The overall system is still a pretty barebones work in progress, and I've mostly only been testing it for reading and not writing, but it should support doing both with pretty much any cartridge; it's capable of e.g. dumping a 32 Mbit SA-1 cart directly over USB in about 24 seconds, which beats the hell out of having to use the actual firmware's slow and cumbersome SD card support. I remembered other Super UFO-based tools being mentioned here and there so I figured I ought to remember to actually post mine.
Anyway, a copy of my hardware notes for anyone who happens to be interested:
Code: Select all
Super UFO hardware registers
by Revenant
last updated 2018/07/18
The registers at $2184-218f are automatically enabled when turning on the SNES,
but are disabled when launching a game, and are not enabled again if the reset
button is pressed.
If the UFO registers are NOT enabled:
- Reading any register returns open bus
- Writing any register except $218a or $218b has no effect
- CH376 chip is powered off / USB connection is terminated
All other values/effects mentioned below assume the registers are enabled.
So, to configure the memory layout, you have to:
- write #$0a to $218b to write-enable $218a
- write #$00 to $218a to enable BIOS and write-enable other registers
- write $2184-2189 to configure DRAM/SRAM/cartridge mapping
and optionally (i.e. if booting a game)...
- write $218a again to disable BIOS and write-protect other registers
- write $218b to write-protect $218a
The Super UFO uses the WinChipHead CH376 chip for USB communication and SD card
functionality. (See the PDF datasheets in this directory for details)
A point of interest:
On boot, the 9.x UFO firmware reads and writes $2180-83, $2188, $218d and $218f
as a means of decoding the routines which handle $2184-89 (probably to deter
counterfeit/clone hardware). It's currently unknown how to read anything from
$218d or $218f other than open bus, and writing $218d has no known effects.
The equivalent routines are stored "in the clear" in the old 8.x firmware.
$2184 - memory control 1 (UFO SRAM mapping, SRAM size, DRAM size)
=================================================================
Controls which region of a given bank the UFO SRAM is mapped to, and how much
of it is exposed, as well as part of CPU->DRAM address translation.
Read from the bytes at $0012 and $0015 in the UFO header.
W: CPU->DRAM offset (A22)
bit 7: add 16Mbit if A15 = 0 (HiROM upper 32k if 32 Mbit)
bit 6: add 16Mbit if A22 = 1 (LoROM if >16 Mbit)
(see also $2186 below)
if game uses SRAM:
W: bits 4-5 = UFO SRAM mapping (A15:12)
0: $6000-7fff
1: $0000-ffff
2: $0000-7fff
3: $8000-ffff
bits 0-2 = UFO SRAM size
0: none (open bus)
1/4/5: $800 bytes (16 kbit)
2/6: $2000 bytes (64 kbit)
3: $8000 bytes (256 kbit)
7: $20000 bytes (1 Mbit)
$2185 - memory control 2 (UFO SRAM mapping)
===========================================
Controls which banks the UFO SRAM is mapped to.
Each byte contains 2-bit logic states for 4 address lines, starting with A23
as the top two bits of $2185.
Read from the byte at $0016 in the UFO header.
W: bits 6-7 = UFO SRAM mapping (A23)
bits 4-5 = UFO SRAM mapping (A22)
bits 2-3 = UFO SRAM mapping (A21)
bits 0-1 = UFO SRAM mapping (A20)
0/1: don't care
2: 0
3: 1
$2186 - memory control 3 (DRAM size)
====================================
Controls the actual UFO DRAM address translation.
Essentially, determines which area of DRAM to map to a given SNES CPU address/bank.
The highest two bits of this value are in bits 6-7 of $2184, above. All applicable bits
in both registers must be set for DRAM address decoding/mirroring to work properly.
Read from the byte at $0013 in the UFO header.
W: CPU->DRAM offset (A21:18)
bit 7: add 8Mbit if A15 = 0 (HiROM upper 32k)
bit 6: add 8Mbit if A21 = 1
bit 5: add 4Mbit if A15 = 0 (HiROM upper 32k)
bit 4: add 4Mbit if A20 = 1
bit 3: add 2Mbit if A15 = 0 (HiROM upper 32k)
bit 2: add 2Mbit if A19 = 1
bit 1: add 1Mbit if A15 = 0 (HiROM upper 32k)
bit 0: add 1Mbit if A18 = 1
(see also bits 6-7 of $2184 above)
Essentially, the six highest address lines on the UFO DRAM are driven by
the output of a 5-bit adder, where the two inputs are
- bits 0/2/4/6 of $2186 and bit 6 of $2184, AND the respective bit in A22:18
- bits 1/3/5/7 of $2186 and bit 7 of $2184, AND the inverse of A15
The remaining DRAM address bits are driven by A17:16 and A14:0, so these settings
effect every 32kb DRAM region within four consecutive banks (e.g. banks 80-83).
