			======================================================
			 Dr. DevSter's Guide to The Sega 32x
			 ">>ALMOST<< Everything you wanted to know, that you
			  never knew, and that you're going to know about
			  the 32x"
			 Joseph Norman - pimp, http://devster.monkeeh.com
			======================================================

This info is presented to ALMOST inform a user on how their Sega 32x
works and what makes it "tick". Sega is copyrighted by Sega. Any reference
to copyrighted material is not presented for monetary gain, but for
educational purposes and higher learning. Everything found in the doc
was discovered from the means of dissassembling the beast and browsing
through the Gens source code, and with the help of the Sega dev forums here
and there. This contains everything you need to know to get code started on
the 68k, and sh2.

					Contents
					========
	] 32X Specs
		]] Proccessor
	] 32x Cartridges
		]] 32x Security
		]] 32x Cartridge Map+Headers
		]] Getting the 32x to start up
		]] The 32x Custom Vector ROM Hex Dump
		]] The 68k New Exception Table
	] Programming
		]] Memory Map on the Genesis 68k
		]] Master and Slave SH2 Memory Map
		]] Description of the 32x Registers
		]] Description of the 32x VDP Registers
	] Video
		]] The Frame Buffer
		]] The VDP Modes
		]] CRAM
	] PWM (Coming Later)
	] Document History

32X Specs
=========
CPUs: Dual SH2 RISC
Main RAM: 256k
Video RAM: 256k
Screen Resolution: 320x224
Clock Speed: 23 Mhz
Color depth: 15 bits, 32768 unique colors
Number of Video Modes: 3
Sound: 2-channel PWM

Although many specs claim that the 32x can generate polygons and texture mapping
through hardware, this is untrue, and false. All software generates this.

Proccessor
==========
The 32x contains dual SH2 proccessors, one acting as a master, and the other acting
as a slave. Usually, the configuration of a game is to make the master cpu is used
for the game coding, and the slave cpu used for VDP manipulation. The SH2 (Super-Hitachi
2) is a RISC proccessor, and each instruction is 2 bytes long. The SH2 is stock, so
there are publically released manuals for these CPUs. Both CPUs share 256k of SDRAM.

