snestech.txt 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850
  1. SNES hardware notes
  2. by Charles MacDonald
  3. WWW: http://cgfm2.emuviews.com
  4. Unpublished work Copyright 2003 Charles MacDonald
  5. This document is in a very preliminary state and is subject to change.
  6. Most everything within has been tested and verified on a SNES but
  7. please be aware that my testing methods or interpretations of results
  8. could be flawed. I can't guarantee that everything is 100% accurate.
  9. Last updated 09/17/03
  10. [09/17/03]
  11. - Added the cartridge information section.
  12. - Added some details on the screen layout.
  13. [08/27/03]
  14. - Fixed some typos
  15. - Added CGRAM information
  16. - Added notes about valid times to access OAM
  17. [08/25/03]
  18. - Added some sprite information
  19. [08/22/03]
  20. - Added mouse information
  21. - Added multitap information
  22. - Changed joypad section
  23. [08/20/03]
  24. - Initial release
  25. Table of contents
  26. 1. Various notes
  27. 2. CGRAM
  28. 3. Sprites
  29. 3. Hardware version registers
  30. 4. I/O hardware
  31. 5. Register reference
  32. 6. Cartridge information
  33. 7. Assistance needed
  34. 8. Credits and acknowledgements
  35. 9. Disclaimer
  36. ----------------------------------------------------------------------------
  37. Various notes
  38. ----------------------------------------------------------------------------
  39. V-Blank occurance flag
  40. - Bit 7 of $4212 is set at line $00E1 and cleared at line $0000 in 224-line
  41. mode.
  42. - Bit 7 of $4212 is set at line $00F0 and cleared at line $0000 in 239-line
  43. mode.
  44. Joypad automatic scanning flag
  45. - Bit 0 of $4212 is set at line $00E1 and cleared at line $00E4 in 224-line
  46. mode.
  47. - Bit 0 of $4212 is set at line $00F0 and cleared at line $00F3 in 239-line
  48. mode.
  49. Non-maskable interrupts
  50. According to the 65816 manual, the NMI signal is an edge-sensitive input,
  51. so that only a high to low transition on the NMI pin will cause an interrupt
  52. to occur. Leaving it high, low, or having a low to high transition has no
  53. effect. I'm going to assume the PPU normally holds NMI high and brings it
  54. low to trigger an interrupt.
  55. The PPU will pull NMI low at line $00E8 in 224-line mode or line $00F7 in
  56. 239-line mode. It will remain low until either $4210 is read, or a new
  57. frame starts, at which point the PPU will bring NMI high again.
  58. The inverted state of the NMI signal from the PPU can be read through bit 7
  59. of $4210, where 0= no NMI has been requested, 1= an NMI is pending. After
  60. reading this register, the PPU resets the NMI signal by pulling it high.
  61. Bit 7 of $4200 doesn't affect how the PPU manages NMIs at all, it is just
  62. a gate between the NMI output of the PPU and the NMI input of the CPU.
  63. When set, NMIs can be generated. When cleared, the CPU ignores the state of
  64. the NMI pin.
  65. Here are some details of specific situations:
  66. When there is a pending NMI, toggling bit 7 of $4200 does not create any
  67. additional interrupts.
  68. Bit 7 of $4210 will be set in the NMI routine when it executes.
  69. After the NMI routine finishes, bit 7 will remain set (assuming $4210 wasn't
  70. read) until the start of the next frame. This will not cause more NMIs to
  71. occur as they are only triggered by high-to-low transitions, having the NMI
  72. pin remain low does not do anything.
  73. Bit 7 of $4210 reflects the NMI status independantly of bit 7 of $4200.
  74. Interlaced display
  75. When bit 0 of $2133 is set, the screen becomes interlaced regardless of
  76. the BG mode setting. When the screen is interlaced, the following applies:
  77. - For BG modes 0,1,2,3,4,7 each line of the background is repeated in the
  78. even and odd frames for single-density interlace. (224 or 239 lines shown)
  79. - For BG modes 5,6 each line of the background is unique for the even and
  80. odd frames for double-density interlace. (448 or 478 lines shown)
  81. Screen layout
  82. For an NTSC non-interlaced display, each frame consists of 262 lines.
  83. Depending on the screen height, these lines are divided into the following
  84. groups:
  85. Section 224-line mode 239-line mode
  86. Active display 224 239
  87. Bottom blanking 12 15
  88. Vertical sync 3 3
  89. Top blanking 23 5
  90. Total 262 262
  91. Active display is the portion of the screen where graphics are displayed.
  92. Bottom blanking is the bottom border after the active display shown at the
  93. very bottom of the display. Lines are filled with black.
