What is this unused memory range in the Game Boy's memory map?

Question

Here is a basic memory map of the Game Boy's 16bit address bus:

0000-3FFF 16KB ROM Bank 00 (in cartridge, fixed at bank 00)
4000-7FFF 16KB ROM Bank 01..NN (in cartridge, switchable bank number)
8000-9FFF 8KB Video RAM (VRAM) (switchable bank 0-1 in CGB Mode)
A000-BFFF 8KB External RAM (in cartridge, switchable bank, if any)
C000-CFFF 4KB Work RAM Bank 0 (WRAM)
D000-DFFF 4KB Work RAM Bank 1 (WRAM) (switchable bank 1-7 in CGB Mode)
E000-FDFF Same as C000-DDFF (ECHO) (typically not used) 
FE00-FE9F Sprite Attribute Table (OAM)
FEA0-FEFF Not Usable
FF00-FF7F I/O Ports
FF80-FFFE High RAM (HRAM)
FFFF Interrupt Enable Register 

The memory at registers FEA0 to FEFF is labeled frequently as "not usable," "unused," or "empty but unusable for I/O." One page cryptically says:

$FEA0-$FEFF - Unused

And it'd be smart to leave it that way. =)

What is this memory range used for and why shouldn't developers touch it?

Answer 1

Calling it a "memory range" is incorrect - and possibly what is leading you astray. The entire range 0000-FFFF is called the "address range" of the CPU - you can write a CPU instruction (or three) that can access a bit, byte or word at any of those addresses. What the hardware does with that access depends on what hardware is "at" that address.

• The first 16K addresses into ROM Bank 0. There's an EPROM that will "read out" a byte if there's an access there - you can call that memory.
• The second 16K addresses into one of a number of ROM Banks, depending on whichever one is switched in via an I/O Port (see below). There's also an EPROM here (possibly the same one...) - you can call that memory too.
• The next 8K is Video RAM - write a value here and the screen may be changed (depending on whether that byte is on-screen at the moment or not). Definitely memory!
• The next 8K is true RAM - if it exists in the cartridge. Note that there's probably hardware to respond to an access at this address even if there's no RAM there (this hints at my final point below). But yes, that's memory - if it exists.
• The next 4K addresses real RAM inside the GameBoy - memory!
• The next 4K addresses more real RAM - which bank (of 7) depends on an I/O Port (see below). Memory!
• The next 7.5K are an "echo" of the previous two RAM windows. Accessing these (as is described) actually access that RAM - so there's accessible memory there, albeit not unique.
• The final 0.5K is, quite simply, not memory - except the 127 bytes of HRAM at FF80-FFFE.

What's in most of those bytes (not including the range you're talking about) are hardware registers that do various things when you read or write to the various bits. You could quite easily store a $A5 there, but get a $43 if you read it. Each of the bits mean something on the write, and the read may mean the same thing, or a completely different thing, for each bit. The point is, it's hardware dependent on a byte-by-byte basis as to the hardware that's "at" each memory location.

And that's the point about the "empty" range, and the caution there. If there's physically no hardware mapped to that address, then the low-level CPU access to that address goes... nowhere. And if the CPU does the read and then waits for an acknowledgement - there may not be hardware to provide the acknowledge. You could hang the CPU, in hardware, that only a reset or power cycle can fix.

That's what could happen in a more sophisticated CPU, with Bus transactions and multi-master arrangements. A Bus error is not a good situation there! But the CPU in the GameBoy doesn't have that, so it would simply read the "floating Bus" as a random byte - perhaps the last byte accessed? Who knows.

That's what I meant about the External RAM earlier. It'd be easy to imagine a program trying to access RAM that's not there, so the hardware should cater for that and respond anyway - but theoretically it'll be the cartridge program that's accessing it, and the cartridge should know how much RAM it has to give. So maybe not...

However, the piddly 96 bytes in that range? Would the rest of the hardware "know" that there's no hardware there and generate the acknowledge? Obviously not! Hence the caution - it's just bad practice to access addresses that don't have hardware "at" them.