Sega Dreamcast

The SH-4 (SH7091 variant at 200 MHz) is a 32-bit RISC processor with fixed 16-bit instruction encoding, a hardware FPU with vector extensions, and 2-way superscalar issue. It is the sole processor responsible for all game logic and 3D math—the PowerVR GPU performs no vertex transformation.

Register file

General-purpose registers (32-bit): R0–R15, where R0 has special roles in indexed addressing and some immediate-mode instructions. R15 is conventionally the stack pointer. R0–R7 are banked: two physical sets (BANK0 and BANK1) are selected by SR.RB, enabling fast exception entry without register saves.

Floating-point registers (32 physical banks of 16): FR0–FR15 (single-precision, active bank), XF0–XF15 (extended bank, the other bank). The FPSCR.FR bit swaps which physical bank is "front" (FR) vs. "back" (XF). Double-precision pairs: DR0 = {FR0,FR1}, DR2 = {FR2,FR3}, … DR14 = {FR14,FR15}. Four-component vectors: FV0 = {FR0–FR3}, FV4 = {FR4–FR7}, FV8 = {FR8–FR11}, FV12 = {FR12–FR15}. The back-bank matrix register XMTRX is a 4×4 matrix laid out column-major: column 0 = {XF0–XF3}, column 1 = {XF4–XF7}, column 2 = {XF8–XF11}, column 3 = {XF12–XF15}.

Control/system registers:

SR bit layout (reset value 0x700000F0)bit 0 = T (true/false condition), bit 1 = S (MAC saturation), bits 4–7 = IMASK (interrupt mask level 0–15), bit 8 = Q, bit 9 = M (divide step state), bit 12 = FD (FPU disable), bit 28 = BL (exception block), bit 29 = RB (register bank select), bit 30 = MD (0=user, 1=privileged).

FPSCR bit layout (reset value 0x00040001)bits 0–1 = RM (00=round-nearest, 01=round-zero), bits 2–6 = Flag (I,U,O,Z,V sticky), bits 7–11 = Enable (I,U,O,Z,V), bits 12–17 = Cause (I,U,O,Z,V,E—cleared before each FPU op), bit 18 = DN (denorm-as-zero), bit 19 = PR (0=single, 1=double), bit 20 = SZ (FMOV transfer size, 0=32-bit, 1=64-bit pair), bit 21 = FR (FP bank select). The combination SZ=1 + PR=1 is reserved and must never be set.

Instruction set architecture

All instructions are 16 bits wide. Fields commonly encode nnnn (destination register 0–15), mmmm (source register), dddddddd (displacement), iiiiiiii (immediate). The instruction set spans these categories:

Data transfer: MOV Rm,Rn (0110nnnnmmmm0011), MOV #imm,Rn (1110nnnniiiiiiii), MOV.B/W/L with all addressing modes (register indirect, pre-decrement @-Rn, post-increment @Rn+, indexed @(R0,Rn), displacement @(disp,Rn), GBR-based @(disp,GBR), PC-relative @(disp,PC)), MOVA (11000111dddddddd), MOVT, SWAP.B/W, XTRCT, LDS/STS (to/from FPUL, FPSCR, MACH, MACL, PR), LDC/STC (to/from SR, GBR, VBR, SSR, SPC, DBR, SGR, Rn_BANK).

Arithmetic: ADD, ADDC, ADDV, SUB, SUBC, SUBV, NEG, NEGC, MUL.L, MULS.W, MULU.W, DMULS.L, DMULU.L, MAC.L, MAC.W, DT (decrement-and-test), DIV0S, DIV0U, DIV1, CMP/EQ, CMP/GE, CMP/GT, CMP/HI, CMP/HS, CMP/PL, CMP/PZ, CMP/STR, CMP/EQ #imm, EXTS.B/W, EXTU.B/W.

Logic: AND, OR, XOR, TST, NOT—plus @(R0,GBR) variants for AND.B, OR.B, TST.B, XOR.B.

Shift: ROTL, ROTR, ROTCL, ROTCR, SHAL, SHAR, SHLL/SHLR (1/2/8/16), SHAD Rm,Rn (0100nnnnmmmm1100—arithmetic dynamic shift, new in SH-3/4), SHLD Rm,Rn (0100nnnnmmmm1101—logical dynamic shift, new in SH-3/4).

Branch: BF (10001011dddddddd), BT (10001001dddddddd), BF/S and BT/S (with delay slot), BRA (1010dddddddddddd), BSR, BRAF Rm (0000mmmm00100011—PC-relative far branch via register, new vs SH-1), BSRF Rm (0000mmmm00000011), JMP @Rm, JSR @Rm, RTS, RTE (0000000000101011). All unconditional branches and JMP/JSR/RTS/RTE have delay slots.

System: NOP, SLEEP, CLRT, SETT, CLRS, SETS, CLRMAC, TRAPA #imm (11000011iiiiiiii), LDTLB (0000000000111000—load TLB entry from PTEH/PTEL, new in SH-3/4).