  94. Vertical sync is the period between the bottom and top borders which is
  95. off-screen. Lines are filled with a darker black color than in the blanking
  96. areas.
  97. Top blanking is the border after the vertical sync period shown at the very
  98. top of the display. Lines are filled with black.
  99. ----------------------------------------------------------------------------
  100. CGRAM
  101. ----------------------------------------------------------------------------
  102. Overview
  103. The PPU has 512 bytes of on-chip RAM called CGRAM which holds palette data.
  104. CGRAM is divided into 256 2-byte entries that define a single color.
  105. Each entry has the following format:
  106. MSB LSB
  107. -bbbbbgggggrrrrr
  108. b = Blue component (0=black, 31=bright)
  109. g = Green component (0=black, 31=bright)
  110. r = Red component (0=black, 31=bright)
  111. - = Unused bit.
  112. The background can use the first 128 colors in BG modes 0,1,2,5,6, and all
  113. 256 colors in BG modes 3,4,7 when not in direct color mode. Sprites always
  114. use the latter 128 colors. Specific details about palette use and selection
  115. for each mode will be described later.
  116. The PPU provides several registers for using CGRAM:
  117. $2121 - CGRAM address
  118. $2122 - CGRAM data port (write)
  119. $213B - CGRAM data port (read)
  120. CGRAM access
  121. The PPU has a 9-bit address register which gives a byte offset into CGRAM.
  122. Writing to $2121 loads the CPU data into bits 8-1 of the address register
  123. and clears bit 0, forcing an even address to be set.
  124. Each time $213B is read, the byte at the current offset pointed to by the
  125. address register is returned to the CPU, and the address register is
  126. incremented by one.
  127. Each time $2122 is written to the address register is incremented by one.
  128. If the address register is even during a write, the CPU data is stored in
  129. a latch. If the address register is odd, the latched data becomes the LSB
  130. and the new data written becomes the MSB of a 16-bit word. This word is
  131. written to the current address, with bit 0 of the address register ignored.
  132. The address register will wrap from $01FF to $0000 due to reading $213B or
  133. writing to $2122. You can mix reads and writes freely.
  134. Valid access times
  135. When the screen is forcibly blanked or in the V-Blank period, CGRAM can be
  136. read and written. I haven't tested access during H-Blank yet.
  137. Here are my observations about CGRAM access during the active display
  138. period:
  139. - Writing to CGRAM always results in the last word written to the data port
  140. being written to address 0,1 regardless of the address register setting.
  141. You could think of address bits 8-1 as always being fixed to zero during
  142. this time.
  143. - Reading from CGRAM returns a random mix of bytes from CGRAM and data that
  144. wasn't stored in CGRAM. The address register has no effect on where the
  145. data comes from.
  146. - When the screen is turned on, the previously set value in the address
  147. register not changed. Following reads or writes with the screen off
  148. affect the address originally selected.
  149. CGRAM access examples
  150. Here are some examples of unexpected behavior. Assume CGRAM contains the
  151. bytes $AA, $BB, $CC, $DD at address $0000 for each test:
  152. - Set address to $0000
  153. - Write $45
  154. CGRAM is not updated, and the LSB latch contains $45
  155. - Set address to $0000
  156. - Read $2138
  157. - Write #$45
  158. The bytes $CC, $45 are written to address $0000. $CC was the last value
  159. in the LSB latch, and a single byte write triggers a write to CGRAM as the
  160. previous read made the address register odd.
  161. ----------------------------------------------------------------------------
  162. Sprites
  163. ----------------------------------------------------------------------------
  164. The PPU can manage up to 128 sprites. Sprites use 16-color 8x8 tiles, the
  165. same as used by the backgrounds. The sprite size can range from 1x1 tiles
  166. up to 8x8 tiles, with several variations in between.
  167. The attributes for each sprite are stored in 544 bytes of on-chip RAM called
  168. OAM or "Object Attribute Memory". The OAM can be thought of having two
  169. sections, a 512-byte table that has 128 x 4-byte entries, and a 32-byte
  170. table used as 128 x 2-bit entries.
