CNROM: Difference between revisions

From NESdev Wiki
Jump to navigationJump to search
No edit summary
(→‎Notes: Deleting section about $2007 to rewrite in Tricky-to-emulate games, where it'd make more sense)
 
(13 intermediate revisions by 7 users not shown)
Line 1: Line 1:
{{User:Tepples/Infobox_iNES_mapper
[[Category:CNROM-like mappers]][[Category:Nintendo licensed mappers]][[Category:Expansion audio]]
{{Infobox iNES mapper
|name=CNROM
|name=CNROM
|company=Nintendo
|company=Nintendo, others
|mapper=3
|mapper=3
|othermappers=[[iNES Mapper 185|185]]
|othermappers=[[iNES Mapper 185|185]]
Line 9: Line 10:
|chrmax=32K
|chrmax=32K
|chrpage=8K
|chrpage=8K
|mirroring=Fixed H or V (solder pads)
|busconflicts=Yes
|busconflicts=Yes
|audio=No
}}
}}
[[Category:CNROM-like mappers]][[Category:Nintendo licensed mappers]]
{{nesdbbox
NES-[[CNROM]] (and its [[Famicom|HVC]] counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM.  The most common usage of this board, as well as other third-party compatible boards, is assigned to [[iNES Mapper 003|iNES mapper 3]]. (See [[iNES Mapper 003]] for the suggested emulator implementation.)  A small collection of non-bankswitching CNROM boards that have an incompatible copy-protection issue are assigned to [[iNES Mapper 185]].
|ines|3|iNES 003
|ines|185|iNES 185
|unif_wild|CNROM|CNROM
}}
'''NES-[[CNROM]]''' (and its [[Famicom|HVC]] counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM.  The most common usage of this board, as well as other third-party compatible boards, is assigned to [[iNES Mapper 003|iNES mapper 3]]. (See [[iNES Mapper 003]] for the suggested emulator implementation.)  If the CNROM board mounts only 8 KiB of CHR-ROM, the 8 KiB CHR bank number becomes a Chip Select number for copy-protection purposes, described by [[iNES Mapper 185]].  


== Banks ==
== Banks ==
Line 20: Line 25:
* PPU $0000-$1FFF: 8 KB switchable CHR ROM bank
* PPU $0000-$1FFF: 8 KB switchable CHR ROM bank


For 16 KB PRG ROM testing, [http://bootgod.dyndns.org:7777/profile.php?id=423 Joust (NES)] makes a worthwhile test subject.
For 16 KB PRG ROM testing, [https://nescartdb.com/profile/view/423/joust Joust (NES)] makes a worthwhile test subject.


== Registers ==
== Registers ==
Line 26: Line 31:
  7  bit  0
  7  bit  0
  ---- ----
  ---- ----
  xxDD xxCC
  ..DC ..BA
   ||  ||
   ||  ||
   ||  ++- Select 8 KB CHR ROM bank for PPU $0000-$1FFF
   ||  ++- CHR A14..A13 (8 KiB bank)
   ++------ Security diodes config
  |+------ Output to Diode 2 (D2)
   +------- Output to Diode 1 (D1)


== Hardware ==
The CNROM board contains a [[74161|74HC161]] binary counter used as a quad D latch (4-bit register) to select the current CHR bank.
The CNROM board contains a [[74161|74HC161]] binary counter used as a quad D latch (4-bit register) to select the current CHR bank.


Early CNROM boards allow security diodes to be placed. If the latched bits 4 and 5 do not correspond to the configuration of the 2 diodes placed on the board while the PPU is rendering, the latched signal will conflict with some of the PPU's addresses bus and create bus conflicts. This system was probably created to make dumping cartridges harder, because the dumping device would have to write the correct value into the 74HC161 latch to dump the CHR ROM properly, or else bus conflicts will appear and possibly damage the dumping device.
== Security diodes ==
This anti-dump precaution wasn't very effective, and Nintendo quickly gave up on this. Only Japanese games released in 1986 are known to have these diodes present.
As a (weak) copy protection mechanism, the CNROM circuit board has a spot for two diodes that produce additional bus conflicts to hinder cartridge dumping attempts. Diode 1 connects latch bit 'D' to CHR-ROM A10; Diode 2 connects latch bit 'C' to CHR-ROM A12. Each latch bit must be set such that the diode does ''not'' allow current to flow, because if it does, AND-type bus conflicts occur that may cause the wrong CHR-ROM A10 and A12 signals to be applied, depending on the relative output resistances of latch chip and console or dumping device. Both the NES PPU and modern Kazzo-like dumping devices have strong enough output drivers to always win these bus conflicts, but 1980s' dumping equipment will lose these bus conflicts and produce an unusable readout. Each diode can be mounted either with the anode or the cathode facing the latch output. As a diode will allow current to flow if the anode-side voltage is significantly higher than the cathode-side voltage, the latch bit must be 0 if it faces the anode, and 1 if it faces the cathode.


