gistfile1.txt

Super UFO hardware registers
by Revenant

last updated 2018/04/04

The registers at $2184-218f are automatically enabled when turning on the SNES,
but are disabled when launching a game, and are not enabled again if the reset
button is pressed.

If the UFO registers are NOT enabled:
 - Reading any register returns open bus
 - Writing any register except $218a or $218b has no effect
 - CH376 chip is powered off / USB connection is terminated

All other values/effects mentioned below assume the registers are enabled.
So, to configure the memory layout, you have to:
- write #$0a to $218b to write-enable $218a
- write #$00 to $218a to enable BIOS and write-enable other registers
- write $2184-2189 to configure DRAM/SRAM/cartridge mapping

and optionally (i.e. if booting a game)...
- write $218a again to disable BIOS and write-protect other registers
- write $218b to write-protect $218a

The Super UFO uses the WinChipHead CH376 chip for USB communication and SD card
functionality. (See the PDF datasheets in this directory for details)


A point of interest:
On boot, the 9.x UFO firmware reads and writes $2180-83, $2188, $218d and $218f
as a means of decoding the routines which handle $2184-89 (probably to deter
counterfeit/clone hardware). It's currently unknown how to read anything from
$218d or $218f other than open bus, and writing $218d has no known effects.
The equivalent routines are stored "in the clear" in the old 8.x firmware.



$2184 - memory control 1 (UFO SRAM mapping, SRAM size, DRAM size)
=================================================================
Controls which region of a given bank the UFO SRAM is mapped to, and how much
of it is exposed.
Also controls the actual UFO DRAM address translation. (See also $2186)
Read from the bytes at $0012 and $0015 in the UFO header.

if game is HiROM:
W: bit 7 (#$80) = DRAM is >16 Mbit

if game is LoROM:
W: bit 6 (#$40) = DRAM is >16 Mbit

if game uses SRAM:
W: bits 4-5 = UFO SRAM mapping (A15:12)
     0: $6000-7fff
     1: $0000-ffff
     2: $0000-7fff
     3: $8000-ffff
   bits 0-2 = UFO SRAM size
     0:     none (open bus)
     1/4/5: $800 bytes (16 kbit)
     2/6:   $2000 bytes (64 kbit)
     3:     $8000 bytes (256 kbit)
     7:     $20000 bytes (1 Mbit)

$2185 - memory control 2 (UFO SRAM mapping)
===========================================
Controls which banks the UFO SRAM is mapped to.
Each byte contains 2-bit logic states for 4 address lines, starting with A23
as the top two bits of $2185. 
Read from the byte at $0016 in the UFO header.

W: bits 6-7 = UFO SRAM mapping (A23)
   bits 4-5 = UFO SRAM mapping (A22)
   bits 2-3 = UFO SRAM mapping (A21)
   bits 0-1 = UFO SRAM mapping (A20)
     0/1: don't care
     2:   0
     3:   1

$2186 - memory control 3 (DRAM size)
====================================
Controls the actual UFO DRAM address translation. (See also bit 6 of $2184 and 
bit 0 of $2188.) All applicable bits in all 3 registers must be set for DRAM 
address decoding to work properly.
Read from the byte at $0013 in the UFO header.

if game is HiROM:
W: #$55 = DRAM is 32 Mbit
   #$f5 = DRAM is 24 Mbit
   #$95 = DRAM is 16 Mbit
   #$3d = DRAM is 12 Mbit
   #$37 = DRAM is 10 Mbit
   #$25 = DRAM is 8 Mbit
   #$09 = DRAM is 4 Mbit
   (these are the values used by the firmware when setting HiROM size. Other
    configurations may or may not work as intended...)

if game is LoROM:
W: bit 6 (#$40) = DRAM is >8 Mbit
   bit 4 (#$10) = DRAM is >4 Mbit
   bit 2 (#$04) = DRAM is >2 Mbit
   bit 0 (#$01) = DRAM is >1 Mbit
   (setting other bits in LoROM mode may invert DRAM address bits or do other
    weird stuff, so be careful)