  171. The PPU provides several registers for sprite control:
  172. $2101 - OAM control
  173. $2102 - OAM address LSB
  174. $2103 - OAM address MSB
  175. $2104 - OAM data port (write)
  176. $2138 - OAM data port (read)
  177. The OAM control register defines various aspects about the sprites:
  178. D7 : Sprite size, bit 2
  179. D6 : Sprite size, bit 1
  180. D5 : Sprite size, bit 0
  181. D4 : Sprite name offset, bit 1
  182. D3 : Sprite name offset, bit 0
  183. D2 : Sprite pattern table base, bit 2
  184. D1 : Sprite pattern table base, bit 1
  185. D0 : Sprite pattern table base, bit 0
  186. The sprite pattern table is where the tile data for sprites is fetched from.
  187. The table is 16K in size and can be positioned on 16K boundaries. Bits 2-0
  188. of this register correspond to bits 16-14 of the VRAM address.
  189. As there is only 64K of VRAM, bit 2 has no effect. Pattern data read from
  190. $10000-$1FFFF is instead read from $00000-$0FFFF due to mirroring.
  191. When a sprite has bit 8 of it's name field set so that it reads patterns
  192. out of the upper 8K of the 16K table (tiles 256-511), bits 4, 3 of this
  193. register are added to bits 14 and 13 of the VRAM address.
  194. If the resulting address is bigger than $10000 then data is read from
  195. $00000 onwards due to mirroring. The same holds true if the address is
  196. bigger than $20000, due to wrapping.
  197. The sprite sizes are as follows:
  198. D7 D6 D5 Small Large
  199. 0 0 0 8x8 16x16
  200. 0 0 1 8x8 32x32
  201. 0 1 0 8x8 64x64
  202. 0 1 1 16x16 32x32
  203. 1 0 0 16x16 64x64
  204. 1 0 1 32x32 64x64
  205. 1 1 0 16x32 32x64
  206. 1 1 1 16x32 32x32
  207. The last two settings are undocumented but appear to function normally.
  208. Overview
  209. The CPU interface to the OAM appears as a 1024-byte array. Here's a memory
  210. map:
  211. $0000-$01FF : 512 bytes, used as 128 x 4-byte entries
  212. $0200-$03FF : 32 bytes, mirrored every 32 bytes (so mirrored 16 times)
  213. Reading and writing from the mirrored areas are valid.
  214. OAM access
  215. The PPU has a 10-bit address register which gives a byte offset into OAM.
  216. Writing to $2102 will load the CPU data into bits 8-1 of the address
  217. register. Writing to $2103 will load bit 0 of the CPU data into bit 9 of
  218. the address register. Writing to $2102 or $2103 will clear bit 0 of the
  219. address register so an even address is always selected. You can write to
  220. $2102 and $2103 in any order, or write to just one or the other to update
  221. part or all of the address.
  222. Each time $2138 is read, the byte at the current offset pointed to by the
  223. address register is returned to the CPU, and the address register is
  224. incremented by one.
  225. Each time $2104 is written to the address register is incremented by one.
  226. If the address register is even during a write, the CPU data is stored in
  227. a latch. If the address register is odd, the latched data becomes the LSB
  228. and the new data written becomes the MSB of a 16-bit word. This word is
  229. written to the current address, with bit 0 of the address register ignored.
  230. This only affects writing to offsets $0000-$01FF. The 32 byte table at
  231. $0200-$03FF will be updated for a write to even or odd addresses. Writes
  232. to even addresses still update the LSB latch, however.
  233. The address register will wrap from $03FF to $0000 due to reading $2138 or
  234. writing to $2104. You can mix reads and writes freely.
  235. Valid access times
  236. When the screen is forcibly blanked or in the V-Blank period, OAM can be
  237. read and written. I haven't tested access during H-Blank yet.
  238. It would seem that the address register is used for some internal operation
  239. during the active display period, which involves incrementing it. Here are
  240. my observations:
  241. - Writing to OAM during this time results in the data being written to
  242. consecutively larger addresses, starting at a random offset and with
  243. a random amount of skipped bytes between the data. The address register
  244. has no effect on where the data goes.
  245. - Reading from OAM returns data from consecutively larger addresses,
  246. starting at a random offset and with a random amount of skipped bytes
  247. between the data. The address register has no effect on where the data
  248. goes.
  249. - Setting the address register to a known value and waiting a few scanlines
  250. with the screen turned on results in data being read or written to a
  251. larger address than the one originally set.
  252. - Writing to the address register on the same scanline where a sprite is
  253. being displayed has no effect on the sprite. I would assume during the
  254. active display period, the address register can't be updated by the CPU
  255. as it is being used by the PPU exclusively.
