ACA1234 registers
General
The ACA1234 is the 2021-incarnation of our 128MByte-MC68030 accelerator.
- memory is autoconfig, so even Kickstart V3.0 users have full memory from a cold start without the ACAtune tool
- MapROM is now activated with a different tool, ACAtool
- Chipram access speed has been tweaked for each CPU clock speed
- A1200-IDE access speed has been improved
- improved Fastmem write speed
- FPU option (at the customer's risk - operation guaranteed only without FPU)
- 1MB MapROM option
- 8MByte flash for storing Kickstart ROMs and installation software
- can be completely disabled and re-enabled without power cycling the computer
Autoconfig
The ACA1234 uses Z2/Z3 Autoconfig through the Z2 config window $00e8.0000. Vendor ID $1212 and product IDs 28/29 ($1C/$1D). In 68ec020 mode, the card is completely dormant, only waiting for the "magic sequence" to re-activate the 68030 CPU. The physical board size in 68030 mode is 128MByte. Subsize is "auto-sized", which results in a single 126MByte block starting at address $4000.0000. All registers are available through the Z2 autoconfig space, which has product ID 28 ($1C). This will make all registers available to control software without having to deal with MMU settings. However, MMU windows still have to be checked if the MapROM area shall be written to, as it won't be in the free memory pool by default.
The Diagvector of the Z2 card points to $8000, resulting in the Autoconfig ROM to be located at $e9.8000. This space is filled from SPI flash on startup (see further down). Further, the SPI flash contents are checked for two bytes containing the complement of each other: Only if this is the case, the Diagvector is marked as "valid" in the Autoconfig nibbles. The Diagvector of the Z3 board shows a valid value, but is marked as invalid, as there is no ROM in the Z3 memory area.
The serial number of both Autoconfig entries is not used and is currently 0.
memory map
Memory areas not shown will access the host computer. Exception: A few spaces in the $07xx.xxxx area are mentioned for their special usefullness, such as adding trapdoor-memory of the host computer to the free memory pool (well, if you must...). The whole 16M space at $07xx.xxxx is the host computer's 16M without any alterations, giving you access to all memory or even a mis-behaving autoconfig card that also resides in $e9.0000.
address range | description |
---|---|
$00c0.0000 to $00cf.ffff | 1MB Fastmem |
$00d0.0000 to $00d7.ffff | 512k read-only mirror from fastmem (aka "dead space") |
$00e0.0000 to $00e7.ffff | 512KB physical ROM or mapped Fastmem, depending on MapROM bit |
$00f8.0000 to $00ff.ffff | 512KB physical ROM or mapped Fastmem, depending on MapROM bit |
$0100.0000 to $06ff.ffff | mirrors of lower 16M area as shown above |
$07c0.0000 to $07d7.ffff | 1.5M area mapped from host computer $00c0.0000 to $00d7.ffff |
$07e0.0000 to $07e7.ffff | 512KB physical ROM regardless of MapROM register |
$07f8.0000 to $07ff.ffff | 512KB physical ROM regardless of MapROM register |
$4000.0000 to $47df.ffff | 126MB Fastmem |
$47e0.0000 to $47ef.ffff | 1MB read-only mirror of trapdoor mem space (write-protected) |
$47f0.0000 to $47f7.ffff | 512KB lower MapROM space (will show in $00e0.0000 when enabled) |
$47f8.0000 to $47ff.ffff | 512KB upper MapROM space (will show in $00f8.0000 when enabled) |
Jumpers
register space
All register accesses are 8-bit wide on even addresses of the 64k Autoconfig area in $00e9.0000 after auto configuration. Odd addresses contain random data on reads, and should not be written to, as they trigger the neighbouring even-address registers.
address range | description |
---|---|
$00e9.0000 to $00e9.3fff | Z2 autoconfig nibbles, dedicated write-registers |
$00e9.4000 to $00e9.7fff | CF card slot (8 addresses only, depending on selected CF space) |
$00e9.8000 to $00e9.ffff | transfer RAM (128 bytes, even addresses) |
Registers
Write registers are located just "above" the config nibbles at offset $80. Although the whole space is 16k in size, only address lines A1 to A7 are decoded, resulting in 128 total even addresses with a gap of one byte each (the odd byte) that are mirrored 64 times. Note that these 128 addresses also contain the config nibbles.
