2 * Support for a few cart mappers and some protection.
5 * This work is licensed under the terms of MAME license.
6 * See COPYING file in the top-level directory.
9 #include "../pico_int.h"
10 #include "../memory.h"
11 #include "eeprom_spi.h"
14 static int have_bank(u32 base)
16 // the loader allocs in 512K quantities
17 if (base >= Pico.romsize) {
18 elprintf(EL_ANOMALY|EL_STATUS, "carthw: missing bank @ %06x", base);
24 /* standard/ssf2 mapper */
25 int carthw_ssf2_active;
26 unsigned char carthw_ssf2_banks[8];
28 static carthw_state_chunk carthw_ssf2_state[] =
30 { CHUNK_CARTHW, sizeof(carthw_ssf2_banks), &carthw_ssf2_banks },
34 void carthw_ssf2_write8(u32 a, u32 d)
38 if ((a & ~0x0e) != 0xa130f1) {
46 if (carthw_ssf2_banks[a >> 1] == d)
53 carthw_ssf2_banks[a >> 1] = d;
55 cpu68k_map_set(m68k_read8_map, target, target + 0x80000 - 1, Pico.rom + base, 0);
56 cpu68k_map_set(m68k_read16_map, target, target + 0x80000 - 1, Pico.rom + base, 0);
59 void carthw_ssf2_write16(u32 a, u32 d)
62 if ((a & ~0x0f) == 0xa130f0)
63 carthw_ssf2_write8(a + 1, d);
66 static void carthw_ssf2_mem_setup(void)
68 cpu68k_map_set(m68k_write8_map, 0xa10000, 0xa1ffff, carthw_ssf2_write8, 1);
69 cpu68k_map_set(m68k_write16_map, 0xa10000, 0xa1ffff, carthw_ssf2_write16, 1);
72 static void carthw_ssf2_statef(void)
75 for (i = 1; i < 8; i++)
76 carthw_ssf2_write8(0xa130f0 | (i << 1), carthw_ssf2_banks[i]);
79 static void carthw_ssf2_unload(void)
81 memset(carthw_ssf2_banks, 0, sizeof(carthw_ssf2_banks));
82 carthw_ssf2_active = 0;
85 void carthw_ssf2_startup(void)
89 elprintf(EL_STATUS, "SSF2 mapper startup");
92 for (i = 0; i < 8; i++)
93 carthw_ssf2_banks[i] = i;
95 PicoCartMemSetup = carthw_ssf2_mem_setup;
96 PicoLoadStateHook = carthw_ssf2_statef;
97 PicoCartUnloadHook = carthw_ssf2_unload;
98 carthw_chunks = carthw_ssf2_state;
99 carthw_ssf2_active = 1;
103 /* Common *-in-1 pirate mapper.
104 * Switches banks based on addr lines when /TIME is set.
107 static unsigned int carthw_Xin1_baddr = 0;
109 static void carthw_Xin1_do(u32 a, int mask, int shift)
113 carthw_Xin1_baddr = a;
116 len = Pico.romsize - a;
118 elprintf(EL_ANOMALY|EL_STATUS, "X-in-1: missing bank @ %06x", a);
122 len = (len + M68K_BANK_MASK) & ~M68K_BANK_MASK;
123 cpu68k_map_set(m68k_read8_map, 0x000000, len - 1, Pico.rom + a, 0);
124 cpu68k_map_set(m68k_read16_map, 0x000000, len - 1, Pico.rom + a, 0);
127 static carthw_state_chunk carthw_Xin1_state[] =
129 { CHUNK_CARTHW, sizeof(carthw_Xin1_baddr), &carthw_Xin1_baddr },
133 // TODO: test a0, reads, w16
134 static void carthw_Xin1_write8(u32 a, u32 d)
136 if ((a & 0xffff00) != 0xa13000) {
141 carthw_Xin1_do(a, 0x3f, 16);
144 static void carthw_Xin1_mem_setup(void)
146 cpu68k_map_set(m68k_write8_map, 0xa10000, 0xa1ffff, carthw_Xin1_write8, 1);
149 static void carthw_Xin1_reset(void)
151 carthw_Xin1_write8(0xa13000, 0);
