This is the detailed technical description and documentation for the multi-functional Carnivore2 cartridge that was created by RBSC.
NOTE: The hexadecimal numbers are shown as #90
, 90h
or 0x90
The main components and features:
On–board BIOSes and modules:
File | Subslot | Description |
---|---|---|
BOOTCMFC.BIN | 0 | Boot Menu |
BIDECMFC.BIN | 1 | IDE BIOS |
2 | 1 MB RAM | |
FMPCCMFC.BIN | 3 | FMPAC BIOS |
The location of the Boot Menu, directory and BIOSes in the FlashROM chip is described below. There are logical and physical blocks and they have different numbering.
The FlashROM chip that is used in Carnivore2 has 8 logical blocks in the first physical 64 KB block and then go the rest of 64 KB physical blocks. In the logical blocks there are Boot Menu and directory. The next few blocks are allocated for the BIOSes of the embedded devices.
The first 8 logical 8 KB blocks are grouped into the first physical block that is addressed by
the AddrFr
register. Logical blocks 0, 1, 6 and 7 contain the Boot Menu's code and data. Blocks 2 and 3 contain directory entries. Then go 2 blocks that are reserved for future use.
Address range | Block number | Description |
---|---|---|
000000h–001FFFh | 0 | after power on (AddrFR=#00, R1Mult=“10000101” B1AdrD = #4000) is visible in subslot 0 at address #4000–#5FFF and contains the first 8 KB of boot menu (ROM “AB” header + start addresses) |
002000h–003FFFh | 1 | after power on is visible in subslot 0 at addresses #6000-#7FFF (bits 2–0 of R1Mult = “101” are the size of the shown block (16 KB)) and contain the second 8 KB of boot menu |
004000h–005FFFh | 2 | directory entries |
006000h–007FFFh | 3 | directory entries |
008000h–009FFFh | 4 | not used |
00A000h–00BFFFh | 5 | not used |
00C000h–00DFFFh | 6 | used for the data of the Boot Menu |
00E000h–00FFFFh | 7 | used for the data of the Boot Menu |
After the first 8 logical 8 KB blocks that form the first physical block, there go the physical 64 KB blocks of the FlashROM.
Address range | Physical block number | Logical block number | Description |
---|---|---|---|
010000h–01FFFFh | 8 | 1, AddrFR=#01 | contain the IDE BIOS |
020000h–02FFFFh | 9 | 2, AddrFR=#02 | contain the IDE BIOS |
030000h–03FFFFh | 10 | 3, AddrFR=#03 | contains FMPAC BIOS |
040000h–04FFFFh | 11 | 4, AddrFR=#03 | Data blocks — these blocks are used for saving the ROM images (games, etc.) |
050000h–05FFFFh | 12 | 5, AddrFR=#03 | |
… | … | … | |
… | … | … | |
7F0000h–7FFFFFh | 134 | 127, AddrFR=#7F |
Model: Numonix M29W640GB TSOP48
Datasheet
Block layout:
#00000 | 8K |
#02000 | 8K |
#04000 | 8K |
#06000 | 8K |
#08000 | 8K |
#0A000 | 8K |
#0C000 | 8K |
#0E000 | 8K |
#10000 | 64K x 127 |
Command addresses: #4555 and #5AAA
Commands:
AUTOSELECT | #90 |
WRITE | #A0 |
CHIP_ERASE | #10 |
BLOCK_ERASE | #30 |
RESET | #F0 |
FlashROM ID: #7E
BOOTCMFC.BIN
BIDECMFC.BIN
FMPCCMFC.BIN
The OPLL emulation (FMPAC) that is supported by the cartridge is mapped to ports #7C–7D.
The FMPAC SRAM is emulated by using the 8 KB of the upper area of the 1st megabyte of RAM (shadow RAM) that is not shared with the memory mapper. The physical address of the 8 KB area for SRAM in the shadow RAM is 0FE000h–0FFFFFh.
