Need help reviving a hkt-0120 (on various levels): GD-M, OS mode, Jumper settings?

[T_chan]

Cool, thx for the info !
Did you manage to send data to the DA board ?

Of course I tried to send CROSS & other things, but there was no reaction at all.
It looked as if no input was accepted at all.
But I just connected 1 pin to send the data, nothing else in fact. (my guess would be that it would be pin 8)

So the last thing I thought was that I might have to also provide a clock or another signal when I send data, or that the sending of the data needed to be synchronized to a certain clock.
So I started looking at the JTAG protocol, saw that JTAG seemed indeed to need to be synchronized with another pin (TCK) to send data,
but I stopped there to focus on other things...

 

[Ioncannon]

@MetalliC Cool, another pin found and the secret password! Though there isn't really any reason to change that info. Interesting, I assumed the password was needed to get into ALL debug options.

Yeah I tried sending data like @T_chan did and nothing caused a response. There was a bunch of interesting things underneath that you could change iirc but I'd be careful with it.

 

[Ioncannon]

Interesting there is a spot for a switch to solder on as well.

 

[MetalliC]

Cool, thx for the info !
Did you manage to send data to the DA board ?

Of course I tried to send CROSS & other things, but there was no reaction at all.
It looked as if no input was accepted at all.
But I just connected 1 pin to send the data, nothing else in fact. (my guess would be that it would be pin 8)

I don't have real Katana/DA, but having fun with its firmware disassemble and analysis

I think I see that's going on there, at boot serial 'SCI' port receive disabled by default, and NMI handler is not that useless as it looked at 1st sight. it looks like there needed to:

• generate NMI to DA SH-2 (connect J4 to gnd for a short time), this will enable SCI receive.
• send CROSS to serial

after this, serial debug expected to work in full its glory

 

[Ioncannon]

I don't have real Katana/DA, but having fun with its firmware disassemble and analysis

I think I see that's going on there, at boot serial 'SCI' port receive disabled by default, and NMI handler is not that useless as it looked at 1st sight. it looks like there needed to:

• generate NMI to DA SH-2 (connect J4 to gnd for a short time), this will enable SCI receive.
• send CROSS to serial

after this, serial debug expected to work in full its glory

Nice, something to test once I finish my move. Once setup again, need to try loading Dev.CAS firmware again and see if I can get it to work.

You don't see any crazy lockout if one enters the password wrong, right @MetalliC ?

 

[MetalliC]

You don't see any crazy lockout if one enters the password wrong, right @MetalliC ?

no, it will wait forever for correct text sequence

 

[T_chan]

Hmmm... I think I tried that (generate interrupt, and then send CROSS via pin 8)...
maybe I did something wrong... (or I don't remember correctly)
I might give it a try if I get the courage to make place on my desk & disassemble the devkit again...

 

[MetalliC]

Hmmm... I think I tried that (generate interrupt, and then send CROSS via pin 8)...
maybe I did something wrong... (or I don't remember correctly)
I might give it a try if I get the courage to make place on my desk & disassemble the devkit again...

perhaps something else was wrong ? like serial port config, it should be 38400 8N1 (8 data bits, no parity, 1 stop bit), but as I see you've said at prev page 7 data bits.

 

[T_chan]

it should be 38400 8N1 (8 data bits, no parity, 1 stop bit)

Are you sure about this ?
Amongst my notes, I have a dump of a log (without any garbage characters) that I created & that litteraly has the name xx_38400_7bits_evenparity_1stopbit.txt, so normally that was the setting that I would have been using then...

 

[MetalliC]

Are you sure about this ?

yes, DA code set SH-2's SCI "Serial Mode Register" to 0 (hard coded constant value, not alterable/variable). SH7095 and SH7604 datasheets says this means 8N1 async mode.
it is like that at least in genie.fsh from Katana R11a, but I doubt it will differ in other versions

PS: if being precise - serial port configured to ~36877 baud (XTAL/128 / 6)

 

[T_chan]

Cool, thanks for the info !

