Dan MaloneyOK, I guess we can kick it off now. Welcome to Hack Chat everyone, I'm Dan and I'll be moderating today along with Dusan for Tube Time, who joins us to look at the ins and outs of building your own retro sound cards and such.
Good afternoon, Tube Time -- have you joined the chat yet?
yup, right here!
AH, cool. Welcome aboard!
thank you.
Hi and welcome all.
I was just looking at the electron gun cross-sections on Twitter. Cool stuff, I used to pull electron guns out of old tubes when I worked in a TV repair shop.
yeah they're tricky little beasts to design, there's a fascinating story about that.
you can use geometric methods using drafting tools, which is often what they did with optics back in the day as well
but one trick they did was to build the lens out of conductive pieces of metal and mount them on top of conductive carbon paper
then you could apply a voltage across the pieces of metal and measure the field strength at various points on the paper
a similar method involved a 3D mockup of the tube elements that were placed in a bath of conductive fluid (salt water, for example). then you could put a probe electrode at various points inside to measure the field
i was going to say that's a bit tangential to today's topic but it's also where i got my handle from!
It's amazing to realize that every livingroom in the world once had a small particle accelerator in it, strictly for entertainment purposes.
people often think it's because of audio tubes or amplifiers or whatever but i really like CRTs and nixie tubes. and a few other weird obscure vacuum tubes. audio tubes are...ok, but not my major focus.
Nah, all this stuff is too cool not to dive into. That live stream you did with the old Ikegami camera was great, BTW
that's sort of the tie in with my retrocomputing hobby. i like the CRTs and i grew up using the computers, so this is a way for me to extend that
ahh thank you, that was fun. i need to calibrate it again because i have another project in mind for it involving my Amiga Toaster Flyer hard disk video recorder from 1995
anyway i grew up with old Amiga and PC hardware in 80s and 90s, so i have a nostalgic attachment
but some of the hardware has gotten harder and harder to find, and in many cases, collectible and therefore quite expensive!
Any interest in old VME stuff?
at some point a few years ago i wanted to get my hands on an Ad Lib sound card for an old XT computer, and i had trouble finding one that wasn't $$$
And thus we come to today's main topic!
nope, never did VME.
anyway i was doing some research and i realized that the board itself was just a simple 2-layer design, and i could see nearly all of the traces
i also found Sergey's ad lib clone design that he had done
but it was really small and didn't look at all like the original. that's what kicked off the reverse engineering project
it took a bit of trial and error but i figured out that the original images didn't have too much distortion--meaning that if i knew the dots per inch, i could calculate precise distances between components, trace lengths, and that sort of thing
the basic idea is to take a chip footprint with a known pitch (0.1") and then measure the number of pixels from end to end, and divide by the spacing
that factor gets entered into GIMP (which i use for image editing) and so it displays coordinates in inches which is quite convenient
So you didn't so much as build a working version of the card, but a detailed replica
yes, my goal was to match it as closely as possible so that i could fab one up and enjoy it the same way as i could have enjoyed an original card
in fact i succeeded a little too well and later on there was some concern in the community that folks would fab the card and try to pass it off as original, selling it on ebay
now there *were* a few obscure differences so that i (and a few others who knew) would be able to tell the difference, but eventually i removed some stuff to make it more obvious.
Yeah, and I'd imagine whatever is left of the original manufacturer might have taken issue with your efforts too
well, i did look into that a bit
and it turns out that the taiwanese (?) company who acquired all the rights to Ad Lib's IP only cared about the software and also let the trademarks lapse
so it's still in a bit of a legal grey area but no sane company is going to throw a whole bunch of expensive lawyer time after something that makes basically no revenue.
that's not always the case: for example, i did briefly think of cloning the TR-808 drum machine but considering that Roland still actively sells a reissue as well as plugins that emulate it, they would not be very happy about it.
so if people want a TR-808, go buy the reissue :)
at some point after i released the ad lib clone, people started asking about the original sound blaster card, which is also hard to find
i don't mean like SB Pro or SB16 or anything like that, i mean the original 1989 card that changed the PC gaming market forever
up until ten years ago or so they could still be found pretty cheaply but thanks to LGR and similar folks the demand went up really fast and now they're expensive, like hundreds of dollars
LGR?
