LC8953: Difference between revisions

From NeoGeo Development Wiki
Jump to navigation Jump to search
m (Details about chip tech)
 
(6 intermediate revisions by the same user not shown)
Line 1: Line 1:
[[File:cd2_lc8953.jpg|right|thumb|Sanyo LC8953 [[68k]] peripherial controller chip found on a CDM3-2 board.]]
[[File:cd2_lc8953.jpg|right|thumb|Sanyo LC8953 [[68k]] peripherial controller chip found on a {{PCB|NEO-CDM3-2 board}}.]]


Sanyo Programmable Controler ("PUPPET") used in CD systems. Handles DMA to [[DRAM]]. Later replaced by the [[LC98000]].
Mysterious Sanyo [[68k]] programmable controller used in CD systems, also known as "PUPPET". Handles DMA, [[68k interrupts]] and communication with the [[LC89515]]. It was later replaced by a {{Chipname|LC98000}}.
Both publicly available datasheets for these ICs are incomplete.


==DMA==
=MPDMAC (DMA)=


The datasheet describes a 16-instruction microcode that is used to control DMA registers and transfer. There is no public documentation of this (?) and all open source emulates use HLE to emulate it.  18 bytes of microcode are written by the BIOS for each type of transfer to register. The microcode can be written using 9 word writes or 4 longword writes and one word write (verified).
The datasheet describes a 16 instructions long microcode program which can be loaded into the chip to perform DMA operations. There is no public documentation of the instruction set and all open source emulators use HLE to simulate it. The datasheet specifies that comparison and conditional jumps are possible.


This can be used as a reference to reverse engineer the microcode format or to control the DMA hardware without BIOS routines.  These were tested working on top-loading CDM 4-x boards as part of a test routine.
The programs are 18 bytes (16x 9 bit instructions) loaded by the [[system ROM]] for each type of transfer needed.


*Set $FF0061 to $00
==Loading programs==
*Write microcode to $FF007E+
*Set registers as defined by microcode
*Set $FF0061 to $40


===Word fill===
* Set [[Memory mapped registers|$FF0061]] to $00
* Write microcode in words from $FF0080 to $FF008E
* Set source, destination and count registers as needed
* Set $FF0061 to $40 to start transfer
 
==Reverse engineering==
 
The chip is a very large LC92200 gate array, which could be reverse engineered optically.
 
The following programs come from the top-loading CDM 4-x and [[CDZ]] system ROM as part of the [[system self-test]]:
 
==Word fill==
 
Same program on CDM 4-x and CDZ.
 
Parameters:
* $FF0064: 32bit destination
* $FF006C: 16bit word to fill with
* $FF0070: 32bit length in words
 
<pre>
dc.w $FFDD,$FCF5,$92F6,$2602,$FDFF,$FFFF,$FCF5,$8AF0,$1609
 
111111111    1FF NOP/Wait ?
101110111    177
111100111    1E7 End if 0 ?
101011001    159
001011110    05E
110001001    189
100000001    101
011111101    0FD
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
111001111    1CF
010110001    0B1
010111100    0BC
000001011    00B Store ?
000001001    009
</pre>
 
==Word copy==
 
Parameters:
* $FF0064: 32bit source
* $FF0068: 32bit destination
* $FF0070: 32bit length in words
 
===CDM 4-x===


<pre>
<pre>
dc.w $FFDD,$FCF5,$92F6,$2602,$FDFF,$FFFF,$FCF5,$8AF0,$1609 (CDM 4-x & CDZ)
dc.w $FE6D,$FCF5,$82BF,$F693,$BF29,$02FD,$FFFF,$F97D,$FCF5


$FF0064: 32bit destination
111111100    1FC
$FF006C: 16bit word to fill with
110110111    1B7
$FF0070: 32bit length in words
111100111    1E7 End if 0 ?
101011000    158
001010111    057
111111101    1FD
101001001    149
110111111    1BF
001010010    052
000001011    00B Store ?
111101111    1EF
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
001011111    05F
011111110    0FE
011110101    0F5
</pre>
</pre>


===Word copy===
===CDZ===


<pre>
<pre>
dc.w $FE6D,$FCF5,$82BF,$F693,$BF29,$02FD,$FFFF,$F97D,$FCF5 (CDM 4-x)
dc.w $FE3D,$FCF5,$82BF,$93BF,$F629,$02FD,$FFFF,$F17D,$FCF5
dc.w $FE3D,$FCF5,$82BF,$93BF,$F629,$02FD,$FFFF,$F17D,$FCF5 (CDZ)


$FF0064: 32bit source
111111100    1FC
$FF0068: 32bit destination
011110111    0F7
$FF0070: 32bit length in words
111100111    1E7 End if 0 ?
101011000    158
001010111    057
111100100    1E4
111011111    1DF
111110110    1F6
001010010    052
000001011    00B Store ?
111101111    1EF
111111111    1FF NOP/Wait ?
111111110    1FE
001011111    05F
011111110    0FE
011110101    0F5
</pre>
</pre>


===Address fill===
==Address fill==
 
Same program on CDM 4-x and CDZ.
 