  256. OAM access examples
  257. Here are some examples of unexpected behavior. Assume OAM contains the
  258. bytes $AA, $BB, $CC, $DD at address $0000 for each test:
  259. - Set address to $0000
  260. - Write $45
  261. OAM is not updated, and the LSB latch contains $45
  262. - Set address to $0000
  263. - Read $2138
  264. - Write #$45
  265. The bytes $CC, $45 are written to address $0000. $CC was the last value
  266. in the LSB latch, and a single byte write triggers a write to OAM as the
  267. previous read made the address register odd.
  268. - Set address to $0000
  269. - Write #$12
  270. - Write #$00 to $2103
  271. - Write #$34
  272. OAM is not updated. The second write only loads the LSB latch as the
  273. write to $2103 cleared bit 0 of the address register.
  274. ----------------------------------------------------------------------------
  275. Hardware version registers
  276. ----------------------------------------------------------------------------
  277. Here are the version register return values and chip markings for my
  278. original model NTSC SNES:
  279. Register Value Chip
  280. $4210 $01 Nintendo S-CPU 5A22-01
  281. $213E $01 Nintendo S-PPU1 5C77-01
  282. $213F $01 Nintendo S-PPU2 5C78-01
  283. ----------------------------------------------------------------------------
  284. I/O hardware
  285. ----------------------------------------------------------------------------
  286. The SNES has two 7-pin joypad ports. Here's a diagram of the faceplate of
  287. the SNES to show the pin configuration:
  288. 1P port 2P port
  289. (Power light) ( o o o | o o o o ] [ o o o o | o o o )
  290. 7 6 5 4 3 2 1 1 2 3 4 5 6 7
  291. Pin # Description S-CPU pin (1P) S-CPU pin (2P)
  292. Pin 1 +5V n/a n/a
  293. Pin 2 Output strobe 35 36
  294. Pin 3 Output 37 37 (common between both ports)
  295. Pin 4 Serial input 1 32 28
  296. Pin 5 Serial input 2 33 27
  297. Pin 6 Bidirectional 25 26
  298. Pin 7 Ground n/a n/a
  299. Each pin is accessible through the various hardware registers as follows:
  300. 1P port
  301. - Read $4016 to pulse pin 2.
  302. - Writing to bit 0 of $4016 controls pin 3.
  303. - Reading bit 0 of $4016 returns data from pin 4.
  304. - Reading bit 1 of $4016 returns data from pin 5.
  305. - Pin 6 is connected to bit 6 of $4201 (WRIO) and $4213 (RDIO).
  306. 2P port
  307. - Read $4017 to pulse pin 2.
  308. - Writing to bit 0 of $4016 controls pin 3.
  309. - Reading bit 0 of $4017 returns data from pin 4.
  310. - Reading bit 1 of $4017 returns data from pin 5.
  311. - Pin 6 is connected to bit 7 of $4201 (WRIO) and $4213 (RDIO).
  312. 2P pin 6 is also connected to S-PPU2 pin 29. This is most likely the
  313. external input signal that can be used to latch the H/V counter. A lightgun
  314. such as the Super Scope or Konami Justifier would use pulse pin 6 of the 2P
  315. port to make the PPU2 latch the H/V counter when it detects the raster beam.
  316. The second serial input from pin 5 and bidirectional pin 6 are unused by
  317. the joypad and mouse. The Hudson Super Multitap may be the only peripheral
  318. to use them, see the multitap section for more details.
  319. The standard way most peripherals work is to write 1 then 0 to bit 0 of
  320. $4016 to reset the devices in the 1P and 2P ports. You can then read bit 0
  321. of $4016 and $4017 multiple times to return data serially, starting with
  322. the MSB down to the LSB.
  323. I/O port
  324. The SNES is described as having an 8-bit bidirectional I/O port. I don't
  325. know if this physically corresponds to the expansion port on the bottom of
  326. the control deck, or if the CPU just has an I/O port built in and some or
  327. all of the port pins are used.
  328. Writing to $4201 (WRIO) sets the data to be output through the I/O port.
  329. Any bit that is also set to 1 will allow the corresponding pin to act
  330. as an input, and data from that pin can be read through $4213 (RDIO).
  331. The only uses I know of for the I/O port are as follows:
  332. - Any value written to $4201 can be read back through $4213.
  333. - As bit 7 of $4201 controls pin 6 of the 2P port, which is also shared with
  334. the external signal input of the PPU to latch the H/V counter, writing 1
  335. then 0 to bit 7 of $4201 will latch the H/V counter.
