Now Reading
Downtown Doug Brown » Extra enjoyable with Apple’s inner instruments: making a PDS card

Downtown Doug Brown » Extra enjoyable with Apple’s inner instruments: making a PDS card

2023-12-30 15:56:11

In my last post, I found out learn how to use Apple’s leaked Flasher utility from the Nineties to reflash a ROM SIMM inside my Performa 630. It’s mainly the Mac equal of a BIOS replace, however just for Apple’s builders. The analysis concerned in that submit was fairly a journey of reverse engineering from each a software program and {hardware} perspective. I needed to disassemble the code to determine which computer systems have been appropriate and what the software program was anticipating to search out. I additionally needed to create a duplicate of an Apple improvement ROM SIMM that was wired precisely the best way Macs of the period anticipated it. Though I used to be very enthusiastic about my discoveries, one large query remained:

What was the aim of the underside proper half of the principle window labeled “PDS ROM Information”? And what would it not take to allow it?

PDS stands for Processor Direct Slot. It’s an enlargement slot that gives a lot of the CPU’s indicators and can be utilized for including issues like Ethernet, a video card, or an accelerator. For those who take a look at the comments on my last post, you will note some dialogue concerning the PDS playing cards utilized by the Flasher app (thanks Al!). It seems like they have been used to flash programmable ROM SIMMs/DIMMs, and there have been a number of generations of playing cards. That is sensible, as a result of the checklist of appropriate fashions covers a wide range of methods with completely different PDS slots. A few of the Quadra machines just like the 700, 900, 650, and 800 have a 140-pin 68040 PDS slot. The LC 475, 575, 580, and 630 have the 96-pin LC PDS slot that got here from the unique Mac LC, with an additional set of 18 pins that may optionally be utilized by fancier playing cards. The 610 has a card slot that takes an adapter board to offer you both a NuBus slot or 140-pin PDS slot.

Though I nonetheless don’t know what Apple’s unique PDS playing cards utilized by builders regarded like, I actually needed to rig one thing as much as get the PDS portion of this software program working. So I went to work disassembling the Flasher utility and researching traditional Mac {hardware} and Motorola MC680x0 processors.

Once I was first disassembling Flasher, I seen an enormous desk of appropriate flash ROMs. A big portion of the entries have been marked as PDS, which I wasn’t serious about on the time, so I had principally ignored them. I spent a little bit extra time investigating them this time round. The entire PDS entries use learn and write addresses within the 0xExxxxxxx vary, which corresponds with “slot E”. That makes whole sense as a result of that’s the place Quadra PDS playing cards are anticipated to be mapped in reminiscence. Wanting by way of the entries, I discovered that the Lobos SIMM I replicated can also be supported on the PDS aspect. The bottom learn deal with is 0xE0000000, whereas writes use 0xEC000000. Apart from that, the desk entry appears to be just about the identical because the entry used for an onboard SIMM of the identical sort. There are additionally a bunch of different desk entries with extra choices that might require additional reverse engineering to totally perceive. Let’s give attention to simply this one desk entry.

I started to suppose: what would it not take to create a PDS card with a 64-pin ROM SIMM socket so I might program my duplicate Lobos board by way of the PDS slot? All it could must do is map the flash into reminiscence at 0xE0000000 for reads and 0xEC000000 for writes. That doesn’t appear too sophisticated, proper? I made a decision to leap in and determine it out.

I began by deciding which Mac I might use for this experiment. I opted for my LC 475.

It has an LC PDS slot, which makes use of a available 96-pin Eurocard connector and as an additional benefit is the only of all of them.

Though the Quadras have 68040s, this slot just about pretends to be a 15.6672 MHz 68020 in order that playing cards designed for the unique Mac LC will nonetheless work. Easy is nice! Additionally, the case is very easy to open up. My Performa 630 can be a poor alternative for this experiment as a result of you need to shove the logic board into the case with a purpose to begin it up.

I checked out sections 3 and 5 of the MC68020 user manual to get an thought of what sort of logic would must be carried out by my PDS card. It was intimidating at first, however after spending a while desirous about it, I got here to the conclusion that it actually isn’t too sophisticated. Handle strobe (/AS) goes low to point {that a} legitimate deal with is on the deal with bus. Information strobe (/DS) additionally goes low, both on the similar time or shortly afterward relying on whether or not it’s a learn or write cycle. The RW sign tells me whether or not it’s a learn or a write.

That’s just about it in a nutshell! My PDS card’s job is to detect when an deal with I care about is being accessed, do the learn or write requested, after which briefly drive /DSACK0 and /DSACK1 low to inform the CPU that I accomplished the operation and it was a 32-bit switch. Clearly, the cardboard has to do that in a method that follows all timing necessities as acknowledged by the datasheet.

