8271 disc controller de-cap and craziness -- do not try this at home!

discuss both original and modern hardware for the bbc micro/electron
User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Fri Aug 28, 2020 8:26 pm

Rich Talbot-Watkins wrote:
Fri Aug 28, 2020 8:08 pm
Right now I wonder if the address bits need swizzling somehow.
I messed about with this idea last night, but the difficulty is finding a way of doing it which doesn't overflow the row decoder. We only have 108 rows -- it's not a power of two.

Ditto inverting the bits -- your first read is off the end of the ROM.

I'm not convinced by the microcontroller theory at this point, honestly. I'm starting to think it's some sort of infernal state machine.

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Fri Aug 28, 2020 8:46 pm

Just a bit more waffle:

Here are the obviously regular structures on the die that I've found are connected to that 8-bit bus -- lots of 'em. Pretty much all of these connect in the same bit order (with respect to their layout).
bus_all_structures.jpg
The fact that the bus lines terminate in the top-left corner of the die has made me presume for a while that the bus is also used to transport signals from the pads at the very top. The (purple, as I drew them) pads up there are inputs. Here's the data sheet:
datasheet_bus_connections.jpg
The block labelled "input buffer" accepts seven signals from outside:

- READY 0
- READY 1
- TRACK 0
- COUNT/OPI
- INDEX
- WR PROTECT
- FAULT

All of those, except READY 1, are available on the top edge of the die, so I assume that these signals join the bus at this point. How READY1 gets there is another question, as that's in the bottom left corner, but here's one interesting thing:
dark_blue_bus_line_just_stops.jpg
This bus line heading up the left side of the chip towards those pads at the top -- it is the dark blue one as I drew them -- just stops! There's no via to link it to any layer below; there's a piece of extraneous metal there that just doesn't connect to anything. I don't know what it means; maybe they were planning to put READY1 at the top of the die along with the other input pads in the group mentioned on the datasheet. Looking at where the blue bus line turns east to cross the middle of the die, it is possible to trace a tap from here towards the READY1 pad in the bottom left corner, so there is a clue there that they may have moved that pad at the last minute.

The set of outputs that are labelled on the data sheet as being connected to the "output buffer" -- eight of them -- literally *all* run up the left hand side of the die, and there is evidence of them connecting via some logic to the bus lines that run north/south along the left edge of the chip, so maybe the bus services them, too.

User avatar
scarybeasts
Posts: 559
Joined: Tue Feb 06, 2018 7:44 am
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by scarybeasts » Fri Aug 28, 2020 9:17 pm

guesser wrote:
Fri Aug 28, 2020 7:16 pm
The circuit I posted above seems to confirm that the ROM column pulling low (i.e. a transistor/0 on my annotation) results in the bus line being high. In other words inverted from my original dump as you did to find those plausible opcodes. 👍
That's good to know!
I'm no longer sure I want to call the opcodes "plausible", though. The sequence is far too verbose. In microcode, where space is tight, you'd likely zero a bunch of registers differently, with a 1-byte series of opcodes such as CLR A; MOV R0,A; MOV R1,A; ... etc.


Cheers
Chris

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Fri Aug 28, 2020 11:05 pm

Diminished wrote:
Fri Aug 28, 2020 8:46 pm
here's one interesting thing
I've noticed a couple of odd bits of metal going nowhere, but none as long as that!
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

Coeus
Posts: 1821
Joined: Mon Jul 25, 2016 12:05 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Coeus » Sat Aug 29, 2020 2:29 am

So on the odd bits of mental going nowhere and the comment about whether this really is based on an 8048 or similar, it occurred to me: "If you were Intel back in about 1976/77 and wanted to produce a hybrid chip - one which has an existing design at its core but has some application specific logic as well - how would yo do that?

It's the kind of thing done all the time now and can presumably be done on software but back then would do this photographically? Would you change the layout of the core part (in this case the 8048) at all or would you just put the new logic side by side and connect them at the metal layer.

