Technical description of Carnivore2

This is the detailed technical description and documentation for the multi-functional Carnivore2 cartridge that was created by
RBSC.

NOTE: The hexadecimal numbers are shown as #90, 90h or 0x90

The main components and features:

External storage: CF card (CompactFlash)

Nextor is used as DOS (built-in support for FAT12/16, maximum partition size: 4 GB)
High read and write speeds
Supports SD and MicroSD card adapters
Nextor supports floppy disk emulation with DSK files
Utilities compatible with MSX-DOS versions 1 and 2
The cartridge can be configured as a RAM extension, IDE disk, FMPAC and SCC/SCC+ sound cards, or a combination of
these devices
RAM: 2048 KB (2 MB)
Includes:
1024 KB main RAM with mapper
256 KB for ROM shadowing
720 KB additional RAM with a mapper, similar to MegaRAM
4 KB FMPAC SRAM (a backup battery is needed to save data after turning off the power)
Flash memory (FlashROM): 8 MB capacity, 64 Mbit/s
The first 256 KB are used for service information and ROM BIOSes
Mapper emulation:
Linear 64 KB mode
ASCII8
ASCII16
Konami4
Konami5 (SCC/SCC+)
Custom mapper
Sound
PPI and PSG emulation
Konami SCC and SCC+ emulation
OPLL emulation (YM2413, MSX – Music), BIOS UI translated to English
Volume setting for all emulated audio devices
PSG and PPI can be enabled and disabled in the user interface
Additional 128 byte configuration EEPROM (M93C46MN1), works in 8–bit mode
User–adjustable volume for SCC and FMPAC (8 steps), saved in 93C46 EEPROM
User–adjustable volume for PSG and Clicker (8 steps), saved in 93C46 EEPROM
User–controlled PSG and Clicker device on/off switch
User–adjustable VDP frequency (50/60Hz), saved in the 93C46 EEPROM

On–board BIOSes and modules:

File Subslot Description

BOOTCMFC.BIN 0 Boot Menu
BIDECMFC.BIN 1 IDE BIOS
2 1 MB RAM
FMPCCMFC.BIN 3 FMPAC BIOS

The location of the Boot Menu, directory and BIOSes in the FlashROM chip is described below. There are logical and physical
blocks and they have different numbering.

The location of blocks in FlashROM

The FlashROM chip that is used in Carnivore2 has 8 logical blocks in the first physical 64 KB block and then go the rest of 64
KB physical blocks. In the logical blocks there are Boot Menu and directory. The next few blocks are allocated for the BIOSes
of the embedded devices.

1/16
8 KB blocks
The first 8 logical 8 KB blocks are grouped into the first physical block that is addressed by the AddrFr register. Logical blocks
0, 1, 6 and 7 contain the Boot Menu's code and data. Blocks 2 and 3 contain directory entries. Then go 2 blocks that are
reserved for future use.

Block
Address range Description
number
after power on (AddrFR=#00, R1Mult=“10000101” B1AdrD = #4000) is visible in
000000h–001FFFh 0 subslot 0 at address #4000–#5FFF and contains the first 8 KB of boot menu (ROM
“AB” header + start addresses)
after power on is visible in subslot 0 at addresses #6000-#7FFF (bits 2–0 of R1Mult =
002000h–003FFFh 1 “101” are the size of the shown block (16 KB)) and contain the second 8 KB of boot
menu
004000h–005FFFh 2 directory entries
006000h–007FFFh 3 directory entries
008000h–009FFFh 4 not used
00A000h–00BFFFh 5 not used
00C000h–00DFFFh 6 used for the data of the Boot Menu
00E000h–00FFFFh 7 used for the data of the Boot Menu

64 KB blocks
After the first 8 logical 8 KB blocks that form the first physical block, there go the physical 64 KB blocks of the FlashROM.

