SMSARCH: A Sega Master System Cartridge Archiver
1.0 Introduction
The SMSARCH is a Sega Master System cartridge archiver. The device copies the contents of the cartridge ROM to a binary file by interfacing with a personal computer. The interface is through a 25-pin Centronics parallel port. One major design goal was to have the device’s hardware be as simple as possible. Therefore, most of the SMSARCH’s control is implemented in software. The software uses the parallel port’s control lines to communicate with the SMSARCH’s hardware. Also, the software makes special use of the parallel port’s printer status lines, allowing the SMSARCH to be used with any parallel port (a bi-directional port is not necessary). The software is written in C++.
2.0 Sega Master System Technical Overview
The Sega Master System (SMS) is an 8-bit video-game console that was introduced in the U.S. in 1986. The console uses a Z80 microprocessor as its main processor. The SMS has 8 kilobytes of program RAM and 16 kilobytes of video RAM. Additionally, the SMS can handle ROM’s up to 4 Megabits (512 kilobytes). Only the program RAM and cartridge ROM areas are directly addressed by the Z80 microprocessor. The video RAM is addressed through hardware ports. Accessing a cartridge’s entire ROM area requires special paging due to the Z80’s limited 16-bit address size. The SMSARCH emulates the functions of the SMS’s paging hardware allowing it to access all of a cartridge’s ROM contents.
2.1 The Sega Master System’s Paging Scheme
The SMS’s main processor, the Z80, can address up to 64 kilobytes of memory (the Z80 supports 16-bit addresses). Some of the memory is mapped to RAM, and some is mapped to ROM. This ROM is the game ROM. Sega Master System ROM’s comes in two forms. The first are ROM cards, (or "Sega Cards"), that are physically about the size of credit cards. These compact ROM’s can hold 32 kilobytes of data. The most popular ROM format for the SMS, however, is cartridges. Cartridges come in 1, 2, and 4 megabit (128, 256, and 512 kilobyte) sizes. Because the ROM cartridges can be much larger than 64 kilobytes, the SMS makes use of a special paging scheme that maps 16-kilobyte pages into 16-kilobyte frames in main memory. The main memory map is shown in figure 1.
The SMS uses three 16-kilobyte frames, allowing a total of 48 kilobytes of ROM to be "visible" at a time. Therefore, although an entire ROM card’s memory is visible at any time, only a fraction of the total ROM on a cartridge is visible. To access the entire contents of a ROM cartridge it is necessary to swap pages in and out of the frames, as they are needed. This is accomplished through three "Frame Control Registers," or FCR’s. The FCR’s are located at addresses 0xFFFD, 0xFFFE, 0xFFFF hexadecimal. Writing the desired page number to these registers will cause that page to appear in the respective frame. Note, that in practice, the largest number ever written to these registers is 31 (addressing starts at 0), because the largest cartridge ever manufactured was 4 megabits (512 kilobytes, or 32 16-kilobyte pages). However, because they are 8-bit registers, it is very likely that the SMS could support cartridges with as many as 256 pages. This would yield cartridges with sizes up to 32 megabits (4 megabytes). Another point is that the FCR’s are physically located on the cartridge. This can lead to differences in the way the actual paging mechanism works, depending on the cartridge. As we will see later, this is exactly the case. The general paging scheme mentioned in this paragraph is made slightly more complicated depending on the size of a cartridge, as discussed in the section titled ‘How Cartridges Handle Paging.’