Here is an extract from the SH2 Hardware Manual on the overview of these CPUs:
 CPU:
  -Original Hitachi architecture
  -32-bit internal configuration
  -General-registers:
   -Sixteen 32-bit general registers
   -Three 32-bit control registers
   -Four 32-bit system registers
  -RISC-type instruction set:
   -Instruction length: 16-bit fixed length for improved code efficiency
   -Load-store architecture (basic arithmetic and logic operations are executed between registers)
   -Delayed conditional/unconditional branch instructions reduce pipeline disruption during
    branching
   -Instruction set based on C language
  -Instruction execution time: one instruction/state (35 ns/instruction at 28.7 MHz operation)
  -Address space: 4 Gbytes available in the architecture (128-Mbyte memory space)
  -On-chip multiplier: multiply operations (32 bits ´ 32 bits ® 64 bits) and multiply-and-accumulate
   operations (32 bits ´ 32 bits + 64 bits ® 64 bits) executed in 2 to 4 states
  -Five-stage pipeline
 Operating Modes:
  -Clock mode: selected from the combination of an on-chip oscillator module, a frequency
   multiplier, clock output, PLL synchronization, and 90° phase shifting
  -Slave/master mode
  -Processing states
   -Power-on reset state
   -Manual reset state
   -Exception handling state
   -Program execution state
   -Power-down state
   -Bus-released state
  -Power-down states
   -Sleep mode
   -Standby mode
   -Module stop mode
 Interrupt Controller (INTC):
  -Five external interrupt pins (NMI, IRL0 to IRL3), encoded input of 15 external interrupt
   sources via pins IRL0 to IRL3
  -Twelve internal interrupt sources (DMAC ´ 2, DIVU ´ 1, FRT ´ 3, WDT ´ 1, SCI ´ 4, REF ´ 1)
  -Sixteen programmable priority levels
  -Vector number settable for each internal interrupt source
  -Auto-vector or external vector selectable as vector for external interrupts via pins IRL0 to IRL3
   User Break Controller (UBC):
  -Generates an interrupt when the CPU or DMAC generates an address, data, or bus cycle with
   the specified conditions (address, data, CPU cycle/non-CUP cycle, instruction fetch/data access,
   read/write, byte/word/longword access)
  -Simplifies configuration of a self-debugger
  -Clock Pulse Generator (CPG)/Phase Locked Loop (PLL):
  -On-chip clock pulse generator
  -Crystal clock source or external clock source can be selected
  -Clock multiplication (´1, ´2, ´4), PLL synchronization, or 90° phase shift can be selected
  -Supports clock pause function for frequency change of external clock
 Bus State Controller (BSC):
  -Supports external memory access
   -32-bit external data bus
  -Memory address space divided into four areas. It is possible to set the following characteristics
   for each area (32 Mbyte linear):
   -Bus size (8, 16, or 32 bits)
   -Number of wait cycles settable or not settable
   -Setting the memory space type simplifies connection to DRAM, synchronous DRAM,
    pseudo-SRAM, and burst ROM
   -Outputs signals RAS, CAS, CE, and OE corresponding to DRAM, synchronous DRAM,
    and pseudo-SRAM areas
   -Tp cycles can be generated to assure RAS precharge time
   -Address multiplexing is supported internally, so DRAM and synchronous DRAM can be
    connected directly
   -Outputs chip select signals (CS0 to CS3) for each area
  -DRAM/synchronous DRAM/pseudo-SRAM refresh functions
   -Programmable refresh interval
   -Supports CAS-before-RAS refresh and self-refresh modes
  -DRAM/synchronous DRAM/pseudo-SRAM burst access function
   -Supports high-speed access modes for DRAM/synchronous DRAM/pseudo-SRAM
  -Wait cycles can be inserted by an external WAIT signal
 Cache Memory:
  -4 kbytes
  -64 entries, 4-way set associative, 16-byte line length
  -Write-through data writing method
  -LRU replacement algorithm
  -2 kbytes of the cache can be used as 2-kbyte internal RAM
 Direct Memory Access Controller (DMAC) (2 Channels):
  -Permits DMA transfer between external memory, external I/O, on-chip peripheral modules
  -Enables DMA transfer request and auto-request from external pins, on-chip SCI, and on-chip
   timers
  -Cycle-steal mode or burst mode
  -Channel priority level is selectable (fixed mode or round-robin mode)
  -Dual or single address transfer mode is selectable
  -Transfer data width: 1/2/4/16 bytes
  -Address space: 4 Gbytes; maximum number of transfers: 16,777,216
 Division Unit (DIVU):
  -Executes 64 ¸ 32 ® 32… 32 and 32 ¸ 32 ® 32… 32 divisions in 39 cycles
  -Overflow interrupt
 16-Bit Free-Running Timer (FRT) (1 Channel):
  -Selects input from three internal/external clocks
  -Input capture and output compare
  -Counter overflow, compare match, and input capture interrupts
 Watchdog Timer (WDT) (1 Channel):
  -Can be switched between watchdog timer and interval timer functions
  -Count overflow can generate an internal reset, external signal, or interrupt
  -Power-on reset or manual reset can be selected as the internal reset
 Serial Communication Interface (SCI) (1 Channel):
  -Asynchronous or synchronous mode is selectable
  -Simultaneous transmission and reception (full duplex)
  -Dedicated baud rate generator
  -Multiprocessor communication function
 Package:
  -144-pin plastic QFP (FP-144)

32x Cartridges
==============
32x cartridges are normal 16-bit ROM. Addresses from the cartridge connector are
connected to the addresses of the ROM, data goes to data, etc. For propper operation,
the 32x needs 86ns, or faster ROMs (((23 Mhz)^-1)*(2 clocks per R/W)*(1000 ns/ms)=86 ns)
if code/data is executing directly on the cartridge from the SH2. If this is not the
case, then ROMs can be as slow as 150ns, for 68k timing. I've successfully used 70ns
non-volatile SRAMs directly connected the the 32x from the cartridge connector. The
odd/even write lines existing on the original Genesis cartridge connector still have
the same function going from the 32x cart connector, so writing to SRAMs are the same.

When accessing the cartridge from the 68k and sh2, the sh2 gets to access it first. The
68k can only access cartridge rom from the bank areas. The 68k does not have full view
of the rom. The sh2 does not need any banking areas, and it has full view of the rom.

32x Security
============
Each 32x cartridge has a special header at the begining of $400-$7FF. This is the hex dump
of the security code+data:

0000036C 46FC 2700 4BF9 00A1 0000 7001 0CAD 4D41 F.'.K.....p...MA
0000037C 5253 30EC 6600 03E6 082D 0007 5101 67F8 RS0.f....-..Q.g.
0000038C 4AAD 0008 6710 4A6D 000C 670A 082D 0000 J...g.Jm..g..-..
0000039C 5101 6600 03B8 102D 0001 0200 000F 6706 Q.f....-......g.
000003AC 2B78 055A 4000 7200 2C41 4E66 41F9 0000 +x.Z@.r.,ANfA...
000003BC 04D4 6100 0152 6100 0176 47F9 0000 04E8 ..a..Ra..vG.....
000003CC 43F9 00A0 0000 45F9 00C0 0011 3E3C 0100 C.....E.....><..
000003DC 7000 3B47 1100 3B47 1200 012D 1100 66FA p.;G..;G...-..f.
000003EC 7425 12DB 51CA FFFC 3B40 1200 3B40 1100 t%..Q...;@..;@..
000003FC 3B47 1200 149B 149B 149B 149B 41F9 0000 ;G..........A...
0000040C 04C0 43F9 00FF 0000 22D8 22D8 22D8 22D8 ..C.....".".".".
0000041C 22D8 22D8 22D8 22D8 41F9 00FF 0000 4ED0 ".".".".A.....N.
0000042C 1B7C 0001 5101 41F9 0000 06BC D1FC 0088 .|..Q.A.........
0000043C 0000 4ED0 0404 303C 076C 0000 0000 FF00 ..N...0<.l......
0000044C 8137 0002 0100 0000 AF01 D91F 1127 0021 .7...........'.!
0000045C 2600 F977 EDB0 DDE1 FDE1 ED47 ED4F D1E1 &..w.......G.O..
0000046C F108 D9C1 D1E1 F1F9 F3ED 5636 E9E9 9FBF ..........V6....
0000047C DFFF 4D41 5253 2049 6E69 7469 616C 2026 ..MARS Initial &
0000048C 2053 6563 7572 6974 7920 5072 6F67 7261  Security Progra
0000049C 6D20 2020 2020 2020 2020 2043 6172 7472 m          Cartr
000004AC 6964 6765 2056 6572 7369 6F6E 2020 2020 idge Version    
000004BC 436F 7079 7269 6768 7420 5345 4741 2045 Copyright SEGA E
000004CC 4E54 4552 5052 4953 4553 2C4C 5444 2E20 NTERPRISES,LTD. 
000004DC 3139 3934 2020 2020 2020 2020 2020 2020 1994            
000004EC 2020 2020 2020 2020 2020 2020 2020 2020                 
000004FC 2020 2020 2020 524F 4D20 5665 7273 696F       ROM Versio
0000050C 6E20 312E 3000 48E7 C040 43F9 00C0 0004 n 1.0.H..@C.....
0000051C 3011 303C 8000 323C 0100 3E3C 0012 1018 0.0<..2<..><....
0000052C 3280 D041 51CF FFF8 4CDF 0203 4E75 48E7 2..AQ...L...NuH.
0000053C 81C0 41F9 0000 063E 43F9 00C0 0004 3298 ..A....>C.....2.
0000054C 3298 3298 3298 3298 3298 3298 2298 3341 2.2.2.2.2.2.".3A
0000055C FFFC 3011 0800 0001 66F8 3298 3298 7000 ..0.....f.2.2.p.
0000056C 22BC C000 0000 7E0F 3340 FFFC 3340 FFFC ".....~.3@..3@..
0000057C 3340 FFFC 3340 FFFC 51CF FFEE 22BC 4000 3@..3@..Q...".@.
0000058C 0010 7E09 3340 FFFC 3340 FFFC 3340 FFFC ..~.3@..3@..3@..
0000059C 3340 FFFC 51CF FFEE 4CDF 0381 4E75 8114 3@..Q...L...Nu..
000005AC 8F01 93FF 94FF 9500 9600 9780 4000 0080 ............@...
000005BC 8104 8F02 48E7 C140 43F9 00A1 5180 08A9 ....H..@C...Q...
000005CC 0007 FF80 66F8 3E3C 00FF 7000 7200 337C ....f.><..p.r.3|
000005DC 00FF 0004 3341 0006 3340 0008 4E71 0829 ....3A..3@..Nq.)
000005EC 0001 000B 66F8 0641 0100 51CF FFE8 4CDF ....f..A..Q...L.
000005FC 0283 4E75 48E7 8180 41F9 00A1 5200 08A8 ..NuH...A...R...
0000060C 0007 FF00 66F8 3E3C 001F 20C0 20C0 20C0 ....f.><.. . . .
0000061C 20C0 51CF FFF6 4CDF 0181 4E75 41F9 00FF  .Q...L...NuA...
0000062C 0000 3E3C 07FF 7000 20C0 20C0 20C0 20C0 ..><..p. . . . .
0000063C 20C0 20C0 20C0 20C0 51CF FFEE 3B7C 0000  . . . .Q...;|..
0000064C 1200 7E0A 51CF FFFE 43F9 00A1 5100 7000 ..~.Q...C...Q.p.
0000065C 2340 0020 2340 0024 1B7C 0003 5101 2E79 #@. #@.$.|..Q..y
0000066C 0088 0000 0891 0007 66FA 7000 3340 0002 ........f.p.3@..
0000067C 3340 0004 3340 0006 2340 0008 2340 000C 3@..3@..#@..#@..
0000068C 3340 0010 3340 0030 3340 0032 3340 0038 3@..3@.03@.23@.8
0000069C 3340 0080 3340 0082 08A9 0000 008B 66F8 3@..3@........f.
000006AC 6100 FF12 08E9 0000 008B 67F8 6100 FF06 a.........g.a...
000006BC 08A9 0000 008B 6100 FF3C 303C 0040 2229 ......a..<0<.@")
000006CC 0020 0C81 5351 4552 6700 0092 303C 0080 . ..SQERg...0<..
000006DC 2229 0020 0C81 5344 4552 6700 0080 21FC "). ..SDERg...!.
000006EC 0088 02A2 0070 303C 0002 7200 122D 0001 .....p0<..r..-..
000006FC 1429 0080 E14A 8242 0801 000F 660A 0801 .)...J.B....f...
0000070C 0006 6700 0058 6008 0801 0006 6600 004E ..g..X`.....f..N
0000071C 7020 41F9 0088 0000 3C28 018E 4A46 6700 p A.....<(..JFg.
0000072C 0010 3429 0028 0C42 0000 67F6 B446 662C ..4).(.B..g..Ff,
0000073C 7000 2340 0028 2340 002C 3E14 2C7C FFFF p.#@.(#@.,>.,|..
0000074C FFC0 4CD6 7FF9 44FC 0000 6014 43F9 00A1 ..L...D...`.C...
0000075C 5100 3340 0006 303C 8000 6004 44FC 0001 Q.3@..0<..`.D...