NOTE: The settings of SRAM will be lost after powering down unless the cartridge has the backup battery installed.
FMPAC's own control registers:
To enable 8 KB of SRAM at address 4000h–5FFFh, set 4Dh to 5FFEh and 69h to 5FFFh.
Model: M93C46MN1 (128 bytes/1 Kbit)
Datasheet
IMPORTANT! The chip is operated only in 8–bit mode!
This EEPROM is used to store additional configuration settings. Using the EEPROM prevents the important configuration settings from being lost after power goes down. The location of the settings in the EEPROM and their description can be found i the table blow.
Address | Description |
---|---|
01 | FMPAC and SCC volume, 3 bits per value, max volume is 8, first 2 bits are used as flags |
02 | 50 or 60 Hz VDP frequency flag, bit 1 from this byte is used — if this bit is zero then 60 Hz is used |
03 | PSG and clicker enable/disable flags and volumes, 3 bits per volume, max volume is 8, first 2 bits are used as enable/disable flags |
04 | Entry sorting (0=disabled) |
05 | Fade in/out effects (0=disabled) |
06 | Keyboard/joystick speed (this is an increment for default value) |
07 | Menu font palette |
08 | |
09 | Menu background palette |
0A | |
0B | Help font palette |
0C | |
0D | Help background palette |
0E | |
0F | Volume font palette |
10 | |
11 | Volume background palette |
12 | |
13 | PSG/PPI font palette |
14 | |
15 | PSG/PPI background palette |
16 | |
17 | Custom settings in use flag (must be #42) |
18 | Double reset on “cold boot” (1=enabled) |
19 | FMPAC mono (1=enabled) |
1A | Last used entry |
1B | Music playback status |
1C | Autostart entry number |
1D | Help scroller status |
1E | Dual-PSG status |
1F | Autostart delay |
20 | Slot 3 usage flag |
21 | User-configurable ID and control port number |
Writing to EEPROM is done via the configuration register CardMDR+#23
. The commands for EEPROM are saved into this register in a sequence that is described in the chip's datasheet. Only write–enable, read and write commands are used.
The configuration registers are located at addresses #0F80 or #4F80 or #8F80 or #CF80h. Their visibility and location is controlled by the main control register's first byte — at address #4F80. The main control register is called CardMDR
. After power on, the registers are located at address #4F80. All registers are write–only except the pseudo–register for sending/receiving the data when accessing the FlashROM and the register for the configuration EEPROM, as well as 3 bytes of the firmware version - FPGA_ver.
Below you can find the description of configuration registers.
Register number, name | Bit number | Value | Description |
---|---|---|---|
00 CardMDR | Main cartridge's configuration register | ||
01 AddrM0 | lower address register (bits 7–0) for accessing the FlashROM | ||
02 AddrM1 | middle address register (bits 15–8) for accessing the FlashROM | ||
03 AddrM2 | higher address register (bits 22–16) for accessing the FlashROM | ||
04 DatM0 | pseudo–register for sending/receiving data from/to FlashROM | ||
05 AddrFR | register controlling the number of FlashROM's 64 KB block for ROM emulation The default value of this register is 00h |
||
06 R1Mask | Configuration registers for bank 1 | ||
07 R1Addr | |||
08 R1Reg | |||
09 R1Mult | |||
0A B1MaskR | |||
0C R2Mask | Configuration registers for bank 2 | ||
0D R2Addr | |||
0E R2Reg | |||
0F R2Mult | |||
10 B2MaskR | |||
11 B2AdrD | |||
12 R3Mask | Configuration registers for bank 3 | ||
13 R3Addr | |||
14 R3Reg | |||
15 R3Mult | |||
16 B3MaskR | |||
17 B3AdrD | |||
18 R4Mask | Configuration registers for bank 4 | ||
