The overall system is still a pretty barebones work in progress, and I've mostly only been testing it for reading and not writing, but it should support doing both with pretty much any cartridge; it's capable of e.g. dumping a 32 Mbit SA-1 cart directly over USB in about 24 seconds, which beats the hell out of having to use the actual firmware's slow and cumbersome SD card support. I remembered other Super UFO-based tools being mentioned here and there so I figured I ought to remember to actually post mine.
Anyway, a copy of my hardware notes for anyone who happens to be interested:
Code: Select all
Super UFO hardware registers by Revenant last updated 2018/07/18 The registers at $2184-218f are automatically enabled when turning on the SNES, but are disabled when launching a game, and are not enabled again if the reset button is pressed. If the UFO registers are NOT enabled: - Reading any register returns open bus - Writing any register except $218a or $218b has no effect - CH376 chip is powered off / USB connection is terminated All other values/effects mentioned below assume the registers are enabled. So, to configure the memory layout, you have to: - write #$0a to $218b to write-enable $218a - write #$00 to $218a to enable BIOS and write-enable other registers - write $2184-2189 to configure DRAM/SRAM/cartridge mapping and optionally (i.e. if booting a game)... - write $218a again to disable BIOS and write-protect other registers - write $218b to write-protect $218a The Super UFO uses the WinChipHead CH376 chip for USB communication and SD card functionality. (See the PDF datasheets in this directory for details) A point of interest: On boot, the 9.x UFO firmware reads and writes $2180-83, $2188, $218d and $218f as a means of decoding the routines which handle $2184-89 (probably to deter counterfeit/clone hardware). It's currently unknown how to read anything from $218d or $218f other than open bus, and writing $218d has no known effects. The equivalent routines are stored "in the clear" in the old 8.x firmware. $2184 - memory control 1 (UFO SRAM mapping, SRAM size, DRAM size) ================================================================= Controls which region of a given bank the UFO SRAM is mapped to, and how much of it is exposed, as well as part of CPU->DRAM address translation. Read from the bytes at $0012 and $0015 in the UFO header. W: CPU->DRAM offset (A22) bit 7: add 16Mbit if A15 = 0 (HiROM upper 32k if 32 Mbit) bit 6: add 16Mbit if A22 = 1 (LoROM if >16 Mbit) (see also $2186 below) if game uses SRAM: W: bits 4-5 = UFO SRAM mapping (A15:12) 0: $6000-7fff 1: $0000-ffff 2: $0000-7fff 3: $8000-ffff bits 0-2 = UFO SRAM size 0: none (open bus) 1/4/5: $800 bytes (16 kbit) 2/6: $2000 bytes (64 kbit) 3: $8000 bytes (256 kbit) 7: $20000 bytes (1 Mbit) $2185 - memory control 2 (UFO SRAM mapping) =========================================== Controls which banks the UFO SRAM is mapped to. Each byte contains 2-bit logic states for 4 address lines, starting with A23 as the top two bits of $2185. Read from the byte at $0016 in the UFO header. W: bits 6-7 = UFO SRAM mapping (A23) bits 4-5 = UFO SRAM mapping (A22) bits 2-3 = UFO SRAM mapping (A21) bits 0-1 = UFO SRAM mapping (A20) 0/1: don't care 2: 0 3: 1 $2186 - memory control 3 (DRAM size) ==================================== Controls the actual UFO DRAM address translation. Essentially, determines which area of DRAM to map to a given SNES CPU address/bank. The highest two bits of this value are in bits 6-7 of $2184, above. All applicable bits in both registers must be set for DRAM address decoding/mirroring to work properly. Read from the byte at $0013 in the UFO header. W: CPU->DRAM offset (A21:18) bit 7: add 8Mbit if A15 = 0 (HiROM upper 32k) bit 6: add 8Mbit if A21 = 1 bit 5: add 4Mbit if A15 = 0 (HiROM upper 32k) bit 4: add 4Mbit if A20 = 1 bit 3: add 2Mbit if A15 = 0 (HiROM upper 32k) bit 2: add 2Mbit if A19 = 1 bit 1: add 1Mbit if A15 = 0 (HiROM upper 32k) bit 0: add 1Mbit if A18 = 1 (see also bits 6-7 of $2184 above) Essentially, the six highest address lines on