  336. While bit 7 is set to 0, the latch will always hold the same value and
  337. reading $2137 will not change the latched value. If you want to poll
  338. the H/V counter using $2137, set bit 7 back to 1 for it to work properly.
  339. - Pin 6 of the 1P or 2P port is used as an output to control the Hudson
  340. Super Multitap. See the multitap section for more details.
  341. ----------------------------------------------------------------------------
  342. Automatic reading
  343. ----------------------------------------------------------------------------
  344. The SNES has a feature to automatically read the four serial input pins
  345. and store them into a set of registers during V-Blank. This can be done
  346. without the CPU having to manually write and read $4016 / $4017, saving
  347. time for other tasks.
  348. When bit 0 of $4200 is set, at the start of V-Blank (depending on the screen
  349. height) the SNES will automatically do the following steps:
  350. - Write 1 then 0 to bit 0 of $4016.
  351. - Read $4016 and $4017 sixteen times, storing the return values from bits
  352. 0 and 1 into eight registers like so:
  353. - 16 bits from bit 0 of $4016 are stored in $4218 (LSB) and $4219 (MSB)
  354. - 16 bits from bit 1 of $4016 are stored in $421C (LSB) and $421D (MSB)
  355. - 16 bits from bit 0 of $4017 are stored in $421A (LSB) and $421B (MSB)
  356. - 16 bits from bit 1 of $4017 are stored in $421E (LSB) and $421F (MSB)
  357. This process takes three scanlines to complete. Bit 0 of $4212 shows the
  358. scanning status, where 1= the SNES is still reading data, 0= the SNES has
  359. finished or automatic scanning was not enabled.
  360. The use I've seen in games and demos is to wait for this bit to be set, and
  361. then cleared in the NMI handler.
  362. ----------------------------------------------------------------------------
  363. Hudson Super Multitap
  364. ----------------------------------------------------------------------------
  365. The multitap plugs into the 1P or 2P port. It has four connectors to plug
  366. additional joypads into, and has a switch for selecting a multiplayer or
  367. compatability mode.
  368. In compatability mode (switch = 2P) the joypad plugged in to connector #1
  369. works like a standard pad. All remaining connectors are ignored, pin 6
  370. is ignored in terms of selecting which set of joypad data to return, and
  371. no extra data is returned in the second serial input.
  372. In multiplayer mode (switch = 3P-5P) the first serial input returns data
  373. from the joypad in connector #1 or #3, and the second serial input returns
  374. data from the joypad in connector #2 or #4. Pin 6 of the 1P or 2P port
  375. is used to select connectors #1 and #3 when set to 1, or #2 and #4 when
  376. set to 0.
  377. ----------------------------------------------------------------------------
  378. SNES joypad
  379. ----------------------------------------------------------------------------
  380. The SNES joypad uses two 4021 ICs, which are 8-stage static shift registers.
  381. They are cascaded together to form a 16-bit shift register that stores the
  382. state of the directional pad and buttons, allowing the SNES to read out
  383. the state of the joypad serially.
  384. The button states will be loaded into the shift register when bit 0 of
  385. $4016 is set to 1 and then 0. This happens to both control pads as they
  386. share a common pin. Each time $4016 or $4017 is read, the shift register
  387. for the 1P or 2P pad advances by one, outputting a bit which can be read
  388. in bit 0 of $4016 or $4017 respectively.
  389. The tail end of the shift register is filled with a one on each shift. After
  390. the sixteenth time $4016 or $4017 has been read, all consecutive reads will
  391. return one due to the shift register being completely filled with ones.
  392. This will go on forever until the shift register is loaded again by writing
  393. 1 then 0 to $4016.
  394. If at any time $4016 is left at 1, reading either joypad will always return
  395. the state of the first input, which is the 'B' button. This won't stop until
  396. $4016 is set to zero again.
  397. Here is the order of button states read out through $4016 or $4017:
  398. Read 1 - Button B Read 9 - Button A
  399. Read 2 - Button Y Read 10 - Button X
  400. Read 3 - Button Select Read 11 - Button L
  401. Read 4 - Button Start Read 12 - Button R
  402. Read 5 - Up Read 13 - '0'
  403. Read 6 - Down Read 14 - '0'
  404. Read 7 - Left Read 15 - '0'
  405. Read 8 - Right Read 16 - '0'
  406. All reads after read 16 will return 1.
  407. All buttons are 1= pressed, 0= released.
  408. If no joypad is plugged in, then zero is always read from $4016 or $4017.
  409. A game can check if a joypad is connected by seeing if any reads beyond
  410. the 16th one return '1', otherwise there is no joypad.
