Listing and information on all known SFRs.

Address	Name	Description
CPU
100	ACC	Accumulator
101	PSW	Program Status Word
102	B	B Register
103	C	C Register
104	TRL	Table Reference (Low Byte)
105	TRH	Table Reference (High Byte)
106	SP	Stack Pointer
107	PCON	Power Control
108	IE	Interrupt Enable Control
109	IP	Interrupt Priority Control
10A	UNUSED
10B
10C
10D	EXT	External Memory Control
10E	OCR	Oscillation Control Register
10F	UNUSED
Timer 0
110	T0CNT	Timer 0 Control
111	T0PRR	Timer 0 Prescalar Reload
112	T0L	Timer 0 Low Byte
113	T0LR	Timer 0 Low Byte Reload
114	T0H	Timer 0 High Byte
115	T0HR	Timer 0 High Byte Reload
116	UNUSED
117	UNUSED
Timer 1
118	T1CNT	Timer 1 Control
119	UNUSED
11A	T1LC	Timer 1 Low Compare Data
11B	T1L/T1LR	Timer 1 Low Byte (Value or Reload)
11C	T1HC	Timer 1 High Compare Data
11D	T1H/T1HR	Timer 1 High Byte (Value or Reload)
11E	UNUSED
11F	UNUSED
LCD Screen
120	MCR	Mode Control
121	UNUSED
122	STAD	Start Address
123	CNR	Character Number Register
124	TDR	Time Division Register
125	XBNK	XRAM Bank Address
126	UNUSED
127	VCCR	LCD Contrast Control Register
128	UNUSED
129
12A
12B
12C
12D
12E
12F
Serial I/O
130	SCON0	SIO0 Control
131	SBUF0	SIO0 Buffer
132	SBR	SIO Baud Rate Generator
133	UNUSED
134	SCON1	SIO1 Control
135	SBUF1	SIO1 Buffer
136	UNUSED
137
138
139
13A
13B
13C
13D
13E
13F
140
141
142
143
Port 1
144	P1	Port 1 Latch
145	P1DDR	Port 1 Data Direction Register
146	P1FCR	Port 1 Function Control Register
147	?	Bits[0-6]: Logic High, Bit[7]: R/W
148	?	BIOS writes once with 0x00 on startup
149	UNUSED
14A
14B
Port 3
14C	P3	Port 3 Latch
14D	P3DDR	Port 3 Data Direction Register
14E	P3INT	Port 3 Interrupt Control
14F	UNUSED
150	UNUSED
151	?	BIOS sets bit 5 only
152	UNUSED
153	UNUSED
Flash
154	FPR	Flash Program Register
155	?	BIOS writes once with 0xFF
156	UNUSED
157
158
159
15A
15B
Port 7
15C	P7	Port 7 Latch
15D	I01CR	External Interrupts 0-1 Control
15E	I23CR	External Interrupts 2-3 Control
15F	ISL	Input Signal Selection
Maple
160	MPLSW	Maple Status Word
161	MPLSTA	Maple Start Transfer
162	MPLRST	Maple Reset
Work RAM
163	VSEL	VMS Control Registers
164	VRMAD1	Work RAM Access Address 1
165	VRMAD2	Work RAM Access Address 2
166	VTRBF	Send/Receive Buffer
167	VLREG	Maple Word Length Registration
168	UNUSED
169
16A
16B
16C
16D
16E
16F
170
171
172
173
174
175
176
177
178
179
17A
17B
17C
17D
17E
Base Timer
17F	BTCR	Base Time Control Register

CPU

[0x100] ACC: Accumulator

8-bit register used as the implicit target register for most instructions and operations, such as arithmetic computation, transfers, I/O, and more.

[0x101] PSW: Program Status Word

PSW consists of flags for the results of arithmetic instruction execution as well as for specifying RAM banks and indirect address registers.

7	6	5	4	3	2	1	0
CY	AC		IRBK1	IRBK0	OV	RAMBK0	P

CY (bit 7): Carry Flag
Set when carrying from the MSB after an addition or when a borrow to the MSB occurs after an addition. Otherwise, the flag is reset. The flag is also modified by rotation instruction staht include CY.

AC (bit 6): Auxiliary Carry Flag
Set when bit 3 of the accumulator propagates over to the next higher digit as a carry or to the next lower digit as a borrow. Otherwise it is reset.

IRBKx (bits 3-4): Indirect Address Register Bank
Specifies which of the 4 register banks to use as indirect address registers when using indirect addressing. See Indirect Addressing for more information.

OV (bit 2): Overflow Flag
Set when an overflow occurs in addition or subtraction. Also set when the result of a multiplication is greater than 256 or division by zero is performed.

RAMBK0 (bit 1): RAM Bank
Specifies the current RAM bank for data access. Bank 0 contains the stack and is reserved for use by the system BIOS while Bank 1 is general purpose application RAM. See Memory Map for more information.

P (bit 0): Parity Flag
Set when the total number of bits set within the accumulator is an odd number. Reset to 0 when the total number of bits set within the accumulator is even. Read-only.

[0x102] B: B Register

Used in combination with ACC and the C Register for sourcing and storing data with arithmetic operations.

[0x103] C: C Register

Used in combination with ACC and the B Register for sourcing and storing data with arithmetic operations.

[0x104] TRL: Table Reference Register (Low Byte)

[0x105] TRH: Table Reference Register (High Byte)

TRL and TRH combine to form a single 16-bit register, TRR, which is used for ROM and flash addressing. The LDC instruction adds TRR register to the value stored within the ACC to form a target address for loading data into the accumulator. The BIOS's flash subroutines (read/write) also use TRR for determining which address to target within the specified bank.

