Skip to content

CDROM Internal Info on PSX CDROM Controller

PSX software can access the CDROM via Port 1F801800h..1F801803h (as described in the previous chapters). The following chapters describe the inner workings of the PSX CDROM controller - this information is here for curiosity only - normally PSX software cannot gain control of those lower-level stuff (although some low level registers can be manipulated via Test commands, but that will usually conflict with normal operation).

Motorola MC68HC05 (8bit single-chip CPU)

The Playstation CDROM drive is controlled by a MC68HC05 8bit CPU with on-chip I/O ports and on-chip BIOS ROM. There is no way to reprogram that BIOS, nor to tweak it to execute custom code in RAM.
CDROM Internal HC05 Instruction Set
CDROM Internal HC05 On-Chip I/O Ports
CDROM Internal HC05 I/O Port Usage in PSX
CDROM Internal HC05 Motorola Selftest Mode
The PSX can read HC05 I/O Ports and RAM via Test Commands:
CDROM - Test Commands - Read HC05 SUB-CPU RAM and I/O Ports

Decoder/FIFO (CXD1199BQ or CXD1815Q)

This chip handles error correction and ADPCM decoding, and acts as some sort of FIFO interface between main/sub CPUs and incoming cdrom sector data. On the MIPS Main CPU it is controlled via Port 1F801800h..1F801803h.
CDROM Controller I/O Ports
On the HC05 Sub CPU it is controlled via Port A (data in/out), Port E (address/index), and Port D (read/write/select signals); the HC05 doesn't have external address/data bus, so one must manually access the CXD1815Q via those ports.
CDROM Internal CXD1815Q Sub-CPU Configuration Registers
CDROM Internal CXD1815Q Sub-CPU Sector Status Registers
CDROM Internal CXD1815Q Sub-CPU Address Registers
CDROM Internal CXD1815Q Sub-CPU Misc Registers
The PSX can read/write the Decoder I/O Ports and SRAM via Test commands:
CDROM - Test Commands - Read/Write Decoder RAM and I/O Ports
The sector buffer used in the PSX is 32Kx8 SRAM. Old PU-7 boards are using CXD1199BQ chips, later boards are using CXD1815Q, and even later boards have the stuff intergrated in the SPU. Note: The CXD1199BQ/CXD1815Q are about 99% same as described in CXD1199AQ datasheet.

Signal Processor and Servo Amplifier

Older PSX mainboards are using two separate chips:
CDROM Internal Commands CX(0x..3x) - CXA1782BR Servo Amplifier
CDROM Internal Commands CX(4x..Ex) - CXD2510Q Signal Processor
Later PSX mainboards have the above intergrated in a single chip, with some extended features:
CDROM Internal Commands CX(0x..Ex) - CXD2545Q Servo/Signal Combo
Later version is CXD1817R (Servo/Signal/Decoder Combo).
Even later PSX mainboards have it integrated in the Sound Chip: CXD2938Q (SPU+CDROM) with some changed bits and New SCEx transfer:
CDROM Internal Commands CX(0x..Ex) - CXD2938Q Servo/Signal/SPU Combo
Finally, PM-41(2) boards are using a CXD2941R chip (SPU+CDROM+SPU_RAM), unknown if/how far the CDROM part of that chip differs from CXD2938Q.
Some general notes:
CDROM Internal Commands CX(xx) - Notes
CDROM Internal Commands CX(xx) - Summary of Used CX(xx) Commands
The PSX can manipulate the CX(..) registers via some test commands:
CDROM - Test Commands - Test Drive Mechanics
Note: Datasheets for CXD2510Q/CXA1782BR/CXD2545Q do exist.

CDROM Pinouts

Pinouts - DRV Pinouts
Pinouts - HC05 Pinouts

CDROM Internal HC05 Instruction Set

ALU, Load/Store, Jump/Call

  Opcode      Clk HINZC Name Syntax
  x6 ...      2-5 --NZ- LDA  MOV  A,<op>      ;A=op
  xE ...      2-5 --NZ- LDX  MOV  X,<op>      ;X=op
  x7 ...      4-6 --NZ- STA  MOV  <op>,A      ;op=A
  xF ...      4-6 --NZ- STX  MOV  <op>,X      ;op=X
  xC ...      2-4 ----- JMP  JMP  <op>        ;PC=op
  xD ...      5-7 ----- JSR  CALL <op>        ;[SP]=PC, PC=op
  xB ...      2-5 H-NZC ADD  ADD  A,<op>      ;A=A+op
  x9 ...      2-5 H-NZC ADC  ADC  A,<op>      ;A=A+op+C
  x0 ...      2-5 --NZC SUB  SUB  A,<op>      ;A=A-op
  x2 ...      2-5 --NZC SBC  SBC  A,<op>      ;A=A-op-C
  x4 ...      2-5 --NZ- AND  AND  A,<op>      ;A=A AND op
  xA ...      2-5 --NZ- ORA  OR   A,<op>      ;A=A OR op
  x8 ...      2-5 --NZ- EOR  XOR  A,<op>      ;A=A XOR op
  x1 ...      2-5 --NZC CMP  CMP  A,<op>      ;A-op
  x3 ...      2-5 --NZC CPX  CMP  X,<op>      ;X-op
  x5 ...      2-5 --NZ- BIT  TEST A,<op>      ;A AND op
  A7,AF,AC = Reserved (no STA/STX/JMP with immediate operand)

Operands can be...

  Opcode      Clk ALU/LDA/LDX      Clk STA/STX          Clk JMP/CALL
  Ax nn         2 cmd r,nn           - N/A              -/6 call relative (BSR)
  Bx nn         3 cmd r,[nn]         4 mov [nn],r       2/5 cmd nn
  Cx nn mm      4 cmd r,[nnmm]       5 mov [nnmm],r     3/6 cmd nnmm
  Dx nn mm      5 cmd r,[X+nnmm]     6 mov [X+nnmm],r   4/7 cmd X+nnmm
  Ex nn         4 cmd r,[X+nn]       5 mov [X+nn],r     3/6 cmd X+nn
  Fx            3 cmd r,[X]          4 mov [X],r        2/5 cmd X

Read-Modify-Write

  Opcode      Clk HINZC Name Syntax
  xC ...      3-6 --NZ- INC  INC op      ;increment   ;op=op+1
  xA ...      3-6 --NZ- DEC  DEC op      ;decrement   ;op=op-1
  xF ...      3-6 --01- CLR  ??  op,00h  ;clear       ;op=op AND 00h
  x3 ...      3-6 --NZ1 COM  NOT op      ;complement  ;op=op XOR FFh
  x0 ...      3-6 --NZC NEG  NEG op      ;negate      ;op=00h-op
  x9 ...      3-6 --NZC ROL  RCL op      ;rotate left through carry
  x6 ...      3-6 --NZC ROR  RCR op      ;rotate right through carry
  x8 ...      3-6 --NZC LSL  SHL op      ;shift left logical
  x4 ...      3-6 --0ZC LSR  SHR op      ;shift right logical
  x7 ...      3-6 --NZC ASR  SAR op      ;shift right arithmetic
  xD ...      3-5 --NZ- TST  TEST op,FFh ;test for negative or zero (AND FFh?)
  x1,x2,x5,xB,xE = Reserved (except for: 42 = MUL)

Operands can be...

  Opcode      Clk RMW          Clk CLR                Clk TST
  3x nn         5 cmd [nn]       5 MOV [nn],00h         4 TEST [nn],0FFh
  4x            3 cmd A          3 MOV A,00h,slow       3 TEST A,0FFh,slow
  5x            3 cmd X          3 MOV X,00h,slow       3 TEST X,0FFh
  6x nn         6 cmd [X+nn]     6 MOV [X+nn],00h       5 TEST [X+nn],0FFh
  7x            5 cmd [X]        5 MOV [X],00h          4 TEST [X],0FFh

CLR includes a dummy-read-cycle, whilst TST does omit the dummy-write cycle.
The ",slow" RMW opcodes are smaller, but slower than equivalent ALU opcodes.

Bit Manipulation and Bit Test with Relative Jump (to $+3+/-dd)

  Opcode      Clk HINZC Name  Syntax
  00h+i*2 nn dd 5 ----C BRSET JNZ [nn].i,dest  ;C=[nn].i, branch if set
  01h+i*2 nn dd 5 ----C BRCLR JZ  [nn].i,dest  ;C=[nn].i, branch if clear
  10h+i*2 nn    5 ----- BSET  SET [nn].i       ;set [nn].i
  11h+i*2 nn    5 ----- BCLR  RES [nn].i       ;clear [nn].i

Branch (Relative jump to $+2+/-nn)

  Opcode      Clk HINZC Name    Syntax
  20 nn         3 ----- BRA     JR  nn      ;branch always
  21 nn         3 ----- BRN     NUL nn      ;branch never
  22 nn         3 ----- BHI     JA  nn      ;if C=0 and Z=0, higher        ?
  23 nn         3 ----- BLS     JBE nn      ;if C=1 or Z=1, lower or same  ?
  24 nn         3 ----- BCC/BHS JNC/JAE nn  ;if C=0, carry clear, higher.same
  25 nn         3 ----- BCS/BLO JC/JB nn    ;if C=1, carry set, lower
  26 nn         3 ----- BNE     JNZ/JNE nn  ;if Z=0, not equal / not zero
  27 nn         3 ----- BEQ     JZ/JE nn    ;if Z=1, equal / zero
  28 nn         3 ----- BHCC    JNH nn      ;if H=0, half-carry clear
  29 nn         3 ----- BHCS    JH  nn      ;if H=1, half-carry set
  2A nn         3 ----- BPL     JNS nn      ;if S=0, plus / not signed
  2B nn         3 ----- BMI     JS  nn      ;if S=1, minus / signed
  2C nn         3 ----- BMC     JEI nn      ;if I=0, interrupt mask clear
  2D nn         3 ----- BMS     JDI nn      ;if I=1, interrupt mask set
  2E nn         3 ----- BIL     JIL nn      ;if XX=LO, interrupt line low
  2F nn         3 ----- BIH     JIH nn      ;if XX=HI, interrupt line high
  AD nn         6 ----- BSR     CALL relative nn  ;branch to subroutine always

Control/Misc

  Opcode      Clk HINZC Name Syntax
  9D            2 ----- NOP  NOP            ;no operation
  97            2 ----- TAX  MOV X,A        ;transfer A to X
  9F            2 ----- TXA  MOV A,X        ;transfer X to A
  9C            2 ----- RSP  MOV SP,00FFh   ;reset stack pointer (SP=00FFh)
  42           11 0---0 MUL  MUL X,A        ;X:A=X*A (unsigned multiply)
  81            6 ----- RTS  RET            ;return from subroutine
  80            9 xxxxx RTI  RETI           ;return from interrupt
  99            2 ----1 SEC  STC            ;set carry flag
  98            2 ----0 CLC  CLC            ;clear carry flag
  9B            2 -1--- SEI  DI             ;set interrupt mask (disable ints)
  9A            2 -0--- CLI  EI             ;clear interrupt mask (enable ints)
  8E          ..2 -0--- STOP STOP           ;?
  8F          ..2 -0--- WAIT WAIT           ;?
  83           10 -1--- SWI  SWI            ;software interrupt ...? PC=[FFFCh]
  <IRQ>         ? ????? Interrupt           ;?                       PC=[FFFxh]
  <RESET>       ? ????? Reset               ;?                       PC=[FFFEh]
  82,84..8D,90..96,9E = Reserved

MUL isn't supported in original "M146805 CMOS" family (MUL is used/supported in PSX cdrom controller).

Registers

  A   8bit  accumulator
  X   8bit  index register
  SP  6bit  stack pointer (range 00C0h..00FFh)
  PC  16bit program pointer (range 0000h..FFFFh)
  CCR 5bit  condition code register (flags) (111HINZC)

Pushed on IRQ are:

  SP.highest PC.lo
             PC.hi
             X
             A
  SP.lowest  Flags (CCR, 5bit condition code register) (111HINZC)

Addressing Modes

  nn       immediate             ;00h..FFh
  [nn]     direct address        ;[0000h..00FFh]
  [nnmm]   extended address      ;[0000h..FFFFh]
  [X]      indexed, no offset    ;[0000h..00FFh]
  [X+nn]   indexed, 8bit offset  ;[0000h..01FEh]
  [X+nnmm] indexed, 16bit offset ;[0000h..FFFFh]
  [nn].i   bit                   ;[0000h..00FFh].bit0..7
  dd       relative              ;$+2..3+(-80h..+7Fh)

Notes:

  operand "X+nn" performs an unsigned addition, and can address 0000h..01FEh.
  16bit operands (nnmm) are encoded in BIG-ENDIAN format (same for pushed PC).

Exception Vectors

Exception vectors are 16bit BIG-ENDIAN values at FFF0h-FFFFh (or at FFE0h-FFEFh when running in Motorola Bootstrap mode).

  Vector Prio Usage
  FFF0h  7=lo TBI Vector (Timebase)
  FFF2h  6    SSPI Vector (SPI bus)     (SPI1 and SPI2)
  FFF4h  5    Timer 2 Interrupt Vector  (Timer 2 Input/Compare)
  FFF6h  4    Timer 1 Interrupt Vector  (Timer 1 Input/Compare/Overflow)
  FFF8h  3    KWI Vector (Key Wakeup)   (KWI0..7 pins)
  FFFAh  2    External Interrupt Vector (/IRQ1 and /IRQ2 pins)
  FFFCh  none Software Interrupt Vector (SWI opcode)            ;\regardless of
  FFFEh  1=hi Reset Vector              (/RESET signal and COP) ;/CPU's "I"

Directives/Pseudos (used by a22i assembler; in no$psx utility menu)

  .hc05         select HC05 instruction set (default would be .mips)
  .nocash       select nocash syntax (default would be .native opcode names)
  db ...        define 8bit byte(s), or quoted ascii strings
  dw ...        define 16bit word(s) in BIG ENDIAN (for HC05 exception vectors)
  org nnnn      change origin for following opcodes
  end           end of file
  mov c,[nn].i  alias for "jnz [nn].i,$+3" (dummy jump & set carry=[nn].i)

CDROM Internal HC05 On-Chip I/O Ports

HC05 Port 3Eh - MISC - Miscellaneous Register (R/W)

  0    OPTM  Option Map Select (bank-switching for Port 00h..0Fh)
  1    FOSCE Fast (Main) Oscillator Enable (0=Disable OSC, 1=Normal)
  2-3  SYS   System Clock Select (0=OSC/2, 1=OSC/4, 2=OSC/64, 3=XOSC/2)
  4-5  -     Not used (0)
  6    STUP  XOSC Time Up Flag   (R)
  7    FTUP  OSC Time Up Flag    (R)   (0=Busy, 1=Ready/Good/Stable)

Note: For PSX, OSC is 4.0000MHz (PU-7/PU-8), 4.2336MHz (PU-18 and up). SysClk is usually set to OSC/2, ie. around 2MHz.

