Internal Registers

SOURCE: https://wiki.superfamicom.org/registers

NMI/IRQ Registers

NMITIMEN - Interrupt Enable Flags ($4200)

$4200

Byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

⍰ Rendering

7  bit  0
---- ----
n-yx ---a
| ||    |
| ||    +-- Auto-Joypad Read Enable.
| ||        When set, the registers $4218-$421f will be updated at about V Counter = $E3 (or presumably $F2).
| ||
| ++------- IRQ enable
|           0/0 = No IRQ will occur
|           0/1 = An IRQ will occur sometime just after the V Counter reaches the value set in $4209/$420A.
|           1/0 = An IRQ will occur sometime just after the H Counter reaches the value set in $4207/$4208.
|           1/1 = An IRQ will occur sometime just after the H Counter reaches the value set in $4207/$4208
|                 when V Counter equals the value set in $4209/$420A.
|
+---------- NMI Enable
            If clear, NMI will not occur. If set, NMI will fire just after the start of V-Blank. NMI fires
            shortly after the V Counter reaches $E1 (or presumably $F0 if overscan is enabled, see register $2133).

Some games try to read this register. However, they work only because open bus behavior gives them values they expect. This register is initialized to $00 on power on or reset.

HTIMEL/HTIMEH - H Timer low/high bytes ($4207/$4208)

$4207

Low byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

$4208

High byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

15     8 7      0
-------- --------
.......h hhhhhhhh

If bit 4 of $4200 is set and bit 5 is clear, an IRQ will fire every scanline when the H Counter reaches the value set here. If bits 4 and 5 are both set, the IRQ will fire only when the V Counter equals the value set in $4209/$420A. Note that the H Counter ranges from 0 to 339, thus greater values will result in no IRQ firing. HTIME is initialized to $1ff on power on, unchanged on reset.

VTIMEL/VTIMEL - V Timer low/high bytes ($4209/$420A)

$4209

Low byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

$420A

High byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

15     8 7      0
-------- --------
.......v vvvvvvvv

If bit 5 of $4200 is set and bit 4 is clear, an IRQ will fire just after the V Counter reaches the value set here. If bits 4 and 5 are both set, the IRQ will fire instead when the V Counter equals the value set here and the H Counter reaches the value set in $4207/$4208. Note that the V Counter ranges from 0 to 261 in NTSC mode (262 is possible every other frame whan interlace is active) and 0 to 311 in PAL mode (312 in interlace?), thus greater values will result in no IRQ firing. VTIME is initialized to $1ff on power on, unchanged on reset.

NMI Flag and 5A22 Version ($4210)

$4210

Byte

☑ Read

☐ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

7  bit  0
---- ----
nooo vvvv
|||| ||||
|||| ++++-- 5A22 chip version number
|+++------- Open bus
+---------- NMI Flag.

The NMI flag is set at the start of V-Blank (at the moment, we suspect when H-Counter is somewhere between $28 and $4E), and cleared on read or at the end of V-Blank. Supposedly, it is required that this register be read during NMI. Note that this bit is not affected by bit 7 of $4200. NMI is cleared on power on or reset.

TIMEUP - IRQ Flag ($4211)

$4211

Byte

☑ Read

☐ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

7  bit  0
---- ----
iooo oooo
|||| ||||
|+++ ++++-- Open Bus
+---------- IRQ Flag

This bit is set just after an IRQ fires (at the moment, it seems to have the same delay as the NMI Flag of $4210 has following NMI), and is cleared on read or write. Supposedly, it is required that this register be read during the IRQ handler. If this really is the case, then I suspect that that read is what actually clears the CPU’s IRQ line. This register is marked read/write in another doc, with no explanation. IRQ is cleared on power on or reset.

HVBJOY - PPU Status ($4212)

$4212

Byte

☑ Read

☐ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

NOTE: The values for the set/clear timing of the HBlank/VBlank bits appear to be wrong? The SNES Timing page gives different info (and that one seems correct)

7  bit  0
---- ----
vh.. ...a
||      +-- Auto-Joypad Status
||          This is set while Auto-Joypad Read is in progress, and cleared when complete.
||          It typically turns on at the start of V-Blank, and completes 3 scanlines later.
||
|+--------- H-Blank Flag
|           If we’re currently in H-Blank, this flag is set, otherwise it is clear.
|           The setting seems to occur at H Counter about $121-$122, and the clearing at about $12-$18.
|
+---------- V-Blank Flag
            If we’re currently in V-Blank, this flag is set, otherwise it is clear.
            The setting seems to occur at H Counter about $16-$17 when V Counter is $E1, and the clearing at about $1E with V Counter 0.

This register is marked read/write in another doc, with no explanation.

APU Registers

APUIO3 - APU I/O register 3

2140 rwb++++
2141 rwb++++
2142 rwb++++
2143 rwb++++
        xxxxxxxx

These registers are used in communication with the SPC700. Note that the value written here is not the value read back. Rather, the value written shows up in the SPC700’s registers $f4-7, and the values written to those registers by the SPC700 are what you read here. If the SPC700 writes the register during a read, the value read will be the logical OR of the old and new values. The exact cycles during which the ‘read’ actually occurs is not known, although a good guess would be some portion of the final 3 master cycles of the 6-cycle memory access. Note that these registers are mirrored throughout the range $2140-$217f.

WRAM Registers

WMDATA - WRAM Data read/write ($2180)

$2180

Byte

☑ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

This register reads to or writes from the WRAM address set in $2181-3. The address is then incremented. The effect of mixed reads and writes is unknown, but it is suspected that they are handled logically. Note that attempting a DMA from WRAM to this register will not work, WRAM will not be written. Attempting a DMA from this register to WRAM will similarly not work, the value written is (initially) the Open Bus value. In either case, the address in $2181-3 is not incremented.

WMADDL/M/H - WRAM Address low/middle/high bytes ($2181/$2182/$2183)

$2181

Low byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

$2182

Middle byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

$2183

High byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

23     16 15      8 7       0
---- ---- ---- ---- ---- ----
.... ...x xxxx xxxx xxxx xxxx

This is the 17-bit address that will be read or written by accesses to $2180. Note that WRAM is also mapped in the SNES memory space from $7E:0000 to $7F:FFFF, and from $0000 to $1FFF in banks $00 through $3F and $80 through $BF. Verious docs indicate that these registers may be read as well as written. However, they are wrong. These registers are open bus. DMA from WRAM to these registers has no effect. Otherwise, however, DMA writes them as normal. This means you could use DMA mode 4 to $2180 and a table in ROM to write any sequence of RAM addresses. The value does not wrap at page boundaries on increment.

Joypad registers

JOYSER0 / JOYSER1 ($4016/$4017)

JOYSER0 - NES-style Joypad Access Port 1 ($4016)

Byte

☑ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

Read ($4016/$4017):
7  bit  0
---- ----
.... ..ca
       |+-- State of the Data1 line.
       +--- State of the Data2 line.

Reading $4016 drives the Clock line of Controller Port 1 low.
The SNES then reads the Data1 and Data2 lines, and Clock is set back to high.


Write ($4016):
7  bit  0
---- ----
.... ...L
        +-- Writing this bit controls the Latch line of both controller ports. 
            When L is set, the Latch goes high (or is it low? At any rate, whichever one makes the pads latch their state). 
            When cleared, the Latch goes the other way.

JOYSER1 - NES-style Joypad Access Port 2 ($4017)

Byte

☑ Read

☐ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

7  bit  0
---- ----
...1 11db
       |+-- State of the Data1 line.
       +--- State of the Data2 line.

Reading $4017 drives the Clock line of Controller Port 2 low.

These registers basically have a direct connection to the controller ports on the front of the SNES. Note the 1-bits in $4017: the CPU chip has pins for these bits, but these pins are tied to Gnd and thus always 1.

Data for normal joypads is returned in the order: B, Y, Select, Start, Up, Down, Left, Right, A, X, L, R, 0, 0, 0, 0, then ones until latched again.

Note that Auto-Joypad Read (see register $4200) will effectively write 1 then 0 to bit ‘L’, then read 16 times from both $4016 and $4017. The ‘a’ bits will end up in $4218/9, with the first bit read (e.g. the B button) in bit 15 of the word. Similarly, the ‘b’ bits end up in $421a/b, the ‘c’ bits in $42c/d, and the ‘d’ bits in $421e/f. Any further bits the device may return may be read from $4016/$4017 as normal. The effect of reading these during auto-joypad read is unknown. See the section “CONTROLLERS” below for details.

JOYxL/JOYxH - Controller Port 1/2 Data 1/2 Register low/high byte ($4218 to $421F)

Low byte

☑ Read

☐ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

High byte

☑ Read

☐ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

15      8 7       0
---- ---- ---- ----
byet UDLR axlr 0000

a/b/x/y/l/r/e/t   = A/B/X/Y/L/R/Select/Start button status.
U/D/L/R           = Up/Down/Left/Right control pad status.
                    Note that only one of L/R and only one of U/D may be set, due to the pad hardware.