[0x106] TRL: Stack Pointer

Used to point to the last filled address within the stack region of RAM bank 0. It is incremented before moving data onto the stack with a PUSH instruction and is decremented after fetching data from the stack with the POP instruction.

[0x107] PCON: Power Control

Used to suspend the CPU and its peripherals to reduce power consumption. These bits are automatically reset when execution is resumed.

7	6	5	4	3	2	1	0
						HOLD	HALT

HOLD (bit 1): Suspend CPU and Timers
When set to 1, puts the VMU into a deep sleep, stopping the CPU, all timers, and all oscillators. Only an external interrupt or reset will cause operations to resume. Not in the official documents and will cause the BIOS to no longer maintain the proper time, since the base timer is halted.

HALT (bit 0): Halt CPU
When set to 1, stops CPU instruction exection while allowing timers and all other peripherals to continue operating normally. Any interrupt will wake the CPU up and break resume execution.

[0x108] IE: Interrupt Enable Control

7	6	5	4	3	2	1	0
IE7						IE1	IE0

IE7 (bit 7): Master Interupt Enable
When set to 1, all interrupt requests are enabled. When reset to 0, "high" and "low" priority interrupts are disabled.

IE1-IE0 (bits 1-0): Interrupt Priority Control
Sets the priority level of external interrupts INT1 and INT0:

IE1	IE0	INT1 Priority	INT0 Priority
0	0	Highest	Highest
1	0	Low	Highest
X	1	Low	Low

[0x109] IP: Interrupt Priority Control

Provides flags for controlling whether interrupts are given LOW or HIGH priority ranking

7	6	5	4	3	2	1	0
IP7	IP6	IP5	IP4	IP3	IP2	IP1	IP0

IP7 (bit 7): P3 Interrupt Priority
Sets the priority for Port 3 interrupts. 0: Low, 1: High.

IP6 (bit 6): Maple Interrupt Priority
Sets the priority for Maple interrupts. 0: Low, 1: High.

Warning: This is an undocumented bitfield which was most likely intentionally hidden. While its behavior has yet to be confirmed, this hole perfectly aligns with the location of the Maple interrupt which was also undocumented.

IP5 (bit 5): SIO1 Interrupt Priority
Sets the priority for Serial I/O 1 interrupts. 0: Low, 1: High.

IP4 (bit 4): SIO0 Interrupt Priority
Sets the priority for Serial I/O 0 interrupts. 0: Low, 1: High.

IP3 (bit 3): T1 Interrupt Priority
Sets the priority for Timer 1 interrupts. 0: Low, 1: High.

IP2 (bit 2): T0H Interrupt Priority
Sets the priority for Timer 0 High overflow interrupts. 0: Low, 1: High.

IP1 (bit 1): INT3/Base Timer Interrupt Priority
Sets the priority for Internal Interrupt Source 3 and Base Timer interrupts. 0: Low, 1: High.

IP0 (bit 0): INT2/T0L Interrupt Priority
Sets the priority for Internal Interrupt Source 2 and Timer 0 Low overflow interrupts. 0: Low, 1: High.

[0x10D] EXT: External Memory Control

Controls the source and base address of ROM memory space accesses.

Warning: This register was intentionally left undocumented in the hardware documentation and was never meant to be modified directly. You are meant to use the CHANGE macro instruction, which manages this register for you.

7	6	5	4	3	2	1	0
				EXT3	EXT2	LDCEXT	EXT0

EXT3 (bit 3): External Bank Address
Controls which 64KB bank is selected for the ROM source.

EXT2 (bit 2): ?
Undocumented flag.

LDCEXT (bit 1): LDC Instruction Source?
Hardware docs say:

Note: [If the applicaton is running], "the system switches from the application (game mode) to the system program. However, if bit 1 (LDCEXT) of the external memory control register is set, the CHANGE instruction will not cause a change to the system program. The application continues to run."

EXT0 (bit 0): ?
Undocumented flag.

[0x10E] OCR: Oscillation Control Register

Controls power to the oscillators and determine which is used by the system clock.

7	6	5	4	3	2	1	0
OCR7		OCR5	OCR4			OCR1	OCR0

OCR 7 (bit 7): System Clock Divider
When set to 1 (default), the system clock frequency is divided by 6. When reset to 0, its divided by 12.

OCR5-4 (bits 5-4): System Clock Selector
Selects the system clock source based on the values in the following table:

OCR5	OCR4	Source Oscillator
0	0	RC
0	1	CF
1	0	Quartz
1	1	CF

OCR1 (bit 1): RC Oscillator Control
When set to 1, the RC oscillator is disabled, preserving power. When reset to 0, it is enabled.

OCR0 (bit 0): CF Oscillator Control
When set to 1 (default), the CF oscillator ceases operation. When reset to 0 (as when the VMU is docked), it begins to operate.

Warning: It has been proven that the CF oscillator, which is usually used when the VMU is docked in the controller, can be enabled while running in standalone GAME mode. However, this drains the batteries quickly. Look into buying a AA battery supply adapter, USB power cable mod, or rechargeabel LIR2032s if this is an issue and you wish to use this clock source.

Note: The VMU hardware docs make mention of not disabling the Quartz oscillator, so I'm assuming perhaps OCR2 is the control flag for it?

Timer 0

[0x110] T0CNT: Timer 0 Control

Configures and controls the operation of the Timer 0 peripheral.

7	6	5	4	3	2	1	0
T0HRUN	T0LRUN	T0LONG	T0LEXT	T0HOVF	T0HIE	T0LOVF	T0LIE

T0HRUN (bit 7): Timer 0 High Count Control
Setting this flag to 1 starts the T0H counter by supplying the clock to it. Resetting it to 0 stops counting and reloads T0H with T0HR.