Some Japanese CNROM games combine the diode security with special CHR ROM where higher addresses are actually additional chip enable signals. This will cause the game's CHR ROM to be disabled at all if the wrong CHR bank is selected, making only one actual 8K CHR bank available (the games could in theory run in a [[NROM]] board without being affected).
The security diodes were mounted by most Nintendo-manufactured Japanese CNROM games manufactured in 1986 as well as Bandai-manufactured CNROM games from 1986 and 1987. They were never used on North American or PAL CNROM games, even as the NES-CNROM board has an unpopulated spot for them until at least revision -02.
Those games typically turn the PPU off, switch in the wrong CHR bank (that return open bus) with wrong diode configuration, read a CHR byte in a specific place where the bus conflicts with the mapper will not appear even with the wrong diode config, then read the same byte with the correct bank and diode config latched, and enter in an infinite loop if the two reads matches. Those games have been assigned to [[iNES Mapper 185]]. Trying to dump them as regular NROM games will create bus conflicts with the dumping device, and even if this is bypassed the game will not run because the CHR ROM will be mirrored for all 8K bank select values.


=== Solder Pad Config ===
== Solder Pad Config ==
* Horizontal mirroring : 'H' disconnected, 'V' connected.
* Horizontal mirroring : 'H' disconnected, 'V' connected.
* Vertical mirroring : 'H' connected, 'V' disconnected.
* Vertical mirroring : 'H' connected, 'V' disconnected.
Line 46: Line 50:
* 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
* 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
* 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.
* 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.
* Bit 4 security implemented to '0' : D2 cathode set to '3' (CHR A12) and D2 anode set to '4' (latch).
* Bit 4 security implemented to '1' : D2 cathode set to '4' (latch) and D2 anode set to '3' (CHR A12).
* Bit 5 security implemented to '0' : D1 cathode set to '1' (CHR A10) and D1 anode set to '2' (latch).
* Bit 5 security implemented to '1' : D1 cathode set to '2' (latch) and D1 anode set to '1' (CHR A10).
* Security unimplemented : D1 and D2 not present.


== Variants ==
== Variants ==
Line 60: Line 58:
In fact, [[iNES Mapper 003]] encompasses both CNROM and similar boards that used more CHR ROM, such as those made by [http://bootgod.dyndns.org:7777/profile.php?id=4090 Bandai] and [http://bootgod.dyndns.org:7777/profile.php?id=1838 Panesian].
In fact, [[iNES Mapper 003]] encompasses both CNROM and similar boards that used more CHR ROM, such as those made by [http://bootgod.dyndns.org:7777/profile.php?id=4090 Bandai] and [http://bootgod.dyndns.org:7777/profile.php?id=1838 Panesian].


The [http://bootgod.dyndns.org:7777/profile.php?id=3953 Japanese version of ''Dance Aerobics''] adds a [http://forums.nesdev.org/viewtopic.php?p=102300#p102300 sound playback IC] to CNROM. It adds a [http://forums.nesdev.org/viewtopic.php?t=9449 register mapped from $6000-$7FFF] that can play one of eight voice recordings. However, the specifics of the compression are not yet known, and there is no standardized way to bundle audio data with [[iNES]] images.
The [http://bootgod.dyndns.org:7777/profile.php?id=3953 Japanese version of ''Dance Aerobics''] adds a [http://forums.nesdev.org/viewtopic.php?p=102300#p102300 sound playback IC] to a CNROM-like board. It adds a [http://forums.nesdev.org/viewtopic.php?t=9449 register mapped from $6000-$7FFF] that can play one of eight voice [https://forums.nesdev.org/viewtopic.php?p=199048#p199048 recordings]. However, the [https://forums.nesdev.org/viewtopic.php?p=199681#p199681 specifics] of the compression are not yet known, and there is no standardized way to bundle audio data with [[iNES]] images.
 
[https://nescartdb.com/profile/view/3844/hayauchi-super-igo ''Hayauchi Super Igo''] is a CNROM-like board with a 2KB SRAM mapped at $6000, using a [[7410|74HC10]] as the address decoder.


Theoretically the bank select register could be implemented with a [[74377|74HC377]] octal D latch, allowing up to 2 megabytes of CHR ROM.
Theoretically the bank select register could be implemented with a [[74377|74HC377]] octal D latch, allowing up to 2 megabytes of CHR ROM.
== Notes ==
Many CNROM games such as ''Milon's Secret Castle'' store data tables in otherwise unused portions of CHR ROM and access them through [[PPUDATA]] ($2007) reads. If an emulator can show the title screen of the [[NROM]] game ''Super Mario Bros.'', but CNROM games don't work, the emulator's PPUDATA readback is likely failing to consider CHR ROM bankswitching.