HC05 Port OPTM=0:00h - PORTA - Port A Data Register (R/W)

HC05 Port OPTM=0:01h - PORTB - Port B Data Register (R)

HC05 Port OPTM=0:02h - PORTC - Port C Data Register (R/W)

HC05 Port OPTM=0:03h - PORTD - Port D Data Register (R/W)

HC05 Port OPTM=0:04h - PORTE - Port E Data Register (R/W)

HC05 Port OPTM=0:05h - PORTF - Port F Data Register (R) (undoc: R/W)

These are general purpose I/O ports (controlling external pins). Some ports are Input-only, and some can be optionally used for special things (like IRQs, SPI-bus, or as Timer input/output).

  PA.0-7  PAn   Port A Bit0..7 Input/Output            (0=Low, 1=High) (R/W)
  PB.0-7  PBn   Port B Bit0..7 Input        /KWI0..7   (0=Low, 1=High) (R)
  PC.0    PC0   Port C Bit0    Input/Output /SDI1 (SPI)(0=Low, 1=High) (R/W)
  PC.1    PC1   Port C Bit1    Input/Output /SDO1 (SPI)(0=Low, 1=High) (R/W)
  PC.2    PC2   Port C Bit2    Input/Output /SCK1 (SPI)(0=Low, 1=High) (R/W)
  PC.3    PC3   Port C Bit3    Input/Output /TCAP (T1) (0=Low, 1=High) (R/W)
  PC.4    PC4   Port C Bit4    Input/Output /EVI  (T2) (0=Low, 1=High) (R/W)
  PC.5    PC5   Port C Bit5    Input/Output /EVO  (T2) (0=Low, 1=High) (R/W)
  PC.6    PC6   Port C Bit6    Input/Output /IRQ2      (0=Low, 1=High) (R/W)
  PC.7    PC7   Port C Bit7    Input/Output /IRQ1      (0=Low, 1=High) (R/W)
  PD.0-7  PDn   Port D Bit0..7 Input/Output            (0=Low, 1=High) (R/W)
  PE.0-7  PEn   Port E Bit0..7 Input/Output            (0=Low, 1=High) (R/W)
  PF.0-7  PFn   Port F Bit0..7 Input/Undoc  A/D-input  (0=Low, 1=High) (R)(R/W)

HC05 Port OPTM=1:00h - DDRA - Port A Data Direction Register (R/W)

HC05 Port OPTM=1:02h - DDRC - Port C Data Direction Register (R/W)

HC05 Port OPTM=1:03h - DDRD - Port D Data Direction Register (R/W)

HC05 Port OPTM=1:04h - DDRE - Port E Data Direction Register (R/W)

HC05 Port OPTM=1:05h - DDRF - Port F Data Direction Register (undoc)

  DDRX.0-7  DDRXn Port X Data Direction Bit0..7 (0=Input, 1=Output) (R/W)

Officially, there are no DDRB and DDRF registers (Port B and F are always Inputs). Although, actually, Motorola's Bootstrap RAM \<does> manipulate DDRF.

HC05 Port OPTM=1:08h - RCR1 - Resistor Control Register 1 (R/W)

HC05 Port OPTM=1:09h - RCR2 - Resistor Control Register 2 (R/W)

  RCR1.0    RAL   Port A.Bit0-3 Pullup Resistors (0=Off, 1=On)
  RCR1.1    RAH   Port A.Bit4-7 Pullup Resistors (0=Off, 1=On)
  RCR1.2    RBL   Port B.Bit0-3 Pullup Resistors (0=Off, 1=On)
  RCR1.3    RBH   Port B.Bit4-7 Pullup Resistors (0=Off, 1=On)
  RCR1.4    RGL   Port G.Bit0-3 Pullup Resistors (0=Off, 1=On) ;\
  RCR1.5    RGH   Port G.Bit4-7 Pullup Resistors (0=Off, 1=On) ; on chips
  RCR1.6    RHL   Port H.Bit0-3 Pullup Resistors (0=Off, 1=On) ; with Port G,H
  RCR1.7    RHH   Port H.Bit4-7 Pullup Resistors (0=Off, 1=On) ;/
  RCR2.0-7  RCn   Port C.Bit0-7 Pullup Resistors (0=Off, 1=On)

HC05 Port OPTM=1:0Ah - WOM1 - Open Drain Output Control Register 1 (R/W)

HC05 Port OPTM=1:0Bh - WOM2 - Open Drain Output Control Register 2 (R/W)

  WOM1.0   AWOML Port A.Bit0-3 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM1.1   AWOMH Port A.Bit4-5 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM1.2   GWOML Port G.Bit0-3 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM1.3   GWOMH Port G.Bit4-5 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM1.4   HWOML Port H.Bit0-3 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM1.5   HWOMH Port H.Bit4-5 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM1.6-7 -     Not used (0)
  WOM2.0-5 CWOMn Port C.Bit0..5 Open Drain Mode when DDR=1 (0=No, 1=Open Drain)
  WOM2.6-7 -     Not used (always both bits set)

==== Interrupts =====

HC05 Port OPTM=0:08h - INTCR - Interrupt Control Register (R/W)

  0-1  -     Not used (0)
  2    IRQ2S IRQ2 Select Edge-Sensitive Only (0=LowLevelAndNegEdge, 1=NegEdge)
  3    IRQ1S IRQ1 Select Edge-Sensitive Only (0=LowLevelAndNegEdge, 1=NegEdge)
  4    KWIE  Key Wakeup Interrupt Enable (0=Disable, 1=Enable)
  5    -     Not used (0)
  6    IRQ2E IRQ2 Interrupt Enable (0=Disable, 1=Enable)
  7    IRQ1E IRQ1 Interrupt Enable (0=Disable, 1=Enable)

HC05 Port OPTM=0:09h - INTSR - Interrupt Status Register (R and W)

  0    RKWIF Reset Key Wakeup Interrupt Flag (0=No Change, 1=Reset) (W)
  1    -     Not used (0)
  2    RIRQ2 Reset IRQ2 Interrupt Flag       (0=No Change, 1=Reset) (W)
  3    RIRQ1 Reset IRQ1 Interrupt Flag       (0=No Change, 1=Reset) (W)
  4    KWIF  Key Wakeup Interrupt Flag (PB/KWI)       (0=No, 1=IRQ) (R)
  5    -     Not used (0)
  6    IRQ2F IRQ2 Interrupt Flag (PC6)                (0=No, 1=IRQ) (R)
  7    IRQ1F IRQ1 Interrupt Flag (PC7)                (0=No, 1=IRQ) (R)

HC05 Port OPTM=1:0Eh - KWIE - Key Wakeup Interrupt Enable Register (R/W)

  0-7  KWIEn Port B.Bit0..7 Key Wakeup Interrupt Enable (0=Disable, 1=Enable)

==== SPI Bus ====

HC05 Port OPTM=0:0Ah - SPCR1 - Serial Peripheral Control Register 1 (R/W)

  0    SPRn  SPI Clock Rate (0=ProcessorClock/2, 1=ProcessorClock/16)
  1-3  -     Not used (0)
  4    MSTRn SPI Master Mode Select      (0=Slave/SCK.In, 1=Master/SCK.Out)
  5    DORDn SPI Data Transmission Order         (0=MSB First, 1=LSB First)
  6    SPEn  SPI Enable (SPI1:PortC, SPI2:PortG) (0=Disable, 1=Enable)
  7    SPIEn SPI Interrupt Enable (... ack HOW?) (0=Disable, 1=Enable)

HC05 Port OPTM=0:0Bh - SPSR1 - Serial Peripheral Status Register 1 (R)

  0-5  -     Not used (0)
  6    DCOLn SPI Data Collision Occurred         (0=No, 1=Collision)
  7    SPIFn SPI Transfer Complete Flag          (0=Busy, 1=Complete) (R)

Note: SPSR1.7 appears to be reset after reading SPSR1 (probably same for SPSR1.6, and maybe also same for whatever SPI IRQ signal).

HC05 Port OPTM=0:0Ch - SPDR1 - Serial Peripheral Data Register 1 (R/W)

  0-7  BITn  Data to be sent / being received

==== Time Base / Config ====

HC05 Port 10h - TBCR1 - Time Base Control Register 1 (R/W)

  0-1  T2R   Timer2 Prescaler (0=SysClk, 1=SysClk/4, 2=SysClk/32, 3=SysClk/256)
  2-3  T3R   PWM Prescaler    (0=CLK3, 1=CLK3/2, 2=CLK3/8, 3=Timer2compare)
  4-6  -     Not used (0)
  7    TBCLK Time Base Clock (0=XOSC, 1=OSC/128) ;<-- write-able only ONCE

HC05 Port 11h - TBCR2 - Time Base Control Register 2 (R/W, some bits R or W)

  0    COPC  COP Clear 2bit COP timeout divider (0=No Change, 1=Clear) (W)
  1    COPE  COP Enable                          ;<-- write-able only ONCE
  2    -     Not used (0)
  3    RTBIF Reset Time Base Interrupt Flag (0=No Change, 1=Clear TBIF) (W)
  4-5  TBR   Time Base Interrupt Rate (0=TBCLK/128, 1=/4096, 2=/8192, 3=/16384)
  6    TBIE  Time Base Interrupt Enable (0=Disable, 1=Enable)
  7    TBIF  Time Base Interrupt Flag   (0=No, 1=IRQ)        (R)

HC05 Port OPTM=1:0Fh - MOSR - Mask Option Status Register (R)

  0-4  -     Not used (0)
  5    XOSCR XOSC Feedback Resistor (0=None, 1=Implemented)
  6    OSCR  OSC Feedback Resistor  (0=None, 1=Implemented)
  7    RSTR  /RESET Pullup Resistor (0=None, 1=Implemented)

Reading this register returns A0h (on PSX/PSone with 52pin chips).

==== Timer 1 ====

HC05 Port 12h - TCR - Timer 1 Control Register (R/W)

  0    OLVL  Output Level on TCMP pin on Compare Match? (0=Low, 1=High)
  1    IEDG  Input Edge on TCAP pin (0=NegativeEdge, 1=PositiveEdge)
  2-4  -     Not used (0)
  5    TOIE  Timer Overflow Interrupt Enable (0=Disable, 1=Enable)
  6    OC1IE Output Compare Interrupt Enable (0=Disable, 1=Enable)
  7    ICIE  Input Capture Interrupt Enable  (0=Disable, 1=Enable)

HC05 Port 13h - TSR - Timer 1 Status Register (R)

  0-4  -     Not used (0)
  5    TOF   Timer Overflow Flag (0=No, 1=Yes) (R) ;clear by Port 19h access
  6    OC1F  Output Compare Flag (0=No, 1=Yes) (R) ;clear by Port 17h access
  7    ICF   Input Capture Flag  (0=No, 1=Yes) (R) ;clear by Port 15h access

HC05 Port 14h - ICH - Timer 1 Input Capture High (undoc)

HC05 Port 15h - ICL - Timer 1 Input Capture Low (undoc)

  0-15 Capture Value

HC05 Port 16h - OC1H - Timer 1 Output Compare 1 High (undoc)

HC05 Port 17h - OC1H - Timer 1 Output Compare 1 Low (undoc)

  0-15 Compare Value

HC05 Port 18h - TCNTH - Timer 1 Counter 1 High (undoc)

HC05 Port 19h - TCNTL - Timer 1 Counter 1 Low (undoc)

  0-15 Counter

HC05 Port 1Ah - ACNTH - Alternate Counter High (undoc)

HC05 Port 1Bh - ACNTL - Alternate Counter Low (undoc)

  0-15 Alternate Counter (uh, what?)

==== Timer 2 ====

HC05 Port 1Ch - TCR2 - Timer 2 Control Register (R/W)

  0    OL2   Timer Output 2 Edge (0=Falling, 1=Rising)
  1    OE2   Timer Output 2 Enable (EVO) (0=Disable, 1=Enable)
  2    IL2   Timer Input 2 Edge/Level (0=Low/Falling, 1=High/Rising)
  3    IM2   Timer Input 2 Mode Select for EVI (0=EventMode, 1=GatedByCLK2)
  4    T2CLK Timer 2 Clock Select (0=CLK2 from Prescaler, 1=EXCLK from EVI)
  5    -     Not used (0)
  6    OC2IE Output Compare 2 Interrupt Enable    (0=Disable, 1=Enable)
  7    TI2IE Timer Input 2 Interrupt Enable (EVI) (0=Disable, 1=Enable)

HC05 Port 1Dh - TSR2 - Timer 2 Status Register (R/W)

  0-1  -     Not used (0)
  2    ROC2F Reset Output Compare 2 Interrupt Flag (0=No Change, 1=Clear) (W)
  3    RTI2F Reset Timer Input 2 Interrupt Flag    (0=No Change, 1=Clear) (W)
  4-5  -     Not used (0)
  6    OC2F  Output Compare 2 Interrupt Flag    (0=No, 1=Yes) (R)
  7    TI2F  Timer Input 2 Interrupt Flag (EVI) (0=No, 1=Yes) (R)

HC05 Port 1Eh - OC2 - Timer 2 Output Compare Register (R/W)

  0-7  Compare Value ("Transferred to buffer on certain events?")

