Technical Document (NES Emulator) Last Update: 2014 11/26 Contact: gucchan@sfc.wide.ad.jp Author: Ryoma Kawaguchi (B1, Keio University) Jun Murai Lab., ARCH(Internet Architecture Research Team) @ Delta North. David A.Patterson, John L.Hennessy 4 (Computer Organization and Design: The Hardware/Software Interface) (NES)
"emulate" 拟 (mo2 ni3 qi4) PC ROM ROMROM ( )
CPU PPU(Picture Processing Unit) UI SDL PC / ROM / ROM CPU PPU VM C++ AVR ROM ROM AVR-gcc C ROM
ROM : http://datacrystal.romhacking.net/wiki/super_mario_bros. ines 1.0 Format ines (*.nes) ROM /NES ROM ines nesdev +-------------------+ + ines Header (16) + +-------------------+ + Trainer patch + + (0 or 512 byte) + +-------------------+ + + + PRG-ROM + -> CPU + (0x4000*x bytes) + + + +-------------------+ + + + CHR-ROM + -> PPU + (0x2000*y bytes) + + + +-------------------+ + PlayChoice ROM + + (INST-ROM/PROM) + ~~~~~~~~~~~~~~~~~~~~~ PlayChoice Trainer PlayChoiceTrainer 512byte seek 0 1 2 3 4 +--------------+---------------+---------------+--------------+ 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + File Signature + + ("NES" + 0x1a) + +--------------+---------------+---------------+--------------+ + PRG-ROM Page + CHR-ROM Page + Flag-0 + Flag-1 + + (PRG/0x4000) + (CHR/0x2000) + (PPU Flags) + (Mapper No.) + +--------------+---------------+---------------+--------------+ + SRAM Size + Flag-2 + Flag-3 + Reserved + + + (NTSC/PAL) + (Mirroring) + (zero-field) + +--------------+---------------+---------------+--------------+ + Reserved + + (zero-field) + +-------------------------------------------------------------+ Flag-0 bit0: bit[0]=1 bit[0]=0 bit1: bit[1]=1 SRAM (0x6000 ~ 0x7fff( RAM ) ) bit2: bit[2]=1 Trainer patch (0x7000 ~ 0x71ff ( RAM ) ) bit3: 4 VRAM bit4-7: Flag-1 bit0-1: (Vs unisystem, playchoice ) bit2-3: ines 00 0b10=2 NES2.0 bit4-7: Flag-2
bit0: bit[0]=1 PAL bit[0]=0 NTSC bit1-7: Flag-3 ( ) ines bit0-1: bit[0,1]=1 PAL bit[1,1]=3 NTSC/PAL bit[0,0]=0 NTSC (KEL-4630-060-038) NES(Nintendo Entertainment System) NES 72 60 nesdev CPU R/W R: PRG-ROM( RAM) (H=R,L=W) IRQ: IRQ PPU RD/WE: CHR-ROM RAM /WE=L,/RD=H: W /WE=H,/RD=L: R /WR=H,/RD=H: Disable ROMSEL: PRG-ROM CIRAM/CE (VRAM CS): VRAM Chip-Select PPU A13: CHR-ROM (PPU A13 2 ) (Front:F, Back:B) URL: http://www.emusta.net/kairo.pdf F25+F13=A0 (PPU A0+CPU A0)
