okay, probably just need to patch binary that is loaded through rom
00001025 8FBF001C 8FB00014 8FB10018
03E00008 27BD0028 3C0EA460 03E00008

7000D058	(8000D058 - mighty convenient setting it up like this!)
OR	V0,R0,R0
LW	RA,001C (SP)
LW	S0,0014 (SP)
LW	S1,0018 (SP)
JR	RA
ADDIU	SP,SP,0028

This is the return after catching the PI interupt.  It just resets some values and returns to whatever called it.  That's the link.  V0, S0, S1 are free.
T4 = rom address (00000000 10xxxxxx-as sent to PI_CART_ADDY_REG)
T3 = rom address (FFFFFFFF B0xxxxxx)
T2 = rom address (00000000 00xxxxxx)	also A1
T6 = number of bytes to write	//these two are dirty!  not needed after this point
T7 = PI_WR_LEN_REG (T6-1)

A2 = target addy (FFFFFFFF 80xxxxxx)	also A0
V0 = target addy (00000000 00xxxxxx-as sent to PI_DRAM_ADDY_REG)

------------
read for code containing this thingy; presumably 0xBCB30.  addy + 0x1CF0 for actual
------------
8100D058	LUI V0,8040	->codeaddy
8100D05C	JALR V0,S1	->to newcode
8100D060	LUI S0,B00C

CO-OP only:
ADDIU	S0,S0,CB30
BNE	S0,T3, +5
LUI	S0,802C
LD	V0,DB18 (S0)
SD	V0,1CF0 (A2)
LD	V0,DB20 (S0)
SD	V0,1CF8 (A2)

LW	RA,001C (SP)
LW	S0,0014 (SP)
JR	S1
OR	V0,R0,R0

8100D058 3C02
8100D05A 8040
8100D05C 0040
8100D05E 8809
8100D060 3C10
8100D062 B00C

81400000 2610
81400002 CB30
81400004 160B
81400006 0005
81400008 3C10
8140000A 802C
8140000C DE02
8140000E DB18
81400010 FCC2
81400012 1CF0
81400014 DE02
81400016 DB20
81400018 FCC2
8140001A 1CF8
8140001C 8FBF
8140001E 001C
81400020 8FB0
81400022 0014
81400024 0220
81400026 0008
81400028 0000
8140002A 1025
------------
------------
812BDAE0 3C02
812BDAE2 8008
812BDAE4 8C42
812BDAE6 A0B8
812BDAE8 AFA2
812BDAEA 002C
812BDAEC 8FA4
812BDAEE 004C
812BDAF0 2C81
812BDAF2 0004
812BDAF4 1420
812BDAF6 0003
812BDAF8 0000
812BDAFA 0000
812BDAFC 8FA4
812BDAFE 002C
812BDB00 AFA4
812BDB02 004C
812BDB04 3C0C
812BDB06 7F08
812BDB08 358C
812BDB0A 9D00
812BDB0C 0180
812BDB0E 0008
812BDB10 0000
812BDB12 0000

812BDB18 3C0C
812BDB1A 802B
812BDB1C 358C
812BDB1E DAE0
812BDB20 0180
812BDB22 0008
812BDB24 0000
812BDB26 0000

------------- Final!
"Co-op Fix #62" .off
812BDAE0 3C02
812BDAE2 8008
812BDAE4 8C42
812BDAE6 A0B8
812BDAE8 AFA2
812BDAEA 002C
812BDAEC 8FA4
812BDAEE 004C
812BDAF0 2C81
812BDAF2 0004
812BDAF4 1420
812BDAF6 0003
812BDAF8 0000
812BDAFA 0000
812BDAFC 8FA4
812BDAFE 002C
812BDB00 AFA4
812BDB02 004C
812BDB04 3C0C
812BDB06 7F08
812BDB08 358C
812BDB0A 9D00
812BDB0C 0180
812BDB0E 0008
812BDB10 0000
812BDB12 0000
812BDB18 3C0C
812BDB1A 802B
812BDB1C 358C
812BDB1E DAE0
812BDB20 0180
812BDB22 0008
812BDB24 0000
812BDB26 0000
8100D058 3C02
8100D05A 8040
8100D05C 0040
8100D05E 8809
8100D060 3C10
8100D062 B00C
"Co-op (2)" .off
81400000 2610
81400002 AB74
81400004 160B
81400006 0005
81400008 3C10
8140000A 802C
8140000C DE02
8140000E DB18
81400010 FCC2
81400012 1CF0
81400014 DE02
81400016 DB20
81400018 FCC2
8140001A 1CF8
8140001C 8FBF
8140001E 001C
81400020 8FB0
81400022 0014
81400024 0220
81400026 0008
81400028 0000
8140002A 1025
---------------------
---------------------
PAL	same as before, but patch to 8000BDB8