T0LRUN (bit 6): Timer 0 Low Count Control
Setting this flag to 1 starts the T0L counter by supplying the clock to it. Resetting it to 0 stops counting and reloads T0L with T0LR.

T0LONG (bit 5): Timer 0 Bit Length Specifier
When set to 1, 16-bit mode is used. When reset to 0, 8-bit mode used.

T0LEXT (bit 4): Timer 0 Low Input Clock Select
Specifies the clock supplied to T0L. When set to 1, it is driven by an external input signal (source determined by ISL). When reset to 0, the prescalar output is selected.

T0HOVF (bit 3): Timer 0 High Overflow Flag
This flag is set whenever T0H overflows and otherwise never changes. It must be reset by the interrupt handler or application.

T0HIE (bit 2): Timer 0 High Interrupt Enable
Enables or disables generation of interrupt requests upon T0H overflow. When set to 1, the T0H interrupt vector (0x0023) is used. When reset to zero, no request is generated.

T0LOVF (bit 1): Timer 0 Low Overflow Flag
This flag is set whenever T0L overflows and otherwise never changes. It must be reset by the interrupt handler or application. This flag is not used when in 16-bit mode.

T0LIE (bit 0): Timer 0 Low Interrupt Enable
Enables or disables generation of interrupt requests upon T0L overflow. When set to 1, the T0L interrupt vector (0x0013) is used. When reset to zero, no request is generated.

[0x111] T0PRR: Timer 0 Prescalar Reload

Stores the reload value for the Timer 0 prescalar register (TPR).

[0x112] T0L: Timer 0 Low Byte

Read-only register storing the current value of either the first independently operating 8-bit counter/timer of Timer 0, or the low byte of the combined 16-bit counter/timer of Timer 0, depending on the current T0CNT configuration

[0x113] T0LR: Timer 0 Reload

The value used to reload the T0L timer/counter is stored within this register. When using 8-bit mode, its contents are reloaded into T0L upon overflow.

[0x114] T0H: Timer 0 High Byte

Read-only register storing hte current value of either the second independently operating 8-bit counter/timer of Timer 0, or the high byte of the combined 16-bit counter/timer of Timer 0, depending on the current T0CNT configuration.

[0x115] T0HR: Timer 0 High Reload

The value used to reload the T0H timer/counter is stored within this register. Upon overflow, its contents are loaded into T0H.

Timer 1

[0x118] T1CNT: Timer 1 Control

Configures and controls the operation of the Timer 1 peripheral.

7	6	5	4	3	2	1	0
T1HRUN	T1LRUN	T1LONG	ELDT1C	T1HOVF	T1HIE	T1LOVF	T1LIE

T1HRUN (bit 7): Timer 1 High Count Control
Setting this flag to 1 starts the T1H counter by supplying the clock to it. Resetting it to 0 stops counting and reloads T1H with T1HR.

T1LRUN (bit 6): Timer 1 Low Count Control
Setting this flag to 1 starts the T1L counter by supplying the clock to it. Resetting it to 0 stops counting and reloads T1L with T1LR.

T1LONG (bit 5): Timer 1 Bit Length Specifier
When set to 1, 16-bit mode is used. When reset to 0, 8-bit mode used.

ELDT1C (bit 4): Pulse Generator Data Update
Controls whether the comparison data register values, from T1HC and T1LC, are sent to the pulse signal comparator or not. When set to 1, the values are sent to the comparator immediately as they are changed, updating the pulse generator data. When reset to 0, the values are not sent to the comparator, so the pulse generator output does not change.

When needing to update both 8-bit counters simultaneously, first reset this flag, update their values, then set the flag back. This will update both atomically.

T1HOVF (bit 3): Timer 1 High Overflow Flag
This flag is set whenever T1H overflows and otherwise never changes. It must be reset by the interrupt handler or application.

T1HIE (bit 2): Timer 1 High Interrupt Enable
Enables or disables generation of interrupt requests upon T1H overflow. When set to 1, the T1H interrupt vector (0x002B) is used. When reset to zero, no request is generated.

T1LOVF (bit 1): Timer 1 Low Overflow Flag
This flag is set whenever T1L overflows and otherwise never changes. It must be reset by the interrupt handler or application. Unlike T0L, the flag is always set when an overflow occurs at T1L, regardless of T1's bit length.

T1LIE (bit 0): Timer 1 Low Interrupt Enable
Enables or disables generation of interrupt requests upon T1L overflow. When set to 1, the T1 interrupt vector (0x002B) is used. When reset to zero, no request is generated.

[0x11A] T1LC: Timer 1 Low Compare Data

Data which gets fed to a comparator and compared with the value of T1L, for generating the resulting PWM signal. When the data is less than the value of T1L, the resulting signal has a LOW output, and when it's greater than or equal to, it has a HIGH output.

When ELDT1C is set to 1, and this register is modified, its value is immediately sent to the comparator. When it is reset to 0, the comparator is never updated as T1LC changes.

[0x11B] T1L/T1LR: Timer 1 Low Byte (Value or Reload)

Depending on whether this register is written to or read from, it is either accessing T1L or T1LR. When reading, it is accessing T1L, the current value of the Timer 1 Counter/Timer's low byte. When writing, it is accessing T1LR, the reload value which is copied to T1L when an overflow occurs.

[0x11C] T1HC: Timer 1 High Compare Data

Data which gets fed to a comparator and compared with the value of T1H, for generating the resulting PWM signal. When the data is less than the value of T1H, the resulting signal has a LOW output, and when it's greater than or equal to, it has a HIGH output.

