CD-ROM Registers

Host interface registers of the CD-ROM decoder at 1F801800h to 1F801803h.

Summary

The CPU reaches the CD-ROM drive only through the host interface of the decoder chip. The interface provides mailboxes for commands to the drive's microcontroller and a data port for sector data. It also holds the audio volume registers.¹ It occupies the four 8-bit addresses 1F801800h to 1F801803h. Two bits in the ADDRESS register select one of four banks, so each address reaches up to four different registers.¹²

The register set is that of Sony's CXD1199AQ CD-ROM decoder, and the later decoders of the PlayStation appear to be variants of it.¹ Old PU-7 boards use the CXD1199BQ and later boards the CXD1815Q, while still later boards build the decoder into the SPU.³ The register names on this page are the names in the CXD1199AQ data sheet.⁴

Register Map

The registers available for reading are as follows:¹⁵

The registers available for writing are as follows:¹⁵

A 32-bit read from 1F801800h returns HSTS four times. The auto increment flag in the CD-ROM bus configuration at 1F801018h is off by default, and turning it on breaks CD-ROM DMA, which depends on each 32-bit word being split into four reads of RDDATA.⁶

HSTS and ADDRESS

HSTS is the status register at 1F801800h in every bank. A write to the same address goes to the ADDRESS register, and bits 0 and 1 (RA) of ADDRESS select the bank.⁷⁴

While BUSYSTS is set, a new command must not be sent. A command sent during that time is lost, and the controller may hang after the next one.⁸ When BUSYSTS clears, a new command can be written. However, the result is unpredictable while the interrupt of the previous command is still pending, so the interrupt is acknowledged first.⁸⁹

COMMAND and PARAMETER

A write to COMMAND (bank 0, 1F801801h) passes the command byte to the drive's HC05 microcontroller. The HC05 takes the parameters from the FIFO, executes the command, puts the response in the result FIFO and raises INT3, or INT5 on an error.⁹ The parameter bytes are written to PARAMETER (bank 0, 1F801802h) before the command. The data sheet gives the FIFO as 8 bytes deep, while psx-spx finds 16 bytes on the PlayStation, where the longest command has 13 parameter bytes.⁴¹⁰

A command that the drive does not support returns INT5 and leaves its parameters in the FIFO. They then pass to the next command, so software sets CLRPRM in HCLRCTL after such an error.¹¹

RESULT

RESULT (1F801801h in every bank) returns the response bytes of a command. The data sheet gives an 8-byte FIFO; psx-spx finds 16 bytes.¹²¹³ RSLRRDY clears after the last byte of the response is read. Further reads return zeros to the end of the 16 bytes and then the same response again, until a new response arrives.¹³

RDDATA

RDDATA (1F801802h in every bank) returns sector data. After a read command raises INT1, software sets BFRD in HCHPCTL and waits for DRQSTS, and the sector can then be read.¹⁴ RDDATA can be read with 8-bit or 16-bit loads, and a 2048-byte sector therefore takes 2048 byte loads, 1024 halfword loads or a 512-word DMA transfer. The CD-ROM data bus itself is 8 bits wide, so the CPU bus interface splits every wider read.¹⁴

The sector size in the mode makes a sector 800h or 924h bytes long. Reads past the end repeat the byte at index 800h - 8 or 924h - 4.¹⁴

HCHPCTL

The bit descriptions are from the data sheet.¹⁵ The older nocash documents describe SMEN as a request for an interrupt on the next command. psx-spx explains this as a side effect of the BFWRDY interrupt.¹⁶

Interrupts

HINTSTS (banks 1 and 3, read at 1F801803h) holds the interrupt status, and HINTMSK enables each bit. The drive raises its interrupt whenever HINTMSK AND HINTSTS is not zero, and HINTMSK is normally set to 1Fh.¹⁷¹⁸

The data sheet makes bits 0 to 2 three separate interrupt flags that the sub CPU sets.¹⁹ The HC05 instead uses them as a single 3-bit interrupt type, which always takes one of the following values:¹⁷

The responses are queued one after another. If the first response is INT3 and the second INT5, INT5 is not delivered until INT3 is acknowledged. However, BFEMPT and BFWRDY can appear together with an INT value (13h for BFWRDY with INT3).¹⁷ Every interrupt answers a command, except INT5, which opening the lid also raises at any time.¹⁷

Sony's libcd gives the same values as the normal subsystem status: CdlDataReady 0x01, CdlComplete 0x02, CdlAcknowledge 0x03, CdlDataEnd 0x04 and CdlDiskError 0x05.²⁰ libcd also uses CdlNoIntr for a command or read that has not finished.²¹²²

HCLRCTL

HCLRCTL (bank 1, write at 1F801803h) acknowledges interrupts and resets parts of the decoder.²³

Software normally writes 07h to acknowledge the HC05 interrupt or 1Fh to acknowledge all of them. After the acknowledge the result FIFO is drained, and a pending command then goes to the controller.²⁴

When the flags are polled, a read can catch the bits while they change. About once in a thousand INT3s the CPU sees 1 before 3, and about once in a hundred INT5s it sees 4 before 5. A second read after the first nonzero value gives the stable value.²⁵ The problem occurs on older consoles such as LATE-PU-8 and does not occur on the PSone.²⁵

Audio Registers

The four attenuators of the decoder set how the left and right CD audio reach the SPU. Sony's libcd sets them with CdMix() and the CdlATV structure.²⁶

80h is 0 dB, and a lower value v attenuates by 20 log (v / 80h) dB. 40h is therefore 6.02 dB down, and 00h cuts the path off.²⁷ The data sheet prohibits 81h and higher.²⁷ psx-spx reports that the PlayStation accepts values up to FFh for double volume and saturates only partly above that. With this, "80h, 0, 80h, 0" gives normal stereo and "40h, 40h, 40h, 40h" gives mono at the same level.²⁸

ATV0 and ATV2 are 80h after reset, and the other write registers are 00h.²⁹ A change to the attenuators takes effect only when CHNGATV is set in ADPCTL.²⁹

Sound Map Registers

WRDATA (bank 1, 1F801801h) and CI (bank 2, 1F801801h) serve sound map playback, in which the host sends ADPCM sectors to the decoder in place of the disc.³⁰ CI has the layout of the coding information byte of an XA subheader:³¹

The sound map procedure and its limits are on the XA audio page.

Initialization

psx-spx gives the following start-up sequence. The kernel writes 1325h to Com_Delay at 1F801020h as a 32-bit write.³²

Reading a Sector

For each sector the steps are: wait for INT1, set BFRD, acknowledge INT1 and copy the data to main memory by I/O or DMA.³³ The data request belongs to the interrupt that is pending, so it is normally set between the arrival and the acknowledge of INT1. If the buffer overruns before the request, wrong sectors are delivered without any error flag. After the request the requested data is held intact.³³

References