Physical block
Address range Logical block number Description
number
010000h–01FFFFh 8 1, AddrFR=#01 contain the IDE BIOS
020000h–02FFFFh 9 2, AddrFR=#02 contain the IDE BIOS
030000h–03FFFFh 10 3, AddrFR=#03 contains FMPAC BIOS
040000h–04FFFFh 11 4, AddrFR=#03
050000h–05FFFFh 12 5, AddrFR=#03
Data blocks — these blocks are used for saving
… … …
the ROM images (games, etc.)
… … …
7F0000h–7FFFFFh 134 127, AddrFR=#7F

FlashROM chip

Model: Numonix M29W640GB TSOP48

Datasheet

Block layout:

#00000 8K
#02000 8K
#04000 8K
#06000 8K
#08000 8K
#0A000 8K
#0C000 8K
#0E000 8K

2/16
 #10000 64K x 127

Command addresses: #4555 and #5AAA

Commands:

AUTOSELECT #90
WRITE #A0
CHIP_ERASE #10
BLOCK_ERASE #30
RESET #F0

FlashROM ID: #7E

Block 0 is reserved for the directory and the boot menu: BOOTCMFC.BIN
Blocks 1–2 are reserved for the IDE BIOS: BIDECMFC.BIN
Block 3 is reserved for the FMPAC BIOS: FMPCCMFC.BIN

OPLL еmulation (FMPAC)

The OPLL emulation (FMPAC) that is supported by the cartridge is mapped to ports #7C–7D.

The FMPAC SRAM is emulated by using the 8 KB of the upper area of the 1st megabyte of RAM (shadow RAM) that is not
shared with the memory mapper. The physical address of the 8 KB area for SRAM in the shadow RAM is 0FE000h–0FFFFFh.

NOTE: The settings of SRAM will be lost after powering down unless the cartridge has the backup battery installed.

FMPAC's own control registers:

7FF4h: write YM-2413 register port (write only)

7FF5h: write YM-2413 data port (write only)
7FF6h: activate OPLL I/O ports (read/write)
7FF7h: ROM page (read/write)

To enable 8 KB of SRAM at address 4000h–5FFFh, set 4Dh to 5FFEh and 69h to 5FFFh.

Additional configuration EEPROM

Model: M93C46MN1 (128 bytes/1 Kbit)

Datasheet

IMPORTANT! The chip is operated only in 8–bit mode!

This EEPROM is used to store additional configuration settings. Using the EEPROM prevents the important configuration
settings from being lost after power goes down. The location of the settings in the EEPROM and their description can be found
i the table blow.

Address Description
01 FMPAC and SCC volume, 3 bits per value, max volume is 8, first 2 bits are used as flags
02 50 or 60 Hz VDP frequency flag, bit 1 from this byte is used — if this bit is zero then 60 Hz is used
PSG and clicker enable/disable flags and volumes, 3 bits per volume, max volume is 8, first 2 bits are used as
03
enable/disable flags
04 Entry sorting (0=disabled)
05 Fade in/out effects (0=disabled)
06 Keyboard/joystick speed (this is an increment for default value)

3/16
 Address Description
07
Menu font palette
08
09
Menu background palette
0A
0B
Help font palette
0C
0D
Help background palette
0E
0F
Volume font palette
10
11
Volume background palette
12
13
PSG/PPI font palette
14
15
PSG/PPI background palette
16
17 Custom settings in use flag (must be #42)
18 Double reset on “cold boot” (1=enabled)
19 FMPAC mono (1=enabled)
1A Last used entry
1B Music playback status
1C Autostart entry number
1D Help scroller status
1E Dual-PSG status
1F Autostart delay
20 Slot 3 usage flag
21 User-configurable ID and control port number

Writing to EEPROM is done via the configuration register CardMDR+#23. The commands for EEPROM are saved into this register
in a sequence that is described in the chip's datasheet. Only write–enable, read and write commands are used.

Configuration registers

The configuration registers are located at addresses #0F80 or #4F80 or #8F80 or #CF80h. Their visibility and location is
controlled by the main control register's first byte — at address #4F80. The main control register is called CardMDR. After
power on, the registers are located at address #4F80. All registers are write–only except the pseudo–register for
sending/receiving the data when accessing the FlashROM and the register for the configuration EEPROM, as well as 3 bytes of
the firmware version - FPGA_ver.