[0x11D] T1H/T1HR: Timer 1 High Byte (Value or Reload)

Depending on whether this register is written to or read from, it is either accessing T1H or T1HR. When reading, it is accessing T1H, the current value of the Timer 1 Counter/Timer's high byte. When writing, it is accessing T1HR, the reload value which is copied to T1H when an overflow occurs.

LCD Screen

Warning: These registers are largely mysterious and unknown. They are initialized and managed by the BIOS and, other than XBNK, don't really need to be modified... except in the name of science...

[0x120] MCR: Mode Control

7	6	5	4	3	2	1	0
MCR7	MCR6	MCR5	MCR4	MCR3			MCR0

MCR7-MCR5 (bits 7-5): LCD Clock Division Ratio
The official documentation simply says "always set these bits to 0" for a 1/1 ratio.

Note: Whether other values are acceptable or not is unknown.

MCR4 (bit 4): LCD Clock 1/2 Division Ratio Select Circuit
Controls whether to divide the ratio given by MCR7-MCR5 by 1/2 or to select it directly as the LCD clock.

When set to 1, The LCD clock is not divided, giving a frame frequency of 165.5Hz. When reset to 0, the LCD clock frequency is divided by 1/2, giving a frame frequency of 82.7 Hz.

The default value for this flag is 0.

MCR3 (bit 3): LCD Controller Control
Controls whether the display controller operates. When reset to 0, operation ceases, meaning the screen is still powered, but it no longer updates to reflect changes in XRAM. When set to 1, the screen automatically refreshes to reflect changes in the contents of XRAM.

MCR0 (bit 0): Display Mode Select
The official hardware docs only say this should always be set to 1, in order to set the display to "graphics mode."

Note: What the other mode is or how it operates is unknown.

[0x122] STAD: Start Address

Configures XRAM's start address. A value of 0 is assumed to be the regular XRAM start address of 0x180. Every value increment of STAD will advance XRAM's start address by 2 bytes.

Warning: Some start addresses are unavailable. Do not use xx6H, xx7H, xxEH, or xxFH as start addresses.; Since using the BIOS subroutine's flash write operations will attempt to modify the state of the FLASH icon, you must reset STAD back to 0 before using them, in order to prevent the BIOS from writing to a random XRAM location.

Note: I have personally never seen a single VMU game or application modify these settings. Only bother with it if you know what you're doing or are doing so in the name of science.

[0x123] CNR: Character Number Register

The official documentation merely says this register is not accessible by applications... Sure it is.

This register is Write-Only and 7-bits large, how it behaves is not exactly well understood but it's likely the amount of bytes that every line of the LCD should have, setting it to anything other than x0000101 will garble the frame

[0x124] TDR: Time Division Register

The official documentation merely says that the register is not accessible by applications... BS.

This register is Write-Only and 6-bits large, it controls how many lines the LCD will display, setting it too low will cause the contrast to get higher, the default setting is xx100000. It appears that this also changes the refresh rate of the LCD, low values will cause the displayed lines to be repeated over all the unscanned lines on the LCD panel

Note: the icons appear to be just a scanline to the LCD controller, messing with this register also affects how the icons are scanned

[0x125] XBNK: XRAM Bank Address

Swaps the active XRAM bank number, which is mapped to the end of the internal RAM address space.

7	6	5	4	3	2	1	0
						XBNK1	XBNK0

XBNK1-0 (bits 1-0): XRAM Bank Select
Sets the active XRAM bank.

XBNK1	XBNK0	Bank	Purpose
0	0	0	Top-Half of LCD Screen
0	1	1	Bottom-Half of LCD Screen
1	0	2	Icons
1	1	X	Invalid

[0x127] VCCR: LCD Contrast Control Register

Write-only register controlling various aspects of the LCD display, but there is no contrast control.

7	6	5	4	3	2	1	0
VCCR7	VCCR6	VCCR5	VCCR4	VCCR3	VCCR2	VCCR1	VCCR0

VCCR7 (bit 7): LCD Power Control
Controls whether the display is powered or not. When reset to 0, the screen is shut off. When set to 1, it is powered on.

VCCR6 (bit 6): LCD XRAM Access Control
Controls whether XRAM memory is accessible to the CPU. When reset to 0, XRAM memory can be read from and written to. When set to 1, this access becomes disabled.

Warning: The documentation says to always disable XRAM access when the quartz oscillator is used as the system clock and to only access it with the RC (or CF) oscillator(s).

VCCR5-0 (bits 5-0): ?
The official documentation merely says to ALWAYS set these bits to 0 when accessing VCCR.

Note: This is most likely the field which controls the contrast of the LCD screen, which the VMU doesn't support.

Serial I/O

[0x130] SCON0: SIO0 Control

Controls various aspects of the operation of the Serial IO 0 peripheral.

7	6	5	4	3	2	1	0
SCON07	SCON06		SCON04	SCON03	SCON02	SCON01	SCON00

SCON07 (bit 7): Polarity Control
Controls the polarity of the the transfer clock, SCK0, which is used by SIO0.

When set to 1, SCK0 is 0 when operation stops and bit 0 of SBUF0 is output.
When reset to 0, SCK0 is 0 when operation stops and the last transferred bit is held as the output

SCON06 (bit 6): Overrun Flag
Set to 1 when an 8-bit data transfer is complete and the falling edge of the transfer clock is received, the flag is set. During continuous transfer, the flag is set every 8 bits.

Note: This flag is never reset automatically and must be reset by the application.

SCON04 (bit 4): Transfer Bit Length Control
Swaps SIO0 transfer data length between 8-bit continuous mode (1) or 8-bit mode (0). When set to 1, 2 or more bytes of data can be sent continuously in 8-bit units. When reset to 0, only 8-bits of data can be sent.

SCON03 (bit 3): SIO0 Operation Control
Starts or stops SIO0 transfers. When set to 1, a transfer starts, resetting the flag when 8bits have been transferred. When reset to 0, serial transfer stops.