So I searched to see if I could find any cases of an 8048 being de-capped to see if we can see the same places. What I found, though, was this: https://caps0ff.blogspot.com/2020/04/yo ... dsman.html which covers reading the ROM on some NEC 8041 variants. I think it was in Chris's blog that I saw reference to a German article that suggested the 8271 is based on the 8041 rather than the 8048. The blog I linked above suggests that there are sufficient differences in instruction set between these two to cause weird results if the disassembler is not disassembling the right variation of the instruction set.

Coeus
Posts: 1821
Joined: Mon Jul 25, 2016 12:05 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Coeus » Sat Aug 29, 2020 2:33 am

And here is the YouTube URL for how these guys think the ROM physical layout works: https://www.youtube.com/watch?v=j4VAWy0 ... e=youtu.be

User avatar
scarybeasts
Posts: 559
Joined: Tue Feb 06, 2018 7:44 am
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by scarybeasts » Sat Aug 29, 2020 2:47 am

Coeus wrote:
Sat Aug 29, 2020 2:29 am
I think it was in Chris's blog that I saw reference to a German article that suggested the 8271 is based on the 8041 rather than the 8048. The blog I linked above suggests that there are sufficient differences in instruction set between these two to cause weird results if the disassembler is not disassembling the right variation of the instruction set.
Oh that is very interesting. I note that the ROM they recovered starts with 0x04 0x08, aka. JMP (page0) 08. One of the byte extraction combinations I tried last night gave that as the first two bytes and I remember thinking JMP (page0) 08 seemed very plausible as a way of jumping past the interrupt vectors and getting going. But then the thing at 0x08 didn't make much sense. I'll have a look at it again to see if it makes more sense in 8041...


Cheers
Chris

User avatar
scarybeasts
Posts: 559
Joined: Tue Feb 06, 2018 7:44 am
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by scarybeasts » Sat Aug 29, 2020 8:26 am

Coeus wrote:
Sat Aug 29, 2020 2:33 am
And here is the YouTube URL for how these guys think the ROM physical layout works: https://www.youtube.com/watch?v=j4VAWy0 ... e=youtu.be
It looks like the particular layout in the video might only apply to ROMs with a power-of-two number of rows, i.e. not our 8271. Very interesting though that the byte ordering of 8-byte runs flips half-way! I tried adding some similar things to my conversion attempts, with no particular luck.

So, still banging my head against a wall. Argh!


Cheers
Chris

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 7:29 pm

Hmm

Has anyone tried Gray code, in which no more than one bit changes at a time? There are actually compelling reasons why that might be beneficial here (no skew glitches).

There's an automatic Gray code generator here if you want to play with it.

dp11
Posts: 1199
Joined: Sun Aug 12, 2012 9:47 pm
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by dp11 » Sat Aug 29, 2020 7:34 pm

Gray code address makes jumps hard and jumps can have all bits changing so don't actually buy you anything.

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 7:40 pm

dp11 wrote:
Sat Aug 29, 2020 7:34 pm
jumps can have all bits changing so don't actually buy you anything.
Drat.

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 8:00 pm

Also the address decoder is plainly a straight binary count even if the lines were scrambled up, which they don't appear to be.
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 8:02 pm

guesser wrote:
Sat Aug 29, 2020 8:00 pm
Also the address decoder is plainly a straight binary count even if the lines were scrambled up, which they don't appear to be.
Well, I was thinking the big ROM contents would be transposed too, but I agree it doesn't make much sense to do it.

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 8:16 pm

Can anyone tell me what the green line (which is metal) is directly connected to here?
nicht_verstehen_1.jpg
nicht_verstehen_1.jpg (11.72 KiB) Viewed 462 times
nicht_verstehen_2.jpg
nicht_verstehen_2.jpg (10.26 KiB) Viewed 462 times
Is it the region to the right of its via, or the region to the left of it?

