Show threadTube🌿TimeJul 27, 2023
I'm at the "blink an LED" stage of bringing it up.
Show threadTube🌿TimeAug 15, 2023
wrote some temporary verilog to validate the bus interface using a single 16-bit register. here goes nothing
Show threadTube🌿TimeAug 15, 2023
oops. logic analyzer time. guess i should have expected it.
Show threadTube🌿TimeAug 15, 2023
ok so i unplugged the board and powered up the computer -- and the error stays. looks like i broke something. 😩
Show threadTube🌿TimeAug 16, 2023
gotta take this step by step. I should have checked this at the start but first I will force the FPGA into the unprogrammed state (-CRESET low) then check each pin to make sure it's in a valid state.
Show threadTube🌿TimeAug 16, 2023
ok when *not* in reset, the FPGA is pulling the DMA line BURST_L low constantly. this is bad, and explains the 00011320 error i saw earlier.
Show threadTube🌿TimeAug 16, 2023
seems that i typo'd the wiring between the top level verilog module and the module that handles the micro channel bus. it's a floating connection and it seems to mostly just sit at a logic 0.
Show threadTube🌿TimeAug 16, 2023
the other problem (01290200) is more concerning and will need a logic analyzer.
Show threadTube🌿TimeAug 16, 2023
yes, i made a dedicated interposer/extender board just to help with the logic analyzer connections. it's called the Fing Longer (a reference to Futurama).
Show threadTube🌿TimeAug 16, 2023
hmm, so during a read operation, the data is never driven onto the bus (the output stays pulled up to FFFF). looks like the MADE24 line is staying low? that's weird. let me try making the logic ignore it.
Show threadTube🌿TimeAug 16, 2023
oh! now the card is putting data onto the bus! the "test1" channel is the data direction for the 74lvc4245 buffers showing that they are transferring data from the card to the host PC.
Show threadTube🌿TimeAug 16, 2023
wow, it actually works, i'm able to write a value to the simple register and read it back. this is a HUGE step forward.
Show threadTube🌿TimeAug 16, 2023

i'll need to figure out what is up with the MADE24 line. could be that the pin doesn't actually do that. the HDD pinout is one that i reverse engineered a while back, so it might be a mistake.

this could also explain the damage to the PC, perhaps the card tried to write to the data bus when it was not supposed to and damaged the output drivers of some other chip.

Show threadTube🌿TimeAug 18, 2023
huh, the "MADE24" line is controlled by bit 7 of register 96. I wonder what that is.
Show threadTube🌿TimeAug 18, 2023
lol, this is the active high CHRESET! i was wondering why that line seemed to be missing.
Show threadTube🌿TimeAug 23, 2023
moving on to the Teensy interface. i had to choose the IO pins carefully so i can make a 16-bit parallel IO port.
Show threadTube🌿TimeAug 23, 2023

got the Teensy interface up and running. i'm using direct IO port access on the Teensy 4.1. take a look at core_pins.h in the Teensy header files. basically you can read from GPIOx_PSR and write to GPIOx_DR.

i also had to add a short delay to create some setup time for the FPGA--the Teensy 4.1 is a hair too fast lol

Show threadTube🌿TimeSep 3, 2023
bidirectional registers now work! i can write a command from the PC to the Teensy, and i can write a response from the Teensy and read it from the PC. there are also status flags showing when new data is available. it may not seem like much, but this is huge progress.
Show threadTube🌿TimeSep 4, 2023
excellent progress today. I've been able to implement the "Get Diagnostic Status" command. it transfers the command block and handles the returning status block as well as the flags and interrupts. best of all, it works on real hardware using my diagnostic program!
Show threadTube🌿TimeSep 4, 2023

OK why does pin 1 start halfway down the edge of this chip???

my best guess is that the die is rotated to a 45 degree angle. anyway i want to dump the contents so i can analyze the drive firmware.