  411. As far as I can tell, the joypad does not return any data through pin 5
  412. (which always returns zero) and any setting of pin 6 will not affect the
  413. joypad operation.
  414. ----------------------------------------------------------------------------
  415. SNES mouse
  416. ----------------------------------------------------------------------------
  417. The SNES mouse works in a similar fashion to the joypad. It has a custom
  418. 18-pin chip called the "SFM1" which returns data about the mouse status
  419. serially to the SNES.
  420. Writing 1, then 0 to bit 0 of $4016 will reset the SFM1 and subsequent reads
  421. from $4016 or $4017 (depending on which port the mouse is plugged into) will
  422. return the mouse state data. Leaving bit 0 of $4016 set to 1 will result
  423. in zero always being read back.
  424. The mouse data is as follows:
  425. Read 1 - '0' Read 17 - Y sign
  426. Read 2 - '0' Read 18 - Y movement bit 6 (?)
  427. Read 3 - '0' Read 19 - Y movement bit 5
  428. Read 4 - '0' Read 20 - Y movement bit 4
  429. Read 5 - '0' Read 21 - Y movement bit 3
  430. Read 6 - '0' Read 22 - Y movement bit 2
  431. Read 7 - '0' Read 23 - Y movement bit 1
  432. Read 8 - '0' Read 24 - Y movement bit 0
  433. Read 9 - Right button Read 25 - X sign
  434. Read 10 - Left button Read 26 - X movement bit 6 (?)
  435. Read 11 - '0' Read 27 - X movement bit 5
  436. Read 12 - '0' Read 28 - X movement bit 4
  437. Read 13 - '0' Read 29 - X movement bit 3
  438. Read 14 - '0' Read 30 - X movement bit 2
  439. Read 15 - '0' Read 31 - X movement bit 1
  440. Read 16 - '1' Read 32 - X movement bit 0
  441. All reads after read 32 will return 1.
  442. The left/right buttons are 1= pressed, 0= released.
  443. The Y and X sign are 1= up/left movement, 0= down/right movement. The sign
  444. bits do not change until the mouse is moved in a opposite direction. So
  445. moving the mouse up, and leaving it stationary would keep the Y sign bit
  446. set to 1.
  447. The Y and X movement fields indicate how rapidly the mouse was moved in a
  448. particular direction. This is usually $00-$1F, but extremely rapid movements
  449. can yield higher values. I haven't been able to get values large enough
  450. to indicate there is a seventh movement bit, but there may likely be one.
  451. Both fields are zero when there is no movement.
  452. As far as I can tell, the mouse does not return any data through pin 5
  453. (which always returns zero) and any setting of pin 6 will not affect the
  454. mouse operation.
  455. ----------------------------------------------------------------------------
  456. Register reference
  457. ----------------------------------------------------------------------------
  458. $2180 - WRAM data port
  459. $2181 - WRAM offset (bits 7-0 are offset bits 7-0)
  460. $2182 - WRAM offset (bits 7-0 are bits 15-8)
  461. $2183 - WRAM offset (bit 0 is offset bit 16, bits 7-1 are unused)
  462. Registers $2181-$2183 define a 17-bit offset in WRAM. Reading or writing
  463. $2180 will return a byte from or write a byte to WRAM, and automatically
  464. increment the WRAM offset by one. The offset wraps from $01FFFF to $000000.
  465. Reading $2180, $2181, or $2183 returns the last value on the data bus,
  466. which is usually the last byte of the opcode fetched. For example, this
  467. value would be $21 for 'lda $2181', or $00 for 'lda [$00]' when the pointer
  468. at $00 is $2181.
  469. ----------------------------------------------------------------------------
  470. Cartridge information
  471. ----------------------------------------------------------------------------
  472. Cartridge pinout
  473. Solder side Component side
  474. MCK - 01 32 - /RAMSEL
  475. EXPAND - 02 33 - REFRESH
  476. PA6 - 03 34 - PA7
  477. /PARD - 04 35 - /PAWR
  478. <key>
  479. GND - 05 36 - GND
  480. A11 - 06 37 - A12
  481. A10 - 07 38 - A13
  482. A9 - 08 39 - A14
  483. A8 - 09 40 - A15
  484. A7 - 10 41 - A16
  485. A6 - 11 42 - A17
  486. A5 - 12 43 - A18
  487. A4 - 13 44 - A19
  488. A3 - 14 45 - A20
  489. A2 - 15 46 - A21
  490. A1 - 16 47 - A22
  491. A0 - 17 48 - A23
  492. /IRQ - 18 49 - /ROMSEL
  493. D0 - 19 50 - D4
  494. D1 - 20 51 - D5
  495. D2 - 21 52 - D6
  496. D3 - 22 53 - D7
  497. /RD - 23 54 - /WR
  498. CIC0 - 24 55 - CIC1
  499. CIC2 - 25 56 - CIC3
  500. /RESET - 26 57 - SYSCK
  501. +5V - 27 58 - +5V
  502. <key>
  503. PA0 - 28 59 - PA1
  504. PA2 - 29 60 - PA3
  505. PA4 - 30 61 - PA5
  506. SOUND-L - 31 62 - SOUND-R
  507. Pin assignments
  508. A23-0 - CPU address bus
  509. D7-0 - CPU data bus
  510. /WR - CPU write strobe
  511. /RD - CPU read strobe
  512. /IRQ - CPU IRQ input. Allows on-cart hardware to interrupt the CPU.
  513. /RESET - When the system is reset (power-up or hard reset) this goes low.
  514. Could be used to reset additional on-cart hardware.
  515. /RAMSEL - Goes low on accesses to WRAM at the following addresses:
  516. 00-3F:0000-1FFF
  517. 80-BF:0000-1FFF
  518. 7E-7F:0000-FFFF
  519. /ROMSEL - Goes low on access to cartridge ROM at the following addresses:
  520. 00-3F:8000-FFFF
  521. 40-7D:0000-FFFF
  522. 80-BF:8000-FFFF
  523. C0-FF:0000-FFFF
  524. PA7-0 - Address bus for $2100-$21FF range in banks $00-$3F/$80-$BF (B-Bus)
  525. /PAWR - Write strobe for B-Bus
  526. /PARD - Read strobe for B-Bus
  527. MCK - 21.47727 MHz master clock
  528. SYSCK - Unknown, is an output from the CPU.
  529. SOUND-L - Audio input to be mixed with left channel output
  530. SOUND-R - Audio input to be mixed with right channel output
  531. THROUGH - Connected to pin 24 of the expansion port.
  532. REFRESH - Unknown, is an output from the CPU also connected to WRAM.
  533. This is most likely to manage DRAM refresh.
  534. CIC3-0 - To CIC chip on cartridge
  535. Details
  536. For more information about the CIC chip, please see the following:
  537. - U.S. Patent no. 4,799,635 (NES specific)
  538. - http://home.freeuk.com/markk/Consoles/SNES_Lockout.txt
  539. The only hardware I know of which uses the two sound input pins is the
  540. Super Gameboy and Super Gameboy 2.
  541. The SNES has two address busses, the A-Bus which is used by the CPU, ROM,
  542. WRAM, etc. and the B-Bus which is used by the PPU1, PPU2, APU I/O ports,
  543. and WRAM. When the SNES does DMA, it can transfer data from the A-Bus to
  544. the B-Bus or vice-versa, but not to the same bus. This holds true even
  545. for WRAM, which is connected to both the A-Bus and B-Bus.
  546. I would guess the B-Bus signals are brought out to the cartridge connector
  547. so any on-cart hardware could map it's own registers within that region,
  548. allowing for DMA from the A-Bus to it. Exactly what range of B-Bus addresses
  549. are open for expansion purposes is unknown.
  550. Cartridge information
  551. Here's some information about several cartridges I've examined:
  552. Name: Lagoon
  553. Board: SHVC-1A3B-12
  554. Type: LoROM / 16 megabits / 8K SRAM
  555. This cartridge has a 74LS139 for address decoding and a 8K SRAM chip.
  556. 00-1F:8000-FFFF : Program ROM
  557. 20-3F:8000-FFFF : Unmapped
  558. 40-6F:0000-FFFF : Unmapped
  559. 70-7D:0000-FFFF : SRAM
  560. 7E-7F:0000-FFFF : Work RAM
  561. 80-9F:8000-FFFF : Program ROM
  562. A0-BF:8000-FFFF : Unmapped
  563. C0-EF:0000-FFFF : Unmapped
  564. F0-FF:0000-FFFF : SRAM
  565. - A23 and A15 are ignored, so banks $80-FF are a mirror of $00-7F.