19 R4Addr | |||
1A R4Reg | |||
1B R4Mult | |||
1C B4MaskR | similar to B1MaskR | ||
1D B4AdrD | similar to B1AdrD | ||
1E Mconf | Expanded slot configuration register | ||
1F CMDRCpy | copy of the CardMDR+#00 register (to be used with LDIR command) | ||
20 ConfFl | FlashROM chip's configuration The default value of this register is — 010b |
||
2 | 0 | 8 bit bus | |
1 | 16 bit bus | ||
1 | Reset/protect flag | ||
0 | 1 | enable 12V for boosted writing into FlashROM | |
0 | зdisable 12V for boosted writing into FlashROM | ||
21 NSReg | Non-standard Register The default value of this register is #00, please don't change it! |
||
22 SndLVL | volume level register The default value of this register is 1Bh (00011011b) |
||
7, 6 | 10 = FMPAC mono, 00 = FMPAC stereo |
||
5, 4, 3 | FMPAC audio level (0–7) | ||
2, 1, 0 | SCC/SCC+ audio level (0–7) | ||
23 CfgEEPR | register for controlling additional configuration EEPROM (93C46) | ||
7, 6, 5, 4 | not used | ||
3 | EECS signal Chip Select EEPROM | ||
2 | EECK signal CLK (sync) | ||
1 | EEDI signal Data Input (data sent to EEPROM) | ||
0 | EEDO signal Data Output (data received from EEPROM); read–only | ||
24 PSGCtrl | PSG control register The default value of this register is 1Bh (00011011b) |
||
7 | enable/disable PSG | ||
6 | enable/disable PPI Clicker | ||
5, 4, 3 | PSG audio level (0–7) | ||
2, 1, 0 | PPI Clicker audio level (0–7) | ||
25 | reserved for future use | ||
26 | reserved for future use | ||
27 | reserved for future use | ||
0 | activation flag for interceptor code on system restart or read from #4000 | ||
1 | enabled | ||
1 | interceptor code's location | ||
0 | boot menu in FlashROM | ||
1 | first shadow RAM block | ||
28 SLM_cfg | per–device subslot assignment (master slot) | ||
7 | FMPAC subslot number | ||
6 | |||
5 | RAM (Mapper MMM) subslot number | ||
4 | |||
3 | IDE (CF) subslot number | ||
2 | |||
1 | FlashROM/SCC subslot number | ||
0 | |||
29 SCART_cfg | slave slot control register | ||
7 | 1 | slave slot enabled | |
0 | slave slot disabled | ||
6 | 1 | slave slot's location assigned by user | |
0 | slave slot assigned as subslot of master slot | ||
5 | 1 | slave slot expanded (if not used as a subslot of master slot) | |
0 | slave slot non–expanded (if not used as a subslot of master slot) | ||
4 | 1 | master slot's location is assigned by user | |
0 | master slot located at the physical slot | ||
3 | 1 | not used | |
0 | |||
2 | 1 | allow slot select register for emulated slot (used only for slots 1 and 2) | |
0 | disable slot select register for emulated slot (real slot's register will be used) | ||
2A SCART_SLT | slot/subslot configuration on power–on | ||
7, 6 | 00 = mini ROM up to 32 KB without mapper 01 = K4 mapper 10 = K5 mapper without SCC 11 = K5 mapper + SCC |
||
5, 4 | master slot number | ||
3, 2 | expanded slave slot number | ||
1, 0 | slave slot number | ||
2B SCART_StBl | slave slot's 64 KB block assignment in FlashROM | ||
2C, 2D, 2E FPGA_ver | FPGA firmware version (3 ASCII bytes) | ||
2F | MROM_offs = mini ROM offset in 64 KB block (in 8 KB steps) | ||
30 PSGAlt | PSG port configuration | ||
1 | reserved | ||
0 | 1 | alternative ports: #10-#11 | |
0 | default ports: #A0-#A1 | ||
35 PFXN | User-configurable I/O port number for ID and control |
There are six bank configuration registers:
n — this is the bank number.
Bitmask for bank's register address. This value is normally mirrored into several addresses, for example for Konami 5 cartridges those addresses for the first bank are 5000h–57FFh. Here we use only the high byte's address — F8h (11111000b).
