Site Tools


Table of Contents

A list of the 3DO's memory mappings. Much of this was sourced from the 3DOessence spreadsheet.


Base AddressEnd AddressSizeHardwareDescription
0x0316_00000x0317_FFFF128KiBNVRAM mirror



0x0330_0000read: MADAM version/feature data
write: debug output
0x0330_0004read: memory configuration
* 0x0100_0000: Red MADAM
* 0x0102_0000: Green MADAM w/ matrix hardware
* 0x0102_0001: Green MADAM w/ no matrix hardware
0x0330_0008DMA channel enablement
* 0x0000_8000: Player Bus
* 0x0010_0000: Sprite control
0x0330_000CUnsure. “testbin” sets it to 0x00178906.
Contains a bitmask of reasons for an abort signal MADAM sent to the CPU.
* 0x0000_0001: ROMF “Rom Failure”
* 0x0000_0002: ROMW “Rom Write”
* 0x0000_0004: CLIOT “CLIO timeout”
* 0x0000_0008: HARDU “User access to hardware”
* 0x0000_0010: SYSRAMU “User access to sysram”
* 0x0000_0020: FENCEV “Fence (memory protection) violation”
* 0x0000_0040: VPR “Virtual Page error”
* 0x0000_0080: R26E “Out of 26bit address range”
* 0x0000_0100: SPSC “SPORT while SC”
* 0x0000_0200: BITE “Byte access to hardware”
* 0x0000_0400: BADDEC
* 0x0000_0800: ARPS “ARM to Regis / PIP while SIP”
* 0x0000_1000: BWAAC “Byte address, word access”
0x0330_0024DMA privilage violations
* 0x0000_0001: DMA access to SYSRAM
* 0x0000_0002: SPORT access to SYSRAM (VDL DMA channel)
* 0x0000_0004: REGIS access to SYSRAM
* 0x0000_0008: DMA access over VRAMSIZE
* 0x0000_0010: SPORT access over VRAMSIZE (VDL DMA channel)
* 0x0000_0020: REGIS acess over VRAMSIZE
* 0x0000_0040: REGIS math failure
Spryte rendering engine status register. Details found in US patent 5,572,235. See Table 1.8.
* 0x0000_0010: SPRON “spryte engine enabled”
* 0x0000_0020: SPRPAU “spryte engine paused”
Write a value and when read it will return the number of the most significantly set bit.

example: Write 0x8400_0000 and a read will return 31. Write 0x0000_0000 and the return will be 0xFFFF_FFFF;
0x0330_0040The currently rendered horizontal pixel offset.
0x0330_0100SPRSTRT: Spryte rendering engine's start register. From US patent 5,572,235: The Spryte rendering process is started from the CPU by writing a meaningless value to the 'SPRSTRT' address in the memory address manipulator chip (MAMC). This sets the 'Spryte-ON' flipflop. Writing to SPRSTART while the 'Spryte-ON' flipflop is already on will have no effect at all. BUT DON'T DO IT. The race condition of Spryte just now ending and you just now writing is not preventable.
0x0330_0104SPRSTOP: Spryte rendering engine's stop register. From US patent 5,572,235: The Spryte process is stopped cold when the CPU writes to 'SPRSTOP'. All intermediate states of the engines have been RESET. The data pointers are now WRONG. Spryte processing is dead. Except, of course, for the SPRPAUS flipflop.
0x0330_0108SPRCNTU: Spryte rendering engine's continue register. From US patent 5,572,235: The CPU can reset the PAUSE flipflop by writing to 'SPRCNTU'. If the Spryte engine was on but paused it will not continue. If not, it won't. This is also when the CPU might avail itself of the SPRPAUS function.
0x0330_010CSPRPAUS: Spryte rendering engine's pause register. From US patent 5,572,235: The CPU can request that the Spryte rendering engine stop operating at the end of the current Spryte but not reset itself by writing to 'SPRPAUS'. This will set a 'SPRPAUS' flipflop that will cause the Cpryte rendering engine to set its 'PAUSE' flipflop at the end of the current Spryte. When the PAUSE flipflop is set by this mechanism (not by other means), the SPRPAUS flipflop will be cleared. The SPRPAUS event is only a one shot thing. Obviously this can only be done if the CPU already has access to the system bus. SPRPAUS can be set by the CPU even if the Spryte engine is off. When an interrupt is present, the PAUSE flipflop is held in a 'set' condition. This will allow the Spryte rendering engine to pause cleanly and allow the CPU to notice the interrupt.
0x0330_0110CCBCTL0: struct Bitmap→bm_CEControl
General spryte rendering engine control word
0x0330_0130REGCTL0: struct Bitmap→bm_REGCTL0
Controls the modulo for reading source frame buffer data into the primary and/or secondary imput port of the spryte engine and for writing spryte image result data from the spryte engine into a destination frame buffer in VRAM. The modulo effectively indicates the number of pixels per scan line as represented in the respective frame buffer in VRAM.
0x0330_0134REGCTL1: struct Bitmap→bm_REGCTL1
X and Y clip values, effecively indicating the number of pixels in the X and Y dimensions which make up the frame buffer. Bits 26:16 indicate the last writable row (counting from row 0) in the Y dimension and the bits 10:0 indicate the last writable column (counting from col 0) in the X dimension. All other bits must be zero. As an example, a value of 0x00EF_013F indicates that the frame buffer data is represented in 320×240 format.
0x0330_0138REGCTL2: struct Bitmap→bm_REGCTL2
Read base address. Indicates the address in VRAM of the upper left corner pixel of the source frame buffer data.
0x0330_013CREGCTL3: struct Bitmap→bm_REGCTL3
Write base address. Indicates the addres in VRAM of the upper left corner pixel of the destination frame buffer.
0x0330_0230Fence control 0L
0x0330_0234Fence control 0R
0x0330_0238Fence control 1L
0x0330_023CFence control 1R
0x0330_0270Fence control 2L
0x0330_0274Fence control 2R
0x0330_0278Fence control 3L
0x0330_027CFence control 3R
0x0330_0400CPU RAM to DSP DMA Group 0x0: current address
See US patent WO09410641A1 page 46 line 25 for details.
0x0330_0404CPU RAM to DSP DMA Group 0x0: current length
0x0330_0408CPU RAM to DSP DMA Group 0x0: next address
0x0330_040CCPU RAM to DSP DMA Group 0x0: next length
0x0330_04C0CPU RAM to DSP DMA Group 0xC: current address
0x0330_04C4CPU RAM to DSP DMA Group 0xC: current length
0x0330_04C8CPU RAM to DSP DMA Group 0xC: next address
0x0330_04CCCPU RAM to DSP DMA Group 0xC: next length
0x0330_04D0FMV DMA group 1?
0x0330_04D4FMV DMA group 1?
0x0330_04E0FMV DMA group 1?
0x0330_04E4FMV DMA group 1?
0x0330_0540XBUS DMA: source / destination address
0x0330_0544XBUS DMA: length
0x0330_0550FMV DMA group 2?
0x0330_0554FMV DMA group 2?
0x0330_0560FMV DMA group 2?
0x0330_0564FMV DMA group 2?
0x0330_0570Player Bus DMA: destination address
See US patent WO09410641A1 page 61 line 25 for details.
0x0330_0574Player Bus DMA: length
Lower half word of 0xFFFC (-4) indicates end.
0x0330_0578Player Bus DMA: source address


0x0340_0000CLIO version in high byte. Feature flags in the rest.
0x0340_0008FreeDO code implies it's the line which should trigger VINT0. However, 3DOessence.xml claims it is only triggered on even fields. When doing that some games run at half speed.

FZ10 function 0x03024674 writes to this register and then sets the interrupt mask (via 0x0340_0048). Function 0x03022454 writes 0x11 via 0x03024674.
0x0340_000CFreeDO code implies it's the line which should trigger VINT1. However, 3DOessence.xml claims it is only triggered on odd fields. When doing that some games run at half speed.

Games seem to write 0x0000_0005 and 0xFFFF_FFFF to it each field render.
0x0340_0010??? FZ10 function 0x0300_0FB4 writes 0x2000 to this register if 0x0340_0000 == 0x0400_0000.
0x0340_0020??? FZ10 function 0x0300_0248 writes 0xF400_0000 twice in a row if 0x0340_0000 == 0x0400_0000.
0x0340_0024??? FZ10 function 0x0300_0248 writes 0x6001_1F1F then 0xE001_1F1F if 0x0340_0000 == 0x0400_0000 else it writes 0xC005_0F0F.
0x0340_0028Reason the console reset?
* writing a 0x0000_0000 resets bits
* bits 0, 1, 6 checked by BIOS
* FZ10 BIOS function 0x0302706C writes 0x30
0x0340_002C??? Games write 0x0000_000B to it each field render as does a number of FZ10 ROM functions (0x0300_3BC4, 0x0302_18D0, 0x0302_45C0). MAME suggests it is a watchdog.
0x0340_0030??? HCNT: according to MAME
0x0340_0034VCNT: currently displayed raster line + bit 11 representing even (0) or odd (1) field.
0x0340_0038??? Games write 0xC693_B70F to it each field render. MAME suggests it is a seed for a PRNG.
0x0340_003C??? MAME suggests it is a PRNG. FZ10 ROM function 0x0300_56C8 reads the value and ORs it with a read from the PRNG at 0x0340_17F0 « 0x10.
0x0340_0040Triggers ARM's FIQ (Fast Interrupt reQuest) exception.
Reading yields pending interrupts mask. Writing a mask will *set* the corresponding bits to enable software triggered hardware interrupts. Higher numbered interrupts have higher priorities (implemented in software by the handler.)

