Forums

I recently found a functioning MasterSystem II with two gamepads and an extra game, Sonic The Hedhehog.

After completing both Alex Kidd and Sonic decided to build a programmable cartridge which would allow me to play more games but the main problem was that most games I wanted to play need a mapper, so I decided to build a mapper of my own.

I'm currently building a prototype 'cartridge' which (I hope) will run Penguin Land (128K, Slot 2 AFAIK), you can see the progress (can't post links, imgurDOTcom /s6PBKmw and /a/AHypQ).
Using a PIC18F14K22@64MHz I get ~16+ Instructions per MasterSytem cycle, there is more than enough time to decode the address in time for the Z80 to fetch a byte without delays. While samples arrive I'm using a PIC18F4520 @32MHz, fast enough for Slot2 mapping (pure ASM).

Now, I would like to ask for help regarding the workings of the mapper since I don't have much to experiment with so correct me if I'm wrong.

- Reading the documentation I'm assuming the mapper decodes the 2MSB from the address bus into the nMSB of the memory chip using the [0xFFFc-0cFFFF] registers so, considering no shift ever happens and no Slot0 mapping, the 14LSB of the address bus are the same on the rom chip and the address bus regardles of the mapper status.

- Disassembling my victim game, Penguin Land, I detect writes to the mapper config register:

ld a,008h
ld (0fffch),a ;Write 0x08 to Mapper config

ld a,000h
ld (0fffch),a ;Clear Mapper config.

Those writes set/unset the "RAM enable ($8000-$bfff)", which I honestly don't know how it works. I think it may activate on-board ram for the level editor but I honestly don't know (related to ramkill?).

- Have you tested it on actual hardware? SST flash chip samples have not arrived so, no.

FFFC pages in the on cart RAM. I suggest you try another game without the RAM first, e.g. Alex Kidd.

The mapper chip pretty much just puts the last value written on the high address lines.

Maxim wrote

FFFC pages in the on cart RAM. I suggest you try another game without the RAM first, e.g. Alex Kidd.

The mapper chip pretty much just puts the last value written on the high address lines.

so this ram enable bit is just the input to a demultiplexer between RAM and ROM CE# when the address is in range.

I'll try another game first. how can I know (without diasm) which mapper slots is a game using? is there a list of such games?

Edit:
FFFCh is the mapper control register, did you mean 8000h-bfffh?

NeonMan,
http://www.smspower.org/Development/Mappers
may be a good reference

Sorry for ressurrecting an old discussion but I find it interesting.

I have a question related to the above. For a 48K SMS cartridge it does not need a mapper -is that correct?-if so what is the simplest 48K cartridge circuit? I am saying the above because the Z80 can address 64K memory ROM or RAM without a mapper this means it can address 48K ROM without a mapper (the other 16K block is of course the 8KB mirrored RAM of the SMS). Assuming the 48K SMS cartridge can be made without a mapper it would still need to load 2 (for the block of memry from 32K to 48K) in the register &FFFF.
That is using

ld (&FFFF),2

and where the 16KB block from 32KB to 48K is stored in the address range from &8000 to &C000 in some 48K cartridge where there are 16 address lines directly wired (without a mapper) to some memory IC in a cartridge.

Can anyone confirm the above is correct? If the 16 address
pins (A0 to A15) exposed in the cartridge slot are directly wired to the z80 internally then I cannot see why the above cannot be true (that
you don't need a mapper to access 48K but you still need to use
ld (&FFFF),2) to notify the master system that a 48K cartridge is being used).

You don't need a mapper for 48k and you also don't need to write anything to $ffff, because with no mapper there is nothing to respond to that. Out of curiosity, why would you think the write to $ffff is still necessary?

The cart does need some address decoding logic to ensure that the ROM doesn't attempt to write to the data bus when the system is addressing RAM. There's a pin, ~CSRAM / ~MC-F which can be easily utilised to use implement that, or you can use ~M0-7 and ~M8-B instead.

Jolene wrote

...ld (&FFFF),2) to notify the master system that a 48K cartridge is being used).

Ah, just saw this!

So the mapper is not part of the base unit, it's built into each cartridge and it's the mapper which responds to writes to $ffff, not the base unit, so with a 48k or less cart ROM there's no mapper and no need to write to $ffff.

The cart will have access to the full 64k of address space and can safely respond to the lower 48k based on address decoding. The only thing it can't do without a mapper is fancy switching around of the 16k banks, but no reason to want to do that anyway with such a small ROM.

Jolene wrote

what is the simplest 48K cartridge circuit?

it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF)

sverx wrote

it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF)

Sorry, missed this, yes @sverx is right. There are a few options, but I'd do something like:

~OE (ROM) = ~RD (cart)
~CE (ROM) =!(!(~CE) . ~MC-F))

Which you can realise with 3 NAND gates.

Me, I like to use 74x138s for most decoding logic as they are so versatile. You can certainly use one here instead of a 74x00

Also it's actually harder to find 64KB ROMs than bigger ones so you might just use a bigger one with some address lines fixed.

A single AND gate is even simpler - combine ~M0-7 and ~M8-B

lidnariq wrote

A single AND gate is even simpler - combine ~M0-7 and ~M8-B

What about ~CE? If you don't decode that, won't you get contention with the BIOS?

One pedantically oughtn't, but you can skip ~RD safely. (Nothing has any reason to try to write to ROM)

Sega themselves took advantage of this, such as on the boards with 28-pin SMS ROMs with integral mapper like board 171-5519. It doesn't bother to connect to ~RD. Instead, A0-A14 D0-D7 power and ground are the normal pins for a 27C256, and ~WR, ~M0-7, and ~CE respectively go to pins 1, 22, and 20.

willbritton wrote

sverx wrote

it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF)

Sorry, missed this, yes @sverx is right. There are a few options, but I'd do something like:

~OE (ROM) = ~RD (cart)
~CE (ROM) =!(!(~CE) . ~MC-F))

Which you can realise with 3 NAND gates.

Me, I like to use 74x138s for most decoding logic as they are so versatile. You can certainly use one here instead of a 74x00

Also it's actually harder to find 64KB ROMs than bigger ones so you might just use a bigger one with some address lines fixed.

@willbrittion

"Out of curiosity, why would you think the write to $ffff is still necessary? "
It is because z80 8 bit game computers exist where the mapper inside the
cartridge works in conjunction with hardware inside the computer
(outside the cartridge) to implement memory banking/16KB block
switching so I wasn't sure if that applied to the master system;
as you wrote above all the relevant hardware is inside the cartridge
so I know now that it doesn't apply.

~CE (ROM) =!(!(~CE) . ~MC-F))
you could also use an expression like (A15 OR A14) instead of MC-F in above following @sverx comment of disabling the left most bits.
I think CE on the cart slot is designed for connection
to CE on ROM chip (as you mention in your formula above)

Regarding the mention of the 27C256 above
"normal pins for a 27C256"

(it has a 32KB maximum capacity) so it would not be
used in a 48K cartridge.

Jolene wrote

([a 27C256] has a 32KB maximum capacity) so it would not be used in a 48K cartridge.

Yes, which is why I didn't say that.

lidnariq wrote

One pedantically oughtn't, but you can skip ~RD safely. (Nothing has any reason to try to write to ROM)

Funnily enough, sverx and I found a bug the other day with SDCC that inadvertently generated code which attempted to write to ROM, so I'd correct to Nothing has any reason to write to ROM if working properly :D

But yeah, if you don't decode ~RD that does free up a line to decode ~CE so would simplify the logic.

willbritton wrote

sverx wrote

it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF)

Sorry, missed this, yes @sverx is right. There are a few options, but I'd do something like:

~OE (ROM) = ~RD (cart)
~CE (ROM) =!(!(~CE) . ~MC-F))

Which you can realise with 3 NAND gates.

Me, I like to use 74x138s for most decoding logic as they are so versatile. You can certainly use one here instead of a 74x00

Also it's actually harder to find 64KB ROMs than bigger ones so you might just use a bigger one with some address lines fixed.