HC05 Port 1Fh - TCNT2 - Timer 2 Counter Register (R) (W=Set Counter to 01h)

  0-7  Counter Value, incremented at T2R (set to 01h on Compare Matches)

==== Reserved ====

HC05 Port 3Fh - Unknown/Unused

Reading this port via Sony's test command returns 20h (same as openbus), but reading it via Motorola's selftest function returns 00h (unlike openbus), so it seems to have some unknown/undocumented function; bit5 might indicate selftest mode, or it might reflect initialization of whatever other ports.

HC05 Port OPTM=0:06h..07h,0Dh..0Fh - Reserved

HC05 Port OPTM=1:01h,06h..07h,0Ch..0Dh - Reserved

HC05 Port 20h..3Dh - Reserved

These ports are unused/reserved. Trying to read them on a PSone does return 20h (possibly the prefetched next opcode value from the RAM test command). Other HC05 variants contain some extra features in these ports:
CDROM Internal HC05 On-Chip I/O Ports - Extras
The PSX CDROM BIOS doesn't use any of these ports - execpt, it is writing [20h]=2Eh (possibly to disable unused LCD hardware; which might be actually present in the huge 80pin HC05 chips on old PU-7 mainboards).

HC05 Openbus

Openbus values can be read from invalid memory locations, on PSX with 52pin chips:

  I/O bank 0:    0:06h..07h, 0:0Dh..0Fh
  I/O bank 1:    1:01h, 1:06h..07h, 1:0Ch..0Dh, and upper 4bit of 1:05h
  Unbanked I/O:  20h..3Dh
  Unused Memory: 0240h..0FFFh, 5000h..FDFFh

The returned openbus value depends on the opcode's memory operand:

  [nn],[mmnn],[nn+x],[mmnn+x] --> returns LAST byte of current opcode (=nn)
  [x]                         --> returns FIRST byte of following opcode

CDROM Internal HC05 On-Chip I/O Ports - Extras

HC05 Port OPTM=0:0Dh - SPCR2 - Serial Peripheral Control Register 2 (R/W)

HC05 Port OPTM=0:0Eh - SPSR2 - Serial Peripheral Status Register 2 (R)

HC05 Port OPTM=0:0Fh - SPDR2 - Serial Peripheral Data Register 2 (R/W)

This is a second SPI channel, works same as first SPI channel, but using the lower 3bits of Port G (instead of Port C) for the SPI signals.

HC05 Port OPTM=0:06h - PORTG - Port G Data Register (R/W)

HC05 Port OPTM=0:07h - PORTH - Port H Data Register (R/W)

HC05 Port 3Ch - PORTJ - Port J Data Register (R/W)

  PG.0    PG0   Port G Bit0    Input/Output /SDI2      (0=Low, 1=High) (R/W)
  PG.1    PG1   Port G Bit1    Input/Output /SDO2      (0=Low, 1=High) (R/W)
  PG.2    PG2   Port G Bit2    Input/Output /SCK2      (0=Low, 1=High) (R/W)
  PG.3    PG3   Port G Bit3    Input/Output /TCMP      (0=Low, 1=High) (R/W)
  PG.4    PG4   Port G Bit4    Input/Output /PWM0      (0=Low, 1=High) (R/W)
  PG.5    PG5   Port G Bit5    Input/Output /PWM1      (0=Low, 1=High) (R/W)
  PG.6    PG6   Port G Bit6    Input/Output /PWM2      (0=Low, 1=High) (R/W)
  PG.7    PG7   Port G Bit7    Input/Output /PWM3      (0=Low, 1=High) (R/W)
  PH.0-7  PHn   Port H Bit0..7 Input/Output            (0=Low, 1=High) (R/W)
  PJ.0-3  PJn   Port J Bit0..3 Output                  (0=Low, 1=High) (R/W)
  PJ.4-7  -     Not used (0)

HC05 Port OPTM=1:06h - DDRG - Port G Data Direction Register (R/W)

HC05 Port OPTM=1:07h - DDRH - Port H Data Direction Register (R/W)

  0-7  DDRXn Port X Data Direction Bit0..7 (0=Input, 1=Output) (R/W)

HC05 Port 20h - LCDCR - LCD Control Register (R/W)

  0    -     Not used (0)
  1    PDH   Select Port D (H) (0=FP35-FP38 pins, 1=PD7-PD4 pins)
  2    PEL   Select Port E (L) (0=FP31-FP34 pins, 1=PE3-PE0 pins)
  3    PEH   Select Port E (H) (0=FP27-FP30 pins, 1=PE7-PE4 pins)
  4    -     Not used (0)
  5-6  DUTY  LCD Duty Select (...)
  7    LCDE  LCD Output Enable BP and FP pins (0=Disable, 1=Enable)

HC05 Port 21h..34h - LCDDR1..20 - LCD Data Register 1..20 (R/W)

  0-3  First Data Unit  ;\Fourty 4bit LCD values (in the twenty registers)
  4-7  Second Data Unit ;/(some duties use only the LSBs of that 4bit values)

HC05 Port 34h - PWMCR - PWM Pulse Width Modulation Control Register (R/W)

  0-3  CH0-3 PWM Channel 0..3 on Port G.Bit4-7 Enable (0=Disable, 1=Enable)
  4-7  -     Not used (0)

HC05 Port 35h - PWMCNT - PWM Counter Register (R) (W=Set Counter to FFh)

  0-7  PWM Counter, incremented at PHI2 (range 01h..FFh)

HC05 Port 36h - PWMDR0 - PWM Duty Register 0 (R/W)

HC05 Port 37h - PWMDR1 - PWM Duty Register 1 (R/W)

HC05 Port 38h - PWMDR2 - PWM Duty Register 2 (R/W)

HC05 Port 39h - PWMDR3 - PWM Duty Register 3 (R/W)

  0-7  Duty (N cycles High, 255-N cycles Low)

HC05 Port 3Ah - ADR - A/D Data Register (R)

  0-3  A/D Conversion result (probably unsigned, 00h=Lowest, FFh=Max voltage?)

HC05 Port 3Bh - ADSCR - A/D Status and Control Register (R/W)

  0-3  CH0-3 A/D Channel (0..7=PortF.Bit0-7, 8..0Fh=Reserved/Vref/FactorTest)
  4    -     Not used (0)
  5    ADON  A/D Charge Pump enable (0=Disable, 1=Enable)
  6    ADRC  A/D RC Oscillator On (0=Normal/Use CPU Clock, 1=Use RC Clock)
  7    COCO  A/D Conversion Complete (0=Busy, 1=Complete) (R)

HC05 Port 3Dh - PCR - Program Control Register (R/W) (for EPROM version)

  0    PGM   EPROM Program Command (0=Normal, 1=Apply Programming Power)
  1    ELAT  EPROM Latch Control (0=Normal/Read, 1=Latch/Write)
  2-7  RES   Reserved for Factory Testing (always 0 in user mode)

CDROM Internal HC05 I/O Port Usage in PSX

Port A - Data (indexed via Port E)

  porta.0-7 i/o  CXD1815Q.Data (indexed via Port E)
  porta.0   in   debug.dta.serial.in  ;\normally unused (exists in early bios)
  porta.1   out  debug.dta.serial.out ; (prototype/debug_status stuff)
  porta.2   out  debug.clk.serial.out ;/(with portc.5 = debug.select)

Port B - Inputs

  portb.0   in   F-BIAS  ;unused
  portb.1   in   SCEx input (serial 250 baud, received via 1000Hz timer2 irq)
  portb.2   in   LMTSW  aka /POS0        ;\pos0 and door switches
  portb.3   in   DOOR   aka SHELL_OPEN   ;/
  portb.4   in   TEST2
  portb.5   in   TEST1 (CL316) enter test mode (instead of mainloop)
  portb.6   in   COUT   ;<-- unused, extra pin, not "SENSE=COUT"
  portb.7   in   CXD2510Q.SENSE ;-from CXD2510Q (and forwarded from CXA1782BR)

Port C - Inputs/Outputs

  portc.0   in   CXD2510Q.SUBQ  ;\
  portc.1   in?  NC (SPI.OUT)   ; used via SPDR1 to receive SPI bus SUBQ data
  portc.2   out  CXD2510Q.SQCK  ;/
  portc.3   out  SPEED
  portc.4   out    ="SPEED XOR 1"  ... AL/TE ... or CG ... or MIRR ?
  portc.5   out  ROMSEL: debug.select   (or "SCLK" on later boards???)
  portc.6   in   CXD1815Q.XINT/IRQ2 ;unused (instead INTSTS bits are polled)
  portc.7   in   CXD2510Q.SCOR/IRQ1 ;used via polling INTSR.7 (not as irq)

Port D - Outputs

  portd.0   out  NC             ;-unused (always 1)
  portd.1   out  CXD2510Q.DATA  ;\serial bus for CXD2510Q
  portd.2   out  CXD2510Q.XLAT  ; (and also forwarded to CXA1782BR)
  portd.3   out  CXD2510Q.CLOK  ;/
  portd.4   out  CXD1815Q.DECCS ;\
  portd.5   out  CXD1815Q.DECWR ; control for data/index on Port A/E
  portd.6   out  CXD1815Q.DECRD ;/
  portd.7   out  LDON  ... IC723.Pin11 ... maybe "laser on" ?

Port E - Index (for data on Port A)

  porte.0-4 out  CXD1815Q.Index (for data on Port A)
  porte.5   out  NC, not used
  porte.6   out  NC, see "idx_4xh" maybe test signal ???
  porte.7   out? NC, TEST? configured as OUTPUT... but used as INPUT?

Port F - Motorola Bootstrap Serial I/O (not used in cdrom bios)

  portf.0   out  NC, TX         ;\
  portf.1   in   NC, RX         ; not used by sony's cdrom bios
  portf.2   out  NC, RTS        ; (but used by motorola's bootstrap rom)
  portf.3   out  NC, DTR        ;/
  portf.0   in   Serial Data In  (from daughterboard)  ;\
  portf.1   out  Serial Data Out   (to daughterboard)  ; usage in SCPH-5903
  portf.2   out  Serial Clock Out  (to daughterboard)  ; (PSX with Video CD)
  portf.3   out  Audio/Video Select (0=Normal, 1=VCD)  ;/
  portf.4-7 -    NC, not used (probably pins don't even exist)

Other HC05 I/O Ports

  SPI 1   - used for receiving SUBQ (via Port C)
  IRQ 1   - used for latching/polling SUBQ's "SCOR" (not used as interrupt)
  IRQ 2   - connects to CXD1815Q.XINT, but isn't actually used at all
  Timer 1 - unused
  Timer 2 - generates 1000Hz interrupts (for 250 baud "SCEx" string transfers)
  DDRx    - data directions for Port A-F (as listed above)

Note: The PSX has the HC05 clocked via 4.00MHz oscillator (older boards), or via 4.3MHz signal from SPU (newer boards); internally, the HC05 is clocked at half of those frequencies (ie. around 2 MHz).

CDROM Internal HC05 Motorola Selftest Mode

52-pin HC05 chips (newer psx cdrom controllers)

52-pin chips are used on LATE-PU-8 boards, and on later boards ranging from PU-18 up to PM-41(2).
CDROM Internal HC05 Motorola Selftest Mode (52pin chips)

80-pin HC05 chips (older psx cdrom controllers)

80-pin chips are used PU-7, EARLY-PU-8, and PU-9 boards.
CDROM Internal HC05 Motorola Selftest Mode (80pin chips)

32-pin HC05 chips (joypad/mouse)

Sony's Digital Joypad and Mouse are using 32pin chips (with TQFP-32 package), which are probably containing Motorola HC05 CPUs, too. Unknown if/how those chips can be switched into bootstrap/dumping modes.

Pinouts

Pinouts - HC05 Pinouts

CDROM Internal HC05 Motorola Selftest Mode (52pin chips)

Motorola Bootstrap ROM

The Motorola MC68HC05 chips are including a small bootstrap ROM which gets activated upon /RESET when having two pins strapped to following levels:

  Pin30 PortC.6 (/IRQ2) (/XINT) ----> wire to 3.5V (VCC)
  Pin31 PortC.7 (/IRQ1) (SCOR)  ----> wire to 7V (2xVCC)

Moreover, two pins are needed on /RESET for selecting a specific test mode:

  Pin16 PortB.0 ----> ModeSelectBit0 (0=GND, 1=3.5V)
  Pin17 PortB.1 ----> ModeSelectBit1 (0=GND, 1=3.5V)

The selectable four modes are:

  Mode0: Jump to RAM Address 0040h (useless when RAM is empty)
  Mode1: Semifunctional Selftest (useless)
  Mode2: Upload 200h bytes to RAM & jump to 0040h (allows fast/custom dumping)
  Mode3: Download ROM as ASCII hexdump (nice, but very slow)

The upload/download functions are using following additional pins:

  Pin50 PortF.0 ----> TX output (11bytes: 0Dh,0Ah," AAAA DD ")
  Pin51 PortF.1 <---- RX input  (1byte: "!" to request next 11 bytes)
  Pin52 PortF.2 ----> RTS output or so (not needed)
  Pin1  PortF.3 ----> DTR output or so (not needed)
  Ground ------------ GND for RX/TX

RX/TX are RS232-like serial signals (but using other voltages, 0=0V and 1=3.5V). Transfer format is 8-N-1, ie. one startbit(0), 8 databits LSB first, no parity, one stopbit(1). Baudrate is OSC/2/208 (ie. 9616 bps for 4.000MHz, or 10176 bps for 4.2336MHz clock derived from CXD2545Q/CXD2938Q).
Note: Above pins may vary on some chips (namely on chips that don't have PortF). The pins for entering bootstrap mode (PortC in this case) should be described in datasheets; but transfer protocol and mode selection (PortB) and transmission (PortF) aren't officially documented.

Mode2: Upload 200h bytes to RAM & jump to 0040h

This mode is very simple and powerful: After /RESET, you send 200h bytes to the RX input (without any response on TX output), the bytes are stored at 0040h..023Fh in RAM, and the chip jumps to 0040h after transferring the last byte. The uploaded program can contain a custum highspeed dumping function, or perform hardware tests, etc. A custom dumping function for PSX/PSone can be found at:

  http://www.psxdev.net/forum/viewtopic.php?f=70&t=557

After uploading the 200h-byte dumping function it will respond by send 4540h bytes (containing some ASCII string, the 16.5Kbyte ROM image, plus dumps for RAM and (banked) I/O port region, plus openbus tests for unused memory and I/O regions.