Show threadTube🌿TimeSep 5, 2023
no 28-pin TSOP socket, oh well
Show threadTube🌿TimeSep 5, 2023
now i'm knee deep in Ghidra listings. this code probably runs the entire hard drive, not just the host interface.
Show threadTube🌿TimeSep 6, 2023
this sort of reverse engineering is very much like solving a challenging puzzle. you push and push until you can deduce something based on what you already know, then you pivot, taking that new knowledge and pushing on that until you learn even more.
Show threadTube🌿TimeSep 6, 2023

so last night I identified the power on self test routines by inspection. it's not too hard to identify a checksum routine or a memory test routine. this helped me fill in the memory map.

also, the POR test function stores the results at a particular memory location, and the codes match up with the POR error codes in the DBA-ESDI spec! the next step is to search the whole ROM for any instructions that read this memory location--this should identify the functions that generate the status block.

Show threadTube🌿TimeSep 8, 2023
drive firmware is turning into a bit of a slog so i switched over to the IBM BIOS. having a spec is nice, but the code will cover a bunch of corner cases.
Show threadTube🌿TimeSep 16, 2023
managed to reverse engineer enough that I was able to read the defect map out of one of the original hard drives. sounds easy but the process uses DMA.
Show threadTube🌿TimeSep 23, 2023

working through a nasty timing hazard with the mailbox flags on the command port. sometimes you write data and the "data available" flag never gets set.

so now i am digging through the logic that yosys generated to see if it even makes sense.

Show threadTube🌿TimeSep 24, 2023
having good test programs is important. here's the status interface register dropping values. the Teensy program is just writing an incrementing number, and the diagnostics program is checking for gaps.
Show threadTube🌿TimeSep 26, 2023

got that all sorted out. it was a synchronization issue with the flags between the two interfaces.

this is the "seek" command successfully completing! this is a *major* step since it requires 4 working mailboxes and interrupts.

Show threadTube🌿TimeSep 27, 2023
another important step today--i got the data port and data port mailbox flags working. it can also detect 8-bit vs 16-bit transfers. getting very close to working PIO transfers.
Show threadTube🌿TimeSep 28, 2023
nice! I managed to get PIO data transfers working well enough for the buffer test routine to pass.
Show threadTube🌿TimeSep 28, 2023
ok this is fantastic--I've managed to transfer my first actual sector! it's just using PIO and the data is not from a real filesystem, but this is another big step forward!
Show threadTube🌿TimeSep 29, 2023

DMA on Micro Channel is really hard. i'm running a bunch of simulations first, making adjustments to the logic as needed.

so many moving parts.

Show threadTube🌿TimeSep 30, 2023
wow, got four bytes to transfer successfully over DMA! not sure why it got stuck after that.
Show threadTube🌿TimeSep 30, 2023

just ran the same test again and it transferred the whole sector over DMA!!

so at least read transfers are working partially. writes just hang the machine after transferring half a sector. it's probably time for the logic analyzer.

Show threadTube🌿TimeOct 3, 2023
not sure why I always end up in front of a logic analyzer, but here we are.
Show threadTube🌿TimeOct 3, 2023
several issues. this first issue, during a host to device write, holds the arbitration bus too long. it should release immediately after the second arb/gnt pulse
Show threadTube🌿TimeOct 3, 2023
had a theory and it reproduces in simulation. the transfer request flag isn't getting cleared soon enough. la_dma_selected is what can clear this flag and it is changed on the falling edge of cmd, which is too late to catch the ARB/GNT pulse.
Show threadTube🌿TimeOct 3, 2023
yes, that solves the crashing problem. but data isn't getting transferred correctly, so I've got more work to do.
Show threadTube🌿TimeOct 3, 2023
weirdly enough, it works the second try!!! something on the host was prematurely turning off DMA. maybe a bug in difdiag.
Show threadTube🌿Time
so the interrupt_detected flag is supposed to be set in the irq14 handler, and it is *supposed* to be set only when DMA is done. but somehow interrupt_detected is set without the IRQ handler ever being called! then the DMA operation is broken down prematurely.
Oct 4, 2023 at 2:14amWeb
Show threadTube🌿TimeOct 4, 2023
using the logic analyzer, i proved that the irq14 handler never gets called. the only code that *ever* sets the interrupt_detected flag exists in this handler. it's declared as a volatile so it can't be cached in a register.
Show threadTube🌿TimeOct 4, 2023
I wrote the flag value out to an unused IO port, 0x4F, so I can see it on the logic analyzer. a neat trick!
Show threadTube🌿TimeOct 4, 2023

so i don't know how this flag is getting set. my hack is to preemptively clear the flag right before starting DMA, and so far, it seems to be working.

i think this code was "working" with the real ESDI drive because that one uses burst mode DMA and it finishes up very quickly, before the irq14wait routine can exit early.