Programmable logic looks like right answer for this versus a microcontroller. Both that or a bunch of logic gate ICs. I messed around on EDA Playground (a extremely cool web site, by the best way) to see what learn and write cycles would seem like and determine on a technique to deal with them. I made a Verilog testbench that performs a couple of learn and write cycles based mostly on the spec within the 68020 handbook. Right here’s an instance of a learn cycle to 0xE000000 assuming no wait states are wanted:

The learn cycle begins with the rising fringe of the clock. It places the deal with onto the deal with bus and in addition signifies whether or not it’s a learn or write. On the subsequent falling edge, it asserts /AS and /DS. That is the sign to my PDS card to really do one thing. On the closing falling edge, it saves the info that has been introduced on the info bus and deasserts /AS and /DS. Writes are related, however /DS is asserted a cycle later as a substitute.

I discovered that for each reads and writes, the best method can be to say /DSACK0 and /DSACK1 instantly as quickly as /AS went low. Then I might deassert it when /AS went excessive once more. I didn’t even want to have a look at /DS. I might use this very same logic to say the output allow (/OE) or write allow (/WE) sign on the flash chips too. Right here’s what that might seem like for a learn cycle:

A write cycle would look very related. The CPU will present information to put in writing on D[31:0] and can assert /DS barely later than throughout learn cycles. I might simply must pulse the /WE pin of the flash chips as a substitute of /OE.

This association offers loads of time for the flash chips to do their factor. The /OE or /WE pulse width is about 127 nanoseconds, which is lots. There’s additionally loads of setup and maintain time on each the falling and rising fringe of the /WE pulse for write cycles. The very nice factor about this design is it’s purely combinational logic. The rule is solely: each time the deal with matches and /AS is asserted, assert /DSACK and both /OE or /WE, relying on the RW sign.

Figuring out if the deal with matches ended up being an attention-grabbing rabbit gap. Realizing that PDS playing cards are mapped to fit E, you may suppose that you must guarantee that A[31:28] == 0xE or one thing like that. However no, the LC PDS slot is bizarre. The 96-pin portion of the connector widespread with earlier LC sequence Macs doesn’t even have A30 by way of A28 populated. It solely has A31. Additionally, there’s a complete different 24-bit addressing mode to consider. Apple particulars this within the LC 475 developer note, with a pattern circuit for producing a card choose sign:

Taking a look at FC0 by way of FC2 is essential so to differentiate between regular learn cycles versus particular CPU area cycles corresponding to interrupt acknowledge cycles. FC3 tells you whether or not 24-bit addressing is enabled. In 24-bit mode, PDS accesses are acknowledged by A[23:20] equaling 0xE. In 32-bit mode, you simply should verify if A31 is excessive. This all appeared a bit on the sophisticated aspect to me, however I used to be fairly positive I might ignore supporting 24-bit mode as a result of I already knew that the Flasher utility places the system into 32-bit mode behind the scenes when doing operations. In any case, the desk entry has a learn deal with of 0xE0000000, which isn’t a legitimate deal with with 24-bit addressing.

It was round this time that I began taking a look at an LC PDS card that I’ve available: an Apple Ethernet LC Twisted-Pair card. I assumed it could be a very good alternative to double verify my work and see if my method was sane, particularly because it doesn’t have any particular ASICs aside from an Ethernet chipset.

This card has a PROM chip of some type (U1) that’s clearly used as a declaration ROM for figuring out itself to the system. Which means that the cardboard goes to have some glue logic for hooking up this PROM chip to the deal with and information buses, which is precisely what I wanted to perform too. U2 appears to be some form of PLD (a PAL16V8/GAL16V8 I believe) which is certainly in command of /DSACK1 and the flash /OE pin, in addition to different stuff like a chip choose for the Ethernet chip. It’s taking a look at a handful of deal with traces, /AS, /FC3, and another stuff that wasn’t instantly apparent.

One puzzling factor I discovered was that FC0-2 didn’t go anyplace on this card. I assumed Apple stated you wanted to make use of them to ensure you didn’t by accident deal with interrupt acknowledge cycles as learn cycles? Effectively…it seems that there are different methods for detecting them that don’t require taking a look at FC0-2. I asked about it on 68kmla. ymk gave me some nice recommendation: for those who don’t want the total PDS deal with area, you may detect interrupt acknowledge cycles by taking a look at among the deal with bits as a substitute. Interrupt acknowledge cycles are assured to have a lot of the deal with bits set to 1. This seems to be the method Apple used on their Ethernet card. I experimentally decided that if A24 is excessive, the cardboard doesn’t reply. I believe it’s taking a look at this slightly than FC0-2. It’s lots less complicated to implement for those who don’t want the total deal with area. I made a decision to make use of Apple’s technique on my card too.

