Tashtari
PIC Whisperer
The more I delve into the HD20 and the DCD protocol in general, the more fascinating things seem to become...
I'm going to start this thread just so I can put some of the things I've found out somewhere.
The May 1985 DCD Document is the best overall source for information on the DCD protocol, but that's not saying much given that it's full of inaccuracies, or things that might have been accurate at some point during development, but no longer. Its description of the 7-to-8 encoding that is used to communicate with the device over the IWM is accurate, the description of the eight protocol "states" selected by the phase lines is very nearly accurate (state 0 has ReadData in data mode, not sense mode), the description of how DCDs are chained is accurate. The descriptions of the handshake protocols between the Mac and the DCD are accurate, except for the holdoff protocol which is quite different (see what I've written about this in the README for TashTwenty). The document also features a list of commands that is almost entirely wrong. It's that that I'm going to focus on.
Read blocks (0x00) and write blocks (0x01) are both accurately described by the document. Controller status (0x03) is almost accurately described, with a small alteration to the format of the buffer returned by the device. There is a small, handwritten allusion to what command 0x02 is in the document - the description of the write command also seems to suggest that "write verify" is in the same format, and "02" is scrawled next to "write verify". This is consistent with the behavior I've seen when sticking the analyzer on the HD20 Test application running in destructive mode, it does a long series of 0x02 commands that run through the drive's logical blocks in order, presumably using the drive's own reads to discover errors.
So what about the rest? I would see the occasional 0x04-and-beyond command, a couple showed up when doing an Erase Disk from the Finder and a bunch were thrown out at the start of the HD20 Test run, but none of them seemed to line up with the stuff from the May 1985 document. It wasn't until I read this article from MacGUI and got my hands on a copy of HD Diag that things started to make sense...
The December 1984 Nisha Firmware Specification Document contains a bunch of commands that sound familiar versus the ones in the May 1985 document and a protocol for carrying them that doesn't seem to line up with anything else. But when I put the analyzer on the 512ke running HD Diag and started throwing commands at it, I noticed that all the commands I sent used the command numbers listed in the December 1984 document, plus 4. Do the others line up?
Beginning of HD20 Test Test:
0x0A - 4 = 0x06 ... Set_Recovery
0x05 - 4 = 0x01 ... Read_Controller
0x11 - 4 = 0x0D ... Read_SpareTable
0x04 - 4 = 0x00 ... Read_Id
0x17 - 4 = 0x13 ... Read_Track
Set_Recovery takes a parameter of either 0x01 or 0x00, according to the document, but Mac here sends... an 0x03? But these are entirely sane things for a test application to do at the start of its run.
Erase Disk:
0x19 - 4 = 0x15, and 0x1A - 4 = 0x16 ... neither of which are listed in the December 1984 document. Dang, things were looking so promising. The drive did a bunch of clicking before responding to each of these, and I think they lined up with "Formatting disk..." and "Verifying format..." so perhaps that's what they do, lay down sector boundaries on each track and verify that they're there.
I'm guessing there were some non-radical but significant changes to the Nisha firmware specification after December 1984, but until someone discovers some more documents in the bottom of a file drawer somewhere, we may be left guessing.
Fortunately, no guesswork is needed for TashTwenty to work, for two reasons. One, Mac never does anything except 0x00, 0x01, and 0x03 in the course of normal operation. Two, one of the features of the DCD protocol that the May 1985 document doesn't mention is that Mac always gives an expected response length whenever it sends a command, so TashTwenty can (and does) respond to commands it doesn't know with an empty block, which seems to frequently get interpreted as "yup, yeah, did the thing you said, everything's fine". It certainly works for Erase Disk, anyway.
Here endeth the rambling.
I'm going to start this thread just so I can put some of the things I've found out somewhere.