The default value of this register is F8h
High byte of the bank's address register (example: 50h for address 5000h)
The default value of this register is 50h.
Initial value for bank's number (usually 00h)
The default value of this register is 00h.
RnMult — bank's mode and size register
Bit number | Value | Description |
---|---|---|
7 | 1 | bank's register is enabled |
0 | bank's control is disabled | |
6 | 1 | mirroring is disabled |
0 | mirroring is enabled | |
5 | media type selection | |
0 | FlashROM | |
1 | RAM | |
4 | 1 | writing to bank is enabled |
0 | writing to bank is disabled | |
3 | 0 | bank is enabled |
1 | bank is disabled | |
2, 1, 0 | bank's size 111b = 64 KB, 110b = 32 KB, 101b = 16 KB, 100b = 8 KB, 011b = 4 KB other value — bank is disabled The default value of this register is 85h |
The default value is 00h (bank is disabled)
Bitmask for bank's addressing mode into the FlashROM. This is the ROM's emulated size and the number of pages. For example for a 128 KB ROM we will need 16 pages of 8 KB, so we set the 0Fh (00001111b) mask.
The default value of this register is 03h
High byte of the bank's address (example: 40h for address 4000h).
The default value of this register is 40h
00 CardMDR — main cartridge's configuration register
Bit number | Value | Description |
---|---|---|
7 | 1 | don't show registers |
0 | show registers | |
6 | 0/1/2/3 | registers are located at addresses 0F80h/4F80h/8F80h/CF80h |
5 | ||
4 | 1 | SCC enabled |
0 | SCC disabled | |
3 | 1 | delayed configuration |
0 | configuration is changed immediately after updating the registers | |
2 | 0 | delayed configuration is enabled after CPU executes at address 0000h |
1 | configuration is enabled after reading from address 4000h The delayed configuration works only for AddrFR and bank control registers |
|
1 | source for BIOS of embedded devices | |
0 | BIOS data (boot menu, IDE controller, FMPAC) is read from FlashROM chip | |
1 | BIOS data (boot menu, IDE controller, FMPAC) is read from RAM Warning! The data must be copied into DAM before setting this bit! |
|
0 | configuration registers visibility control | |
0 | all configuration registers are visible at addresses 0F80h/4F80h/8F80h/CF80h depending on the values of bits 5 and 6 | |
1 | configuration registers are not visible, 1 byte of data from the corresponding block in the FlashROM is available at those addresses |
1E Mconf — expanded slot configuration register
Bit number | Value | Description |
---|---|---|
7 | 1 | slot is expanded |
0 | slot is not expanded | |
6 | 1 | MMM mapper ports FC,FD,FE,FF reading is enabled |
5 | 1 | control YM2413 (FM Pack Synt. 7Ch,7Dh) |
4 | 1 | control 3С порта (МММ mapper) |
3 | 1 | control -3 Subslot FM Pack bios ROM |
2 | 1 | control -2 Subslot MMM mapper with 1 MB of RAM is enabled |
1 | 1 | control -1 Subslot CF card interface |
0 | 1 | control -0 Subslot MSCC (and this register) |
There are 253 user–controlled directory entries available in the cartridge. The first directory entry can't be edited or deleted because it sets the default cartridge's configuration — all enabled. The directory is 8 KB in size and is located in the 2 and 3 logical blocks of the FlashROM chip at addresses 004000h–005FFFh (block 2) and 006000h–007FFFh (block 3). The physical block number (controlled by the AddrFr
register) is zero.