Floating-point instructions (all new vs SH-2)

The SH-2 has no FPU. Every FP instruction below is an SH-4 addition. All FP opcodes begin with 1111 in bits [15:12].

FMAC is the cornerstone single-precision multiply-accumulate: FR0 × FRm + FRn → FRn with full 28-bit internal precision. FIPR computes a 4-component inner product in 4 cycles. FTRV multiplies XMTRX (the back-bank 4×4 matrix) by FVn in 7 cycles—this is the critical instruction for vertex transformation. FSRRA and FSCA are technically SH-4A instructions but are present on the Dreamcast's SH7091 silicon and widely used by games.

Cache control and other SH-4 additions over SH-2

Beyond the entire FPU, these instructions are new to SH-4

• PREF @Rn (0000nnnn10000011) — Prefetch 32-byte cache line to operand cache
• OCBI @Rn (0000nnnn10010011) — Operand cache block invalidate
• OCBP @Rn (0000nnnn10100011) — OC block purge (writeback + invalidate)
• OCBWB @Rn (0000nnnn10110011) — OC block writeback (keep valid)
• MOVCA.L R0,@Rn (0000nnnn11000011) — Move with cache block allocate (no read-fill)
• SHAD/SHLD — Dynamic shift by register amount (SH-3/4)
• BRAF/BSRF — PC-relative far branches (added SH-2, absent in SH-1)
• LDTLB — Load TLB from PTEH/PTEL/PTEA

Addressing modes

Superscalar pipeline

The SH-4 has a 5-stage pipeline (IF → ID → EX → MA → WB) and can dual-issue by classifying instructions into groups: MT (move/trivial—can pair with anything), EX (execute-stage ALU), LS (load/store), FE (FP execute), BR (branch), CO (co-issue prohibited—always single-issue). Two instructions from different groups can issue together. CO-group instructions (LDC, STC, LDS, STS, TRAPA, RTE, SLEEP, MAC.L, MAC.W) always execute alone.

Memory-mapped control registers (P4 area, 0xFFxxxxxx)

CCR (0xFF00001C) bit layoutbit 0 = OCE (OC enable), bit 1 = WT (write-through), bit 2 = CB (copy-back P1), bit 3 = OCI (OC invalidate), bit 5 = ORA (OC-as-RAM enable for 8KB+8KB split), bit 7 = OIX (OC index mode), bit 8 = ICE (IC enable), bit 11 = ICI (IC invalidate), bit 15 = IIX (IC index mode).

Store queues at 0xE0000000–0xE3FFFFFFtwo 32-byte buffers (SQ0 at bit[5]=0, SQ1 at bit[5]=1). Filled with MOV.L writes, flushed via PREF @Rn. Upper physical address bits come from QACR0/QACR1. Critical for burst-writing display lists to the TA FIFO.

Exception handling

Exception entrySR→SSR, PC→SPC, R15→SGR, set SR.MD=1, SR.RB=1, SR.BL=1, write exception code to EXPEVT or INTEVT, branch to VBR + offset. Offsets: +0x100 for general exceptions, +0x400 for TLB miss, +0x600 for interrupts. Reset vectors are fixed at 0xA0000000 (power-on) and 0xA0000020 (manual). Key EXPEVT codes: 0x040/0x060 = TLB miss read/write, 0x0E0/0x100 = address error read/write, 0x120 = FPU exception, 0x160 = TRAPA, 0x180 = illegal instruction, 0x800 = FPU disable.

How TBDR works

Unlike immediate-mode renderers that process triangles in submission order and rely on a Z-buffer to resolve visibility (causing massive overdraw), the PowerVR divides the screen into 32×32 pixel tiles and performs per-tile hidden surface removal (HSR) before texturing. This means the texture shading processor (TSP) only processes the visible fragment per pixel—zero overdraw. The process has two asynchronous phases that can overlap across frames:

Binning phase (Tile Accelerator): The CPU submits geometry as global parameters + vertex parameters to the TA FIFO at physical address 0x10000000. The TA sorts each primitive into the tiles it overlaps, building per-tile Object Pointer Buffers (OPBs) and an Object Buffer (OB) in VRAM.

Rendering phase (ISP → TSP): Triggered by writing to STARTRENDER (0xA05F8014). For each tile: the ISP (Image Synthesis Processor) fetches the tile's primitives, performs depth testing and HSR to find the visible surface at each pixel, and the TSP (Texture Shading Processor) applies texturing, shading, and blending only to visible fragments. The completed tile is written to the framebuffer in VRAM. This per-tile architecture means the working set fits in on-chip SRAM, delivering extremely high effective fill rates.

Three rendering lists

• Opaque (PVR_LIST_OP_POLY): Front-to-back HSR, only the nearest fragment is textured. No alpha blending. Most efficient list.
• Translucent (PVR_LIST_TR_POLY): Supports alpha blending. The hardware performs order-independent transparency—automatically sorting translucent fragments per-pixel and blending back-to-front. Slower than opaque but avoids manual sorting.
• Punch-through (PVR_LIST_PT_POLY): 1-bit alpha test against PT_ALPHA_REF. Pixels either fully opaque or fully discarded. Used for cutout textures (foliage, chain-link fences).

