Created
April 4, 2018 04:43
-
-
Save devinacker/72d107bcc18235ef4ef112538ebc72b5 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Super UFO hardware registers | |
by Revenant | |
last updated 2018/04/04 | |
The registers at $2184-218f are automatically enabled when turning on the SNES, | |
but are disabled when launching a game, and are not enabled again if the reset | |
button is pressed. | |
If the UFO registers are NOT enabled: | |
- Reading any register returns open bus | |
- Writing any register except $218a or $218b has no effect | |
- CH376 chip is powered off / USB connection is terminated | |
All other values/effects mentioned below assume the registers are enabled. | |
So, to configure the memory layout, you have to: | |
- write #$0a to $218b to write-enable $218a | |
- write #$00 to $218a to enable BIOS and write-enable other registers | |
- write $2184-2189 to configure DRAM/SRAM/cartridge mapping | |
and optionally (i.e. if booting a game)... | |
- write $218a again to disable BIOS and write-protect other registers | |
- write $218b to write-protect $218a | |
The Super UFO uses the WinChipHead CH376 chip for USB communication and SD card | |
functionality. (See the PDF datasheets in this directory for details) | |
A point of interest: | |
On boot, the 9.x UFO firmware reads and writes $2180-83, $2188, $218d and $218f | |
as a means of decoding the routines which handle $2184-89 (probably to deter | |
counterfeit/clone hardware). It's currently unknown how to read anything from | |
$218d or $218f other than open bus, and writing $218d has no known effects. | |
The equivalent routines are stored "in the clear" in the old 8.x firmware. | |
$2184 - memory control 1 (UFO SRAM mapping, SRAM size, DRAM size) | |
================================================================= | |
Controls which region of a given bank the UFO SRAM is mapped to, and how much | |
of it is exposed. | |
Also controls the actual UFO DRAM address translation. (See also $2186) | |
Read from the bytes at $0012 and $0015 in the UFO header. | |
if game is HiROM: | |
W: bit 7 (#$80) = DRAM is >16 Mbit | |
if game is LoROM: | |
W: bit 6 (#$40) = DRAM is >16 Mbit | |
if game uses SRAM: | |
W: bits 4-5 = UFO SRAM mapping (A15:12) | |
0: $6000-7fff | |
1: $0000-ffff | |
2: $0000-7fff | |
3: $8000-ffff | |
bits 0-2 = UFO SRAM size | |
0: none (open bus) | |
1/4/5: $800 bytes (16 kbit) | |
2/6: $2000 bytes (64 kbit) | |
3: $8000 bytes (256 kbit) | |
7: $20000 bytes (1 Mbit) | |
$2185 - memory control 2 (UFO SRAM mapping) | |
=========================================== | |
Controls which banks the UFO SRAM is mapped to. | |
Each byte contains 2-bit logic states for 4 address lines, starting with A23 | |
as the top two bits of $2185. | |
Read from the byte at $0016 in the UFO header. | |
W: bits 6-7 = UFO SRAM mapping (A23) | |
bits 4-5 = UFO SRAM mapping (A22) | |
bits 2-3 = UFO SRAM mapping (A21) | |
bits 0-1 = UFO SRAM mapping (A20) | |
0/1: don't care | |
2: 0 | |
3: 1 | |
$2186 - memory control 3 (DRAM size) | |
==================================== | |
Controls the actual UFO DRAM address translation. (See also bit 6 of $2184 and | |
bit 0 of $2188.) All applicable bits in all 3 registers must be set for DRAM | |
address decoding to work properly. | |
Read from the byte at $0013 in the UFO header. | |
if game is HiROM: | |
W: #$55 = DRAM is 32 Mbit | |
#$f5 = DRAM is 24 Mbit | |
#$95 = DRAM is 16 Mbit | |
#$3d = DRAM is 12 Mbit | |
#$37 = DRAM is 10 Mbit | |
#$25 = DRAM is 8 Mbit | |
#$09 = DRAM is 4 Mbit | |
(these are the values used by the firmware when setting HiROM size. Other | |
configurations may or may not work as intended...) | |
if game is LoROM: | |
W: bit 6 (#$40) = DRAM is >8 Mbit | |
bit 4 (#$10) = DRAM is >4 Mbit | |
bit 2 (#$04) = DRAM is >2 Mbit | |
bit 0 (#$01) = DRAM is >1 Mbit | |
(setting other bits in LoROM mode may invert DRAM address bits or do other | |