the UFO DRAM are driven by the output of a 5-bit adder, where the two inputs are - bits 0/2/4/6 of $2186 and bit 6 of $2184, AND the respective bit in A22:18 - bits 1/3/5/7 of $2186 and bit 7 of $2184, AND the inverse of A15 The remaining DRAM address bits are driven by A17:16 and A14:0, so these settings effect every 32kb DRAM region within four consecutive banks (e.g. banks 80-83). In practice, the following combinations are used by the UFO firmware: Size LoROM HiROM 4Mbit $05 $09 8Mbit $15 $25 10Mbit $55 $37 12Mbit $55 $3d 16Mbit $55 $95 24Mbit $55* $f5 32Mbit $55* $55** * also set bit 6 of $2184 ** also set bit 7 of $2184 $2187 - memory control 4 (DRAM/cart mapping) ============================================ Controls which banks the UFO DRAM is mapped to when game mode is active, or which half of the cartridge is mapped in when firmware mode is active. Works like $2185 for DRAM. Read from the byte at $0014 in the UFO header. if firmware mode is enabled ($218a) and cartridge is enabled ($2189): W: bits 6-7 = cartridge mapping (A23) 0: cart A23 = 0 (cart banks $00-7d at $80-fd, open bus at $fe-ff) 1/2/3: cart A23 = 1 (cart banks $80-ff at $80-ff) if game mode is enabled ($218a) and DRAM is enabled ($2189): W: bits 6-7 = UFO DRAM mapping (A23) bits 4-5 = UFO DRAM mapping (A22) bits 2-3 = UFO DRAM mapping (A21) bits 0-1 = UFO DRAM mapping (A20) 0/1: don't care 2: 0 3: 1 $2188 - memory control 5 & hardware status ========================================== Used to set LoROM/HiROM mapping for DRAM address translation. Also returns different hardware info in bits 0-3 depending on what is written to bit 7 of $218f. Read from the byte at $0017 in the UFO header. if $218f & #$80: R: bits 0-3 = constant #$5 (hardware revision?) bits 4-7 = open bus otherwise: R: bit 0 (#$01) = no SD card bit 1 (#$02) = ? (SD card related) bit 2 (#$04) = USB cable connected bit 3 (#$08) = ? bits 4-7 = open bus any time: W: bit 0 (#$01) = UFO DRAM mapping (A15) 0: don't care (HiROM) 1: 1 (LoROM) $2189 - game select =================== Selects what is mapped at "game" banks as selected by $218a. Note that if the cartridge is enabled, writes to those addresses will still also go to DRAM (if it's write-enabled by $218a). SRAM and DRAM mapping are determined by $2184-87. Anything that isn't mapped to either of them will be mapped to the cartridge if it's enabled, or open bus otherwise. W: bits 0-1 = game select firmware mode: 0/2: enable DRAM only (DRAM always at banks $80+, mapping ignored) 1/3: enable cartridge only (map low or high half of cart, see $2187) firmware update mode: 0/2: enable DRAM and SRAM (DRAM always 32 Mbit and at banks $80+) 1: enable SRAM only 3: enable SRAM and cartridge game mode: 0: enable DRAM, SRAM, and cartridge 1/2: enable SRAM only 3: enable SRAM and cartridge $218a - firmware enable ======================= if mapper enabled ($218b): W: #$x0 = firmware mode banks $00-07: UFO firmware banks $08-7d: SRAM banks $80-ff: configurable by $2189 Enable other registers and write-enable DRAM (default power-on state) #$xA = firmware update mode(?) banks $00-07: UFO firmware banks $08-ff: configurable by $2189 (except $7e-7f) Disable other registers (and write-enable DRAM or not?) (set by firmware updater while reflashing) other = game mode banks $00-ff: configurable by $2189 (except $7e-7f) Disable other registers and write-protect DRAM (set when booting into DRAM or cartridge) $218b - mapper enable ===================== W: #$xA = enable writes to $218a $218c - CH376 data port ======================= R/W: input to or output from USB/SD card commands (see datasheets for details) $218d - ??? =========== R/W: unknown (antipiracy) $218e - CH376 command port ========================== R: bit 7 (#$80) = interrupt flag (0: interrupt pending) bits 6-0 = same as data port bits 6-0 W: USB/SD card command (see datasheets for details) $218f - hardware status control =============================== R: unknown (antipiracy) W: bit 7 (#$80) = 0: get CH376 status in $2188 1: get hardware revision (or something) in $2188 bits 0-6 = unknown (antipiracy)