Now I used to be prepared to really take into consideration making this PDS card. I had an thought of what logic wanted to be carried out, and I additionally was fairly assured about wiring. Simply hook up the entire information and deal with traces from the ROM SIMM socket on to the PDS slot, after which use a programmable logic gadget of some type to deal with bus management and flash write/learn cycle management.

I had an honest thought of what the Verilog would seem like for my glue logic. One thing like this:

module flashcontroller(a31, a27, a24, rw, as_n, flash_oe_n, flash_we_n, dsack_n);
  enter a31;
  enter a27;
  enter a24;
  enter rw;
  enter as_n;
  output flash_oe_n;
  output flash_we_n;
  output [1:0] dsack_n;
  
  wire pds_select = a31 & ~a24;
  
  assign flash_oe_n = ~(pds_select & rw & ~as_n);
  assign flash_we_n = ~(pds_select & ~rw & ~as_n & a27);
  assign dsack_n = pds_select & ~as_n ? 2'b00 : 2'bzz;
endmodule

A be aware on this: I’m taking a look at A27 as a result of write cycles within the software program are addressed to 0xECxxxxxx. I figured it could make sense to limit legitimate write cycles the identical method. I simply silently ignore write cycles that don’t have A27 excessive. I might have additionally checked out A26, however I assumed A27 by itself was ample.

I wasn’t positive precisely what sort of programmable logic gadget to make use of for this. I in all probability might have discovered a flowery 5V CPLD, however I opted for one thing fairly easy that could possibly be present in DIP kind issue to make for simple prototyping. Microchip’s ATF22V10C appeared like an ideal candidate.

I rapidly realized that Verilog can be ineffective for this specific job. Easy PLDs appear to be extra usually programmed utilizing an previous language known as CUPL. It wasn’t too loopy to study. Microchip provides WinCUPL as a free download. It’s fairly previous and buggy, however it will get the job performed even in Home windows 10. There are additionally open supply alternate options corresponding to galette.

Right here’s my equal logic in CUPL appropriate for programming into the 22V10:

PIN 2 = A31;
PIN 3 = A27;
PIN 4 = A24;
PIN 5 = RW;
PIN 6 = !AS;

PIN 14 = !FLASH_OE;
PIN 15 = !FLASH_WE;
PIN 16 = !DSACK0;
PIN 17 = !DSACK1;

PDS_SELECT = A31 & !A24;

FLASH_OE = PDS_SELECT & RW & AS;
FLASH_WE = PDS_SELECT & !RW & AS & A27;
DSACK0 = 'b'1;
DSACK1 = 'b'1;
DSACK0.oe = PDS_SELECT & AS;
DSACK1.oe = PDS_SELECT & AS;

It’s actually not that loopy. Simply barely completely different syntax and also you deal with active-low logic within the pin definitions, which form of makes the equations extra intuitive. I might see arguments going each methods on whether or not that’s a very good or a nasty factor.

Anyway, WinCUPL additionally got here with a simulator so I might create a bunch of pattern enter vectors to check and ensure it labored as anticipated in a wide range of eventualities. I additionally ultimately put it onto a breadboard for testing with some LEDs. I had a short second of panic once I thought the output permits for DSACK weren’t working accurately, however it seems I used to be simply being dumb and by accident altering RW once I thought I used to be altering /AS.

With my logic examined, it was time to throw collectively a PDS card. Ideally I ought to have designed a PCB, however by the point a PCB would have arrived, my free time across the holidays would have been over. So as a substitute, I made the loopy choice to construct all of it on a protoboard. This required hours and hours of soldering. I needed to design one thing that was reusable for probably testing different ideas sooner or later, so I introduced all 96 pins to a header. Soldering 96 tiny wires to 192 pins was…very tedious. Severely, for those who’re going to do that, simply design a PCB as a substitute. Don’t be like me.

The tip result’s messy, however every thing is linked! I acquired higher at soldering the wires as time went on. I additionally added a socket for the ATF22V10C with headers for every pin, together with greater headers for 5V and GND.

To begin out, I made a decision to do some primary sanity testing to guarantee that my PLD design labored correctly. I attempted to dump reminiscence at 0xE0000000 in MacsBug with no PDS card put in in my LC 475.

DM E0000000

This ends in a bus error:

The bus error is brought on by a timer. If sufficient time elapses after a learn or write cycle has begun and nothing has responded to it, considered one of Apple’s chips will robotically assert /BERR to terminate the transaction. In any other case the CPU would fortunately simply wait without end.

See Also

Subsequent, I connected the naked minimal wanted for my PLD to make the CPU comfortable when it noticed a learn or write cycle: the deal with pins, /AS, R/W, and the /DSACK pins. And, after all, 5V and floor.