In practice, the following combinations are used by the UFO firmware:
Size LoROM HiROM
4Mbit $05 $09
8Mbit $15 $25
10Mbit $55 $37
12Mbit $55 $3d
16Mbit $55 $95
24Mbit $55* $f5
32Mbit $55* $55**
* also set bit 6 of $2184
** also set bit 7 of $2184
$2187 - memory control 4 (DRAM/cart mapping)
============================================
Controls which banks the UFO DRAM is mapped to when game mode is active, or
which half of the cartridge is mapped in when firmware mode is active.
Works like $2185 for DRAM. Read from the byte at $0014 in the UFO header.
if firmware mode is enabled ($218a) and cartridge is enabled ($2189):
W: bits 6-7 = cartridge mapping (A23)
0: cart A23 = 0 (cart banks $00-7d at $80-fd, open bus at $fe-ff)
1/2/3: cart A23 = 1 (cart banks $80-ff at $80-ff)
if game mode is enabled ($218a) and DRAM is enabled ($2189):
W: bits 6-7 = UFO DRAM mapping (A23)
bits 4-5 = UFO DRAM mapping (A22)
bits 2-3 = UFO DRAM mapping (A21)
bits 0-1 = UFO DRAM mapping (A20)
0/1: don't care
2: 0
3: 1
$2188 - memory control 5 & hardware status
==========================================
Used to set LoROM/HiROM mapping for DRAM address translation.
Also returns different hardware info in bits 0-3 depending on what is written
to bit 7 of $218f.
Read from the byte at $0017 in the UFO header.
if $218f & #$80:
R: bits 0-3 = constant #$5 (hardware revision?)
bits 4-7 = open bus
otherwise:
R: bit 0 (#$01) = no SD card
bit 1 (#$02) = ? (SD card related)
bit 2 (#$04) = USB cable connected
bit 3 (#$08) = ?
bits 4-7 = open bus
any time:
W: bit 0 (#$01) = UFO DRAM mapping (A15)
0: don't care (HiROM)
1: 1 (LoROM)
$2189 - game select
===================
Selects what is mapped at "game" banks as selected by $218a.
Note that if the cartridge is enabled, writes to those addresses will still
also go to DRAM (if it's write-enabled by $218a).
SRAM and DRAM mapping are determined by $2184-87.
Anything that isn't mapped to either of them will be mapped to the cartridge
if it's enabled, or open bus otherwise.
W: bits 0-1 = game select
firmware mode:
0/2: enable DRAM only (DRAM always at banks $80+, mapping ignored)
1/3: enable cartridge only (map low or high half of cart, see $2187)
firmware update mode:
0/2: enable DRAM and SRAM (DRAM always 32 Mbit and at banks $80+)
1: enable SRAM only
3: enable SRAM and cartridge
game mode:
0: enable DRAM, SRAM, and cartridge
1/2: enable SRAM only
3: enable SRAM and cartridge
$218a - firmware enable
=======================
if mapper enabled ($218b):
W: #$x0 = firmware mode
banks $00-07: UFO firmware
banks $08-7d: SRAM
banks $80-ff: configurable by $2189
Enable other registers and write-enable DRAM
(default power-on state)
#$xA = firmware update mode(?)
banks $00-07: UFO firmware
banks $08-ff: configurable by $2189 (except $7e-7f)
Disable other registers (and write-enable DRAM or not?)
(set by firmware updater while reflashing)
other = game mode
banks $00-ff: configurable by $2189 (except $7e-7f)
Disable other registers and write-protect DRAM
(set when booting into DRAM or cartridge)
$218b - mapper enable
=====================
W: #$xA = enable writes to $218a
$218c - CH376 data port
=======================
R/W: input to or output from USB/SD card commands
(see datasheets for details)
$218d - ???
===========
R/W: unknown (antipiracy)
$218e - CH376 command port
==========================
R: bit 7 (#$80) = interrupt flag (0: interrupt pending)
bits 6-0 = same as data port bits 6-0
W: USB/SD card command (see datasheets for details)
$218f - hardware status control
===============================
R: unknown (antipiracy)
W: bit 7 (#$80) =
0: get CH376 status in $2188
1: get hardware revision (or something) in $2188
bits 0-6 = unknown (antipiracy)