HDD (or flash) instead of a CD, questions...

Chilly Willy · Post by **Chilly Willy** » Thu Aug 22, 2013 12:36 am

l_oliveira wrote:
Chilly Willy wrote:There's already a region-free hack to the WonderMega and X'Eye BIOSes. I forget where they were posted... AssemblerGames or maybe SonicRetro...

Anywho, if you want them, you can PM me.
I know, I made most of them.

Anyway I just copied Raq's idea ... lol

the problem with X'Eye and Wondermega2 bioses is that I was not able to test them at all and I got reports that they don't work from testers.

Oh! Okay - thanks for the heads up. I've never tried them, though I could seeing as I have flash carts that allow replacement BIOSes.

l_oliveira · Post by **l_oliveira** » Thu Aug 22, 2013 1:13 am

I'm about to put out a new set, which restores the original behavior of the cartridge booting mechanism you guys discovered a while ago...

I used the TMSS code that was on the bios as data to show the logo. That disrupted the cartridge boot mechanism.

Also the new set of BIOSes will have a routine which skip the SEGA logo screen when the game is started with a button combo from the dashboard menu. That allow you to keep the original BIOS you like and improves compatibility with Japanese games considerably.

Apparently a lot of the Japanese games detect leftovers from the US/PAL SEGA logo screen and halt execution from that. Hence why Datel made their CD region free device skip it.

Finally sorry about this slight thread hijack.

Post by **KanedaFr** » Wed Oct 09, 2013 9:24 am

I plan to spy a little what happens really in this CN1 connector (where the CDDrive board is connected to the MainBoard)
I don't plan to buy an oscillo so do you think something like this will be enough ?
http://dangerousprototypes.com/docs/Ope ... ic_Sniffer

thx

Mask of Destiny · Post by **Mask of Destiny** » Wed Oct 09, 2013 9:43 am

I have one and it was good enough for snooping on the VDP's VRAM bus.

TmEE co.(TM) · Post by **TmEE co.(TM)** » Wed Oct 09, 2013 12:23 pm

The CD drive signals are all analog, a logic probe is no good there. Digitalness happens after bunch of the Sony chips.

Post by **KanedaFr** » Wed Oct 09, 2013 12:35 pm

I don't think the lines I want to "spy" are analogs:
/INT, CDCK, DBx,WFCK, SBSO, ESXK, .....

From what I understand, it's the data for the LC8951 (to manage the DATA side of the CD Drive) and the CXD2500AQ (to manage the AUDIO side of the CD Drive)
Perhaps I'm wrong, I just (re)started to check this yesterday, with the new documents available.

TmEE co.(TM) · Post by **TmEE co.(TM)** » Wed Oct 09, 2013 12:59 pm

(My MegaCD has full analog ribbons)

l_oliveira · Post by **l_oliveira** » Wed Oct 09, 2013 4:04 pm

KanedaFr wrote:I don't think the lines I want to "spy" are analogs:
/INT, CDCK, DBx,WFCK, SBSO, ESXK, .....

From what I understand, it's the data for the LC8951 (to manage the DATA side of the CD Drive) and the CXD2500AQ (to manage the AUDIO side of the CD Drive)
Perhaps I'm wrong, I just (re)started to check this yesterday, with the new documents available.

The comms from CD board to MEGA-CD are indeed digital. You have 4 bits of data used to send the CD drive "mechacon" (Mechanics Controller) commands, the I2S bus used by the SANYO chip to retrieve data blocks from the CD DSP, a few control signals also used by the DSP chip to signal the status and type of data on the I2S bus and a bunch of flag signals which tell the large I/O chip the overall status of the drive.

The main point of concern for a hardware based drive emulator is understand the low level bus protocol used on the communication of the MEGA-CD sub CPU to the 4 bit CPU serving as mechanism controller on the CD drive. Considering the complexity level of this system, it's possible that it's almost literally what the BIOS is making the sub CPU write at the control registers at the 208 pin chip.

