Start End Description
0x000000 0x0027FF RAM
0x002800 0x002FFF PPU
0x003000 0x0037FF Sound
0x003D00 0x003DFF IO
0x003E00 0x003E03 DMA

External memory starts at 0x4000. It can be mapped to the internal ROM and the two possible chips in the cartridges.

FIXME Document how to manipulate the banking (using GPIOs?)

IO registers

Address Contents
3D00 IO configuration
3D01-3D05 IOA registers
3D06-3D0A IOB registers
3D0B-3D0F IOC registers
1/6/B IOx data
2/7/C IOx buffer
3/8/D IOx direction
4/9/E IOx attributes
5/A/F IOx mask

Each IO port is configured by 4 registers.

The direction register is 0 for input pins, 1 for output pins.

Global configuration register

  • Bit 0: IOA special functions select
  • Bit 1: IOB special functions select

These two bits allow to select one of two special functions for the IOA and IOB registers. Then each pin in that IO register can be switched between normal GPIO and special function using the MASK register.

For IOA, special = 0 selects the TFT display interface, special = 1 selects the STN LCD interface and I2S audio output.

For IOB, only special = 0 is documented and it selects the CSB0, CSB1, CSB2 chip select pins for external memory (further configured by port 3D23)

  • Bit 2: IOA Wakeup enable
  • Bit 3: IOB Wakeup enable
  • Bit 4: IOC Wakeup enable

These bits enable system wakeup from sleep mode from activity on the corresponding IO ports. A typical setup on the V.Smile is to enable wakeup on port B to detect when the ON button is pressed.

Input pins configuration

If the attribute bit for a pin is 0, the data bit can be used to set a pull up or pull down resistor on the pin.

If the attribute bit is 1, the pin is floating without pull up or pull down.

It is possible to read both the internal buffer and the actual state of the pin.

Output pins configuration

If the attribute bit for a pin is 0, the output is inverted. Writing 1 to the data bit results in a logic 0 output. If the data bit is set to 0, the result is a logic 1 output.

If the attribute bit is 1, there is no inversion, and the data bit is output as is.


Address Contents
3D10 Timebase setup
3D11 Timebase clear
3D12 TimerA Data
3D13 TimerA Control: output_pulse_ctrl (bits 9-6), source B select bits (5-3), source A select bits (2-0)
3D14 TimerA enable (bit 0)
3D15 TimerA IRQ clear (bit 0)
3D16 TimerA DATA
3D17 TimerB Control: output_pulse_ctrl (bits 9-6), source C select bits (bits 2-0)
3D18 TimerB enable (bit0)
3D19 TimerB IRQ clear (bit0)
3D1C Scanline counter

Timebase setup values:

  • Bits 3-2: TMB2 frequency
    • 00 - 128 Hz
    • 01 - 256 Hz
    • 10 - 512 Hz
    • 11 - 1024 Hz
  • Bits 1-0: TMB1 frequency
    • 00 - 8 Hz
    • 01 - 16 Hz
    • 10 - 32 Hz
    • 11 - 64 Hz

Timer A

Timer A ticks on the rising edge of the AND of sources A and B (so one source can be used to mask the other).

The counter is incremented at each tick until it reaches FFFF and overflows.

Reading the data register allows to know the current timer value.

When the timer overflows, several things happen:

  • An interrupt is triggered (if activated)
  • The FTAOUT pin is toggled
  • The counter is reloaded to the last value written to the data register
  • The 4 bit counter for PWM generation is incremented

Control register bits 2-0: Source A

  • 00x: Timer disabled
  • 010: 32768Hz
  • 011: 8192Hz
  • 100: 4096Hz
  • 101: 1 (use source B only)
  • 110: Timer disabled
  • 111: EXT1

Control register bits 5-3: Source B

  • 000: 2048Hz
  • 001: 1024Hz
  • 010: 256Hz
  • 011: TMB1
  • 100: 4Hz
  • 101: 2Hz
  • 110: 1 (use source A only)
  • 111: EXT2

Control register bits 9-6: output pulse control

This configure the pulse width from 0 to 15 timer ticks. A new pulse starts every 16 ticks.