F24+F12=A1 (PPU A1+CPU A1) F23+F11=A2 (PPU A2+CPU A2) F22+F10=A3 (PPU A3+CPU A3) B20+F06=P50+P06=A7 (PPU A7+CPUA7) F19+F07=A6 (PPU A6+CPU A6) F20+F08=A5 (PPU A5+CPU A5) F21+F09=A4 (PPU A4+CPU A4) B21+F05=P51+P05 (PPU A8+CPU A8) B22+F04=P52+P04 (PPU A9+CPU A9) B23+F03=P53+P30 (PPU A10+CPU A10) B24+F02=P54+P02 (PPU A11+CPU A11) B05 = P35 (CPU A14) B04 = P34 (CPU A13) B25+B03=P55+P33 (PPU A12+CPU A12) F27+B12=P27+P42 (PPU D1+CPU D1) F29+B10=P29+P40 (PPU D3+CPU D3) B29+B08=P59+P38 (PPU D5+CPU D5) B27+B06=P57+P36 (PPU D7+CPU D7) B28+B07=P58+P37 (PPU D6+CPU D6) B30+B09=P60+P39 (PPU D4+CPU D4) F28+B11=P28+P41 (PPU D2+CPU D2) F26+B13=P26+P43 (PPU D0+CPU D0) B02=P32 (M2(CPU clock output) = CLK) B17=P47 (PPU/WR = CWE(CHR-ROM WRITE )) B26=P56 (PPU A13 = CHR(CHR-ROM CE(Chip-Enable) )) F17 (PPU/RD = COE(CHR-ROM OE(Output-Enable) )) B14=P44 (/ROMSEL(/A15+M2) = PRG(PRG-ROM CE(Chip-Enable) )) F14 (CPU R/W = PWR(PRG-ROM WRITE )) B19 (PPU /A13 = CIN) F01, F16 (GND) F30, B01(P31) (Vcc (+5V)) ROM 74HC393AP (4bit x2) x2 AVR (ATmega328P-PU) x1 MAX232C(ADM209 (TTL/CMOS IC)) x1 LED x2 (510Ω) x2 RS232C (Dsub 9-pin ) x1 USB<->RS232C(Dsub 9-pin ) x1
(KEL-4630-060-038) x1 74HC393AP: http://www.semicon.toshiba.co.jp/info/lookup.jsp?pid=tc74hc393ap&lang=ja ATmega328P-PU: http://www.avr.jp/user/ds/pdf/mega88a.pdf Mapper-0(NROM) Enable 3 15 15bit (=32KB ) ROM 88bit(=1byte) PRG-ROM CHR-ROM Enable CHR-ROM CHR-ROM Enable ROM 1 ROM AVR AVR I/O 74HC393AP. 74HC393AP 4bit1 IC 1 MSB 8bit 2 IC16bit AVR I/O CLR( ) /CLK 2
(Bsch3v ) AVR 8, Enable 4<->AVR AVR(ATmega328P-PU) AVR AVR (PC) [Rk@20:55:40]~% cd /dev && ls -la tty.* crw-rw-rw- 1 root wheel 18, 4 Oct 30 02:47 tty.bluetooth-modem crw-rw-rw- 1 root wheel 18, 6 Oct 30 02:47 tty.bluetooth-pda-sync crw-rw-rw- 1 root wheel 18, 0 Oct 30 02:47 tty.bluetooth-serial-1 crw-rw-rw- 1 root wheel 18, 2 Oct 30 02:47 tty.bluetooth-serial-2 crw-rw-rw- 1 root wheel 18, 8 Oct 30 20:55 tty.usbserial-fthfzezc [Rk@20:55:50]~% RS232C<->USB USBtty screen AVR ROM (PRG-ROM/CHR-ROM) ROM, PRG-ROM: CPU R/W(1,OE) + /ROMSEL(1,CS) + M2(0) + PPU /RD(1) CHR-ROM: CPU R/W(0,OE) + /ROMSEL(0,CS) + M2(1) + PPU /RD(1) PC Ruby ruby-serialport CPU (6502,RP2A03)