SCON02 (bit 2): LSB/MSB Start Select
Selects the bit order for data transfers. When set to 1, the transfer starts with the MSB and ends with the LSB. When reset to 0, the transfer starts with the LSB and ends with the MSB.

SCON01 (bit 1): SIO0 Transfer End Flag
Detects the end of a serial transfer. It gets set to 1 when a serial transfer of 8 bits has completed. While set, if the falling edge of the transfer clock is detected, SCON06 gets set to 1, signalling an overrun.

Note: This flag is not reset automatically. It must be done by the application.

SCON00 (bit 0): SIO0 Interrupt Request Enable Control
Enables or disables interrupt request generation upon SIO0 transfer end. When set to 1, interrupt vector 0x0033 is called. When reset to 0, not interrupt request is generated.

[0x131] SBUF0: SIO0 Buffer

Used as a buffer to store TX/RX data from SIO0.

[0x132] SBR: SIO Baud Rate Generator

Sets the transfer rate for both SIO0 and SIO1 when the internal clock is used as the transfer clock. The transfer rate, TSBR, can be obtained by the following:

TSBR = (256 - [SBR setting value]) x 2 x Tcyc      
____          ________
    |        |        |        (Tcyc = cycle clock)
    |________|        |____

    |<-Transfer Rate->|
            TSBR

[0x134] SCON1: SIO1 Control

Controls various aspects of the operation of the Serial IO 1 peripheral.

7	6	5	4	3	2	1	0
	SCON16		SCON14	SCON13	SCON12	SCON11	SCON10

SCON06 (bit 7): Overrun Flag
Set to 1 when an 8-bit data transfer is complete and the falling edge of the transfer clock is received, the flag is set. During continuous transfer, the flag is set every 8 bits.

Note: This flag is never reset automatically and must be reset by the application.

SCON14 (bit 4): Transfer Bit Length Control
Swaps SIO1 transfer data length between 8-bit continuous mode (1) or 8-bit mode (0). When set to 1, 2 or more bytes of data can be sent continuously in 8-bit units. When reset to 0, only 8-bits of data can be sent.

SCON13 (bit 3): SIO0 Operation Control
Starts or stops SIO0 transfers. When set to 1, a transfer starts, resetting the flag when 8bits have been transferred. When reset to 0, serial transfer stops.

SCON12 (bit 2): LSB/MSB Start Select
Selects the bit order for data transfers. When set to 1, the transfer starts with the MSB and ends with the LSB. When reset to 0, the transfer starts with the LSB and ends with the MSB.

SCON01 (bit 1): SIO1 Transfer End Flag
Detects the end of a serial transfer. It gets set to 1 when a serial transfer of 8 bits has completed. While set, if the falling edge of the transfer clock is detected, SCON16 gets set to 1, signalling an overrun.

Note: This flag is not reset automatically. It must be done by the application.

SCON00 (bit 0): SIO1 Interrupt Request Enable Control
Enables or disables interrupt request generation upon SIO1 transfer end. When set to 1, interrupt vector 0x003B is called. When reset to 0, not interrupt request is generated.

[0x135] SCON1: SIO1 Buffer

Used as a buffer to store TX/RX data from SIO1.

Port 1

Note: The hardware docs show a "VMS Serial interface circuit" with pins giong to Port1 output. Figure out how to set/configure these.

[0x144] P1: Port 1 Latch

Contains the latched data for I/O Port 1.

Bit	7	6	5	4	3	2	1	0
Port 1	P17	P16	P15	P14	P13	P12	P11	P10
Function	PWM	TEST	SCK1	SB1	SO1	SCK0	SB0	SO0

Note: Hardware docs show P16's signal input as BUZZ.

[0x145] P1DDR: Port 1 Data Direction Register

Write-only register used to configure whether bits 7 to 0 of Port 1 are used for input or output. Setting a bit to 1 configures the corresponding port pin to be in output mode. Resetting a bit to 0 sets the pin to be in input mode.

[0x146] P1FCR: Port 1 Function Control Register

Configures the operation of bits 7-0 of Port 1.

7	6	5	4	3	2	1	0
P17FCR	P16FCR	P15FCR	P14FCR	P13FCR	P12FCR	P11FCR	P10FCR

P17FCR (bit 7): Select P17 Function
When set to 1, the logical sum of the PWM signal and port latch data is output on P17. When reset to 0, the port latch data is output.

P16FCR (bit 6): Select P16 Function
Supposedly fixed to 0 and cannot be manipulated by the application.

P15FCR (bit 5): Select P15 Function
When set to 1, the logical sum of the serial interface clock 1 (SCK1) and the port latch data is output on P15. When reset to 0, the port latch data is output.

P14FCR (bit 4): Select P14 Function
When set to 1, the logical sum of the serial 1 interface data (SB1) and port latch data is output on P14. When reset to 0, the port latch data is output.

P13FCR (bit 3): Select P13 Function
When set to 1, the logical sum of the serial 1 interface data (SO1) and port latch data is output on P13. When reset to 0, the port latch data is output.

P12FCR (bit 2): Select P12 Function
When set to 1, the logical sum of the serial interface clock 0 (SCK0) and the port latch data is output on P12. When reset to 0, the port latch data is output.

P11FCR (bit 1): Select P11 Function
When set to 1, the logical sum of the serial 0 interface data (SB0) and port latch data is output on P11. When reset to 0, the port latch data is output.

P10FCR (bit 0): Select P10 Function
When set to 1, the logical sum of the serial 0 interface data (SO1) and port latch data is output on P10. When reset to 0, the port latch data is output.