Wiring for Mode2 on PSX/PSone consoles with 52-pin HC05 chips

                            .------------ pin31, PC7, SCOR, cut the connection
                   39       |   27               to Signal Processor,
                 .-----------------.             then wire Pin31 to 7.5V
              40 |                 | 26
                 |  C nnnn         |
                 |  SC4309nnPB     |
                 |  G63C 185       |
  pin50, TX <--- |                 | ---- pin17, PB1, SCEX, wire to 3.5V,
  pin51, RX ---> |                 |                  for Mode2 Selection
              52 | O               | 14
                 '-----------------'
                   1            13

Good places to pick 3.5V and 7.5V from nice solder pads are:

  CN602.Pin1  = 7.5V     ;\on PSX boards (with either 5pin or
  CN602.Pin3  = 3.5V     ;/               7pin CN602 connectors)
  IC601.Pin1  = 7.5V     ;-on PSone boards (3pin 78M05 voltage regulator)
  IC102.Pin32 = 3.5V     ;-on PSone boards (32pin Main BIOS ROM chip)

The SCOR trace on Pin31, connects to Signal Processor...

  CXD2510Q.Pin63  (eg. on PU-8 boards)   ;\
  CXD2545Q.Pin74  (eg. on PU-18 boards)  ; either one of these, depending
  CXD1817R.Pin49  (eg. on PU-20 boards)  ; on which chipset you have
  CXD2938Q.Pin77  (eg. on PM-41 boards)  ;
  CXD2941R.Pin85  (eg. PM-41(2) boards)  ;/

cut that trace (preferably on the PCB between two vias or test points, so you can later repair it easily) (better don't try to lift Pin31, it breaks off easily)
Note: Mode2 also requires Pin16=Low, and Pin30=High (but PSX/PSone boards should have those pins at that voltages anyways).

Mode3: Download ROM as ASCII hexdump

This mode is very slow and not too powerful. But it may useful if you can't get Mode2 working for whatever reason. Wiring for Mode3 is same as above, plus PortB.0=3.5V. In this mode, the chip will send one 0Dh,0Ah," AAAA DD " string immediately after /RESET (with 16bit address "AAAA" (initially 1000h), and 8bit data "DD"). Thereafter the chip will wait for incoming commands:

  4-digit ASCII HEX address --> change address, and return 0Dh,0Ah," AAAA DD "
  chr(00h) --> increment address, and return 0Dh,0Ah," AAAA DD "
  chr(07h) --> jump to current address (not so useful)
  other characters --> same as chr(00h)
  All digits/characters sent to RX input will produce an echo on TX output.

Basic setup would be wiring RX to GND (the chip will treat that as infinite stream of start bits with chr(00h), so it will respond by sending data from increasing addresses automatically; the increment wraps from 4FFFh to FE00h (skipping the gap between Main ROM and Bootstrap ROM), and also wraps from FFFFh to 0000h; transfer is ultraslow: 13 characters needed per dumped byte: chr(00h) to chip, chr(00h) echo from chip, and 0Dh,0Ah," AAAA DD " from chip.

CDROM Internal HC05 Motorola Selftest Mode (80pin chips)

80pin Sony 4246xx chips

And for anyone else planning to try this, these are the connections:

  Pin PortC
  46  PC7/IRQ1 (SCOR) disconnect from PCB, then wire the pin to Vtst (7.6V)
  45  PC6/IRQ2 (/XINT) wire to Vdd (3.5V) (you have to solder to the pin)

In bootstrap mode, Port A is used as follows:

  Pin PortA DDRA Usage
  23  PA0   in   RXD
  24  PA1   out  TXD
  25  PA2   in   -
  26  PA3   in   Testmode.bit0 (GND=0, 3.5V=1)
  27  PA4   in   Testmode.bit1 (GND=0, 3.5V=1)
  28  PA5   in   Testmode.bit2 (GND=0, 3.5V=1)
  29  PA6   out  RTS (don't care)
  30  PA7   out  -

The selectable testmodes are:

  PA5 PA4 PA3  Effect
  0   x   x    Jump to 0040h      ;\
  1   0   0    Test (complex)     ; not so useful
  1   0   1    Test (simple loop) ;/
  1   1   0    ROM Dump 4200h bytes (plain binary, non-ASCII)
  1   1   1    RAM Upload 100h bytes to 0040h..013Fh, then jump to 0040h

RX/TX are plain binary (non-ASCII), baudrate is 9600 (when using 4.000MHz oscillator), transfer format is 8,N,2 (aka 8,N,1 with an extra pause bit).

Wiring for Upload/Download on PSX consoles with 80-pin HC05 chips

                  .------------ pin46, PC7/IRQ1, SCOR, cut & wire to 7.5V
                  |.----------- pin45, PC6/IRQ2, wire to 3.5V
         60       ||  41
       .-----------------.
    61 |               o | 40
       |  Sony Computer  |           ,----- pin28, PA5, wire to 3.5V
       |  Entertainment  | _________/  ,--- pin27, PA4, wire to 3.5V
       |  Inc. (C) E35D  | ==========='---- pin26, PA3, mode select
       |     4246xx 185  | ----> pin24, PA1, TXD (for ROM dump)
       |                 | <---- pin23, PA0, RXD (for RAM upload)
    80 | O               | 21
       '-----------------'
         1            20

Good places to pick 3.5V and 7.5V from nice solder pads are:

  CN602.Pin1  = 7.5V     ;\on PSX boards (with 7pin CN602 connectors)
  CN602.Pin3  = 3.5V     ;/

Credits to TriMesh for finding the 80pin chip's bootstrap signals.

Other 80pin chips

DTL-H100x uses 80pin chip with onchip PROM (chip text "(M) MC68HC705L15", instead of "Sony [...] 4246xx"), wiring for serial dumping on that is unknown (the bootstrap ROM may be a little different because it should contain PROM burning functions). PU-9 boards boards seem to use a similar PROM (with some sticker on it).
DTL-H2000 uses 80pin CXP82300 chip with socketed piggyback 32pin EPROM - that chip is a Sony SPC700 CPU, not a Motorola HC05 CPU. Accordingly there's no Motorola Bootstrap mode in it, but of course one could simply dump the EPROM with standard eprom utilities, but nobody did do so yet).

CDROM Internal CXD1815Q Sub-CPU Configuration Registers

00h - DRVIF - Drive Interface (W)

  0-1 "L"     Reserved (should be 0)
  2   LSB 1st CD DSP DATA order               (0=MSB first, 1=LSB first)
  3-4 BCK MD  CD DSP Number of BCLKs per WCLK (0=16, 1=24, 2=32, 3=Reserved)
  5   BCK RED Strobe DATA on BLCK Edge        (0=Falling Edge, 1=Rising Edge)
  6   LCH LOW Channel on LRCK=Low             (0=Right, 1=Left)
  7   C2PL1st      ... C2PO lower byte 1st

01h - CONFIG 1 - Configuration 1 (W)

  0   HCLKDIS  HCLK Pin Output (0=8.4672MHz, 1=Disable; Fixed Low)
  1   CLKDIS   CLK Pin Output (0=16.9344MHz, 1=Disable; Fixed Low)
  2   9BITRAM  SRAM Databus width (0=8bit/normal, 1=9bit)
  3-4 RAM SZ   SRMA Address bus (0=32K, 1=64K, 2=128K, 3=Reserved)
  5   PRTYCTL      ... Priority Control
  6   XSLOW    Number of clock cycles per DMA cycle (0=12, 1=4) (for SRAM)
  7   "L"      Reserved (should be 0)

02h - CONFIG 2 - Configuration 2 (W)

  0   "L"      Reserved (should be 0)
  1   DACODIS        .... DAC Out Disable
  2   DAMIXEN  Digital Audio Mixer Enable (0=Attentuator/Mixer for CD-DA, 1=No)
  3   SMBF2    Number of Sound Map Buffer Surfaces (0=Three, 1=Two)
  4   SPMCTL   Sound Parameter Majority Control (0=?)  ;\for ADPCM params
  5   SPECTL   Sound Parameter Error Control    (0=?)  ;/
  6-7 "L"      Reserved (should be 0)

03h - DECCTL - Decoder Control (W)

  0-2 DECMD    Decoder Mode (0-7)
                 0 or 1  Decoder Disable            ;-disable sector reading
                 2 or 3  Monitor-only Mode          ;\no error correction
                 4       Write-only Mode            ;/
                 5       Real-time Correction Mode  ;\with error correction
                 6       Repeat Correction Mode     ;/
                 7       CD-DA Mode                 ;-audio
  3   AUTODIST Auto Distinction (0=Use MODESEL/FORMSEL bits, 1=Use Sector Hdr)
               (Error Correction is done according to above MODE/FORM values)
  4   FORMSEL  Form Select (0=FORM1, 1=FORM2) (must be 0 for MODE1)
  5   MODESEL  Mode Select (0=MODE1, 1=MODE2)
  6   ECCSTR   ECC Strategy (0=Normal, 1=Use Error Flags; requires 9bit SRAM)
  7   ENDLADR  Enable Drive Last Address    ...

07h - CHPCTL - Chip Control (W)

  0   "L"      Reserved (should be 0)
  1   DBLSPD   Double Speed Mode (0=Normal, 1=Double) (init CD DSP first)
  2   RPSTART  Repeat Correction Start (0=No, 1=Start) (automatically cleared)
  3   SWOPEN   Sync Window Open (0=SyncControlledByIC, 1=OpenDetectionWindow)
  4   CD-DA    CD-DA Play     (0=No, 1=Playback CD-DA as audio)
  5   CDDAMUTE CD-DA Mute     (0=Normal, 1=Mute CD-DA Audio)
  6   RTMUTE   Real-time Mute (0=Normal, 1=Mute CDROM ADPCM)
  7   SMMUTE   Sound Map Mute (0=Normal, 1=Mute Sound Map ADPCM)

CDROM Internal CXD1815Q Sub-CPU Sector Status Registers

00h - ECCSTS - ECC Status (R)

  0 CFORM   FORM assumed by Error Correction (0=FORM1, 1=FORM2)
  1 CMODE   MODE assumed by Error Correction (0=MODE1, 1=MODE2)
  2 ECCOK   ECC Okay (0=Bad, 1=Okay)
  3 EDCOK   EDC Okay (0=Bad, 1=Okay)
  4 CORDONE Correction Done (0=None, 1=Error occurred and was corrected)
  5 CORINH  Correction Inhibit (0=Okay,1=AUTODIST couldn't determine MODE/FORM)
  6 ERINBLK Erasure in Block (0=Okay, 1=At least 1 byte is wrong & uncorrected)
  7 EDCALL0 EDC all-zero  (0=No/EDC Exists, 1=Yes/All four EDC bytes are 00h)

01h - DECSTS - Decoder Status (R)

  0   NOSYNC   No Sync       (0=Okay, 1=Sector Sync Mark Missing)
  1   SHRTSCT  Short Sector  (0=Okay, 1=Sector Sync Mark within Sector Data)
  2-4 -        Reserved (undefined)
  5   RTADPBSY Real-time ADPCM Busy (0=No, 1=Busy/playback)
  6-7 -        Reserved (undefined)

02h - HDRFLG - Header/Subheader Error Flags for HDR/SHDR registers (R)

  0 CI      Error in 4th Subheader byte (Coding Info) (0=Okay, 1=Error)
  1 SUBMODE Error in 3rd Subheader byte (Submode)     (0=Okay, 1=Error)
  2 CHANNEL Error in 2nd Subheader byte (Channel)     (0=Okay, 1=Error)
  3 FILE    Error in 1st Subheader byte (File)        (0=Okay, 1=Error)
  4 MODE    Error in 4th Header byte (MODE)           (0=Okay, 1=Error)
  5 BLOCK   Error in 3rd Header byte (FF)             (0=Okay, 1=Error)
  6 SEC     Error in 2nd Header byte (SS)             (0=Okay, 1=Error)
  7 MIN     Error in 1st Header byte (MM)             (0=Okay, 1=Error)

Error flags for current sector are probably stored straight in this register (ie. these flags are probably available even without using 9bit SRAM).
Or maybe not... if the chip supports receiving newer sectors during time-consuming error corrections... then those newer would need to be stored in SRAM, and would thus require 9bit SRAM for the error flags?

03h - HDR - Header Bytes (R)

  1st read: 1st Header byte (MM)
  2nd read: 2nd Header byte (SS)
  3rd read: 3rd Header byte (FF)
  4th read: 4th Header byte (MODE)

04h - SHDR - Subheader Bytes (R)

  1st read: 1st Subheader byte (File)
  2nd read: 2nd Subheader byte (Channel)
  3rd read: 3rd Subheader byte (Submode) (SM)
  4th read: 4th Subheader byte (Coding Info) (CI)

The contents of the HDRFLG, HDR, SHDR registers indicate:

      (1) The corrected value in the real-time correction or
          repeat correction mode
      (2) Value of the raw data from the drive in the monitor-only
          or write-only mode
    The CMOME? and CMODE bits (bits 1, 0) of ECCSTS indicate the FORM and MODE
    of the sector the decoder has discriminated by the raw data from the drive.
    Due to erroneous correction, the values of these bits may be at variance
    with those of the HDR register MODE byte and SHDR register submode byte
    bit5.

Unknown when 1st..4th read indices are reset for HDR and SHDR (maybe on access to certain I/O ports, or maybe anytime when receiving a new sector), also unknown what happens on 5th read and up.