Parameters:
* $FF0064: 32bit destination
* $FF0070: 32bit length in longwords


<pre>
<pre>
dc.w $FEF5,$FCF5,$92E8,$BE96,$F629,$02FD,$FFFF,$FC3D,$FCF5 (CDM 4-x & CDZ)
dc.w $FEF5,$FCF5,$92E8,$BE96,$F629,$02FD,$FFFF,$FC3D,$FCF5


$FF0064: 32bit destination
111111101    1FD
$FF0070: 32bit length in longs (number of addresses to copy)
111010111    1D7
111100111    1E7 End if 0 ?
101011001    159
001011101    05D
000101111    02F
101001011    14B
011110110    0F6
001010010    052
000001011    00B Store ?
111101111    1EF
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
100001111    10F
011111110    0FE
011110101    0F5
</pre>
</pre>


===Byte copy===
==Byte copy==
 
Used to copy data to 8bit memory, such as PCM RAM.
 
* Read word from source
* Swap word
* Write word to destination
* Swap word again
* Write word to destination + 2
* source += 2, destination += 4
* Repeat (length) times
 
Parameters:
* $FF0064: 32bit source
* $FF0068: 32bit destination
* $FF0070: 32bit length in words (as in pairs of bytes)
 
===CDM 4-x===


<pre>
<pre>
dc.w $F2DD,$FCF5,$82F6,$93DA,$BE93,$DABE,$2C02,$FDFF,$FFCD (CDM 4-x)
dc.w $F2DD,$FCF5,$82F6,$93DA,$BE93,$DABE,$2C02,$FDFF,$FFCD
dc.w $E2DD,$FCF5,$82BE,$93DA,$BE93,$DABE,$F62D,$02FD,$FFFF (CDZ)


$FF0064: 32bit source
111100101    1E5
$FF0068: 32bit destination
101110111    177
$FF0070: 32bit length in words (as in pairs of bytes)
111100111    1E7 End if 0 ?
101011000    158
001011110    05E
110100100    1A4
111101101    1ED
010111110    0BE
100100111    127
101101010    16A
111110001    1F1
011000000    0C0
001011111    05F
101111111    17F
111111111    1FF NOP/Wait ?
111001101    1CD
</pre>
</pre>


Used for copying data to 8bit memory, such as PCM RAM.
===CDZ===


*Read word from source
<pre>
*Swap word
dc.w $E2DD,$FCF5,$82BE,$93DA,$BE93,$DABE,$F62D,$02FD,$FFFF
*Write word to destination
 
*Swap word again
111000101    1C5
*Write word to destination + 2
101110111    177
*source += 2, destination += 4
111100111    1E7 End if 0 ?
*Repeat (length) times
101011000    158
001010111    057
110100100    1A4
111101101    1ED
010111110    0BE
100100111    127
101101010    16A
111110111    1F7
101100010    162
110100000    1A0
010111111    0BF
011111111    0FF
111111111    1FF NOP/Wait ?
</pre>


==IRQ==
=IRQs=


There is a programmable IRQ controller in this chip but it's not known if the [[NEO-MGA]] is used for this instead. DMA is used to copy the 2KB of data into work RAM and an interrupt is generated to signal this after every sector copied (and for other events too?). This is not emulated by any open source emulators.
The programmable [[68k interrupts|interrupt]] controller is used to generate the new vectored interrupts needed by the CD systems. DMA is used to copy each CD sector into [[68k user RAM|work RAM]] and an interrupt is generated to signal the end of the transfer. This is emulated at least by MESS.


==Datasheet==
=Datasheet=


Incomplete official datasheet: [[http://www.datasheetcatalog.org/datasheet/sanyo/ds_pdf_e/LC8953.pdf]]
Incomplete datasheet with pinout: [[http://www.datasheetcatalog.org/datasheet/sanyo/ds_pdf_e/LC8953.pdf]]
Both publicly available datasheets for the LC8953 and LC98000 ICs are incomplete and US Sanyo representatives aren't aware of the existence of more detailed documents.


[[Category:Chips]]
[[Category:Chips]]
[[Category:CD systems]]

Latest revision as of 14:06, 24 January 2021

Sanyo LC8953 68k peripherial controller chip found on a NEO-CDM3-2 board.

Mysterious Sanyo 68k programmable controller used in CD systems, also known as "PUPPET". Handles DMA, 68k interrupts and communication with the LC89515. It was later replaced by a LC98000.

MPDMAC (DMA)

The datasheet describes a 16 instructions long microcode program which can be loaded into the chip to perform DMA operations. There is no public documentation of the instruction set and all open source emulators use HLE to simulate it. The datasheet specifies that comparison and conditional jumps are possible.

