Oh! Okay - thanks for the heads up. I've never tried them, though I could seeing as I have flash carts that allow replacement BIOSes.l_oliveira wrote:I know, I made most of them.Chilly Willy wrote:There's already a region-free hack to the WonderMega and X'Eye BIOSes. I forget where they were posted... AssemblerGames or maybe SonicRetro...
Anywho, if you want them, you can PM me.
Anyway I just copied Raq's idea ... lol
the problem with X'Eye and Wondermega2 bioses is that I was not able to test them at all and I got reports that they don't work from testers.
HDD (or flash) instead of a CD, questions...
-
- Very interested
- Posts: 2984
- Joined: Fri Aug 17, 2007 9:33 pm
-
- Very interested
- Posts: 53
- Joined: Mon Mar 07, 2011 12:58 am
I'm about to put out a new set, which restores the original behavior of the cartridge booting mechanism you guys discovered a while ago...
I used the TMSS code that was on the bios as data to show the logo. That disrupted the cartridge boot mechanism.
Also the new set of BIOSes will have a routine which skip the SEGA logo screen when the game is started with a button combo from the dashboard menu. That allow you to keep the original BIOS you like and improves compatibility with Japanese games considerably.
Apparently a lot of the Japanese games detect leftovers from the US/PAL SEGA logo screen and halt execution from that. Hence why Datel made their CD region free device skip it.
Finally sorry about this slight thread hijack.
I used the TMSS code that was on the bios as data to show the logo. That disrupted the cartridge boot mechanism.
Also the new set of BIOSes will have a routine which skip the SEGA logo screen when the game is started with a button combo from the dashboard menu. That allow you to keep the original BIOS you like and improves compatibility with Japanese games considerably.
Apparently a lot of the Japanese games detect leftovers from the US/PAL SEGA logo screen and halt execution from that. Hence why Datel made their CD region free device skip it.
Finally sorry about this slight thread hijack.
I plan to spy a little what happens really in this CN1 connector (where the CDDrive board is connected to the MainBoard)
I don't plan to buy an oscillo so do you think something like this will be enough ?
http://dangerousprototypes.com/docs/Ope ... ic_Sniffer
thx
I don't plan to buy an oscillo so do you think something like this will be enough ?
http://dangerousprototypes.com/docs/Ope ... ic_Sniffer
thx
-
- Very interested
- Posts: 616
- Joined: Thu Nov 30, 2006 6:30 am
-
- Very interested
- Posts: 2440
- Joined: Tue Dec 05, 2006 1:37 pm
- Location: Estonia, Rapla City
- Contact:
The CD drive signals are all analog, a logic probe is no good there. Digitalness happens after bunch of the Sony chips.
Mida sa loed ? Nagunii aru ei saa
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen
I don't think the lines I want to "spy" are analogs:
/INT, CDCK, DBx,WFCK, SBSO, ESXK, .....
From what I understand, it's the data for the LC8951 (to manage the DATA side of the CD Drive) and the CXD2500AQ (to manage the AUDIO side of the CD Drive)
Perhaps I'm wrong, I just (re)started to check this yesterday, with the new documents available.
/INT, CDCK, DBx,WFCK, SBSO, ESXK, .....
From what I understand, it's the data for the LC8951 (to manage the DATA side of the CD Drive) and the CXD2500AQ (to manage the AUDIO side of the CD Drive)
Perhaps I'm wrong, I just (re)started to check this yesterday, with the new documents available.
-
- Very interested
- Posts: 2440
- Joined: Tue Dec 05, 2006 1:37 pm
- Location: Estonia, Rapla City
- Contact:
(My MegaCD has full analog ribbons)
Mida sa loed ? Nagunii aru ei saa
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen
-
- Very interested
- Posts: 53
- Joined: Mon Mar 07, 2011 12:58 am
The comms from CD board to MEGA-CD are indeed digital. You have 4 bits of data used to send the CD drive "mechacon" (Mechanics Controller) commands, the I2S bus used by the SANYO chip to retrieve data blocks from the CD DSP, a few control signals also used by the DSP chip to signal the status and type of data on the I2S bus and a bunch of flag signals which tell the large I/O chip the overall status of the drive.KanedaFr wrote:I don't think the lines I want to "spy" are analogs:
/INT, CDCK, DBx,WFCK, SBSO, ESXK, .....
From what I understand, it's the data for the LC8951 (to manage the DATA side of the CD Drive) and the CXD2500AQ (to manage the AUDIO side of the CD Drive)
Perhaps I'm wrong, I just (re)started to check this yesterday, with the new documents available.
The main point of concern for a hardware based drive emulator is understand the low level bus protocol used on the communication of the MEGA-CD sub CPU to the 4 bit CPU serving as mechanism controller on the CD drive. Considering the complexity level of this system, it's possible that it's almost literally what the BIOS is making the sub CPU write at the control registers at the 208 pin chip.
