SSnoCD (之三)

Sega Saturn cd-drive

本文文档包含对cd光驱与主板之间连接线的信号分析,
进一步的操作应该将 M37477m8 从 cd 电路板上拆下, 并按照它的文档将单片机的程序下载下来并做逆向分析, 进而可以精确的获取光驱与主板的通讯协议.

sage saturn(ss) 光驱与主板连接协议分析.
ss 光驱与主板连接线分为 21 针与 20 针.

CD 光驱主板上的 ic

1. m56754sp - 4 通道马达控制器.
2. M37477m8 - 8kB rom, 192byte ram. 单片机;
3. MN662724RPE - CD 信号处理器.
4. AN8809SB - ?

cd 光盘规范

2352 一个扇区, 第一个扇区在 00, 从 0x10 (偏移 0x9300) 扇区开始光盘基本信息
ss cdrom 直接读取光盘上的信息.

在CD-DA中，立体声有两个通道，每次采样有2个16位的样本，
左右通道的每个16位数据分别组成2个8位字节，6次采样共24字节组成一帧?
一帧有一个8位的控制字节.

TOC:
Every CD (Compact Disc) has a TOC (Table Of Contents) section located
in the “lead-in” area on the CD. For an CD-DA, (audio CD), the “lead-in” area
is located between radius 23mm and 25mm(光盘最内圈)

The size of the "lead-in" area is about, 4,500 sectors with a capacity of about 9 MB.
The TOC in the "lead-in" area contains the total length of the recording session, a list 
of tracks and their starting addresses and some other information.

Note that on a multi-session CD, each session will have its own "lead-in" area and TOC.
On a recordable/writable CD (CD-R), there is an extra area called PMA (Program Memory Area)
before the "lead-in" area. The PMA is located between radius 22.35mm and radius 23m.

The PMA is used by the recording process to store a temporary copy TOC, 
before the session is closed. After the session is closed, 
the TOC is written to the "lead-in" area.

C2 ERRORS
C2 Errors refer to bytes in a frame (24 bytes per frame, 98 frames per block) and is an
indication of a CD player’s attempt to use error correction to recover lost data.
C2 errors can be serious. In theory, a CD player should correct them.
C2 errors are usually an indication of poor media quality,
or the failure of a CD burner to produce a quality burn (see conclusion).

21 pin

• 光驱仓开关在电源连接线上.

• 信号线分为2组, 控制组与数据组;

  1. OSCSW - 33.33Mhz 时钟, 从开机开始发送, 下降 10ns, 上升 20ns, 持续14次传输13字节, 空闲 0.2um

  2. [GND]

  3. CDATA - 启动后维持0; 在p6拉低前拉高, p7时钟开始前恢复0?

  4. HDATA - cd-drive 返回的状态.
  5. COMREQ - 下拉开始一个字节, 几乎与6同时下拉
  6. COMSYNC - 下拉启动一个命令序列, 几乎与5同时下拉, 持续一个字节后上拉
  7. COMCLK - 时钟, 50kHZ(10um), 当 5低时发送, 高时停止, 在上升沿读取数据

  8. [GND]

  9. ?? - 直通 14 ?

  10. SI - 音乐盘 始终为 0; 数据盘与 p18 同步?

  11. RESET - 开机后 reset 为低, 拉高 0.3ms 后复位结束

  12. [GND]
  13. mpx - 左右声道切换/串行数据字节信号 44.25khz, 在 p14 高时改变; cdda 中32bit切换
  14. CKX - 串行数据时钟 cdda:2.7mhz, 数据:4.167mhz; 上升沿时读取数据;
  15. SDAS - 串行数据, p14 上升沿时读取数据;

  16. [GND]

  17. ? - 长时间在0, 未知的原因被拉高

  18. subout - p15有数据时, p21 拉底时拉底; 下降沿为开始一帧;
  19. subck - p18拉底后, 有8个脉冲(172.4khz); 每个帧开始发送 8 bit subcode; 数据cd为0;
  20. c2f - p13 频率的 1/2, 与p13 下降沿同步, 不是一直有数据?
  21. cfck - 7.375k (6.44k) 帧同步时钟; cdda: 每个上升/下降沿为1帧, 186bit(23byte);

