Quickdev16 & Super Nintendo

David Voswinkel david@optixx.org Matthias Nagler matt@dforce3000.de>

Sunday, January 1, 12

Motivation?

Sunday, January 1, 12

What to expect?

Sunday, January 1, 12

The Super Nintendo

Sunday, January 1, 12

Abbreviations
• • •
Sunday, January 1, 12

SFC

• • • •

Super Famicom Super Family Computer Super Nintendo Entertainment System Super home video computer

SNES Product code SHVC

Super Nintendo
• • • • • • • • •
Sunday, January 1, 12

16-bit video game console based on the WDC 65816 processor Successor of successful 8-bit Nintendo Entertainment System Cartridge based system Dedicated video chips Audio co-processor Released November1990 50 Million units sold 785 Games released Last commercial successful 2d only gaming system

Super Famicom
• • • • •
Super Family Computer (SFC) Japan version Release November 1990 NTSC / 60Hz CIC chip

Sunday, January 1, 12

Super Nintendo
• • • • •
North America version Release August 1991 NTSC / 60 Hz CIC chip New cartridge slot format

Sunday, January 1, 12

Super Nintendo
• • • •
Europe Version Release April 1992 PAL / 50 Hz New CIC Chip

Sunday, January 1, 12

Comparison
SNES Year Price Cpu Gfx Storage 1990 Amiga Genesis 500 1988 1987 3DO 1993 $700 PSX 1994 599DM

329DM 295DM 900DM 65816 2 PPU 8MB 68000 VDP 4MB 68000 OCS 1.4MB

ARM60 R3000 x GPU

700MB 700MB

Sunday, January 1, 12

Games

Sunday, January 1, 12

Games
• • • • • •
785 official games released Commercial phase 1990 - 1995 Last game in Japan: Metal Slader Glory (2001) Capacity constraints multimedia content JAP, USA & EU Cartridges

• •

Package design CIC Lockout chip

50/60 Hz Version

Sunday, January 1, 12

Super Mario World
Sunday, January 1, 12

F-Zero
Sunday, January 1, 12

Super Mario Kart
Sunday, January 1, 12

Donkey Country
Sunday, January 1, 12

Yoshis Island
Sunday, January 1, 12

License
• 3rd party producer are welcome • Exclusive releases • Lockout chip CIC • Cartridges sold for $70 • Nintendo charged ~$20 for 8Mbit
cartridge
Sunday, January 1, 12

Approval

Long approval process


Sunday, January 1, 12

• • • • •

Quality assurance Market control Avoid Atari problem (E.T.) No explicit content Limited game genres

Full game play video

Hardware
• • • • • • • • •
WDC 65C816 CPU - Nintendo 5A22

• •

Successor of MOS 6502 NTSC 3.57 MHz

24Bit A-Bus to RAM and ROM 8Bit B-Bus to subsystems Co-processor APU with 64KB RAM 2 PPU for graphics with 32KB video RAM each 128KB work RAM 8 DMA Channels No IPL or BIOS starts from reset vector in ROM area SPC has IPL

Sunday, January 1, 12

Mainboard
Sunday, January 1, 12

CPU

Mainboard
Sunday, January 1, 12

PPU

PPU

CPU

Mainboard
Sunday, January 1, 12

PPU

PPU

WRAM

CPU

Mainboard
Sunday, January 1, 12

VRAM

VRAM

PPU

PPU

WRAM

CPU

Mainboard
Sunday, January 1, 12

Sunday, January 1, 12

CPU
• • •
16Bit native mode 65C02 emulation mode Registers 8Bit or 16Bit


Sunday, January 1, 12

• • •

Accumulator Stack pointer X and Y index registers

Direct page and stack relative addressing modes

Sunday, January 1, 12

Sunday, January 1, 12

Ricoh 5A22
• NMI on V-blank • DMA for block transfers • Only between A and B bus • H-DMA (Scanline DMA) • MMIO
Sunday, January 1, 12

PPU
• • • • • • • • •
Sunday, January 1, 12

Progressive mode 256 x 224 pixel HighRes 512 x 478 pixel 15Bit color depth 8 modes 128 sprites, 32 max. per scanline VRAM OAM CGRAM HDMA

Modes
• • • • •
Sunday, January 1, 12

Tiled mode

• •

Flip horizontally Flip vertically

Bitmap mode Up to 4 layers / playfields Color add / subtract Rotate and zoom

Mode 7
• • • •
128x128 Tiles Matrix transformations HDMA LUTs

Sunday, January 1, 12

APU
• • • • • • •
Sunday, January 1, 12

8Bit Sony SPC700 Sample use BBR compression 64KB Ram 8 x 16Bit Channels at 32 kHz Runs own code Independent system Bootstrapped by the main cpu

Cartridges
• • • • • • • •
Nintendo licensed / manufactured 4 Mbit - 48 Mbit cartridges (256KB - 6MB) Mask ROM SRAM battery for savegames MAD chip (address decoding) CIC chip (security chip) Custom chips (graphics enhancement) Memory layouts

• •

LoRom 32 KB pages HiRom 64 KB pages

Sunday, January 1, 12

Cartridge SHVC-1A3B
Sunday, January 1, 12

Rom 4MBit

Cartridge SHVC-1A3B
Sunday, January 1, 12

CIC

Rom 4MBit

Cartridge SHVC-1A3B
Sunday, January 1, 12

MAD CIC

Rom 4MBit

Cartridge SHVC-1A3B
Sunday, January 1, 12

SRAM 64KB MAD CIC

Rom 4MBit

Cartridge SHVC-1A3B
Sunday, January 1, 12

Bat MAD CIC

SRAM 64KB

Rom 4MBit

Cartridge SHVC-1A3B
Sunday, January 1, 12

Pinouts
• • •
LoRom 32KB pages HiRom 64KB pages A-Bus

• • • • • •

24bit address bus (16MB address space) BA0-BA7 switch between 256 pages 8Bit databus ROM,CPU and WRAM

B-Bus 8bit address bus CPU, SPC and PPUs

Sunday, January 1, 12

LoRom
Sunday, January 1, 12

LoRom
Sunday, January 1, 12

WRAM

LoRom
Sunday, January 1, 12

MMIO

LoRom
Sunday, January 1, 12

Rom

LoRom
Sunday, January 1, 12

Rom

LoRom
Sunday, January 1, 12

Rom

LoRom
Sunday, January 1, 12

HiRom
Sunday, January 1, 12

HiRom
Sunday, January 1, 12

WRAM

HiRom
Sunday, January 1, 12

MMIO

HiRom
Sunday, January 1, 12

Rom

HiRom
Sunday, January 1, 12

Rom

HiRom
Sunday, January 1, 12

Rom

HiRom
Sunday, January 1, 12

Custom Chips

GFX / Calculations

• • • •

• • • • • • • •
AI

Super Fx CX4 DSP 1 - 4 OBC-1 GB-Z80 MX15001TFC S-DD1 SPC7110 ST010 - ST018

Gameboy Flash Rom Decompression

Sunday, January 1, 12

DSP
• Microcode version 1- 4 • Vector calculations • 2D/3D transformations • Memory mapped IO
Sunday, January 1, 12

SA-1
• • • • • • •
Sunday, January 1, 12

WDC 65C816 CPU @ 10MHz Improved version of SNES CPU 256Byte IRAM CPU and DMA at the same time Memory mapping capabilities Mode CIC copy protection for PAL/NTSC Address space up to 64Mbit

Super Mario RPG

SHVC-1L5B-11
Sunday, January 1, 12

Super Mario RPG

SA 1

SHVC-1L5B-11
Sunday, January 1, 12

Super Mario RPG

SRAM 256KB

SA 1

SHVC-1L5B-11
Sunday, January 1, 12

Super Mario RPG
ROM 32MBit

SRAM 256KB

SA 1

SHVC-1L5B-11
Sunday, January 1, 12

Super FX
• • • • • • • • •
Sunday, January 1, 12

RISC CPU @ 10MHz/21.4MHz Framebuffer plot opcodes Light source shading Sprite effects Memory mapped IO Software effects No 3D accelerator at all Clock problems Support for DRAM

Winter Gold

SHVC-1CB5B
Sunday, January 1, 12

Winter Gold

Super FX

SHVC-1CB5B
Sunday, January 1, 12

Winter Gold
SRAM 512KB

Super FX

SHVC-1CB5B
Sunday, January 1, 12

Winter Gold
SRAM 512KB ROM 16MBit

Super FX

SHVC-1CB5B
Sunday, January 1, 12

Winter Gold
SRAM 512KB ROM 16MBit

Super FX

CIC

SHVC-1CB5B
Sunday, January 1, 12

Lockout Chip
• • • • • • • •
Key/- Lock System Chip in cartridge “key” Chip in system “lock” that controls the SNES reset line Run the same clock and same code Seeded Calculate and communicate over 2 wires Verify each others results CPU

• • • •

4Bit Accumulator and x register 32 nybbles RAM 512 Byte ROM

Reverse engineered & PIC implementation

Sunday, January 1, 12

Copy Protection
• Generic SRAM protection • Specific Copystation checks • Import protections • PPU flag PAL/NTSC video • Copy protections of unlicensed cartridges
Sunday, January 1, 12

Soul Blade HKO

Unlicensed copy protected cartridge
Sunday, January 1, 12

Addons

Sunday, January 1, 12

Satellaview
• • • • • • •
“Online Service” Satellite modem, unidirectional Japan only Broadcasted games and content could be downloaded On regular Satellite TV channel Store on 8 Mbit BX-S Flash modules Phoneline modem was planned, but never released

Sunday, January 1, 12

Ultra16
• Boot menu for the SNES • Support for all regions games • 50/60 Hz switching via
software

• Support for Satellaview games
Sunday, January 1, 12

Ultra16 Menu
Sunday, January 1, 12

• • • • • •

Commercial Development
Mostly assembler Some games in asm and c Cross assembling on PC or Amiga Mostly self written tools Different official Devkits (Intelligent Systems, Ricoh) Prototype cartridges

• •

Flash EPROMS

Sunday, January 1, 12

psy-Q Devkit
Sunday, January 1, 12

Accolade Devkit
Sunday, January 1, 12

Unknown Devkit
Sunday, January 1, 12

Development System
Sunday, January 1, 12

Homebrew Development
Assemblers

• •

• • • • • •

WLA DX Snescom cc65 tcc & wla-link WDC Compiler snes-sdk

C Compilers

SDKs

Sunday, January 1, 12

Copier Stations
• • • • • •
Sunday, January 1, 12

Storage

• •

DRAM 4 - 128 MBit

3.5” Floppy 1.4MB Parallel port connector Boot / Game menu Save Games on floppies Custom chip and CIC piggybacks

Doctor SF7
Sunday, January 1, 12

Super Wild Card
Sunday, January 1, 12

Super Wild Card
Sunday, January 1, 12

Flash Cartridges
• Storage • Flash • 16 - 64 MBit • Parallel port • USB • SDCard
Sunday, January 1, 12

Tototek Super Flash
Sunday, January 1, 12

Mash Mod
Sunday, January 1, 12

Retrousb Powerpak
Sunday, January 1, 12

Emulation

Sunday, January 1, 12

ZSNES

ZSNES

• • • • • •

Started 1998 Windows Intel OS X Linux A lot assembler code using nasm x86 only

Sunday, January 1, 12

Snes9x
• Snes9x • SNES96 • pure C • portable code
Sunday, January 1, 12

BSNES
• BSNES • Started 2005 • Clean C++ code • Windows / Linux / OS X • SDL, QT • Debugger
Sunday, January 1, 12

Scene

Sunday, January 1, 12

Homebrew
• • • • •
Very small ... By a magnitude smaller than PSP, NDS or WII community Extensive register-drivern graphics interface No real middleware nor libraries Resources

• •

efnet #snesdev nesdev.parodius.com

Sunday, January 1, 12

Warez Scene
• • • • •
Sunday, January 1, 12

Active early 90ies Napalm Anthrox

Amiga Crews: Quartex, Red Sector & Paradox

Early demos use game music instead of own compositions Writing good audio drivers remain a challange for quite some time

Intros & Demos

Sunday, January 1, 12

Anthrox Sine Dot
Sunday, January 1, 12

Anthrox Mode7
Sunday, January 1, 12

Censor
Sunday, January 1, 12

Napalm
Sunday, January 1, 12

Paradox
Sunday, January 1, 12

Project Quickdev16
• optixx, max and D4S • Started around February 2009 • Version 1 finished in September 2009 • Version 2 still going ...
Sunday, January 1, 12

optixx.org
Sunday, January 1, 12

assembla.com/wiki/show/quickdev16
Sunday, January 1, 12

Proof of concept

Sunday, January 1, 12

Milestones
• Rom memory layout • Cartridge dumper • Rom analysis • SNES Memory map • Documentations • BSNES sources
Sunday, January 1, 12

Hardware
• STK 500 • 512K SRAM • ATmega16 • SDCard • Shift register, bus driver and a switch
Sunday, January 1, 12

Modified cartridge
Sunday, January 1, 12

Rom dumper
Sunday, January 1, 12

Multinorm cartridge
Sunday, January 1, 12

STK500
Sunday, January 1, 12

Memory
Sunday, January 1, 12

Sunday, January 1, 12

AVR / SNES Switch
Sunday, January 1, 12

POC running
Sunday, January 1, 12

Mario!
Sunday, January 1, 12

Firmware
• Slow SRAM interface • Memory CRC checks • Simple SD-Card routines • Debug printfs via UART
Sunday, January 1, 12

Bugs
• WR Line to CART • Same game overwrote “ROM” • Switch Situation • “Switch, plug and then power”
Sunday, January 1, 12

Sunday, January 1, 12

Prototype

Sunday, January 1, 12

Hardware Design
• Switching between AVR and SNES SRAM
access

• Shift register to preload SRAM addresses • Counter for fast SRAM address
increment

Sunday, January 1, 12

Prototype
• PCB from PCB Pool • ATmega 644 • 8 x 512K SRAM • SIO FDTI for UART
Sunday, January 1, 12

AVR , USB and bus driver
Sunday, January 1, 12

Sregs, counter and SRAM
Sunday, January 1, 12

Routing
Sunday, January 1, 12

Routing
Sunday, January 1, 12

PCB Pool
Sunday, January 1, 12

PCB Pool
Sunday, January 1, 12

Front
Sunday, January 1, 12

Back
Sunday, January 1, 12

SRAM
Sunday, January 1, 12

FTDI
Sunday, January 1, 12

AVR
Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

PCB Pool
• Good quality • Extreme good support via email • Delivered on time • Pictures of each process step • Expensive • But worth the money
Sunday, January 1, 12

Problems overcome
• Commercial just crashed • Seemed to be audio related • Wrote some test roms to trigger
problem

Sunday, January 1, 12

Sunday, January 1, 12

LA session powerup
Sunday, January 1, 12

Openbus 0x21
• • • • • •
Sunday, January 1, 12

SPC reads 0x21 on B-Bus. Bus driver problem “Our” SRAM is permanently on the bus CS is not implemented HOTFIX: add an extra OR gate SRAM active when SNES CS low and AVR switch low

Hotfix
Sunday, January 1, 12

Version 1
• Reduce to 4 x 512K SRAM • Kill FTDI to save space and money • We call it • Black PCBs
Sunday, January 1, 12

Front
Sunday, January 1, 12

Back
Sunday, January 1, 12

Seeedstudio
Sunday, January 1, 12

Seeedstudio PCB
• Based Hong Kong • Manufactured in China • Good email support • “Fancy colors” • Free shaping • Golden connector
Sunday, January 1, 12

Sunday, January 1, 12

Software

Sunday, January 1, 12

Firmware
• USB Bootloader • 4kb • software V-USB • Debug shell via uart
Sunday, January 1, 12

Ucon64
• Opensource • Supports a lot of copiers and flashcarts • Added support for Quickdev16 • Libusb based • Windows, Linux & OS X support
Sunday, January 1, 12

Qdinc
• Inital full rom upload • Subsequent uploads are diff only • Works with vanilla firmware

Sunday, January 1, 12

Loader 1
• Part of the AVR firmware • Used RLE compression • HiRom • WRAM trick • Progress feedback via “shared memory”
Sunday, January 1, 12

Version 1
Sunday, January 1, 12

Loader 2
• Use deflate compression • Progress bar via “shared memory” • Polling of status register • IRQ driven • Rom info
Sunday, January 1, 12

Version 2
Sunday, January 1, 12

Size matters
mini Boot Code RAM Loader v1 Loader v2 4096 7532 344 31091 35726 debug 4096 24984 742 31091 35726

Sunday, January 1, 12

Loader crunching
Loader v1 Loader v1 RLE Loader v2 Loader v2 RLE Loader v2 deflate 65536 31091 65536 58046 35726

Sunday, January 1, 12

Sunday, January 1, 12

More debugging

Sunday, January 1, 12

Chuck Norris Debugging
Sunday, January 1, 12

PCB Quality
• • • •
First batch was faulty Soldermask was off Some pads had broken connections New batch of PCB for free

• • •

Faulty print No golden connectors But all working

Sunday, January 1, 12

Seeedstudio
Sunday, January 1, 12

Seeedstudio
Sunday, January 1, 12

Production

• Time to play OEM...

Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

Sunday, January 1, 12

Hack a day

Version 2

Sunday, January 1, 12

Wishlist
• • • • • •
Sunday, January 1, 12

CPLD or FPGA Native and fast USB JTAG Custom chip support Time multiplexed bus sharing Memory pattern triggers

Prototype 2

Sunday, January 1, 12

Hardware
• • • • •
Sunday, January 1, 12

AT90USB1287

USB client and host

Xilinx CPLD xc95144xl Cypress 16Mbit SRAM AVR JTAG CPLD JTAG

CPLD
Sunday, January 1, 12

AVR and SRAM
Sunday, January 1, 12

ISP and JTAG
Sunday, January 1, 12

Lost in Verilog

Sunday, January 1, 12