more protocol details, higher level

Hi,

I have looked at the protocol a bit more, and slowly a pattern emerges.  We
will probably never fully understand the meaning of the individual bits, and
at some point there is no sense in further scrutinizing the protocol for the
limited number of commands we support and need.  I doubt we can guess new
commands easily.  Further progress would then require information from Sony
insider, or dumps from the firmware (is it possible to retrieve them?).

So, here is my latest attempt at making sense of the protocol data.

The first byte is used for returning a status code (08, 09, 0a) as known.

Someone suggested the second byte is a "peripheral index".  In any case it
is not really significant for the device I have here.

The third byte is the command byte.  One command can implement multiple
functions, depending on the arguments.  For example:

06  Retrieve disc and track properties
07  Set disc and track properties
08  Toc Sync(?)
09  Retrieve status information
40  Erase something
43  Move track
50  Set playback track
c3  Set playback status
c5  Stop playback

What comes next is command specific, but there are similarities.

06,07  One byte that specifies the number of arguments, if any,
       then the arguments, then ff
08     First 80 01 (meaning unknown), then same as 06,07
else   ff, optionally followed by argument(s).

Arguments can be like this:
10 10 00     ->  disc flags
20 10 01 00 $t  -> Track number $t
20 18 01 00 $q  -> wchar on/off
20 18 02 00 $t  -> Track number $t
20 18 03 00 $t  -> Track number $t with wchar
30 00 01 00  ->  length (of track)
30 00 0a 00  ->  title string
30 00 10 00  ->  track count
30 80 07 00  ->  bitrate
30 00 ?? 00  ->  Something status related
30 88 ?? 00  ->  Likewise something status related, Pete suggested registers

This is of course very sketchy.  But it becomes clearer if you look at
examples:

Get Disc Title
==============

00 18  06  02  20 18 01 00 00  30 00 0a 00  ff 00 00 00 00 00
        |   |   |               |           |
        +- Get disc/track info  |           +- End of Arguments
            |   |               |
            +- Two arguments    |
                |               |
                +- disc wchar format
                                |
                                +- Title string

Now, this is a nice fit, but it doesn't explain why the 20 18 01 00 00 has
two purposes (differentiating between disc and tracks, and selecting wchar),
nor does it explain why the player expects the five 00s at the end for the
reply.

Get Disc Flags
==============

00 18  06  01  10 10 00  ff 00 00 01 00 0b
        |   |   |         |
        +- Get disc/track info
            |   |         |
            +- One argument
                |         |
                +- disc flags
                          |
                          +- End of arguments

Get Track Flags
===============

00 18  06  01  20 10 01 00 $t  ff 00  00 01 00 08
        |   |   |               |         +-----+-- Reply buffer info filled out already
        +- Get disc/track info  |
            |   |               |
            +- One argument     |
                |               |
                +- Track        |
                                |
                                +- End of arguments

Erase Disc
==========

00 18  40  ff 00 00


Erase Track
===========

00 18  40  ff 01 00  20 10 01 00 $t
               |     |
               +- Seems to indicate that this is a track erase rather than a disc erase
                     |
                     +- Standard track argument

Well, so far so good.  Of course, there are still more questions than
answers, and a few notable exceptions.  Maybe I was too greedy with the
argument interpretation (20 ?? ?? ?? ??, 30 ?? ?? ??), but it doesn't look
too bad now.  Most commands make a moderate amount of sense now.

Thanks,
Marcus


-- 
`Rhubarb is no Egyptian god.' GNU      http://www.gnu.org    [email protected]
Marcus Brinkmann              The Hurd http://www.gnu.org/software/hurd/
[email protected]
http://www.marcus-brinkmann.de/