unlock/lock sequence
Registers are locked by default after a reset or a power-up. Before writing to any register has an effect, you need to go through the unlock sequence, which is designed to keep any undesired things from happening if a crashed CPU is accessing lots of memory locations in a row. The unlock sequence must be written to address $e9.007e as five byte-writes of the decimal values 0,30,4,20,13. After this write-sequence, all other write-registers are unlocked. It is recommended to write $ff to $e9.007e after register operations have been completed - this (and deviating from the unlock sequence) will lock other registers.
register overview
Registers are shown with their primary address only. There are mirrors, which you should generally consider off-limits.
address | write | read |
---|---|---|
$00e9.007e | Unlock sequence port | status byte 1 |
$00e9.0080 | Switch-off port | status byte 2 |
$00e9.0082 | Set Speed | # of trial runs left |
$00e9.0084 | Resident Scratchpad | Resident Scratchpad |
$00e9.0086 | stop SPI command | initiate read-trigger |
$00e9.0088 | Set CF register space | license bits |
$00e9.008a | (de)activate IDE speeder | refund bits |
$00e9.008c | Get card information | Diagnosis flags |
$00e9.008e | Copy SPI contents | $20 |
$00e9.0090 | SPI write port | SPI read port/$70 |
$00e9.0092 | SPI write port | SPI read port/$00 |
$00e9.0094 | SPI write port | SPI read port/$4e |
$00e9.0096 | SPI write port | SPI read port/$75 |
$00e9.0098 | EEProm operations | $20 |
$00e9.009a | Licensing operations | $20 |
$00e9.009c | MapROM reset | $20 |
$00e9.009e | MapROM set | $20 |
Status register bits
The status registers are always active and visible, regardless of the lock state of the write-registers.
register | Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
---|---|---|---|---|---|---|---|---|
byte 1 | 80MHz | 66MHz | Found A1200 | S | E | Div2 | IDE-Speeder | MapROM |
byte 2 | JP0 | JP1 | Osc1 err | Osc2 err | Osc3 err | Locked | Host err | LED red |
Diag flags | SeenGoodVoltage | Voltage warning | PSU err | Limpmode | License Fail | Genlock | PAL | NTSC |
The upper two bits of byte 1 show the speed of SD-Ram: If a bit is 1, then the corresponding speed is active. Both bits will never be 1 at a time, for obvious reasons. If both bits are 0, then the current SD-Ram frequency is 50MHz.
The "Found A1200" bit will be 1 if the host computer is an A1200. If it's an ACA500, ACA500plus or ACA2000, this bit will be 0.
The S and E bits are for internal informational purpose only - they reflect the optimization strategy when accessing the host computer's bus. For 33 and 40MHz operation, the S-bit is 1. For 25 and 40MHz operation, the E-bit is 1.
The Div2 bit shows the CPU speed in relation to SD-Ram speed: If it is 1, the SD-Ram speed is divided by two. If this bit is 0, SD-Ram clock and CPU clock are equal.
If the "IDE-Speeder" bit is 1, then accesses to the data port of the A1200 Gayle-based IDE controller are accelerated.
If the MapROM bit is 1, then areas $00e0.00000 to $00e7.ffff and $00f8.0000 to %00ff.ffff are swapped out for 32-bit RAM - see memory map above.
The JP0 and JP1 bits show the state of the board jumpers: JP0 is set when a jumper connects the middle pin with the pin at the board edge. JP1 is set when the middle pin is connected to the inner pin. Both bits are never set at the same time.
The OSC err bits show the result of the power-up self-test of the card: If one of the oscillators does not work, it will be shown in the corresponding bit and may help in faster repair diagnosis. The MCU will always attempt to avoid using a non-working oscillator and launch the system anyway, albeit with a safe configuration of no chipram optimization, no CF card controller and no IDE speeder. Timings for these parts of the design may be off, so they are switched off for safety reasons.
The Host Err bit is set to 1 if the host computer's bus frequency is found to be lower than 14.18MHz (PAL) or higher than 14.32MHz (NTSC). This may be the case if the host ACA500plus is set to the wrong bus frequency. Since chip ram access timing optimizations are only working properly if the relation between host frequency and accelerator is correct, these optimizations are switched off when an error has been found, and the same precautions are taken as for a non-working crystal oscillator. This may or may not lead to the card being in limp mode. In any case, the result of self-diagnosis can be read.
