So I'm doing a bit of tracing through the 96530006 periphery stuff, and bumped into a question that I'm hoping mrfred, acamus, or someone else can shed some light on.
First, some background for those who don't know, or haven't bothered looking at this stuff:
What we call the "periphery" values are actually a set of 6 tables, with 8 word-width entries each, starting at F9A in all ROMs. At FFFF8A04 (in 96530006; other ROMs will differ), a periphery offset is stored which says which of the eight values to look up. sub_DC6, sub_DD2, and sub_DE0 perform those lookups (for byte-, word-, and long-width tables, respectively); passing in r4 as the starting address, the looked-up value is returned in r0. These lookup routines, and sub_DE0 in particular, are used a fair bit elsewhere for doing table lookups; you might be familiar with their use in locating the fuel tables, for example.
At boot, the ROM periphery values (subject to the periphery offset) are copied into RAM; in 96530006, F9A through FEA are copied into FFFF89F6 through FFFF8A00 (D0, D1, D2, D3, D4, and a final address that isn't listed in the MUT region, but it's all consecutive in RAM anyway). There's some mangling that's done to a few of the values, though (and these appear to be universal; 8859, at the very least, supports them):
- if 0x101C is set to 0, both FCA and FDA are set to zero before copying to RAM.
- if 0x101D is set to 0, FCA bit 1 is set to zero before copying to RAM.
- if 0x101E is set to 0, FCA bit 2 is set to zero before copying to RAM.
- if 0x101F is set to 0, FCA bit 4 is set to zero before copying to RAM.
- if 0x1020 is set to 0, FCA bit 5 is set to zero before copying to RAM.
- if 0x1021 is set to 0, FCA bit 6 is set to zero before copying to RAM.
- if 0x1022 is set to 0, FCA bit 7 is set to zero before copying to RAM.
- if 0x1023 is set to 0, FCA bit 8 is set to zero before copying to RAM.
- if 0x1024 is set to 0, FCA bits 9 and 10 are set to zero before copying to RAM.
- if 0x1025 is set to 0, FCA bits 13 and 14 are set to zero before copying to RAM.
Note that, by default, all of the above are set to 1, meaning none of the bit-zeroing happens out of the box. The routine that does this (the copying to RAM, as well as the bit-twiddling) starts at FA6C (in 96530006); the periphery-related stuff is at FAB8.
(Small aside #1: I REALLY don't get the point of these tests; if you can change the 0x101C-0x1025 values in the ROM...er...why wouldn't you just change the periphery bits directly? "Ours is not to question why...")
(Small aside #2: It seems like F9A, which is undocumented in the wiki right now, is mostly used for "system-ish" stuff; at least a couple of bits appear to be immobilizer-related, for example.)
Anyway, what got me started looking at this was FEA; I wanted to see what code was involved with bit 14. This is where I feel a little silly: while I see a ton of references to the other peripheries, where the heck is FEA (or FFFF8A00) referenced? I can't find any obvious code that makes use of it (either directly, or as some offset of MUT_D0), other than the initial copy to RAM, and one check at 3C72E (and that only tests bit 4, and all branches appear to blow r0 away after the bit test).
mrfred, you spent a lot of time digging through this stuff at one point; would you be able to point me at something in 8859 to reference against (I know 9653 isn't your primary interest, I'm happy to do the translation legwork myself)? I feel like I'm missing something incredibly obvious here, because someone obviously found a few of the FEA periphery bits that we've labeled.