User avatar
BigEd
Posts: 3436
Joined: Sun Jan 24, 2010 10:24 am
Location: West
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by BigEd » Sat Aug 29, 2020 8:18 pm

That's really weird - whereabouts are we? And can we see more context please? (maybe 3x)

User avatar
scarybeasts
Posts: 559
Joined: Tue Feb 06, 2018 7:44 am
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by scarybeasts » Sat Aug 29, 2020 8:33 pm

Well, I'm pretty vexed by the lack of any code to reverse engineer and annotate :)

Anyone have any objections to seeing if I can reach a bored retro chip expert via Twitter (with links to some of the resources on this thread)?


Cheers
Chris

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 8:36 pm

That's a metal to diffusion via with a couple of gates around it like the connections to the bus from the output of the ROM I finished tracing out last night.

e.g.
bus-output.png
The diffusion silicon is presumably connected off to gnd somewhere off the image is it? EDIT: ah yes, found it now
Last edited by guesser on Sat Aug 29, 2020 8:42 pm, edited 1 time in total.
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

User avatar
BigEd
Posts: 3436
Joined: Sun Jan 24, 2010 10:24 am
Location: West
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by BigEd » Sat Aug 29, 2020 8:40 pm

Ah yes, that's right: the connection from the metal is to the small island surrounded on three sides by a bendy transistor, with more series transistors nearby.

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 8:40 pm

scarybeasts wrote:
Sat Aug 29, 2020 8:33 pm
Anyone have any objections to seeing if I can reach a bored retro chip expert via Twitter (with links to some of the resources on this thread)?
Not if it's Master Ken, I'd be embarrassed thinking he's reading my bumbling amateur analysis! :wink:
(That and he'd have the whole thing reversed in an evening and spoil all the fun) :lol:
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 8:42 pm

BigEd wrote:
Sat Aug 29, 2020 8:18 pm
That's really weird - whereabouts are we? And can we see more context please? (maybe 3x)
Immediately to the right of the ROM output tap on the "green" bus line.
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 8:54 pm

guesser wrote:
Sat Aug 29, 2020 8:36 pm
That's a metal to diffusion via with a couple of gates around it like the connections to the bus from the output of the ROM I finished tracing out last night.
Ah yes, it's obvious now I look at it again. I've been staring at this too long. :shock:

Thank you.
The diffusion silicon is presumably connected off to gnd somewhere off the image is it?
It is:
nicht_verstehen_3.jpg


This is because I decided to go tracing those "extra two" bus lines -- bits 8 and 9 -- which the Seventh-Day True Microcontroller Believers are calling the page bits.

I have this so far (in blue-green). The blown-up region I posted is the eastern end of one page line, which is presumably gated by something:

https://drive.google.com/file/d/1ty6FJe ... sp=sharing

It isn't terribly interesting, although notable that these bits terminate up in the top-left in a similar fashion to the other 8 bits. Makes me wonder if perhaps I was wrong about them hooking up to the input pads.

I'll export the paths in a minute so others can do whatever they want with them.
scarybeasts wrote:
Sat Aug 29, 2020 8:33 pm
Anyone have any objections to seeing if I can reach a bored retro chip expert via Twitter (with links to some of the resources on this thread)?
I have no objections. Apart from brainlessly tracing wires, I feel like pretty much 100% of my theories and suggestions in this thread have turned out to be completely worthless. :lol:

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 9:04 pm

Here are the exported SVGs of bits 8 and 9. I'm working at 50% (133 MP) instead of 100% now, so you'll have to scale them accordingly.
page_paths.zip
(4.26 KiB) Downloaded 7 times

Viel Spaß!

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 9:09 pm

Diminished wrote:
Sat Aug 29, 2020 8:54 pm
Ah yes, it's obvious now I look at it again. I've been staring at this too long. :shock:
I've been hooked completely by this (as you can probably tell by the timestamps on my posts) and a couple of times this week I've seen polysilicon wires when I close my eyes :shock:

:lol:
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 9:38 pm

Diminished wrote:
Sat Aug 29, 2020 9:04 pm
Here are the exported SVGs of bits 8 and 9. I'm working at 50% (133 MP) instead of 100% now, so you'll have to scale them accordingly.

page_paths.zip


Viel Spaß!
Ta, that's those added to my file, for anyone else playing along at home :)
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 9:47 pm

Diminished wrote:
Sat Aug 29, 2020 8:54 pm
This is because I decided to go tracing those "extra two" bus lines -- bits 8 and 9 -- which the Seventh-Day True Microcontroller Believers are calling the page bits.

