So I made a small breakthrough in reversing the program ROM.
Looking at the MAME source, I found out that the YMW258/MultiPCM maps channels in a slightly unusual way. In MAME the channel map table looks like this
Code:
const int32_t multipcm_device::VALUE_TO_CHANNEL[32] =
{
0, 1, 2, 3, 4, 5, 6 , -1,
7, 8, 9, 10,11,12,13, -1,
14,15,16,17,18,19,20, -1,
21,22,23,24,25,26,27, -1,
};
i found an equivalent table in the program rom at 0x14e10 to used to convert logical channel numbers to physical (how the chip recognizes them).
Code:
ROM:94E10 ChannelMapTable:.byte 0, 1, 2, 3, 4, 5, 6, 8! 0
ROM:94E10 .byte 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0x10, 0x11! 8
ROM:94E10 .byte 0x12, 0x13, 0x14, 0x15, 0x16, 0x18, 0x19, 0x1A! 0x10
ROM:94E10 .byte 0x1B, 0x1C, 0x1D, 0x1E! 0x18
This led me to find the write to chip function
Code:
ROM:81F6A GEW8GetChannelWrite: ! near ! CODE XREF: sub_8264A+25p
ROM:81F6A mov:g.w r4, @-sp
ROM:81F6C
ROM:81F6C loc_81F6C: ! CODE XREF: GEW8GetChannelWrite+5j
ROM:81F6C btst.b #0:8, @unk_800:8 ! check busy flag?
ROM:81F6F bne loc_81F6C:8
ROM:81F71 mov:g.b @unk_3957:16, r4
ROM:81F75 extu.b r4
ROM:81F77 add:q.w #-2, sp
ROM:81F79 stc.b ep, @sp
ROM:81F7B ldc.b #9:8, ep
ROM:81F7E ! assume ep:9
ROM:81F7E mov:g.b @(0x4E10:16,r4), r4 ! Convert channel number to physical
ROM:81F82 ldc.b @sp, ep
ROM:81F84 ! assume ep:nothing
ROM:81F84 add:q.w #2, sp
ROM:81F86 mov:s.b r4, @unk_801:8 ! set channel
ROM:81F88 jsr SmallDelay:16
ROM:81F8B mov:s.b r0, @unk_802:8 ! set register number
ROM:81F8D jsr SmallDelay:16
ROM:81F90 mov:s.b r1, @unk_800:8 ! write data
ROM:81F92 mov:g.w @sp+, r4
ROM:81F94 rts
ROM:81F94 ! End of function GEW8GetChannelWrite
(There are also variations of this function to only set the channel and to write data to a register.)
Just like the MAME MultiPCM core, this only uses three addresses to set the channel number, register number and to write the data.