The Spy Who Loved Me Co-Op Patch (console)	- PAL (European) version
  Non-player kills count as player suicides in multiplayer.  This is a console port of SubDrag's amazing rom patch.  It is designed for uploaded stages, so be sure to have a 8MB expansion pak in your N64.  It has been tested to work on console.  Be sure both the first and second lists are both active, or the game will fail near-instantly.  The next installment of the help file will include it.
  Only use this with PAL cartridges.

"Co-op Fix #62" .off
812ADC60 3C02
812ADC62 8007
812ADC64 8C42
812ADC66 8BC8
812ADC68 AFA2
812ADC6A 002C
812ADC6C 8FA4
812ADC6E 004C
812ADC70 2C81
812ADC72 0004
812ADC74 1420
812ADC76 0003
812ADC78 0000
812ADC7A 0000
812ADC7C 8FA4
812ADC7E 002C
812ADC80 AFA4
812ADC82 004C
812ADC84 3C0C
812ADC86 7F08
812ADC88 358C
812ADC8A 9E84
812ADC8C 0180
812ADC8E 0008
812ADC90 0000
812ADC92 0000
812ADC98 3C0C
812ADC9A 802A
812ADC9C 358C
812ADC9E DC60
812ADCA0 0180
812ADCA2 0008
812ADCA4 0000
812ADCA6 0000
8100BDB8 3C02
8100BDBA 8040
8100BDBC 0040
8100BDBE 8809
8100BDC0 3C10
8100BDC2 B00C
"Co-op (2)" .off
81400000 2610
81400002 A9F0
81400004 160B
81400006 0005
81400008 3C10
8140000A 802B
8140000C DE02
8140000E DC98
81400010 FCC2
81400012 1E74
81400014 DE02
81400016 DCA0
81400018 FCC2
8140001A 1E7C
8140001C 8FBF
8140001E 001C
81400020 8FB0
81400022 0014
81400024 0220
81400026 0008
81400028 0000
8140002A 1025

-----------------------
-----------------------
-----------------------
Now the STAGE part of it all...
handle changes slightly to allow RA to contain return address
this requires resetting S1 in the loop
Any other variables will need to be a SD/LD
expect program to upload the first level data stuff to 80400A00 (0x980 / 2432 entries)

Okay, here's the dumb part!
They load the BG file partially before full write.  So, must use PI_WR_LEN_REG value (or comparison) to ensure no overruns
Thankfully, once BG written the rest of the sizes are absolutely set.  whew.


method is so:
increment through a list of ROM addresses, data addresses, and sizes (#DWORDS)
ends when ROM address=0

8100D058	3C028040	LUI V0,8040	->codeaddy
8100D05C	0040F809	JALR RA,V0	->to newcode
8100D060	3C10B00C	LUI S0,B00C
8100D064	8FBF001C	LW RA,001C (SP)

CO-OP only:
2611CB30	ADDIU	S1,S0,CB30
562B0007	BNEL	S1,T3, iterate
24500080	addiu	s0,v0, (offset to list of sizes) 0x80

coop:
3C10802C	LUI	S0,802C
DE02DB18	LD	V0,DB18 (S0)
FCC21CF0	SD	V0,1CF0 (A2)
DE02DB20	LD	V0,DB20 (S0)
10000011	beq	r0,r0, end
FCC21CF8	SD	V0,1CF8 (A2)

interate:
00067825	OR	T7,R0,A2
loopus:
8E110000	lw	s1,0000 (S0)	//s1=ROM address
1011000D	beq	s1,r0, end
8E020004	lw	v0,0004 (S0)	//v0=data addy
562BFFFC	bnel	s1,t3, loopus
2610000C	addiu	s0,s0,000C	//s0=next sample

