SMSARCH: A Sega Master System Cartridge Archiver

 

1.0 Introduction

 

The SMSARCH is a Sega Master System cartridge archiver. The device copies the contents of the cartridge ROM to a binary file by interfacing with a personal computer. The interface is through a 25-pin Centronics parallel port. One major design goal was to have the device’s hardware be as simple as possible. Therefore, most of the SMSARCH’s control is implemented in software. The software uses the parallel port’s control lines to communicate with the SMSARCH’s hardware. Also, the software makes special use of the parallel port’s printer status lines, allowing the SMSARCH to be used with any parallel port (a bi-directional port is not necessary). The software is written in C++.

 

 

2.0 Sega Master System Technical Overview

 

The Sega Master System (SMS) is an 8-bit video-game console that was introduced in the U.S. in 1986. The console uses a Z80 microprocessor as its main processor. The SMS has 8 kilobytes of program RAM and 16 kilobytes of video RAM. Additionally, the SMS can handle ROM’s up to 4 Megabits (512 kilobytes). Only the program RAM and cartridge ROM areas are directly addressed by the Z80 microprocessor. The video RAM is addressed through hardware ports. Accessing a cartridge’s entire ROM area requires special paging due to the Z80’s limited 16-bit address size. The SMSARCH emulates the functions of the SMS’s paging hardware allowing it to access all of a cartridge’s ROM contents.

 

 

2.1 The Sega Master System’s Paging Scheme

 

The SMS’s main processor, the Z80, can address up to 64 kilobytes of memory (the Z80 supports 16-bit addresses). Some of the memory is mapped to RAM, and some is mapped to ROM. This ROM is the game ROM. Sega Master System ROM’s comes in two forms. The first are ROM cards, (or "Sega Cards"), that are physically about the size of credit cards. These compact ROM’s can hold 32 kilobytes of data. The most popular ROM format for the SMS, however, is cartridges. Cartridges come in 1, 2, and 4 megabit (128, 256, and 512 kilobyte) sizes. Because the ROM cartridges can be much larger than 64 kilobytes, the SMS makes use of a special paging scheme that maps 16-kilobyte pages into 16-kilobyte frames in main memory. The main memory map is shown in figure 1.

The SMS uses three 16-kilobyte frames, allowing a total of 48 kilobytes of ROM to be "visible" at a time. Therefore, although an entire ROM card’s memory is visible at any time, only a fraction of the total ROM on a cartridge is visible. To access the entire contents of a ROM cartridge it is necessary to swap pages in and out of the frames, as they are needed. This is accomplished through three "Frame Control Registers," or FCR’s. The FCR’s are located at addresses 0xFFFD, 0xFFFE, 0xFFFF hexadecimal. Writing the desired page number to these registers will cause that page to appear in the respective frame. Note, that in practice, the largest number ever written to these registers is 31 (addressing starts at 0), because the largest cartridge ever manufactured was 4 megabits (512 kilobytes, or 32 16-kilobyte pages). However, because they are 8-bit registers, it is very likely that the SMS could support cartridges with as many as 256 pages. This would yield cartridges with sizes up to 32 megabits (4 megabytes). Another point is that the FCR’s are physically located on the cartridge. This can lead to differences in the way the actual paging mechanism works, depending on the cartridge. As we will see later, this is exactly the case. The general paging scheme mentioned in this paragraph is made slightly more complicated depending on the size of a cartridge, as discussed in the section titled ‘How Cartridges Handle Paging.’

 

Starting Address (hexadecimal)

Description

0x0000

First 1 kilobyte of ROM page 0

0x0400

Frame 0, (Last 15 kilobytes, first kilobyte is always from page 0)

0x4000

Frame 1

0x8000

Frame 2

0xC000

Program RAM

0xE000

Mirror of Program RAM (minus last four bytes)

0xFFFC

Control byte for Frame 2 (described below)

0xFFFD

Page to go into Frame 0. (Only last 15 kilobytes of selected page. The first kilobyte is always from ROM page 0.)

0xFFFE

Page to go into Frame 1

0xFFFF

Page to go into Frame 2

 

Figure 1: Sega Master System Main Memory Map

 

There are other complications as well. Notice that Frame 0 is really only a 15-kilobyte frame. When the system is powered on, the values of the FCR’s can not be controlled. Therefore, a known area of ROM must be provided so the system can initialize itself. By forcing the first 1-kilobyte of memory to always point to ROM page 0, the system always knows where its start-up code is, regardless of the contents of the FCR’s. Consequently, any initialization and start-up code must be placed in the first 1 kilobyte of ROM page 0. Although this is an effective way of guaranteeing proper power up, it limits the usefulness of frame 0. Only the last 15 kilobytes of any page mapped into frame 0 will be available. The first kilobyte will always be from ROM page 0.

The SMS has the capability of including "Battery-backed-up RAM" on a cartridge. This allows the user to save the current game on the cartridge, and continue even after the console’s power has been turned off. Accessing this RAM is accomplished using Frame 2. The FCR 0xFFFC controls whether Frame 2 will contain a page of ROM or a page of battery-backed-up RAM. Only Frame 2 has this feature. The bit fields for 0xFFFC are shown in figure 2.

 

Bit Field

Function

7-4

Unknown

3

16K RAM or ROM (0=ROM, 1=RAM)

2

RAM page 0 or 1

1-0

Unknown

 

Figure 2: Bit Fields in Register 0xFFFC

 

As mentioned before, the SMS’s Program RAM is also mapped into main memory. There are 8 kilobytes of Program RAM starting at address 0xC000. This RAM is assumed to hold any data or storage the program requires while running. It is unlikely that this area holds program code, since the code can be read directly from the ROM. Also, since any graphics would be stored in video memory, the Program RAM seems limited to general program data (such as state information). Finally, the area from 0xE000 to 0xFFFB (inclusive) is unused. The hardware simply maps this area back into the Program RAM.

 

 

2.2 How Cartridges Handle Paging

 

As mentioned earlier, an individual cartridge can slightly alter the paging mechanism since the paging hardware is actually embedded in the ROM chip, not the console hardware. This really doesn’t lead to any problems since the software controlling the paging (i.e., what values to write to which FCR) is also on the chip. The software knows what kind of ROM chip it is embedded in, so it knows the paging mechanism the chip uses. Fortunately, all paging differences result only from the size of the ROM. So, paging is slightly more complicated than explained in section 2.1, but not unreasonable if the size of the ROM is known.

According to the previous section, only the first 1K of ROM page 0 is available on power up. The reason is because the values in the FCR’s are not known. However, it appears that cartridges make the provision that Frame 0 includes page 0, and Frame 1 includes page 1 on start-up. This greatly simplifies accessing the first 32 kilobytes; no writes to the FCR’s are necessary. Therefore, in practice, the first 2 pages are available immediately after power-up.

Accessing the remaining pages requires using the FCR’s. The general paging scheme mentioned in section 2.1 indicates that any page can be mapped into any frame. It appears, however, that depending on the size of the cartridge ROM, only certain frames can be used.

 

Cartridge Type

Frame used for Paging (all pages except 0 and 1)

One-Mega (128 kilobyte)

Frame 2

Two-Mega (256 kilobyte)

Frame 1

Four-Mega (512 kilobyte)

Frame 1

 

Figure 3: Cartridge Framing Scheme

 

According to figure 3, then, all of the remaining pages in a "One-Mega" cartridge should be mapped into Frame 2 using FCR 0xFFFF. Likewise, for two and four mega cartridges, all remaining pages are mapped into Frame 1 using FCR 0xFFFE.

 

2.3 The Cartridge Socket Interface

 

The cartridge interfaces with the Master System console (or SMSARCH) through a 50-pin card-edge connector. The signals attributed to each line are shown in figure 4. Those signals slightly shaded represent signals that are not needed to retrieve information from the cartridge. They seem to be processor signals, and were probably intended for more advanced connections (possibly to a peripheral). Also, some of the un-shaded signals are only used by certain manufacturer’s cartridges. The designer of the SMSARCH doesn’t have access to these cartridges, so they are not part of the SMSARCH design. The unused signals are Mreq, ~ROM/RAM, and Clock, their use will not be discussed in this document. The signals that are used by the SMSARCH are explained below:

 

WR: This is the write signal. This signal should be asserted (made high) whenever writing to the FCR’s. The WR signal should be low at all other times.

 

~CrtOe: This is the cartridge output enable signal. It is an active low signal, and should be low whenever reading from the cartridge. The signal should be high at all other times.

 

~Reset: This signal resets the cartridge. This signal is an active low signal and is pulsed low only once by the SMSARCH control software during initialization. The Reset signal is held high at all other times.

 

~M0-7: This signal indicates to the cartridge that the memory area 0x0000 through 0x7FFF is currently being accessed. This seems to be redundant, because this information is also contained in the address lines. However, certain cartridges don’t contain address line 15, so this signal becomes important. For consistency, the SMSARCH forces this signal low when reading memory from address 0x0000 through 0x7FFF for all cartridges. The signal is held high at all other times.

 

~M8-B: This signal is similar to ~M0-7. It is held low when accessing memory from 0x8000 through 0xBFFF. Note that this only occurs when reading "One-Mega" cartridges, since this area is Frame 2. The signal is held high at all other times.

 

~MC-F: This signal is also similar to ~M0-7. It should be held low when accessing memory from 0xC000 through 0xFFFF. The only time this signal is ever forced low is when writing to the FCR’s. The signal is held high at all other times.

 

 

Back

     

Front

+5 Volts

1

 

2

WR

Mreq

3

 

4

~ROM/RAM

~M8-B

5

 

6

Address14

Address13

7

 

8

Address8

Address9

9

 

10

Address11

~M0-7

11

 

12

Address10

~CrtOE

13

 

14

Data7

Data6

15

 

16

Data5

Data4

17

 

18

Data3

GROUND

19

 

20

GROUND

GROUND

21

 

22

Data2

Data1

23

 

24

Data0

Address0

25

 

26

Address1

Address2

27

 

28

Address3

Address4

29

 

30

Address5

Address6

31

 

32

Address7

Address12

33

 

34

UNKNOWN

+5 Volts

35

 

36

Address15

M1

37

 

38

I/Oreq

Refresh

39

 

40

Halt

Wait

41

 

42

Int

JyDs

43

 

44

BusReq

BusAck

45

 

46

~Reset

Clock

47

 

48

Jread

~MC-F

49

 

50

NMI

 

Figure 4: Cartridge Socket Pin Layout

 

The data lines (Data0 - Data7) are bi-directional. A value can be safely read from or written to these lines. However, the only time the data lines should be driven is when the FCR’s are being addressed. The address lines (Address0 - Address15) are write only lines. The result of reading these lines is unclear, and is not recommended.

 

 

3.0 The SMSARCH

 

So far, the discussion has focused on the Sega Master System. The information provided above should be sufficient to allow people so motivated to design their own SMS cartridge archiver. Now, however, the discussion will focus on the SMSARCH’s hardware and software. This section discusses every aspect of the SMSARCH’s design and use.

 

3.1 The SMSARCH’s Hardware

 

Currently the hardware is implemented in CMOS logic (74HCTXXX series).

(To be completed)

 

3.2 The SMSARCH’s Software

 

(To be completed)