154 static void carthw_Xin1_statef(void)
156 carthw_Xin1_write8(carthw_Xin1_baddr, 0);
159 void carthw_Xin1_startup(void)
161 elprintf(EL_STATUS, "X-in-1 mapper startup");
163 PicoCartMemSetup = carthw_Xin1_mem_setup;
164 PicoResetHook = carthw_Xin1_reset;
165 PicoLoadStateHook = carthw_Xin1_statef;
166 carthw_chunks = carthw_Xin1_state;
170 /* Realtec, based on TascoDLX doc
171 * http://www.sharemation.com/TascoDLX/REALTEC%20Cart%20Mapper%20-%20description%20v1.txt
173 static int realtec_bank = 0x80000000, realtec_size = 0x80000000;
175 static void carthw_realtec_write8(u32 a, u32 d)
177 int i, bank_old = realtec_bank, size_old = realtec_size;
181 realtec_bank &= 0x0e0000;
182 realtec_bank |= 0x300000 & (d << 19);
183 if (realtec_bank != bank_old)
184 elprintf(EL_ANOMALY, "write [%06x] %02x @ %06x", a, d, SekPc);
186 else if (a == 0x402000)
188 realtec_size = (d << 17) & 0x3e0000;
189 if (realtec_size != size_old)
190 elprintf(EL_ANOMALY, "write [%06x] %02x @ %06x", a, d, SekPc);
192 else if (a == 0x404000)
194 realtec_bank &= 0x300000;
195 realtec_bank |= 0x0e0000 & (d << 17);
196 if (realtec_bank != bank_old)
197 elprintf(EL_ANOMALY, "write [%06x] %02x @ %06x", a, d, SekPc);
200 elprintf(EL_ANOMALY, "realtec: unexpected write [%06x] %02x @ %06x", a, d, SekPc);
202 if (realtec_bank >= 0 && realtec_size >= 0 &&
203 (realtec_bank != bank_old || realtec_size != size_old))
205 elprintf(EL_ANOMALY, "realtec: new bank %06x, size %06x", realtec_bank, realtec_size, SekPc);
206 if (realtec_size > Pico.romsize - realtec_bank)
208 elprintf(EL_ANOMALY, "realtec: bank too large / out of range?");
212 for (i = 0; i < 0x400000; i += realtec_size) {
213 cpu68k_map_set(m68k_read8_map, i, realtec_size - 1, Pico.rom + realtec_bank, 0);
214 cpu68k_map_set(m68k_read16_map, i, realtec_size - 1, Pico.rom + realtec_bank, 0);
219 static void carthw_realtec_reset(void)
224 for (i = 0; i < 0x400000; i += M68K_BANK_SIZE) {
225 cpu68k_map_set(m68k_read8_map, i, i + M68K_BANK_SIZE - 1, Pico.rom + Pico.romsize, 0);
226 cpu68k_map_set(m68k_read16_map, i, i + M68K_BANK_SIZE - 1, Pico.rom + Pico.romsize, 0);
228 cpu68k_map_set(m68k_write8_map, 0x400000, 0x400000 + M68K_BANK_SIZE - 1, carthw_realtec_write8, 1);
229 realtec_bank = realtec_size = 0x80000000;
232 void carthw_realtec_startup(void)
236 elprintf(EL_STATUS, "Realtec mapper startup");
238 // allocate additional bank for boot code
239 // (we know those ROMs have aligned size)
240 i = PicoCartResize(Pico.romsize + M68K_BANK_SIZE);
242 elprintf(EL_STATUS, "OOM");
246 // create bank for boot code
247 for (i = 0; i < M68K_BANK_SIZE; i += 0x2000)
248 memcpy(Pico.rom + Pico.romsize + i, Pico.rom + Pico.romsize - 0x2000, 0x2000);
250 PicoResetHook = carthw_realtec_reset;
253 /* Radica mapper, based on DevSter's info
254 * http://devster.monkeeh.com/sega/radica/
255 * XXX: mostly the same as X-in-1, merge?