I don't think you need any logic gates for a 48KB rom. Because you can wire a 27C512 64KB ROM as a 48KB rom (top 16K unused) as follows:Wire A0,A1,...,A15 from the cartridge slot to the A0,A1,...,A15 address pins of the 27C512 (in the cart PCB), wire the D0,D1,...,D7 from the cartridge slot to the D0,D1,...,D7 data pins of the 27C512,wire CE from the cartridge slot to CE on the 27C512, wire MC-F from the cartridge slot to OE pin on the 27C512, wire GND and +5V from cartridge slot to GND +5V of the 27C512. Because MC-F is 0 when the addresses from 0 to 49152=16384*3 are accesses this means the 27C512 ROM is enabled for the first 49152 bytes because the input to OE is 0. All bytes from the zeroeth to the 49152 byte is the first 48K of the 27C512 EPROM. When the master system built in base unit RAM is accessed then the input to OE is 1 and so the 27C512 ROM is disabled when the base unit RAM is used. Since no one mentioned wiring a 48K ROM without logic gates I'm asking is what I said not correct?

No, that's not correct. MCF goes low for 0xC000 to 0xFFFF as its unofficial name implies.

Yes, it does feel quite unfortunate that it's not possible but it isn't.

Also I'd be a bit nervous about not decoding #RD at all as you'd be relying heavily on user code not accidentally or otherwise attempting to write to the lower 48K which would result in data bus contention unless you decode either #RD or #WR.

Hmm, you could use the stupid A≥B one-BJT gate I found once.

a-ge-b.png (1.33 KB)

lidnariq wrote

Hmm, you could use the stupid A≥B one-BJT gate I found once.

So from Asynchronous it needs a NOT gate, I built a working 48K game cartridge today using a NOT gate IC to invert the MCF signal. It doesn't need MREQ as in your one transistor circuit. I played the 48K game Bread and Butter with no problem on real hardware. The MREQ seems like some sort of error protection in your one transistor circuit that is not essential. I built your one transistor circuit above (which decodes MCF, MREQ to OE) and it didn't work but I think that is because of the NPN transistor I have to use. Which is the common 2N5551 transistor. For some reason it doesn''t work with an 2N5551 transistor.

Both #MC-F and #CE contain a term for #MREQ, see here.

Lidnariq's BJT circuit essentially gives #MREQ + !#MC-F which is necessary if you don't have a term elsewhere for #MREQ, but you do I think as you say that you are using #CE for the ROM's chip select.

The BJT should work as a simple not gate, with or without #MREQ on the emitter (if not using you would tie the emitter to GND and remove the 15k pull-up). Possibly you would need to play with the resistor values to make sure it's fully saturated when #MC-F is high.

Author	Message
NeonMan Joined: 24 Sep 2013 Posts: 141	Building a MasterSystem flash cart from scratch (With custom built mapper!) Posted: Tue Sep 24, 2013 8:16 pm
NeonMan Joined: 24 Sep 2013 Posts: 141	I recently found a functioning MasterSystem II with two gamepads and an extra game, Sonic The Hedhehog. After completing both Alex Kidd and Sonic decided to build a programmable cartridge which would allow me to play more games but the main problem was that most games I wanted to play need a mapper, so I decided to build a mapper of my own. I'm currently building a prototype 'cartridge' which (I hope) will run Penguin Land (128K, Slot 2 AFAIK), you can see the progress (can't post links, imgurDOTcom /s6PBKmw and /a/AHypQ). Using a PIC18F14K22@64MHz I get ~16+ Instructions per MasterSytem cycle, there is more than enough time to decode the address in time for the Z80 to fetch a byte without delays. While samples arrive I'm using a PIC18F4520 @32MHz, fast enough for Slot2 mapping (pure ASM). *Now, I would like to ask for help regarding the workings of the mapper since I don't have much to experiment with so correct me if I'm wrong.* - Reading the documentation I'm assuming the mapper decodes the 2MSB from the address bus into the nMSB of the memory chip using the [0xFFFc-0cFFFF] registers so, considering no shift ever happens and no Slot0 mapping, the 14LSB of the address bus are the same on the rom chip and the address bus regardles of the mapper status. - Disassembling my victim game, Penguin Land, I detect writes to the mapper config register: ld a,008h ld (0fffch),a ;Write 0x08 to Mapper config ld a,000h ld (0fffch),a ;Clear Mapper config. Those writes set/unset the "RAM enable ($8000-$bfff)", which I honestly don't know how it works. I think it may activate on-board ram for the level editor but I honestly don't know (related to ramkill?). - Have you tested it on actual hardware? SST flash chip samples have not arrived so, no.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14727 Location: London	Posted: Tue Sep 24, 2013 10:34 pm
	FFFC pages in the on cart RAM. I suggest you try another game without the RAM first, e.g. Alex Kidd. The mapper chip pretty much just puts the last value written on the high address lines.

