Post by @rqm

gloriouscow
@gloriouscow @oldbytes.space
Public en

so there's a rumor you can tickle the NEC uPD765 floppy controller just right and it will whisper sweet nothings in your ear

those sweet nothings being its microcode.

#retrocomputing #vintagecomputing

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en

now, we already have the 765's microcode ROM array dumped via die photography thanks to @infosecdj .

so why might we want to proceed with the tickle party?

because the microcode ROM doesn't make any damn sense, that's why. so i'm curious if the debug mode might dump out something in a different order.

plus i'm just curious to see if I can figure out the method in the first place.

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en
NEC uPD765 Floppy Disk Controller: Internally this is a microcoded part with a primative controller of NEC’s own design. Testing microcode embedded in a part can be troublesome. The uPD765 had a few extra gates associated with the DMA Request and DMA Ack pins. Presenting a certain illegal combination here places the part into a “test” mode and allows the sequencer microcode to be output on the normal Data pins. The sequencer microcode is responsible for high level commands such as Read Track, Recalibrate, Format Track, or Write Data. There is a similar test mode for the nano-code array which serializes data at the floppy disk head.
NEC uPD765 Floppy Disk Controller: Internally this is a microcoded part with a primative controller of NEC’s own design. Testing microcode embedded in a part can be troublesome. The uPD765 had a few extra gates associated with the DMA Request and DMA Ack pins. Presenting a certain illegal combination here places the part into a “test” mode and allows the sequencer microcode to be output on the normal Data pins. The sequencer microcode is responsible for high level commands such as Read Track, Recalibrate, Format Track, or Write Data. There is a similar test mode for the nano-code array which serializes data at the floppy disk head.

this rumor comes from a 14-year old comment Hackaday from a user 'NateOcean'.

Unfortunately nobody knows who the hell NateOcean is and he did not elaborate.

But thanks to him we know we have to tickle the DMA lines.

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en
a photo of the 765 die centered on the DRQ pin showing bidirectionality(?) maybe?
a photo of the 765 die centered on the DRQ pin showing bidirectionality(?) maybe?

Our friend Nate leaves us with many ambiguities. What's an "illegal combination" of the DMA lines?

Well, DRQ is an output pin.

So it would be rather odd to see that it sure looks like its bidirectional.

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en

I mean if I was a fancy-pants NEC chip designer and I wanted to give my chip a microcode-yodelling debug mode using pin tickling i'd logically make it check said tickled pins during reset.

i could be wrong here! but it's good as any guess at the moment.

but then how does the microcode get read out? does it just come tumbling out as we clock the chip? do we have to toggle some other pin to advance it? who knows!

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en

i figure we assert /CS and /RD and keep clocking it and if nothing exciting happens we can try twiddling /RD on and off.

I'm going to use my new best friend, the Pi Pico 2.

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en
a breadboard with a raspberry pi pico 2, and an NEC D765AC floppy disk controller chip, connected with colored hook-up wires.
a breadboard with a raspberry pi pico 2, and an NEC D765AC floppy disk controller chip, connected with colored hook-up wires.

here's the probe rig wired up. complete with cat hair

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en

i added a bypass cap for the 765 and tied some of the unused inputs to ground, but i don't feel like taking another picture

Replying to @gloriouscow@oldbytes.space
gloriouscow
@gloriouscow @oldbytes.space
Public en

initial check looks good - we're able to reset the 765.

I'm actually able to read 0x90 from the main status register which is remarkably plausible.

That's RQM and BUSY.