Starting Address (hexadecimal) |
Description |
0x0000 |
First 1 kilobyte of ROM page 0 |
0x0400 |
Frame 0, (Last 15 kilobytes, first kilobyte is always from page 0) |
0x4000 |
Frame 1 |
0x8000 |
Frame 2 |
0xC000 |
Program RAM |
0xE000 |
Mirror of Program RAM (minus last four bytes) |
0xFFFC |
Control byte for Frame 2 (described below) |
0xFFFD |
Page to go into Frame 0. (Only last 15 kilobytes of selected page. The first kilobyte is always from ROM page 0.) |
0xFFFE |
Page to go into Frame 1 |
0xFFFF |
Page to go into Frame 2 |
Figure 1: Sega Master System Main Memory Map
There are other complications as well. Notice that Frame 0 is really only a 15-kilobyte frame. When the system is powered on, the values of the FCR’s can not be controlled. Therefore, a known area of ROM must be provided so the system can initialize itself. By forcing the first 1-kilobyte of memory to always point to ROM page 0, the system always knows where its start-up code is, regardless of the contents of the FCR’s. Consequently, any initialization and start-up code must be placed in the first 1 kilobyte of ROM page 0. Although this is an effective way of guaranteeing proper power up, it limits the usefulness of frame 0. Only the last 15 kilobytes of any page mapped into frame 0 will be available. The first kilobyte will always be from ROM page 0.
The SMS has the capability of including "Battery-backed-up RAM" on a cartridge. This allows the user to save the current game on the cartridge, and continue even after the console’s power has been turned off. Accessing this RAM is accomplished using Frame 2. The FCR 0xFFFC controls whether Frame 2 will contain a page of ROM or a page of battery-backed-up RAM. Only Frame 2 has this feature. The bit fields for 0xFFFC are shown in figure 2.
Bit Field |
Function |
7-4 |
Unknown |
3 |
16K RAM or ROM (0=ROM, 1=RAM) |
2 |
RAM page 0 or 1 |
1-0 |
Unknown |
Figure 2: Bit Fields in Register 0xFFFC
As mentioned before, the SMS’s Program RAM is also mapped into main memory. There are 8 kilobytes of Program RAM starting at address 0xC000. This RAM is assumed to hold any data or storage the program requires while running. It is unlikely that this area holds program code, since the code can be read directly from the ROM. Also, since any graphics would be stored in video memory, the Program RAM seems limited to general program data (such as state information). Finally, the area from 0xE000 to 0xFFFB (inclusive) is unused. The hardware simply maps this area back into the Program RAM.
2.2 How Cartridges Handle Paging
As mentioned earlier, an individual cartridge can slightly alter the paging mechanism since the paging hardware is actually embedded in the ROM chip, not the console hardware. This really doesn’t lead to any problems since the software controlling the paging (i.e., what values to write to which FCR) is also on the chip. The software knows what kind of ROM chip it is embedded in, so it knows the paging mechanism the chip uses. Fortunately, all paging differences result only from the size of the ROM. So, paging is slightly more complicated than explained in section 2.1, but not unreasonable if the size of the ROM is known.
According to the previous section, only the first 1K of ROM page 0 is available on power up. The reason is because the values in the FCR’s are not known. However, it appears that cartridges make the provision that Frame 0 includes page 0, and Frame 1 includes page 1 on start-up. This greatly simplifies accessing the first 32 kilobytes; no writes to the FCR’s are necessary. Therefore, in practice, the first 2 pages are available immediately after power-up.
Accessing the remaining pages requires using the FCR’s. The general paging scheme mentioned in section 2.1 indicates that any page can be mapped into any frame. It appears, however, that depending on the size of the cartridge ROM, only certain frames can be used.
Cartridge Type |
Frame used for Paging (all pages except 0 and 1) |
One-Mega (128 kilobyte) |
Frame 2 |
Two-Mega (256 kilobyte) |
Frame 1 |
Four-Mega (512 kilobyte) |
Frame 1 |
Figure 3: Cartridge Framing Scheme
According to figure 3, then, all of the remaining pages in a "One-Mega" cartridge should be mapped into Frame 2 using FCR 0xFFFF. Likewise, for two and four mega cartridges, all remaining pages are mapped into Frame 1 using FCR 0xFFFE.
