snes cart hacking: replacing mask ROMs

snes cart hacking: replacing mask ROMs
by dext3r on 2011-05-12 (#78064)

hello all,

I need some help/explanation of how the NBA JAM TE cart is designed.

It's a 24 Mbit LoROM cart with 2 ROMs, SaveRAM and MAD-1 decoder.
http://www.snescentral.com/pcb.php?id=0 ... side=front

Here's where I'm getting confused: 36-pin ROM has 23 Address lines...(A0-A22) which gives max memory of 64 Mbit? Why even use 2 ROMs if you could stuff the whole game and then some in a single ROM? (Or is my calculation off? 2^23 = 8,388,608 bytes = 8 Megabyte or 64 Megabit??)
To get to all A22 though, you need to put 7F:FFFF on the address bus -- not a valid ROM address -- which is where the MAD-1 comes in, to decode that shit to a valid address.

The SNES memory map docs show:
Banks 00-3F give you 64 * 32kbit = 2 Mbit of memory there.
Banks 40-7D give you 62 * 64kbit = a little under 4 Mbit

So a total of a little under 6 Mbit without decoding? Ugh so confused...throw in the LoROM = A15 ignored thing and I'm toast...Ignoring A15 means you will get repeated data on the ROM, right?

What is the maximum addressable memory when using the MAD-1?

My goal is to replace the 2 ROMs with a single FLASH chip, as large as possible. (Or multiple chips if necessary)
Hoping somebody can help me out, I've read through all the docs and snippets I could find but something just isn't sticking in my brain. Or I am extremely stupid. lol, it's one or the other. much thanks for any help.

by tepples on 2011-05-12 (#78067)

LoROM means A15 is ignored, and now you're down to 32 Mbit of address space (without doing a Lo-Hi combo like Tales of Phantasia). Perhaps during the Super NES's commercial era, a 16 Mbit mask ROM and a 4 Mbit or 8 Mbit mask ROM combined were cheaper than a 32 Mbit mask ROM.

Quote:
Banks 00-3F give you 64 * 32kbit

64 * 32 kilobytes, not kilobits.

Google snes mad-1 gives this document and this document about the MAD-1 mapper. BA0 through BA7 appear to mean "bank address" (that is, A16-A23), so BA4 and BA5 mean A20 and A21.

by dext3r on 2011-05-12 (#78076)

tepples wrote:
LoROM means A15 is ignored, and now you're down to 32 Mbit of address space (without doing a Lo-Hi combo like Tales of Phantasia). Perhaps during the Super NES's commercial era, a 16 Mbit mask ROM and a 4 Mbit or 8 Mbit mask ROM combined were cheaper than a 32 Mbit mask ROM.

Quote:
Banks 00-3F give you 64 * 32kbit

64 * 32 kilobytes, not kilobits.

Google snes mad-1 gives this document and this document about the MAD-1 mapper. BA0 through BA7 appear to mean "bank address" (that is, A16-A23), so BA4 and BA5 mean A20 and A21.

thanks for the correction.

i've read those docs -- and actually found a simplified logic output for the MAD-1 here:
Code:
/HI 01 16 /LOW
SRAM /CS 02 15 A15 (LoROM), A13 (HiROM)
NC 03 14 BA4 (LoROM), A14 (HiROM)
ROM /OE 04 13 BA5
SRAM Vcc 05 12 Vcc or BA6 (LoROM), A15 or BA6(HiROM)...
Vcc 06 11 /CART (pad 49 on cartridge edge)
resistor to +3V of battery 07 10 GND=LoRom, Vcc=HiROM
GND 08 09 /RESET (pad 26 on cartridge edge)

/HI <--- if two ROM chips, this selects the upper one
/LOW <--- if two ROM chips, this selects the lower one

Verified & Simplified by kyuusaku
Pin 9 is A
Pin 10 is B
Pin 11 is C
Pin 12 is D
Pin 13 is E
Pin 14 is F
Pin 15 is G

The Logic (Invert Outputs)
==========================
Pin 1 is G E C' A + E C' B A
Pin 2 is G F E D' C B A + G' F E D C' B' A + SRAMVCC'
Pin 3 is G F E' D' C B A + G' F' E D C' B' A
Pin 4 is G C' A + C' B A
Pin 16 is G E' C' A + E' C' B A

kinda just 'posting out-loud' for the rest of my post here:

And then I could further simplify this because Pin 10 (B) is always grounded in LoROM and C' and A are going to be valid if the SNES is reading the cart im assuming:
Code:
Pin 1 (/HI) is G E (A15=1, A21=0)
Pin 2 (SaveRAM /CS) is G' F E D B' + SRAMVCC' (Wait, so select SaveRAM if the SRAMVCC is low? Huh?)
Pin 3 (Do I care? not sure yet, maybe use this for additional chip select?)
Pin 4 (ROM /OE) is G (A15 =1)
Pin 16 (/LOW) is G E' (A15=1, A21=0)

I'm assuming the 36-pin ROM doesn't actually have all 23 address lines connected inside the chip. If its a 16Mbit chip, 2MB, 21 lines, A0-A20...

i need to go thru the logic step by step to verify stuff for myself. thanks

by dext3r on 2011-05-13 (#78114)

so im looking at this...

what happens when A15 is low? which ROM is selected?

by kyuusaku on 2011-05-13 (#78120)

The reason for multiple ROMs is cost/availability and in this case w/ a 24M game, memory grid design constraints.

LoROM ignores A15, but still the mask ROMs can support up to 64M. A22 and A21 pins are just NC here on a 16M ROM.

LoROM supports up to 64M of ROM. HiROM supports up to 95M or whatever the space /ROMSEL is asserted.

Ignoring A15 has the effect of repeating 32k blocks so the ROM is decoded linearly in $8000-FFFF. On the banks where /ROMSEL is asserted during $0000-7FFF, the memory is mirrored from $8000-FFFF. On the banks they aren't, WRAM and registers are.

The MAD-1 can be used as a generic decoder for whatever. It ignores A15 as well unless you choose to decode using it (such as for SRAM).

Regarding SRAMVCC, the logic isn't right (I tacked on the SRAMVCC logic manually, forgetting that the outputs were inverted and later removed the post here that was taken from when I realized). It should be:
(G F E D' C B A SRAMVCC + G' F E D C' B' A SRAMVCC)'

by dext3r on 2011-05-13 (#78126)

much thanks for the replies guys

sorry if this stuff has been gone over a thousand times -- its probably really extremely trite stuff to vets like you and tepples

i think i am closer to getting it -- i need to hit up the cart with my multimeter

by dext3r on 2011-05-24 (#78651)

just of interesting note, i obtained an older revision of the cart PCB and it, in fact, has 1 mask ROM. (+ MAD-1 and SRAM)

so it does look like at some point down the road it was cheaper to do the 8/16mbit combo and just decode it differently.

now i have another board to hit up with the multimeter