This data NEEDS to reside at locations $400-$7FF in the cartridge,
or else the 32x will lock up, and not go into 32x mode.

32x Cartridge Map+Headers
=========================
A 32x game cartridge has some additional vectors. These vectors determine how the SH2
code initially runs.

0x000000 - 0x0000FF	68k Vectors
0x000100 - 0x0001FF	Regular Sega Genesis header
0x000200 - 0x000319	68k Exception Table Code. Description in section: The 68k New
			Exception Table
0x00031A - 0x0003D3	Can be anything
0x0003D4.l		Source address of the data to be copied from the cartridge
			to the Master SH2 RAM (cartridge starts at 0x00000000).
0x0003D8.l		Destination address of the data to be copied from the cartridge
			to the Master SH2 RAM (RAM starts at 0x00000000).
0x0003DC.l		Size of the data to be copied from the cartridge to the 32x RAM
			in bytes.
0x0003E0.l		Absolute address that the Master SH2 will jump to when it has
			finished copying data from cartridge to RAM on startup.
0x0003E4.l		Absolute address that the Slave SH2 will jump to
0x0003E8.l		New vector base address for Master SH2 after copying is done.
0x0003EC.l		New vector base address for Slave SH2
0x0003F0 - 0x0003FF	32x security code set up. The 68k reset vector always points
			to $3F0. Description in section: Getting the 32x to start up
0x000400 - 0x0007FF	32x Security Code Image + 68k initialization for the 32x.
			Description in section: 32x Security
0x000800 - etc.		68k User Code Start

Getting the 32x to start up
===========================
To start up the 32x, the Genesis needs to have these two lines of code at $3F0-$3FF,
right before the 32x security header. These two lines of code don't start up the 32x
itself, but sets up the 32x security header. These lines are not scanned by the 32x,
unlike the code from $400-$7FF.

	MOVE.L	#$FFFFFFC0,A4
	MOVE.L	#$00000000,($A15128)

The 68k reset vector HAS to jump to $3F0. The reset vector is located at $000004 in
the cartridge. The stack reset value can have any value.

Now, execution for 68k code now starts at $880800, right after the 32x security header.

The 32x Custom Vector ROM Hex Dump
==================================
00000000 	00000000 00880200 00880206 0088020C 	................
00000010 	00880212 00880218 0088021E 00880224 	...............$
00000020 	0088022A 00880230 00880236 0088023C 	...*...0...6...<
00000030 	00880242 00880248 0088024E 00880254 	...B...H...N...T
00000040 	0088025A 00880260 00880266 0088026C 	...Z...`...f...l
00000050 	00880272 00880278 0088027E 00880284 	...r...x...~....
00000060 	0088028A 00880290 00880296 0088029C 	................
00000070 	008802A2 008802A8 008802AE 008802B4 	................
00000080 	008802BA 008802C0 008802C6 008802CC 	................
00000090 	008802D2 008802D8 008802DE 008802E4 	................
000000A0 	008802EA 008802F0 008802F6 008802FC 	................
000000B0 	00880302 00880308 0088030E 00880314 	................
000000C0 	08F90000 00A15107 128008B9 000000A1 	......Q.........
000000D0 	51074E75 48E70140 08F90000 00A15107 	Q.NuH..@......Q.
000000E0 	43F900A1 30F17E07 1298D2FC 000251CF 	C...0.~.......Q.
000000F0	FFF808B9 000000A1 51074CDF 02804E75 	........Q.L...Nu

The 68k New Exception Table
===========================
All Addresses are actual code, these are not pointers. Each entry of code
is 6 bytes each. A JMP command is enough to fit in 6 bytes. BRA can also
be used too.