Misc. peripherals

Address Contents
3D20 System Control
3D21 Interrupts control
3D22 Interrupt status (read)/ clear (write)
3D23 External Memory Control
3D24 Watchdog clear (write 55AA)
3D25 ADC Control
3D27 ADC data
3D28 Sleep Mode (write AA55)
3D29 Wakeup Source
3D2A Wakeup Time
3D2B TV System (read only, bit0 indicaters NTSC or PAL)
3D2C Pseudo Random1
3D2D Pseudo Random2
3D2E FIQ Sel
3D2F DS register (sets or gets data segment value of CPU status register)

System control

  • Bit 15: enable watchdog
  • Bit 14: enable sleep
  • Bit 9: Low-voltage regulator output enable
  • Bit 8: Low-voltage regulator enable
  • Bit 7: #2V out
  • Bits 6-5: Low-voltage regulator voltage select
  • Bit 4: 32KHz clock
  • Bit 2: Video DAC enable
  • Bit 1: Audio DAC enable


The three interrupt registers have the same layout:

  • Bit 13: ADC (interrupt vector is at FFFB)
  • Bit 12: External interrupt 2 (FFFD)
  • Bit 11: Timer A (FFFA)
  • Bit 10: Timer B (FFFA)
  • Bit 9: External interrupt 1 (FFFD)
  • Bit 8: UART (FFFB)
  • Bit 7: Key change (FFFF)
  • Bit 6: 4096Hz (FFFE)
  • Bit 5: 2048Hz (FFFE)
  • Bit 4: 1024Hz (FFFE)
  • Bit 3: 4Hz (FFFF)
  • Bit 1: TMB1 (FFFF)
  • Bit 0: TMB2 (FFFF)

There are interrupts coming from devices, which have separate enable bits in each of the devices.

The complete list of interrupt vectors is:

Vector address Name Triggered by
FFF5 BREAK break CPU instruction
FFF6 FIQ configured by 3D2E
FFF7 RESET Console startup/reset
FFFA IRQ2 Timers A and B
FFFC IRQ4 SPU beat and envelope
FFFD IRQ5 External interrupts
FFFE IRQ6 1024, 2048 or 4096Hz ticker
FFFF IRQ7 4Hz ticker, Timebase 1, Timebase 2, Low voltage detect, Key change

As the vector addresses are only 16-bit, they can only point to the first segment (0x0000 - 0xFFFF).

External bus configuration

  • Bits 11-8: External RAM decode control
    • 0xxx - No mapping
    • 1000 - Map 0x3ff000 - 0x3fffff to RAMCSB (4 kibiwords)
    • 1001 - Map 0x3fe000 - 0x3fffff to RAMCSB (8 kibiwords)
    • 1010 - Map 0x3fc000 - 0x3fffff to RAMCSB (16 kibiwords)
    • 1011 - Map 0x3f8000 - 0x3fffff to RAMCSB (32 kibiwords)
    • 1100 - Map 0x3f0000 - 0x3fffff to RAMCSB (64 kibiwords)
    • 1101 - Map 0x3e0000 - 0x3fffff to RAMCSB (128 kibiwords)
    • 1110 - Map 0x3c0000 - 0x3fffff to RAMCSB (256 kibiwords)
    • 1111 - Map 0x380000 - 0x3fffff to RAMCSB (512 kibiwords)
  • Bits 7-6: ROM address decode control
    • 00 - Map entire range to ROMCSB
    • 01 - Map 0x4000 - 0x1fffff to ROMCSB, 0x200000 - 0x3fffff to CSB1
    • 1x - Map 0x4000 - 0x0fffff to ROMCSB, 0x100000 - 0x1fffff to CSB1, 0x200000 - 0x2fffff to CSB2, 0x300000 - 0x3fffff to CSB1
  • Bits 5-3: Bus arbitration priority control
    • 101 - 1. Audio, 2. PPU, 3. CPU
    • 111 - 1. PPU, 2. Audio, 3. CPU
  • Bits 2-1: Number of wait states
  • Bit 0: CKOEN

External RAM mapping overrides any ROM mapping.


Control register:

  • Bit 13: interrupt status
  • Bit 12: request conversion
  • Bit 10: auto request
  • Bit 9: interrupt enable
  • Bit 8: VRT enable
  • Bits 5-4: select channel
  • Bits 3-2: clock select
  • Bit 1: CSB
  • Bit 0: ADE


Wakeup source:

  • Wakeup source: same layout as the interrupt registers, but only the 8 low bits are available?
  • Wakeup time: number of 32kHz clock cycles (8 bits)
  • Sleep: write AA55 here to start sleeping. CPU will be halted until the next wakeup event.

Pseudo random generators

There are two generators using the formula f(x) = x^15+x^14+1.

The first one has a default seed = 001_0100_0001_1000 The second one has a default seed = 001_0110_0101_1000

You can write the registers to set a new seed.


There can only be a single FIQ source active at a time. This register selects which one.

  • 000: PPU
  • 001: SPU
  • 010: TimerA
  • 011: TimerB
  • 100: UART(SPI)
  • 101: External
  • 110: ADC
  • 111: None

DS register

This allows direct read and write access to the DS (Data Segment) register. Normally in the uN'SP architecture, this register is part of the CPU SR register. However, this makes it unconvenient to change its value. This memory mapped version of the register can be used with usual CPU instructions to set and use the DS value more conveniently.


All UART registers are 8bit only.

Address Contents
3D30 UART Control (7: TxEn, 6: RxEn, 5: Mode, 4: MulPro, 3-2: bits per byte, 1: Tx Interrupt Enable, 0: Rx Interrupt Enable
3D31 UART Status (7: Rx buffer full, 6: Tx busy, 5: bit9, 4: overrun, 3: frame error, 2: parity, 1: tx ready, 0: rx ready
3D32 UART Reset (bit 0)
3D33 UART Baudrate setting (low byte)
3D34 UART Baudrate setting (high byte)
3D35 UART Tx buffer
3D36 UART Rx buffer

Baudrate settings:

  • 1200: FA 92
  • 2400: FD 41
  • 4800: FE A0
  • 9600: FF 50
  • 19200: FF A8
  • 57600: FF E2
  • 115200: FF F1

Before using the UART, the corresponding PINs need to be configured properly. IOC13 and IOC14 must be set to “special”/“mask” mode to disable the GPIO and assign the pin to UART. The example below also forces CTS A (IOC8) low, allowing the first controller port to transmit data. Normally this would only be done after receiving an RTS from said controller.

// Enable controller CTS
*PORTC_DIR = 0x89c0;
*PORTC_ATTR = 0x89c0;
*PORTC_DATA = 0xf77f;

// Enable Uart RX (controller input)

*PORTC_SPECIAL |= 0x6000; // UART Tx and Rx in "special" mode
*PORTC_ATTR |= 0x6000;
*PORTC_DIR |= 0x4000;

Reading from the UART then is quite simple:

  • Wait until the status register indicates Rx ready (bit 0)
  • When Rx is ready, read the Rx data register to get the byte

For transmitting, you need to check if the FIFO is cleared (bit 1 of status register) then you can push your bytes to the transmit register.


Address Contents
3D40 SPI Control (bit 8: busy, bit 7: tx empty, bit 6: rx full, bit 5: SPH, bit 4: SPO, bit 3: SPIEN, bit 2: LPM, bit 1: Tx Interrupt Enable, bit 0: Rx Interrupt Enable)
3D41 SPI Data (write to send, read to receive)

General DMA

Address Contents
3E00 DMA Source address
3E01 DMA Source segment
3E02 DMA word count
3E03 DMA Target Address (14 bits)

This is a DMA for generic purposes. Note that there is another DMA channel in the PPU registers.

Both DMA units operate in the same way. First, set the source and destination addresses. The source can be anywhere in memory, but the destination register is only 14 bits wide, which allows to target only the internal RAM and IO registers (you wouldn't write to ROM, would you?).

The transfer is started when you write the word count register, and you can read that register to know when the transfer is done (the register is 0 when there are no more words to transfer).

memory_map.txt · Last modified: 2022/08/19 10:48 by pulkomandy
CC Attribution 4.0 International
Driven by DokuWiki Recent changes RSS feed Valid CSS Valid XHTML 1.0