You got me motivated to disassemble my devkit this week-end
(no promises though... ^_^)

 

[MetalliC]

@T_chan that will be interesting task for sure
I've also checked GD-M code and it have similar serial debug console. same thing but not require NMI, just send "CROSS" code word to it.

 

[T_chan]

Good news & big thanks to MetalliC !

I connected a UM232R to my DA Board again, with the following settings:

• 8N1
• DA Board - Main Debug J6 pin (TXD) -> UM232R RXD (DB1) pin (blue cable on the picture)
• DA Board - Main Debug J8 pin (RXD) -> UM232R TXD (DR0) pin (white cable on the picture)
• DA Board - Main Debug J10 pin (GND) -> UM232R GND pin (black cable on the picture)
• J1 of the UM232R was put on pins 2-3 (5V)
• J2 of the UM232R was connected

I used Minicom on Ubuntu, but Putty on Windows should work as well.

Booting the devkit (the DA board & main motherboard were not connected) outputs this:

DA Boot
Configure BSC
Configure cache
Test DRAM
Call main()
Flash Protection Check
Manufacturer Code = 04, Device Code = a4

RELEASE VERSION
Version : 4.9.0a
Built : May 11 2000, 08:52:57
Product ID : KATANA
Model ID : DEBUG ADAPTER
SerialNumber : pcsu02395
Test Date : 1998-05-12

Running idle process
Start 1k load
Reset line low but failed to go high.
Type 'CROSS' to enable debug support.

I then connected Main Debug J4 pin to GND for a brief moment, and it gives this:

Enter Password...

You can then type 'CROSS' or 'cross', doesn't matter - no enter/return/newline is needed, it immediately shows this:

Press ? for menu.

A few examples:

If you type 'h'- "Channels usage info":

Channels usage information.
Buffer 0 Channel 0 DA --> Console, OS. Used 0 Free 131072
Buffer 1 Channel 0 DA <-- Console, OS. Used 0 Free 131072
Buffer 2 Channel 1 DA --> Console, file server. Used 0 Free 131072
Buffer 3 Channel 1 DA <-- Console, file server. Used 0 Free 131072
Buffer 4 Channel 2 DA --> Console, sound tools. Used 0 Free 131072
Buffer 5 Channel 2 DA <-- Console, sound tools. Used 0 Free 131072
Buffer 6 Channel 3 DA --> Console, unassigned. Used 0 Free 131072
Buffer 7 Channel 3 DA <-- Console, unassigned. Used 0 Free 131072
Buffer 8 Channel 4 DA <-- Console, profiling. Used 0 Free 2097152
Buffer 9 Channel 5 DA <-- Console, unassigned. Used 0 Free 524288
Buffer a Channel 6 DA <-- Console, block temp. Used 0 Free 131072

If you type 'd' - "Pseudo dip switches":

DIP1 DIP2 DIP3 DIP4 DIP5 DIP6 DIP7 DIP8
OFF OFF OFF OFF OFF OFF OFF OFF

Press '1-5' to toggle DIP, '?' for info...?

If you then type '?' for extra info:

Pseudo DIP switch assignments LED assignments (Cross LED card)
----------------------------- --------------------------------
DIP 1 - Packet info (shortform). LED 1 On - SCSI activity quiescent.
DIP 2 - Packet info (full). Off - SCSI activity in progress.
DIP 3 - JTAG Scan details. LED 2 On - SH4 Game running.
DIP 4 - SCSI packet RX/TX dump. Off - SH4 in the monitor.
DIP 5 - Auto flush profile buffer. LED 3 On - BIOS/STAT command in progress.
DIP 6 - Temporary test usage. Off - BIOS/STAT activity quiescent.
DIP 7 - Temporary test usage. LED 4 On - STUB command in progress.
DIP 8 - Temporary test usage. Off - STUB activity quiescent.

Cool stuff
Now understanding what is useful when a DA board has problems, that's a next step

(Note: I did not test the CDM Debug pins yet, as I got an error in loop - maybe I need to connect a drive, or it's my DA board that has a problem)

 

[MetalliC]

@T_chan cool! thanks for testing this, glad to see expected results.
as of password mentioned earlier - the rabbit hole there even deeper to access EEPROM routines there should be sent hex value 0x11 and then 0x05 or 0x06 for EEPROM erase or configure menu respectively, where it will be waiting for another password - "27071961"

 

[Ioncannon]

Nice! Looks like there are a bunch of memory viewing and debugging functions for the DA? Which are redundant since you can do it over scsi but might give you an idea where something fails. Also just realized you are loading the debug adapter barebones, that's pretty cool! I guess it is just powered by the moltex connector?

Interesting it still works without the Dreamcast board connected.

 

[Ioncannon]

Also looking at old photos of a ripped open Dev.CAS....

I spy what might be a JTAG connector: http://i485.photobucket.com/albums/rr216/shadowfamicomdev/dcdev221.jpg

 

[Ioncannon]

Good news & big thanks to MetalliC !

I connected a UM232R to my DA Board again, with the following settings:

• 8N1
• DA Board - Main Debug J6 pin (TXD) -> UM232R RXD (DB1) pin (blue cable on the picture)
• DA Board - Main Debug J8 pin (RXD) -> UM232R TXD (DR0) pin (white cable on the picture)
• DA Board - Main Debug J10 pin (GND) -> UM232R GND pin (black cable on the picture)
• J1 of the UM232R was put on pins 2-3 (5V)
• J2 of the UM232R was connected

View attachment 9855 View attachment 9856

I used Minicom on Ubuntu, but Putty on Windows should work as well.

Booting the devkit (the DA board & main motherboard were not connected) outputs this:



I then connected Main Debug J4 pin to GND for a brief moment, and it gives this:



You can then type 'CROSS' or 'cross', doesn't matter - no enter/return/newline is needed, it immediately shows this:


View attachment 9860

A few examples:

If you type 'h'- "Channels usage info":



If you type 'd' - "Pseudo dip switches":



If you then type '?' for extra info:



Cool stuff
Now understanding what is useful when a DA board has problems, that's a next step

(Note: I did not test the CDM Debug pins yet, as I got an error in loop - maybe I need to connect a drive, or it's my DA board that has a problem)

Your error loop is probably due to a missing HDD. My devkit did that while the drive connection was faulty.

 

[T_chan]

Nice! Looks like there are a bunch of memory viewing and debugging functions for the DA? Which are redundant since you can do it over scsi but might give you an idea where something fails. Also just realized you are loading the debug adapter barebones, that's pretty cool! I guess it is just powered by the moltex connector?

Interesting it still works without the Dreamcast board connected.

Yes, DA only connected via the Molex power connector & the "Main Debug" pins.
Easier for me, since I need to disassemble the DA board from the metal case to access the pins...

 

[Nolaw]

So I finally received my UM232 today, here are my results (not so much so far)

DA which came with the SET4:

RELEASE VERSION

Version : 4.9.0a
Built : May 11 2000, 08:52:57
Product ID : KATANA
Model ID : DEBUG ADAPTER
SerialNumber : pcch20795
Test Date : 1998-07-27
Running idle process
Start 1k load
1K stub loaded.
Console boot ROM called.
Waiting for response from the console.
Time in boot ROM 1838 mS.
Full stub loaded @ 0xac004000.
CPU debugging, in the monitor.
Type 'CROSS' to enable debug support.

But then nothing happens...

The DA which came with the original Set5 (and doesn't properly work with the GDM) shows me the attached picture


So on both of these, where do I go now? I haven't figured out on how to do display the system info @T_chan mentioned originally.

1. DA from Set4 let's me get to the menu without asking for a password
2. DA from Set5 doesn't seem to let me enter the password. Even if I touch J4 with GND briefly and it shows me the field "Enter password..." it doesn't seem to react to anything

But at least I get some readable output now

 

[T_chan]

(do the pictures/dump match your text ? I would think the picture is for the SET4, since it's an older version & you get to the debug options)

2 things I can think of:
1) I suppose you left the DA board in the SET5 connected to the main board ?
I did my tests without the connection to the main board, that might influence things I suppose...
2) did you try to execute an option of the debug menu on the SET4 board, to see if your input is recognized/configured correctly ? (since it's not even asking you to type 'CROSS')