Each directory entry occupies 40h (64 bytes) and has the following format:
Register number | Name | Bit number | Value/description |
---|---|---|---|
#00 | NUM | Record number (last one — #FF is ignored) | |
#01 | ACT | Active/empty record's flag (#FF — active record) | |
#02 | STB | Starting 64 KB block for data | |
#03 | LNB | Data size in 64 KB blocks | |
#04 | MAP | Mapper type symbol | |
#05 | NAM | Record name (30 bytes) | |
#22 | NAM | ||
#23 | R1Mask | Configuration registers for bank 1 | |
#24 | R1Addr | ||
#25 | R1Reg | ||
#26 | R1Mult | ||
#27 | B1MaskR | ||
#28 | B1AdrD | ||
#29 | R2Mask | Configuration registers for bank 2 | |
#2A | R2Addr | ||
#2B | R2Reg | ||
#2C | R2Mult | ||
#2D | B2MaskR | ||
#2E | B2AdrD | ||
#2F | R3Mask | Configuration registers for bank 3 | |
#30 | R3Addr | ||
#31 | R3Reg | ||
#32 | R3Mult | ||
#33 | B3MaskR | ||
#34 | B3AdrD | ||
#35 | R4Mask | Configuration registers for bank 4 | |
#36 | R4Addr | ||
#37 | R4Reg | ||
#38 | R4Mult | ||
#39 | B4MaskR | ||
#3A | B4AdrD | ||
#3B | Mconf | expanded slot configuration register | |
#3C | CardMDR | main configuration register | |
#3D | PosSiz | size and position in 64 KB block for mini ROMs | |
#3E | RstRun | reset and start options | |
#3F | Resrv | Reserved |
PosSiz — size and position in 64 KB block for mini ROMs
Bit number | Value/description | ||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
7 | reserved | ||||||||||||||||||||||||||||||||||||
6, 5, 4 | offset of mini ROM in 64 KB block based on ROM's size:
|
||||||||||||||||||||||||||||||||||||
3 | non–standard ROM size: 1 — 49 KB 0 — standard ROM size |
||||||||||||||||||||||||||||||||||||
2, 1, 0 | mini ROM's size: 110b = 32 KB 101b = 16 KB 100b = 8 KB 011b = 4 KB 000b = not mini ROM |
RstRun — reset and start options
Bit number | Value/description |
---|---|
3 | ROM's start address: 0 — use bit 2 from this register 1 — use start address at 0002h |
2 | ROM's start address: 0 — use start address at 4002h 1 — use start address at 8002h |
1 | execution control: 0 — don't start ROM 1 — start using ROMini address (bits 3,2) |
0 | reset flag: 0 — do not reset MSX 1 — reset MSX |
The cartridge supports a few common mappers and the linear mode that allows first 64 KB of the MiniROM to be visible in the address space. The physical addresses allocated for the mappers' operation lie in the range of 100000h–1FFFFFh. This means that only the second megabyte of RAM is used.
K | Konami5 (SCC) mapper |
k | Konami4 mapper |
a | ASCII8 mapper |
A | ASCII16 mapper |
M | mini ROM (8, 16, 32, 48 and 64 KB ROM without mapper) |
C | configuration entry |
U | unknown mapper |
The cartridge supports the ASCII8 mapper.
Default configuration values:
#F8 | #60 | #00 | #84 | #FF | #40 | bank 1 |
---|---|---|---|---|---|---|
#F8 | #68 | #00 | #84 | #FF | #60 | bank 2 |
#F8 | #70 | #00 | #84 | #FF | #80 | bank 3 |
#F8 | #78 | #00 | #84 | #FF | #A0 | bank 4 |
#FF | #AC | #00 | #02 | #FF | configuration registers |
The cartridge supports the ASCII16 mapper.
Default configuration values:
#F8 | #60 | #00 | #85 | #FF | #40 | bank 1 |
---|---|---|---|---|---|---|
#F8 | #70 | #00 | #85 | #FF | #80 | bank 2 |
#F8 | #60 | #00 | #85 | #FF | #С0 | bank 3 |
#F8 | #70 | #00 | #85 | #FF | #00 | bank 4 |
#FF | #8C | #00 | #01 | #FF | configuration registers |
The cartridge supports the Konami4 mapper.