The "Locked" bit shows the current status of write-register locking. The "LED red" bit shows the state of the red error LED on the card.
DiagFlags: "SeenGoodVoltage" is a bit that is set whenever the main voltage goes above 4.85V (the magical minimum voltage that most low-drop 3.3V regulators require). This bit will remain set until the next power cycle. The "voltage warning" bit is real-time and will be 1 whenever the VCC rail drops below 4.85V. The PSUerr bit will be set if the voltage drops below 4.85V after having been above that threshold - this is also a storage bit that can only be cleared with a power cycle. If the "Limpmode" bit is 1, the user will surely notice from the slow speed of the system, and probably from the blinking red LED on the card, but this bit confirms limp mode to a tool that may be able to explain the cause to the user by combining some information from self-diagnosis. The "License Fail" bit will be set if the Kickstart/Workbench license was not found. PAL or NTSC bits will be set (only one at a time) if the host computer's frequency was found to be one or the other. The "Genlock" bit will be set if the frequency of the host computer is off a bit - the general assumption is that if the computer has a Genlock interface, the altered timing might collide with the chip ram access optimizations of the ACA1234. While this may work OK for slower host frequencies, it may or may not fail at faster frequencies (especially on NTSC machines). The user should be warned that operation may not be stable if the host computer runs at a non-standard frequency.
Switch-off port
Writing $14 (decimal 20) to this register when unlocked will cause an immediate reset and switch to the host computer's CPU: In case of an A1200, the 68ec020, and in case of the ACA500/ACA500plus, the 68(s)ec000. This will switch off all memory, including MapROM and $c0 memory; the ACA1234 is in complete stealth mode after this write-access, so the computer will appear as if this card is not connected. Note that by switching off MapROM, this CPU-switch may also mean a Kickstart version change, which requires more software intervention to make Kickstart run through all of it's power-up procedures.
While the ACA1234 is switched off, it is lurking on the bus for the magic sequence that takes it back to 68030 mode. This sequence in non-interactive, meaning you cannot read anything on the bus that may tell you if the ACA1234 is actually there. The only way to find out if the ACA1234 is connected is to do a few plausibility checks and then run through the sequence. Plausibility checks are mostly "negative indicators":
- if you detect OCS/ECS and a CPU higher than 68000, the ACA1234 can't be there
- if you detect AGA and a CPU other than 68ec020, the ACA1234 can't be there
The magic sequence is non-destructive on all Amiga computers, as it accesses addresses between CIA chips that are empty by design:
- Write $31 to $bf.6000, read from $bf.6000, discard the read-value.
- Write $32 to $bf.6002, read from $bf.6002, discard the read-value.
- Write $33 to $bf.6000, read from $bf.6000, discard the read-value.
- Write $34 to $bf.6002
Reading the same location again will delay the next write by a known amount of time, which is needed to give the (rather slow) micro controller on the ACA1234 enough time to process the access. Further, since there is no feedback from the dormant card, you might want to write these four values in a loop a few times until you time out and confirm that there is no ACA1234 to activate.
If your loop exits after a few rounds, there is no ACA1234 in the computer. If there is an ACA1234 in the computer, the 4th access will issue an immediate reset, the host CPU is switched off and control is given back to the 68030 on the ACA1234. Speed settings will be set to default (whatever has been saved in EEPROM), and MapROM is switched off, so the computer will appear as if it came from a fresh power-up (except for data structures remaining in chip ram). Fastmem contents are preserved from the time that the 68030 has been switched off.
set speed register
Write the desired speed to this register. A speed-change will cause an immediate reset, even if you select the same speed again. You have been warned :-) Available speeds are:
- $01 = 25MHz
- $02 = 33MHz
- $03 = 40MHz
- $04 = 50MHz
If the selected speed is not licensed, trial runs will be checked. If there are trial runs left, they are counted down by one and the selected speed will be chosen. If the number of trials left is 0, the next lower speed will be used. If an undocumented/wrong speed setting is used, the card will revert to "limp mode", where it runs at 25MHz and significantly slower fastmem performance. The users needs to power-cycle to leave limp mode.
