A question about CPU address exposed to the cartridge

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems. See the NESdev wiki for more information.

Moderator: Moderators

Optimizer61
Posts: 3
Joined: Thu Apr 22, 2021 1:10 am

A question about CPU address exposed to the cartridge

Post by Optimizer61 »

Hello there. I'm a newbie and this could be an idiotic/basic question. My apologies in that case.

I see that we are exposed to CPU address pins A0 to A15 on the NES Cartridge connector. My question is, can we use that to write the NES registers (Like PPU, APU)? Or is there something preventing us from doing so?

Thank you!
User avatar
Quietust
Posts: 1918
Joined: Sun Sep 19, 2004 10:59 pm
Contact:

Re: A question about CPU address exposed to the cartridge

Post by Quietust »

Optimizer61 wrote: Thu Apr 22, 2021 8:10 am Hello there. I'm a newbie and this could be an idiotic/basic question. My apologies in that case.

I see that we are exposed to CPU address pins A0 to A15 on the NES Cartridge connector. My question is, can we use that to write the NES registers (Like PPU, APU)? Or is there something preventing us from doing so?
No, you cannot - the NES CPU is always in control of the address bus and the control signals (M2 and R/W), so if a cartridge tried to output its own signals it would cause a bus conflict. Even if you were somehow able to "pause" the CPU (which you can't do because the 6502's "RDY" signal isn't exposed anywhere), you wouldn't be able to access any of the APU registers because those are located inside the RP2A03/RP2A07 chip, and the address pins are not bidirectional.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
Optimizer61
Posts: 3
Joined: Thu Apr 22, 2021 1:10 am

Re: A question about CPU address exposed to the cartridge

Post by Optimizer61 »

Thanks for the reply. There is something not clear to me in your answer.
you wouldn't be able to access any of the APU registers because those are located inside the RP2A03/RP2A07 chip, and the address pins are not bidirectional
Registers could be inside the chip (almost always are right?), but there must be a way to access those through the pins exposed. The way CPU writes to them for example. Why would I need address pins to be bidirectional? All I need to do is to write to them. Even if the data pins were unidirectional that's fine too correct? Again all I would need is writing.
User avatar
Dwedit
Posts: 4921
Joined: Fri Nov 19, 2004 7:35 pm
Contact:

Re: A question about CPU address exposed to the cartridge

Post by Dwedit »

Quietust is saying that the APU (thus all registers in the $4000-401F memory range) is physically inside of the CPU, and can't directly be influenced by outside access on the address pins.

If you _really really_ need to cause an outside force to write to the APU, that's what interrupts are for. Trigger an interrupt, then have the handler code write to the APU.
Here come the fortune cookies! Here come the fortune cookies! They're wearing paper hats!
User avatar
Quietust
Posts: 1918
Joined: Sun Sep 19, 2004 10:59 pm
Contact:

Re: A question about CPU address exposed to the cartridge

Post by Quietust »

Optimizer61 wrote: Thu Apr 22, 2021 8:33 am Registers could be inside the chip (almost always are right?), but there must be a way to access those through the pins exposed. The way CPU writes to them for example. Why would I need address pins to be bidirectional? All I need to do is to write to them. Even if the data pins were unidirectional that's fine too correct? Again all I would need is writing.
When things like microprocessors are designed and manufactured, you (almost?) never connect the internal signals directly to the chip's external pins because they wouldn't be able to handle enough current - instead, they'll be connected to special "I/O driver" circuits along the edge of the die, and those circuits can either connect the internal signals to arrays of large transistors to drive the external pins (high or low) or they can read the signal coming from the external pin and translate it into a logic level suitable for use inside the chip. Some pins will have output-only drivers (e.g. address pins), some will be input-only (e.g. interrupt signals), and some will be bidirectional (e.g. data pins).

Looking at the Visual 2A03, all of the Address pins have output-only drivers, which means there is physically no way for a signal coming from outside the chip to make its way inside. By comparison, the Data pins have bidirectional drivers, as do nearly all of the other pins (though most of them are simply hardwired to be input-only or output-only).

As it turns out, the RP2A03G does have a state in which the address lines will not output a specific value (during which you could potentially output your own address) and that is when the chip is being held in RESET. Unfortunately, there's no practical way of using that, because the only thing that's going to reset the CPU is the lockout chip (which doesn't exist in toploaders or in the Famicom) and the only chip you would be able to talk to (the PPU) will also be being held in RESET (which will prevent it from acting upon those signals).
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: A question about CPU address exposed to the cartridge

Post by lidnariq »

Optimizer61 wrote: Thu Apr 22, 2021 8:33 am All I need to do is to write to them.
What exactly do you think it means to "write" to them?
Optimizer61
Posts: 3
Joined: Thu Apr 22, 2021 1:10 am

Re: A question about CPU address exposed to the cartridge

Post by Optimizer61 »

Dwedit wrote: Thu Apr 22, 2021 9:01 am Quietust is saying that the APU (thus all registers in the $4000-401F memory range) is physically inside of the CPU, and can't directly be influenced by outside access on the address pins.