CDROM Internal CXD1815Q Sub-CPU Address Registers

Drive Address -- used for storing incoming CDROM sectors in Buffer RAM
Host Address -- used for transferring Buffer RAM to (or from) Main CPU
ADPCM Address -- used for Real-time ADPCM audio output from Buffer RAM

05h - CMADR - Drive Current Minute Address (R)

  0-6   CMADR    Address bit10-16 (in 1Kbyte steps)
  7     -        Reserved (undefined)

Indicates the start address of the most recently decoded sector (called "Minute Address" because it points to the MM byte of the MM:SS:FF:MODE sector header). Normally, CMADR should be forwarded to Host:

  HADR = (CMADR AND 7Fh)*400h+offset
  HXFR = length OR 4000h

Whereas, offset would be usually 00h, 04h, or 0Ch (to start reading from the begin of the sector, or to skip 4-byte MODE1 header, or 12-byte MODE2 header). And length would be usually 800h (normal data sector), or 924h (entire sector, excluding the leading 12 sync-bytes). Length bit14 is undocumented/reserved, but the PSX CDROM BIOS does set that bit for whatever reason.
Alternately, the sector can be forwarded to the Real-time ADPCM decoder:

  ADPMNT = (CMADR AND 7Fh) OR 80h

19h - ADPMNT - ADPCM "MNT" Address (W)

  0-6   ADPxxx  ADPCM source Address bit10-16 (in 1Kbyte-steps)
  7     RTADPEN Real-time ADPCM Enable (0=Disable, 1=Enable Real-time ADPCM)

04h - DLADR-L, Drive Last Address, bit0-7 (W)

05h - DLADR-M, Drive Last Address, bit8-15 (W)

06h - DLADR-H, Drive Last Address, bit16 (W)

  0-16  DLADR  Addr. bit0-16     ...
  17-23 "L"    Reserved (should be 0)

10h - DADRC-L - Drive Address Counter, bit0-7 (W)

11h - DADRC-M - Drive Address Counter, bit8-15 (W)

12h - DADRC-H - Drive Address Counter, bit16 (W)

  0-16  DADRC    Incrementing Drive-to-Buffer Write Address, bit0-16
  17-23 "L"      Reserved (should be 0)

0Eh - DADRC-L - Drive Address Counter, Bit0-7 (R)

0Fh - DADRC-M - Drive Address Counter, Bit8-15 (R)

  0-15  DADRC Address bit0-15  ;bit16 is in Port 0Bh            ...

0Ch - HXFR-L - Host Transfer Length, bit0-7 (W)

0Dh - HXFR-H - Host Transfer Length, bit8-11 and stuff (W)

  0-11  HXFR     number of data bytes, bit0-11 (0..FFFh)       ...
  12    HADR.16  HADR  bit16
  13    "L"      Reserved (should be 0)
  14    "L" ??   Reserved (should be 0)   ;<-- XXX but on PSX: Always 1 !?!
                                          ;    seems to Disable INT8 ?!!!
  15    DISHXFRC Disable HXFRC (0=Use HXFRC, 1=Disable, Infinite-or-Zero Len?)

0Eh - HADR-L - Host Transfer Address, bit0-7 (W)

0Fh - HADR-M - Host Transfer Address, bit8-15 (W)

  0-15  HADR     Addr. bit0-15  ;bit16 in Port 0Dh    ...

0Ah - HXFRC-L - Host Transfer Remain Counter, bit0-7 (R)

0Bh - HXFRC-H - Host Transfer Remain Counter, bit8-11, and other bits (R)

  0-11  HXFRC Host Transfer Counter bit0-11 (number of remaining bytes)
  12    HADRC bit16  ;MSB of Port 0Ch/0Dh
  13    DADRC bit16  ;MSB of Port 0Eh/0Fh
  14-15 -     Reserved (undefined) (usually both bits set)

0Ch - HADRC-L - Host Transfer Address Counter, bit0-7 (R)

0Dh - HADRC-M - Host Transfer Address Counter, bit8-15 (R)

  0-15  HADRC Address bit0-15  ;bit16 is in Port 0Bh

"This counter keeps the addresses which write or read the data with host into/from the buffer.
When data from the host is written into the buffer or data to the host is read from the buffer, the HADRC value is output from MA0 to 16. HADRC is incremented each time one byte of data from the drive is read from the buffer (BFRD is high) or written into the buffer (BFWR is high)."

Note

When reading from SRAM, data seems to go through a 8-byte data fifo, the HXFRC (remain) and HADRC (addr) values aren't aware of that FIFO (ie. if there's data in the fifo, then addr will be 8 bigger and remain 8 smaller than what has arrived at the host).

Unclear Notes

"If sound map data is to be transferred before the data is transferred (immediately after the host has set the BFRD and BFWR bits (bits 7 and 6) of the HCHPCTL register high)":

  900h is loaded into HXFRC
  and 600Ch, 6A0Ch, or 740Ch is loaded into HADRC
  (at least, supposedly, above addresses , for cases when using 32K SRAM)

"At any other time":

  HADR and HXFR are loaded into HADRC and HXFRC

Unknown what the above crap is trying to say exactly.
"At any other time" does apparently refer to cases when transfers get started (whilst during transfer, the address/remain values are obviously increasing/decreasing).
For sound map, theoretically, the SMEN bit should be set, but above does somewhat suggest that BFRD or BFWR (or actually: both BFRD and BFWR) need to be set...?

Sector Buffer Memory Map (32Kx8 SRAM)

  0000h 1st Sector (at 0000h..0923h) (unused gap at 0924h..0BFFh)
  0C00h 2nd Sector (at 0C00h..1523h) (unused gap at 1524h..17FFh)
  1800h 3rd Sector (at 1800h..2123h) (unused gap at 2124h..23FFh)
  2400h 4th Sector (at 2400h..2D23h) (unused gap at 2D24h..2FFFh)
  3000h 5th Sector (at 3000h..3923h) (unused gap at 3924h..3BFFh)
  3C00h 6th Sector (at 3C00h..4523h) (unused gap at 4524h..47FFh)
  4800h 7th Sector (at 4800h..5123h) (unused gap at 5124h..53FFh)
  5400h 8th Sector (at 5400h..5D23h) (unused gap at 5D24h..5FFFh)
  6000h Soundmap ADPCM Buffer (at 600Ch..690Bh) (gaps at 6000h and 690Ch)
  6A00h Soundmap ADPCM Buffer (at 6A0Ch..730Bh) (gaps at 6A00h and 730Ch)
  7400h Soundmap ADPCM Buffer (at 740Ch..7D0Bh) (gaps at 7400h and 7D0Ch)
  7E00h Unknown/Unused

CDROM Internal CXD1815Q Sub-CPU Misc Registers

16h - HIFCTL - Host Interface Control (W)

  0-2  HINT    Request Host Interrupt (INT1..INT7, or 0=None/No change)
  3-7  "L"     Reserved (should be 0)

11h - HIFSTS - Host Interface Status (R)

  0-2 HINTSTS  Pending Host Interrupt (INT1..INT7, or 0=None/All acknowledged)
  3   DMABUSY  DMA Busy (0=Data FIFO Empty and HXFRC=0, 1=Data Transfer Busy)
  4   PRMRRDY  Paramter Read Ready (0=Parameter FIFO Empty, 1=Ready/Not Empty)
  5   RSLEMPT  Result Empty        (0=Response FIFO Not Empty, 1=Empty)
  6   RSLWRDY  Result Write Ready  (0=Response FIFO Full, 1=Ready/Not Full)
  7   BUSYSTS  Command Busy Status (0=Command Not Empty, 1=Ack'ed by CLRBUSY)

0Ah - CLRCTL - Clear Control (W)

  0   RESYNC   Sync with CD DSP (0=No change, 1=Resync, eg. after speed change)
  1-3 "L"      Reserved (should be 0)
  4   RTADPCLR Abort Real-time ADPCM (0=No Change, 1=Abort; when ADPMNT.7=0)
  5   CLRRSLT  Clear Reply FIFO    (0=No change, 1=Acknowledge; clear FIFO)
  6   CLRBUSY  Acknowledge Command (0=No change, 1=Acknowledge; clear BUSYSTS)
  7   CHPRST   Chip Reset          (0=No change, 1=Do Chip Initialization)

07h - INTSTS - Interrupt Status (R) - (0=No, 1=IRQ)

09h - INTMSK - Interrupt Mask (W) - (0=Disable, 1=Enable)

0Bh - CLRINT - Clear Interrupt Status (W) - (0=No change, 1=Clear/Ack)

  0   HCRISD   Host Chip Reset Issued
  1   HSTCMND  Host Command                ...
  2   DECINT   Decoder Interrupt           ..
  3   HDMACMP  Host DMA Complete           .   <-- PSX: used for retry ?!?!!!
  4   RTADPEND Real-time ADPCM end
  5   RSLTEMPT Result Empty
  6   DECTOUT  Decoder Time Out
  7   DRVOVRN  Drive Overrun

12h - HSTPRM - Host Parameter (R)

  0-7  Param FIFO (check HIFSTS.4 to see if the FIFO is empty)

HIFSTS.4 goes off when all bytes read.
Said to have 8-byte FIFO in CXD1199AQ datasheet.
But, PSX has 16-byte Parameter FIFO...!?!

13h - HSTCMD - Host Command (R)

  0-7  Command (check INTSTS.1 or HIFSTS.7 to see if a command was sent)

Command should be ack'ed via CLRINT.1 and CLRCTL.6.

17h - RESULT - Response FIFO (W)

  0-7  Data (has 8-byte FIFO)

Said to have 8-byte FIFO in CXD1199AQ datasheet.
But, PSX has 16-byte Response FIFO...!?!

08h - ADPCI - ADPCM Coding Information (R)

  0   S/M      ADPCM Stereo/Mono        (0=Mono, 1=Stereo)
  1   -        Reserved (undefined)
  2   FS       ADPCM Sampling Frequency (0=37.8kHz, 1=18.9kHz)
  3   -        Reserved (undefined)
  4   BITLNGTH ADPCM Sample Bit Length  (0=Normal/4bit, 1=8bit)
  5   ADPBUSY  ADPCM Decoding           (0=No, 1=Yes/Busy)
  6   EMPHASIS ADPCM Emphasis           (0=Normal/Off, 1=On)
  7   MUTE     DA Data is Muted (uh?)   (0=No, 1=Yes/Muted)

Unknown if ADPCI is affected by configurations by Main-CPU's Sound Map ADPCM or by Sub-CPU's Real-time ADPCM (or by both)?
Note: Bit5,7 are semi-undocumented in the datasheet (mentioned in the ADPCI description, but missing in overall register summary).

1Bh - RTCI - Real-time ADPCM Coding Information (W)

  0    S/M      ADPCM Stereo/Mono        (0=Mono, 1=Stereo)
  1    "L"      Reserved (should be 0)
  2    FS       ADPCM Sampling Frequency (0=37.8kHz, 1=18.9kHz)
  3    "L"      Reserved (should be 0)
  4    BITLNGTH ADPCM Sample Bit Length  (0=Normal/4bit, 1=8bit)
  5    "L"      Reserved (should be 0)
  6    EMPHASIS ADPCM Emphasis           (0=Normal/Off, 1=On)
  7    "L"      Reserved (should be 0)

06h,09h,10h,14h..1Fh - Reserved (R)

  0-7  Reserved (undefined)

Of these, 09h and 10h are officially unused/reserved. And addresses 06h and 14h..1Fh aren't officially mentioned to exist at all.
Trying to read these registers on a PSone returns Data=C0h for 06h, 09h, 10h, 15h-16h, 18h-1Fh, and Data=FFh for 14h, and Data=DEh for 17h.

08h,13h-15h,18h,1Ah,1Ch-1Fh - Reserved (W)

  0-7  Reserved (should be 00h) (or don't write at all)

Of these, 09h,13h-15h,18h,1Ah are officially unused/reserved. And addresses 1Ch-1Fh aren't officially mentioned to exist at all.

CDROM Internal Commands CX(0x..3x) - CXA1782BR Servo Amplifier

CXA1782BR - CX(0x) - Focus Servo Control - "FZC" FocusZeroCross at SENS pin

  23-20 4bit  Command (00h)
  19    1bit  FS4 Focus Servo (0=Off, 1=On)
  18    1bit  FS3 DEFECT
  17    1bit  FS2 Enable Focus Search Voltage (0=Off, 1=On)
  16    1bit  FS1 Select Focus Search Voltage (0=Falling, 1=Rising)
  15-0  16bit Unused (don't care)

For Focus Search: Keep FS1=on, and toggle FS2 on and off (this will generate a waveform, and SENS will indicate when reaching a good focus voltage).

CXA1782BR - CX(1x) - Tracking/Brake/Sled - "DEFECT" at SENS pin

  23-20 4bit  Command (01h)
  19    1bit  TG1,TG2 ON/OFF Tracking Servo Gain Up/Normal (hmmm?)
  18    1bit  Brake Circuit ON/OFF
  17-16 2bit  PS Sled Kick Height (0=+/-1, 1=+/-2, 2=Undoc, 3="Don't use"?)
  15-0  16bit Unused (don't care)

Note: The PSX CDROM BIOS does use the "Undoc" setting (ie. bit17=1), but the effect is undoc/unknown?
Note: CX(1x) works different on CXD2545Q (some bits are moved around, and the "SledKickHeight" bits are renamed to "SledKickLevel" and moved to different/new CX(3X) commands.

CXA1782BR - CX(2x) - Tracking and Sled Servo Control - "TZC" at SENS pin

  23-20 4bit  Command (02h)
  19-18 2bit  Tracking Control (0=Off, 1=Servo On, 2=F-Jump, 3=R-Jump) ;TM1,3,4
  17-16 2bit  Sled Control     (0=Off, 1=Servo On, 2=F-Fast, 3=R-Fast) ;TM2,5,6
  15-0  16bit Unused (don't care)

CXA1782BR - CX(3x) - "Automatic Adjustment Comparator Output" at SENS pin

  23-20 4bit  Command (03h)
  19    1bit  Value to be adjusted (0=Balance, 1=Gain)
  18-16 3bit  New Balance or Gain value (depending on above bit)
  15-0  16bit Unused (don't care)

Note: CX(3x) is extended and works very different on CXD2545Q.

CXA1782BR Command 4x..7x - "HIGH-Z" at SENS pin

  N-N   4bit  Command (04h..07h)

CXA1782BR Command 8x..Fx - "UNSPECIFIED???" at SENS pin

  N-N   4bit  Command (08h..0Fh)

Note

The Servo Amplifier isn't directly connected to the CPU. Instead, it's connected as a slave device to the Signal Processor. There are two ways to access the Servo Amplifier:
1) The CPU can send CX(0X..3X) commands to the Signal Processor (which will then forward them to the Servo Amplifier).
2) The Signal Processor can send CX(0X..3X) commands to the Servo Amplifier (this happens during CX(4xxx) Auto Sequence command).

CDROM Internal Commands CX(4x..Ex) - CXD2510Q Signal Processor

CXD2510Q - CX(4xxx) - Auto Sequence

  23-20 4bit  Command (4)
  19-16 4bit  AS3-0 Auto Sequence Command (see below)
  15-12 4bit  MT3-0 Max Timer Value (N timer units, or 0=Invalidate Timer)
  11    1bit  LSSL  Timer Units     (0=2.9ms, 1=186ms) (for above MT value)
  10-8  3bit  Unused (zero)
  7-0   8bit  Unused (don't care)

Values for AS (Auto Sequence Command):

  00h     Cancel
  04h/05h Forward/Reverse Fine Search   ;<--sends CX(25h) ;\these do internally
  07h     Focus-On                      ;<--sends CX(02h) ; send commands to
  08h/09h Forward/Reverse 1 Track Jump  ;\                ; CXA1782BR
  0Ah/0Bh Forward/Reverse 10 Track Jump ;   sends CX(25h) ; and, auto sequence
  0Ch/0Dh Forward/Reverse 2N Track Jump ;/                ;/is interrupted?
  0Eh/0Fh Forward/Reverse 1N Track Move ;<--CXD2545Q only(Reserved on CXD2510Q)
  01h..03h,06h = Reserved

CXD2510Q - CX(5x) - Blind,Brake,Overflow Timer

  23-20 4bit  Command (5)
  19-16 4bit  TR3-0 Timer (N*0.022ms for Blind/Overflow, N*0.045ms for Brake)
  15-8  8bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

CXD2510Q - CX(6xx) - SledKick,Brake,Kick Timer

  23-20 4bit  Command (6)
  19-16 4bit  SD3-0 Timer KICK.D (N*2.9ms for Fine Search? else N*1.45ms?)
  15-12 4bit  KF3-0 Timer KICK.F (N*0.09ms)
  11-8  4bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

CXD2510Q - CX(7xxxx) - Track jump count setting (for Auto Sequence Command)

  23-20 4bit  Command (7)
  19-4  16bit Track Jump Count Setting (0..65535) for Command 4x
  3-0   4bit  Unused (don't care)

CXD2510Q - CX(8xx) - MODE Specification

  23-20 4bit  Command (8)
  19    1bit  CDROM        (0=Audio, 1=CDROM; no average and pre-value stuff)
  18    1bit  DOUT Mute    (0=Not muted, 1=Mute DOUT)
  17    1bit  D.out Mute-F (0=Not muted, 1=Mute DA)
  16    1bit  WSEL         (0=Enhanced Sync Window, 1=Enhanced Anti-Rolling)
  15    1bit  VCO SEL      (0=Double Correction, 1=Quadruple Correction)
  14    1bit  ASHS         (0=Double Correction, 1=Quadruple Correction)
  13    1bit  SOCT         (0=Output SubQ to SQSO, 1=Output Each? to SQSO)
  12    1bit  Unused (zero)
  11-8  4bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

CXD2510Q - CX(9xx) - Function Specification

  23-20 4bit  Command (9)
  19    1bit  DCLV ON-OFF (complex stuff, related to gain and frequencies)
  18    1bit  DSPB ON-OFF (0=Normal Speed, 1=Double Speed; fixed pitch)
  17    1bit  ASEQ ON-OFF (select output on SENS pin)
  16    1bit  DPLL ON-OFF (0=Analog RFPLL, 1=Digital RFPLL)
  15-14 1bit  Bilingual Audio (0=Stereo, 1=RightOnly, 2=LeftOnly, 3=Mute)
  13    1bit  FLFC (normally 0)
  12    1bit  Unused (zero)
  11-8  4bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

CXD2510Q - CX(Axx) - Audio Control

  23-20 4bit  Command (0Ah)
  19    1bit  Vari Up   (write 1-then-0 to increase pitch by +0.1%)
  18    1bit  Vari Down (write 1-then-0 to decrease pitch by -0.1%)
  17    1bit  Mute (0=Not muted; unless muted elsewhere, 1=Mute & Peak=0)
  16    1bit  ATT  (0=Attentuation off, 1=Minus 12 dB)
  15-14 2bit  PCT  (0=Normal, 1=LevelMeter, 2=PeakMeter, 3=Normal) (0-1=QuadC2)
  13-12 2bit  Unused (zero)
  11-8  4bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

Normal: SQSO outputs... WHAT?
PeakMeter: SQSO outputs highest peak ever on any channel (bit15: usually 0)
LevelMeter: SQSO outputs recent peak (with bit15 toggled: 0=Right, 1=Left)

CXD2510Q - CX(Bxxxx) - Traverse Monitor Counter Setting

  23-20 4bit  Command (0Bh)
  19-4  16bit Traverse Monitor Count (used when monitored by COMP and COUT) (?)
  3-0   4bit  Unused (don't care)

CXD2510Q - CX(Cxx) - Spindle Servo Coefficient Setting

  23-20 4bit  Command (0Ch)
  19-18 2bit  Gain MDP for CLVP mode (0=-6db, 1=0dB, 1=+6dB, 3=Reserved)
  17-16 2bit  Gain MDS for CLVS/CLVP (0=-12dB, 1=-6dB, 2=0dB, 3=Reserved)
  15    1bit  Zero (zero)
  14    1bit  Gain DCLV0 overall gain (0=0dB, 1=+6dB
  13-12 2bit  Unused (zero)
  11-8  4bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

CXD2510Q - CX(Dx) - CLV Control

  23-20 4bit  Command (0Dh)
  19    1bit  DCLV PWM MD Digital CLV PWM mode  (0=Use MDS+MDP, 1=Ternary MDP)
  18    1bit  TB Bottom Hold in CLVS/CLVH modes (0=At cycle RFCK/32, 1=RFCK/16)
  17    1bit  TP Peak Hold in CLVS mode         (0=At cycle RFCK/4, 1=RFCK/2)
  16    1bit  Gain CLVS for CLVS mode (0=0dB, 1=+6dB)(always +6dB in CLVP mode)
  15-8  8bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

CXD2510Q - CX(Ex) - CLV Mode

  23-20 4bit  Command (0Eh)
  19-16 4bit  CM3-0
  15-8  8bit  Unused (don't care on CXD2510Q, zero on CXD2545Q)
  7-0   8bit  Unused (don't care)

Values for CM (CLV Mode):

  00h Stop  Spindle Motor Stop mode
  06h CLVA  Automatic CLVS/CLVP switching mode, normally used for playback
  08h Kick  Spindle Motor Forward rotation mode
  0Ah Brake Spindle Motor Reverse rotation mode
  0Ch CLVH  Peak hold at 34kHz
  0Eh CLVS  Rough Servo Mode, RF-PLL related
  0Fh CLVP  PLL Servo mode

N/A - CX(F) - Reserved

  23-0  N/A  Don't use

SUBQ Output

 80bit subq
 15bit peak level (lsb first) (absolute/unsigned value)
 1bit  peak l/r flag (aka appears as "MSB" of peak level)

L/R is toggled after each SUBQ reading, however the PSX Report mode does usually forward SUBQ only every 10 frames, so it stays stuck in one setting (but may toggle after one second; ie. every 75 frames). And, peak is reset after each read, so 9 of the 10 frames are lost.

CXD2510Q - SENS output

  Index         ASEQ=0  ASEQ=1   ;<-- ASEQ can be set via CX(9xx)
  0X            HighZ   SEIN (FZC)                     ;\aka SENS output
  1X            HighZ   SEIN (A.S)    ... aka DEFECT   ; from CXA1782BR
  2X            HighZ   SEIN (T.Z.C)  ... aka TZC      ; forwarded through
  3X            HighZ   SEIN (SSTOP)  ... aka Gain/Bal ;/CXD2510Q
  4X            HighZ   XBUSY
  5X            HighZ   FOK
  6X            HighZ   SEIN (HighZ)
  AX            GFS     GFS
  BX            COMP    COMP
  CX            COUT    COUT
  EX            /OV64   /OV64
  7X-9X,DX,FX   HighZ   0

Whereas,

 FZC    Focus Zero Cross
 DEFECT Defect?
 TZC    Tracking Zero Cross
 SSTOP  Gain or Balance adjust reached wanted level
 XBUSY  Low while the auto sequencer operation is busy
 FOK    High for "focus OK" (same as FOK pin)
 GFS    High when the played back frame sync is obtained with correct timing
 COMP   Measures the number of tracks set with Reg B. High when Reg B is
          latched, low when the initial Reg B number is input by CNIN
 COUT   Measures the number of tracks set with Reg B. High when Reg B is
          latched, toggles each time the Reg B number is input by CNIN. While
          $44 and $45 are being executed, toggles with each CNIN 8-count
          instead of the Reg B number
 OV64   Low when filtered EFM signal is lengthened by 64 channel clock
          pulses or more

CDROM Internal Commands CX(0x..Ex) - CXD2545Q Servo/Signal Combo

CXD2545Q - CX(0x) and CX(2x) - same as CXA1782BR Servo Amplifier

CDROM Internal Commands CX(0x..3x) - CXA1782BR Servo Amplifier

CXD2545Q - CX(4x..Ex) - same as CXD2510Q Signal Processor

CDROM Internal Commands CX(4x..Ex) - CXD2510Q Signal Processor
One small difference is that the CXD2545Q supports a new "M Track Move" function as part of the CX(4xxx) command. And, some "don't care" bits are now reserved (ie. some commands need to be padded with additional leading "0" bits).

CXD2545Q - CX(1x) - Anti Shock/Brake/Tracking Gain/Filter

  23-20 4bit  Command (01h)
  19    1bit  Anti Shock (0=Off, 1=On)
  18    1bit  Brake      (0=Off, 1=On)
  17    1bit  Tracking Gain (0=Normal, 1=Up)
  16    1bit  Tracking Gain Filter (0=Select 1, 1=Select 2)
  15-0  16bit Unused (don't care)

CXD2545Q - CX(30..33) - Sled Kick Level

  23-20 4bit  Command (03h)
  19-18 2bit  Subcommand (0)
  17-16 2bit  Sled Kick Level (0=+/-1, 1=+/-2, 2=+/-3, 3=+/-4)
  15-0  16bit Unused (don't care)

CXD2545Q - CX(34xxxx) - Write to Coefficient RAM

  23-16 8bit  Command (34h)
  15    1bit  Zero (0)
  14-8  7bit  Address (00h..4Fh = Select Coefficient K00..K4F)
  7-0   8bit  Data    (00h..FFh = New value)
  PLUS  8bit  Eight more bits on PSone (!)

Allows to change the default preset coefficient values,
CDROM Internal Coefficients (for CXD2545Q)

CXD2545Q - CX(34Fxxx) - Write to Special Register

  23-12 12bit Command (34Fh)
  11-10 2bit  Index (0=TRVSC, 1=FBIAS, 2=?, 3=?)
  9-0   10bit Data (for FBIAS: bit0=don't care)

CXD2545Q - CX(35xxxx) - FOCUS SEARCH SPEED/VOLTAGE/AUTO GAIN

  23-16 8bit  Command (35h)
  15-14 2bit  FT  Focus Search-up speed 1
  13-8  6bit  FS  Focus Search limit voltage (default 011000b) (+/-1.875V)
  7     1bit  FTZ Focus Search-up speed 2
  6-0   7bit  FG  AGF Convergence Gain Setting (default 0101101b)

CXD2545Q - CX(36xxxx) - DTZC/TRACK JUMP VOLTAGE/AUTO GAIN

  23-16 8bit  Command (36h)
  15    1bit  Zero (0)
  14    1bit  DTZC DTZC Delay (0=4.25us/Default, 1=8.5us)
  13-8  6bit  TJ   Track Jump voltage (default 001110b) (+/-1.09V)
  7     1bit  Zero (0)
  6-0   7bit  TG   AGT Convergence Gain Setting (default 0101110b)

CXD2545Q - CX(37xxxx) - FZSL/SLED MOVE/Voltage/AUTO GAIN

  23-16 8bit  Command (37h)
  15-14 2bit  FZS              XXX pg. 84
  13-8  6bit  SM    Sled Move Voltage
  7     1bit  AGS
  6     1bit  AGJ
  5     1bit  AGGF
  4     1bit  AGGT
  3     1bit  AGV1
  2     1bit  AGV2
  1     1bit  AGHS
  0     1bit  AGHT

CXD2545Q - CX(38xxxx) - Level/Auto Gain/DFSW (Initialize)

  23-16 8bit  Command (38h)
  15    1bit  VCLM VC level measurement on/off
  14    1bit  VCLC VC level compensation for FCS_In Register on/off
  13    1bit  FLM  Focus zero level measurement on/off
  12    1bit  FLC0 Focus zero level compensation for FZC Register on/off
  11    1bit  RFLM RF zero level measurement on/off
  10    1bit  RFLC RF zero level compensation on/off
  9     1bit  AGF  Focus automatic gain adjustment on/off
  8     1bit  AGT  Tracking automatic gain adjustment on/off
  7     1bit  DFSW Defect switch disable (1=disable defect measurement)
  6     1bit  LKSW Lock switch (1=disable sled free-running prevention)
  5     1bit  TBLM Traverse center measurement on/off
  4     1bit  TCLM Tracking zero level measurement on/off
  3     1bit  FLC1 Focus zero level compensation for FCS_In Register on/off
  2     1bit  TLC2 Traverse center compensation on/off
  1     1bit  TLC1 Tracking zero level compensation on/off
  0     1bit  TLC0 VC level compensation for TRK/SLD_In register on/off

VCLM,FLM,RFLM,TCLM are accepted every 2.9ms.