Default configuration values:
#E8 | #50 | #00 | #04 | #FF | #40 | bank 1 |
---|---|---|---|---|---|---|
#E8 | #60 | #01 | #84 | #FF | #60 | bank 2 |
#E8 | #80 | #02 | #84 | #FF | #80 | bank 3 |
#E8 | #A0 | #03 | #84 | #FF | #A0 | bank 4 |
#FF | #AC | #00 | #02 | #FF | configuration registers |
The cartridge supports the Konami5 (SCC) mapper.
Default configuration values:
#F8 | #50 | #00 | #84 | #FF | #40 | bank 1 |
---|---|---|---|---|---|---|
#F8 | #70 | #01 | #84 | #FF | #60 | bank 2 |
#F8 | #90 | #02 | #84 | #FF | #80 | bank 3 |
#F8 | #B0 | #03 | #84 | #FF | #A0 | bank 4 |
#FF | #BC | #00 | #02 | #FF | configuration registers |
The cartridge supports MiniROM (ROM images up to 49 KB) without mapper.
Default configuration values:
#F8 | #60 | #00 | #06 | #7F | #40 | bank 1 |
---|---|---|---|---|---|---|
#F8 | #70 | #01 | #08 | #7F | #80 | bank 2 |
#F8 | #70 | #02 | #08 | #3F | #С0 | bank 3 |
#F8 | #78 | #03 | #08 | #3F | #A0 | bank 4 |
#FF | #8C | #07 | #01 | #FF | configuration registers |
The cartridge supports the linear 64 KB mode, when the first 64 KB of the ROM are visible in the address space.
The default configuration values for MiniROMs are:
#F8 | #60 | #00 | #06 | #7F | #40 | bank 1 |
---|---|---|---|---|---|---|
#F8 | #70 | #01 | #08 | #7F | #80 | bank 2 |
#F8 | #70 | #02 | #08 | #3F | #C0 | bank 3 |
#F8 | #78 | #03 | #08 | #3F | #A0 | bank 4 |
#FF | #8C | #07 | #01 | #FF | configuration registers |
Bank addresses in linear mode:
#0000–#3FFF | bank 1 |
---|---|
#4000–#7FFF | bank 2 |
#8000–#BFFF | bank 3 |
#C000–#FFFF | bank 4 |
Below you can find the default values for several configuration registers.
CardMDR | CardMDR+#00 | 20h (but may vary because of 2 last bits) |
AddrFR | CardMDR+#05 | 00h |
R1Mult | CardMDR+#09 | 85h |
R2Mult | CardMDR+#0F | 00h |
R3Mult | CardMDR+#15 | 00h |
R4Mult | CardMDR+#1B | 00h |
CMDRCpy | CardMDR+#1F | 20h |
ConfFl | CardMDR+#20 | 02h |
RCP file format description.
Address (byte) | Description | |
---|---|---|
#00 | Mapper type | |
#01 | R1Mask | Configuration registers for bank 1 |
#02 | R1Addr | |
#03 | R1Reg | |
#04 | R1Mult | |
#05 | B1MaskR | |
#06 | B1AdrD | |
#07 | R2Mask | Configuration registers for bank 2 |
#08 | R2Addr | |
#09 | R2Reg | |
#0A | R2Mult | |
#0B | B2MaskR | |
#0C | B2AdrD | |
#0D | R3Mask | Configuration registers for bank 3 |
#0E | R3Addr | |
#0F | R3Reg | |
#10 | R3Mult | |
#11 | B3MaskR | |
#12 | B3AdrD | |
#13 | R4Mask | Configuration registers for bank 4 |
#14 | R4Addr | |
#15 | R4Reg | |
#16 | R4Mult | |
#17 | B4MaskR | |
#18 | B4AdrD | |
#19 | Mconf | |
#1A | CardMDR | |
#1B | PosSiz | |
#1C | RstRun | |
#1D | Not used, always FF |
Carnivore2 can be detected and controlled via its own configurable port #F0-F2. The following I/O operations are possible: