Super Mario Bros 3 / Kaiser KS 202 chip

[krzysiobal]

During investigation of Kaiser custom chips (KS 204, KS 203), I've found some info about existence of yet anoter one (KS 202):

This page says that such cartridge should have mapper number 56 assigned. However, neither FCEUX nor wiki has any info about it.

Curious about the fact I started digging more and digged out some info and photos of that cartridge.

I starded analysing the connections and it seems to be quite fascinating. Except the KS 202 chip there is 6116 RAM which stores CHR ROM banks, exactly as this Contra cartridge.

Does anyone have ROM of that game or physical cartidge?

[MLX]

The KS202 chip is also present in the Super Mario Bros. 2 FDS port by Kaiser. Might be easier to trace it on that. I only have those poor quality photos however.

[krzysiobal]

Oh thank you, that helped a lot!

KS202's pinout seems to be:

Code: Select all

                .--\/--.
     CPU-A12 -> |01  20| -> WRAM-/CE
     CPU-A13 -> |02  19| <- CPU-D3
     CPU-A14 -> |03  18| <- CPU-R/W
         VCC -- |04  17| <- CPU-D0
          M2 -> |05  16| <- CPU-D1
     PRG-A14 <- |06  15| <- CPU-D2
     PRG-A13 <- |07  14| -- GND
     PRG-A15 <- |08  13| <- CPU-/ROMSEL
     PRG-A16 <- |09  12| <- RESET
     PRG-/CE <- |10  11| -> /IRQ
                `------'

How it function is unknown, but surely it can only be responsible for PRG banking (up to 128K), IRQ (probably counting CPU cycles), generating WRAM and PRG /CE signal (the last one is not used).

PAL pinout seems to be:

Code: Select all

                 .--\/--.
     CPU-A10  -> |01  20| -- VCC
     CPU-A11  -> |02  19| -> CIRAM-A10
CPU-A12&13&14 -> |03  18| -> PPU-A13
  CPU-/ROMSEL -> |04  17| -> MUX-RD/WR
  REG1-D4 (*) -> |05  16| -> CHR-/CE
      CPU-R/W -> |06  15| -> PRG2-/CE
       CPU-D0 <- |07  14| -> PRG1-/CE
      PPU-A10 -> |08  13| n/c (internal feedback)
      PPU-A11 -> |09  12| -> REG1-/GW (*)
          GND -- |10  11| <- PPU-/RD (filtered ??)
                 `------'

Its role is to:
* Add PRG-A17, stored in 74670 (*) and generate PRG1/CE, PRG2/CE
* Generate CHR /CE
* Generate CIRAM-A10 (internally latched D0),
* Generate signal controlling the 6116+74240+74157 CHR-ROM register

Doubts/notes:
* I am not sure which bit is used as PRG-A17 (logically should be CPU-D4, but the via under PRG-ROM can go to anything, maybe even address bit)
* Cant determine register addresses for PRG/CHR banking and IRQ
* 8x1k CHR-banks, not 2x2k+4x1k like in MMC3

[krzysiobal]

Oh, I found this ROM and a description of the mapper, other source claims this mapper is also called KS7022C.

The above mapper description does not quite match the hardware (for example: F000/F001/F003 select banks while KS202 does not have A0/A1 routed). After more analysis of the ROM it turned out that the KS202 chip has 8 registers ((mask $F000):

Code: Select all

*$8000 [....IIII] - set bits 3-0 of 16 bit IRQ counter
*$9000 [....IIII] - set bits 7-4 of 16 bit IRQ counter
*$a000 [....IIII] - set bits 11-8 of 16 bit IRQ counter
*$b000 [....IIII] - set bits 15-12 of 16 bit IRQ counter
*$c000 [.......E] - irq enable (FF, disable: 00), probably only bit0 of written value maters
*$d000 [........] - any write acknowledges pending IRQ
*$e000 [......RR] - set register number to update on writing to $f000
*$f000 [....PPPP] - set PRG bank:
                       00 -> no effect
                       01 -> $8000-$9fff
                       10 -> $a000-$bfff
                       11 -> $c000-$dfff
                       ($e000-$ffff always points to bank 15)

The value of each nibble of 16 bit counter is manipulated directly. It counts up and when overflows - IRQ is generated (if it it enabled).

