Email or username:

Password:

Forgot your password?
Top-level
Tube❄️Time

moving on to the Teensy interface. i had to choose the IO pins carefully so i can make a 16-bit parallel IO port.

149 comments
Tube❄️Time replied to FozzTexx

@fozztexx it's because DBA-ESDI is also inherently 16-bit. weird, but i must say that 256-word sectors is actually kinda satisfying.

Tube❄️Time replied to Tube❄️Time

got the Teensy interface up and running. i'm using direct IO port access on the Teensy 4.1. take a look at core_pins.h in the Teensy header files. basically you can read from GPIOx_PSR and write to GPIOx_DR.

i also had to add a short delay to create some setup time for the FPGA--the Teensy 4.1 is a hair too fast lol

Tube❄️Time replied to Tube❄️Time

bidirectional registers now work! i can write a command from the PC to the Teensy, and i can write a response from the Teensy and read it from the PC. there are also status flags showing when new data is available. it may not seem like much, but this is huge progress.

Press 'f' for flag register contents.

Press 'a' for ATN register contents.

Press 'i' to write to ISR and trig an interrupt. Enter data for ISR: CC

Flag reg: 2

Flag reg: 0
a screen from DOS DEBUG showing the value 'CC' coming from a register, as well as some flags showing new data available in the register.
Tube❄️Time replied to Tube❄️Time

excellent progress today. I've been able to implement the "Get Diagnostic Status" command. it transfers the command block and handles the returning status block as well as the flags and interrupts. best of all, it works on real hardware using my diagnostic program!

Darryl Ramm replied to Tube❄️Time

Great progress! But help out simpleton me, I've lost track of what you are doing. Is this still part of reverse engineering things to get a SnarkBarker to work on the expansion port?? Or an entirely different project?

Tube❄️Time replied to Darryl

@darryl_ramm it is a solid state replacement HDD that works with the weird IBM DBA-ESDI protocol (similar in concept to IDE)

Darryl Ramm replied to Tube❄️Time

@tubetime Cool, I would love to get a 701 butterfly. Had one for years at work.

Tube❄️Time replied to Tube❄️Time

OK why does pin 1 start halfway down the edge of this chip???

my best guess is that the die is rotated to a 45 degree angle. anyway i want to dump the contents so i can analyze the drive firmware.

M5M27C256AVP in the TSOP package, but pin 1 starts halfway down the left edge of the package instead of the upper left corner.
Alan Martello replied to Tube❄️Time

@tubetime I’ve always wondered about that. I think your intuition is accurate since that would allow a smaller package size from less area outside the die needed to route to the external pads.

Tim replied to Tube❄️Time

@tubetime you gotta do what you gotta do

Oliver Klink replied to Tube❄️Time

@tubetime I once bought the wrong form factor AtMega 8...

Tube❄️Time replied to Tube❄️Time

now i'm knee deep in Ghidra listings. this code probably runs the entire hard drive, not just the host interface.

Keelan replied to Tube❄️Time

@tubetime

Meme image: good news bad news.jpg
Top text: successfully locating the reset vector in a piece of mystery code
Bottom text: realizing that the code starts doing weird stuff when you’re only 5 instructions into the reset vector

I have mainly reverse engineered things with user interfaces, so there’s always strings I can work backwards from. Doing something like a hard drive controller is playing the game on extra hard mode.

Tube❄️Time replied to Tube❄️Time

this sort of reverse engineering is very much like solving a challenging puzzle. you push and push until you can deduce something based on what you already know, then you pivot, taking that new knowledge and pushing on that until you learn even more.

Tube❄️Time replied to Tube❄️Time

so last night I identified the power on self test routines by inspection. it's not too hard to identify a checksum routine or a memory test routine. this helped me fill in the memory map.

also, the POR test function stores the results at a particular memory location, and the codes match up with the POR error codes in the DBA-ESDI spec! the next step is to search the whole ROM for any instructions that read this memory location--this should identify the functions that generate the status block.

Tube❄️Time replied to Tube❄️Time

drive firmware is turning into a bit of a slog so i switched over to the IBM BIOS. having a spec is nice, but the code will cover a bunch of corner cases.

Alan Martello replied to Tube❄️Time

@tubetime Out of curiosity, does the newer IBM BIOS have any similarity to the original IBM PC AT BIOS that they published in the AT Tech Reference from March 1984? Wondering if they ever did a full rewrite at some point. bitsavers.trailing-edge.com/pd

Tube❄️Time replied to Tube❄️Time

managed to reverse engineer enough that I was able to read the defect map out of one of the original hard drives. sounds easy but the process uses DMA.

