Memory
~~~~~~
Memory map:
   0x00000000-0x00?????? = ROM (varying sizes)
   0x00200000-0x0021ffff = RAM? (Daytona/ZeroGunr only)
   0x00220000-0x0023ffff = ROM? (Daytona only, 2nd half of program ROM mirror)
   0x00500000-0x005fffff = RAM
   0x00800000-0x008????? = TGP?
   0x00880000-0x0088ffff = TGP? (RAM?)
   0x00980000-0x009????? = TGP?
   0x00e00000-0x00e????? = ???
   0x00e80000-0x00e80003 = Interrupt request (INTREQ)
   0x00e80004-0x00e80007 = Interrupt enable (INTENA)
   0x00f00000-0x00f0000? = ??? (some sort of timer maybe?)
   0x01000000-0x0100ffff = VIDEO RAM
   0x01080000-0x010fffff = GFX DATA RAM
   0x01800000-0x01803fff = PALETTE RAM
   0x01810000-0x0181bfff = ???
   0x01c00000-0x01c0???? = INPUTS
   0x01c80000-0x01c80001 = SOUND COMMAND
   0x01d00000-0x01d03fff = BACKUP RAM
   0x01d84000-0x01d8???? = ??? (DoA only. eprom maybe?)
   0x02000000-0x02ffffff = DATA ROM
   0x12000000-0x127fffff = TEXTURE RAM

Most areas are interleaved. Some are spread between two chips,
(1/2, or even/odd), some are spread between 4 chips (1/2/3/4).

BYTE  = 8-bit
SHORT = 16-bit
WORD  = 32-bit

0x00000-0x3ffff: ROM IC12, PROGRAM 0 (even SHORTs)
0x00000-0x3ffff: ROM IC13, PROGRAM 1 ( odd SHORTs)
0x40000-0x7ffff: ROM IC14, PROGRAM 2 (even SHORTs)
0x40000-0x7ffff: ROM IC15, PROGRAM 3 ( odd SHORTs)

0x500000-0x5fffff: RAM IC16 (even SHORTs)
0x500000-0x5fffff: RAM IC17 ( odd SHORTs)

0x1000000-0x100ffff: RAM IC45 (even BYTEs)
0x1000000-0x100ffff: RAM IC46 ( odd BYTEs)

0x1080000-0x10fffff: RAM IC47 (1st BYTEs)
0x1080000-0x10fffff: RAM IC48 (2nd BYTEs)
0x1080000-0x10fffff: RAM IC49 (3rd BYTEs)
0x1080000-0x10fffff: RAM IC50 (4th BYTEs)

0x1800000-0x1803fff: RAM IC54 (even SHORTs)
0x1800000-0x1803fff: RAM IC55 ( odd SHORTs)

0x1810000-0x1813fff: RAM IC57 (even BYTEs)
0x1814000-0x1817fff: RAM IC58 (even BYTEs)
0x1818000-0x181bfff: RAM IC59 (even BYTEs)

0x1d00000-0x1d03fff: RAM IC65 (even BYTEs)
0x1d00000-0x1d03fff: RAM IC66 ( odd BYTEs)

0x2000000-0x23fffff: ROM IC10, DATA0 (even SHORTs)
0x2000000-0x23fffff: ROM IC11, DATA1 ( odd SHORTs)
0x2400000-0x27fffff: ROM IC8,  DATA2 (even SHORTs)
0x2400000-0x27fffff: ROM IC9,  DATA3 ( odd SHORTs)
0x2800000-0x2bfffff: ROM IC6,  DATA4 (even SHORTs)
0x2800000-0x2bfffff: ROM IC7,  DATA5 ( odd SHORTs)
0x2c00000-0x2ffffff: ROM IC4,  DATA6 (even SHORTs)
0x2c00000-0x2ffffff: ROM IC5,  DATA7 ( odd SHORTs)

Interrupts
~~~~~~~~~~
Configured to use each pin for a seperate vector.
INTREQ is at 0xe80000, INTENA is at 0xe80004.
When INTREQ is written to the data is always ANDed with the value
already there.

Any item of hardware can request an interrupt by setting the appropriate bit
in INTREQ. The corresponding bit in INTENA controls whether that interrupt is
enabled. The interrupt controller (?) will then try to raise the appropriate
IRQ pin.