If you _really really_ need to cause an outside force to write to the APU, that's what interrupts are for. Trigger an interrupt, then have the handler code write to the APU.
Quietust wrote: Thu Apr 22, 2021 10:07 am
Optimizer61 wrote: Thu Apr 22, 2021 8:33 am Registers could be inside the chip (almost always are right?), but there must be a way to access those through the pins exposed. The way CPU writes to them for example. Why would I need address pins to be bidirectional? All I need to do is to write to them. Even if the data pins were unidirectional that's fine too correct? Again all I would need is writing.
When things like microprocessors are designed and manufactured, you (almost?) never connect the internal signals directly to the chip's external pins because they wouldn't be able to handle enough current - instead, they'll be connected to special "I/O driver" circuits along the edge of the die, and those circuits can either connect the internal signals to arrays of large transistors to drive the external pins (high or low) or they can read the signal coming from the external pin and translate it into a logic level suitable for use inside the chip. Some pins will have output-only drivers (e.g. address pins), some will be input-only (e.g. interrupt signals), and some will be bidirectional (e.g. data pins).

Looking at the Visual 2A03, all of the Address pins have output-only drivers, which means there is physically no way for a signal coming from outside the chip to make its way inside. By comparison, the Data pins have bidirectional drivers, as do nearly all of the other pins (though most of them are simply hardwired to be input-only or output-only).

As it turns out, the RP2A03G does have a state in which the address lines will not output a specific value (during which you could potentially output your own address) and that is when the chip is being held in RESET. Unfortunately, there's no practical way of using that, because the only thing that's going to reset the CPU is the lockout chip (which doesn't exist in toploaders or in the Famicom) and the only chip you would be able to talk to (the PPU) will also be being held in RESET (which will prevent it from acting upon those signals).

Guys my bad. I thought NES CPU is a pure 6502 chip and APU and PPU were two external chips. I just realized the NES CPU is actually 2A03/07 which has a 6502 core and has APU builtin. Everything you guys were saying makes so much sense now.
puppydrum64
Posts: 160
Joined: Sat Apr 24, 2021 7:25 am

Re: A question about CPU address exposed to the cartridge

Post by puppydrum64 »

It's a very easy mistake to make since the 2A03 is programmed the same way as the 6502. It's kind of like how the Game Boy uses a similar chip to the Z80 but has fewer registers.
tepples
Posts: 22705
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Re: A question about CPU address exposed to the cartridge

Post by tepples »

The difference between a 2A03's CPU core and an authentic 6502 is a lot less than the difference between the Game Boy's CPU core and a Zilog Z80. It's as if only the daa instruction were missing, not the entire DD (IX), ED, and FD (IY) prefixes.

Apart from the lack of decimal mode, the 2A03 behaves the same as if it had a 6502 and a discrete APU and DMA unit. It's not too different from other systems with a 6502 CPU that completely decode their memory-mapped I/O addresses, such as the Apple II's I/O area at $C000-$C03F. It's just cheaper to completely decode things when there isn't a printed circuit board between the CPU core and the peripheral, as you don't have to route a bunch of signals into an IC package.
Pokun
Posts: 2675
Joined: Tue May 28, 2013 5:49 am
Location: Hokkaido, Japan

Re: A question about CPU address exposed to the cartridge

Post by Pokun »

Yeah I think it was confirmed from decap images that the 6502 core inside the 2A03 is identical to a stock 6502 chip with the sole difference that a single connection is cut off. Even the decimal mode circuitry is present but is rendered useless because of that missing connection. Ricoh deliberately made the decimal mode useless for whatever legal reason.
puppydrum64
Posts: 160
Joined: Sat Apr 24, 2021 7:25 am

Re: A question about CPU address exposed to the cartridge

Post by puppydrum64 »

I think they would have had to pay royalties to Commodore had they left it in. That's what I heard
Pokun
Posts: 2675
Joined: Tue May 28, 2013 5:49 am
Location: Hokkaido, Japan

Re: A question about CPU address exposed to the cartridge

Post by Pokun »

Yeah that's what people think. In interviews Nintendo claims that Ricoh did have the license to use the 6502, so if that is true the modification might have been done to avoid having to pay the full fee to Commodore/MOS. I think it's just theories though, I haven't seen an official statement on this.


There are other smaller differences from using a stock 6502 chip, like the /SO pin, which is missing on the 2A03 (the connection should still be present inside the 2A03 chip but probably left floating). It would be a waste to give it its own pin since it isn't used in the Famicom/NES design.
It's supposedly very seldom used in any design that uses the 6502.
User avatar
Dwedit
Posts: 4921
Joined: Fri Nov 19, 2004 7:35 pm
Contact:

Re: A question about CPU address exposed to the cartridge

Post by Dwedit »

Pokun wrote: Wed May 26, 2021 3:55 pmThere are other smaller differences from using a stock 6502 chip, like the /SO pin, which is missing on the 2A03 (the connection should still be present inside the 2A03 chip but probably left floating). It would be a waste to give it its own pin since it isn't used in the Famicom/NES design.
It's supposedly very seldom used in any design that uses the 6502.
Not only seldom used, outright removed from the 65C02.
Here come the fortune cookies! Here come the fortune cookies! They're wearing paper hats!
Oziphantom
Posts: 1565
Joined: Tue Feb 07, 2017 2:03 am

Re: A question about CPU address exposed to the cartridge

Post by Oziphantom »

It's odd they removed it, it not really that usable in a Computer context, but embedded cases it has it uses.
Pokun
Posts: 2675
Joined: Tue May 28, 2013 5:49 am
Location: Hokkaido, Japan

Re: A question about CPU address exposed to the cartridge

Post by Pokun »

They did? It's back in the modern static WDC version still produced today (W65C02S-14), now called the "SOB" pin as they added a "B" to many of the signals for some reason.
Edit: I now know that the "B" stands for "bar" and is just a way to represent the overline over "SO" to indicate that it is an active low signal.

The 65816 is missing it even in the modern WDC version though.
Last edited by Pokun on Sat May 27, 2023 3:34 pm, edited 1 time in total.
Post Reply