NeonMan Joined: 24 Sep 2013 Posts: 141	Posted: Tue Sep 24, 2013 11:23 pm
NeonMan Joined: 24 Sep 2013 Posts: 141	Maxim wrote FFFC pages in the on cart RAM. I suggest you try another game without the RAM first, e.g. Alex Kidd. The mapper chip pretty much just puts the last value written on the high address lines. so this ram enable bit is just the input to a demultiplexer between RAM and ROM CE# when the address is in range. I'll try another game first. how can I know (without diasm) which mapper slots is a game using? is there a list of such games? Edit: FFFCh is the mapper control register, did you mean 8000h-bfffh?

kamillebidan Joined: 25 Feb 2013 Posts: 384 Location: Osaka	Posted: Wed Sep 25, 2013 12:57 am
	NeonMan, http://www.smspower.org/Development/Mappers may be a good reference

Jolene Joined: 31 Dec 2022 Posts: 30	Posted: Sat Dec 31, 2022 11:39 am
Jolene Joined: 31 Dec 2022 Posts: 30	Sorry for ressurrecting an old discussion but I find it interesting. I have a question related to the above. For a 48K SMS cartridge it does not need a mapper -is that correct?-if so what is the simplest 48K cartridge circuit? I am saying the above because the Z80 can address 64K memory ROM or RAM without a mapper this means it can address 48K ROM without a mapper (the other 16K block is of course the 8KB mirrored RAM of the SMS). Assuming the 48K SMS cartridge can be made without a mapper it would still need to load 2 (for the block of memry from 32K to 48K) in the register &FFFF. That is using ld (&FFFF),2 and where the 16KB block from 32KB to 48K is stored in the address range from &8000 to &C000 in some 48K cartridge where there are 16 address lines directly wired (without a mapper) to some memory IC in a cartridge. Can anyone confirm the above is correct? If the 16 address pins (A0 to A15) exposed in the cartridge slot are directly wired to the z80 internally then I cannot see why the above cannot be true (that you don't need a mapper to access 48K but you still need to use ld (&FFFF),2) to notify the master system that a 48K cartridge is being used).

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Sat Dec 31, 2022 2:24 pm
	You don't need a mapper for 48k and you also don't need to write anything to $ffff, because with no mapper there is nothing to respond to that. Out of curiosity, why would you think the write to $ffff is still necessary? The cart does need some address decoding logic to ensure that the ROM doesn't attempt to write to the data bus when the system is addressing RAM. There's a pin, ~CSRAM / ~MC-F which can be easily utilised to use implement that, or you can use ~M0-7 and ~M8-B instead.

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Sat Dec 31, 2022 3:05 pm
	Jolene wrote ...ld (&FFFF),2) to notify the master system that a 48K cartridge is being used). Ah, just saw this! So the mapper is not part of the base unit, it's built into each cartridge and it's the mapper which responds to writes to $ffff, not the base unit, so with a 48k or less cart ROM there's no mapper and no need to write to $ffff. The cart will have access to the full 64k of address space and can safely respond to the lower 48k based on address decoding. The only thing it can't do without a mapper is fancy switching around of the 16k banks, but no reason to want to do that anyway with such a small ROM.

sverx Joined: 05 Sep 2013 Posts: 3801 Location: Stockholm, Sweden	Posted: Sat Dec 31, 2022 5:06 pm
	Jolene wrote what is the simplest 48K cartridge circuit? it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF)