257 static u32 carthw_radica_read16(u32 a)
259 if ((a & 0xffff00) != 0xa13000)
260 return PicoRead16_io(a);
262 carthw_Xin1_do(a, 0x7e, 15);
267 static void carthw_radica_mem_setup(void)
269 cpu68k_map_set(m68k_read16_map, 0xa10000, 0xa1ffff, carthw_radica_read16, 1);
272 static void carthw_radica_statef(void)
274 carthw_radica_read16(carthw_Xin1_baddr);
277 static void carthw_radica_reset(void)
279 carthw_radica_read16(0xa13000);
282 void carthw_radica_startup(void)
284 elprintf(EL_STATUS, "Radica mapper startup");
286 PicoCartMemSetup = carthw_radica_mem_setup;
287 PicoResetHook = carthw_radica_reset;
288 PicoLoadStateHook = carthw_radica_statef;
289 carthw_chunks = carthw_Xin1_state;
293 /* Pier Solar. Based on my own research */
294 static unsigned char pier_regs[8];
295 static unsigned char pier_dump_prot;
297 static carthw_state_chunk carthw_pier_state[] =
299 { CHUNK_CARTHW, sizeof(pier_regs), pier_regs },
300 { CHUNK_CARTHW + 1, sizeof(pier_dump_prot), &pier_dump_prot },
301 { CHUNK_CARTHW + 2, 0, NULL }, // filled later
305 static void carthw_pier_write8(u32 a, u32 d)
307 u32 a8, target, base;
309 if ((a & 0xffff00) != 0xa13000) {
315 pier_regs[a8 / 2] = d;
317 elprintf(EL_UIO, "pier w8 [%06x] %02x @%06x", a, d & 0xffff, SekPc);
322 if (!(pier_regs[0] & 2))
328 if (!(pier_regs[0] & 2))
334 if (!(pier_regs[0] & 2))
347 //elprintf(EL_UIO, "pier w8 [%06x] %02x @%06x", a, d & 0xffff, SekPc);
348 elprintf(EL_STATUS, "-- unmapped w8 [%06x] %02x @%06x", a, d & 0xffff, SekPc);
354 if (!have_bank(base))
357 cpu68k_map_set(m68k_read8_map, target, target + 0x80000 - 1, Pico.rom + base, 0);
358 cpu68k_map_set(m68k_read16_map, target, target + 0x80000 - 1, Pico.rom + base, 0);
361 static void carthw_pier_write16(u32 a, u32 d)
363 if ((a & 0xffff00) != 0xa13000) {
364 PicoWrite16_io(a, d);
368 elprintf(EL_UIO, "pier w16 [%06x] %04x @%06x", a, d & 0xffff, SekPc);
369 carthw_pier_write8(a + 1, d);
372 static u32 carthw_pier_read8(u32 a)
374 if ((a & 0xffff00) != 0xa13000)
375 return PicoRead8_io(a);
378 return eeprom_spi_read(a);
380 elprintf(EL_UIO, "pier r8 [%06x] @%06x", a, SekPc);
384 static void carthw_pier_statef(void);
386 static u32 carthw_pier_prot_read8(u32 a)
388 /* it takes more than just these reads here to disable ROM protection,
389 * but for game emulation purposes this is enough. */
390 if (pier_dump_prot > 0)
392 if (pier_dump_prot == 0) {
393 carthw_pier_statef();
394 elprintf(EL_STATUS, "prot off on r8 @%06x", SekPc);
396 elprintf(EL_UIO, "pier r8 [%06x] @%06x", a, SekPc);
398 return Pico.rom[(a & 0x7fff) ^ 1];
401 static void carthw_pier_mem_setup(void)
403 cpu68k_map_set(m68k_write8_map, 0xa10000, 0xa1ffff, carthw_pier_write8, 1);
404 cpu68k_map_set(m68k_write16_map, 0xa10000, 0xa1ffff, carthw_pier_write16, 1);
405 cpu68k_map_set(m68k_read8_map, 0xa10000, 0xa1ffff, carthw_pier_read8, 1);
408 static void carthw_pier_prot_mem_setup(int prot_enable)
411 /* the dump protection.. */
413 for (a = 0x000000; a < 0x400000; a += M68K_BANK_SIZE) {
414 cpu68k_map_set(m68k_read8_map, a, a + 0xffff, Pico.rom + Pico.romsize, 0);
415 cpu68k_map_set(m68k_read16_map, a, a + 0xffff, Pico.rom + Pico.romsize, 0);
417 cpu68k_map_set(m68k_read8_map, M68K_BANK_SIZE, M68K_BANK_SIZE * 2 - 1,
418 carthw_pier_prot_read8, 1);
421 cpu68k_map_set(m68k_read8_map, 0, 0x27ffff, Pico.rom, 0);
422 cpu68k_map_set(m68k_read16_map, 0, 0x27ffff, Pico.rom, 0);
426 static void carthw_pier_statef(void)
428 carthw_pier_prot_mem_setup(pier_dump_prot);
430 if (!pier_dump_prot) {
431 /* setup all banks */
432 u32 r0 = pier_regs[0];
433 carthw_pier_write8(0xa13001, 3);
434 carthw_pier_write8(0xa13003, pier_regs[1]);
435 carthw_pier_write8(0xa13005, pier_regs[2]);
436 carthw_pier_write8(0xa13007, pier_regs[3]);
437 carthw_pier_write8(0xa13001, r0);
441 static void carthw_pier_reset(void)
444 pier_regs[1] = pier_regs[2] = pier_regs[3] = 0;
445 carthw_pier_statef();
446 eeprom_spi_init(NULL);
449 void carthw_pier_startup(void)
455 elprintf(EL_STATUS, "Pier Solar mapper startup");
457 // mostly same as for realtec..
