Well, the 74HC161 chip is basically a 4 bit presettable counter, in the case of a NES mapper it's just used as a latch and the count option is never set (it was the easier way to get 4 flips-flops).
On a CNROM board, the outputs PRG D0 and PRG D1 are connected to the D0 and D1 '161 inputs, so the latches outpouts will "maitain" this value, this allow you to preset the CHR A13 and CHR A14 outpouts, in a software wiewpoint it allows you to swap 4 8kb CHR banks.
What about the two remaining latches, D2 and D3 ? They're connected to the PRG D4 and PRG D5, so, when writing to this mapper, not only the bits 0 and 1 matches, but the bits 4 and 5 are also connected to the mapper. I'm not totally sure of this, but the '161 outputs Q2 and Q3 are connected to CHR A11 and CHR A12. My question is : What does this means ?
For my wiewpoint, it would mean that writing, for example #$0x (where x is the CHR bank number 0-3) into the '161 mapper would only allow you to tiles $00-$7f in the first pattern table, and if the PPU is trying to read anything else, bus conflicts would appear. Here, if the '161 wons, it would just mirror the tiles $00-$7f in the first pattern table, else, if the PPU wons nothing particular would happen. Because thoose bus conflics could be here for the majority of the time, the '161 chip may simply burn.
To acess others tiles, writing another value into the mapper would be needed. For example, to read the tile section $00-$7f in the segond pattern table, writing #$2x in the mapper would be needed.
Of course, all this stuff above is a nonsense otherwise all the CNROM games out there wouldn't work. I tried to toggle thoose bits in emulation, but no emulators makes any diference.
Note : Some games does always clears thoose two bits, and others does always set them.
On a CNROM board, the outputs PRG D0 and PRG D1 are connected to the D0 and D1 '161 inputs, so the latches outpouts will "maitain" this value, this allow you to preset the CHR A13 and CHR A14 outpouts, in a software wiewpoint it allows you to swap 4 8kb CHR banks.
What about the two remaining latches, D2 and D3 ? They're connected to the PRG D4 and PRG D5, so, when writing to this mapper, not only the bits 0 and 1 matches, but the bits 4 and 5 are also connected to the mapper. I'm not totally sure of this, but the '161 outputs Q2 and Q3 are connected to CHR A11 and CHR A12. My question is : What does this means ?
For my wiewpoint, it would mean that writing, for example #$0x (where x is the CHR bank number 0-3) into the '161 mapper would only allow you to tiles $00-$7f in the first pattern table, and if the PPU is trying to read anything else, bus conflicts would appear. Here, if the '161 wons, it would just mirror the tiles $00-$7f in the first pattern table, else, if the PPU wons nothing particular would happen. Because thoose bus conflics could be here for the majority of the time, the '161 chip may simply burn.
To acess others tiles, writing another value into the mapper would be needed. For example, to read the tile section $00-$7f in the segond pattern table, writing #$2x in the mapper would be needed.
Of course, all this stuff above is a nonsense otherwise all the CNROM games out there wouldn't work. I tried to toggle thoose bits in emulation, but no emulators makes any diference.
Note : Some games does always clears thoose two bits, and others does always set them.