(CPU (1~10 ) :CPU, : (0x37=55), :6502 ) MOS Technology 6502 RICOH 10 (2A03 ) NES CPUROM 16bitCPU 64Kbyte, ROM32Kbyte Memory-Mapped I/O 0 0x0000 ~ 0x07ff : RAM (2KB) (: 0x0000 ~ 0x00ff, : 0x0100 ~ 0x01ff) 0x0800 ~ 0x1fff : RAM 0x2000 ~ 0x2007 : PPU I/O (PPU) 0x2008 ~ 0x3fff : 0x2000 ~ 0x2007 0x4000 ~ 0x401f : APU, I/O (DMA/ ) 0x4020 ~ 0x5fff : RAM
0x6000 ~ 0x7fff : RAM 0x8000 ~ 0xbfff : PRG-ROM Low 0xc000 ~ 0xffff : PRG-ROM High 8bit :A,X,Y,S(Processor Status Register), P(Stack pointer) 16bit :PC (Program counter) P [N] N P[X] PX N V R B D I Z C N Negative flag.. A[7] == 1 V overflow flag.. R Reserved flag.. B Break flag.. BRK () IRQ D Deciaml flag.. P[D]=1 BCD RP3A02 I Interrupt flag.. P[I]=1 IRQ, P[I]=0 IRQ Z Zero flag.. P[Z]=1 C Carry flag.. P[C]=1 NMI(vector:0xfffa ~ 0xfffb): P[I] PPU VBlank - P[I]=1P[B]=0 RESET(vector:0xfffc ~ 0xfffd): - P[I]=1 IRQ/BRK(vector:0xfffe~0xffff): /BRK - P[I]=1 - IRQ BRK ISR P[B]=1 BRK IRQ.bank 1.org $fffa.dw NMIProc.dw RESETProc.dw IRQProc ROM (Bank1) CPU P(Processor Status Register) = 0x34 S(Stack pointer) = 0xfd PC(Program counter) = (read(0xfffc) read(0xfffd << 8)) RESET A = X = Y = 0 0x0008 = 0xf7,0x0009 = 0xef,0x000a = 0xdf,0x000f = 0xbf 0x4015( ) = 0x00 0x4017( IRQ ) = 0x00 0x4007~0x400f = 0x00 IRQ/NMI A,X,Y S(Stack pointer) 3 () PC(Program counter) = (read(0xfffc) (read(0xfffd) << 8)) RESET 0x4015 = 0x00 Interrupt
u8.. unsigned 8-bit, u16.. unsigned 16-bit s8.. signed 8-bit, Implied (Op)..Op Accumlator (Op).. Immediate (Op #u8)..u8 Zero-page (Op u8).. vm.load(u8) Zero-page index-x (Op u8x).. vm.load((u8 + X) % 0x100) Zero-page index-y (Op u8,y)..vm.load((u8 + Y) % 0x100) Relative (Op s8).. Absolute (Op u16).. Absolute index-x (Op u16,x).. Absolute index-y (Op u16,y).. Indirect (Op u16).. Indirect X (Op u8,x).. Indirect Y (Op u8,y).. JMP Indirect 0xc100: 0x4c 0xc1ff: 0x00 0xc200: 0x23.. 0xd02c: 0x6c 0xff 0xc1 ; jmp (0xc1ff -> 0x2300 ( )) 0xd02c: 0x6c 0xff 0xc1 ; jmp (0xc1ff -> 0x4c00 ( 256byte )) 6502 256byte 256byte 16bit 64KB CPU Indirect jmp 16bit 8bit 2, 2byte (little-endian ) (Op l h) l=0xff 256byte uint16_t addrindirect() { uint16_t src = vm.read(pc++); // 0xff src = src (vm.read(pc++) << 8); // 0xc1ff // read(0xc1ff) (read(0xc100 0x0000) << 8) = 0x00 (0x4c << 8) = 0x4c00 return vm.read(src) (vm.read((src & 0xff00) ((src + 1) & 0x00ff)) << 8); PHP inline void CPU::opPHP() { this->stack.push(this->psr & pow(2,4)); P (Processor Status Register) push PLA pop A PHP PLABreakpop PNVRBDIZCR 1B 1 http://nesdev.com/opcodes.txt Indirect JMP 0x6c(Indirect)