CXD2545Q - CX(39xx) - Select internal RAM/Registers for serial readout

  23-16 8bit  Command (39h)
  15    1bit  DAC Serial data readout DAC mode on/off
  14-8  7bit  SD  Serial readout data select (see below)
  7-0   8bit  Unused (don't care)

Serial Readout Addresses:

  Addr    Data  Content
  00h     8bit  VC input signal
  01h     8bit  SE input signal
  02h     8bit  TE input signal
  03h     8bit  FE input signal
  04h-07h 9bit  TE AVRG register (mirrored to 04h-07h)
  08h-0Bh 9bit  FE AVRG register (mirrored to 08h-0Bh)
  0Ch-0Fh 9bit  VC AVRG register (mirrored to 0Ch-0Fh)
  12h     8bit  RFDC envelope (peak)
  13h     8bit  RFDC envelope (bottom)
  1Ch     9bit  TRVSC register
  1Dh     9bit  FBIAS register
  1Eh     8bit  RFDC input signal
  1Fh     8bit  RF AVRG register
  20h-3Fh 16bit Data RAM        (M00-M1F)
  40h-7Fh 8bit  Coefficient RAM (K00-K3F) (note: K40-K4F cannot be read out)

CXD2545Q - CX(3Ax000) - Focus BIAS addition enable

  23-16 8bit  Command (3Ah)
  15    1bit  Zero (0)
  14    1bit  FBON: FBIAS register addition (0=off, 1=Add FBIAS to FCS)
  13-0  14bit Zero (0)

CXD2545Q - CX(3Bxxxx) - Operation for MIRR/DFCT/FOK

  23-16 8bit  Command (3Bh)
  15-14 2bit  SFO  FOK Slice Level (...depends on SFOX)
  13-12 2bit  SDF  DFCT Slice Level (0=89mV, 1=134mV, 2=179mV, 3=224mV)
  11-10 2bit  MAX  DFCT Maximum Time (0=No Limit, 1=2ms, 2=2.36ms, 3=2.72ms)
  9     1bit  SFOX FOK Slice Level (...depends on SFO)
  8     1bit  BTF  Bottom Hold Double-Speed Count-Up mode for MIRR (0=off)
  7-6   2bit  D2V  Peak Hold 2 for DFCT (0=22.05kHz, 1=44.1, 2=88.2, 3=176.4)
  5-4   2bit  D1V  Peak Hold 1 for DFCT (0=176.4kHz, 1=352.8, 2=705.6, 3=1411)
  3-0   4bit  Zero (0)

CXD2545Q - CX(3Cxxxx) - TZC for COUT SLCT HPTZC (Default)

  23-16 8bit  Command (3Ch)
  15-0  16bit Unused (don't care)

CXD2545Q - CX(3Dxxxx) - TZC for COUT SLCT DTZC

  23-16 8bit  Command (3Dh)
  15-0  16bit Unused (don't care)

CXD2545Q - CX(3Exxxx) - Filter

  23-16 8bit  Command (3Eh)
  15-14 2bit  F1NDM FCS servo filter 1st stage (1=normal, 2=down)
  13-12 2bit  F3NUM FCS servo filter 3rd stage (1=normal, 2=up)
  11-10 2bit  T1NDM TRK servo filter 1st stage (1=normal, 2=down)
  9-8   2bit  T3NUM TRK servo filter 3rd stage (1=normal, 2=up)
  7     1bit  DFIS  FCS hold filter input extraction node (0=M05, 1=M04)
  6     1bit  TLCD  Mask TLC2 set by D2 of CX(38) only when FOK low
  5     1bit  RFLP  Pass signal from RFDC pin through low-pass-filter
  4-0   5bit  Zero (0)

CXD2545Q - CX(3Fxxxx) - Others

  23-16 8bit  Command (3Fh)          ... XXX pg. 89
  15-14 2bit  Unused (0)
  13-12 2bit  XTD
  11    1bit  Unused (0)
  10-8  3bit  DRR
  7     1bit  Unused (0)
  6     1bit  ASFG
  5     1bit  Unused (0)
  4     1bit  LPAS
  3-2   2bit  SRO
  1-0   2bit  Unused (0)

CXD2545Q feedback on 39xx: see pg. 77 (eg. 390C = VC AVRG)

XXX

CXD2545Q - SENS output

  Index          ASEQ=0  ASEQ=1           Length
  $0X            Z       FZC              -
  $1X            Z       AS               -
  $2X            Z       TZC              -
  $38            Z       AGOK*1           -
  $38            Z       XAVEBSY*1        -
  $30-37,$3A-3F  Z       SSTP             -
  $3904          Z       TE Avrg Reg.     9 bit
  $3908          Z       FE Avrg Reg.     9 bit
  $390C          Z       VC Avrg Reg.     9 bit
  $391C          Z       TRVSC Reg.       9 bit
  $391D          Z       FB Reg.          9 bit
  $391F          Z       RFDC Avrg Reg.   8 bit
  $4X            Z       XBUSY            -
  $5X            Z       FOK              -
  $6X            Z       0                -
  $AX            GFS     GFS              -
  $BX            COMP    COMP             -
  $CX            COUT    COUT             -
  $EX            OV64    OV64             -
  $7X-9X,DX,FX   Z       0                -

*1 $38 outputs AGOK during AGT and AGF command settings, and XAVEBSY during AVRG measurement.
SSTP is output in all other cases.

CDROM Internal Commands CX(0x..Ex) - CXD2938Q Servo/Signal/SPU Combo

Most commands are same as on CXD2545Q. New/changed commands are:

CXD2938Q - CX(349xxxxx) - New SCEx

Older PSX consoles have received the "SCEx" string at 250 baud via HC05 PortB.bit1, which allowed modchips to injected faked "SCEx" signals to that pin. To prevent that, the CXD2938Q contains some new 32bit commands that allow to receive somewhat encrypted "SCEx" strings via SPI bus. The used commands are:

  CX(34910000) NewScexStopReading
  CX(3491xy80) NewScexRandomKey(xy)
  CX(34920000) NewScexFlushResyncOrSo
  CX(34944A00) NewScexInitValue1
  CX(3498C000) NewScexInitValue2
  CX(349C1000) NewScexThis   ;\inverse  ;\use CX(3C2080) for COUT selection
  CX(349D1000) NewScexThat   ;/of COUT  ;/

The relevant command is NewScexRandomKey(xy) which does send a random value (x=01h..0Fh, and y=01h), and does then receive a 12-byte response via SPI bus (which is normally used to receive SUB-Q data).

  1st byte: Unknown/unused (normally ADR/Control) ;\these should be probably
  2nd byte: Unknown/unused (normally Track)       ; set to some invalid values
  3rd byte: Unknown/unused (normally Index/Point) ;/to avoid SUB-Q confusion
  4th..10th byte: SCEx data or Dummy bytes (depending on xy.bit7..1)
  11th..12th byte: Unknown/unused (normally Audio Peak level)

The 12-byte packet does contain one SCEx character encoded in 4th..10th byte corresponding to Flags in "xy" bit 7..1 (in that order):
All bytes with Flag=1 are ORed together to compute a Character byte (those bytes could be all set to 53h for "S", or if more than one flag is set, it could be theoretically split to something like 41h and 12h).
All bytes with Flag=0 are ORed together to compute a Dummy byte. If the Character byte is same as the Dummy byte, then it gets destroyed by setting Character=00h (to avoid that, one could set all dummies to 00h, or set one or more dummies to FFh, for example).
Finally, "xy" bit0=0 indicates that the resulting character byte is inverted (XORed by FFh), however, the CDROM BIOS does always use bit0=1, so the inversion feature is never used.
For the whole SCEx string, there must be at least one 00h byte inserted between each character (or some Char=Dummy mismatch, which results in Char=00h either), and there should be a few more 00h bytes preceeding the first character ("S").
Note: Modchips didn't bother to reproduce that new SCEx transfers, instead they have simply bypassed it by injecting the 250 baud SCEx string to some analog lower level signal.

CXD2938Q - CX(3Bxxxx) - Some Changed Bits

Same as in older version, but initialized slightly differently: CXD2545Q used CX(3B2250) whilst CXD2938Q is using CX(3B7250).

CXD2938Q - CX(3Cxxxx) - TzcCoutSelect with New/Changed Extra Bits

The CXD2545Q used two 8bit commands, CX(3C) and CX(3D), for TzcOut selection, which are now replaced by a single 24bit command, CX(3Cxxxx), and which do include a new mode related to New SCEx.

  CXD2545Q   CXD2938Q
  CX(3C)     CX(3C0080) TzcCoutSelectHPTZC;\ <--formerly CX(3C)
  -          CX(3C2080) TzcCoutSelectSCEX ;  <--special NewScex mode
  CX(3D)     CX(3C4080) TzcCoutSelectDTZC ;/ <--formerly CX(3D)

CXD2938Q - CX(8xxxxx) - Disc Mode with New/Changed Extra Bits

Command CX(8xx) has been 12bit wide on CXD2545Q, and is now expanded 24bit width (with some changed/unknown bits).

  CXD2545Q   CXD2938Q
  CX(8180)   CX(810408) MODE = Audio (CD-DA)
  CX(8120)   CX(812400) MODE = Audio (CD-DA) (manual SPI bus access)
  CX(8980)   CX(890408) MODE = CDROM (Data)
  -          CX(898000) MODE = CDROM (Data) (used on RESET)

CXD2938Q - CX(9xx000) - Normal/Double Speed with New Extra Bits

Command CX(9xx) has been 12bit wide on CXD2545Q (with bit12=reserved/zero), and is now expanded 24bit width (with bit12=unknown/one and bit11-0=unknown/zero).

CXD2938Q - CX(Dx0000) and CX(Ex0000) - New Zero Padding

Commands CX(Dx) and CX(Ex) have been 8bit wide on CXD2545Q, and are now zeropadded to 24bit width, ie. CX(Dx0000) and CX(Ex0000). Unknown if the extra bits are hiding any extra features. In practice, the CDROM BIOS is always setting them zero (except in some test commands which are accidently still using the old 8bit form, resulting in garbage in lower 16bits).

CDROM Internal Commands CX(xx) - Notes

Serial Command Transmission (for Signal Processor and Servo Amplifier)

Commands are sent serially LSB first via DATA,CLOK,XLAT pins: DATA+CLOK are used to send commands to the chip, command execution is then applied by dragging XLAT low for a moment.
Commands can be up to 24bits in length, but unused LSBs (the "don't care" bits) can be omitted; the PSX BIOS clips the length to 8bit/16bit where possible (due to the LSB-first transfer order, the chip does treat the most recently transferred bit as MSB=bit23, and there's no need to transfer the LSBs if they aren't used).
Aside from being used as command number, the four most recently transferred bits are also used to select SENS status feedback (for the SENS selection it doesn't matter if the four bits were terminated by XLAT or not).

Sled Motor / Track Jumps / Tracking

The Sled motor moves the drive head to the current read position. On a Compact Disc, the term "Track" does normally refer to Audio tracks (songs). But the drive hardware uses the terms "Track" and "Tracking" for different purposes:
Tracking appears to refer to moving the Optics via magnets (ie. moving only the laser/lens, without actually moving the whole sled) (this is done for fine adjustments, and it seems to happen more or less automatically; emulators can just return increasing sectors without needing to handle special tracking commands).
Track jumps refer to moving the entire Sled, one "track" is equal to one spiral winding (1.6 micrometers). One winding contains between 9 sectors on innermost windings, and 22.5 sectors on outermost windings (the PSX cdrom bios is translating the sector-distance to non-linear track-distance, and emulators must undo that translation; otherwise the sled doesn't arrive at the intended location; the cdrom bios will retry seeking a couple of times and eventually settle down at the desired location - but it will timeout if the sled emulation is too inaccurate).
The PSX hardware uses two mechanisms for moving the Sled:
Command CX(4xxx) Forward/Reverse Track Jump: allows to move the sled by 1..131070 tracks (ie. max 210 millimeters), and the hardware does stop automatically after reaching the desired distance.
Command CX(2x) Forward/Reverse Fast Sled: moves the sled continously until it gets stopped by another command (in this mode, software can watch the COUT signal, which gets toggled each "N" tracks; whereas "N" can be selected via Command CX(Bxxxx), which is configured to N=100h in PSX).
The PSX cdrom bios is issuing another Fast Sled command (in opposite direction) after Fast Sled commands, emulators must somehow interprete this as "sled slowdown" (rather than as actually moving the sled in opposite direction, which could move the sled miles away from the target). For some reason vC1 BIOS is using a relative short slowdown period, whilst vC2/vC3 are using much longer slowdown periods (probably related to different SledKickHeight aka SledKickLevel settings and/or to different Sled Move Voltage settings).

Focus / Gain / Balance

The hardware includes commands for adjusting & measuring focus/gain/balance. Emulators can just omit that stuff, and can always signalize good operation (except that one should emulate failures for Disc Missing; and eventually also for cases like Laser=Off, or Spindle=Stopped).
Focus does obviously refer to moving the lens up/down. Gain does probably refer to reflection level/laser intensity. Balance might refer to tracking adjustments or so.