Each list also has optional modifier volume variants (opaque modifier, translucent modifier) for stencil-like per-pixel shadow effects using inclusion/exclusion volumes.

Tile Accelerator parameter format

Parameters are submitted as 32-byte aligned blocks to the TA FIFO at 0x10000000 (or 0xB0000000 via P2). Two main types:

Global parameters (32 bytes): Set polygon state for subsequent vertices. Word 0 is a parameter control word encoding: bits [31:29] = parameter type (0=end-of-list, 4=polygon/modifier, 7=vertex), bits [26:24] = list type (0=opaque, 1=opaque modifier, 2=translucent, 3=translucent modifier, 4=punch-through), bits [22:21] = group/strip control. Subsequent words contain: ISP/TSP instruction word (depth compare mode, culling, Z-write), TSP instruction word (texture filtering, UV clamp/flip, fog, alpha), texture control word (address in VRAM, format, mip, VQ, twiddled, size).

Vertex parameters (32 bytes): Position as 3 × 32-bit IEEE floats (X, Y, Z where Z is 1/W for perspective correction), packed ARGB color (32-bit), base/offset colors, UV texture coordinates (32-bit float or 16-bit packed). Bit 28 in the parameter control word signals end-of-strip (last vertex of a triangle strip).

End-of-list: A special 32-byte parameter (type field = 0) marks the end of the current polygon list.

Texture formats

Twiddled textures store pixels in Morton order (Z-order curve), interleaving U and V coordinate bits. This dramatically improves 2D spatial locality for texture cache access. All power-of-two textures should be twiddled; paletted textures are always twiddled.

VQ (Vector Quantization) compression stores a 2048-byte codebook of 256 entries, each a 2×2 texel block (4 pixels × 2 bytes at 16bpp). The image data is a twiddled array of 8-bit indices into this codebook, achieving approximately 8:1 compression for 16bpp textures. Decoded in hardware at zero performance cost.

Stride textures support non-power-of-two widths (multiples of 32, up to 992). Width is set globally via TSP_CFG register (0xA05F80E4) bits [4:0].

PVR core registers (base 0xA05F8000)

8MB VRAM layout

VRAM occupies physical 0x04000000–0x047FFFFF (8MB) in two 4MB banks. The 32-bit area (0xA5000000–0xA57FFFFF via P2) provides sequential access—used for framebuffers. The 64-bit area (0xA4000000–0xA47FFFFF) interleaves banks every 4 bytes for double bandwidth—used for textures. Typical allocation: two framebuffers (~614KB each at 640×480×16bpp), two tile-buffer sets (OPB+OB), texture memory occupying the remainder. Total usable texture space depends on resolution and buffering strategy.

Architecture overview

The AICA integrates a 64-channel PCM/ADPCM synthesizer, a 128-step programmable DSP, and an ARM7DI processor (no Thumb, no hardware multiplier) running at approximately 45 MHz with 2MB dedicated sound RAM. The ARM7 executes audio driver code independently from the SH-4—it has no built-in firmware and must be loaded by the main CPU.

AICA registers from SH-4 (physical addresses in Area 0)

Via P20xA0700000 for registers, 0xA0800000 for sound RAM.

Channel registers (64 channels × 0x80 bytes = 0x2000 bytes at offset 0x0000)

Each channel occupies 0x80 bytes starting at base + (channel × 0x80)

Key system registers

SH-4 ↔ ARM7 communication

The SH-4 loads the ARM7 audio driver into sound RAM (0x00800000), then clears bit 0 of ARMReset (0x2C00) to release the ARM7. The ARM7 boots from address 0x00000000 in its local space (= start of sound RAM). Communication uses shared mailbox regions in sound RAM—the SH-4 writes commands and audio data; the ARM7 reads them and controls the 64 channels. Interrupts can be sent bidirectionally via the INTSend/INTRequest registers.

Physical address space (29-bit, 8 × 64MB areas)

Logical address regions (32-bit, SH-4 with MMU off)

Games typically access main RAM at 0x8C000000 (P1, cached) or 0x0C000000 (P0), and hardware registers at 0xA05Fxxxx (P2, uncached).

Bus architecture

The SH-4 connects to main RAM directly via a 100 MHz, 64-bit SDRAM bus (two 32-bit banks). The SH-4 connects to Holly via a 100 MHz multiplexed address/data bus (MPX mode). Holly's internal root bus connects to: PVR core (with 64-bit 100 MHz VRAM bus), G1 bus (GD-ROM, Boot ROM, Flash—16-bit), G2 bus (AICA, modem, expansion—16-bit), and Maple interface (serial). All DMA is arbitrated by Holly's bus arbiter.

Key DMA channels: SH-4 DMAC has 4 channels (SAR/DAR/DMATCR/CHCR registers at 0xFFA00000–0xFFA0003C per channel, DMAOR at 0xFFA00040). Holly provides additional DMA: Ch2-DMA for PVR (0xA05F6800), Sort-DMA (0xA05F6810), GD-ROM DMA (0xA05F7404), AICA DMA (via G2), Maple DMA (0xA05F6C04).