Resident Scratchpad
This is a byte that will be initialized to 0 on a power-up only. Any write requires prior execution of the unlock sequence, otherwise the write will be ignored without an error message. Whatever you write into this byte will survive a reset, no matter if it was a soft-reset, a keyboard reset, or a command-initiated reset (for example a speed change). However, it's behaviour is not completely like RAM; it only allows setting bits, but resetting requires all bits to be 1 (value $ff) - in that case, the MCU will allow you to write $00 and "simulate" a power-up. The main purpose of this register is to indicate that the computer is coming from a fresh power-up, or to relay bits of information to the Autoconfig ROM - either from a configuration tool, from installer software or the ACA500plus menu. Software can use it to determine if certain system patches need to be applied, or if the user has requested a special configuration for this boot. Note that this byte is volatile and it's actually stored in RAM of the MCU, so any number of read/write accesses is allowed (unlike EEPROM).
SPI flash operations
The SPI flash interface of the ACA1234 is geared towards more convenient programming than the bit-banging interface of previous products. Your window to the 64MBit chip is the four register addresses at $e9.0090 (read/write port) and address $e9.0086 (Stop trigger). Any write access to one of the write ports will also assert the "slave select" line of the flash chip, initiating a command if the slave select line was de-asserted before. Send any amount of further bytes to the chip using these write addresses. Then continue by reading data from the same address(es) to poll response bytes from the flash chip. To signal the chip that a command has ended, write any value to $e9.0086; this will de-assert the slave select line and put the flash chip into a low-power standby mode. SPI write operations require registers to be unlocked; reading will work without unlocking, though only by using the $e9.0084 read-initiate trigger.
The 2-byte distance and four consecutive mirrors allow using the (otherwise rarely used) movep command.
Example1: Reading the chip ID.
- start by writing to $e9.0086 - this makes sure that any previous command is stopped and the chip is ready to receive the next.
- write $9f to $e9.0090 - this is the RDID command
- read from $e9.0090 - you'll get $1c as the manufacturer ID (Elite semiconductors)
- read from $e9.0090 - you'll get $70 for "flash memory"
- read from $e9.0090 - you'll get $17 or decimal 23 for capacity: 2^23 equals 8MBytes.
- End by de-asserting the slave select line: Write any value to $e9.0086
Example2: Reading a data block
- start by writing to $e9.0086 - it's good practise.
- load a data regsiter (for example D0) with $03001337
- Write D0 to $e9.0090 with the movep.l command
- now read any number of bytes from $e9.0090 - what you get is the contents of the flash array, starting at address $001337. If you read beyond the 8MByte barrier, the address will automatically wrap around and reading continues at address 0. You can use move.b, movep.w or movep.l to read bytes, words or longwords from the flash array.
- End by de-asserting the slave select line: Write any value to $e9.0086
Example3: Polling the WiP bit
- start by writing to $e9.0086 - it's good practise.
- write $05 to $e9.0090 - this is the Read-Status command
- read from $e9.0090 in a timed-out loop and check bit#0 of the byte
- End by de-asserting the slave select line: Write any value to $e9.0086
Note that there is no need to re-issue the "read status" command to get updated information from the chip. Please consult the EN25QH64A data sheet for all commands that the chip supports, and especially for proper timeout values to choose for WiP (write-in-progress) polling.
Example 4: Initiate read with the $e9.0086 read-trigger
The "initiate read-trigger" will do multiple operations upon a byte-read from this address that are geared towards reading a block of data from the SPI flash with minimal code size. Upon a read of this address, the following actions are taken:
- stop any previously-running SPI command (de-assert slave-select line)
- start a new SPI command
- send $03 read command and $000080 start-address
- read byte#1
- read byte#2
- if XOR of these two bytes equals $ff, return byte#1 to 68030 CPU and leave SPI command open
- if XOR of these two bytes is not $ff, return $00 to 68030 CPU and stop SPI command
Now a simple copy-loop can use the byte to have a length to copy from SPI - multiplied by a sane value, if more than 255 longs are required. Even if the case of $00 (=error, two bytes were not complement of each other) is not properly caught by the copy-loop, the SPI read port will still return usable data, as the four read-ports will output static bytes while the SPI flash chip is not selected: movep.l from $e9.0090 will return $70004e75, which is the equivalent of moveq #0,d0;RTS (kudos to Toni Wilen for this brilliant idea!).