Thanks for pointing the I2S protocol:
I now better understand the BCLK and LRCLK !
I now better understand the BCLK and LRCLK !
thanks! I was getting mad trying to understand these kana "wanchippumaicon"l_oliveira wrote:the CD drive "mechacon" (Mechanics Controller) commands
and a lot of clocks !l_oliveira wrote: the I2S bus used by the SANYO chip to retrieve data blocks from the CD DSP, a few control signals also used by the DSP chip to signal the status and type of data on the I2S bus and a bunch of flag signals which tell the large I/O chip the overall status of the drive.
can you explain it ? I don't understand what you mean.l_oliveira wrote: Considering the complexity level of this system, it's possible that it's almost literally what the BIOS is making the sub CPU write at the control registers at the 208 pin chip.
-
- Very interested
- Posts: 53
- Joined: Mon Mar 07, 2011 12:58 am
I don't know the software specifics, but I am sure you do, since you're one of the scene specialists on MEGA-CD...KanedaFr wrote:can you explain it ? I don't understand what you mean.
Well I was looking at the documentation you guys put out some years ago and there were mentions of sets of 4 bit "instructions" which tell the drive what to do. You see, if you read the schematics you will see these signals:
http://console5.com/techwiki/images/c/c ... 2_of_4.png
CB0-CB3 would be the command bus and probably how it reads back registers from the mechacon chip (CXP-xxxx I don't remember the code now).
Well, if there were a datasheet of the CD drive or anything similar we could dig out how it works at a low level then outline how to simulate it...
A good starting point would be discover what each of these signal names stand for.
I suppose that is supposed to mean "1-chip micon" (one chip micro controller)KanedaFr wrote:thanks! I was getting mad trying to understand these kana "wanchippumaicon"
Edit: changed img tag to URL so the page isn't annoying to read.
Last edited by l_oliveira on Thu Oct 10, 2013 1:12 am, edited 1 time in total.
So you thinks it's the CXP5084 which drive all the things ?l_oliveira wrote:
CB0-CB3 would be the command bus and probably how it reads back registers from the mechacon chip (CXP-xxxx I don't remember the code now).
It will be interesting to dump its rom then....
http://console5.com/wiki/Sega_CD_v1 and sega cd maintenance manual helps a lot !
Well, if there were a datasheet of the CD drive or anything similar we could dig out how it works at a low level then outline how to simulate it...
I'm actually trying to list what are each line on the CN1 connectorA good starting point would be discover what each of these signal names stand for.
Got some of them, get stuck on some other (DFCK?! digital filter clock ? I don't even find where it comes from/go to..) and just understood i2s related one
i wonder why i totally missed the CXP...I suppose that is supposed to mean "1-chip micon" (one chip micro controller)KanedaFr wrote:thanks! I was getting mad trying to understand these kana "wanchippumaicon"
I was on the CXD only...
-
- Very interested
- Posts: 53
- Joined: Mon Mar 07, 2011 12:58 am
There's a few "generic" parts that form a CD Player circuit:
RF Frontend > Interfaces the laser diode and photodiodes with the micon and dsp, provide the PLL loop that controls disc spin speed and keeps lens focused, following commands given by the micon chip
DSP: Correct basic errors on the data stream caused by scratches and other problems with the disc. Also it converts the analogic output from the RF frontend chip into a digital data stream. If the unit is simply a CD Player the I2S output from the DSP can be connected straight to a CD DAC chip. On our case it goes to the SANYO chip instead. That Sanyo chip is what make the MEGA-CD different from a normal CD player.
MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.
Servo driver IC > Drives the motors and magnetic actuators based on commands from the DSP chip and from the MICON.
On the case of the MEGA-CD, the SUB CPU is doing the task a panel controller would do if that drive were being used in a CD player. I know of CD players which use that specific mechanism (including the same circuit board) to play music discs.
RF Frontend > Interfaces the laser diode and photodiodes with the micon and dsp, provide the PLL loop that controls disc spin speed and keeps lens focused, following commands given by the micon chip
DSP: Correct basic errors on the data stream caused by scratches and other problems with the disc. Also it converts the analogic output from the RF frontend chip into a digital data stream. If the unit is simply a CD Player the I2S output from the DSP can be connected straight to a CD DAC chip. On our case it goes to the SANYO chip instead. That Sanyo chip is what make the MEGA-CD different from a normal CD player.
MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.
Servo driver IC > Drives the motors and magnetic actuators based on commands from the DSP chip and from the MICON.
On the case of the MEGA-CD, the SUB CPU is doing the task a panel controller would do if that drive were being used in a CD player. I know of CD players which use that specific mechanism (including the same circuit board) to play music discs.
OK, it's why you said we have to understand the meaning of the CD0-CD3 as a command bus to the miconl_oliveira wrote:
MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.