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Sat Dec 31, 2022 5:59 pm
	sverx wrote it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF) Sorry, missed this, yes @sverx is right. There are a few options, but I'd do something like: ~OE (ROM) = ~RD (cart) ~CE (ROM) =!(!(~CE) . ~MC-F)) Which you can realise with 3 NAND gates. Me, I like to use 74x138s for most decoding logic as they are so versatile. You can certainly use one here instead of a 74x00 Also it's actually harder to find 64KB ROMs than bigger ones so you might just use a bigger one with some address lines fixed.

lidnariq Joined: 24 Mar 2021 Posts: 120	Posted: Sat Dec 31, 2022 8:06 pm
lidnariq Joined: 24 Mar 2021 Posts: 120	A single AND gate is even simpler - combine ~M0-7 and ~M8-B

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Sat Dec 31, 2022 8:35 pm
	lidnariq wrote A single AND gate is even simpler - combine ~M0-7 and ~M8-B What about ~CE? If you don't decode that, won't you get contention with the BIOS?

lidnariq Joined: 24 Mar 2021 Posts: 120	Posted: Sun Jan 01, 2023 2:05 am
lidnariq Joined: 24 Mar 2021 Posts: 120	One pedantically oughtn't, but you can skip ~RD safely. (Nothing has any reason to try to write to ROM) Sega themselves took advantage of this, such as on the boards with 28-pin SMS ROMs with integral mapper like board 171-5519. It doesn't bother to connect to ~RD. Instead, A0-A14 D0-D7 power and ground are the normal pins for a 27C256, and ~WR, ~M0-7, and ~CE respectively go to pins 1, 22, and 20.

Jolene Joined: 31 Dec 2022 Posts: 30	Posted: Sun Jan 01, 2023 2:23 am
Jolene Joined: 31 Dec 2022 Posts: 30	willbritton wrote sverx wrote it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF) Sorry, missed this, yes @sverx is right. There are a few options, but I'd do something like: ~OE (ROM) = ~RD (cart) ~CE (ROM) =!(!(~CE) . ~MC-F)) Which you can realise with 3 NAND gates. Me, I like to use 74x138s for most decoding logic as they are so versatile. You can certainly use one here instead of a 74x00 Also it's actually harder to find 64KB ROMs than bigger ones so you might just use a bigger one with some address lines fixed. @willbrittion "Out of curiosity, why would you think the write to $ffff is still necessary? " It is because z80 8 bit game computers exist where the mapper inside the cartridge works in conjunction with hardware inside the computer (outside the cartridge) to implement memory banking/16KB block switching so I wasn't sure if that applied to the master system; as you wrote above all the relevant hardware is inside the cartridge so I know now that it doesn't apply. ~CE (ROM) =!(!(~CE) . ~MC-F)) you could also use an expression like (A15 OR A14) instead of MC-F in above following @sverx comment of disabling the left most bits. I think CE on the cart slot is designed for connection to CE on ROM chip (as you mention in your formula above) Regarding the mention of the 27C256 above "normal pins for a 27C256" (it has a 32KB maximum capacity) so it would not be used in a 48K cartridge.

lidnariq Joined: 24 Mar 2021 Posts: 120	Posted: Sun Jan 01, 2023 3:41 am
lidnariq Joined: 24 Mar 2021 Posts: 120	Jolene wrote ([a 27C256] has a 32KB maximum capacity) so it would not be used in a 48K cartridge. Yes, which is why I didn't say that.

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Sun Jan 01, 2023 9:27 am
	lidnariq wrote One pedantically oughtn't, but you can skip ~RD safely. (Nothing has any reason to try to write to ROM) Funnily enough, sverx and I found a bug the other day with SDCC that inadvertently generated code which attempted to write to ROM, so I'd correct to Nothing has any reason to write to ROM if working properly :D But yeah, if you don't decode ~RD that does free up a line to decode ~CE so would simplify the logic.