The May 1985 DCD Document is the best overall source for information on the DCD protocol, but that's not saying much given that it's full of inaccuracies, or things that might have been accurate at some point during development, but no longer. Its description of the 7-to-8 encoding that is used to communicate with the device over the IWM is accurate, the description of the eight protocol "states" selected by the phase lines is very nearly accurate (state 0 has ReadData in data mode, not sense mode), the description of how DCDs are chained is accurate. The descriptions of the handshake protocols between the Mac and the DCD are accurate, except for the holdoff protocol which is quite different (see what I've written about this in the README for TashTwenty). The document also features a list of commands that is almost entirely wrong. It's that that I'm going to focus on.
Read blocks (0x00) and write blocks (0x01) are both accurately described by the document. Controller status (0x03) is almost accurately described, with a small alteration to the format of the buffer returned by the device. There is a small, handwritten allusion to what command 0x02 is in the document - the description of the write command also seems to suggest that "write verify" is in the same format, and "02" is scrawled next to "write verify". This is consistent with the behavior I've seen when sticking the analyzer on the HD20 Test application running in destructive mode, it does a long series of 0x02 commands that run through the drive's logical blocks in order, presumably using the drive's own reads to discover errors.
So what about the rest? I would see the occasional 0x04-and-beyond command, a couple showed up when doing an Erase Disk from the Finder and a bunch were thrown out at the start of the HD20 Test run, but none of them seemed to line up with the stuff from the May 1985 document. It wasn't until I read this article from MacGUI and got my hands on a copy of HD Diag that things started to make sense...
The December 1984 Nisha Firmware Specification Document contains a bunch of commands that sound familiar versus the ones in the May 1985 document and a protocol for carrying them that doesn't seem to line up with anything else. But when I put the analyzer on the 512ke running HD Diag and started throwing commands at it, I noticed that all the commands I sent used the command numbers listed in the December 1984 document, plus 4. Do the others line up?
Beginning of HD20 Test Test:
Mac: 0A 03 00 00 00 00
DCD: 8A 00 00 00 00 00
Mac: 05 00 00 00 00 00
DCD: 85 00 00 00 00 00
Mac: 11 00 00 00 00 00
DCD: 91 00 00 00 00 00
Mac: 04 00 00 00 00 00
DCD: 84 00 00 00 00 00
Mac: 17 00 80 00 00 00
DCD: 97 00 00 00 00 00
(then more 17/97)
0x0A - 4 = 0x06 ... Set_Recovery
0x05 - 4 = 0x01 ... Read_Controller
0x11 - 4 = 0x0D ... Read_SpareTable
0x04 - 4 = 0x00 ... Read_Id
0x17 - 4 = 0x13 ... Read_Track
Set_Recovery takes a parameter of either 0x01 or 0x00, according to the document, but Mac here sends... an 0x03? But these are entirely sane things for a test application to do at the start of its run.
Erase Disk:
Mac: 19 01 00 00 00 00
DCD: 99 00 00 00 00 00
Mac: 1A 00 00 00 00 00
DCD: 9A 00 00 00 00 8A
0x19 - 4 = 0x15, and 0x1A - 4 = 0x16 ... neither of which are listed in the December 1984 document. Dang, things were looking so promising. The drive did a bunch of clicking before responding to each of these, and I think they lined up with "Formatting disk..." and "Verifying format..." so perhaps that's what they do, lay down sector boundaries on each track and verify that they're there.
I'm guessing there were some non-radical but significant changes to the Nisha firmware specification after December 1984, but until someone discovers some more documents in the bottom of a file drawer somewhere, we may be left guessing.
Fortunately, no guesswork is needed for TashTwenty to work, for two reasons. One, Mac never does anything except 0x00, 0x01, and 0x03 in the course of normal operation. Two, one of the features of the DCD protocol that the May 1985 document doesn't mention is that Mac always gives an expected response length whenever it sends a command, so TashTwenty can (and does) respond to commands it doesn't know with an empty block, which seems to frequently get interpreted as "yup, yeah, did the thing you said, everything's fine". It certainly works for Erase Disk, anyway.
Here endeth the rambling.