1-7 pin 协议

上电 0.5s 后 5,6 上拉, 1s 后 p3 上拉,
准备好后 req 和 sync 每16.63ms 拉低3.1ms (60hz) 来测试主机是否准备完毕,
直到检测到 COMCLK 开始发送时钟, 认为主机启动, 开始传送数据. 并将 CDATA 拉低.

sync 一个下降沿, sh1 准备发送时钟.
req 下降持续 8 个时钟, 当 req 下降时, sh1 发送时钟脉冲.
一个序列结束后休眠 14.24ms

当 3(cdrom到cpu) 脚发送一个序列, 下一个序列 4(cpu到cdrom) 脚才应答,
所以请求序列可能重复发送.

每个序列13字节, 字节序

01 命令
02 - 03 ?? =80
04 - 11 8 个字节
12 crc 校验
13 总是 0x00 停止位?? 有时 0x80

3pin CDATA / 4pin HDATA (猜测)

a1 3 -> 01 00 00 00 00 00 00 00 00 00 00 FE 00 cd 盖打开, 进入 a2
4 <- 00 00 00 00 00 00 00 00 00 00 00 FF 00 继续的意思?

a2 3 -> 48 00 00 00 00 00 00 00 00 00 00 B7 00 cd 盖被关闭, 等待应答
4 <- C0 80 00 00 00 00 00 00 00 00 40 9F 00 cpu 收到盖关闭消息, 开始检测光盘. 进入a3
该命令中的 40 与 a3 序列中的40 有关系?

a3 3 -> 40 00 00 00 00 00 00 00 00 00 00 BF 00 正在检测光盘, 进入:a4,a5
4 <- 00 00 00 00 00 00 00 00 00 00 00 FF 00

a4 3 -> c1 00 00 00 00 00 00 00 00 00 00 3e 00 没有检测到光盘
4 <- 00 00 00 00 00 00 00 00 00 00 00 FF 00

a5 3 -> 60 80 00 08 40 A8 64 E0 22 A2 60 A8 00 检测1, 发送音轨信息?
3 -> 60 80 00 08 40 A8 E4 E0 22 A2 60 28 00 检测2
3 -> 60 80 00 88 40 A8 14 E0 92 6A 10 5f 00 检测3
3 -> 60 80 00 88 40 A8 94 E0 92 6A 10 9f 00 检测4
3 -> 60 80 00 88 40 A8 0C E0 92 6A 10 4f 00 检测5
3 -> 60 80 00 05 40 A8 8C E0 80 00 00 10 00 检测6
3 -> 60 80 00 05 40 A8 4C E0 80 00 00 E0 00 检测7
3 -> 60 80 00 05 40 A8 CC E0 80 00 00 60 00 检测8
3 -> 60 80 00 85 40 A8 2C E0 88 00 00 2f 00 检测9
3 -> 60 80 00 85 40 A8 aC E0 88 00 00 cf 00 检测10
3 -> 60 80 00 45 40 A8 eC E0 2a 80 1a 2a 00 检测11
3 -> 60 80 00 45 40 A8 1C E0 2a 80 1a ca 00 检测12
3 -> 60 80 00 45 40 A8 9C E0 2a 80 1a 4a 00 检测13, 大约共20多次后进入 a6

a7 3 -> 44 80 00 90 40 a8 a6 e0 1c 08 90 ff 00 等待应答, 应该是开始发送轨道信息
4 <- 00 00 00 00 00 00 00 00 00 00 00 FF 00

a8 3 -> 62 80 80 00 00 00 A0 E0 00 80 96 82 00 一大堆光盘信息?
3 -> 62 80 80 00 00 00 20 E0 00 80 0E DC 00
3 -> 62 80 80 00 00 00 80 E0 00 80 cE DC 00
3 -> 42 80 80 00 00 00 80 E0 00 80 CE fc 00
3 -> 62 80 80 80 00 00 80 E0 00 40 80 D5 00
3 -> 62 80 80 80 00 00 00 E0 00 40 00 B5 00 应答
4 <- 20 00 00 00 00 00 00 00 00 00 00 DF 00

a9 3 -> 48 80 80 80 00 00 00 E0 00 40 00 87 00 等待应答, 应该是光盘检测结束, 光盘已经就绪?

aa 3 -> 01 80 80 80 00 00 00 E0 00 40 00 ce 00