CXD2678 and CXD2680 - MiniDisc-wiki/md-firmware GitHub Wiki
The CXD2678 and CXD2680 SoCs are the last generations of Non-HiMD NetMD capable SoCs for portable MD recorders. They are the successor to the Type-R CXD2677. The CXD2678 was only used in the MZ-N10 and was replaced by the CXD2680.
The main difference (that we know of) between both SoCs is that the CXD2678 has 8MiB of DRAM and the CXD2680 only 2MiB.
Specs
| CPU core | ARMv4t, probably ARM7TDMI* based on Sony's SR11 cores |
| Flash size | 640KiB |
| SRAM size | 36KiB |
| DRAM size | 2MiB (CXD2680), 8MiB (CXD2678) |
| NetMD | Yes |
| Codec version | Type-S |
* The CPU does not have the typical co-processor interface for processor identification with MIDR, ruling out other cores
Memory Map
| Start | End | Description |
|---|---|---|
| 0x00000000 | 0x0009FFFF | Flash |
| 0x02000000 | 0x02008FFF | SRAM |
| 0x03000000 | 0x0300FFFF | Peripherals A |
| 0x0301FF00 | 0x0301FFFF | Peripherals ? |
| 0x03800000 | 0x0380FFFF | Peripherals B |
| 0x03F00000 | 0x04000000 | Unknown, device freezes on access |
Block Diagram
Based on random resources, educated guesses, and firmware (and probably not fully correct): https://raw.githubusercontent.com/Sir68k/md-firmware/main/wiki/cxd2680.svg
Peripheral Map
0x03000000 - 0x0300FFFF
| Start | End | Description | Notes |
|---|---|---|---|
| 03000000 | 030000FF | General/interrupts | |
| 03000200 | 030002FF | General/interrupts | IRQ/FIQ status registers here, containing reason for interrupt |
| 03001000 | 030013FF | GPIO | |
| 03002000 | 030020FF | GPIO w A/D converter | |
| 03003000 | 030030FF | SPI0 control | |
| 03003100 | 030031FF | SPI0 buffer | |
| 03003200 | 030032FF | SPI1 control | |
| 03003300 | 030033FF | SPI1 buffer | |
| 03003400 | 030034FF | SPI2 control | |
| 03003500 | 030035FF | SPI2 buffer | SPI2 is used for communication with integrated MD/DSP controller. XLAT (see 0x0300b000), is used for flushing the buffer and executing DSP commands. It seem that the buffer can also be flushed with other signals, maybe for other stuff? For example, during init a lot of data is sent, but it's not flushed with XLAT, but with another signal. |
| 03003600 | 030036FF | SPI3 control | |
| 03003700 | 030037FF | SPI3 buffer | |
| 03003800 | 030038FF | SPI control | Probably used for setting the general SPI config, such as clock |
| 03004000 | 030040FF | SSB0 | Link to RF AMP |
| 03004100 | 030041FF | SSB1/TSB1 | REMOTE interface (part A)? |
| 03004200 | 030042FF | SSB2/TSB2 | REMOTE interface (part B, maybe for sync recoding stuff)? |
| 03005000 | 030050FF | TIMER A | Used for IRQ? |
| 03005100 | 030051FF | TIMER B | Used for FIQ? |
| 03005200 | 030052FF | TIMER C | Used for processing SPI/REMOTE/..., e.g. regular updates |
| 03005300 | 030053FF | TIMER D | Used for other general system stuff |
| 03005400 | 030054FF | TIMER E | |
| 03005500 | 030055FF | TIMER F | |
| 03005600 | 030056FF | TIMER G | |
| 03005700 | 030057FF | TIMER H | |
| 03005800 | 030058FF | TIMER I | |
| 03007000 | 030074FF | GPIO PWM control | Maybe with D/A converter? |
| 03007800 | 030078FF | ? | Unknown, not used |
| 03008000 | 030080FF | ? | Unknown, not used |
| 03009000 | 030090FF | ? | Unknown, not used |
| 0300A300 | 0300A3FF | ? | Unknown, possibly related to ATRAC DSP signalling |
| 0300B000 | 0300B0FF | ATRAC DSP irq signalling | linked to mon/xlat |
| 0300B100 | 0300B1FF | DRAM transfer address registers | possible general registers that can be used for other things as well? |
| 0300B200 | 0300B3FF | ? | Unknown, not used |
0x0301FF00 - 0x0301FFFF
| Start | End | Description | Notes |
|---|---|---|---|
| 0301FF00 | 0301FFFF | ? | Unknown, not used |
0x03800000 - 0x0380FFFF
| Start | End | Description | Notes |
|---|---|---|---|
| 03801000 | 03801013 | ? | Unknown, configured only a couple of times, to fixed values |
| 03802000 | 038020FF | Patch controller | Used to apply virtual patches to the flash memory |
| 03803000 | 038030FF | DMA controller | |
| 03804000 | 038040FF | ? | Unknown, related to DMA transfer |
| 03805000 | 038050FF | ? | Unknown, unused |
| 03806000 | 03806FFF | ? | Unknown, unused, dump shows that a block of 0x100 bytes is repeated 16 times |
| 03807000 | 038070FF | FCU | Flow control unit, controls transfers between buffers and md unit/dram |
| 03808000 | 03808FFF | Data transfer buffer A | Used for putting padding on LP2 data |
| 03809000 | 03809FFF | Data transfer buffer B | Used for putting padding on LP2 data |
| 0380A000 | 0380A0FF | FCU / PCM buffer control | |
| 0380B000 | 0380B0FF | PCM buffer input | |
| 0380B100 | 0380B1FF | PCM buffer | First 32 words is PCM encoding buffer, inputted via 0x0380B000 |
| 0380C000 | 0380C02F | USB controller | General + control transfers |
| 0380C100 | 0380C1FF | USB Bulk MD -> PC | Not used (only by homebrew) |
| 0380C200 | 0380C2FF | USB Bulk PC -> MD | |
| 0380C300 | 0380C3FF | USB Interrupt transfers? | Not used |
| 0380D000 | 0380D0FF | DES encryption | DMA transfers can use DES unit to immediately encrypt transfers |
| 0380E000 | 0380E0FF | Monitor interrupts? Something with FOK |