Set CF register space
The CF card registers in $e9.4000 are divided into the lower 8 registers and the alternate status/reset registers. Only one group can be accessed at a time. The LSB of the written byte determines the registers that will be active: 1= standard CF/IDE registers, 0= alternate status/reset. The latter will be useful for soft-resetting misbehaving cards that don't come up properly after a power cycle.
(de)activate IDE speeder
The ACA1234 can accelerate accesses to the data port of the Gayle-based IDE controller in the A1200. Note that this can't be switched on if the ACA1234 is connected to an ACA500, ACA500plus or ACA2000, as the architecture of these cards does not allow the kind of acceleration that the A1200 allows. In case of the ACA500plus, the transparent longword-acceleration should be sufficient! Activating the IDE speeder requires the connected IDE devices to be PIO mode 4 compatible. Although the cycle times are not as short as Mode 4 allows, the access times must be this fast, because data must pass through (hopefully!) a buffered IDE interface, the A1200 board, and the board-side data drivers of the ACA1234. This is considerably slower than the local CF port, hence the slower access.
Please note that if you use a 4-way IDE adapter, both IDE ports will be accelerated (addresses $da.0000 and $da.2000). This can safely be done, as the alternate status/device control register is not accelerated. Another thing that may appear in the upper address space is a Catweasel MK1 controller. This will most likely NOT be compatible with the accelerated speed, but with the low amount of units in the field, an update to the multidisk.device will most likely not be required. Any other device that may use this address space and is not compatible with accelerated access speed may use the mirror at addresses $07da.0000/$07da.2000, which will not be accelerated, even if the IDE speeder is activated. This will let you use multiple devices (even master/slave) and make a per-device decision about acceleration if a dedicated device geared towards the ACA1234 is used.
The following table gives a rough idea about the performance that can be expected from the IDE speeder. Measurements taken with Sysinfo, using a rather slow 128MByte DOM. Achievable performance may be higher with better equipment, but the theoretical max. can't be reached in practise, as you still need loop overhead and memory accesses for source/destination data. Measured values are read-only. Theoretical max. is identical for read and write.
CPU speed | no speeder | with speeder | With Speeder and IDEfix | Theoretical max. |
---|---|---|---|---|
25MHz | 1.9 MB/s | 2.87 MB/s | 2.75 MB/s | 10 MB/s |
33MHz | 1.97 MB/s | 3.23 MB/s | 3.35 MB/s | 11.1 MB/s |
40MHz | 1.8 MB/s | 2.87 MB/s | 3.8 MB/s | 11.4 MB/s |
50MHz | 1.94 MB/s | 2.99 MB/s | 4.23 MB/s | 14.29 MB/s |
License/refund bits
register | Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
---|---|---|---|---|---|---|---|---|
1=license active | Maintenance | Combined full | CF controller | IDE speeder | 50MHz | 40MHz | 33MHz | 25MHz |
1=license deactivated | Maintenance | Combined full | CF controller | IDE speeder | 50MHz | 40MHz | 33MHz | 25MHz |
Bits 0-5 should be self-explanatory. Bit#6 ("combined full" license) overrides all lower bits and will enable all speeds, IDE speeder and CF controller, regardless of their refund status. Note that licensing of CF card slot and IDE speeder was only an initial plan and has been implemented before we decided that these will always be part of the package. They remain in the design for possible cut-down versions that resellers may request.
The Maintenance bits have a special meaning: On developer cards, "adding" a maintenance code will erase all licenses and all refund bits, but set the "maintenance license" bit, which will keep the same license code from being entered again. This has been implemented for testing purpose and will most likely not remain in the code for the release version.
Sending a "refund maintenance" code will reset all licenses, refunds and other stored information to factory-default. The "refund maintenance" bit will be set, keeping the same code from being entered again. On developer cards, this code can be entered any number of times, so although the "refund maintenance" bit is set, you can enter the same code again and have the same effect. This can be used to get multiple rounds of testing, and will be reduced to a one-time factory default for all other cards.
Get card information
Write any value to register $e9.008c to have this card's information copied to the transfer RAM area. It is composed of the following parts:
- Version: This is a 0-terminated ascii string with name, version number and compilation date of the MCU code.
- Warranty ID: This is a 0-terminated 5-character string
- CPU mask and speed: This is a 0-terminated string
- Card ID: This is a 12-byte sequence, not terminated, sequence might contain 0-bytes.