Below you can find the description of configuration registers.

Register number, name Bit number Value Description

00 CardMDR Main cartridge's configuration register
01 AddrM0 lower address register (bits 7–0) for accessing the FlashROM
02 AddrM1 middle address register (bits 15–8) for accessing the FlashROM
03 AddrM2 higher address register (bits 22–16) for accessing the FlashROM

4/16
 Register number, name Bit number Value Description
04 DatM0 pseudo–register for sending/receiving data from/to FlashROM
register controlling the number of FlashROM's 64 KB block for ROM emulation
05 AddrFR
The default value of this register is 00h
06 R1Mask
07 R1Addr
08 R1Reg Configuration registers for bank 1
09 R1Mult
0A B1MaskR
0C R2Mask
0D R2Addr
0E R2Reg
Configuration registers for bank 2
0F R2Mult
10 B2MaskR
11 B2AdrD
12 R3Mask
13 R3Addr
14 R3Reg
Configuration registers for bank 3
15 R3Mult
16 B3MaskR
17 B3AdrD
18 R4Mask
19 R4Addr
Configuration registers for bank 4
1A R4Reg
1B R4Mult
1C B4MaskR similar to B1MaskR
1D B4AdrD similar to B1AdrD
1E Mconf Expanded slot configuration register
1F CMDRCpy copy of the CardMDR+#00 register (to be used with LDIR command)
FlashROM chip's configuration
20 ConfFl
The default value of this register is — 010b
0 8 bit bus
2
1 16 bit bus
1 Reset/protect flag
1 enable 12V for boosted writing into FlashROM
0
0 зdisable 12V for boosted writing into FlashROM
Non-standard Register
21 NSReg
The default value of this register is #00, please don't change it!
volume level register
22 SndLVL
The default value of this register is 1Bh (00011011b)
10 = FMPAC mono,
7, 6
00 = FMPAC stereo
5, 4, 3 FMPAC audio level (0–7)
2, 1, 0 SCC/SCC+ audio level (0–7)
23 CfgEEPR register for controlling additional configuration EEPROM (93C46)

5/16
 Register number, name Bit number Value Description
7, 6, 5, 4 not used
3 EECS signal Chip Select EEPROM
2 EECK signal CLK (sync)
1 EEDI signal Data Input (data sent to EEPROM)
0 EEDO signal Data Output (data received from EEPROM); read–only
PSG control register
24 PSGCtrl
The default value of this register is 1Bh (00011011b)
7 enable/disable PSG
6 enable/disable PPI Clicker
5, 4, 3 PSG audio level (0–7)
2, 1, 0 PPI Clicker audio level (0–7)
25 reserved for future use
26 reserved for future use
27 reserved for future use
activation flag for interceptor code on system restart or read from #4000
0
1 enabled
interceptor code's location
1 0 boot menu in FlashROM
1 first shadow RAM block
28 SLM_cfg per–device subslot assignment (master slot)
7
FMPAC subslot number
6
5
RAM (Mapper MMM) subslot number
4
3
IDE (CF) subslot number
2
1
FlashROM/SCC subslot number
0
29 SCART_cfg slave slot control register
1 slave slot enabled
7
0 slave slot disabled
1 slave slot's location assigned by user
6
0 slave slot assigned as subslot of master slot
1 slave slot expanded (if not used as a subslot of master slot)
5 slave slot non–expanded (if not used as a subslot of master
0
slot)
1 master slot's location is assigned by user
4
0 master slot located at the physical slot
1
3 not used
0
allow slot select register for emulated slot (used only for slots 1
1
and 2)
2
disable slot select register for emulated slot (real slot's register
0
will be used)

6/16
 Register number, name Bit number Value Description
2A SCART_SLT slot/subslot configuration on power–on
00 = mini ROM up to 32 KB without mapper
01 = K4 mapper
7, 6
10 = K5 mapper without SCC
11 = K5 mapper + SCC
5, 4 master slot number
3, 2 expanded slave slot number
1, 0 slave slot number
2B SCART_StBl slave slot's 64 KB block assignment in FlashROM
2C, 2D, 2E FPGA_ver FPGA firmware version (3 ASCII bytes)
2F MROM_offs = mini ROM offset in 64 KB block (in 8 KB steps)
30 PSGAlt PSG port configuration
1 reserved
1 alternative ports: #10-#11
0
0 default ports: #A0-#A1
35 PFXN User-configurable I/O port number for ID and control

Registers of configuration bank

There are six bank configuration registers:

1. RnMask
2. RnAddr
3. RnReg
4. RnMult
5. BnMaskR
6. BnAdrD

n — this is the bank number.

