFh L201B L2402 L26B7 L2BBD ; ;---------------------------- Start of main code ------------------------------------------ ; RESET: ; this is where the reset vector points to 3000 ; ; ;-------------------- interrupt vectors -------------------- ; FFAC D48B ; Vector1 FFAE D31B ; serial comms? FFB0 D48B FFB2 D48B FFB4 D48B FFB6 D48B FFB8 D48B FFBA D48B FFB4 D48B FFB6 D48B FFB8 D48B FFBA D48B FFBC D48B FFBE D48C ; Vector2 FFC0 D48B FFC2 D48B FFC4 D48B FFC6 D48B FFC8 D48B FFCA D48B FFCC D48B FFCE D1A0 ; Vector3 FFD0 D1B3 ; Vector4 FFD2 D194 ; Vector5 FFD4 D150 ; Vector6 FFD6 D10C ; Vector7 FFD8 D014 ; Vector8 FFDA CF1C ; Vector9 FFDC CE75 ; Vector10 FFDE D48B FFE0 D48B FFE2 D48B FFE4 D48B FFE6 D48B FFE8 D48B FFEA D48B FFEC D48B FFEE CE41 ; Vector11 FFF0 CE2F ; Vector12 FFF2 CDE1 ; Vector13 FFF4 CDAE ; Vector14 FFF6 CD7B ; Vector15 FFF8 D48B FFFA D48B FFFC CD71 ; Vector16 FFFE 3000 ; Reset ; ; ; END OF FILE