🇺🇦 haxadecimal replied to Tube❄️Time

@tubetime I've lost count of the things I've done that "sounds easy but the process uses DMA."

Tube❄️Time replied to Tube❄️Time

working through a nasty timing hazard with the mailbox flags on the command port. sometimes you write data and the "data available" flag never gets set.

so now i am digging through the logic that yosys generated to see if it even makes sense.

Tube❄️Time replied to Tube❄️Time

having good test programs is important. here's the status interface register dropping values. the Teensy program is just writing an incrementing number, and the diagnostics program is checking for gaps.

Douglas King replied to Tube❄️Time

@tubetime
If a computer can't count straight, it's not a good sign.

Tube❄️Time replied to Tube❄️Time

got that all sorted out. it was a synchronization issue with the flags between the two interfaces.

this is the "seek" command successfully completing! this is a *major* step since it requires 4 working mailboxes and interrupts.

Tube❄️Time replied to Tube❄️Time

another important step today--i got the data port and data port mailbox flags working. it can also detect 8-bit vs 16-bit transfers. getting very close to working PIO transfers.

Tube❄️Time replied to Tube❄️Time

nice! I managed to get PIO data transfers working well enough for the buffer test routine to pass.

Tube❄️Time replied to Tube❄️Time

ok this is fantastic--I've managed to transfer my first actual sector! it's just using PIO and the data is not from a real filesystem, but this is another big step forward!

Darryl Ramm replied to Tube❄️Time

@tubetime Almost makes you want to lovingly caress it's slightly sticky chemically degraded surface. 😉

Tube❄️Time replied to Tube❄️Time

DMA on Micro Channel is really hard. i'm running a bunch of simulations first, making adjustments to the logic as needed.

so many moving parts.

Briala replied to Tube❄️Time

@tubetime I wonder if IBM expected you to use a special chip that did a lot of that for you.

Tube❄️Time replied to Tube❄️Time

wow, got four bytes to transfer successfully over DMA! not sure why it got stuck after that.

Tube❄️Time replied to Tube❄️Time

just ran the same test again and it transferred the whole sector over DMA!!

so at least read transfers are working partially. writes just hang the machine after transferring half a sector. it's probably time for the logic analyzer.

Tube❄️Time replied to Tube❄️Time

not sure why I always end up in front of a logic analyzer, but here we are.

Tube❄️Time replied to Tube❄️Time

several issues. this first issue, during a host to device write, holds the arbitration bus too long. it should release immediately after the second arb/gnt pulse

Tube❄️Time replied to Tube❄️Time

had a theory and it reproduces in simulation. the transfer request flag isn't getting cleared soon enough. la_dma_selected is what can clear this flag and it is changed on the falling edge of cmd, which is too late to catch the ARB/GNT pulse.

Tube❄️Time replied to Tube❄️Time

yes, that solves the crashing problem. but data isn't getting transferred correctly, so I've got more work to do.

Tube❄️Time replied to Tube❄️Time

weirdly enough, it works the second try!!! something on the host was prematurely turning off DMA. maybe a bug in difdiag.

Jonathan Flusser replied to Tube❄️Time

@tubetime it’s been so long since this experiment started I forget what you’re trying to do!

Netux replied to Tube❄️Time

@tubetime
Ok, I'm a bit confused. You have an fpga you are worthing on, but also a hard drive you are trying to read and another cup you have a white paper for? The drive controller chip?
I looks like you are writing notes for yourself.
I'm guessing you are an EE? Or are you a CE? Us normal CS guys don't ever get to the logic analyzer.

Tube❄️Time replied to Netux

@Netux it's a solid state hard drive replacement that I'm designing. EE but I do some digital stuff too

Katherine the Sixth replied to Tube❄️Time

@tubetime I implemented PS/2 DMA in an emulator good enough to get a Sound Blaster working a while ago and god help us all

Norman Wilson replied to Tube❄️Time

@tubetime It's two! (click) two! (click) two chips in one!

momo replied to Tube❄️Time

@tubetime It's at least so common that the Altium footprint generator has an option for it, although I have never seen it in the wild on any chip sp far.

🇺🇦 haxadecimal replied to Tube❄️Time

@tubetime A lot of early quad SMD packages numbered starting in the middle of the "top" side, and that was purely a (dumb) thing done by package vendors, and dice were always still mounted orthogonally. (or perhaps _almost_ always)

Go Up