The programs are 18 bytes (16x 9 bit instructions) loaded by the system ROM for each type of transfer needed.

Loading programs

  • Set $FF0061 to $00
  • Write microcode in words from $FF0080 to $FF008E
  • Set source, destination and count registers as needed
  • Set $FF0061 to $40 to start transfer

Reverse engineering

The chip is a very large LC92200 gate array, which could be reverse engineered optically.

The following programs come from the top-loading CDM 4-x and CDZ system ROM as part of the system self-test:

Word fill

Same program on CDM 4-x and CDZ.

Parameters:

  • $FF0064: 32bit destination
  • $FF006C: 16bit word to fill with
  • $FF0070: 32bit length in words
dc.w $FFDD,$FCF5,$92F6,$2602,$FDFF,$FFFF,$FCF5,$8AF0,$1609

111111111    1FF NOP/Wait ?
101110111    177
111100111    1E7 End if 0 ?
101011001    159
001011110    05E
110001001    189
100000001    101
011111101    0FD
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
111001111    1CF
010110001    0B1
010111100    0BC
000001011    00B Store ?
000001001    009

Word copy

Parameters:

  • $FF0064: 32bit source
  • $FF0068: 32bit destination
  • $FF0070: 32bit length in words

CDM 4-x

dc.w $FE6D,$FCF5,$82BF,$F693,$BF29,$02FD,$FFFF,$F97D,$FCF5

111111100    1FC
110110111    1B7
111100111    1E7 End if 0 ?
101011000    158
001010111    057
111111101    1FD
101001001    149
110111111    1BF
001010010    052
000001011    00B Store ?
111101111    1EF
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
001011111    05F
011111110    0FE
011110101    0F5

CDZ

dc.w $FE3D,$FCF5,$82BF,$93BF,$F629,$02FD,$FFFF,$F17D,$FCF5

111111100    1FC
011110111    0F7
111100111    1E7 End if 0 ?
101011000    158
001010111    057
111100100    1E4
111011111    1DF
111110110    1F6
001010010    052
000001011    00B Store ?
111101111    1EF
111111111    1FF NOP/Wait ?
111111110    1FE
001011111    05F
011111110    0FE
011110101    0F5

Address fill

Same program on CDM 4-x and CDZ.

Parameters:

  • $FF0064: 32bit destination
  • $FF0070: 32bit length in longwords
dc.w $FEF5,$FCF5,$92E8,$BE96,$F629,$02FD,$FFFF,$FC3D,$FCF5

111111101    1FD
111010111    1D7
111100111    1E7 End if 0 ?
101011001    159
001011101    05D
000101111    02F
101001011    14B
011110110    0F6
001010010    052
000001011    00B Store ?
111101111    1EF
111111111    1FF NOP/Wait ?
111111111    1FF NOP/Wait ?
100001111    10F
011111110    0FE
011110101    0F5

Byte copy

Used to copy data to 8bit memory, such as PCM RAM.

  • Read word from source
  • Swap word
  • Write word to destination
  • Swap word again
  • Write word to destination + 2
  • source += 2, destination += 4
  • Repeat (length) times

Parameters:

  • $FF0064: 32bit source
  • $FF0068: 32bit destination
  • $FF0070: 32bit length in words (as in pairs of bytes)

CDM 4-x

dc.w $F2DD,$FCF5,$82F6,$93DA,$BE93,$DABE,$2C02,$FDFF,$FFCD

111100101    1E5
101110111    177
111100111    1E7 End if 0 ?
101011000    158
001011110    05E
110100100    1A4
111101101    1ED
010111110    0BE
100100111    127
101101010    16A
111110001    1F1
011000000    0C0
001011111    05F
101111111    17F
111111111    1FF NOP/Wait ?
111001101    1CD

CDZ

dc.w $E2DD,$FCF5,$82BE,$93DA,$BE93,$DABE,$F62D,$02FD,$FFFF

111000101    1C5
101110111    177
111100111    1E7 End if 0 ?
101011000    158
001010111    057
110100100    1A4
111101101    1ED
010111110    0BE
100100111    127
101101010    16A
111110111    1F7
101100010    162
110100000    1A0
010111111    0BF
011111111    0FF
111111111    1FF NOP/Wait ?

IRQs

The programmable interrupt controller is used to generate the new vectored interrupts needed by the CD systems. DMA is used to copy each CD sector into work RAM and an interrupt is generated to signal the end of the transfer. This is emulated at least by MESS.

Datasheet

Incomplete datasheet with pinout: [[1]] Both publicly available datasheets for the LC8953 and LC98000 ICs are incomplete and US Sanyo representatives aren't aware of the existence of more detailed documents.

Retrieved from "https://wiki.neogeodev.org/index.php?title=LC8953&oldid=6759"