== See Also ==
== See Also ==

Latest revision as of 14:47, 9 November 2024

CNROM
Company Nintendo, others
Boards CNROM
PRG ROM capacity 32K
PRG ROM window n/a
PRG RAM capacity None
CHR capacity 32K
CHR window 8K
Nametable mirroring Fixed H or V, controlled by solder pads
Bus conflicts Yes
IRQ No
Audio No
iNES mappers 003, 185
NESCartDB
iNES 003
iNES 185
CNROM

NES-CNROM (and its HVC counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM. The most common usage of this board, as well as other third-party compatible boards, is assigned to iNES mapper 3. (See iNES Mapper 003 for the suggested emulator implementation.) If the CNROM board mounts only 8 KiB of CHR-ROM, the 8 KiB CHR bank number becomes a Chip Select number for copy-protection purposes, described by iNES Mapper 185.

Banks

  • CPU $8000-$FFFF: 16 KB PRG ROM, fixed (if 16 KB PRG ROM used, then this is the same as $C000-$FFFF)
  • CPU $C000-$FFFF: 16 KB PRG ROM, fixed
  • PPU $0000-$1FFF: 8 KB switchable CHR ROM bank

For 16 KB PRG ROM testing, Joust (NES) makes a worthwhile test subject.

Registers

Bank select ($8000-$FFFF)

7  bit  0
---- ----
..DC ..BA
  ||   ||
  ||   ++- CHR A14..A13 (8 KiB bank)
  |+------ Output to Diode 2 (D2)
  +------- Output to Diode 1 (D1)

The CNROM board contains a 74HC161 binary counter used as a quad D latch (4-bit register) to select the current CHR bank.

Security diodes

As a (weak) copy protection mechanism, the CNROM circuit board has a spot for two diodes that produce additional bus conflicts to hinder cartridge dumping attempts. Diode 1 connects latch bit 'D' to CHR-ROM A10; Diode 2 connects latch bit 'C' to CHR-ROM A12. Each latch bit must be set such that the diode does not allow current to flow, because if it does, AND-type bus conflicts occur that may cause the wrong CHR-ROM A10 and A12 signals to be applied, depending on the relative output resistances of latch chip and console or dumping device. Both the NES PPU and modern Kazzo-like dumping devices have strong enough output drivers to always win these bus conflicts, but 1980s' dumping equipment will lose these bus conflicts and produce an unusable readout. Each diode can be mounted either with the anode or the cathode facing the latch output. As a diode will allow current to flow if the anode-side voltage is significantly higher than the cathode-side voltage, the latch bit must be 0 if it faces the anode, and 1 if it faces the cathode.

The security diodes were mounted by most Nintendo-manufactured Japanese CNROM games manufactured in 1986 as well as Bandai-manufactured CNROM games from 1986 and 1987. They were never used on North American or PAL CNROM games, even as the NES-CNROM board has an unpopulated spot for them until at least revision -02.

Solder Pad Config

  • Horizontal mirroring : 'H' disconnected, 'V' connected.
  • Vertical mirroring : 'H' connected, 'V' disconnected.
  • 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
  • 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.

Variants

CNROM operates identically to a GNROM with one PRG bank.

The upper 2 bank select bits on the 74HC161 were connected to security diodes. If they were connected to CHR ROM address lines instead, this board could have theoretically supported up to 128 KB of CHR ROM. In fact, iNES Mapper 003 encompasses both CNROM and similar boards that used more CHR ROM, such as those made by Bandai and Panesian.

The Japanese version of Dance Aerobics adds a sound playback IC to a CNROM-like board. It adds a register mapped from $6000-$7FFF that can play one of eight voice recordings. However, the specifics of the compression are not yet known, and there is no standardized way to bundle audio data with iNES images.

Hayauchi Super Igo is a CNROM-like board with a 2KB SRAM mapped at $6000, using a 74HC10 as the address decoder.

Theoretically the bank select register could be implemented with a 74HC377 octal D latch, allowing up to 2 megabytes of CHR ROM.

See Also

  • iNES Mapper 003 - The common emulator implementation used for this board, which includes some compatible additions.
  • iNES Mapper 185 - Emulation for a subset of CNROM boards that implement a weak form of copy protection.
  • Comprehensive NES Mapper Document by \Firebug\, information about mapper's initial state is inaccurate.
Retrieved from "https://www.nesdev.org/w/index.php?title=CNROM&oldid=22214"