The bitmap above only applies for joypads, obviously. More generically, Auto Joypad Read effectively sets 1 then 0 to $4016, then reads $4016/7 16 times to get the bits for these registers. These registers are only updated when the Auto-Joypad Read bit (bit 0) of $4200 is set. They are being updated while the Auto-Joypad Status bit (bit 0) of $4212 is set. Reading during this time will return incorrect values. See the section “CONTROLLERS” below for details.

Multiplication / Division registers

WRMPYA / WRMPYB - Multiplicand A/B ($4202/$4203)

$4202/$4203

Byte

☐ Read

☑ Write

Access during:

☑ Forced blank

☑ Vertical blank

☑ Horizontal blank

☑ Rendering

7  bit  0
---- ----
mmmm mmmm

Write $4202, then $4203. 8 “machine cycles” (probably 48 master cycles) after $4203 is set, the product may be read from $4216/7. $4202 will not be altered by this process, thus a new value may be written to $4203 to perform another multiplication without resetting $4202. The multiplication is unsigned. $4202 holds the value $ff on power on and is unchanged on reset.

WRDIVB - Divisor B

4204  wl++++
4205  wh++++
        dddddddd dddddddd
4206  wb++++
        bbbbbbbb

Write $4204/5, then $4206. 16 “machine cycles” (probably 96 master cycles) after $4206 is set, the quotient may be read from $4214/5, and the remainder from $4216/7. Presumably, $4204/5 are not altered by this process, much like $4202. The division is unsigned. Division by 0 gives a quotient of $FFFF and a remainder of C. WRDIV holds the value $ffff on power on and is unchanged on reset.

RDDIVH - Quotient of Divide Result high byte

4214 r l++++
4215 r h++++
        qqqqqqqq qqqqqqqq

    Write $4204/5, then $4206. 16 "machine cycles" (probably 96 master
    cycles) after $4206 is set, the quotient may be read from these
    registers, and the remainder from $4216/7.
    
    The division is unsigned.

RDMPYH - Multiplication Product or Divide Remainder high byte

4216 r l++++
4217 r h++++
        xxxxxxxx xxxxxxxx

Write $4202, then $4203. 8 “machine cycles” (probably 48 master cycles) after $4203 is set, the product may be read from these registers. Write $4204/5, then $4206. 16 “machine cycles” (probably 96 master cycles) after $4206 is set, the quotient may be read from $4214/5, and the remainder from these registers. The multiplication and division are both unsigned.

Misc

WRIO - Programmable I/O port (out-port)

4201  wb++++
        abxxxxxx

This is basically just an 8-bit I/O Port. ‘b’ is connected to pin 6 of Controller Port 1. ‘a’ is connected to pin 6 of Controller Port 2, and to the PPU Latch line. Thus, writing a 0 then a 1 to bit ‘a’ will latch the H and V Counters much like reading $2137 (the latch happens on the transition to 0). When bit ‘a’ is 0, no latching can occur. Any other effects of this register are unknown. See $4213 for the I half of the I/O Port. Note that the IO Port is initialized as if this register were written with all 1-bits at power up, unchanged on reset(?).

RDIO - Programmable I/O port (in-port)

4213 r b++++
        abxxxxxx

Reading this register reads data from the I/O Port. The way the I/O Port works, any bit set to 0 in $4201 will be 0 here. Any bit set to 1 in $4201 may be 1 or 0 here, depending on whether any other device connected to the I/O Port has set a 0 to that bit. Bit ‘b’ is connected to pin 6 of Controller Port 1. Bit ‘a’ is connected to pin 6 of Controller Port 2, and to the PPU Latch line. See register $4201 for the O side of the I/O Port.

MEMSEL - ROM Access Speed

420d  wb++++
        -------f
               f = FastROM select.

The SNES uses a master clock running at about 21.477 MHz (current theory is 1.89e9/88 Hz). By default, the SNES takes 8 master cycles for each ROM access. If this bit is set and ROM is accessed via banks $80-$FF, only 6 master cycles will be used. This register is initialized to $00 on power on (or reset?). See my memory map and timing doc (memmap.txt) for more details.

????x - Unknown (x=0-7)

43xb rwb++++
43xf rwb++++
        ????????

The effects of these registers (if any) are unknown. $43xf and $43xb are really aliases for the same register. This register is set to $ff on power on, and is unchanged on reset.