$2187 - memory control 4 (DRAM/cart mapping)
============================================
Controls which banks the UFO DRAM is mapped to when game mode is active, or
which half of the cartridge is mapped in when firmware mode is active.
Works like $2185 for DRAM. Read from the byte at $0014 in the UFO header.

if firmware mode is enabled ($218a) and cartridge is enabled ($2189):
W: bits 6-7 = cartridge mapping (A23)
     0:     map cart banks $00-7d at $80-fd, open bus at $fe-ff
     1/2/3: map cart banks $80-ff at $80-ff

if game mode is enabled ($218a) and DRAM is enabled ($2189):
W: bits 6-7 = UFO DRAM mapping (A23)
   bits 4-5 = UFO DRAM mapping (A22)
   bits 2-3 = UFO DRAM mapping (A21)
   bits 0-1 = UFO DRAM mapping (A20)
     0/1: don't care
     2:   0
     3:   1

$2188 - memory control 5 & hardware status
==========================================
Used to set LoROM/HiROM mapping for DRAM address translation.
Also returns different hardware info in bits 0-3 depending on what is written
to bit 7 of $218f.
Read from the byte at $0017 in the UFO header.

if $218f & #$80:
R: bits 0-3 = constant #$5 (hardware revision?)
   bits 4-7 = open bus

otherwise:
R: bit 0 (#$01) = no SD card
   bit 1 (#$02) = ? (SD card related)
   bit 2 (#$04) = USB cable connected
   bit 3 (#$08) = ?
   bits 4-7 = open bus

any time:
W: bit 0 (#$01) = DRAM mapping mode (0: HiROM, 1: LoROM)

$2189 - game select
===================
Selects what is mapped at "game" banks as selected by $218a.
Note that if the cartridge is enabled, writes to those addresses will still 
also go to DRAM (if it's write-enabled by $218a).

SRAM and DRAM mapping are determined by $2184-87.
Anything that isn't mapped to either of them will be mapped to the cartridge
if it's enabled, or open bus otherwise.

W: bits 0-1 = game select
firmware mode:
     0/2: enable DRAM only (DRAM always at banks $80+, mapping ignored)
     1/3: enable cartridge only (map low or high half of cart, see $2187)
firmware update mode:
     0/2: enable DRAM and SRAM (DRAM always 32 Mbit and at banks $80+)
     1:   enable SRAM only
     3:   enable SRAM and cartridge
game mode:
     0:   enable DRAM, SRAM, and cartridge 
     1/2: enable SRAM only
     3:   enable SRAM and cartridge

$218a - firmware enable
=======================
if mapper enabled ($218b):
W: #$x0  = firmware mode
           banks $00-0f: UFO firmware
           banks $10-7d: SRAM
           banks $80-ff: configurable by $2189
           Enable other registers and write-enable DRAM
           (default power-on state)
           
   #$xA  = firmware update mode(?)
           banks $00-0f: ??? (possible bus conflicts w/ SRAM)
           banks $10-ff: configurable by $2189 (except $7e-7f)
           Disable other registers (and write-enable DRAM or not?)
           (set by firmware updater while reflashing)
           
   other = game mode
           banks $00-ff: configurable by $2189 (except $7e-7f)
           Disable other registers and write-protect DRAM
           (set when booting into DRAM or cartridge)

$218b - mapper enable
=====================
W: #$xA = enable writes to $218a

$218c - CH376 data port
=======================
R/W: input to or output from USB/SD card commands
     (see datasheets for details)
     
$218d - ???
===========
R/W: unknown (antipiracy)

$218e - CH376 command port
==========================
R: bit 7 (#$80) = interrupt flag (0: interrupt pending)
   bits 6-0 = same as data port bits 6-0
W: USB/SD card command (see datasheets for details)

$218f - hardware status control
===============================
R: unknown (antipiracy)
W: bit 7 (#$80) =
     0: get CH376 status in $2188
     1: get hardware revision (or something) in $2188
   bits 0-6 = unknown (antipiracy)