Show threadTube🌿TimeOct 4, 2023
decided to look at the real drive. and guess what--it's not using burst mode. the POS registers have it turned off by default. it's also slow to read the data from the spinning disk, so IBM must have figured that it wasn't really necessary.
Show threadTube🌿TimeOct 5, 2023
now I'm reading up on accessing SD cards from the Teensy 4.1. looks like SdFat is the library? could it be so easy?
Show threadTube🌿TimeOct 7, 2023
turns out it's easy but I had to reformat the SD card using the official sdcard.org utility. anyway, I've read the first sector from a real disk image!
Show threadTube🌿TimeOct 7, 2023
the drive now gives the POS ID. let's try to boot!
Show threadTube🌿TimeOct 7, 2023
hmm 01048200 is a drive select acknowledgement error.
Show threadTube🌿TimeOct 7, 2023

the BIOS runs faster than the DIFDIAG utility, and so it seems like it is hitting a timing problem that i didn't hit before.

my drive code seems to randomly hang up and not respond correctly.

Show threadTube🌿TimeOct 7, 2023

it's occasionally getting a spurious end-of-interrupt command which is really odd and points to an issue with the mailboxes (again, sigh).

but it's SO DARN CLOSE. it's transferring sectors from the IML region in the disk image.

Show threadTube🌿TimeOct 8, 2023
figured out one problem. the disk boot routines slam the drive with an ATN and the first command word in 5.5us. the Teensy code takes too long to see the ATN and clears the command register full flag, which drops the first word. oops.
Show threadTube🌿TimeOct 8, 2023
so it *almost* boots now. in fact it successfully loads the IML sectors from the hidden partition on the drive, and no longer throws an I999... error code!
Show threadTube🌿TimeOct 8, 2023

my drive doesn't implement this weird feature called pseudo RBAs--it's a way to artificially limit the maximum possible block address, presumably so they can hide the partition data.

i suspect the BIOS checks this, so i'll have to implement it. ugh. that means i need to figure out this incomprehensible diagram.

Show threadTube🌿TimeOct 8, 2023
holy crap it's booting I can't believe it sdfadfsdfsdfsffasdf
Show threadTube🌿TimeOct 8, 2023
well, it's working well enough to run qbasic. right now the drive is read-only.
Show threadTube🌿TimeOct 14, 2023
i think i need to dig into the 01290200 cache error that has been coming up. i'm concerned that an issue with my DBA-ESDI card has caused it, but i'm not sure.
Show threadTube🌿TimeOct 14, 2023
looks like the cache is inside the CPU. i can't find any cache chips on the motherboard.
Show threadTube🌿TimeOct 14, 2023
see? no cache or memory chips. the larger devices are probably semicustom gate array parts that IBM was fond of using. doubt they contain any cache memory.
Show threadTube🌿TimeOct 14, 2023
looks like the error is generated by an NMI that gets tripped when the cache is being set up. could be a number of causes but in general it is an issue with the internal CPU cache.
Show threadTube🌿TimeOct 14, 2023
could also be this test of the DMA controller which is also included in the same set of tests and triggers the same error code, for some reason.
Show threadFritz AdalisOct 14, 2023
@tubetime
@kenshirriff just posted about these CPUs. They have most of the support circuitry in the cpu itself.
Show threadbitsavers.orgOct 14, 2023

@FritzAdalis @tubetime @kenshirriff

I just did some digging around and I've not been able to find any good on-line documentation for the 486SL series. it had a separate data book ISBN 9781555121921 and there are ancient pointers to a pdf on intel's long dead ftp site to it
https://web.archive.org/web/20180512055622/http://www.rcollins.org/intel.doc/486Manuals.html

Show threadBrian SwetlandOct 14, 2023
@tubetime Inconvenient!
Show threadMarsh RayOct 9, 2023

@tubetime “It’s working well enough to run QBASIC”

Love it 😂

Show threadIan HanschenOct 9, 2023
@tubetime this is incredibly rad
Show threadbitsavers.orgOct 8, 2023
@tubetime
woot!
Show threadSamantaz FoxOct 9, 2023
@tubetime Woohoo! Congrats!
Show threadbitsavers.orgOct 8, 2023

@tubetime

it doesn't look too bad, you just have the choice to save it back to the config area or not with set max-rba (which it probably never does out of the factory). did you clone a disk with the config area?