Warning: As with any IO port, writes are to latched port registers, while normal reads access the port directly; however, certain instructions also read port latched data: BPC, DBNZ, INC, DEC, ST1, CLR1, NOT1.

Port 3

[0x14C] P3: Port 3 Latch

Latch register for IO Port 3, which is an input-only (supposedly) port for the VMU's gamepad buttons. The application must set the bit corresponding to a button to be detected to 1. When the button is actually pressed, the corresponding bit is reset to 0.

Bit	7	6	5	4	3	2	1	0
P3	P37	P36	P35	P34	P33	P32	P31	P30
Button	SLEEP	MODE	B	A	RIGHT	LEFT	DOWN	UP

[0x14D] P3DDR: Port 3 Data Direction Register

Write-only register used to configure whether bits 7 to 0 of Port 3 are used for input or output. Setting a bit to 1 configures the corresponding port pin to be in output mode. Resetting a bit to 0 sets the pin to be in input mode.

Warning: Sanyo's docs claim that this register cannot be driven by the user... but this is most likely bullshit.

[0x14E] P3INT: Port 3 Interrupt Control

Controls interrupt generation and configuration for Port 3.

7	6	5	4	3	2	1	0
					P32INT	P31INT	P30INT

P32INT (bit 2): Port 3 Interrupt Control Flag
When set to 1, causes an interrupt to be generated continuously while a button on Port 3 is held down. When reset to 0, no interrupt for that button is generated.

P31INT (bit 1): Port 3 Interrupt Source Flag
Applicable only when P32INT is set. When an interrupt is generated, this flag is set to 1, so that it can be used by an ISR to determine that P3 is the interrupt's source.

Warning: This flag must be reset by the application within its ISR!

P30INT (bit 0): Port 3 Interrupt Request Enable Control
When set to 1, enables interrupt requests from port 3, calling the interrupt vector 0x004B when one is generated (P31INT=1). When reset to 0, the ISR is never called upon interrupt generation.

Flash

Note: None of this is officially documented or is public knowledge. Sanyo and Sega didn't want you to know about how to access and control flash directly. You were instead to use the firmware routines provided by the BIOS.

[0x154] FPR: Flash Program Register

Used to control direct access to the flash controller.

7	6	5	4	3	2	1	0
						FPR1	FPR0

FPR1 (bit 1): Flash Write Unlock Flag
This flag must be set to 1 before attempting to program flash with the proper unlock sequence, which is required to enable write access to the CPU via the STF instruction. It is initially reset to 0.

FPR1 (bit 0): Flash Address Bank
This flag controls which flash bank (0-1) the LDF and STF instructions access when reading from and writing to flash. It becomes the 17th bit of the absolute address used to for flash access.

When reset to 0, flash bank 0 is used. When set to 1, flash bank 1 is used.

Port 7

[0x15C] P7: Port 7 Latch

Dedicated input port used for low-voltage detection and for monitoring connection status ot the Dreamcast.

Bit	7	6	5	4	3	2	1	0
P1					P73	P72	P71	P70
Function					ID1	ID0	Low voltage	5V detect

P73 (bit 3): External Input Pin 1
Freely available external input pin, connected to a denoiser filter.

P72 (bit 2): External Input Pin 0
Freely available external input pin

P71 (bit 1): Low Voltage Detect Flag
When set to 1 (default), the low voltage detection circuit is enabled, resetting the non-latched port value for P71 to 0 when low voltage is detected.

P70 (bit 0): External 5V Power Detection Flag
When the bit has been set to 1, an external 5v power source has been detected, meaning the VMU has been docked within the Dreamcast controller. When reset to 0, the VMU is running in standalone mode.

Note: It is the resonsibility of any well-formed VMU application to monitor the status of this bit and invoke the firmware application termination routine used to change the BIOS mode. The INT0 interrupt is typically used to monitor this connection status.

[0x15D] I01CR: External Interrupts 0-1 Control Register

Configures the operation of external interrupts 0 and 1.

7	6	5	4	3	2	1	0
I01CR7	I01CR6	I01CR5	I01CR4	I01CR3	I01CR2	I01CR1	I01CR0

I01CR7-IO1CR6 (bits 7-6): Interrupt 1 Detection Level/Edge Select
Configures the INT1 interrupt condition for signals input on the P71/INT1 pin.

I01CR7	I01CR6	INT1 Interrupt Condition
0	0	Detect falling edge
0	1	Detect low level
1	0	Detect rising edge
1	1	Detect high level

I01CR5 (bit 5): Interrupt 1 Source
Set to 1 when the condition specified by bits I01CR7 and I01CR6 is detected. If INT1 interrupts are enabled (I01CR4 is 1), the interrupt vector 0x00B is also called to begin interrupt processing.

I01CR4 (bit 4): Interrupt 1 Control
When set to 1, enables interrupt processing for external INT1 interrupts, calling interrupt vector 0x00B when I01CR5 is set. When reset to 0, interrupt processing is disabled and no interupt request is generated when I01CR5 is set.

I01CR3-IO1CR2 (bits 3-2): Interrupt 0 Detection Level/Edge Select
Configures the INT0 interrupt condition for signals input on the P70/INT0 pin.

I01CR3	I01CR2	INT0 Interrupt Condition
0	0	Detect falling edge
0	1	Detect low level
1	0	Detect rising edge
1	1	Detect high level

I01CR1 (bit 1): Interrupt 0 Source
Set to 1 when the condition specified by bits I01CR3 and I01CR2 is detected. If INT0 interrupts are enabled (I01CR0 is 1), the interrupt vector 0x003 is also called to begin interrupt processing.

I01CR0 (bit 0): Interrupt 0 Control
When set to 1, enables interrupt processing for external INT0 interrupts, calling interrupt vector 0x003 when I01CR1 is set. When reset to 0, interrupt processing is disabled and no interupt request is generated when I01CR1 is set.