The GD-ROM (Gigadisc) is a dual-density proprietary disc format. The low-density area (inner tracks, ~35MB) is standard CD-readable and contains a warning audio track and small data track. A security ring separates it from the high-density area (outer tracks, ~984MB at double density), which contains the game data and is unreadable by standard CD drives. The drive reads using CAV (Constant Angular Velocity) at 4× in the low-density area and 6–12× in the high-density area, with a 128KB buffer. The file system is ISO 9660 with Joliet extensions.

GD-ROM registers (G1 bus, ATAPI-like)

ATAPI commands0xA0 (PACKET—sends 12-byte command packet), 0x08 (soft reset), 0x90 (diagnostic), 0xA1 (identify). GD-ROM DMA registers at 0xA05F7404 (start address), 0xA05F7408 (length), 0xA05F7414 (enable), 0xA05F7418 (status).

Boot sequence

Boot ROM at 0xA0000000 → authenticates disc → loads IP.BIN (32KB from high-density area FAD ~45150) to 0x8C008000 → IP.BIN contains meta info (hardware ID "SEGA SEGAKATANA", product number, boot filename), SEGA license screen code, and two customizable bootstrap stages → reads 1ST_READ.BIN (filename from IP.BIN offset 0x60) from ISO 9660 filesystem, descrambles it, loads to 0x8C010000 → IP.BIN displays SEGA logo → bootstrap sets up stack, VBR, disables cache → jumps to 0x8C010000.

Protocol fundamentals

Maple is a proprietary 2-wire serial bus at ~2 Mbps connecting 4 controller ports, each supporting 1 main peripheral + up to 5 sub-peripherals (expansion slots). All Maple transactions are initiated by the SH-4 through Holly's DMA controller—the CPU writes a linked list of transfer descriptors to main RAM, points the Maple DMA register at it, and triggers the transfer.

Maple DMA registers

Frame format

Each Maple frame consists of a 32-bit header word followed by 0–255 data words

Address encoding: Bits [7:6] = port (0=A, 1=B, 2=C, 3=D). Bit 5 = main peripheral. Bits [4:0] = sub-peripheral select (one-hot). Host addresses: 0x00, 0x40, 0x80, 0xC0. Main peripheral addresses: 0x20, 0x60, 0xA0, 0xE0. Sub-peripherals: 0x01/0x02/0x04 (port A), etc.

Command codes

Function codes (device capabilities)

Controller data format (Get Condition response)

The standard controller returns condition data with inverted button logic (0 = pressed, 1 = released)

Following the 16-bit button wordR trigger (8-bit, 0–255), L trigger (8-bit, 0–255), analog stick X (8-bit, 0=left, 128=center, 255=right), analog stick Y (8-bit, 0=up, 128=center, 255=down), then second stick X/Y for dual-stick controllers.

VMU (Visual Memory Unit)

The VMU contains a Sanyo LC86K87 8-bit CPU, 128KB flash (200 usable blocks × 512 bytes), a 48×32 monochrome LCD (viewed as 48 wide × 32 tall), 4-direction D-pad + A/B/MODE/SLEEP buttons, and a CR2032 battery. It exposes three Maple functions: Storage (0x00000002) for block read/write of save data, Screen (0x00000004) for LCD bitmap writes (192 bytes = 48×32 pixels at 1bpp), and Timer (0x00000008) for the real-time clock. Block reads/writes use commands 0x0B/0x0C with a location word encoding partition, phase, and block number.

The Purupuru (Rumble) Pack exposes function 0x00000100 and is controlled via Set Condition (0x0E) with vibration intensity, duration, and frequency parameters.

The Dreamcast's architecture presents several unique challenges for static recompilation. The SH-4's 16-bit fixed-width instructions simplify decoding but its delay slots on all unconditional branches, FP register banking (FPSCR.FR toggling two 16-register banks), and dual-issue superscalar scheduling require careful modeling. The vector instructions FIPR and FTRV operate across register banks—FTRV reads the back bank as a matrix—making bank-swap tracking essential.

The PowerVR's tile-based architecture means the GPU has no equivalent to a traditional draw call pipeline—all geometry flows through the TA FIFO as parameter blocks, and rendering is deferred per-tile. Emulating this requires either full TBDR simulation or converting the TA parameter stream into modern GPU API calls with manual tile management. The store queue mechanism (0xE0000000 + PREF) is the primary fast path for TA submission and must be correctly emulated.

The AICA's independent ARM7 core means a recompiler must run two instruction-set decoders and manage cross-CPU communication through shared sound RAM. The Maple bus adds a third protocol layer with its own DMA descriptor format. All three subsystems operate asynchronously—timing-accurate synchronization between the SH-4, ARM7, PVR rendering, and Maple DMA polling is the central challenge of any Dreamcast recompilation engine.

AICA Audio Registers (G2-bus, $00700000 base)

The AICA is the Dreamcast's descendant of the Saturn SCSP — same Yamaha lineage but with 64 channels (vs 32), an ARM7DI coprocessor (vs 68EC000), and 2 MB sound RAM (vs 512 KB). Registers are accessed via G2-bus from the SH-4 at physical $00700000 (P2: $A0700000).