none imm zero abs zerox zeroy absx absy indx indy LDA 0xa9 0xa5 0xad 0xb5 0xbd 0xb9 0xa1 0xb1 LDX 0xa2 0xa6 0xae 0xb6 0xbe LDY 0xa0 0xa4 0xac 0xb4 0xbc STA 0x85 0x8d 0x95 0x9d 0x99 0x81 0x91 STX 0x86 0x8e 0x96 STY 0x84 0x8c 0x94 TXA 0x8a TYA 0x98 TXS 0x9a TAY 0xa8 TAX 0xaa TSX 0xba PHP 0x08 PLP 0x28 PHA 0x48 PLA 0x68 ADC 0x69 0x65 0x6d 0x75 0x7d 0x79 0x61 0x71 SBC 0xe9 0xe5 0xed 0xf5 0xfd 0xf9 0xe1 0xf1 CPX 0xe0 0xe4 0xec CPY 0xc0 0xc4 0xcc CMP 0xc9 0xc5 0xcd 0xd5 0xdd 0xd9 0xc1 0xd1 AND 0x29 0x25 0x2d 0x35 0x3d 0x39 0x21 0x31 EOR 0x49 0x45 0x4d 0x55 0x5d 0x59 0x41 0x51 ORA 0x09 0x05 0x0d 0x15 0x1d 0x19 0x01 0x11 BIT 0x24 0x2c ASL 0x0a 0x06 0x0e 0x16 0x1e LSR 0x4a 0x46 0x4e 0x56 0x5e ROL 0x2a 0x26 0x2e 0x36 0x3e ROR 0x6a 0x66 0x6e 0x76 0x7e INX 0xe8 INY 0xc8 INC 0xe6 0xee 0xf6 0xfe DEX 0xca DEY 0x88 DEC 0xc6 0xce 0xd6 0xde CLC 0x18 CLI 0x58 CLV 0xb8 CLD 0xd8 SEC 0x38 SEI 0x78 SED 0xf8 NOP 0xea BRK 0x00 JSR 0x20 JMP 0x4c RTI 0x40 RTS 0x60 ========================================================================= rel BCC 0x90 BCS 0xb0 BEQ 0xf0 BMI 0x30 BNE 0xd0 BPL 0x10 BVC 0x50 BVS 0x70 / : Absolute index-x, Absolute index-y, Indirect-Y +1 : BCC BCS BEQ BNE BVC BVS BPL BMI (Branch ) +1 +2
7, 6, 2, 8, 3, 3, 5, 5, 3, 2, 2, 2, 4, 4, 6, 6, 2, 5, 2, 8, 4, 4, 6, 6, 2, 4, 2, 7, 4, 4, 6, 7, 6, 6, 2, 8, 3, 3, 5, 5, 4, 2, 2, 2, 4, 4, 6, 6, 2, 5, 2, 8, 4, 4, 6, 6, 2, 4, 2, 7, 4, 4, 6, 7, 6, 6, 2, 8, 3, 3, 5, 5, 3, 2, 2, 2, 3, 4, 6, 6, 2, 5, 2, 8, 4, 4, 6, 6, 2, 4, 2, 7, 4, 4, 6, 7, 6, 6, 2, 8, 3, 3, 5, 5, 4, 2, 2, 2, 5, 4, 6, 6, 2, 5, 2, 8, 4, 4, 6, 6, 2, 4, 2, 7, 4, 4, 6, 7, 2, 6, 2, 6, 3, 3, 3, 3, 2, 2, 2, 2, 4, 4, 4, 4, 2, 5, 2, 6, 4, 4, 4, 4, 2, 4, 2, 5, 5, 4, 5, 5, 2, 6, 2, 6, 3, 3, 3, 3, 2, 2, 2, 2, 4, 4, 4, 4, 2, 5, 2, 5, 4, 4, 4, 4, 2, 4, 2, 4, 4, 4, 4, 4, 2, 6, 2, 8, 3, 3, 5, 5, 2, 2, 2, 2, 4, 4, 6, 6, 2, 5, 2, 8, 4, 4, 6, 6, 2, 4, 2, 7, 4, 4, 6, 7, 2, 6, 3, 8, 3, 3, 5, 5, 2, 2, 2, 2, 4, 4, 6, 6, 2, 5, 2, 8, 4, 4, 6, 6, 2, 