Post by **KanedaFr** » Wed Oct 09, 2013 8:42 pm

Thanks for pointing the I2S protocol:
I now better understand the BCLK and LRCLK !

l_oliveira wrote:the CD drive "mechacon" (Mechanics Controller) commands

thanks! I was getting mad trying to understand these kana "wanchippumaicon"

l_oliveira wrote: the I2S bus used by the SANYO chip to retrieve data blocks from the CD DSP, a few control signals also used by the DSP chip to signal the status and type of data on the I2S bus and a bunch of flag signals which tell the large I/O chip the overall status of the drive.

and a lot of clocks !

l_oliveira wrote: Considering the complexity level of this system, it's possible that it's almost literally what the BIOS is making the sub CPU write at the control registers at the 208 pin chip.

can you explain it ? I don't understand what you mean.

l_oliveira · Post by **l_oliveira** » Wed Oct 09, 2013 10:06 pm

KanedaFr wrote:can you explain it ? I don't understand what you mean.

I don't know the software specifics, but I am sure you do, since you're one of the scene specialists on MEGA-CD...

Well I was looking at the documentation you guys put out some years ago and there were mentions of sets of 4 bit "instructions" which tell the drive what to do. You see, if you read the schematics you will see these signals:

http://console5.com/techwiki/images/c/c ... 2_of_4.png

CB0-CB3 would be the command bus and probably how it reads back registers from the mechacon chip (CXP-xxxx I don't remember the code now).

Well, if there were a datasheet of the CD drive or anything similar we could dig out how it works at a low level then outline how to simulate it...

A good starting point would be discover what each of these signal names stand for.

KanedaFr wrote:thanks! I was getting mad trying to understand these kana "wanchippumaicon"

I suppose that is supposed to mean "1-chip micon" (one chip micro controller)

Edit: changed img tag to URL so the page isn't annoying to read.

Post by **KanedaFr** » Wed Oct 09, 2013 10:29 pm

l_oliveira wrote:
CB0-CB3 would be the command bus and probably how it reads back registers from the mechacon chip (CXP-xxxx I don't remember the code now).

So you thinks it's the CXP5084 which drive all the things ?
It will be interesting to dump its rom then....

Well, if there were a datasheet of the CD drive or anything similar we could dig out how it works at a low level then outline how to simulate it...

http://console5.com/wiki/Sega_CD_v1 and sega cd maintenance manual helps a lot !

A good starting point would be discover what each of these signal names stand for.

I'm actually trying to list what are each line on the CN1 connector
Got some of them, get stuck on some other (DFCK?! digital filter clock ? I don't even find where it comes from/go to..) and just understood i2s related one

KanedaFr wrote:thanks! I was getting mad trying to understand these kana "wanchippumaicon"
I suppose that is supposed to mean "1-chip micon" (one chip micro controller)

i wonder why i totally missed the CXP...
I was on the CXD only...

l_oliveira · Post by **l_oliveira** » Wed Oct 09, 2013 11:15 pm

There's a few "generic" parts that form a CD Player circuit:

RF Frontend > Interfaces the laser diode and photodiodes with the micon and dsp, provide the PLL loop that controls disc spin speed and keeps lens focused, following commands given by the micon chip

DSP: Correct basic errors on the data stream caused by scratches and other problems with the disc. Also it converts the analogic output from the RF frontend chip into a digital data stream. If the unit is simply a CD Player the I2S output from the DSP can be connected straight to a CD DAC chip. On our case it goes to the SANYO chip instead. That Sanyo chip is what make the MEGA-CD different from a normal CD player.

MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.

Servo driver IC > Drives the motors and magnetic actuators based on commands from the DSP chip and from the MICON.

On the case of the MEGA-CD, the SUB CPU is doing the task a panel controller would do if that drive were being used in a CD player. I know of CD players which use that specific mechanism (including the same circuit board) to play music discs.