Per-Channel Registers (64 channels × $80 bytes at $00701000 + slot×$80):

Read EG[12:0]/SGC at channel offset for current envelope state.

AICA Channel Setup Pseudocode:

void aica_channel_setup(uint8 slot, uint32 sa, uint16 lsa, uint16 lea,
uint8 pcms, uint16 fns, int8 oct,
uint8 tl, uint8 disdl, uint8 dipan) {
uint32 base = 0x00701000 + slot * 0x80;
write32(base + KYONB_OFF, 0);           // clear key-on
write32(base + SA_OFF, sa >> 1);        // sample address (byte→word)
write16(base + LSA_OFF, lsa);
write16(base + LEA_OFF, lea);
write8(base + PCMS_OFF, pcms);          // 0=PCM16, 1=PCM8, 2=ADPCM4
write16(base + FNS_OFF, fns);
write8(base + OCT_OFF, oct & 0xF);
write8(base + AR_OFF, 0x1F);            // max attack rate
write8(base + TL_OFF, tl);
write8(base + DISDL_OFF, disdl);
write8(base + DIPAN_OFF, dipan);
write8(base + EFSDL_OFF, 0xF);          // max effect send
write32(base + KYONEX_OFF, 1);          // trigger key-on
}

Global Registers ($00702800+):

Timer Overflow → IRQ Chain: Timer A/B/C overflow → sets SCIPD bit → if SCIEB enabled → ARM7 interrupt. If MCIEB enabled → MCIPD set → Holly ISTNRM sound request → SH-4 interrupt at VBR+$600.

DSP Effect Chain (128-step MPRO at $00703400):

64-bit instruction encodingMASA[5:0], IRA/TWA/TRA/EWA, MRD/MWT, YSEL/XSEL, SHFT, NEGB. Ring buffer formula: (MADRS + ADRS_REG + MDEC_CT + NXADR) mod RBL_size. Coefficients at $00703200 (64 entries). Data/temp RAM at $00703400–$000043FF.

Standard effectsHall reverb = 34 steps, Chorus = 22 steps (LFO on delay line). Representative COEF values (no commercial dumps exist publicly): COEF[0]=0x7FFF (gain),

0x4000

(damp), etc.

Dynarec C++ Driver Pattern (from Flycast — x64/ARM64 with dirty-flag + fallback):

class AICA_DSP {
bool dirty = true;
void* dynarec_code = nullptr;
public:
void Run(u32 samples) {
if (dirty || MPRO_changed) { dsp_recompile(); dirty = false; }
for (u32 i = 0; i < samples; i++) {
if (dynarec_enabled) ((void(*)())dynarec_code)();
else runStep();  // interpreter fallback
}
}
void dsp_recompile() { /* emit x64/ARM64 for 128-step MPRO */ }
};

GD-ROM Controller Registers (G1-bus, $A05F7000 base)

ATAPI Registers (directly mapped):

GD-ROM DMA Registers:

GD-ROM DMA Read Protocol (high-density sector read):

void gdrom_dma_read(uint32 fad, uint32 sectors, void* buf) {
write32(0xA05F7404, 0x01);       // FEATURES=DMA mode
write32(0xA05F7408, sectors);
write32(0xA05F709C, 0xA0);       // ATAPI PACKET command
// Send 12-byte CDB: cmd $30 (READ_CD), format, FAD, count
uint8 cdb[12] = {0x30, 0x0C,
(fad>>24), (fad>>16), (fad>>8), fad,
0x00, (sectors>>8), sectors, 0x00, 0x00, 0x00};
for (int i = 0; i < 12; i += 2)
write16(0xA05F7018, (cdb[i]<<8) | cdb[i+1]);
// Configure DMA
write32(0xA05F7404, (uint32)buf);
write32(0xA05F7408, sectors * 2048 / 32);
write32(0xA05F740C, 1);           // direction
write32(0xA05F7414, 1);           // enable → starts transfer
write32(0xA05F7418, 1);           // initiate
while (read32(0xA05F7418) & 1);   // poll or use ISTNRM[14]
}

High-Density Access: GET_TOC command ($14, byte1=1) to switch to GD area.

Sense Key Table + Recovery:

• $05/$21 (illegal FAD) → re-GET_TOC
• $03/$11 (medium error) → CD_OPEN retry
• $0B/$4E (aborted) → SOFT_RESET

KOS-style IRQ Driver:

static void gdrom_irq_callback(uint32 status) {
if (status & (1<<14)) gdrom_dma_done = true;
else if (status & ISTERR_MASK)
gdrom_kos_timed_recovery(cdrom_get_sense());
}

Maple Bus DMA Registers ($A05F6C00 base)

DMA Descriptor Format (32-byte aligned in main RAM):

Lightgun Support: Set GUN=1 + LAST=1 in descriptor word 0 → 8 SDCKB clock pulses →

hardware latches H/V position to PVR register $A05F80C4 (H[31:16], V[15:0]). CRC variants

0xFF

or 0x00 initial XOR.