RnMask

Bitmask for bank's register address. This value is normally mirrored into several addresses, for example for Konami 5
cartridges those addresses for the first bank are 5000h–57FFh. Here we use only the high byte's address — F8h (11111000b).

The default value of this register is F8h

RnAddr

High byte of the bank's address register (example: 50h for address 5000h)

The default value of this register is 50h.

RnReg

Initial value for bank's number (usually 00h)

The default value of this register is 00h.

7/16
RnMult

RnMult — bank's mode and size register

Bit number Value Description

1 bank's register is enabled
7
0 bank's control is disabled
1 mirroring is disabled
6
0 mirroring is enabled
media type selection
5 0 FlashROM
1 RAM
1 writing to bank is enabled
4
0 writing to bank is disabled
0 bank is enabled
3
1 bank is disabled
bank's size
111b = 64 KB,
110b = 32 KB,
2,
101b = 16 KB,
1,
100b = 8 KB,
0
011b = 4 KB
other value — bank is disabled
The default value of this register is 85h

The default value is 00h (bank is disabled)

BnMaskR

Bitmask for bank's addressing mode into the FlashROM. This is the ROM's emulated size and the number of pages. For
example for a 128 KB ROM we will need 16 pages of 8 KB, so we set the 0Fh (00001111b) mask.

The default value of this register is 03h

BnAdrD

High byte of the bank's address (example: 40h for address 4000h).

The default value of this register is 40h

CardMDR
00 CardMDR — main cartridge's configuration register

Bit number Value Description

1 don't show registers
7
0 show registers
6
0/1/2/3 registers are located at addresses 0F80h/4F80h/8F80h/CF80h
5
1 SCC enabled
4
0 SCC disabled

8/16
 Bit number Value Description
1 delayed configuration
3
0 configuration is changed immediately after updating the registers
0 delayed configuration is enabled after CPU executes at address 0000h
2 configuration is enabled after reading from address 4000h
1
The delayed configuration works only for AddrFR and bank control registers
source for BIOS of embedded devices
0 BIOS data (boot menu, IDE controller, FMPAC) is read from FlashROM chip
1
BIOS data (boot menu, IDE controller, FMPAC) is read from RAM
1
Warning! The data must be copied into DAM before setting this bit!
configuration registers visibility control
all configuration registers are visible at addresses 0F80h/4F80h/8F80h/CF80h depending on the
0
0 values of bits 5 and 6
configuration registers are not visible, 1 byte of data from the corresponding block in the FlashROM
1
is available at those addresses

Mconf
1E Mconf — expanded slot configuration register

Bit number Value Description

1 slot is expanded
7
0 slot is not expanded
6 1 MMM mapper ports FC,FD,FE,FF reading is enabled
5 1 control YM2413 (FM Pack Synt. 7Ch,7Dh)
4 1 control 3С порта (МММ mapper)
3 1 control -3 Subslot FM Pack bios ROM
2 1 control -2 Subslot MMM mapper with 1 MB of RAM is enabled
1 1 control -1 Subslot CF card interface
0 1 control -0 Subslot MSCC (and this register)

Directory entry format

There are 253 user–controlled directory entries available in the cartridge. The first directory entry can't be edited or deleted
because it sets the default cartridge's configuration — all enabled. The directory is 8 KB in size and is located in the 2 and 3
logical blocks of the FlashROM chip at addresses 004000h–005FFFh (block 2) and 006000h–007FFFh (block 3). The physical
block number (controlled by the AddrFr register) is zero.