I inserted the cardboard into my LC 475 and booted it up. The truth that it chimed and booted was a very good signal. It meant I didn’t brief any of the deal with traces, information traces, or bus management indicators collectively. It additionally meant the machine was tolerant of my jumper wires. I retried the MacsBug take a look at and it gave me completely different outcomes this time:

That is glorious! As an alternative of a bus error, it learn again precise information. It’s all 0xFF, which in all probability is sensible. I’m not offering any information on the info traces but. Possibly there are pullup resistors that present a default worth of 0xFF when nothing is controlling the bus. I’m not 100% positive. However regardless, there have been no bus errors! My PLD made the CPU comfortable.

Right here’s the place issues acquired actually messy. For those who suppose what I’ve performed above is untidy, you ain’t seen nothing but. I believe this is likely to be the jankiest LC PDS card ever created. If there was a Christmas ugly enlargement card contest, I believe I would win.

The inexperienced PCB is considered one of my Mac ROM SIMM programmer boards. It’s unpopulated aside from the 64-pin ROM SIMM socket and a jumper wire soldered to virtually each pin. For those who pay shut consideration to my weblog, you may keep in mind it from my next-generation SIMM programmer prototyping. So basically I simply needed to hook up virtually all of those jumper wires to my PDS card. One after the other.

Which will sound straightforward, however it wasn’t. The jumper wires are too brief, and it will get increasingly more troublesome to squeeze them in place as you get nearer to the top. Tweezers have been very useful for positioning issues as I used to be ending up. The ultimate end result ended up wanting pretty chaotic, however hey, every thing is linked!

Right here it’s, put in in my LC 475 in all its glory, with a nook of the programmer PCB resting on the 68LC040 CPU and my duplicate Lobos Board programmable ROM SIMM put in.

After my previous adventures with by accident damaging my LC 475 logic board’s onboard flash /WE pin by placing 12V on it, I used to be very cautious to ensure 12V (VPP) was not shorted to every other pins within the circuit.

I cautiously powered on my LC 475. Chances are you’ll discover within the above image I don’t have a battery put in, which implies I’ve to flip the facility swap on and off after the boot chime to ensure that the onboard video to work accurately.

It nonetheless booted simply effective, so I didn’t screw something up with all of my loopy jumper wires hanging round. Effectively, they may have been briefly broadcasting radio waves to my neighbors, however not less than the pc labored. I couldn’t wait to attempt opening the Flasher utility and seeing if it could detect something.

I’m at all times skeptical when one thing works on the primary attempt, however it freaking labored. I had wired up each single a type of jumper wires accurately! The PDS ROM Information part confirmed a four-chip Am28F020 SIMM. This meant that each learn and write cycles have been working correctly, as a result of they’re each wanted with a purpose to carry out the chip identification process.

This screenshot was taken after I had been taking part in with it for some time and had flashed the LC 475 inventory ROM to the SIMM. Right here’s a video of the programming course of so you may examine it to how onboard ROM SIMM flashing worked.

While you program a ROM picture by way of this PDS card, the UI updates as you do it. It tells you that it’s erasing, then programming, and at last verifying. Onboard SIMM programming didn’t enable this, as a result of you may’t do Mac toolbox calls when you’re in the midst of programming your onboard ROM. There was no easy method to replace the display in that case. Additionally, it simply leaves you again within the Flasher utility when it’s completed. It doesn’t robotically reboot prefer it does after reprogramming the identical ROM you booted from.

I hope this journey down Apple developer reminiscence lane is attention-grabbing to folks on the market. It has been a blast reviving this software program and with the ability to share my findings with the world. I truthfully might barely sleep final evening after I acquired my PDS card working. I’ve by no means made something like this earlier than, and it’s opening up new avenues for me to study extra about {hardware} design. Is there any curiosity from folks in really proudly owning considered one of these programmer playing cards? Clearly, it could be a cultured PCB and never my rat’s nest depicted above. One concern is with so many alternative PDS slots on the market, there must be completely different variants of the cardboard. Both that or one mega card that has the entire required card connectors. That would get costly although…

Both method, this positively isn’t the top of this matter. I plan on hacking the Flasher software program to additionally assist fashionable ROM SIMMs in each the inner SIMM socket and the flash card. I’ll positively share the method of determining learn how to hack the software program. I’ve made some good progress on crudely hacking the code to show the idea, however I need to be sure I do my closing hackery the “proper method” in order that it’s maintainable going ahead.

Source Link

What's Your Reaction?
Excited
0
Happy
0
In Love
0
Not Sure
0
Silly
0
View Comments (0)

Leave a Reply

Your email address will not be published.

2022 Blinking Robots.
WordPress by Doejo

Scroll To Top