Re: [Ql-Users] Trump Card questions
Hi Phill, I produced a couple of Trump card clones in the 80's and still have the PCB designs at hand, so drawing up a schematic will not be difficult. If you can mail me the PLD dumps I'll label and comment the equations for you. I did this myself, but cannot locate the files any more. Cheers Malcolm On 21/02/2011 11:22, Phill Harvey-Smith wrote: Hi all, I'm currently trying to modify the MESS source so that it's QL driver supports floppies by emulating the Trump Card. I have the actual disk access working and am able to access and load files from an image of a QL disk. However the emulated card will only see 640K of memory, I have managed to work out that the trump card plays some tricks with memory mapping. It seems initially the ROM is mapped in to both $C and $1, the QDOS start up routine finds the rom at $C, and calls it's initialisation routine at $C011E, which promptly does a jump to $10124, and continues execution from there. It seems that the trump card hardware maps out the copy of the ROM at $C, and maps the RAM into that area on any read from the $1-$17FFF area. This means that the QDOS ram test only finds ram up until $B, and so sets it to 640K (in the emulation). On the real machine it finds the full 896K, so must be finding RAM in the $C-$F area, so the trump card hardware must initially allow access to the RAM, before the ROM is mapped in, but I have no clue as to how this is achieved. Does anyone have any clues, or better still know how it actually works ? I have started tracing the trump cards circuitry, but there are two programable logic chips (PAL1 and PAL2v2), which though I have dumped, when I decompile them the logic makes no sense to me :( Has anyone worked out the logic for these ? Next step I guess will be to hook up the PALs to a microcontroler and probe all combinations of inputs and record outputs. Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Malcolm Lear wrote: Hi Phill, I produced a couple of Trump card clones in the 80's and still have the PCB designs at hand, so drawing up a schematic will not be difficult. Excellent :) If you can mail me the PLD dumps I'll label and comment the equations for you. I did this myself, but cannot locate the files any more. Sure, (I'll send them off list, not sure what atachement policy is for this list) I'm not that sure how accurate they are, my device reader only knows about TI 16L8s, whereas the ones on my TC are national semi. When I ran them through jed2eqn I ended up with things like output = i1 !i1 # vcc Which didn't seem very helpful :( :( Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Ah, that brings all the memories back. I'm sure the chips were protected and I had to switch all combinations of input to deduce the equations. The good news is that I can lay my hands on a board I manufactured and read back the equations from that. Unfortunately the earliest I can do that is next week. I seem to remember that initially the ROM is mirrored and access to a particular range of addresses (the jump) switches it out replacing it with RAM. Cheers Malcolm On 21/02/2011 14:03, Phill Harvey-Smith wrote: Malcolm Lear wrote: Hi Phill, I produced a couple of Trump card clones in the 80's and still have the PCB designs at hand, so drawing up a schematic will not be difficult. Excellent :) If you can mail me the PLD dumps I'll label and comment the equations for you. I did this myself, but cannot locate the files any more. Sure, (I'll send them off list, not sure what atachement policy is for this list) I'm not that sure how accurate they are, my device reader only knows about TI 16L8s, whereas the ones on my TC are national semi. When I ran them through jed2eqn I ended up with things like output = i1 !i1 # vcc Which didn't seem very helpful :( :( Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Malcolm Lear wrote: Ah, that brings all the memories back. I'm sure the chips were protected and I had to switch all combinations of input to deduce the equations. I did wonder about that :) :) I may have a go at hooking them up to an AVR and getting it to scan and record for me :) :) The good news is that I can lay my hands on a board I manufactured and read back the equations from that. Excellent. Unfortunately the earliest I can do that is next week. No probs. I seem to remember that initially the ROM is mirrored and access to a particular range of addresses (the jump) switches it out replacing it with RAM. Indeed, I have worked out this much, however I think the RAM test takes place before this point so will hit the mirrored rom and only see 640K :( So there must be something else afoot :) Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Phill Harvey-Smith wrote: Indeed, I have worked out this much, however I think the RAM test takes place before this point so will hit the mirrored rom and only see 640K :( So there must be something else afoot :) RAM test is pretty much the first thing the OS does, long before initializing the ROMs. The ROM will probably patch the RAMTOP system variable to the new value or something like that. Marcel ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Since the RAM on a standard QL was only ever intended to extend up to $B, would the test ever go beyond that. Cheers Malcolm On 21/02/2011 14:50, Phill Harvey-Smith wrote: Malcolm Lear wrote: Ah, that brings all the memories back. I'm sure the chips were protected and I had to switch all combinations of input to deduce the equations. I did wonder about that :) :) I may have a go at hooking them up to an AVR and getting it to scan and record for me :) :) The good news is that I can lay my hands on a board I manufactured and read back the equations from that. Excellent. Unfortunately the earliest I can do that is next week. No probs. I seem to remember that initially the ROM is mirrored and access to a particular range of addresses (the jump) switches it out replacing it with RAM. Indeed, I have worked out this much, however I think the RAM test takes place before this point so will hit the mirrored rom and only see 640K :( So there must be something else afoot :) Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Malcolm Lear wrote: Since the RAM on a standard QL was only ever intended to extend up to $B, would the test ever go beyond that. Yep it does, loop only stops when it finds a location where it gets a different value back than it wrote. Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
Re: [Ql-Users] Trump Card questions
Marcel Kilgus wrote: Phill Harvey-Smith wrote: Indeed, I have worked out this much, however I think the RAM test takes place before this point so will hit the mirrored rom and only see 640K :( So there must be something else afoot :) RAM test is pretty much the first thing the OS does, long before initializing the ROMs. The ROM will probably patch the RAMTOP system variable to the new value or something like that. I may check in mess for the RAMTOP being modified / accessed by the TC rom, if it does thaen that would probably be the explanation, but however this should also work on the emulation as I do the pageswap when the $1 page code starts to be executed. Cheers. Phill. ___ QL-Users Mailing List http://www.q-v-d.demon.co.uk/smsqe.htm
