Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Darren Clark
Minor correction. Any commands that get translated to an index higher than 0x13 will return an invalid command, not crash the firmware. This statement is incorrect: "I haven't looked for any other logic that would prevent this, but a command 0x13 to 0x2A (except 0x23), or 0x35 to 0x3F will sel

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Brian K. White
This doesn't matter but on the TPDD1, if you set the dip switches to OFF ON ON ON, then you can dump the rom at 19200, and in that case I need to add a sleep after each S-record. I added 30ms just based a note for something else somewhere in the service manual that you should wait 25ms to betwe

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Darren Clark
Nice find! I wasn't looking at port 4 data since I assumed it was all address outputs, but P43, P44, P45 are configured as inputs on the TPDD2 (not on the TPPD1). ;Port4.B0    I/O        Pin37    P40    A8 ;Port4.B1    I/O        Pin36    P41    A9 ;Port4.B2    I/O        Pin35    P42    A10 ;P

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Darren Clark
I don't see anything in the code that reads the drive parameter table other than the command to output that data. I'm guessing Brother may have other drives with more capabilities and this is only there to tell the host how the drive is configured. Also I don't see anything for a second serial

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Darren Clark
The part of the code that picks out the commands is a bit goofy, but I believe it's like this to maintain a standard command set across multiple drives with other added functionality. There is a bit mask for the command, so we're only looking at the lower 6 bits (0x00 to 0x3F). Bit 6 and 7 (6

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Brian K. White
This is great for making the emulators and clients definitive instead of full of mysteries and "here we recite the words lest the gods be angry". Can you see why command 0x11 works as a synonym for 0x33? And why does 0x0F respond with the 0x38 return block? When neither of those are commands. Th

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Stephen Adolph
I'll add some info from your nicely documented code. * A13 value is tested at 0xF1FE, and controls a branch to 0xF1EB; seems to change the way serial data is transmitted. hardware default is to branch. * A12 value is tested at 0xF071, not sure what it does yet. hardware default is to branch. * A1

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Stephen Adolph
Darren, another question, There are some inputs on pins 30,31,32 (called A13, A12, A11) that correspond to P45, P44, P43 on the HD6301. Port 4 of the HD6301 is hooked up to pins 73.36,35,32,32,30,29,28 for P40-P47. I'll go look at the code, but these 3 inputs are configurable. I wonder what the

Re: [M100] Tandy Portable Disk Drive 2 - firmware dumping and reverse engineering

2024-01-28 Thread Stephen Adolph
Thanks Darren. Now that we have the real tpdd firmware I wonder what we can do with it. Some of those variables look tempting, like side and # of tracks. Another question.. it looks like was there a second unpopulated serial port on the drive? Anything in the code on that? P7 is unpopulated and