Cartridge Address Space

This is an archive of a topic from NESdev BBS, taken in mid-October 2019 before a server upgrade.
View original topic
Cartridge Address Space
by on (#103392)
Hi,

Long time reader of these forums, finally found a question google doesn't give me an answer for so I've signed up to ask it.

I've been thinking about doing a hardware project on the NES and I've started to look into how the cart connects to the system. It's a lot different to what I expected.

I was thinking it would be something like the C64 where the ROM connects to some circuitry in the system which maps the addresses correctly, but all but one of the CPU address lines seem to be present. That suggests to me that a cart is hardwired to appear in the upper half of the address space.

How is it that SRAM appears below $8000 then? I notice PRG /CE seems to be derived from A15 somehow. Is ((!PRG /CE) & A13 & A12) used as SRAM enable then? That would make RPG-ROM enable (the obvious) PRG /CE?

Is there any circuitry in the NES/FC which prevents the cart from meddling with addresses beneath $4020? I can see it might be potentially useful for a mapper to be able to spy on bus writes (particularly to I/O writes), but what's the first address you can back with your own chips?

Basically what addresses does the cart "see" and which ones (ignoring nintendo's guidelines to stay above $8000) can it respond to "safely"?

Sorry for the long post, but I'm a total newb to hardware dev.
Thanks for any insight you can impart to this newb. :)
Re: Cartridge Address Space
by on (#103395)
Quote:
How is it that SRAM appears below $8000 then? I notice PRG /CE seems to be derived from A15 somehow. Is ((!PRG /CE) & A13 & A12) used as SRAM enable then?

The canonical enable function for PRG RAM at $6000-$7FFF is !(PRG /CE & M2 & A14 & A13), which is implemented in the Family BASIC PCB by a circuit using a 74LS20. But watch out for glitches if your mapper has I/O ports at $E000-$FFFF, as I'm told PRG /CE changes about 33 ns later than M2.

Quote:
Is there any circuitry in the NES/FC which prevents the cart from meddling with addresses beneath $4020? I can see it might be potentially useful for a mapper to be able to spy on bus writes (particularly to I/O writes)

There is no such circuitry. MMC5 is believed to spy on writes to the PPU. It's also possible to put a readable register behind any write-only register, and some people have suggested (ab)using this for mapper audio that operates using dec $4011 to read a value from the mapper and write it back to the APU.

Quote:
but what's the first address you can back with your own chips?

$4020 appears to be the official start of cart space, and FDS registers go that low.
Re: Cartridge Address Space
by on (#103398)
Thanks. :D
That answers all my questions and then some. :)