CDROM Internal Commands CX(xx) - Summary of Used CX(xx) Commands

The PSX CDROM BIOS versions vC1, vC2, and vC3 are using following CX() commands:

<B>  <--vC1-->  <--vC2-->  <--vC3--></B>
<B>  CXD2510Q   CXD2545Q   CXD2938Q</B>
  CX(00)     CX(00)     CX(00)     AllFocusSwitchesOff
  CX(02)     CX(02)     CX(02)     FocusSearchVoltageFalling
  CX(03)     CX(03)     CX(03)     FocusSearchVoltageRising ;ForTestOnly
  CX(08)     CX(08)     CX(08)     FocusServoOn
  CX(0C)     CX(0C)     CX(0C)     FocusServoOnAndDefectOn ;diff.usage vC# ?
  -----
  CX(11)     -          -          SledKickHeight2
  CX(12)     -          -          SledKickHeightInvalid
  CX(19)     -          -          TrackingGainAndSledKickHeight2
  CX(1D)     -          -          TrackingGainBrakeAndSledKickHeight2
  CX(1E)     -          -          TrackingGainBrakeAndSledKickHeightInvalid
  -----
  -          CX(11)     CX(11)     AntiShockOff            ;\
  -          CX(13)     CX(13)     AntiShockOffGainUp      ;
  -          CX(17)     CX(17)     AntiShockOffGainUpBrake ;/
  -----
  CX(20)     CX(20)     CX(20)     SledAndTrackingOff
  CX(21)     CX(21)     CX(21)     SledServoOn          ;ForTestOnly
  CX(22)     CX(22)     CX(22)     SledFastForward
  CX(23)     CX(23)     CX(23)     SledFastReverse
  CX(24)     -          -          TrackingServoOn
  CX(25)     CX(25)     CX(25)     SledAndTrackingServoOn
  -          CX(26)     CX(26)     SledFastForwardAndTrackingServoOn
  CX(28)     CX(28)     CX(28)     TrackingForwardJump  ;ForTestOnly
  CX(2C)     CX(2C)     CX(2C)     TrackingReverseJump  ;ForTestOnly
  -----
  CX(30+n)   -          -          BalanceAdjust(0..7)
  CX(38+n)   -          -          GainAdjust(0..7)
  -----
  -          CX(30)     CX(30)     SetSledKickLevel1       ;\
  -          CX(31)     CX(31)     SetSledKickLevel2       ;
  -          CX(32)     CX(32)     SetSledKickLevel3       ;/
  -----
  -          CX(3400E6) CX(3400E6) SetK00toE6hSledInputGain            ;def=E0h
  -          CX(340730) CX(340730) SetK07to30hSledAutoGain       ;blah ;def=30h
  -          CX(34114A) CX(34114A) SetK11to4AhFocusOutputGain          ;def=32h
  -          CX(341330) CX(341330) SetK13to30hFocusAutoGain      ;blah ;def=30h
  -          CX(341D6F) CX(341D6F) SetK1Dto6FhTrackingLowBoostFilterAL ;def=44h
  -          CX(341F64) CX(341F64) SetK1Fto64hTrackingLowBoostFilterBL ;def=5Eh
  -          CX(342220) CX(342220) SetK22to20hTrackingOutputGain       ;def=18h
  -          CX(342330) CX(342330) SetK23to30hTrackingAutoGain   ;blah ;def=30h
  -          CX(342D28) CX(342D28) SetK2Dto28hFocusGainDownOutputGain  ;def=1Bh
  -          CX(343E70) CX(343E70) SetK3Eto70hTrackingGainUpOutputGain ;def=57h
  -          -          CX(34910000) NewScexStopReading      ;\
  -          -          CX(3491x180) NewScexRandomKey(x)     ;
  -          -          CX(34920000) NewScexFlushResyncOrSo  ; SCEX SPECIAL
  -          -          CX(34944A00) NewScexInitValue1       ; see also:
  -          -          CX(3498C000) NewScexInitValue2       ; CX(3C2080)
  -          -          CX(349C1000) NewScexThis   ;\inverse ;
  -          -          CX(349D1000) NewScexThat   ;/of COUT ;/
  -          CX(34F000) CX(34F000) SetTRVSCto000h
  -          CX(34Fxxx) CX(34Fxxx) SetFBIAStoNNNh
  -----
  -          CX(3740AA) CX(3740AA) SetSMto00h      ;\set SM to 0,6,7,9
  -          CX(3746AA) CX(3746AA) SetSMto06h      ; (sled move voltage)
  -          CX(3747AA) CX(3747AA) SetSMto07h      ; (and init several
  -          CX(3749AA) CX(3749AA) SetSMto09h      ;/fixed settings)
  -----
  -          CX(380010) CX(380010) ModeMeasureTrackingZeroLevel ;\Measure modes
  -          CX(380800) CX(380800) ModeMeasureRfZeroLevel       ; (accepted
  -          CX(382000) CX(382000) ModeMeasureFocusZeroLevel    ; every 2.9ms)
  -          CX(388000) CX(388000) ModeMeasureVcLevel           ;/
  -          CX(38140A) CX(38140A) ModeCompensate
  -          CX(38140E) CX(38140E) ModeCompensateAndTraverseCenter
  -          CX(38148A) CX(38148A) ModeCompensateAndDefectOff
  -          CX(38148E) CX(38148E) ModeCompensateAndDefectOffTraverseCenter
  -          CX(3814AA) CX(3814AA) ModeCompensateAndStuffAndMeasureTraverse ;!
  -          CX(38150A) CX(38150A) ModeCompensateAndTrackingAutoGain
  -          CX(38150E) CX(38150E) ModeCompensateAndTrackingAutoGain
  -          CX(38160A) CX(38160A) ModeCompensateAndFocusAutoGain
  -----
  -          CX(391E)   -          SenseRFDCinputSignalWithoutDAC  ;\rather
  -          CX(3983)   -          SenseFEinputSignalWithDAC       ;/unused
  -          CX(399C)   -          SenseTRVSCregisterWithDAC       ;\only if
  -          CX(399D)   -          SenseFBIASregisterWithDAC       ;/TEST1=LOW
  -----
  -          CX(3A0000) CX(3A0000) FocusBiasAdditionOff            ;\
  -          CX(3A4000) CX(3A4000) FocusBiasAdditionOn             ;/
  -          CX(3B2250)!CX(3B7250)!InitOperationForMirrDfctFok <-- vC2/vC3 DIFF
  -          CX(3C)  !!!CX(3C0080) TzcCoutSelectHPTZC;\ <--formerly CX(3C)
  -          -       !!!CX(3C2080) TzcCoutSelectSCEX ;  <--special NewScex mode
  -          CX(3D)  !!!CX(3C4080) TzcCoutSelectDTZC ;/ <--formerly CX(3D)
  -          CX(3E0000) CX(3E0000) InitFilterBits                  ;\
  -          CX(3E0008) CX(3E0008) InitFilterBitsInvalid           ;/
  -          CX(3F0008) CX(3F0008) InitOtherStuff                  ;-
  -----
  CX(4000)   CX(4000)   CX(4000)   AutoSeqCancel
  CX(4700)   CX(4700)   CX(4700)   AutoSeqFocusOn
  CX(4800)   CX(4800)   CX(4800)   Forward1track
  CX(4900)   CX(4900)   CX(4900)   Reverse1track
  CX(4C00)   CX(4C00)   CX(4C00)   Forward2Ntrack
  CX(4D00)   CX(4D00)   CX(4D00)   Reverse2Ntrack
  -----
  CX(54)     CX(54)     CX(54)     BlindBrakeOverflowTimer=4
  CX(5A)     CX(5A)     CX(5A)     BlindBrakeOverflowTimer=A
  CX(6100)   CX(6100)   CX(6100)   SledKickBrakeKickTimer
  CX(70xxx0) CX(70xxx0) CX(70xxx0) TrackJumpCountSetting
  CX(8180)   CX(8180)!!!CX(810408) MODE = Audio (CD-DA)
  -          CX(8120)!!!CX(812400) MODE = Audio (CD-DA) (manual SPI bus access)
  -          -          CX(810000/UNUSED)
  -          -          CX(812000/UNUSED)
  CX(8980)   CX(8980)   CX(890408) MODE = CDROM (Data)
  -          -          CX(898000) MODE = CDROM (Data) (used on RESET)
  CX(9B00)   CX(9B00)!!!CX(9B1000) NormalSpeed
  CX(9F00)   CX(9F00)!!!CX(9F1000) DoubleSpeed
  CX(A040)   CX(A040)   CX(A040)   Attentuation Off
  CX(A140)   CX(A140)   CX(A140)   Attentuation -12 dB
  CX(B01000) CX(B01000) CX(B01000) TraverseMonitorCounterSetting
  CX(C600)   CX(C600)   CX(C600)   SpindleServoCoefficientSetting
  CX(D7)     CX(D7)     CX(D70000) ClvControl (fixed)
  CX(E0)     CX(E0)     CX(E00000) SpindleMotorStop
  -          -          CX(E02000) <-- aka bugged CX(E0) with CRAP=2000h
  CX(E6)     CX(E6)     CX(E60000) AutomaticNormal
  CX(E8)     CX(E8)     CX(E80000) SpindleMotorForward
  -          -          CX(E8crap) <-- aka bugged CX(E8) with CRAP=xxxxh
  CX(EA)     CX(EA)     CX(EA0000) SpindleMotorReverse
  -          -          CX(EAcrap) <-- aka bugged CX(EA) with CRAP=xxxxh
  CX(EE)     CX(EE)     CX(EE0000) RoughServo
  -----
  CX(F)      CX(F)      CX(F)      Unused (N/A)
  -----
  CX(Xx)     CX(Xx)     CX(Xx)       ;\
  CX(Xxxx)   CX(Xxxx)   CX(Xxxx)     ; TestCommand (cmd_19h_50h)
  CX(Xxxxxx) CX(Xxxxxx) CX(Xxxxxx)   ;
  -          -          CX(Xxxxxxxx) ;/
  -          CX(Xxxxxx) CX(Xxxxxx) SerialSense, CX(Xxxx) with extra 8bit junk

Note: for vC2, some CX(38xxxx) values may differ depending on "set_mid_lsb_to_140Eh".
For vC2, CX(Dx) and CX(Ex) should be officially zero-padded to CX(Dx00) and CX(Ex00), but the vC2 BIOS doesn't do that, it still uses short 8bit form.
For vC2, CX(Dx) and CX(Ex) should be apparently zero-padded to CX(Dx0000) and CX(Ex0000), at least, the vC3 BIOS is doing so (except on some test comannds that do still use the CX(Ex) short form).

Used Sense Values

  sense(30)  SEIN.BAL       ;vC2: SSTP
  sense(38)  SEIN.GAIN      ;vC2: AGOK(AGT/AGF) or XAVEBSY(AVRG) or SSTP(else?)
  sense(40)  XBUSY (low=AutoSeqBusy)
  sense(50)  FOK   (high=FokusOkay)
  sense(A0)  GFS   (high=GoodFrameSync, ie. CorrectPlaybackSpeed)
  sense(C5)  COUT  (toggles each 100h 'tracks') (100h=selected via CX(B01000))
  sense(EA)  /OV64 (low=EFM too long?)

CDROM Internal Coefficients (for CXD2545Q)

The CXD2545Q contains Preset Coefficients in internal ROM, which are copied to internal Coefficient RAM shortly after Reset. CX(34xxxx) allows to change those RAM settings, and CX(39xxxx) allows to readout some of those values serially.

CXD2545Q - Coefficient Preset Values

  Addr Val Expl.
  K00  E0  Sled input gain
  K01  81  Sled low boost filter A-H
  K02  23  Sled low boost filter A-L
  K03  7F  Sled low boost filter B-H
  K04  6A  Sled low boost filter B-L
  K05  10  Sled output gain
  K06  14  Focus input gain
  K07  30  Sled auto gain
  K08  7F  Focus high cut filter A
  K09  46  Focus high cut filter B
  K0A  81  Focus low boost filter A-H
  K0B  1C  Focus low boost filter A-L
  K0C  7F  Focus low boost filter B-H
  K0D  58  Focus low boost filter B-L
  K0E  82  Focus phase compensate filter A
  K0F  7F  Focus defect hold gain
  K10  4E  Focus phase compensate filter B
  K11  32  Focus output gain
  K12  20  Anti shock input gain
  K13  30  Focus auto gain
  K14  80  HPTZC / Auto Gain High pass filter A
  K15  77  HPTZC / Auto Gain High pass filter B
  K16  80  Anti shock high pass filter A
  K17  77  HPTZC / Auto Gain low pass filter B
  K18  00  Fix (should not change this preset value)
  K19  F1  Tracking input gain
  K1A  7F  Tracking high cut filter A
  K1B  3B  Tracking high cut filter B
  K1C  81  Tracking low boost filter A-H
  K1D  44  Tracking low boost filter A-L
  K1E  7F  Tracking low boost filter B-H
  K1F  5E  Tracking low boost filter B-L
  K20  82  Tracking phase compensate filter A
  K21  44  Tracking phase compensate filter B
  K22  18  Tracking output gain
  K23  30  Tracking auto gain
  K24  7F  Focus gain down high cut filter A
  K25  46  Focus gain down high cut filter B
  K26  81  Focus gain down low boost filter A-H
  K27  3A  Focus gain down low boost filter A-L
  K28  7F  Focus gain down low boost filter B-H
  K29  66  Focus gain down low boost filter B-L
  K2A  82  Focus gain down phase compensate filter A
  K2B  44  Focus gain down defect hold gain
  K2C  4E  Focus gain down phase compensate filter B
  K2D  1B  Focus gain down output gain
  K2E  00  Not used
  K2F  00  Not used
  K30  80  Fix (should not change this preset value)
  K31  66  Anti shock low pass filter B
  K32  00  Not used
  K33  7F  Anti shock high pass filter B-H
  K34  6E  Anti shock high pass filter B-L
  K35  20  Anti shock filter comparate gain
  K36  7F  Tracking gain up2 high cut filter A
  K37  3B  Tracking gain up2 high cut filter B
  K38  80  Tracking gain up2 low boost filter A-H
  K39  44  Tracking gain up2 low boost filter A-L
  K3A  7F  Tracking gain up2 low boost filter B-H
  K3B  77  Tracking gain up2 low boost filter B-L
  K3C  86  Tracking gain up phase compensate filter A
  K3D  0D  Tracking gain up phase compensate filter B
  K3E  57  Tracking gain up output gain
  K3F  00  Not used
  K40  04  Tracking hold filter input gain
  K41  7F  Tracking hold filter A-H
  K42  7F  Tracking hold filter A-L
  K43  79  Tracking hold filter B-H
  K44  17  Tracking hold filter B-L
  K45  6D  Tracking hold filter output gain
  K46  00  Not used
  K47  00  Not used
  K48  02  Focus hold filter input gain
  K49  7F  Focus hold filter A-H
  K4A  7F  Focus hold filter A-L
  K4B  79  Focus hold filter B-H
  K4C  17  Focus hold filter B-L
  K4D  54  Focus hold filter output gain
  K4E  00  Not used
  K4F  00  Not used