Each directory entry occupies 40h (64 bytes) and has the following format:

Register number Name Bit number Value/description

#00 NUM Record number (last one — #FF is ignored)
#01 ACT Active/empty record's flag (#FF — active record)
#02 STB Starting 64 KB block for data
#03 LNB Data size in 64 KB blocks
#04 MAP Mapper type symbol
#05 NAM
Record name (30 bytes)
#22 NAM

9/16
 Register number Name Bit number Value/description
#23 R1Mask
#24 R1Addr
#25 R1Reg
Configuration registers for bank 1
#26 R1Mult
#27 B1MaskR
#28 B1AdrD
#29 R2Mask
#2A R2Addr
#2B R2Reg
Configuration registers for bank 2
#2C R2Mult
#2D B2MaskR
#2E B2AdrD
#2F R3Mask
#30 R3Addr
#31 R3Reg
Configuration registers for bank 3
#32 R3Mult
#33 B3MaskR
#34 B3AdrD
#35 R4Mask
#36 R4Addr
#37 R4Reg
Configuration registers for bank 4
#38 R4Mult
#39 B4MaskR
#3A B4AdrD
#3B Mconf expanded slot configuration register
#3C CardMDR main configuration register
#3D PosSiz size and position in 64 KB block for mini ROMs
#3E RstRun reset and start options
#3F Resrv Reserved

PosSiz
PosSiz — size and position in 64 KB block for mini ROMs

Bit number Value/description

7 reserved

10/16
 Bit number Value/description
offset of mini ROM in 64 KB block
based on ROM's size:
8 KB 16 KB 32 KB
000b 0 KB 0 KB 0 KB
001b 8 KB 16 KB 32 KB
6,
010b 16 KB 32 KB
5,
4 011b 24 KB 48 KB
100b 32 KB
101b 40 KB
110b 48 KB
111b 56 KB

non–standard ROM size:

3 1 — 49 KB
0 — standard ROM size
mini ROM's size:
110b = 32 KB
2,
101b = 16 KB
1,
100b = 8 KB
0
011b = 4 KB
000b = not mini ROM

RstRun
RstRun — reset and start options

Bit number Value/description

ROM's start address:
3 0 — use bit 2 from this register
1 — use start address at 0002h
ROM's start address:
2 0 — use start address at 4002h
1 — use start address at 8002h
execution control:
1 0 — don't start ROM
1 — start using ROMini address (bits 3,2)
reset flag:
0 0 — do not reset MSX
1 — reset MSX

Mappers

The cartridge supports a few common mappers and the linear mode that allows first 64 KB of the MiniROM to be visible in the
address space. The physical addresses allocated for the mappers' operation lie in the range of 100000h–1FFFFFh. This means
that only the second megabyte of RAM is used.

Mappers type values:

K Konami5 (SCC) mapper

k Konami4 mapper
a ASCII8 mapper
A ASCII16 mapper

11/16
 M mini ROM (8, 16, 32, 48 and 64 KB ROM without mapper)
C configuration entry
U unknown mapper

ASCII8
The cartridge supports the ASCII8 mapper.

Default configuration values:

#F8 #60 #00 #84 #FF #40 bank 1

#F8 #68 #00 #84 #FF #60 bank 2
#F8 #70 #00 #84 #FF #80 bank 3
#F8 #78 #00 #84 #FF #A0 bank 4
#FF #AC #00 #02 #FF configuration registers

ASCII16
The cartridge supports the ASCII16 mapper.

Default configuration values:

#F8 #60 #00 #85 #FF #40 bank 1

#F8 #70 #00 #85 #FF #80 bank 2
#F8 #60 #00 #85 #FF #С0 bank 3
#F8 #70 #00 #85 #FF #00 bank 4
#FF #8C #00 #01 #FF configuration registers

Konami4
The cartridge supports the Konami4 mapper.

Default configuration values:

#E8 #50 #00 #04 #FF #40 bank 1

#E8 #60 #01 #84 #FF #60 bank 2
#E8 #80 #02 #84 #FF #80 bank 3
#E8 #A0 #03 #84 #FF #A0 bank 4
#FF #AC #00 #02 #FF configuration registers

Konami5
The cartridge supports the Konami5 (SCC) mapper.