Running 68k Address	Cartridge Address	Description
$880200			$200			Reset Code
$880206			$206			Bus Error
$88020C			$20C			Address Error
$880212			$212			Illegal Instruction
$880218			$218			Divide by 0
$88021E			$21E			CHK Instruction
$880224			$224			TRAPV Instruction
$88022A			$22A			Privilege Violation
$880230			$230			Trace
$880236			$236			Line 1010 Emulator
$88023C			$23C			Line 1111 Emulator
$880242			$242			RESERVED (Can actually be anything)
$880248			$248			RESERVED (Can actually be anything)
$88024E			$24E			RESERVED (Can actually be anything)
$880254			$254			RESERVED (Can actually be anything)
$88025A			$25A			RESERVED (Can actually be anything)
$880260			$260			RESERVED (Can actually be anything)
$880266			$266			RESERVED (Can actually be anything)
$88026C			$26C			RESERVED (Can actually be anything)
$880272			$272			RESERVED (Can actually be anything)
$880278			$278			RESERVED (Can actually be anything)
$88027E			$27E			RESERVED (Can actually be anything)
$880284			$284			RESERVED (Can actually be anything)
$88028A			$28A			Spurious Interrupt
$880290			$290			Level 1 Interrupt
$880296			$296			Level 2 Interrupt (TH)
$88029C			$29C			Level 3 Interrupt
$8802A2			$2A2			Level 4 Interrupt (H-Blank)
$8802A8			$2A8			Level 5 Interrupt
$8802AE			$2AE			Level 6 Interrupt (V-Blank)
$8802B4			$2B4			Level 7 Interrupt
$8802BA			$2BA			Trap #0 Instruction
$8802C0			$2C0			Trap #1 Instruction
$8802C6			$2C6			Trap #2 Instruction
$8802CC			$2CC			Trap #3 Instruction
$8802D2			$2D2			Trap #4 Instruction
$8802D8			$2D8			Trap #5 Instruction
$8802DE			$2DE			Trap #6 Instruction
$8802E4			$2E4			Trap #7 Instruction
$8802EA			$2EA			Trap #8 Instruction
$8802F0			$2F0			Trap #9 Instruction
$8802F6			$2F6			Trap #10 Instruction
$8802FC			$2FC			Trap #11 Instruction
$880302			$302			Trap #12 Instruction
$880308			$308			Trap #13 Instruction
$88030E			$30E			Trap #14 Instruction
$880314			$314			Trap #15 Instruction

Programming
===========
I used snasm68k.exe and snasmsh2.exe to assemble all my assembly code. These files
can be found on the internet, and are free.

Memory Map on the Genesis 68k
=============================
0x000000 - 0x0000FF	Genesis Vector ROM provided by the 32x (256 bytes)
0x000100 - 0x3FFFFF	NOTHING
0x400000 - 0x4FFFFF	Genesis Vector ROM provided by the 32x (256 bytes)
0x480000 - 0x4800FF	Genesis Vector ROM provided by the 32x (256 bytes)
0x4800FF - 0x4FFFFF	Cartridge (Appears as 0x000100 - 0x080000)
0x780000 - 0x7FFFFF	???
0x840000 - 0x85FFFF	Frame Buffer
0x860000 - 0x87FFFF	Frame Buffer Overwrite mode
0x880000 - 0x8FFFFF	Cartridge (Appears as 0x000000 - 0x07FFFF)
0x900000 - 0x9FFFFF	Bankswitched cartridge
0xA00000 - 0xA7FFFF	32x Registers:
32x Identification:
	0xA130EC.l		R:	"MARS"
32x Regsiters:			32X_Reg
	0xA15100	Register base address (64 bytes)
		+ 0x00		R/W:	32X_ACR			Bus Arbiter Controller
		+ 0x02		R/W:	32X_INT			Interruper Controller
		+ 0x04		R/W:	32X_Bank		Cartridge Bankswitching
		+ 0x06		R/W:	32X_DREQ_C 		Data Request
		+ 0x08		R/W:	32X_DREQ_Src 		Data Request Source
		+ 0x0C		R/W:	32X_DREQ_Dest 		Data Request Destination
		+ 0x10		R/W:	32X_DREQ_Len 		Data Request Length
		+ 0x12		R/W:	32X_FIFO		TV FIFO???
		+ 0x20 - 0x2F	R/W:				Communications RAM
		+ 0x30		R/W:	32X_PWM_Cont		Sound PWM
		+ 0x32		R/W:	32X_PWM_Cycle		Sound PWM
		+ 0x34		R/W:	32X_PWM_Pulse_L		Sound PWM
		+ 0x36		R/W:	32X_PWM_Pulse_R		Sound PWM
		+ 0x38		R/W:	32X_PWM_Pulse_C		Sound PWM
32x VDP Registers:		32X_VDP_Reg
	0xA15180	Register base address (16 bytes)
		+ 0x00		R/W:	32X_VDP_Mode		VDP Mode Select
		+ 0x02		R/W:	32X_VDP_Shift		VDP Mode Select
		+ 0x04		R/W:	32X_VDP_AF_Len		VDP Fill Length
		+ 0x06		R/W:	32X_VDP_AF_St		VDP Fill Start Address
		+ 0x08		R/W:	32X_VDP_AF_Data		VDP Fill Data
		+ 0x0A		R/W:	32X_VDP_State		VDP Status
32x VDP CRAM			R:	32X_VDP_CRAM		VDP Color RAM
	0xA15200	CRAM Base Address (512 bytes)

Master and Slave SH2 Memory Map
===============================
0x00000000 - 0x000007FF		SH2 Firmware (2k bytes)
0x00004000 - 0x000040FF		32x Registers (64 bytes)
		+ 0x00 		R/W:	MSH2_WW_IntC		Bus Arbitter/Interrupter er
		+ 0x04		R/W: 	SH2_RB_HCnt		???
		+ 0x06		R: 	SH2_RB_DREQ		Data Request
		+ 0x08		R: 	SH2_RW_DREQ_Src		Data Request Source
		+ 0x0C		R: 	SH2_RW_DREQ_Dst		Data Request Destination
		+ 0x10		R: 	SH2_RW_DREQ_Len		Data Request Length
		+ 0x12		R: 	SH2_RW_FIFO		TV FIFO???
		+ 0x20 - 0x2F	R/W:	SH2_RB_Com		Communication RAM
		+ 0x30		R/W: 	SH2_RB_PWM_Cont		Sound PWM
		+ 0x32		R/W: 	SH2_RB_PWM_Cycle	Sound PWM
		+ 0x34		R/W: 	SH2_RB_PWM_Pulse_L	Sound PWM
		+ 0x36		R/W: 	SH2_RB_PWM_Pulse_R	Sound PWM
		+ 0x38		R/W: 	SH2_RB_PWM_Pulse_c	Sound PWM
0x00004100 - 0x000041FF		VDP Registers (16 bytes)
		+ 0x00		R/W:	SH2_RB_VDP_Mode		VDP Mode Select
		+ 0x02		R/W:	SH2_RB_VDP_Shift	VDP Mode Select
		+ 0x04		R/W:	SH2_RB_VDP_AF_Len	VDP Fill Length
		+ 0x06		R/W:	SH2_RB_VDP_AF_St	VDP Fill Start Address
		+ 0x08		R/W:	SH2_RB_VDP_AF_Data	VDP Fill Data
		+ 0x0A		R/W:	SH2_RB_VDP_State	VDP Status
0x00004200 - 0x000043FF		VDP CRAM (512 bytes)
0x02000000 - 0x023FFFFF		Cartridge (4 mbytes)
0x04000000 - 0x0401FFFF		Frame Buffer (128k bytes)
0x04020000 - 0x0403FFFF		Frame Buffer Overwrite mode (128k bytes)
0x06000000 - 0x0603FFFF		SDRAM (256k bytes)
0x20000000 - 0x200007FF		SH2 Firmware (2k bytes)	 	- MIRROR
0x20004000 - 0x200040FF		32x Registers (64 bytes) 	- MIRROR
0x20004100 - 0x200041FF		VDP Registers (16 bytes) 	- MIRROR
0x20004200 - 0x200043FF		VDP CRAM (512 bytes)	 	- MIRROR
0x22000000 - 0x223FFFFF		Cartridge (4 mbytes)	 	- MIRROR
0x24000000 - 0x2401FFFF		Frame Buffer (128k bytes)	- MIRROR
0x04020000 - 0x0403FFFF		Frame Buffer Ovr (128k bytes)	- MIRROR
0x26000000 - 0x2603FFFF		SDRAM (256k bytes)	 	- MIRROR
0xC0000000 - 0xC0000FFF		SH2 Chache (4k bytes)
0xFFFFFE00 - 0xFFFFFFFF		SH2 Internal registers

Notes: Firmware is different for both the Master and Slave SH2s. Also, both CPUs
share the same RAM, this is why both initial stacks are different.

Description of the 32x Registers
================================
0x00.b	Bus Arbiter Controller High
-----------------------------------
Write:	Bit 7:	Frame Mode Select
		1: Switch the currently unselected frame buffer to SH2 memory
		0: Switch the currently unselected frame buffer to Genesis 68k memory
Read:	Bit 7:	1-The cram and currently unselected frame buffer will appear on the
		  SH2 memory
		0-The cram and currently unselected frame buffer will appear on the
		  Genesis 68k memory
	Bit 5:	Always reads as 1

0x01.b	Bus Arbiter Controller Low
----------------------------------

0x02.w	Interruper Controller
-----------------------------

0x04.w	Cartridge Bankswitching
-------------------------------
Write:	Bits 0-1:	Determines which 1 mb long cartridge ROM bank will appear at
			0x900000-0x9FFFFF on the 68k. Each bank is one megabyte long.

Bankswitching Example Values (FOR THE 68k !!!)
 0x0000: 0x900000-0x9FFFFF appears as 0x000000-0x0FFFFF ROM
 0x0001: 0x900000-0x9FFFFF appears as 0x100000-0x1FFFFF ROM
 0x0002: 0x900000-0x9FFFFF appears as 0x200000-0x2FFFFF ROM
 0x0003: 0x900000-0x9FFFFF appears as 0x300000-0x3FFFFF ROM

Read:	Reflects the bank that is set

0x06.w	Data Request Control
----------------------------

0x08.l	Data Request Source
---------------------------

0x0C.l	Data Request Destination
--------------------------------

0x10.w	Data Request Length
---------------------------

0x12	TV FIFO???
------------------

Communication between the Genesis 68k, Master SH2, and Slave SH2
================================================================
There is a communications RAM located from 0x20 - 0x2F from the 32x register offsets.
Each proccessor can read or write to this RAM at any time. For example, if the Master
SH2 writes "1234" to 0x20, then the Genesis 68k sees it as "1234", and the slave SH2
sees it as "1234", der =).

Firmware Startup Messages_________________________________
| Text   | SH2 Address | Function                        |
----------------------------------------------------------
| "M_OK" | 0xA15120    | Master SH2 ready                |
| "S_OK" | 0xA15124    | Slave SH2 ready                 |
| "SQER" | 0xA15120    | Security code mismatch          |
| "_CD_" | 0xA15120    | Sega CD game inserted?          |
| "SDER" | 0xA15120    | SDRAM check error               |
----------------------------------------------------------

Video
=====
Video is very simple in the 32x compared to the Genesis VDP. First of all, only a frame
buffer is used, so all drawing should be stright foreward, and linear. There has always
been talk that the 32x has internal hardware for rotating and scaling, but this isn't
true, all is done in software. The slave sh2 usually handles all complex video effects.
The 32x video can also be appear on top, or on bottem of the Genesis VDP video, depending
on 32x priority levels.

Description of the 32x VDP Registers
====================================
0x00.b	VDP Mode Select High
----------------------------
Write:	Undetermined
Read:	Bit7:	0:	32x system is a PAL unit
		1:	32x system is an NTSC unit

0x01.b	VDP Mode Select Low
---------------------------
Write:	Bits 0-1:	Select the VDP operating mode
			0: VDP drawing disabled
			1: VDP drawing mode 1, 8 BPP Mode
			2: VDP drawing mode 2, 15 BPP Mode
			3: VDP drawing mode 3, RUNLENGTH MODE
	Bit 6:		Does have a purpose, but this is undetermined
	Bit 7:		Select Genesis/32x VDP overlaying priorities
			0: Genesis in front if alpha bit is 0
			   Genesis in back if alpha bit is 1
			1: Genesis in front if alpha bit is 1
			   Genesis in back if alpha bit is 0
Read:	Bits 0-1:	Reflects the operating mode of the VDP
	Bit 7:		Yes

0x02.b	VDP Mode Select High
----------------------------
Does Nothing

0x03.b	VDP Mode Select Low
---------------------------
Write:	Bit 0:		0: Do not shift pixels left by 1
			1: Shift pixels left by 1
Read:	Bit 0:		Shift mode

0x04.w	VDP Fill Length
-----------------------
Read+Write
Specifies the number of words that will be filed in with the VDP fill function. A VDP
Fill Length of 0 will specify one word to be filled.

0x06.w	VDP Fill Start Address
------------------------------
Read+Write
Specifies the start address inside the current frame buffer in the 32x VDP RAM
where the VDP fill function will start to copy. Fills only start at even addresses,
so this function shifts the register data to the left by 1. [0x06] = (YOUR_ADDRESS & 1) / 2

0x08.w	VDP Fill Data
---------------------
Read+Write
Write the fill data here. Fill data is word length. When a word is written here, the
fill function starts immediately.

0x0B.b	VDP Status High
-----------------------
Write:	-Writing a 0x00 will draw frame buffer 0, and frame buffer 1 will appear
	 in memory space for reading+writing
	-Writing a 0x01 will draw frame buffer 1, and frame buffer 0 will appear
	 in memory space for reading+writing
Read:	Bit 0:	Which Framebuffer selected
	Bit 1:	If 0, then the Genesis has authorization to read/write to the frame
		buffer

0x0C.b	VDP Status High
-----------------------
Read:	Bit 6:	Hblank Status, 1=Triggered
	Bit 7:	Vblank Status, 1=Triggered

The Frame Buffer
================c

The VDP Modes
=============
PAL = 240 lines of video, screen is refreshed 50 times per second
NTSC = 224 lines of video, screen is refreshed 60 times per second

Mode 1, 8 BPP (Bits Per Pixel) MODE
-----------------------------------
In this mode, the CRAM is used to reference the RGB values for the colors used for
each pixel. The data in the frame buffer points to the data in the cram to generate
color. Each byte in the frame buffer corresponds to one entry in the cram.

Frame Buffer Address		Prupose
PAL:	0x00000 - 0x001DF	Each word value points to an address in the frame
NTSC:	0x00000 - 0x001BF	buffer. Each value is for each line of the display.
				EG: Address 0x00000.w in the frame buffer points to
				line 0 on the TV, and address 0x00100.w points to line
				128 on the TV. The pointer data is shifted to the left
				by 1 (or multiplied by 2) by the VDP. So putting a value
				of 0x01C0 at 0x00002.w will make the VDP use the frame
				buffer address at 0x00380 to display the line at line
				1 on the TV.

PAL:	0x001E0 - 0x1FFFF	Each byte value points to an entry in CRAM.
NTSC:	0x001C0 - 0x1FFFF

Mode 2, 15 BPP (Bits Per Pixel) MODE
------------------------------------
In this mode, the Frame Buffer Data is used to reference the RGB values for the colors
used for each pixel. Each word in the frame buffer corresponds to one pixel. The CRAM
is unused in this mode.

Frame Buffer Address		Prupose
PAL:	0x00000 - 0x001DF	Each word value points to an address in the frame
NTSC:	0x00000 - 0x001BF	buffer. Each value is for each line of the display.
				EG: Address 0x00000.w in the frame buffer points to
				line 0 on the TV, and address 0x00100.w points to line
				128 on the TV. The pointer data is shifted to the left
				by 1 (or multiplied by 2) by the VDP. So putting a value
				of 0x01C0 at 0x00002.w will make the VDP use the frame
				buffer address at 0x00380 to display the line at line
				1 on the TV.

PAL:	0x001E0 - 0x1FFFF	Each byte value contains the pixel data.
NTSC:	0x001C0 - 0x1FFFF	15             0
				ABBBBBGGGGGRRRRR
				See the section CRAM for more info on the pixel format

Mode 3, RUNLENGTH MODE
----------------------
This is a weird mode for the 32x, although there are many purposes for it. A pixel in
this mode is generated by a CRAM entry refrerence, and a number to count how many times
to display that given pixel, like RLE compression. This is almose like VDP MODE 1 using
8 BPP, except that each data display entry is 2 bytes.

Frame Buffer Address		Prupose
PAL:	0x00000 - 0x001DF	Each word value points to an address in the frame
NTSC:	0x00000 - 0x001BF	buffer. Each value is for each line of the display.
				EG: Address 0x00000.w in the frame buffer points to
				line 0 on the TV, and address 0x00100.w points to line
				128 on the TV. The pointer data is shifted to the left
				by 1 (or multiplied by 2) by the VDP. So putting a value
				of 0x01C0 at 0x00002.w will make the VDP use the frame
				buffer address at 0x00380 to display the line at line
				1 on the TV.

PAL:	0x001E0 - 0x1FFFF	Each byte value contains the runlength data. The first
NTSC:	0x001C0 - 0x1FFFF	byte holds the number or times to draw the pixel. The
				second byte holds the CRAM entry number. If the pixel
				count number is 0, then nothing is drawn. Each value
				for the pixel count is equal to one pixel.

CRAM
====
The 32x can generate a maximum color pallette of 32768 colors. There is also an alpha
bit, which selects priority between which will be drawn in front of the TV, either
the Genesis VDP, or 32x VDP (Alpha is a name i came up with, since no name is
designated yet, and that it isn't really an aplha :D)

15             0
ABBBBBGGGGGRRRRR

Bits 0-4:	Red Value
Bits 5-9:	Green Value
Bits 10-14:	Blue Value
Bit 15:		Alpha (see the 0x01.b VDP Mode Select Register in VDP register
		descriptions)

Document History
================
version 1	8/23/04		First Public Release
				Doc first typed up on 6/10/04