I have this so far (in blue-green). The blown-up region I posted is the eastern end of one page line, which is presumably gated by something:
The outputs to those two bus lines look like they're coming from last two columns of the small 10 bit ROM to me (just following them with my finger).

The wiggly enable gate for them is common with the other taps of the "rainbow" bus down to the whole mess driving that decoder.
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

User avatar
Diminished
Posts: 522
Joined: Fri Dec 08, 2017 9:47 pm
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by Diminished » Sat Aug 29, 2020 10:19 pm

One more I traced earlier.

This one is interesting because it seems to route an output pad back internally to the chip (SELECT0), and it appears to gate some pretty interesting things. I can't see anything obviously similar for SELECT1, but perhaps they're strict inverses of one another, in which case it would be redundant.

I'd advise you to check carefully that I've done this one correctly though, because I'm not sure:

https://drive.google.com/file/d/1JOPHev ... sp=sharing

SVGs:
SELECT0_paths.zip
(5.78 KiB) Downloaded 5 times

User avatar
scarybeasts
Posts: 559
Joined: Tue Feb 06, 2018 7:44 am
Contact:

Re: 8271 disc controller de-cap and craziness -- do not try this at home!

Post by scarybeasts » Sat Aug 29, 2020 10:38 pm

guesser wrote:
Sat Aug 29, 2020 9:47 pm
Diminished wrote:
Sat Aug 29, 2020 8:54 pm
This is because I decided to go tracing those "extra two" bus lines -- bits 8 and 9 -- which the Seventh-Day True Microcontroller Believers are calling the page bits.

I have this so far (in blue-green). The blown-up region I posted is the eastern end of one page line, which is presumably gated by something:
The outputs to those two bus lines look like they're coming from last two columns of the small 10 bit ROM to me (just following them with my finger).

The wiggly enable gate for them is common with the other taps of the "rainbow" bus down to the whole mess driving that decoder.
That's interesting. Is it possible that the microcode ROM decode could be split across the big ROM and the little ROM? It brings to mind compression schemes to save die space, although perhaps I'm way off on a flight of fantasy here.

And is the thinking that the ROM-like thing in the top right could be the sequencer ROM for the opcodes of a general microcontroller?


Cheers
Chris

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by guesser » Sat Aug 29, 2020 11:05 pm

I've not really studied that structure at all to see how the rows and columns are selected, it's not got an obvious address decoder like what we're calling the ROM. Both halves of it have a ton of empty space too which is a bit perplexing.
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

User avatar
scarybeasts
Posts: 559
Joined: Tue Feb 06, 2018 7:44 am
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by scarybeasts » Sat Aug 29, 2020 11:44 pm

In case anyone needs something different to look at over their morning coffee, here's a 1772 die shot.

https://siliconpr0n.org/map/wdc/wd1772/mz_mit20x/

Is it me or does it look a lot simpler?


Cheers
Chris

guesser
Posts: 485
Joined: Mon Jun 26, 2006 10:21 pm
Contact:

Re: 8271 disc controller craziness -- do not try this at home!

Post by guesser » Sun Aug 30, 2020 12:06 am

scarybeasts wrote:
Sat Aug 29, 2020 11:44 pm
In case anyone needs something different to look at over their morning coffee, here's a 1772 die shot.

https://siliconpr0n.org/map/wdc/wd1772/mz_mit20x/

Is it me or does it look a lot simpler?
Are we going to have a race then? Team B's chip looks simpler, but team A have had a week head start :lol:
A web based teletext editor which can export as Mode 7 screen memory: https://zxnet.co.uk/teletext/editor
Join the Teletext Discord for teletext chat.

Post Reply

Return to “8-bit acorn hardware”