Email or username:

Password:

Forgot your password?
Top-level
Tube❄️Time

ok so i unplugged the board and powered up the computer -- and the error stays. looks like i broke something. 😩

174 comments
Tube❄️Time

gotta take this step by step. I should have checked this at the start but first I will force the FPGA into the unprogrammed state (-CRESET low) then check each pin to make sure it's in a valid state.

Tube❄️Time

ok when *not* in reset, the FPGA is pulling the DMA line BURST_L low constantly. this is bad, and explains the 00011320 error i saw earlier.

Tube❄️Time

seems that i typo'd the wiring between the top level verilog module and the module that handles the micro channel bus. it's a floating connection and it seems to mostly just sit at a logic 0.

Tube❄️Time

the other problem (01290200) is more concerning and will need a logic analyzer.

Tube❄️Time

yes, i made a dedicated interposer/extender board just to help with the logic analyzer connections. it's called the Fing Longer (a reference to Futurama).

NRoach44

@tubetime may I suggest either some of these adaptors, or replicating / building them in next time

I hate having 30+ of those fiddly clips, so I grabbed some

Tube❄️Time replied to NRoach44

@nroach44 i have some and tried them but the flex cable part is too stiff and was making it hard to type

NRoach44 replied to Tube❄️Time

@tubetime ah that's fair. I'm thinking when I get around to needing them I'll include them in the debug board so you just connect the 40pin cables straight on

Tube❄️Time

hmm, so during a read operation, the data is never driven onto the bus (the output stays pulled up to FFFF). looks like the MADE24 line is staying low? that's weird. let me try making the logic ignore it.

MADE 24: Memory Address Enable 24: This line indicates when an
extended address is used on the bus. If a memory cycle is in
progress and MADE 24 is inactive, an extended address greater than
16MB is being presented; if MADE 24 is active, an unextended address
less than or equal to 16MB is being presented. This line is driven by
the controlling master and decoded by all memory slaves, regardless
of their address space size. MADE 24 is driven with a tri-state driver.
William D. Jones replied to Tube❄️Time

@tubetime Looks like the bus has MADE you a problem to solve :D.

...

...

...

I'll see myself out...

Tube❄️Time replied to Tube❄️Time

oh! now the card is putting data onto the bus! the "test1" channel is the data direction for the 74lvc4245 buffers showing that they are transferring data from the card to the host PC.

Tube❄️Time replied to Tube❄️Time

wow, it actually works, i'm able to write a value to the simple register and read it back. this is a HUGE step forward.

Tube❄️Time replied to Tube❄️Time

i'll need to figure out what is up with the MADE24 line. could be that the pin doesn't actually do that. the HDD pinout is one that i reverse engineered a while back, so it might be a mistake.

this could also explain the damage to the PC, perhaps the card tried to write to the data bus when it was not supposed to and damaged the output drivers of some other chip.

Tube❄️Time replied to Tube❄️Time

huh, the "MADE24" line is controlled by bit 7 of register 96. I wonder what that is.

Tube❄️Time replied to Tube❄️Time

lol, this is the active high CHRESET! i was wondering why that line seemed to be missing.

Tube❄️Time replied to Tube❄️Time

moving on to the Teensy interface. i had to choose the IO pins carefully so i can make a 16-bit parallel IO port.

Tube❄️Time replied to FozzTexx

@fozztexx it's because DBA-ESDI is also inherently 16-bit. weird, but i must say that 256-word sectors is actually kinda satisfying.

Tube❄️Time replied to Tube❄️Time

got the Teensy interface up and running. i'm using direct IO port access on the Teensy 4.1. take a look at core_pins.h in the Teensy header files. basically you can read from GPIOx_PSR and write to GPIOx_DR.

i also had to add a short delay to create some setup time for the FPGA--the Teensy 4.1 is a hair too fast lol

Tube❄️Time replied to Tube❄️Time

bidirectional registers now work! i can write a command from the PC to the Teensy, and i can write a response from the Teensy and read it from the PC. there are also status flags showing when new data is available. it may not seem like much, but this is huge progress.

Press 'f' for flag register contents.

Press 'a' for ATN register contents.

Press 'i' to write to ISR and trig an interrupt. Enter data for ISR: CC

Flag reg: 2

Flag reg: 0
a screen from DOS DEBUG showing the value 'CC' coming from a register, as well as some flags showing new data available in the register.
Tube❄️Time replied to Tube❄️Time

excellent progress today. I've been able to implement the "Get Diagnostic Status" command. it transfers the command block and handles the returning status block as well as the flags and interrupts. best of all, it works on real hardware using my diagnostic program!

Darryl Ramm replied to Tube❄️Time

Great progress! But help out simpleton me, I've lost track of what you are doing. Is this still part of reverse engineering things to get a SnarkBarker to work on the expansion port?? Or an entirely different project?

Tube❄️Time replied to Darryl

@darryl_ramm it is a solid state replacement HDD that works with the weird IBM DBA-ESDI protocol (similar in concept to IDE)

Darryl Ramm replied to Tube❄️Time

@tubetime Cool, I would love to get a 701 butterfly. Had one for years at work.

Tube❄️Time replied to Tube❄️Time

OK why does pin 1 start halfway down the edge of this chip???

my best guess is that the die is rotated to a 45 degree angle. anyway i want to dump the contents so i can analyze the drive firmware.

M5M27C256AVP in the TSOP package, but pin 1 starts halfway down the left edge of the package instead of the upper left corner.
Alan Martello replied to Tube❄️Time

@tubetime I’ve always wondered about that. I think your intuition is accurate since that would allow a smaller package size from less area outside the die needed to route to the external pads.

Tim replied to Tube❄️Time

@tubetime you gotta do what you gotta do

Oliver Klink replied to Tube❄️Time

@tubetime I once bought the wrong form factor AtMega 8...

Tube❄️Time replied to Tube❄️Time

now i'm knee deep in Ghidra listings. this code probably runs the entire hard drive, not just the host interface.

Keelan replied to Tube❄️Time

@tubetime

Meme image: good news bad news.jpg
Top text: successfully locating the reset vector in a piece of mystery code
Bottom text: realizing that the code starts doing weird stuff when you’re only 5 instructions into the reset vector

I have mainly reverse engineered things with user interfaces, so there’s always strings I can work backwards from. Doing something like a hard drive controller is playing the game on extra hard mode.

Tube❄️Time replied to Tube❄️Time

this sort of reverse engineering is very much like solving a challenging puzzle. you push and push until you can deduce something based on what you already know, then you pivot, taking that new knowledge and pushing on that until you learn even more.

Tube❄️Time replied to Tube❄️Time

so last night I identified the power on self test routines by inspection. it's not too hard to identify a checksum routine or a memory test routine. this helped me fill in the memory map.

also, the POR test function stores the results at a particular memory location, and the codes match up with the POR error codes in the DBA-ESDI spec! the next step is to search the whole ROM for any instructions that read this memory location--this should identify the functions that generate the status block.

Tube❄️Time replied to Tube❄️Time

drive firmware is turning into a bit of a slog so i switched over to the IBM BIOS. having a spec is nice, but the code will cover a bunch of corner cases.

Alan Martello replied to Tube❄️Time

@tubetime Out of curiosity, does the newer IBM BIOS have any similarity to the original IBM PC AT BIOS that they published in the AT Tech Reference from March 1984? Wondering if they ever did a full rewrite at some point. bitsavers.trailing-edge.com/pd

Norman Wilson replied to Tube❄️Time

@tubetime It's two! (click) two! (click) two chips in one!

momo replied to Tube❄️Time

@tubetime It's at least so common that the Altium footprint generator has an option for it, although I have never seen it in the wild on any chip sp far.

🇺🇦 haxadecimal replied to Tube❄️Time

@tubetime A lot of early quad SMD packages numbered starting in the middle of the "top" side, and that was purely a (dumb) thing done by package vendors, and dice were always still mounted orthogonally. (or perhaps _almost_ always)

Norman Wilson replied to Tube❄️Time

@tubetime Isn't MADE24 supposed to stay low for another four and a half months?

http :verified: replied to Tube❄️Time

@tubetime Is that photo from an Agilent scope screen? If yes, which scope are you using?

Tube❄️Time replied to http

@http this is a logic analyzer, the Agilent/Keysight 16822.

http :verified: replied to Tube❄️Time

@tubetime Ah, a dedicated 68 channel 350MHz state logic analyser. "state data rates up to 1.4 Gb/s". Looks cool expensive. Can't even find a price online. My Saleae is far away from that.

ShutterBugged replied to Tube❄️Time

@tubetime how did you get past it, if the computer's hardware is now borked?

JeffG replied to Tube❄️Time

@tubetime And now I learned there's a 168xx series of LA.

James against the machine

@tubetime ooooh I want to make an SE/30 finglonger... hmmmmmm!

Go Up