HDD (or flash) instead of a CD, questions...

For hardware talk only (please avoid ROM dumper stuff)
Post Reply
KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Thu Oct 10, 2013 9:40 am

Eke wrote:The 4-bit command protocol was actually (partially) reverse-engineered by Stef, there are some notes (CDD_inf.txt I think, can't check now) which describes the commands used by the BIOS, format, etc... I also figured some missing bits (flag indicating music or data, lead-out status indicating the end of CD,...) used by the BIOS and CD player software, you can find some high-level emulation of CDD here (skip to cdd_process function).
GREAT !!!!!
very useful!!!
And it's actually made of 10x4-bit words, with the last one being a checksum, first one command id and the rest usually parameters. I've also noticed the BIOS sometmes uses unknown command 0xA before sending PLAY command, I have the feeling it is used for N-Tracks jump configuration.
this is the strange one....
according 5548's doc, it's 5 nibble... so 5x4bits not 10...

more exactly it's 5nibble CDD->MCD then 5nibble MCD->CDD, using the communication mode you described below
The communication is driven by two clocks: HOCK from Mega CD main ASIC to CDD (4-bit microprocessor, either Sony CXP5084 or NEC UPD7500 on Model 2, Model 1 seems to have HITACHI chip HMCS400 compatible), CDCK from CDD to main ASIC... I think that these are those ones you need to figure out (main ASIC starts driving HOCK signal once the HOCK bit is set in associated CD register).
yes, it's clear communication must be perfect.
My main problem is about timing, write handed notes are partialy readable on the manual and it's important to know the exact duration of a HOCK and CDCK pulse...and timing between each nibble.

CDD also drives the D/M signal (indicates if serial CD data out of DSP is music or data, used by main ASIC to know when to forward SDATA input from DSP to L7883 CDDA DAC/Fader, also reported in one of the CD register bit) and /INT (trigger level 4 interrupt once the last command word has been sent, usually each 1/75 s).

The rest of the signals (serial data, subcode data, serial clocks, C2 error flag, etc) is coming from the DSP (Sony CXD-2500 or -1167 in earlier models) and goes to main ASIC, Sanyo Data Controller (L89510) and CD-DA DAC/Fader (L7883). Sony DSP datasheets have good description of their purpose so it's pretty easy to figure them out. Note that serial CD data (SDATA) is directly connected to the Sanyo CDC chip but goes through the main ASIC before being sent to CD fader, as mentionned above.
yep, these ones are "easy" to trace.
My main concern is more SDATA (becoming ODATA and PDATA but it's not really a problem) and timing.

For curiosity and improve my newb electronic skill, why does some of these signals go throught a 74HC245 Octal bus tranceiver ? ESD protection ? to avoid high-impedance (what I call the Z value) ?

ps: 25pin flat cable is so expensive !!! even from china!!

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Thu Oct 10, 2013 11:07 am

Not sure what 5548's doc you are referring to but it is 10 nibbles for each side, TC0-TC9 from CDD for commands and RS0-RS9 from Sega CD for status/ack

You can get some timings for LRCLK, BCLK and WDCLK (this one is only used for subcodes i think) from the model 1 service manual ( pages 74-78 ). The rate (BCLK) is 75 * 2352 * 8 bits per seconds The only clock that should be difficult to replicate is the DFCLK which is ~16MHz DSP clock and is used by CD-DA DAC.

I don't know the purpose of the 74HC245 chip, apparentlly some buffering of these signals is needed...

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Thu Oct 10, 2013 12:08 pm

Eke wrote:Not sure what 5548's doc you are referring to but it is 10 nibbles for each side, TC0-TC9 from CDD for commands and RS0-RS9 from Sega CD for status/ack
page 79 of the model 1 service manual

Code: Select all

5 bytes (10 nible)
page 80

Code: Select all

5 bytes (status) from CD to Host
5 bytes (command) from Host to CD
But I think it's what is done on cdd.c

Code: Select all

 for ex:
scd.regs[0x38>>1].w = CD_OPEN << 8;
scd.regs[0x3a>>1].w = 0x0000;
scd.regs[0x3c>>1].w = 0x0000;
scd.regs[0x3e>>1].w = 0x0000;
scd.regs[0x40>>1].w = ~CD_OPEN & 0x0f;
5 word but only last byte is valid


You can get some timings for LRCLK, BCLK and WDCLK (this one is only used for subcodes i think) from the model 1 service manual ( pages 74-78 ). The rate (BCLK) is 75 * 2352 * 8 bits per seconds The only clock that should be difficult to replicate is the DFCLK which is ~16MHz DSP clock and is used by CD-DA DAC.
yep, audio was always seen as a problem

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Thu Oct 10, 2013 12:29 pm

yes, it uses 10 x 4-bit nibbles (which indeed makes 5 bytes of data in total) for each side, that's what I meant ("words" might not have been the good word to use)

...but there are actually 10 x 8-bit registers (handled as 5 x 16-bit registers in the emulator) and for each byte, only D0-D3 holds valid data (the nibble), which makes 10 x 4-bit nibbles

this should be clearer this way :wink:

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Thu Oct 10, 2013 1:21 pm

ah ah, yes!
I re-read my posts and I sometimes mixed nibbles and bytes. :oops:
We're alright on this one.