Lazy Game Reviews, a youtube channel focusing on retro gaming and hardware
ty
quite popular i might add.
Funny, I spent an obscene amount of money on an SB card back in the day and it was well worth it -- made me feel all "War Games" at last.
oh yeah they were quite something back in the day, i remember the first time we fired up ours. it was great
anyway my big reservation about cloning the card was the DSP chip
typically it had "creative labs DSP" markings and nothing else
but i did some research and discovered it was just an 8051 microcontroller
"DSP"
so i made a choice and basically figured i'd sort it out later
yeah DSP in this case means "Digital Sound Processor" not "Signal". gotta love marketing
Aah
:)
anyway the reverse engineering was tougher because i only had photos of the card, front and back, of a few revisions
and then someone on twitter volunteered to *remove chips* of his card and take pictures
he had all the rework equipment to do it properly though which was nice. still a bit scary!
so based on that and all the tricks i had learned with the Ad Lib i was able to complete a board layout and fab it up
i even found some surplus DSP chips from a broker in China, so using that i was able to get sound to come out of the card. it was quite a moment!
there's a video i made about it for twitter that i don't have handy, i could look it up later.
then a friend of mine loaned me a cheap chinese clone of the sound blaster, and it also used an 8051. i was able to dump the ROM code from that (the Creative Labs DSP was code protected)
i had to swizzle some IO pins around but the chinese firmware worked fine in my clone sound card, which i had called the Snood Bloober at that point
Was there any functional difference between the DSP and the stock 8051?
yes, and i'll talk about that in a bit
there's a joke about the names, you might have noticed there's a bunch of them
it started as a joke on irc where every time i talked about the card, somebody else would use a different name that was a pun or something
i ended up with an enormous list of names for the card, and settled on Snark Barker as the official one
many other names were considered, like "scrunk bunker" or "sound sphincter" but those didn't make the cut
after all that got released and people were having fun building the cards, i figured i'd take a crack at the official Creative Labs DSP
i had bought about 10 of the chips so i sent a few off to last week's hackaday.io speaker
and he was able to decap and image the chips. disappointingly, they had used an implant rom so we couldn't extract the ROM just using an optical technique
i tried very hard to reverse engineer the 8051 design and look for any back doors that would let me read the ROM out using a test mode but i couldn't find anything.
eventually i reverse engineered the ROM itself and discovered a transmission gate that prevented the bits from the ROM from going out into the internal processor data bus. the address lines were *always* connected no matter what
Transcript of last week's Hack Chat, fyi:
Hack Chat Transcript, Part 1 | Details | Hackaday.io
OK, here we go! Welcome to Hack Chat, I'm Dan and I'll be modding along with Dusan today. We're really pleased to welcome John McMaster onto the Hack Chat today to talk about decapping stuff. I'm not sure I've seen John log in yet, though - you out there, John?
thanks!
so the trick was to connect the 8051 in "external program" mode and wire up the NOP instruction to the data bus. this turned the address register into a counter
I read something a while back about the security bit of some devices being some what like a bit of an EPROM. By decapping and exposing the device to UV they were able to reset the security bit then read the contents of the devices.
then, since john had decapped the chip leaving the bond wires intact, we were able to power it up under the probe station
You two did all that in less than a week?
correct, however the 8751 (eprom) is a different die than the 8051 (mask rom)
it took a few weeks of false starts
under the probe station, i figured out that i could put down a needle on each data bit output right before the transmission gate
the probe for a single data bit lead out to a Saleae logic analyzer along with all the address lines
it took about an hour to get the needle down in the right spot with solid contact, collect the data, and check it for glitches
and so i just repeated that process for every data bit. it took all day!
then i wrote a crappy python script to take each of those 8 very large CSV files and turn them into a ROM image
i was very happy when i saw the creative labs copyright in ASCII text!