bit 0x00: VINT0
bit 0x01: VINT1
bit 0x02: EXINT (XBUS devices)
bit 0x03: Timer 0xF
bit 0x04: Timer 0xD
bit 0x05: Timer 0xB
bit 0x06: Timer 0x9
bit 0x07: Timer 0x7
bit 0x08: Timer 0x5
bit 0x09: Timer 0x3
bit 0x0A: Timer 0x1
bit 0x0B: Audio Timer
bit 0x0C: Audio DMA - DSP to RAM0
bit 0x0D: Audio DMA - DSP to RAM1
bit 0x0E: Audio DMA - DSP to RAM2
bit 0x0F: Audio DMA - DSP to RAM3
bit 0x10: Audio DMA - RAM0 to DSP
bit 0x11: Audio DMA - RAM1 to DSP
bit 0x12: Audio DMA - RAM2 to DSP
bit 0x13: Audio DMA - RAM3 to DSP
bit 0x14: Audio DMA - RAM4 to DSP
bit 0x15: Audio DMA - RAM5 to DSP
bit 0x16: Audio DMA - RAM6 to DSP
bit 0x17: Audio DMA - RAM7 to DSP
bit 0x18: Audio DMA - RAM8 to DSP
bit 0x19: Audio DMA - RAM9 to DSP
bit 0x1A: Audio DMA - RAMA to DSP
bit 0x1B: Audio DMA - RAMB to DSP
bit 0x1C: Audio DMA - RAMC to DSP
bit 0x1D: XBUS DMA transfer complete
bit 0x1E: ??? Watchdog?
bit 0x1F: Indicates more interrupt flags are in 0x0340_0060
0x0340_0044Reading yields pending interrupts mask from 0x0340_0040.
Writing will *clear* the corresponding bits.
0x0340_0048Reading yields the interrupt enable mask for 0x0340_0040.
Writing will *set* the corresponding mask bits.
0x0340_004CReading yields the interrupt enable mask for 0x0340_0040.
Writing will *clear* the corresponding mask bits.
0x0340_0058Reading yields DMA controller interrupt failure reasons?
bits 0…14: channels which had an underflow?
bit 15: ???
bits 16…19: channels which had an overflow?
bit 20: access violation which details are described by 0x0330_0024 (MADAM)
bit 21: indicates bits 22…27 contain some address?
0x0340_0060Continuation of 0x0340_0040

bit 0x00: ?
bit 0x01: ?
bit 0x02: FMV module (Woody). Uses 0x031C_0000 - 0x031C_FFFF.
bit 0x03: ?
bit 0x04: FMV Video from RAM
bit 0x05: FMV Video to RAM
bit 0x06: FMV Audio from RAM
bit 0x07: FMV Audio to RAM
bit 0x08: DMA controller interrupt
bit 0x09:
bit 0x0A:
bit 0x0B:
bit 0x0C:
bit 0x0D:
bit 0x0E:
bit 0x0F:
bit 0x10:
bit 0x11:
bit 0x12:
bit 0x13:
bit 0x14:
bit 0x15:
bit 0x16:
bit 0x17:
bit 0x18:
bit 0x19:
bit 0x1A:
bit 0x1B:
bit 0x1C:
bit 0x1D:
bit 0x1E:
bit 0x1F:
0x0340_0064Like 0x0340_0044
0x0340_0068Like 0x0340_0048
0x0340_006CLike 0x0340_004C
first DIPIR

0x8000 - active
0x4000 - happened before reset
0x00xx - device number of the DIPIR
0x0340_0414second DIPIR
0x0340_17F0PRNG which returns 16bit value on read.
documentation/hardware/opera/memory_mappings.txt · Last modified: 2022/01/20 11:02 by trapexit