Documenting Sony Memory Stick
UPDATE HISTORY: Mar 19 2022 – added some MSIO info
Disclaimer: most of this data was scrounged from many sources, guessed from disassembly, inferred from strings or documents, or obtained by participating in demonic rituals. It might be slightly wrong, it might be completely wrong, it might kill your cat, and it might break your car. No promises are made that any of the abovementioned consequenced may or may not happen to you or your cat.
Table of Contents
- The field
- The basics
- Talking to Memory Sticks
- Memory Stick Classic
- Memory Stick IO
- Memory Stick Pro
- Code for download
- Comments…
The field
Much has been written about how to talk to SD cards. The spec is somewhat available, and the SPI mode, while optional, is basically always present. Interfacing a microcontroller to an SD card is about as much a non-event as interfacing anything to anything can be. MMC cards are basically the same thing, minus a few command differences that are trivial to account for. Compact Flash is basically IDE, which is basically ISA. Also, it requires more pins than most people care to connect to a microcontroller, so pretty much nobody cares about interfacing to CF. SmartMedia/xD is so dead, that I feel like a necromancer even mentioning it. So what memory card format does this leave? The alive-until-somewhat-recently Memory Stick, of course!
The cards came in a number of varieties, the differences between which were never quite clearly explained, of course. There were the normal blue Memory Sticks in sizes from 4MB to 128MB. There were Pink Aibo Memory Sticks, which were necessary to use Sony’s Aibo robot dogs. These go for hundreds of dollars on eBay nowadays, as there is no more supply. There were white and purple Magic Gate memory sticks in 32 – 128MB sizes. Magic Gate was Sony’s DRM technology, similar in design to SD’s DRM; a similar number of users (zero) seriously cared about this. There was MSIO – a method to attach non-memory devices with a Memory Stick slot, similar to SDIO. There were Memory Stick cameras, GPS devices, Bluetooth radios, and WiFi cards. Then, there was the size-reduced Memory Stick DUO which was half the size and came with an adapter to “full-size” it for devices that needed a full-sized Memory Stick. Then there was also Memory Stick Pro, in sizes from 256MB to 2GB, and of course Pro DUO existed as well. All of those also came in Magic Gate varieties as well as not. Later, there was a Memory Stick PRO HG, which was slightly smaller yet, necessitating more adapters, slightly faster when used with devices that supported it, and supported by literally no devices in existence. This one also supported an 8-bit-wide data transfer mode that I have seen no evidence of in any product. As a final death throe, there was also The Memory Stick Micro (also known as M2) which was about the size of a MicroSD card. Electrically this was a Memory Stick Pro (optionally with Magic Gate, of course) in a smaller size. These came with TWO adapters that nested, if needed, to convert it to a full size Memory Stick or a half-size Memory Stick DUO. Sony announced a few more versions: Memory Stick XC and Memory Stick Pro HG Duo XC. No I am not making this up! Just rolls off the tongue, doesn’t it? Luckily, as far as I can tell, neither of those last two Memory sticks ever materialized. Phew…
Why do we care?
Well, preserving history, for one. But also because reverse engineering things is fun? Plus now you can use memory sticks in your microcontroler projects (if you manage to find a proper adapter). My work focused on Memory Stick storage and I did not spend too much time on MSIO, but there is some info here on that too.
The basics
What we know
From what public information is available, and from simple tear downs of devices that use Memory Sticks, we can gather some basic info: Each card has 10 pins (HG has more, but nobody cares). Two of them are ground, one is used for insertion detection only and is tied to ground in the stick, and one supplies power. This leaves us with 6 pins for data transfer. Some more research indicates that there was a 4-bit-wide mode that used 6 pins and a 1-bit-wide mode that used 3. The pinout is public, actually. Seems sane. What now?
I started the analysis with my old Sony CLIE handhelds. It is a simple, familiar environment, and based on the wiring it was clear that they used the simpler 1-bit mode. It also helps that due to the way PalmOS 4 binaries were built, many of them retain function names in the binary. In addition, despite being a godawful architecture, 68k is easy to reverse engineer since a lot more type info is available than in ARM binaries. Some logic analyzer capturing took place as well. After a few days, I had a working basic interface to a memory stick and some names put to concepts.
Gross…
Ok, so first things first: whoever came up with this physical layer protocol was a sadist. There is no other way around this. A few things make me say this. First of all: when you want to signal that you are busy, or ready, most sane designs use one level for one, one for another. For example, SD cards will keep the data line low while they are busy, and it is high when they are not. Well, not Sony. Oh no! When the card is ready to continue communicating it will transmit bytes 0xAA or 0x55 on the line. Because of course that makes sense! But that is not all! There is a signal called Bus State, that toggles between phases of communication (approximately: command, handshake, data, and ack). Good so far? Here’s a curveball: it toggles one bit BEFORE any given phase is over. So the last bit of any given phase is sent after it has toggled. Why? Probably just to make my life harder. Sony tightly controlled Memory Stick interfaces. The only way to make a host device was to use a Sony chip or a SoC that had Memory Stick support built-in, which was an IP block licenseable from Sony only. This tight control freed them from anyone sane ever looking into their design, giving them a strong shake, and committing them to an insane asylum. But I digress…
Talking to Memory Sticks
The Physical layer
The physical layer of the 1-bit-wide mode is three wires: BS wire to signal bus state, CLK wire for the host to send the card a clock signal (20MHz is every device I’ve inspected, but lower speeds all work perfectly, down to DC), and SDIO for bidirectional data. In 4-bit-wide mode the only change is that SDIO becomes DATA0, and DATA1, DATA2, DATA3 join the fray. Also the clock is now 40MHz. Data is always sent MSB first and all parts of every transaction on the wire are byte-sized.
Data line(s) should be pulled down. As the data line(s) are bidirectional, they need time to switch direction. There is always a bit’s worth of clock time to do that! Clock idles low. Data is latched on the rising edge both by host and by card.
Transactions
The lowest level of communication with Memory Stick is a transaction (Sony calls it a TPC). I do not know what the term means, so i’ll go ahead and guess that it is a Transfer/Protocol/Command. Like I said, PalmOS 4.0 binaries give us function names only. In any case, every TPC has an 8-bit code, the bottom 4 of which are the inverse of the top four. A way to make sure they were transferred correctly, I guess. Unlike SD commands, each and every TPC includes a unidirectional data transfer. The top bit of the TPC determines