  566. - SRAM is mirrored repeatedly in the areas it's assigned to.
  567. - When accessing an unmapped region, neither the ROM or SRAM are enabled.
  568. Name: Pilotwings
  569. Board: SHVC-1BON-02
  570. Type: LoROM / 8 megabits / DSP-1
  571. This cartridge has a 74LS139 for address decoding and a NEC uPD77C25 DSP
  572. which Nintendo labels as the "DSP-1" custom chip. It also has a oscillator
  573. and 74HCU04 to provide a clock signal, but I don't know what speed the DSP
  574. actually runs at.
  575. 00-1F:8000-FFFF : Program ROM
  576. 20-2F:8000-FFFF : Unmapped
  577. 30-3F:8000-BFFF : DSP data register (r/w)
  578. 30-3F:C000-FFFF : DSP status register (r/o)
  579. 40-7D:0000-FFFF : Unmapped
  580. 7E-7F:0000-FFFF : Work RAM
  581. 80-9F:8000-FFFF : Program ROM
  582. A0-AF:8000-FFFF : Unmapped
  583. 80-BF:8000-BFFF : DSP data register (r/w)
  584. 80-BF:C000-FFFF : DSP status register (r/o)
  585. C0-FF:0000-FFFF : Unmapped
  586. - A23 and A15 are ignored, so banks $80-FF are a mirror of $00-7F.
  587. - DSP pins INT, SCK, /SIEN, /SOEN are all tied to +5V and are unused.
  588. - When accessing an unmapped region, neither the ROM or DSP are enabled.
  589. Name: Killer Instinct
  590. Board: SHVC-1JON-20
  591. Type: HiROM / 32 megabits
  592. The mask ROM socket on the PCB has the following pin assignments:
  593. +---\/---+
  594. A20 -|01 36|- +5V
  595. A21 -|02 35|- A23
  596. A17 -|03 34|- +5V
  597. A18 -|04 33|- /ROMSEL (ROM /CS)
  598. A15 -|05 32|- A19
  599. A12 -|06 31|- A14
  600. A7 -|07 30|- A13
  601. A6 -|08 29|- A8
  602. A5 -|09 28|- A9
  603. A4 -|10 27|- A11
  604. A3 -|11 26|- A16
  605. A2 -|12 25|- A10
  606. A1 -|13 24|- /RD (ROM /OE)
  607. A0 -|14 23|- D7
  608. D0 -|15 22|- D6
  609. D1 -|16 21|- D5
  610. D2 -|17 20|- D4
  611. GND -|18 19|- D3
  612. +--------+
  613. - A22 is unconnected.
  614. - This game uses a MX23C3201 4096Kx8 mask ROM. I can't find a datasheet for
  615. this chip, so I'm not sure what pin 35 (A23) is used for. It could be
  616. an inverted chip select so the ROM is only mapped to banks $40-$7E and
  617. $C0-$FF, but that's just a guess.
  618. ----------------------------------------------------------------------------
  619. Assistance needed
  620. ----------------------------------------------------------------------------
  621. If any games have a legitimate use of writing to OAM or reading OAM or CGRAM
  622. during the active display period, I'd like to hear about the details of how
  623. the data is used. So far it's been confirmed that Uniracers writes to OAM
  624. this way, maybe there are others.
  625. ----------------------------------------------------------------------------
  626. Credits and acknowlegements
  627. ----------------------------------------------------------------------------
  628. - ToToTek Multimedia for the Game Doctor SF7. (www.tototek.com)
  629. - neviksti for the SNES starter kit. (available at nesdev.parodius.com)
  630. - John Weidman, CaitSith2, neviksti, for the SNES schematic scans.
  631. - Gilligan for the SNES documentation.
  632. - Qwertie for the SNES documentation.
  633. - anomie for the post about SNES peripherals at the SNES9X development forum,
  634. pointing out errors, and suggesting tests.
  635. - Overload for clarifying some details about the mouse.
  636. - Chris MacDonald for testing and support.
  637. ----------------------------------------------------------------------------
  638. Disclaimer
  639. ----------------------------------------------------------------------------
  640. If you use any information from this document, please credit me
  641. (Charles MacDonald) and optionally provide a link to my webpage
  642. (http://cgfm2.emuviews.com/) so interested parties can access it.
  643. The credit text should be present in the accompanying documentation of
  644. whatever project which used the information, or even in the program
  645. itself (e.g. an about box).
  646. Regarding distribution, you cannot put this document on another
  647. website, nor link directly to it.