Do you think it's "basic" stuff like :
read toc
jump to sector
read sector
play
pause
eject
(...SCSI commands?)
I found nothing on programming or dumping the CXP5084 .... it could be interesting to disassemble it program
-
- Very interested
- Posts: 53
- Joined: Mon Mar 07, 2011 12:58 am
CXP5084 was a kind of MCU which would have code developed by the person or company who wishes to use it, then have SONY make the chips in MASKROM. I have a D-202 Discman which uses a CXP5084 chip as MICOM and that chip doesn't work on the MEGA-CD CD player board as the firmware is different in them. Decap would be how to go about dumping the firmware.KanedaFr wrote:OK, it's why you said we have to understand the meaning of the CD0-CD3 as a command bus to the miconl_oliveira wrote:
MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.
Do you think it's "basic" stuff like :
read toc
jump to sector
read sector
play
pause
eject
(...SCSI commands?)
I found nothing on programming or dumping the CXP5084 .... it could be interesting to disassemble it program
About being SCSI or something else, the commands can be anything... Considering that the SONY drive board is semi-generic it is probably following some sort of standard. SCSI is a higher level of protocol than this, as that deal also with an interface which support multiple kinds of devices. This 4 bit bus is something too simple and extremely specific to CD players. Comparing this 4 bit bus interface to SCSI is like comparing the PANASONIC CD interface from 1991 to an ATAPI CD-ROM.
Now about reverse engineering, look what the MEGA-CD SUB CPU does with the CD control register and you can get the commands, I suppose. We can see how it writes, where it writes, what it writes and then probe the outputs of the writes with leds or some sort of probe on these output pins... What you think ?
The 4-bit command protocol was actually (partially) reverse-engineered by Stef, there are some notes (CDD_inf.txt I think, can't check now) which describes the commands used by the BIOS, format, etc... I also figured some missing bits (flag indicating music or data, lead-out status indicating the end of CD,...) used by the BIOS and CD player software, you can find some high-level emulation of CDD here (skip to cdd_process function).
And it's actually made of 10x4-bit words, with the last one being a checksum, first one command id and the rest usually parameters. I've also noticed the BIOS sometmes uses unknown command 0xA before sending PLAY command, I have the feeling it is used for N-Tracks jump configuration.
The communication is driven by two clocks: HOCK from Mega CD main ASIC to CDD (4-bit microprocessor, either Sony CXP5084 or NEC UPD7500 on Model 2, Model 1 seems to have HITACHI chip HMCS400 compatible), CDCK from CDD to main ASIC... I think that these are those ones you need to figure out (main ASIC starts driving HOCK signal once the HOCK bit is set in associated CD register).
CDD also drives the D/M signal (indicates if serial CD data out of DSP is music or data, used by main ASIC to know when to forward SDATA input from DSP to L7883 CDDA DAC/Fader, also reported in one of the CD register bit) and /INT (trigger level 4 interrupt once the last command word has been sent, usually each 1/75 s).
The rest of the signals (serial data, subcode data, serial clocks, C2 error flag, etc) is coming from the DSP (Sony CXD-2500 or -1167 in earlier models) and goes to main ASIC, Sanyo Data Controller (L89510) and CD-DA DAC/Fader (L7883). Sony DSP datasheets have good description of their purpose so it's pretty easy to figure them out. Note that serial CD data (SDATA) is directly connected to the Sanyo CDC chip but goes through the main ASIC before being sent to CD fader, as mentionned above.
And it's actually made of 10x4-bit words, with the last one being a checksum, first one command id and the rest usually parameters. I've also noticed the BIOS sometmes uses unknown command 0xA before sending PLAY command, I have the feeling it is used for N-Tracks jump configuration.
The communication is driven by two clocks: HOCK from Mega CD main ASIC to CDD (4-bit microprocessor, either Sony CXP5084 or NEC UPD7500 on Model 2, Model 1 seems to have HITACHI chip HMCS400 compatible), CDCK from CDD to main ASIC... I think that these are those ones you need to figure out (main ASIC starts driving HOCK signal once the HOCK bit is set in associated CD register).
CDD also drives the D/M signal (indicates if serial CD data out of DSP is music or data, used by main ASIC to know when to forward SDATA input from DSP to L7883 CDDA DAC/Fader, also reported in one of the CD register bit) and /INT (trigger level 4 interrupt once the last command word has been sent, usually each 1/75 s).
The rest of the signals (serial data, subcode data, serial clocks, C2 error flag, etc) is coming from the DSP (Sony CXD-2500 or -1167 in earlier models) and goes to main ASIC, Sanyo Data Controller (L89510) and CD-DA DAC/Fader (L7883). Sony DSP datasheets have good description of their purpose so it's pretty easy to figure them out. Note that serial CD data (SDATA) is directly connected to the Sanyo CDC chip but goes through the main ASIC before being sent to CD fader, as mentionned above.