Independently of the KS202, there is PAL16L8 + other logic (mask $FC00) with its job:

Code: Select all

mask $FC03:
  *$f000 [...P....] - select PRG-A17 (bit 5) for $8000-$9fff (1 on powerup)
  *$f001 [...P....] - select PRG-A17 (bit 5) for $a000-$bfff (1 on powerup)
  *$f002 [...P....] - select PRG-A17 (bit 5) for $c000-$dfff (1 on powerup)
  *$f003 [...P....] - select PRG-A17 (bit 5) for $e000-$ffff (1 on powerup)
mask $FC00:
  *$f800 [.......m] - select mirroring (0=H, 1=V)
mask $FC07:
  *$fc00 [.CCCCCCC] - select 1kB CHR for $0000-$03ff
  *$fc01 [.CCCCCCC] - select 1kB CHR for $0400-$07ff
  *$fc02 [.CCCCCCC] - select 1kB CHR for $0800-$0bff
  *$fc03 [.CCCCCCC] - select 1kB CHR for $0c00-$0fff
  *$fc04 [.CCCCCCC] - select 1kB CHR for $1000-$13ff
  *$fc05 [.CCCCCCC] - select 1kB CHR for $1400-$17ff
  *$fc06 [.CCCCCCC] - select 1kB CHR for $1800-$1bff
  *$fc07 [.CCCCCCC] - select 1kB CHR for $1c00-$1fff

* The game relies on fact that 74680 is initialized to 1 on powerup
* Writing to any of PAL regs also trigger write to KS202

[lidnariq]

After more analysis of the ROM it turned out that the KS202 chip has 8 registers

Code: Select all

*$8000 [....IIII] - set bits 3-0 of 16 bit IRQ counter
*$9000 [....IIII] - set bits 7-4 of 16 bit IRQ counter
*$a000 [....IIII] - set bits 11-8 of 16 bit IRQ counter
*$b000 [....IIII] - set bits 15-12 of 16 bit IRQ counter
*$c000 [.......E] - irq enable (FF, disable: 00), probably only bit0 of written value maters
*$d000 [........] - any write acknowledges pending IRQ
[...]
*$f000 [....PPPP] - set PRG bank:

This is impressively close to the VRC3's memory map. The pinout is also similar, but nowhere near as striking.

[krzysiobal]

So again, KS 202 chip used in those SMB3 and SMB2J are not identical, cause the first one enables RAM at while accessing $6000 and the other ROM (unless any bit in the $E000 register controls that).

BTW. I am wondering what's the role of this high-pass filter for PPU /RD


Something similar for PPU-A12 was in this asian SMB3J, but there it was used to filter? scanline clock, and here the only role of PAL is to generate CHR /CE = PPU-A13 or PPU /RD

So the PAL equations are probably:

Code: Select all

--or opposite
PRG1_nCE <= 0 when REG1_D4=0 and CPU_nROMSEL=0 and CPU_RnW=1 else 1
PRG2_nCE <= 0 when REG1_D4=1 and CPU_nROMSEL=0 and CPU_RnW=1 else 1

--no idea how it could ever work, cause every edge on PPU_nRD cause just short spike
CHR_nCE <= 0 when PPU_A13=0 and PPU_nRD=0 else 1 

REG1_nGW <= 0 when CPU_nROMSEL=0 and CPU_RnW=0 and CPU_A14&A13&A12=1 and CPU_A11=0 and CPU_A10=0 else 1

O1 <= CPU_D0 when  CPU_nROMSEL=0 and CPU_RnW=0 and CPU_A14&A13&A12=1 and CPU_A11=1 and CPU_A10=0 --latch

--not sure if CPU_nROMSEL is taken into account because 74157 already uses it
MUX_RDnWR <= 0 when CPU_nROMSEL=0 and CPU_RnW=0 and CPU_A14&A13&A12=1 and CPU_A11=1 and CPU_A10=1 else 1 

CIRAM_A10 <= PPU_A10 when O1=1 else PPU_A11

[lidnariq]

So again, KS 202 chip used in those SMB3 and SMB2J are not identical, cause the first one enables RAM at while accessing $6000 and the other ROM (unless any bit in the $E000 register controls that).