Note: When level-detection is used on either signal, interrupts are generated continously while the signal remains at the high or low level.

[0x15E] I23CR: External Interrupts 2-3 Control Register

Configures the operation of external interrupts 2 and 3.

7	6	5	4	3	2	1	0
I23CR7	I23CR6	I23CR5	I23CR4	I23CR3	I23CR2	I23CR1	I23CR0

I23CR7 (bit 7): Interrupt 3 Rising Edge Detection Control
Configures the INT3 interrupt condition for signals input on the P73/INT3/T0IN pin. When set to 1, the rising edge of the signal is detected. When reset to 0, the rising edge of the signal is not monitored.

I23CR6 (bit 6): Interrupt 3 Falling Edge Detection Control
Configures the INT3 interrupt condition for signals input on the P73/INT3/T0IN pin. When set to 1, the falling edge of the signal is detected. When reset to 0, the falling edge of the signal is not monitored.

I23CR5 (bit 5): Interrupt 3 Source
Set to 1 when the condition specified by bits I23CR7 or I23CR6 is detected. If INT3 interrupts are enabled (I23CR4 is 1), the interrupt vector 0x01B is also called to begin interrupt processing.

Note: This flag must be reset by the application.

I23CR4 (bit 4): Interrupt 3 Control
When set to 1, enables interrupt processing for external INT3 interrupts, calling interrupt vector 0x01B when I23CR5 is set. When reset to 0, interrupt processing is disabled and no interupt request is generated when I23CR5 is set.

I23CR3 (bit 3): Interrupt 2 Rising Edge Detection Control
Configures the INT3 interrupt condition for signals input on the P72/INT2/T0IN pin. When set to 1, the rising edge of the signal is detected. When reset to 0, the rising edge of the signal is not monitored.

I23CR2 (bit 2): Interrupt 2 Falling Edge Detection Control
Configures the INT3 interrupt condition for signals input on the P72/INT2/T0IN pin. When set to 1, the falling edge of the signal is detected. When reset to 0, the falling edge of the signal is not monitored.

I23CR1 (bit 1): Interrupt 2 Source
Set to 1 when the condition specified by bits I23CR3 and I23CR2 is detected. If INT2 interrupts are enabled (I23CR0 is 1), the interrupt vector 0x013 is also called to begin interrupt processing.

I23CR0 (bit 0): Interrupt 2 Control
When set to 1, enables interrupt processing for external INT2 interrupts, calling interrupt vector 0x013 when I23CR1 is set. When reset to 0, interrupt processing is disabled and no interupt request is generated when I23CR1 is set.

[0x15F] ISL: Input Signal Selection

Selects and configures the source and operation of the input signals for the Base Timer and Timer 0.

7	6	5	4	3	2	1	0
		ISL5	ISL4	ISL3	ISL2	ISL1	ISL0

ISL5-ISL4 (bits 5-4): Base Timer Clock Select
Selects the clock for the base timer. ISL4 is "fixed" to bit 0, while ISL5's value doesn't matter, fixing the source of the base timer to the quartz oscillator.

Note

ISL4 may very well not be fixed and they just don't want you to modify the base timer's source, the following table is also included

ISL5	ISL4	Source
1	1	Timer/Counter T0
0	1	Prescalar
X	0	Cycle Clock
X	0	Quartz Oscillator

ISL3(bit 3): USE PROHIBITED
Fixed to reset value of 0: fBST/16.

Note: ISL3 may very well not be fixed. The docs lie.

ISL2-ISL1 (bits 2-1): Noise Filter Time Constant Select
Selects the time constant of the noise filter.

ISL2	ISL1	Time Constant
1	1	16 * Tcyc
0	1	64 * Tcyc
X	0	1 * Tcyc

The following table is also included (whatever-the-hell it means) with the following cautions:

A signal not matching the time constant conditions is considered noise and is not input.
Sometimes even a signal matching the time constant conditions may be considered noise and not input.
A signal matching the time constant conditions is considered normal and is input.

?	WTF	?
Time Constant	Noise * 1	Noise/
signal * 2	Noise * 3
1 * Tcyc	< 1 * Tcyc	1 * Tcyc-
2 * Tcyc	2 * Tcyc <

ISL0 (bit 0): T0 Clock Input Pin Select
Selects the input pin used as the clock driving Timer 0. When reset to 0, the clock source is P72/INT2/T0IN. When set to 1, the source is the P73/INT3/T0IN pin.

Maple

Note: These registers are intentionally completely undocumented and hidden from application-space developers. They were meant to only be used by the BIOS when in Maple communications mode. The little that is known about them has been pieced together from BIOS disassembly...

[0x160] MPLSW: Maple Status Word

Contains bits reflecting the status of a Maple transfer request.

[0x161] MPLSTA: Maple Start Transfer

Used to control starting and stopping a Maple transfer.

[0x162] MPLRST: Maple Reset

Used to reset the Maple transaction when an error has occured.

Work RAM

[0x163] VSEL: VMS Control Register

Configures the behavior of Work RAM.

7	6	5	4	3	2	1	0
			INCE			SIOSEL	ASEL

INCE (bit 4): VTRBF Address Counter Automatic Increment
This bit controls whether the VRMAD address (formed by VRMAD1 and VRMAD2) is auto-incremented when accessing VTRBF.

When set to 1, VRMAD is automatically incremented by 1 after each VTRBF access. When reset to 0, there is no change to the address upon accessing VTRBF.

SIOSEL (bit 1): Port 1 Use Select Control
Configures the P1 port (P10 to P15).

When set to 1, the port is used as a a dedicated Maple interface for interacting with the Dreamcast (when the VMU is docked). When reset to 0, (default) it is used as a normal I/O port for synchronous serial communication.

Note: This bit is not typically driven by software and is managed by the BIOS.

ASEL (bit 0): VTRBF Address Input Select Control
Arbitrates accesses to VTRBF by either the CPU or the Maple Interface.

When set to 1, this bit means that a transfer between the Dreamcast and WRAM is currently being carried out, and WRAM is not yet accessible by the VMU. When reset to 0, there is no Maple transfer in progresss, and WRAM can be access normally by the VMU.

Warning: Data integrity will not be assured if an application writes to WRAM while a Mplae transfer is in progress.

[0x164] VRMAD1: Work RAM Access Address 1

Forms the lower 8 bits of the 9-bit VRMAD address that is used to access WRAM whenever the VTRBF register is used. When VSEL4 is set to 1, VRMAD is auto-incremented each time VTRBF is accessed.

7	6	5	4	3	2	1	0
VRMAD7	VRMAD6	VRMAD5	VRMAD4	VRMAD3	VRMAD2	VRMAD1	VRMAD0

[0x165] VRMAD2: Work RAM Access Address 2

Provides the 9th bit of the VRMAD address that is used to access WRAM whenver the VTBRF register is used. When VSEL4 is set to 1, VRMAD is auto-incremented each time VTRBF is accessed.

7	6	5	4	3	2	1	0
							VRMAD8

[0x166] VTRBF: Send/Receive Buffer

Used as the data buffer for reading and writing to WRAM at the address specified by VRMAD.

When this register is written to, the data are written to WRAM at the address specified by VRMAD. When this register is read from, the data are read from WRAM at the address specified by VRMAD. When bit 4 of VSEL (VSEL4) is set to 1, VRMAD is automatically incremented each time this register is accessed.

[0x167] VLREG: Maple Word Length Registration

Undocumented register controlling the length of words for Maple transactions when the VMU is docked in the controller and the BIOS is running the Maple stack.

Base Timer

[0x17F] BTCR: Base Timer Control Register

Controls the configuration and interrupt generation of the Base Timer.

Warning

Special care must be taken when working with the Base Timer, because it is configured to generate Base Timer Interrupt 0 at a fixed 0.5s interval. This interrupt is serviced by the BIOS, which uses it to maintain the current time. When providing an ISR for the Base Timer Interrupts (which both share vector 0x001B), you must take care to call into the BIOS implementation at 0.5s intervals to maintain the correct system time.

The following additional warnings are also issued by Sanyo for driving the Base Timer:

In fast-forward mode (BTCR7, BTCR5 = 1), do not set both the system clock and the base timer to the quartz oscillator.
BTCR may occasionally become "0" when BTCR5 and BTCR4 are changed. This is a rare occurrence, but to guard against it, you should save the value of BTCR3 before changing BTCR5 and BTCR4 and then set the value again in BTCR3 after the change.

7	6	5	4	3	2	1	0
BTCR7	BTCR6	BTCR5	BTCR4	BTCR3	BTCR2	BTCR1	BTCR0

BTCR7 (bit 7): Base Timer Interrupt 0 Cycle Control
Controls the cycle for Base Timer Interrupt 0 source generation.

When the value is set to 1, the interval at which the interrupt 0 source is generated for 14-bit counter overflow is 16384/fBST. When reset to 0, the cycle is 64/fBST. To use "fast-forward mode," set this flag. fBST is the input clock frequency.

Warning: Sanyo's hardware docs claims it should only be set to 16384/fBST, presumably because changing its value will impact the timing for the BIOS clock. fBST is the input clock frequency.

BTCR6 (bit 6): Base Timer Operation Control
Starts or stops the Base Timer's count operation.

When set to 1, count operation starts. When reset to 0, the count operation stops, and the 14-bit counter is cleared.

Warning: Sanyo's hardware docs say it should always be active. Again, this is because the BIOS clock relies on it for time keeping.

BTCR5-BTCR4 (bits 5-4): Base Timer Interrupt 1 Cycle Control
Controls the cycle for Base Timer Interrupt 1 source generation.

BTCR7	BTCR5	BTCR4	Base Timer Interrupt 1 Cycle
X	0	0	32 /fBST
X	0	1	128 /fBST
0	1	0	512 /fBST
0	1	1	2048/fBST

fBST: Input clock frequency

BTCR3 (bit 3): Base Timer Interrupt 1 Source Flag
This flag gets set any time the Base Timer Interrupt 1 source is gneerated at the cycle set with BTCR7 and BTCR5-4. When no interrupt is generated, the flag doesn't change.

Note: It's up to the user to reset the flag within the appropriate ISR.

BTCR2 (bit 2): Base Timer Interrupt 1 Request Enable Control
Enables or disables Base Timer Interrupt 1 requests.

When set to 1, the Base Timer Interrupt 1 Source Flag (BTCR3) will generate an interrupt request to interrupt vector 0x001B. When reset to 0, no interrupt request will be generated.

BTCR1 (bit 1): Base Timer Interrupt 0 Source Flag
This flag gets set any time the Base Timer Interrupt 0 source is gneerated at the cycle set with BTCR7. When no interrupt is generated, the flag doesn't change.

Note: It's up to the user to reset the flag within the appropriate ISR.

BTCR0 (bit 0): Base Timer Interrupt 0 Request Enable Control
Enables or disables Base Timer Interrupt 1 requests.

When set to 1, the Base Timer Interrupt 0 Source Flag (BTCR1) will generate an interrupt request to interrupt vector 0x001B. When reset to 0, no interrupt request will be generated.

Warning: Disabling this interrupt will cause the BIOS to cease to maintain the current time.