Default configuration values:

#F8 #50 #00 #84 #FF #40 bank 1

#F8 #70 #01 #84 #FF #60 bank 2
#F8 #90 #02 #84 #FF #80 bank 3
#F8 #B0 #03 #84 #FF #A0 bank 4
#FF #BC #00 #02 #FF configuration registers

12/16
MiniROM
The cartridge supports MiniROM (ROM images up to 49 KB) without mapper.

Default configuration values:

#F8 #60 #00 #06 #7F #40 bank 1

#F8 #70 #01 #08 #7F #80 bank 2
#F8 #70 #02 #08 #3F #С0 bank 3
#F8 #78 #03 #08 #3F #A0 bank 4
#FF #8C #07 #01 #FF configuration registers

Linear 64 KB mode
The cartridge supports the linear 64 KB mode, when the first 64 KB of the ROM are visible in the address space.

The default configuration values for MiniROMs are:

#F8 #60 #00 #06 #7F #40 bank 1

#F8 #70 #01 #08 #7F #80 bank 2
#F8 #70 #02 #08 #3F #C0 bank 3
#F8 #78 #03 #08 #3F #A0 bank 4
#FF #8C #07 #01 #FF configuration registers

Bank addresses in linear mode:

#0000–#3FFF bank 1
#4000–#7FFF bank 2
#8000–#BFFF bank 3
#C000–#FFFF bank 4

Default register values

Below you can find the default values for several configuration registers.

CardMDR CardMDR+#00 20h (but may vary because of 2 last bits)

AddrFR CardMDR+#05 00h
R1Mult CardMDR+#09 85h
R2Mult CardMDR+#0F 00h
R3Mult CardMDR+#15 00h
R4Mult CardMDR+#1B 00h
CMDRCpy CardMDR+#1F 20h
ConfFl CardMDR+#20 02h

RCP file format

RCP file format description.

Address (byte) Description

#00 Mapper type

13/16
 Address (byte) Description
#01 R1Mask
#02 R1Addr
#03 R1Reg
Configuration registers for bank 1
#04 R1Mult
#05 B1MaskR
#06 B1AdrD
#07 R2Mask
#08 R2Addr
#09 R2Reg
Configuration registers for bank 2
#0A R2Mult
#0B B2MaskR
#0C B2AdrD
#0D R3Mask
#0E R3Addr
#0F R3Reg
Configuration registers for bank 3
#10 R3Mult
#11 B3MaskR
#12 B3AdrD
#13 R4Mask
#14 R4Addr
#15 R4Reg
Configuration registers for bank 4
#16 R4Mult
#17 B4MaskR
#18 B4AdrD
#19 Mconf
#1A CardMDR
#1B PosSiz
#1C RstRun
#1D Not used, always FF

User-defined ID and control port I/O

Carnivore2 can be detected and controlled via its own configurable port #F0-F2. The following I/O operations are possible:

1. Detection of the cartridge

Write “C” to port, then read the value. Carnivore2 will respond with its version - “2” (ASCII format)
2. Identify the slot used by Carnivore2
Write “S” to port, then read the value. Carnivore2 will respond with its slot, for example “1” (ASCII format)
3. Hide control registers
Write “H” to port, the control registers will be hidden
4. Show control registers
Write “R” to port, control the registers will appear at their defined location (see below)
5. Set location for control registers
Write “0” to port, the control registers will appear at #0F80
Write “1” to port, the control registers will appear at #4F80
Write “2” to port, the control registers will appear at #8F80
Write “3” to port, the control registers will appear at #CF80
6. Set cartridge's device configuration (software reset is required!)
Write “A” to port, the cartridge will enable only the main slot (one device only)

14/16
 Write “M” to port, the cartridge will set the default configuration (all devices enabled)

Links

Carnivore2 User Guide

15/16
https://sysadminmosaic.ru/en/msx/carnivore2/specification

2024-02-27 08:53

16/16