4, 2, 7, 4, 4, 6, 7 PPU (Picture Processing Unit) PPU CPU 0x2000 ~ 0x2007 8 PPU VRAM 0x20001 bit3,4 0 0x2002 - PPU Status Register : - bit0-4: - bit5: (0:8, 1:9 ) - bit6: (1) - bit7: VBlank 1, 0x2007 - PPU Memory Data : PPU 0x2000 - PPU Control Register1 : - bit0-1: (0b00=0x2000, 0b01=0x2400, 0b10=0x2800, 0b11=0x2c00) - bit2: PPU (0:+1, 1:+32) - bit3: (0:0x0000, 1:0x1000) - bit4: (0: 0x0000, 1:0x1000) - bit5: (0:88, 1:816) - bit6: PPU Master/slave (0: Master) - bit7: VBlank NMI (0:, 1: ) 0x20001 - PPU Control Register2 : - bit0: (0:, 1: ) - bit1: (0: 8, 1: ) - bit2: (bit1 ) - bit3: (0:, 1: ) - bit4: (0:, 1: ) - bit7-5: 000( ), 001(Green), 010(Blue), 100(Red) 0x2003 - Sprite Memory (OAM) Address :0x2004OAM 0x2004 - Sprite Memory (OAM) Data :0x2002 OAM 0x2005 - Background Scroll Offset : 0x2006 - PPU Memory Address :0x2007 PPU (h,l ) 0x2007 - PPU Memory Data
0x2006 PPU ( VRAM pc (0x2000 bit2 )) OAM(Object Attribute Memory) 4byte 64 256byteOAM 64 0byte : Y 1byte : 2byte : bit7: (0:, 1: ) bit6: (0:, 1: ) bit5: (0:, 1: ) bit2-4: (0 ) bit0-1: 2 3byte : X VRAM 0x0000 ~ 0x0fff : 1 ( ) 0x1000 ~ 0x1fff : 2 () 0x2000 ~ 0x23bf : 1 0x23c0 ~ 0x23ff : 1 0x2400 ~ 0x27bf : 2 0x27c0 ~ 0x27ff : 2 0x2800 ~ 0x2bbf : 3 (mirror: 0x2000 ~ 0x23bf) 0x2bc0 ~ 0x2bff : 3 (mirror: 0x23c0 ~ 0x23ff) 0x2c00 ~ 0x2fbf : 4 (mirror: 0x2400 ~ 0x27bf) 0x2fc0 ~ 0x2fff : 4 (mirror: 0x27c0 ~ 0x2fff) 0x3000 ~ 0x3eff : 0x2000 ~ 0x2eff 0x3f00 ~ 0x3f0f : 0x3f20 ~ 0x3f1f : 0x3f20 ~ 0x3fff : +(0x3f00~0x3f1f) PPU VRAM(2048byte), OAM(256byte), (32byte) 0 PPUCTRL(0x2000) = 0x2003 = PPUSCROLL(0x2005) = PPUADDR(0x2006) = 0 PPUCTRL(0x2000) = 0x2003 = PPUSCROLL(0x2005) = PPUADDR(0x2006) = 0 Toggle-flag = false (http://hlc6502.web.fc2.com/nespal2.html RGB ) Hue Brightness6bit(64 ) RGB (VRAM ) SDL 12 12*2+1=25 /
(0x0000 ~ 0x0fff) (88)256=4KB 0x2000 ~ 0x23bf, 0x24000 ~ 0x27bf ( 1 960byte 3230=960) 22 4 2 ines / 64byte2*2 4 0-1 2bit 2-3 2bit 4-5 2bit 6-7 2bit 2bit /