Post by **KanedaFr** » Wed Oct 09, 2013 11:52 pm

l_oliveira wrote:
MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.

OK, it's why you said we have to understand the meaning of the CD0-CD3 as a command bus to the micon

Do you think it's "basic" stuff like :
read toc
jump to sector
read sector
play
pause
eject

(...SCSI commands?)

I found nothing on programming or dumping the CXP5084 .... it could be interesting to disassemble it program

l_oliveira · Post by **l_oliveira** » Thu Oct 10, 2013 1:10 am

KanedaFr wrote:
l_oliveira wrote:
MICON > Controls the low level tasks related to disc reading such as read disc table of contents, jump tracks, keep the data flowing during playback and other boring housekeeping tasks related to CD playback. Usually (on CD players) it's connected to another chip which controls the panel keys and display.
OK, it's why you said we have to understand the meaning of the CD0-CD3 as a command bus to the micon

Do you think it's "basic" stuff like :
read toc
jump to sector
read sector
play
pause
eject

(...SCSI commands?)

I found nothing on programming or dumping the CXP5084 .... it could be interesting to disassemble it program

CXP5084 was a kind of MCU which would have code developed by the person or company who wishes to use it, then have SONY make the chips in MASKROM. I have a D-202 Discman which uses a CXP5084 chip as MICOM and that chip doesn't work on the MEGA-CD CD player board as the firmware is different in them. Decap would be how to go about dumping the firmware.

About being SCSI or something else, the commands can be anything... Considering that the SONY drive board is semi-generic it is probably following some sort of standard. SCSI is a higher level of protocol than this, as that deal also with an interface which support multiple kinds of devices. This 4 bit bus is something too simple and extremely specific to CD players. Comparing this 4 bit bus interface to SCSI is like comparing the PANASONIC CD interface from 1991 to an ATAPI CD-ROM.

Now about reverse engineering, look what the MEGA-CD SUB CPU does with the CD control register and you can get the commands, I suppose. We can see how it writes, where it writes, what it writes and then probe the outputs of the writes with leds or some sort of probe on these output pins... What you think ?

Eke · Post by **Eke** » Thu Oct 10, 2013 6:46 am

The 4-bit command protocol was actually (partially) reverse-engineered by Stef, there are some notes (CDD_inf.txt I think, can't check now) which describes the commands used by the BIOS, format, etc... I also figured some missing bits (flag indicating music or data, lead-out status indicating the end of CD,...) used by the BIOS and CD player software, you can find some high-level emulation of CDD here (skip to cdd_process function).

And it's actually made of 10x4-bit words, with the last one being a checksum, first one command id and the rest usually parameters. I've also noticed the BIOS sometmes uses unknown command 0xA before sending PLAY command, I have the feeling it is used for N-Tracks jump configuration.

The communication is driven by two clocks: HOCK from Mega CD main ASIC to CDD (4-bit microprocessor, either Sony CXP5084 or NEC UPD7500 on Model 2, Model 1 seems to have HITACHI chip HMCS400 compatible), CDCK from CDD to main ASIC... I think that these are those ones you need to figure out (main ASIC starts driving HOCK signal once the HOCK bit is set in associated CD register).

CDD also drives the D/M signal (indicates if serial CD data out of DSP is music or data, used by main ASIC to know when to forward SDATA input from DSP to L7883 CDDA DAC/Fader, also reported in one of the CD register bit) and /INT (trigger level 4 interrupt once the last command word has been sent, usually each 1/75 s).

The rest of the signals (serial data, subcode data, serial clocks, C2 error flag, etc) is coming from the DSP (Sony CXD-2500 or -1167 in earlier models) and goes to main ASIC, Sanyo Data Controller (L89510) and CD-DA DAC/Fader (L7883). Sony DSP datasheets have good description of their purpose so it's pretty easy to figure them out. Note that serial CD data (SDATA) is directly connected to the Sanyo CDC chip but goes through the main ASIC before being sent to CD fader, as mentionned above.