Fixing my Milan 040 (or not) blog

[SteveBagley]

I found the piece I read last summer on how the Milan boots (from https://www.uweschneider.de/en/projects_milan.php), suffice to say the Milan boot is a lot more involved than an ST's…

The big challenge: starting up the system.

Before the processor can execute it's first byte of code the whole hardware needs to be up and functional.

The processor needs to become busmaster of the local bus, the PLX needs to feel responsible to pass the request to the PCI bus, become busmaster of the PCI bus, access the ISA bridge and the ISA bridge needs to split up the 32 bit request into four 8 bit accesses to reach the Flash memory connected to the 8 bit part of the ISA bus.

As additional challenge an Intel processor (normally using an Intel ISA bridge) works in little endian mode searching the boot code at the address 0xFFFF0 and a Motorola processor works in big endian mode searching the boot code at address 0.

And all this effort to use a low priced 8 bit Flash memory. At runtime the whole operating system is copied into the main memory to be executed with 32 bit at full speed.

[exxos]

Yeah Uwe wrote about it here viewtopic.php?p=130157&hilit=Uwe#p130157

The configuration bits are not loading into plx as the address is wrong.

The PLX should get 0x00000000 and the second word is the reset vector 0x00000090, which is at the start of flash. But flash has the wrong address and just puts 11111111 on the bus each cycle.

[exxos]

Uwe replied.

Except for the PLX I used normal PC components to build the Milan. The
8086 fetches the Bootvector from the end of the address space and the,
Freescale aka Motorola 68040 fetches the vector from the beginning of
the address space.

To get a Freescale processor running on a PC environment needs some
persuasion. So the PLX is preprogrammed via EEPROM to translate
0x0000000 Big endian 32-Bit access into little endian 0xFFFF0000 on the
PCI bus.

This address on the PCI bus tells the ISA bridge to access the flash in
8-Bit chunks at ISA address 0xF0000 which is on the end of the original
1MB PC address space.

After startup the Milan reprograms the PLX and the ISA bridge to get
full access to the flash and after checking the RAM and the TOS
checksum it copies the TOS into the RAM and starts is.

So in the flash the first 7x64kByte sectors are the TOS and the last
64k sector is the bootblock.

The last statement seems interesting.. Because the flash has the bootblock at address zero.. There is nothing at $70000 which is the flash address..

1.PNG

2.PNG

So now it sounds like booktblock *should* be higher up, and TOS image should be at address zero :shrug:

[dml]

The last statement seems interesting.. Because the flash has the bootblock at address zero.. There is nothing at $70000 which is the flash address..

Did someone maybe try to fix this machine by flashing that chip and getting it wrong? Is that possible? I'm not clear on whether that flash is one of the socketed ICs or if there's a way to flash it from a board that may already be in a nonworking state. If its socketed then its possible? Or the description of whats in the flash & where may be wrong.

If you can read the flash and all locations look distinct without dupes, the problem could be one of those two ^^^

[exxos]

Did someone maybe try to fix this machine by flashing that chip and getting it wrong? Is that possible?

With a programmer its possible yes. Though I doubt it was me who did that 20 years ago as I wouldn't have had a programmer to read flash.

I'm not clear on whether that flash is one of the socketed ICs or if there's a way to flash it from a board that may already be in a nonworking state. If its socketed then its possible? Or the description of whats in the flash & where may be wrong.

Its just a 8bit PLCC flash. I verified its contents was good with the bootblock image file a few days ago..

If you can read the flash and all locations look distinct without dupes, the problem could be one of those two ^^^

From what I can guess, TOS needs to be at the start of the flash, and the bootblock at likely address $70000.

I think maybe this "format" isn't mentioned anywhere.. I think Uwe wrote ST programs to flash updates.. but it doesn't help when you cant boot the machine ;)

It would explain why we basically have a 040 flash with only 27KB of data :)

Qwe said

So in the flash the first 7x64kByte sectors are the TOS and the last 64k sector is the bootblock.

Currently I have the boot block at the start of the flash and nothing else...

[exxos]

I created a new image which I think is how it's supposed to be... However I cannot seem to erase the flash in my programmer :cry: :cry:

Capture.PNG

[Badwolf]

This is an interesting thread! Good luck getting it sorted out.

I shall keep an eye on it as I know very little about the Milan.

BW

[exxos]

This is an interesting thread! Good luck getting it sorted out.

I shall keep an eye on it as I know very little about the Milan.

I know nothing either :lol:

[exxos]

Looks like my TL866 behaves better :)

Capture.PNG

2.PNG

[SteveBagley]

Just had a look at 'flash.tos' flash programmer for the Milan in Ghidra, it appears to have a mode to read both TOS and the boot block from the flash and write it to disk. That code path reads 0x70000 bytes from 0x7ff80000 as the TOS image, and 0x10000 bytes from 0x7fff0000 as the boot block, so combining TOS and the Boot block in that order looks like it should work.

Note there's code in the bootblk to decompress the TOS part of the flash ROM image.

Steve