256byte1 16byte 16byte 8*82bit 4 ( ) 2bit addr p(x,y) = ((((read(addr + y + 8) >> (7 - x)) & 1) << 1) ((read(addr + y) >> (7 - x)) & 1)) & 3; C++ screen_buffer SDL void PPU::pattern_table_debug() { uint16_t base = 0x0000; uint8_t nespal[4] = { 0x31, 0x21, 0x11, 0x01 ; int w = 0, h = 0; for(int k = 1; k <= (0x2000 / 16); k++) { for(int y = 0; y < 8; y++) { for(int x = 0; x < 8; x++) { uint8_t c = ((((vm.get_chr(base + y + 8) >> (7 - x)) & 1) << 1) ((vm.get_chr(base + y) >> (7 - x)) & 1)) & 3; screen_buffer[(nes_screen_height * (y + h)) + (x + w)] = nespal[c]; w += 8; if((k & 0x1f) == 0) h += 7; base += 16;
DMA DMA 0x4014(DMA ) store DMA DMA 0x0000 ~ 0x00ff 6502 0x0100 ~ 0x01ff 6502 0x0200 ~ 4byte=(16bit)OAM 64 (4*64=256byte)64 DMA 256DMA 0x4014 DMA DMA 8bit 0 00 0x20002 6 0x2005 CPU NTSC 21.47MHz CPU12 1.48MHz PPU 3 PC2.13GHz@Intel Core2 Duo (4GB DDR3 RAM) One scanline is EXACTLY 1364 cycles long. In comparison to the CPU's speed, one scanline is 1364/12 CPU cycles long. (ref: http://web.textfiles.com/games/ppu.txt) 1/60 262 ->1/60 -> PPU PPU
0 ~ 240 241~261 VM VBlank( ) VM CPU NMII/O ( ) 262 241 OAM(Object Attribute Memory) 2 ( STM) ( SBM) 0~240 OAM 256 1 88 STM STM SBM SBM 8px 0 PPUCTRL 8px( ) PPUSCROLL (0 ~ 7) I/O CPU 0x4016,0x40171P,2P 0x4016/0x4017 1 0 0x4016/0x4017 bit0 (1: ),(0:,1: ) Zapper 0x4016/0x4017 0x4016/0x4017 bit0 1->0 / I/O bit0 1 R1: A R2: B R3: SELECT R4: START
R5: UP R6: DOWN R7: LEFT R8: RIGHT PPU 242 I/O VBlank 0x4016,0x4017 CPU I/O read MMC(Memory Management Controller) PRG-ROM 32KB, CHR-ROM 8KB PRG-ROM Mapper( ) Mapper-0(NROM) PRG-ROM32KB, CHR- ROM8KB ROM Mapper-0MMC Mapper-0 16KB ROM 32KB ROMiNES PRG-ROM (16KB ROM 0x3fff, 32KB ROM 0x7fff) NROM::NROM(VM& nes_vm, INES nes_ines) : vm(nes_vm), ines(nes_ines) { this->mask = ines.prg_page() > 1? 0x7fff : 0x3fff; uint8_t NROM::readPT(uint16_t addr) { return chr_ram? CHR_RAM[addr & 0x1fff] : ines.readchr(addr & 0x1fff); uint8_t NROM::readBank(uint16_t addr) { return ines.readprg(addr & mask); uint8_t NROM::readNT(uint16_t addr) { return mirroing[(addr >> 10) & 3][addr & 0x3fff]; void NROM::writeNT(uint16_t addr, uint8_t v) { mirroring[(addr >> 10) & 3][addr & 0x3fff] = v; ROM VRAM enum MirroringType { Vertical, Horizontal ; void NROM::setMirrorType(MirroringType mt) { switch(mt) { case Vertical: mirroring[0] = &vram[0]; mirroring[1] = &vram[0x400]; mirroring[2] = &vram[0]; mirroring[3] = &vram[0x400]; break; case Horizontal: mirroring[0] = &vram[0]; mirroring[1] = &vram[0]; mirroring[2] = &vram[0x400]; mirroring[3] = &vram[0x400]; break;