That's why the GAL is in charge of enabling ROMs in the SMB3 reproduction: so that it can not enable ROM and instead enable RAM. derp

[NewRisingSun]

Both SMB2J (Kaiser) and Bubble Bobble (Kaiser) once write $05 to $F000 after setting the unknown $E000 register 5 at reset. SMB3 once writes $10 to register 5 at reset, then sets $E000 to 6 to continuously write the high bits to the PAL. This suggests that register 5 is supposed to do something, while register 6 does nothing.

SMB2J (Kaiser) writes $05/$02/$00 to $C000, while SMB3 (Kaiser) writes $FF and $00 while still expecting a word counter and expecting that the IRQ is automatically disabled when generated. This means the VRC3-like functionality of bits 0 and 2 cannot apply, and therefore only bit 1 seems to matter as an IRQ-enable bit. (The $05 to $C000 in SMB2J's case is the same $05 that is also written to $F000 after writing $05 to $E000.)

With the KS202 being so close to the VRC3, we should expect there being a Kaiser bootleg reproduction of Salamander rather than of Life Force.

[lidnariq]

Since the KS202 has a /WRAMCE pin, maybe R5 controls whether the region at $6000 is ROM or RAM?

[NewRisingSun]

That should be testable indeed.

Also, I noticed that the Mapper 42 FDS conversion of "Ai Senshi Nicol" has write patterns that fit the KS202 perfectly. In fact that port runs fine as mapper 142 except that it also expects a CHR-ROM switch at $8000, which mapper 142 does not provide.

I had first thought that this port might actually use the KS202 chip but with some kind of additional CHR-ROM switch. But then I saw that there was CHR-RAM writing code that was jumped over. Now I think that the mapper 42 FDS conversion of Ai Senshi Nicol is a mere modification of an undumped actual Kaiser 142 FDS port of that game.

[NewRisingSun]

Here is a picture of a Japanese Salamander bootleg:

https://ct.yimg.com/xd/api/res/1.2/564i ... dfc724.jpg

It does use a Kaiser chip, but it's labelled KS 120 instead of the expected KS 202.

[krzysiobal]

This KS120 chip is just 128kB PRG MASK ROM (the other is 8kB PRG-RAM and 8kB CHR-RAM).
The whole mapper logic must be implemented using those small 74xx chips.

Code: Select all

          .--\/--. 
          |01  28| 
          |02  27| 
          |03  26| 
          |04  25| <- CPU A8
          |05  24| <- CPU A9
          |06  23| 
          |07  22| 
          |08  21| <- CPU A10
          |09  20| 
          |10  19| 
          |11  18| 
          |12  17| 
          |13  16| 
          |14  15| 
          `------' 
           KS 120

[lidnariq]

There's not enough state in the 74xx ICs to implement the VRC3. (At least 16+16+3+3+1 bits would be necessary; only 6+2+14+4 are visible)

I see
* 74'174 + 74'32 (VRC3's UNROM-style banking)
* 74'139 (register decode?)
* 74'00
* 74'74 (IRQ enable / firing?)
* 74'92 (divide-by-2 and divide-by-6)
* '4020 (14-bit ripple counter)

However ... Salamander itself seems to only ever set the VRC3 to generate an IRQ after 0x10000-0x9F00 = 0x6100 cycles. The 74'92, '4020, and 74'00 may just generating an IRQ after 0x60C0 cycles always.

[krzysiobal]

Can someone ask seller for photo of other side?
https://tw.bid.yahoo.com/item/%E7%B4%85 ... 6198264330

I am not even able to enter this site, it redirects me to yahoo.com saying that it won't meet EU privacy regulations.

[tepples]

I get [104043] 商品不存在，請重新選擇商品 which Google translates to "The item does not exist, please re-select the item"