Jolene Joined: 31 Dec 2022 Posts: 30	Posted: Fri May 19, 2023 10:42 pm
Jolene Joined: 31 Dec 2022 Posts: 30	willbritton wrote sverx wrote it's probably one with a single 64K ROM chip with some simple logic to disable the chip when the address has the leftmost two bits set (addresses $C000->$FFFF) Sorry, missed this, yes @sverx is right. There are a few options, but I'd do something like: ~OE (ROM) = ~RD (cart) ~CE (ROM) =!(!(~CE) . ~MC-F)) Which you can realise with 3 NAND gates. Me, I like to use 74x138s for most decoding logic as they are so versatile. You can certainly use one here instead of a 74x00 Also it's actually harder to find 64KB ROMs than bigger ones so you might just use a bigger one with some address lines fixed. I don't think you need any logic gates for a 48KB rom. Because you can wire a 27C512 64KB ROM as a 48KB rom (top 16K unused) as follows:Wire A0,A1,...,A15 from the cartridge slot to the A0,A1,...,A15 address pins of the 27C512 (in the cart PCB), wire the D0,D1,...,D7 from the cartridge slot to the D0,D1,...,D7 data pins of the 27C512,wire CE from the cartridge slot to CE on the 27C512, wire MC-F from the cartridge slot to OE pin on the 27C512, wire GND and +5V from cartridge slot to GND +5V of the 27C512. Because MC-F is 0 when the addresses from 0 to 49152=16384*3 are accesses this means the 27C512 ROM is enabled for the first 49152 bytes because the input to OE is 0. All bytes from the zeroeth to the 49152 byte is the first 48K of the 27C512 EPROM. When the master system built in base unit RAM is accessed then the input to OE is 1 and so the 27C512 ROM is disabled when the base unit RAM is used. Since no one mentioned wiring a 48K ROM without logic gates I'm asking is what I said not correct?

asynchronous Joined: 14 Aug 2000 Posts: 741 Location: Adelaide, Australia	Posted: Sat May 20, 2023 11:13 am
	No, that's not correct. MCF goes low for 0xC000 to 0xFFFF as its unofficial name implies.

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Sat May 20, 2023 11:47 am
	Yes, it does feel quite unfortunate that it's not possible but it isn't. Also I'd be a bit nervous about not decoding #RD at all as you'd be relying heavily on user code not accidentally or otherwise attempting to write to the lower 48K which would result in data bus contention unless you decode either #RD or #WR.

lidnariq Joined: 24 Mar 2021 Posts: 120	Posted: Sat May 20, 2023 7:03 pm
lidnariq Joined: 24 Mar 2021 Posts: 120	Hmm, you could use the stupid A≥B one-BJT gate I found once. a-ge-b.png (1.33 KB)

Jolene Joined: 31 Dec 2022 Posts: 30	Posted: Mon May 22, 2023 2:05 am
Jolene Joined: 31 Dec 2022 Posts: 30	lidnariq wrote Hmm, you could use the stupid A≥B one-BJT gate I found once. So from Asynchronous it needs a NOT gate, I built a working 48K game cartridge today using a NOT gate IC to invert the MCF signal. It doesn't need MREQ as in your one transistor circuit. I played the 48K game Bread and Butter with no problem on real hardware. The MREQ seems like some sort of error protection in your one transistor circuit that is not essential. I built your one transistor circuit above (which decodes MCF, MREQ to OE) and it didn't work but I think that is because of the NPN transistor I have to use. Which is the common 2N5551 transistor. For some reason it doesn''t work with an 2N5551 transistor.

willbritton Joined: 06 Mar 2022 Posts: 664 Location: London, UK	Posted: Mon May 22, 2023 8:30 am
	Both #MC-F and #CE contain a term for #MREQ, see here. Lidnariq's BJT circuit essentially gives #MREQ + !#MC-F which is necessary if you don't have a term elsewhere for #MREQ, but you do I think as you say that you are using #CE for the ROM's chip select. The BJT should work as a simple not gate, with or without #MREQ on the emitter (if not using you would tie the emitter to GND and remove the 15k pull-up). Possibly you would need to play with the resistor values to make sure it's fully saturated when #MC-F is high.

Forums

View topic - Building a MasterSystem flash cart from scratch (With custom built mapper!)