Show threadTube🌿TimeOct 8, 2023
@bitsavers there's no easy way to image that. it'd require reverse engineering the drive firmware.
Show threadVlad VukicevicOct 14, 2023
@tubetime "No command can not access" so.. uh.. commands can access? 🤯
Show threadTube🌿TimeOct 14, 2023
@vvuk the document is full of typos and errors.
Show threadVlad VukicevicOct 15, 2023

@tubetime Your project is an ESDI drive emulator, right? (specific drive type, but ESDI interface) Would it work in another computer that had an ESDI controller and understood the IBM drive?

(I assume so, but then you mentioned microchannel which confused me -- I'm assuming the "creaky old IBM laptop" interface is ESDI?)

Show threadVlad VukicevicOct 15, 2023
@tubetime just saw your comments about this being DBA-ESDI. Time to read about the difference...
Show threadVlad VukicevicOct 15, 2023
@tubetime Oh. https://x.com/foone/status/1369553555313418241?s=46&t=I51G_PgUJMKTHP86YlGk5g
foone🏳️‍⚧️ on X

so IBM invented ESDI DBA: Direct Bus Attachment. It's ESDI-like but it's actually MICROCHANNEL IN THE HARD DRIVE!

X (formerly Twitter)
Show threadAlan MartelloOct 9, 2023
@tubetime Your recent posts make me believe you’re a time traveller - perhaps the great-great-grandson of an IBM engineer who as a child found an old notebook complaining about this problem your grandpa just couldn’t solve and that he was fired for and altered the arc of his life. You studied your whole life as an engineer for this moment to come back to today when the hardware was still available, fix the problem, then go back and help your grandpa. Let us know how it turns out.
Show threadTube🌿TimeOct 9, 2023
@amart not too far off! my grandfather worked there. i once reverse engineered a prototype floppy drive he worked on, and got it working again. https://twitter.com/TubeTimeUS/status/1617703291483467776
Tube Time on X

i've got this weird old IBM prototype 4" floppy disk drive from the late 1970s, and i've decided to reverse engineer it. 🧵 https://t.co/2SWacwTAeC

X (formerly Twitter)
Show threadDaniel Schwarz Oct 8, 2023
@tubetime What’s the end goal here, boot the laptop using a SD card that’s emulating a Micro Channel hard drive interface, via Teensy?
Show threadTube🌿TimeOct 8, 2023
@dschwarz yup!
Show threadDaniel Schwarz Oct 8, 2023

@tubetime I know it’s not the point of your project, but didn’t this laptop have PCMCIA? Would one of these work as a boot drive?

Digigear SD SDHC SDXC to PCMCIA PC Card, Adapter Supports, ATA Flash Memory https://a.co/d/agF7LO9

Amazon.com

Show threadTube🌿TimeOct 8, 2023
@dschwarz nope, the memory card slot is pre-PCMCIA
Show threadChris HammondOct 5, 2023
@tubetime I've used that library before, yes it really is easy. You probably won't set any throughput records, but it was great for writing diagnostic logs that were later read back and uploaded.
Show threadPaula MaddoxOct 6, 2023
@tubetime Yes, it really is that easy :)
Show threadBrian Danger HicksOct 4, 2023
@tubetime When you find yourself asking, "How did this ever work?" and it turns out the answer is "It didn't."
Show threadSteve SyfuhsOct 4, 2023
@tubetime how does that even work? After the first iteration isn't the refresh bit always set, so it's stuck in an infinite loop if it never IRQs?
Show threadTube🌿TimeOct 4, 2023
@SteveSyfuhs oh sorry REFRESH_BIT is a macro that grabs an IO port bit that toggles with the DRAM refresh signal every 15us.
Show threadSteve SyfuhsOct 4, 2023
@tubetime ahhhh that makes way more sense now