- self-diagnosis bytes: This is a 6-byte sequence that contains power-up self-diagnosis data
The rest of the Transfer RAM will be filled with $ff. Note that one of the bytes in the 12-byte Card ID may be $ff, so you really need to count 12 bytes after the three 0-terminated strings. Using $00 or $ff as a termination byte will not work, depending on the ID itself. The six bytes of self-diagnosis data may come in handy for a rare support case. Ideally, these values are displayed in an "about the card"-window of the configuration tool, so they are easily accessible for remote diagnosis of faults.
Copy SPI contents
Writing a value from 0 to 255 to register $e9.008e will copy a 128-page from SPI flash to Transfer RAM. Page 0 is automatically copied there on power-up. This single register write is intended to assist a very short copy-routine that gets up to 32k from SPI flash to load the CF card driver.
EEProm operations
The ACA1234 allows storing a few bytes of information in non-volatile memory of the MCU, outside the SPI flash. This is useful for convenient access in space-constrained routines, or simply to avoid erasing/re-programming an SPI page for storing settings. The EEProm contents cannot be accessed directly. Instead, the 128-byte transfer RAM will be used to gain access to EEProm contents: Write $01 to this register to copy 128 bytes of EEProm data into transfer RAM, which is then accessible in $e9.8000 (even bytes only). Note that the first byte of EEProm space contains four bits of valid information for startup of the ACA1234:
address | Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
---|---|---|---|---|---|---|---|---|
0 | 0 | 0 | 0 | 0 | IDE Speeder | CPU speed#2 | CPU speed#1 | CPU speed#0 |
The upper nibble of this byte must always be 0. The "IDE speeder" bit will be used for the power-up state of the IDE speeder. The three CPU speed bits have the same encoding as the Set Speed register (see there). Example: If byte 0 of EEProm space is $0C, the card will launch with 50MHz and IDE speeder enabled. CAUTION: If a speed is not licensed, trial runs will be counted on every power-up. The user should be warned if he/she is about to save an unlicensed speed.
The other 127 bytes are free for use with the Autoconfig software or the ACAtool.
For writing the Transfer RAM contents back into the EEProm, two steps are required: First, writing to EEProm must be enabled by writing $5a to this register. This will set the internal "EEProm enable"-bit. Next, write $07 to this register. The MCU will now check if the upper nibble of the first byte is 0, and if $5a has been written before. After positive verification, it will transfer all 128 bytes from Transfer RAM into EEProm. Remember to execute the "unlock" procedure first, otherwise even write access to Transfer RAM is inhibited!
Licensing Operations
To perform a licensing operation, write the 15-byte license code to transfer RAM. Write 1 to this register to check the code and add a license if it checks out OK. A clear-text result code (0-terminated string) will be written to transfer RAM after this write access, (partially) overwriting the license code. Caution: Multitasking may be interrupted up to 6 seconds.
Write 2 to this register to check Transfer RAM for a refund license code. A 0-terminated confirmation code will be written to transfer RAM that is meant to be sent back to iComp to confirm that a previously-bought license has been disabled. In case the refund code did not check out, or it has been applied before, a 0-terminated error string will be written to transfer RAM. Since any response is a human-readable, 0-terminated string, a licensing tool may just display this string.
Write 3 to this register to fill transfer RAM with a list of all confirmation codes that have been issued by this card. This may be useful if the user forgot to take note of the confirmation code before.
MapROM set/reset registers
Register $e9009c is for clearing the MapROM bit, and register $e9.009e is for setting the MapROM bit. Register writes must be unlocked, and action is only taken when the hex-value $42 is written. Make sure to prepare the complete 1MByte area, as setting this bit will write-protect the RAM area!
Transfer RAM
This space contains 128 bytes of RAM, yet only at even addresses, so a full 256 bytes of space is taken up. The rest of the 32k area is filled with mirrors of this RAM. On power-up, it is filled with the first 128 bytes of the SPI flash, unless the emergency jumper is set - in that case, it's initialized with all-$FF, prompting the expansion library to not load a ROM during auto-configuration. You can only write to this RAM if registers are unlocked. This space is used to communicate with the micro controller, such as passing commands, persisting settings in the EEPROM of the MCU and adding licenses. See description of write-registers for details about data in this area.