VMU Operations (controller + 5 sub-peripherals per port):

typedef struct {
uint32 cmd;        // $0B=block_read, $0C=block_write
uint32 recipient;  // $21 | (sub << 4)
uint32 sender;
uint32 length;
uint8 data[256];
} maple_frame;

int maple_vmu_op(uint8 port, uint8 pt, uint8 phase,
uint8 block, void* buf, bool write, uint8 sub) {
maple_frame f = {
.cmd = write ? 0x0C : 0x0B,
.recipient = 0x21 | (sub << 4),
// ...
};
maple_send_frame(&f);
for (uint8 s = 0; s < 5; s++) maple_queue_frame(&f);
while (!maple_done());
maple_response r; maple_parse_response(&r);
if (r.error & 0x20) { /* phase retry or bad-block remap */ }
uint8 crc = 0xFF;
for (each byte in data) crc ^= byte;
return crc;
}

SH-4 DMAC + Store Queue

DMAC (4 channels at $FFA00000):

Store Queue (TA Fast Path):

Two 32-byte buffers at $E0000000 (SQ0 at bit[5]=0, SQ1 at bit[5]=1). Fill with MOV.L writes, flush via PREF @Rn instruction. Upper physical address bits from QACR0/QACR1 ($FF000034/$FF00003C).

Primary useburst-write display lists to TA FIFO at physical $10000000 (64-bit transfer size). This is the critical fast path for geometry submission — all high-performance Dreamcast games use Store Queue → TA FIFO for polygon submission.

PVR Tile Accelerator (TA) Parameter Format

Parameter Control Word (PCW — Word 0):

ISP Word 1: [31:29]=depth compare mode, [28:27]=cull mode (none/small/CW/CCW), [26]=z-write disable.

TSP Word 2/3: Blend mode (src/dst alpha factors), fog control, texture filter (point/bilinear/trilinear), UV clamp/flip, texture address in VRAM, format (ARGB1555/RGB565/ARGB4444/YUV422/bump/4BPP/8BPP), mip-map, VQ compression, twiddled.

17-Vertex Parse: TA processes up to 17 vertices per polygon submission. Region array links Object Pointer Buffers (OPB) per 32×32 pixel tile.

OPB Chaining (all resolutions):

void ta_link_opb(uint32 tx, uint32 ty, uint32 list, uint32 ptr) {
uint32 tiles_x = (FB_W_CTRL & 0x1) ? 20 : 10;
uint32* region = (uint32*)(TA_OL_BASE + (ty * tiles_x + tx) * 24 + list * 4);
*region = ptr;
write32(TA_NEXT_OPB, ptr + 64);
write32(TA_ITP_CURRENT, ptr);
write32(TA_GLOB_TILE_CLIP, (ty << 16) | tx);
write32(TA_OBJECT_CLIP, (ty << 16) | tx);
write32(TA_SQ_WRITE, ptr);
write32(TA_OL_LIMIT, ptr + 0x100000);
}

Submission via Store Queue (TA_SQ_WRITE at TA FIFO $10000000).

Additional Holly Registers ($A05F8000+)

Complete I/O Register Dispatch Table

Integration with Existing Pipeline

Interrupt routing through Holly ISTNRM/ISTEXT:

• GD-ROM DMA complete → ISTNRM[14]
• Maple DMA complete / lightgun → ISTNRM[12] + HV latch to $005F80C4
• PVR render complete → ISTNRM[2]
• TA object buffer overflow → ISTERR[5]
• AICA → SH-4 interrupt via MCIPD → Holly ISTNRM sound request bit

SH-4 DMAC + Store Queue fast path:

• PREF instruction flushes 32-byte SQ → TA FIFO at $10000000
• DMAOR master enable (DME bit) required before any DMAC channel transfer
• QACR0/QACR1 ($FF000034/$FF00003C) configure upper address bits for SQ target
• 64-bit burst transfer size on SQ flush

Verification Notes

Test approach (Flycast/lxdream trace comparison):

1. Holly ISTNRM — verify write-1-to-clear (AND NOT) behavior, all 32 flag bits
2. GD-ROM ATAPI — send PACKET command, verify status progression (BSY→DRQ→ready)
3. Maple MDST — start DMA, verify auto-clear of bit 0 on completion + ISTNRM[12]
4. AICA ARMRST — load driver to $00800000, clear bit 0, verify ARM7 boots
5. PVR TA_INIT → STARTRENDER — submit geometry, verify ISTNRM[2] on render done
6. Lightgun — set GUN=1 in maple descriptor, verify HV latch at $005F80C4

Commercial game validation:

• Sonic Adventure: Store Queue TA submission + PVR STARTRENDER at 60fps
• Soul Calibur: Vertex-heavy TA submission with OPB chaining across 640×480 tiles
• Shenmue: GD-ROM streaming + AICA DSP ambient reverb (34-step hall)
• House of the Dead 2: Lightgun HV latch + GUN maple descriptor protocol

AICA DSP — ARM7 Address Space + Upload Protocol

The AICA DSP registers have dual address mappings — the SH-4 accesses them via

G2-bus at $00700000+, while the ARM7 coprocessor accesses them locally at $00800000+

DSP MPRO Upload Format: Each 64-bit program step is written as 4 × 16-bit words

• STEP[63:48] at base address
• STEP[47:32] at base + 4
• STEP[31:16] at base + 8
• STEP[15:0] at base + 12

COEF Table: 128 entries × 13-bit signed values (vs 64 entries documented in Final Synthesis — the full bank is 128). Used by the DSP for scaling, feedback coefficients, and filter parameters. Loaded via SH-4 G2-bus writes after ARM7 reset.

Additional Per-Channel Register — IMXL/ISEL:

• Offset +$30: FX mixer send level (IMXL) and DSP bus select (ISEL). Controls which

DSP mixer input bus the channel feeds into. This register shares the offset with DISDL/DIPAN but uses different bit fields for the mixer routing.

DSP Enable: MVOL register ($00702800) bit 4 enables DSP program execution. Must be set after loading MPRO and COEF. The DSP runs synchronously at the AICA sample rate.

Effect Presets (SCSP-ported patterns):

• Hall reverb: 34 steps
• Chorus: 22 steps (LFO modulation on delay line)
• Delay: 20 steps (simple echo with feedback)

G2 Bus Access Constraints:

• G2-bus writes from SH-4 stall for ≤16µs while AICA DMA is active
• Reading AICA registers during active DMA transfer blocks until DMA completes
• Writes to channel registers while KYONEX is pending may be ignored

GD-ROM — Full ATAPI Command Table + ASC/ASCQ Error Codes

The GD-ROM controller uses an extended ATAPI command set defined in Sega's SPI Protocol Ver.1.30 specification (Cdif131e.pdf). The controller registers at $A05F7400+ are mirrored at physical $005F74xx.

Extended Register Layout (G1-bus $A05F7400+):

ATAPI + Vendor Command Table (SPI Ver.1.30):

ASC/ASCQ Error Code Table (SPI Appendix I, verbatim):

Sector Read + Laser Recovery Sequence (DMA preferred):

void gdrom_read_lba(u32 lba, void* buf, u32 sectors) {
write_gd(0x741C, 0xA0);                    // ATAPI PACKET command
send_12byte_packet(0x30, lba, sectors);     // CD_READ CDB
if (status & 0x01) {                        // ERROR bit set
write_gd(0x741C, 0xA0);
send_12byte(0x13);                      // REQ_ERROR
u8 sense = read_error() >> 4;
u8 asc = read_asc();
u8 ascq = read_ascq();
if (sense == 4 && asc == 0x09 && ascq == 0x04) {
// Laser power control error → SET_MODE laser boost
write_gd(0x741C, 0xA0);
send_12byte(0x12, 0x09, 0x08, 0x00);
delay(50ms);                        // allow laser recalibration
}
retry();
}
// DMA path: set SB_GDSTAR/LEN/DIR=1/EN=1/ST=1; wait ISTNRM bit14
}

Side Effects: ERROR bit assertion → ISTERR interrupt to Holly. Laser servo retry via SET_MODE command ($12) with 50ms recalibration delay.

Maple Bus — Wire Protocol Timing + Response Parsing

The Maple bus operates on 4 independent serial buses (Ports A–D), each with differential clock/data pairs (SDCKA/SDCKB).

Wire Protocol Timing:

Edge Spacing: 125ns between different signal lines (SDCKA→SDCKB), 225ns between same signal line edges. These constraints set the maximum bus throughput.

CRC: Byte-wise XOR with init value 0 over frame header + payload bytes. (Note: The Final Synthesis section documents CRC variants with 0xFF or 0x00 init — the Maximum Depth research confirms init=0 as the canonical implementation.)

**Full Binary Transaction Trace (Port 0controller + VMU + lightgun):**

u32 multi_desc[12] = {
0x80000002 | (0x09<<24) | 0x20, rx1,     // 0x09 Get Condition (controller)
0x80000002 | (0x0B<<24) | 0x21, vmu_rx,  // 0x0B VMU Block Read
0x80000001 | (0x80<<24) | 0x22, gun_rx   // 0x80 Light-Gun (LAST=1)
};

Response Function Codes:

Maple Poll Sequence:

void maple_poll(u32 desc_addr) {
*(u32*)0xA05F6C04 = desc_addr;  // MDSTAR: set descriptor table pointer
*(u32*)0xA05F6C14 = 0x1;        // MDEN: enable Maple DMA
*(u32*)0xA05F6C18 = 0x1;        // MDST: start transfer
while (*(u32*)0xA05F6C18 & 0x1); // poll until !busy (auto-clears)
// Parse response buffers with CRC verification (XOR init 0)
}

SH-4 DMAC — Channel Control Bits + DMA Contention Matrix

CHCRx (Channel Control Register, offset +$0C/+$1C/+$2C/+$3C) Bit Layout:

DMAOR ($FFA00040) Bit Layout:

DMA Contention Matrix (PVR TA + texture upload + GD-ROM load concurrent):

TAFOFINT: TA FIFO overflow interrupt. When SB_TFREM (TA FIFO remaining count) reaches 0, Store Queue writes stall for ~32 cycles until space is available. If overflow persists, TAFOFINT fires and the TA must be reset via SOFTRESET bit 0.