*** (vf2 only) ************
* INT0 -> 0xbc0   (bit 0 only)
* INT1 -> 0xd30   (bit 2 only, does nothing)
* INT2 -> 0xd50   (bits 2->8, see below)
* INT3 -> 0xe10   (bit 10 only, sound queue?)
* 
* The multi-plexed interrupt (INT2) seems to control a lot:
* Bits 2,3,4 are handled in one group, but just talk to the 0xf00000 area.
* Bits 5,6,7 are handled in another group, but always bring up the INTERRUPT
* HALT #.
* Bit 8 is seperate, but also just goes straight to INTERRUPT HALT #.
***************************

TGP
~~~
Uses IC47, IC56, IC60, and IC64.
TGP test code starts at 0x5d70c. (vf2 only)

*** 0x980004 ***
* Status? Bit 0 may indicate the TGP has sent data to the main CPU.
* Bit 0 is polled, if 1 then no data, if 0 then data is waiting at 0x884000.
* DoA checks this before writing to the TGP, and empties any waiting data
* before writing to the TGP.
****************

*** 0x884000 ***
* Data read/write? Checks 0x980004 before reading from here.
****************

*** 0x98000c ***
* Status? If bits 5 and 1 are set, says Overflow.
* Bit 6 if set, says FIFO_in full.
* Bit 7 if set, says End func err.
****************

*** 0x980000 ***
* Writes 0x80000000 before uploading code?
* Writes 0x00000000 when done?
****************

*** 0x880080 ***
* Writes 0x00000001 when done uploading code?
****************

*** 0x800140 ***
* Writes 0x00000000 to start burst transfer?
* Then writes position (in bytes) to 0x804000, followed by length (in words).
****************

Inputs
~~~~~~
Appears to be powered by some kinda MCU or something. Oh well.
Registers are mapped starting at 0x1c00000.
Although some are accessed as SHORTs, it may only use the lower 8-bits.
All digital controls are active-low.
VR button is enabled if bit 0 of R00 is clear?
+/- = gear up/down
1/2 = start (p1 or p2), or button (1/2/3)
LRUD = left/right/up/down
S/T/V = service/test/VR
C/c = coin 1/2
x/? = unused/unknown

Address:      R/W:  Purpose:
R42-R43       R     Status? Lower byte must be 0x40. (0xfdc)
R40-R41       W     Writes 0x0001 to start commucations. (0x1070)
R40-R41       R     Status? Expects lower 2 bits to be 0. (0x100c)
R10           W     Finish? Writes 0x5e at the end of reading. (0x102c)

Plan A:
R16           R     Inputs? The byte goes through a lookup table. (0x1098)
R18           R     Inputs? The byte goes through a lookup table. (0x10a8)
R1a           R     Inputs? The byte goes through a lookup table. (0x10b8)
R10           R     General inputs. bits=??21ST??
R12           R     P1 inputs. bits=LRUD321x
R14           R     P2 inputs. bits=LRUD321x
R1c           R     Inputs?

or Plan B:
R0c           R     Inputs?
R00           W     Control? Writes 0x00 or 0x01 before accessing R02. (0x1170)
R02           R     Inputs. bits=?V??STcC
R04           R     Inputs. bits=??-+??21
R06           R     Inputs?

2D Graphics data
~~~~~~~~~~~~~~~~
The data is uploaded to the GFX DATA RAM on the fly. It contains up to
16384 (unsure?) 8x8 tiles, each is 16 colours (4-bit).

Each tile contains 16 SHORTs, each SHORT contains 4 half-BYTEs. The top-most
nibble is the left-most pixel.

The colour code for each tile is simply the tile number divided by 128.
This means there are only 128 colour codes accessible, out of the 512 that
exist. Maybe the others are for textures or something...

Video memory
~~~~~~~~~~~~
Two layers. Background at 0x1000000 and foreground at 0x1004000.
There's something at 0x100a004, maybe it's a scroll control?
Each layer is 64x48 tiles. Only 62x48 are visible I think.

2D Palette
~~~~~~~~~~
The palette is split into 16-colour sections. The tile number for a tile
gives the section to use. Each colour is one SHORT.
The first colour in each section is always transparent.

Format: 0bbbbbgggggrrrrr

Texture data
~~~~~~~~~~~~
Stored in two areas. Each WORD contains two 8-bit pixels, then two empty
BYTEs. Each area appears to be 1024x1024.

Sound (M68000)
~~~~~~~~~~~~~~
000000-07FFFF WORK RAM
100000-100??? SOUND/SOUND COMM?
400000-400001 SOUND/SOUND COMM?
600000-67FFFF 68000 ROM

interrupts:
1, 2 and 3... (try all 3 every frame, usually what I do...).
4,5,6,7 are unsued, don't call them.

Misc
~~~~
To enable VF2 debug mode, wait till it says "Sound initialise...", then press:
   LEFT, B1, B2, RIGHT, RIGHT, DOWN, B1, UP, B2, B2
in order (P1 inputs), or just cheat and set bit 0x0e of 0x508000 ;-)
I think you have to hold the service switch while doing this.