then there was the issue of flipped bits, so i needed a way to verify it
after disassembling the ROM, i noticed an undocumented command that fetched the 16-bit checksum of the entire ROM
so i could load my dump into an 8051, program it, and then execute the command and compare the checksum with the one returned by a legit DSP
and they didn't match
turns out there was a bug in their checksum routine that double-counted the byte at location 0 on some 8051s and counted an FF (unimplemented ROM) on others, because their data pointer was allowed to overrun by 1
so i had a good dump. and it did NOT match the chinese firmware! apparently the chinese folks had simply written their own firmware from scratch
which is really impressive, it's not easy to duplicate the behavior of a design like this.
eventually john and i also experimented with a process called a dash etch where you use a special chemical solution to process the die after the top metal layer has been removed
the idea is that it reacts differently with silicon that's been doped, as in an implant layer
and we were able to extract the same ROM image optically
we were also able to extract a hidden 512-byte secret ROM that the 8051 contained and nobody knew about even after all these years
so that was fun. the next project came after i had picked up an IBM PS/2 model 50Z, which used the infamous IBM Micro Channel bus
nobody really used it because IBM charged a licensing fee, unlike ISA
but i had this computer and i wanted a sound card. turns out, the Ad Lib folks made a card for micro channel!
but very, very few were ever made and there's only 2 or 3 known to exist
fortunately there are images on the internet of the front and back
where i ran into difficulty was the PLA: there was a PAL chip on the board
figuring out the function of that was tricky because i got it wrong at first--i thought it just did address decoding. i also wondered why the A0 line ran through it directly to get to the OPL2 chip
and as it turns out, they needed to have a latch in their because the micro channel bus address and data are *pipelined* which means that the address for the next bus transaction gets loaded as the current transaction is still in progress!
*there
that's the story about how i reverse engineered a PAL from photos.
eventually i redid the bus interface using a CPLD which was another huge challenge mostly due to obscure behavior of the micro channel bus
finally, my most recent card design was to take the existing Snark Barker design and adapt it to work with the Micro Channel bus
Were you able to just deduce that they needed the latch based on your understanding of MicroChannel?
yes, i stared at logic analyzer plots for many hours
and it turns out you can build a latch in a PAL by cross connecting NAND gates
with the Snark Barker MCA, i didn't bother with the bus interface chip but instead rolled my own using a CPLD
Okay, cool
this design involved much more *forward engineering* rather than reverse engineering
a particular challenge was getting DMA to work properly which took months
i had to write a test program, and i had to spend a lot of time in front of a logic analyzer. i figured that might happen so i even put three HP logic probe pod connectors on the board!
so after a lot of work, the card works in at least several Micro Channel bus computers
each of IBM's computers seems to implement the bus in slightly different ways, and even Creative Labs had a lot of problems with product support back in the day
for example, due to the way interrupts are implemented in micro channel, cards are allowed to share the level-sensitive interrupt
in contrast, the ISA bus does not allow interrupt sharing
if you write your sound driver properly, you are supposed to allow interrupt handler chaining. but many games didn't do that right, so often a micro channel user will spend a lot of time changing interrupt assignments to try to find something that will work
Seems like the logic analyzer is a central tool for you. What other "desert island" tools do you depend on?
the oscilloscope for sure
but you really have to get more basic than that: desert island tools would be a power supply, multimeter, and oscilloscope
everything after that is really nice to have and can save you time, but you can cheat and use a scope as a logic analyzer
it's just a lot more challenging, particularly with an analog scope
so that story brings us up to where i'm at now
So, in addition to the Snark Barker, you're the mastermind behind the MOnSter 6502, the Three Fives, and the recent COMIX-35? Any chance that a COMIX-35 kit will be available?
for things like that i have to think about how those products would be supported
the 555 and 741 are easy to support, but the more complex stuff gets to be a big challenge. typically i just release those as open source projects and support them when i get time
Interesting. I just read about the COMIX-35 as the result of a recent HAD email message. I have my own 40 year old homebrew 1802 board that I'm getting running again.