458 i = PicoCartResize(Pico.romsize + M68K_BANK_SIZE);
460 elprintf(EL_STATUS, "OOM");
466 // create dump protection bank
467 for (i = 0; i < M68K_BANK_SIZE; i += 0x8000)
468 memcpy(Pico.rom + Pico.romsize + i, Pico.rom, 0x8000);
471 eeprom_state = eeprom_spi_init(&eeprom_size);
473 Pico.sv.size = 0x10000;
474 Pico.sv.data = calloc(1, Pico.sv.size);
477 carthw_pier_state[2].ptr = eeprom_state;
478 carthw_pier_state[2].size = eeprom_size;
480 PicoCartMemSetup = carthw_pier_mem_setup;
481 PicoResetHook = carthw_pier_reset;
482 PicoLoadStateHook = carthw_pier_statef;
483 carthw_chunks = carthw_pier_state;
486 /* Simple unlicensed ROM protection emulation */
493 static int sprot_item_alloc;
494 static int sprot_item_count;
496 static u16 *carthw_sprot_get_val(u32 a, int rw_only)
500 for (i = 0; i < sprot_item_count; i++)
501 if ((a & sprot_items[i].mask) == sprot_items[i].addr)
502 if (!rw_only || !sprot_items[i].readonly)
503 return &sprot_items[i].val;
508 static u32 PicoRead8_sprot(u32 a)
513 if (0xa10000 <= a && a < 0xa12000)
514 return PicoRead8_io(a);
516 val = carthw_sprot_get_val(a, 0);
521 elprintf(EL_UIO, "prot r8 [%06x] %02x @%06x", a, d, SekPc);
525 elprintf(EL_UIO, "prot r8 [%06x] MISS @%06x", a, SekPc);
530 static u32 PicoRead16_sprot(u32 a)
534 if (0xa10000 <= a && a < 0xa12000)
535 return PicoRead16_io(a);
537 val = carthw_sprot_get_val(a, 0);
539 elprintf(EL_UIO, "prot r16 [%06x] %04x @%06x", a, *val, SekPc);
543 elprintf(EL_UIO, "prot r16 [%06x] MISS @%06x", a, SekPc);
548 static void PicoWrite8_sprot(u32 a, u32 d)
552 if (0xa10000 <= a && a < 0xa12000) {
557 val = carthw_sprot_get_val(a, 1);
560 *val = (*val & 0xff00) | (d | 0xff);
562 *val = (*val & 0x00ff) | (d << 8);
563 elprintf(EL_UIO, "prot w8 [%06x] %02x @%06x", a, d & 0xff, SekPc);
566 elprintf(EL_UIO, "prot w8 [%06x] %02x MISS @%06x", a, d & 0xff, SekPc);
569 static void PicoWrite16_sprot(u32 a, u32 d)
573 if (0xa10000 <= a && a < 0xa12000) {
574 PicoWrite16_io(a, d);
578 val = carthw_sprot_get_val(a, 1);
581 elprintf(EL_UIO, "prot w16 [%06x] %04x @%06x", a, d & 0xffff, SekPc);
584 elprintf(EL_UIO, "prot w16 [%06x] %04x MISS @%06x", a, d & 0xffff, SekPc);
587 void carthw_sprot_new_location(unsigned int a, unsigned int mask, unsigned short val, int is_ro)
589 if (sprot_items == NULL) {
590 sprot_items = calloc(8, sizeof(sprot_items[0]));
591 sprot_item_alloc = 8;
592 sprot_item_count = 0;
595 if (sprot_item_count == sprot_item_alloc) {
597 sprot_item_alloc *= 2;
598 tmp = realloc(sprot_items, sprot_item_alloc);
600 elprintf(EL_STATUS, "OOM");
606 sprot_items[sprot_item_count].addr = a;
607 sprot_items[sprot_item_count].mask = mask;
608 sprot_items[sprot_item_count].val = val;
609 sprot_items[sprot_item_count].readonly = is_ro;
613 static void carthw_sprot_unload(void)
617 sprot_item_count = sprot_item_alloc = 0;
