Thanks guys. Yep, I forgot that INC was RMW, however that doesn't really provide enough insights to know what's going on with the PRG "stuff".
What effectively this means is that the MMC1 load register is always "off by one". Let me try to explain:
Code:
;
; Focusing on MMC1 load registers, control register, and PRG bank register
;
; MMC1 load register = %????????
; MMC1 control register = %?????
;
FC97 EE 80 FC INC $FC80 = D8 A:80 X:FF Y:00 P:A4 SP:FF CYC: 32 SL:241
;
; INC is an RMW instruction. MMC1 ignores 2nd write.
; $FC80 would correlate with the load register at this point.
; $D8 gets written to MMC1 load register; we only care about bit 0.
; $D8 = %11011000, so at this point:
;
; MMC1 load register = %???????0
; MMC1 control register = %?????
;
FC9A A9 10 LDA #$10 A:80 X:FF Y:00 P:A4 SP:FF CYC: 50 SL:241
FC9C 20 D5 B8 JSR $B8D5 A:10 X:FF Y:00 P:24 SP:FF CYC: 56 SL:241
B8D5 8D FF 9F STA $9FFF = 4F A:10 X:FF Y:00 P:24 SP:FD CYC: 74 SL:241
;
; MMC1 load register = %??????00
; MMC1 control register = %?????
;
B8D8 4A LSR A A:10 X:FF Y:00 P:24 SP:FD CYC: 86 SL:241
B8D9 8D FF 9F STA $9FFF = 4F A:08 X:FF Y:00 P:24 SP:FD CYC: 92 SL:241
;
; MMC1 load register = %?????000
; MMC1 control register = %?????
;
B8DC 4A LSR A A:08 X:FF Y:00 P:24 SP:FD CYC:104 SL:241
B8DD 8D FF 9F STA $9FFF = 4F A:04 X:FF Y:00 P:24 SP:FD CYC:110 SL:241
;
; MMC1 load register = %????0000
; MMC1 control register = %?????
;
B8E0 4A LSR A A:04 X:FF Y:00 P:24 SP:FD CYC:122 SL:241
B8E1 8D FF 9F STA $9FFF = 4F A:02 X:FF Y:00 P:24 SP:FD CYC:128 SL:241
;
; At this point the MMC1 load register contents, since 5
; writes have been issued, should result in the MMC1
; control register being internally set. Thus:
;
; MMC1 load register = %???00000
; MMC1 control register = %00000
;
; Bit 1,0 = mirroring = one-screen, lower bank
; Bit 3,2 = PRG ROM bank mode = switch 32KBytes at $8000 ignoring low bit of bank #
; Bit 4 = CHR ROM bank mode = switch 8KBytes at a time
;
So in effect, the LDA #$10 + JSR $B8D5 wouldn't actually result in the MMC1 control register containing %10000 -- it would instead contain %00000.
After the next 5 writes to the load register, the result there would be %????1, and based on looking at the code, that's not very logical. Furthermore, I believe Dr. Mario uses 4KByte CHR-ROM switching, not 8KByte, but I could be wrong there. No emulator gives in-depth mapper debugging details so I really can't tell.
So can someone shed some light on this? This is incredibly confusing and has been absolutely the #1 reason I have avoided MMC1 like the plague over the years.