the COMIX-35 was kinda a funny story, basically someone on one of the vintage computer forums was selling some 1802-related parts and i realized that he had enough to build a computer. so i bought them on a lark and noticed that the only computer i had all the parts for was the COMX-35
so that turned into a breadboarding exercise, then into a PCB design. the big change was figuring out that i could speed it up by using SRAM and getting rid of the DRAM refresh state machine
the latest retro project is the Graphics Gremlin 8-bit video card
which is turning into a challenge that is about 120% what i thought it would be
so i've been spending many hours in front of GTKWave and the logic analyzer.
mostly because i'm not very good at verilog but i'm using this as a learning opportunity
digital design can be very hard!
the basic idea is a video card that can be programmed for multiple standards, like MDA, CGA, or EGA
and one that will work with both vintage monitors (15KHz, 18.4KHz, 21KHz) and modern VGA compatible monitors (both LCD and CRT)
while at the same time recreating the vintage experience--the MDA, for example, acts exactly like an original MDA card.
@tubetime Have you looked for any video related code that you could leverage, or learn from, at opencores.org?
How would you make card selection? MDA used different memory region than CGA, EGA, VGA etc.
most of the challenge has to do with the ISA bus and the pixel engine trying to access SRAM at the same time
@Kevin yes and no, they've not been all that useful to look at
@MS-BOSS right now it's done by reprogramming the bitstream
i'm thinking about building the USB programmer right into the card so it's super easy to reprogram while installed in an old PC
there's also a switch block on the back but i'm not sure how i'm going to configure the switches yet.
Dual porting memory is interesting and can be tricky getting the timing right. The custom chips in the Amiga interleaved CPU and graphics chip access to memory.
yeah there are a number of tricks
the original MDA card used a counter chip to sequence everything, only allowing ISA bus access to video SRAM during a specific point
Would you also support the composite CGA? That's probably the only reason nowadays why someone would use it for some games.
the CGA card would actually give priority to the ISA bus and would clock out white pixels during that time, which caused the infamous "CGA snow" problem
@MS-BOSS yes that's also the plan
One reason why 6800 / 6809 designs were popular - CPU only accessed the bus on one phase of the main clock
yep! this card design will get more difficult as i go further into the future with regards to standards
MDA and CGA both have 16-bit wide memory onboard, and the pixel engine clocks it out two bytes at a time
my card has to time interleave that because i have an 8-bit wide memory
the EGA card doubles that and uses a 32-bit wide memory
the reason is that it uses 8 pixels per byte and has 4 bit planes
well, up to 4 bit planes. the sequencer, instead of just being a simple hard wired counter, is actually a fancy custom gate array with a bunch of configuration registers in it
so to handle that i have to squeeze in 4 fetches (pipelined address and data) per group of 8 pixels
i think it'll still work the way i'm doing it, but if i want to handle VGA, it won't work anymore
VGA does up to 1 byte per pixel and that gets clocked out at the pixel clock rate (28MHz? 36MHz?)
one way to solve that is with a pixel buffer FIFO
25.175, 28.321 MHz ..
so if you have to pause to handle an ISA bus transfer, the FIFO will pick up the slack
@niksgarage yup, that's it!
the ET4000 super VGA chipset uses the FIFO trick along with many other chipsets and cards in the 90s
then there's a bunch of bonus stuff i'm thinking about for the card
like Hercules support, Tandy video, PCjr video, that sort of thing
the card can also act as a generic RAM card, so for folks who want EMS or XMS, that would be easy
So we're up against our traditional hour limit here, and what springs to mind is how much time all this work must take. We'll let Tube Time get back to it if he has to, or we can keep the chat going -- the Hack Chat is always open!
it could also contain option ROMs. in fact for EGA support it *must* contain the EGA option ROM.
@Dan Maloney thanks, sounds good!
other bonus ideas were turning it into a POST card (but with a VGA output so you can fit all sorts of useful info on screen)
Discussions
Become a Hackaday.io Member
Create an account to leave a comment. Already have an account? Log In.