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Sun Oct 13, 2013 10:00 pm

I'm almost find every parts (making an useful doc soon) but I still don't understand why CDD generate a 16Mhz clock (DFCK) ...

why not keeping this clock on the MCD side ?
because the CDD and the LCxx needed them and so Sega made the choice to put it on the CDD side ?

TmEE co.(TM)
Very interested
Posts: 2440
Joined: Tue Dec 05, 2006 1:37 pm
Location: Estonia, Rapla City
Contact:

Post by TmEE co.(TM) » Mon Oct 14, 2013 3:12 pm

the 16MHz is 16.934400MHz, which is CDDA bitclock.
Mida sa loed ? Nagunii aru ei saa ;)
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Mon Oct 14, 2013 10:31 pm

Tell me if I'm wrong but the LC8951 is in charge of the AUDIO data correction, yes ? This means 3 ICs to handle the audio part....
In that case, which IC is in charge of the DATA (ROM) mode1 / mode 2 data correction ? the Sega 5548 ?
and the CD+G data extract from subcode ? Sega 5548 again ?

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Tue Oct 15, 2013 9:30 am

Oh ! I didn't notice the MegaCD2 manual got the CD section, missing in MegaCD1's one !!
GREEEEEEAT !

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Tue Oct 15, 2013 3:26 pm

KanedaFr wrote:Tell me if I'm wrong but the LC8951 is in charge of the AUDIO data correction, yes ? This means 3 ICs to handle the audio part....
In that case, which IC is in charge of the DATA (ROM) mode1 / mode 2 data correction ? the Sega 5548 ?
and the CD+G data extract from subcode ? Sega 5548 again ?
no, L8951x only handle CD-ROM data block detection, decoding and error correction, it does nothing to audio data...

audio data is simply passed from the DSP to LC7883 DAC (through the main ASIC), additional layer of correction like with CD-ROM data does not exist for audio data

subcode data (P-W channels for a total of 98 bytes per sector) is acquired by the main ASIC from the DSP (using SCOR, SBCO, WFCK and EXCK signals) then stored into subcode buffer accessible from software (BIOS), which can extract CD-G data if needed.

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Post by KanedaFr » Thu Jul 03, 2014 11:49 am

because this subject is on my todo list, I wrote a page with all the informations shared here or coming from service manuals.
http://gendev.spritesmind.net/page-megasd.html

So, if you find errors or got more details to add, just reply or drop me a pm

Note: it's a WIP, images are coming, etc...

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Re: HDD (or flash) instead of a CD, questions...

Post by KanedaFr » Sat Jun 10, 2017 1:17 pm

(I told you it was on my todo list : VERY slow step by step)

2 year ago, furrtek made a SD replacement for the neogeoCD
His work was based on personal testing and our MCD research, since, like for the Neogeo/Genny, the NeoCD/MegaCD have a lot in common.

While his prototype worked (I saw it with my own eyes on RGC2015), he recently told me he moved to the sofware hack (ie moded BIOS) because the hardware hack (replace CDC) was difficult to install and easy to break.
I don't know if we're on the same case with the MegaCD but, at least, Furrtek shared all details about the NeoCD Drive on the neogeo dev wiki ;)
Which is so another source of information.

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Re:HDD (or flash) instead of a CD, questions...

Post by KanedaFr » Sat Jun 10, 2017 1:30 pm

Chilly Willy wrote:
TmEE co.(TM) wrote:There are 2 kinds of CDC used so the games that use HW directly have to have 2 pieces of code for each thing.
What were the two? I only seem to remember one offhand.
:?

I finally found the answer in this document : Differences between MCD2 (Sony) and MCD2 (Funai)

So there are 2 CDC : CXP5084 (Sony, on MCD1, MCD2 and NeoCD) and UPD75006 (Nec)
The two are 4-BIT SINGLE-CHIP MICROCOMPUTER

These use MaskROM...so no way to get the original firmware...(even MAME dev don't know how to dump them apart decapping, from what I read)

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Re: HDD (or flash) instead of a CD, questions...

Post by KanedaFr » Thu Jun 15, 2017 11:12 am

Finally found the time to check Bourricot project on details.
Furrtek followed on an interesting path : while I was planning to get between the main and the CD board (so interception commands and send back status + CD data, error stuff included), he replaced the LC89515.
This way no need to handle all the subQ data, error corrections, ..... it's a direct answer to commands.

I don't know if it's doable on megadrive but it could be another possible answer which need to be analyzed....

KanedaFr
Administrateur
Posts: 1139
Joined: Tue Aug 29, 2006 10:56 am
Contact:

Re: HDD (or flash) instead of a CD, questions...

Post by KanedaFr » Thu Jun 15, 2017 11:23 am

Since Bourricot made me ask if the hack I planned was the right one, I thought about the BIOS hack.
We already talked about it on this thread but it was about modding the BIOS, hack nterface, etc....
What about the all-in-a-cart way ?
since we know (look at Everdrive) it's possible to load a bios from the cart.
would it be possible to get a cart with BIOS, SD reader (using /TIME) and audio player (SR/SL) included ?
It would be awesome : no hardware to mod, only a plug and play hack!

I'm not enough aware of the way data is loaded from MCD which could be a problem (DMA?)
Any feeback on the do-ability of this idea ?

Post Reply