Store Queue Recomp Mapping (TA geometry burst):

u32* sq = (u32*)0xE0000000;
for (int i = 0; i < 8; i++) sq[i] = param[i];  // fill 32 bytes
__asm__("pref @%0" : : "r"(sq));               // PREF → 32B burst to $10000000

PVR TA — Named Registers + Dual FIFO

TA Configuration Registers ($A05F8000+):

Dual TA FIFO:

• Primary: $10000000 (Store Queue target for polygon parameter submission)
• Secondary: $10800000 (alternate FIFO for YUV texture conversion data)

END_OF_LIST: Submitting a parameter with cmd[31:29]=0 (PCW command field) triggers an END_OF_LIST interrupt (ISTNRM list-specific bits), signaling that the current display list is complete and rendering can begin via STARTRENDER.

Holly/PVR Video Output — Timing Tables + Quad-Buffer Swap

Video Output Registers ($A05F8000+):

Video Timing Table (DevBox verbatim defaults):

Quad-Buffer Swap + TA Sync (under TAFOFINT):

void quad_buffer_swap_ta_sync(u32 buf[4], u32 border_rgb) {
if (TAFOFINT()) reset_ta();                  // handle TA overflow
*(u32*)0xA05F8050 = buf[idx];                // FB_R_SOF1: swap scanout buffer
*(u32*)0xA05F8040 = border_rgb;              // VO_BORDER_COL: set border
*(u32*)0xA05F80E8 |= (1<<3);                 // VO_CONTROL: blank_video=1
*(u32*)0xA05F8014 = 0x1;                     // STARTRENDER: begin ISP/TSP
while (!(*(u32*)0xA05F6900 & (1<<12)));      // wait VSYNC (ISTNRM bit 12)
idx = (idx + 1) % 4;
*(u32*)0xA05F80D8 = spg_load;                // SPG_CONTROL → re-arm TA + VPOS reset
}

Side Effects:

• SPG_CONTROL or SPG_LOAD write → restarts sync generator + TA pipeline flush
• blank_video=1 → display shows VO_BORDER_COL instead of framebuffer (prevents tearing

during buffer swap)

• VO_STARTX/Y writes fine-tune CRT horizontal/vertical centering

Expanded I/O Register Dispatch Table

New entries from Maximum Depth Synthesis marked with (MDS)

Combined with the 16 Final Synthesis entries (8 read + 8 write), Dreamcast now has 20 total dispatch entries (8 read + 12 write) in the Final Synthesis table, plus these 4 additional write entries = 24 total (8 read + 16 write).

Cross-Subsystem DMA Coordination

The Dreamcast's subsystems interact through multiple DMA paths that must be correctly

sequenced for recompilation

• AICA audio loading: G2-bus DMA from main RAM to sound RAM ($00800000), coordinated

with SH-4 DMAC CH0. G2 access stalls ≤16µs during active transfer.

• GD-ROM → main RAM: SPI controller triggers GD-ROM DMA. Completion fires ISTNRM[14],

which typically triggers Maple VBLANK poll in the game's interrupt handler.

• TA geometry: Store Queue bursts (PREF → $10000000) use CHCR TS=0 (64-byte SQ

mode). DMAOR round-robin arbitration with MD bit. SB_TFREM monitoring prevents FIFO overflow; TAFOFINT fires if overflow occurs.

• Framebuffer swap: Quad-buffer rotation syncs SPG timing, TA FIFO state, and VO

blanking across all video modes (NTSC/PAL/VGA). SPG_CONTROL write re-arms the TA and resets VPOS for the next frame.

Additional Verification Notes (Maximum Depth)

Expanded test approach:

1. GD-ROM ATAPI command table — send TEST_UNIT_READY ($00), verify no-data status

response; send REQ_ERROR ($13) after forced error, verify ASC/ASCQ matches table

1. Laser recovery — inject sense 4 / ASC $09 / ASCQ $04, verify SET_MODE ($12) issued

with laser boost parameters + 50ms delay

1. Maple wire timing — verify SDCKA/SDCKB edge spacing matches 125ns/225ns spec;

verify CRC with init=0 over frame+payload

1. SH-4 DMAC contention — concurrent CH0 + SQ transfer, verify SB_TFREM stall

behavior (~32 cycles when FIFO full)

1. VO_CONTROL blank_video — set bit 3, verify border color displayed instead of

framebuffer content

1. SPG_CONTROL write — verify sync generator restart and TA pipeline flush on write

Additional commercial game validation:

• Jet Set Radio: Heavy TA geometry + SQ bursts with TAFOFINT recovery
• Crazy Taxi: Continuous GD-ROM streaming + Maple polling in VBLANK handler
• Ikaruga: Precise SPG timing for 60fps progressive scan (VGA mode)