620 static void carthw_sprot_mem_setup(void)
624 // map ROM - 0x7fffff, /TIME areas (which are tipically used)
625 start = (Pico.romsize + M68K_BANK_MASK) & ~M68K_BANK_MASK;
626 cpu68k_map_set(m68k_read8_map, start, 0x7fffff, PicoRead8_sprot, 1);
627 cpu68k_map_set(m68k_read16_map, start, 0x7fffff, PicoRead16_sprot, 1);
628 cpu68k_map_set(m68k_write8_map, start, 0x7fffff, PicoWrite8_sprot, 1);
629 cpu68k_map_set(m68k_write16_map, start, 0x7fffff, PicoWrite16_sprot, 1);
631 cpu68k_map_set(m68k_read8_map, 0xa10000, 0xa1ffff, PicoRead8_sprot, 1);
632 cpu68k_map_set(m68k_read16_map, 0xa10000, 0xa1ffff, PicoRead16_sprot, 1);
633 cpu68k_map_set(m68k_write8_map, 0xa10000, 0xa1ffff, PicoWrite8_sprot, 1);
634 cpu68k_map_set(m68k_write16_map, 0xa10000, 0xa1ffff, PicoWrite16_sprot, 1);
637 void carthw_sprot_startup(void)
639 elprintf(EL_STATUS, "Prot emu startup");
641 PicoCartMemSetup = carthw_sprot_mem_setup;
642 PicoCartUnloadHook = carthw_sprot_unload;
645 /* Protection emulation for Lion King 3. Credits go to Haze */
646 static u8 prot_lk3_cmd, prot_lk3_data;
648 static u32 PicoRead8_plk3(u32 a)
651 switch (prot_lk3_cmd) {
652 case 1: d = prot_lk3_data >> 1; break;
653 case 2: // nibble rotate
654 d = ((prot_lk3_data >> 4) | (prot_lk3_data << 4)) & 0xff;
656 case 3: // bit rotate
658 d = (d >> 4) | (d << 4);
659 d = ((d & 0xcc) >> 2) | ((d & 0x33) << 2);
660 d = ((d & 0xaa) >> 1) | ((d & 0x55) << 1);
662 /* Top Fighter 2000 MK VIII (Unl)
663 case 0x98: d = 0x50; break; // prot_lk3_data == a8 here
664 case 0x67: d = 0xde; break; // prot_lk3_data == 7b here (rot!)
665 case 0xb5: d = 0x9f; break; // prot_lk3_data == 4a
668 elprintf(EL_UIO, "unhandled prot cmd %02x @%06x", prot_lk3_cmd, SekPc);
672 elprintf(EL_UIO, "prot r8 [%06x] %02x @%06x", a, d, SekPc);
676 static void PicoWrite8_plk3p(u32 a, u32 d)
678 elprintf(EL_UIO, "prot w8 [%06x] %02x @%06x", a, d & 0xff, SekPc);
685 static void PicoWrite8_plk3b(u32 a, u32 d)
689 elprintf(EL_UIO, "prot w8 [%06x] %02x @%06x", a, d & 0xff, SekPc);
691 if (addr + 0x8000 > Pico.romsize) {
692 elprintf(EL_UIO|EL_ANOMALY, "prot_lk3: bank too large: %02x", d);
696 memcpy(Pico.rom, Pico.rom + Pico.romsize, 0x8000);
698 memcpy(Pico.rom, Pico.rom + addr, 0x8000);
701 static void carthw_prot_lk3_mem_setup(void)
703 cpu68k_map_set(m68k_read8_map, 0x600000, 0x7fffff, PicoRead8_plk3, 1);
704 cpu68k_map_set(m68k_write8_map, 0x600000, 0x6fffff, PicoWrite8_plk3p, 1);
705 cpu68k_map_set(m68k_write8_map, 0x700000, 0x7fffff, PicoWrite8_plk3b, 1);
708 void carthw_prot_lk3_startup(void)
712 elprintf(EL_STATUS, "lk3 prot emu startup");
714 // allocate space for bank0 backup
715 ret = PicoCartResize(Pico.romsize + 0x8000);
717 elprintf(EL_STATUS, "OOM");
720 memcpy(Pico.rom + Pico.romsize, Pico.rom, 0x8000);
722 PicoCartMemSetup = carthw_prot_lk3_mem_setup;
725 // vim:ts=2:sw=2:expandtab