8E110008	lw	s1,0008 (S0)	//s1=size in words
000E7082	SRL	T6,T6,0x2	//#bytes /4 (# Ws)
copy:
8C500000	lw	s0,0000 (V0)	//copy W
ADF00000	sw	s0,0000 (T7)	//paste W
24420004	addiu	v0,v0,0004	//next W source
21CEFFFF	ADDI	T6,T6,FFFF
100E0003	BEQ	R0,T6,end
2231FFFF	addi	s1,s1,FFFF	//s1--
5411FFF9	bnel	s1,r0, copy
25EF0004	ADDIU	T7,T7,0004	//next W target

end:
8FB10018	LW	S1,0018 (SP)
8FB00014	LW	S0,0014 (SP)
03E00008	JR	RA
00001025	OR	V0,R0,R0

--
"multiload #68" .off
81400000 2611
81400002 CB30
81400004 562B
81400006 0007
81400008 2450
8140000A 0080
8140000C 3C10
8140000E 802C
81400010 DE02
81400012 DB18
81400014 FCC2
81400016 1CF0
81400018 DE02
8140001A DB20
8140001C 1000
8140001E 0011
81400020 FCC2
81400022 1CF8
81400024 0006
81400026 7825
81400028 8E11
8140002A 0000
8140002C 1011
8140002E 000D
81400030 8E02
81400032 0004
81400034 562B
81400036 FFFC
81400038 2610
8140003A 000C
8140003C 8E11
8140003E 0008
81400040 000E
81400042 70C2
81400044 DC50
81400046 0000
81400048 FDF0
8140004A 0000
8140004C 2442
8140004E 0008
"multiload 2" .off
81400050 21CE
81400052 FFFF
81400054 100E
81400056 0003
81400058 2231
8140005A FFFF
8140005C 5411
8140005E FFF9
81400060 25EF
81400062 0008
81400064 8FB1
81400066 0018
81400068 8FB0
8140006A 0014
8140006C 03E0
8140006E 0008
81400070 0000
81400072 1025
8100D058 3C02
8100D05A 8040
8100D05C 0040
8100D05E F809
8100D060 3C10
8100D062 B00C
8100D064 8FBF
8100D066 001C
F1400080 0000
F1400082 0000
"multiload Co-Op #34" .off
812BDAE0 3C02
812BDAE2 8008
812BDAE4 8C42
812BDAE6 A0B8
812BDAE8 AFA2
812BDAEA 002C
812BDAEC 8FA4
812BDAEE 004C
812BDAF0 2C81
812BDAF2 0004
812BDAF4 1420
812BDAF6 0003
812BDAF8 0000
812BDAFA 0000
812BDAFC 8FA4
812BDAFE 002C
812BDB00 AFA4
812BDB02 004C
812BDB04 3C0C
812BDB06 7F08
812BDB08 358C
812BDB0A 9D00
812BDB0C 0180
812BDB0E 0008
812BDB10 0000
812BDB12 0000
812BDB18 3C0C
812BDB1A 802B
812BDB1C 358C
812BDB1E DAE0
812BDB20 0180
812BDB22 0008
812BDB24 0000
812BDB26 0000

-------------
-------------
now the 'slightly more annoying part than before'
getting clipping to copy to point

7F0BCD28 JAL to a routine that loads the compressed binary and decompresses it.
V0=address of decompressed binary

on return to 7F0B428C, uses V0 to set the clipping address at 8007BF94 and  those at 80040F5?

trouble is, the bugger is used by everything else too...  Besides, it doesn't have a ROM address left over


----Interesting TLB stuff
Goldeneye, on boot, 8000046C
sets T0 to 007FE000.  This sets the pagemask to index 80000000-80400000 as 70000000-70400000.  change that and you change the amount of memory indexed!