2.3 The Cartridge Socket Interface
The cartridge interfaces with the Master System console (or SMSARCH) through a 50-pin card-edge connector. The signals attributed to each line are shown in figure 4. Those signals slightly shaded represent signals that are not needed to retrieve information from the cartridge. They seem to be processor signals, and were probably intended for more advanced connections (possibly to a peripheral). Also, some of the un-shaded signals are only used by certain manufacturer’s cartridges. The designer of the SMSARCH doesn’t have access to these cartridges, so they are not part of the SMSARCH design. The unused signals are Mreq, ~ROM/RAM, and Clock, their use will not be discussed in this document. The signals that are used by the SMSARCH are explained below:
WR: This is the write signal. This signal should be asserted (made high) whenever writing to the FCR’s. The WR signal should be low at all other times.
~CrtOe: This is the cartridge output enable signal. It is an active low signal, and should be low whenever reading from the cartridge. The signal should be high at all other times.
~Reset: This signal resets the cartridge. This signal is an active low signal and is pulsed low only once by the SMSARCH control software during initialization. The Reset signal is held high at all other times.
~M0-7: This signal indicates to the cartridge that the memory area 0x0000 through 0x7FFF is currently being accessed. This seems to be redundant, because this information is also contained in the address lines. However, certain cartridges don’t contain address line 15, so this signal becomes important. For consistency, the SMSARCH forces this signal low when reading memory from address 0x0000 through 0x7FFF for all cartridges. The signal is held high at all other times.
~M8-B: This signal is similar to ~M0-7. It is held low when accessing memory from 0x8000 through 0xBFFF. Note that this only occurs when reading "One-Mega" cartridges, since this area is Frame 2. The signal is held high at all other times.
~MC-F: This signal is also similar to ~M0-7. It should be held low when accessing memory from 0xC000 through 0xFFFF. The only time this signal is ever forced low is when writing to the FCR’s. The signal is held high at all other times.
Back |
Front |
|||
+5 Volts |
1 |
2 |
WR |
|
Mreq |
3 |
4 |
~ROM/RAM |
|
~M8-B |
5 |
6 |
Address14 |
|
Address13 |
7 |
8 |
Address8 |
|
Address9 |
9 |
10 |
Address11 |
|
~M0-7 |
11 |
12 |
Address10 |
|
~CrtOE |
13 |
14 |
Data7 |
|
Data6 |
15 |
16 |
Data5 |
|
Data4 |
17 |
18 |
Data3 |
|
GROUND |
19 |
20 |
GROUND |
|
GROUND |
21 |
22 |
Data2 |
|
Data1 |
23 |
24 |
Data0 |
|
Address0 |
25 |
26 |
Address1 |
|
Address2 |
27 |
28 |
Address3 |
|
Address4 |
29 |
30 |
Address5 |
|
Address6 |
31 |
32 |
Address7 |
|
Address12 |
33 |
34 |
UNKNOWN |
|
+5 Volts |
35 |
36 |
Address15 |
|
M1 |
37 |
38 |
I/Oreq |
|
Refresh |
39 |
40 |
Halt |
|
Wait |
41 |
42 |
Int |
|
JyDs |
43 |
44 |
BusReq |
|
BusAck |
45 |
46 |
~Reset |
|
Clock |
47 |
48 |
Jread |
|
~MC-F |
49 |
50 |
NMI |
Figure 4: Cartridge Socket Pin Layout
The data lines (Data0 - Data7) are bi-directional. A value can be safely read from or written to these lines. However, the only time the data lines should be driven is when the FCR’s are being addressed. The address lines (Address0 - Address15) are write only lines. The result of reading these lines is unclear, and is not recommended.
3.0 The SMSARCH
So far, the discussion has focused on the Sega Master System. The information provided above should be sufficient to allow people so motivated to design their own SMS cartridge archiver. Now, however, the discussion will focus on the SMSARCH’s hardware and software. This section discusses every aspect of the SMSARCH’s design and use.
3.1 The SMSARCH’s Hardware
Currently the hardware is implemented in CMOS logic (74HCTXXX series).
(To be completed)
3.2 The SMSARCH’s Software
(To be completed)