weird stuff, so be careful) | |
$2187 - memory control 4 (DRAM/cart mapping) | |
============================================ | |
Controls which banks the UFO DRAM is mapped to when game mode is active, or | |
which half of the cartridge is mapped in when firmware mode is active. | |
Works like $2185 for DRAM. Read from the byte at $0014 in the UFO header. | |
if firmware mode is enabled ($218a) and cartridge is enabled ($2189): | |
W: bits 6-7 = cartridge mapping (A23) | |
0: map cart banks $00-7d at $80-fd, open bus at $fe-ff | |
1/2/3: map cart banks $80-ff at $80-ff | |
if game mode is enabled ($218a) and DRAM is enabled ($2189): | |
W: bits 6-7 = UFO DRAM mapping (A23) | |
bits 4-5 = UFO DRAM mapping (A22) | |
bits 2-3 = UFO DRAM mapping (A21) | |
bits 0-1 = UFO DRAM mapping (A20) | |
0/1: don't care | |
2: 0 | |
3: 1 | |
$2188 - memory control 5 & hardware status | |
========================================== | |
Used to set LoROM/HiROM mapping for DRAM address translation. | |
Also returns different hardware info in bits 0-3 depending on what is written | |
to bit 7 of $218f. | |
Read from the byte at $0017 in the UFO header. | |
if $218f & #$80: | |
R: bits 0-3 = constant #$5 (hardware revision?) | |
bits 4-7 = open bus | |
otherwise: | |
R: bit 0 (#$01) = no SD card | |
bit 1 (#$02) = ? (SD card related) | |
bit 2 (#$04) = USB cable connected | |
bit 3 (#$08) = ? | |
bits 4-7 = open bus | |
any time: | |
W: bit 0 (#$01) = DRAM mapping mode (0: HiROM, 1: LoROM) | |
$2189 - game select | |
=================== | |
Selects what is mapped at "game" banks as selected by $218a. | |
Note that if the cartridge is enabled, writes to those addresses will still | |
also go to DRAM (if it's write-enabled by $218a). | |
SRAM and DRAM mapping are determined by $2184-87. | |
Anything that isn't mapped to either of them will be mapped to the cartridge | |
if it's enabled, or open bus otherwise. | |
W: bits 0-1 = game select | |
firmware mode: | |
0/2: enable DRAM only (DRAM always at banks $80+, mapping ignored) | |
1/3: enable cartridge only (map low or high half of cart, see $2187) | |
firmware update mode: | |
0/2: enable DRAM and SRAM (DRAM always 32 Mbit and at banks $80+) | |
1: enable SRAM only | |
3: enable SRAM and cartridge | |
game mode: | |
0: enable DRAM, SRAM, and cartridge | |
1/2: enable SRAM only | |
3: enable SRAM and cartridge | |
$218a - firmware enable | |
======================= | |
if mapper enabled ($218b): | |
W: #$x0 = firmware mode | |
banks $00-0f: UFO firmware | |
banks $10-7d: SRAM | |
banks $80-ff: configurable by $2189 | |
Enable other registers and write-enable DRAM | |
(default power-on state) | |
#$xA = firmware update mode(?) | |
banks $00-0f: ??? (possible bus conflicts w/ SRAM) | |
banks $10-ff: configurable by $2189 (except $7e-7f) | |
Disable other registers (and write-enable DRAM or not?) | |
(set by firmware updater while reflashing) | |
other = game mode | |
banks $00-ff: configurable by $2189 (except $7e-7f) | |
Disable other registers and write-protect DRAM | |
(set when booting into DRAM or cartridge) | |
$218b - mapper enable | |
===================== | |
W: #$xA = enable writes to $218a | |
$218c - CH376 data port | |
======================= | |
R/W: input to or output from USB/SD card commands | |
(see datasheets for details) | |
$218d - ??? | |
=========== | |
R/W: unknown (antipiracy) | |
$218e - CH376 command port | |
========================== | |
R: bit 7 (#$80) = interrupt flag (0: interrupt pending) | |
bits 6-0 = same as data port bits 6-0 | |
W: USB/SD card command (see datasheets for details) | |
$218f - hardware status control | |
=============================== | |
R: unknown (antipiracy) | |
W: bit 7 (#$80) = | |
0: get CH376 status in $2188 | |
1: get hardware revision (or something) in $2188 | |
bits 0-6 = unknown (antipiracy) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment