In this scope shot, a lower delta-I means a higher current draw by the MMC5. About 200 nsec after the rising edge of M2, something else has a small current spike. This current spike is large with registers $5000 and $5002 and small with registers $5020 and $5001. Comparing $5020 directly to $5001, they are the same. The scope shot compares $5020 ("valid address" signal high: invalid) to $5002 (valid address signal low: valid). Valid address is just an extra pin I am setting on the dsPIC. Also seen in the screenshot is CPU A1, demonstrating acceptable pull-up on address bus now that I changed that to 1k pull-ups today. The screenshot is a 512 sample average. I am triggering on my valid address signal. To verify that this difference is not an artifact of averaging or triggering somehow, I inverted the valid address signal, and spike still followed the valid address, i.e. the spike was present when valid address was high in that case.
This looks promising so far, will continue experimenting this evening.
Update:
This IS a highly effective way to see what registers are writable! I have found these registers to be writable:
5000
NOT 5001 (Confirms what we suspected, no pulse sweep unit)
5002
5003
5004
NOT 5005 (Confirms what we suspected, no pulse sweep unit)
5006
5007
5010
5011
5015
Unfortunately, nothing else until $5100
5100
5101
5102
5103
5104
5105
5106
5107
NOT 5110-5112 (Confirms what we suspected)
5113
5114
5115
5116
5117
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
512A
512B
NOT 512C-512F (Formally ending any remaining suspicion from my buggy tests from before)
5130
5200
5201
5202
5203
5204
5205
5206
5207 (Confirming this unknown register very likely exists)
5208
5209
520A
To do this, I set my scope in 8-sample average mode, running. I ran the same test with the invalid address and the valid address, but I added an I2C command that could change the valid address. In the GUI on my computer, I added a text box and button that would send a new address. The address auto-incremented after clicking the button. So I was able to keep clicking the button and watching the scope to test series of addresses efficiently. I found it best to set 1 horizontal cursor to the bottom of that magic dip on an invalid address and the other cursor to the flat spot right before it. Because the whole waveform shifts up and down slightly depending on the address, I would visually compare the distance between the cursors to the waveform. Anything larger than the cursors is writable. Addresses with only 1 or 2 writable bits had smaller but still detectable dips.
I tested all addresses in the range $5000 - 5250. I also tested these ranges and found nothing:
$5300-5310
$5400-5410
I tested $5800-5812 and they all DID have activity, similar to register $5204 with only 1 bit, for example. I then tested $5A00, it also behaved this way. I then tested $5C00, and it TOO behaved this way. This seems to suggest that RAM could exist in the entire range $5800-5FFF.
Next, I will experiment with the data written. Right now, I am alternating between writing $FF and $00. I will see if I can toggle just 1 bit at a time and see if I can tell which specific bits are writable.
Edit:
I am not able to tell any difference for individual bits. It seems that the current spike does not depend on the data written, only the number of writable bits. I will measure the deflections for each known register to get a rough idea how many bits are writable, but it won't tell us "which" bits. Also, some registers have a great big disturbance when written, presumably I trigger a bankswitch that changes lots of outputs or something. I recorded great big disturbances from writing to these registers:
5101
5105
5116
512B
5205
5206
I may be able to just always write the same value though instead of alternating $00 to $FF, and it may prevent this from happening. Will try it.
Edit:
There is not a strong correlation between number of writable bits and deflection when writing only $00 (9 bits being used to show "unknown"):
Reviewing this data, it suggests that $5208 (CL3 / SL3 Status) is in fact writable. That is fairly interesting.
$5207 (the unknown one) draws a healthy amount of current, I would speculate that it is more than just a 1 or 2 bit register. $5003 and $5007 drew a lot, presumably they are starting pulse channels. $5209 drew a lot, it is starting the timer.
Code: Select all
Reg Known Bits mV
5020 0 7.6
5000 8 9.16
5002 8 9.08
5003 8 14.08
5004 8 9
5006 8 8.88
5007 8 14.16
5010 2 8.56
5011 8 8.96
5015 2 8.6
5100 2 8.44
5101 2 8.24
5102 2 8.36
5103 2 8.28
5104 2 8.44
5105 8 8.64
5106 8 8.52
5107 2 8.16
5113 4 8.52
5114 8 8.6
5115 8 8.6
5116 8 8.76
5117 7 9.44
5120 8 9.52
5121 8 9.52
5122 8 9.48
5123 8 9.44
5124 8 9.44
5125 8 9.44
5126 8 9.36
5127 8 9.52
5128 8 9.04
5129 8 9.04
512A 8 8.92
512B 8 9.24
5130 2 8.52
5200 7 9.52
5201 8 9
5202 8 8.92
5203 8 8.72
5204 1 8.4
5205 8 8.84
5206 8 8.84
5207 9 9.32
5208 9 8.6
5209 8 11.64
520A 8 9.84
New findings!
Writing random data to $5207 makes CL2 and SL2 outputs and toggling around. Will try to define exactly what is happening.
Edit:
==== CL3 / SL3 Data Direction and Output Data ($5207 write only) ====
Code: Select all
7 bit 0
---- ----
ABxx xxCD
|| ||
|| |+- SL3 Output Data
|| +-- CL3 Output Data
|+-------- SL3 Data Direction (0 = output, 1 = input)
+--------- CL3 Data Direction (0 = output, 1 = input)
Edit:
There is more to this. When I set $5207 bits 0 and 1 to both = 0, then write randomly to $5208, SL3/CL3 dance around. More to be done here.
Edit:
I updated the wiki:
CL3 / SL3 Data Direction and Output Data ($5207 write only)
Code: Select all
7 bit 0
---- ----
ABxx xxCD MMC5A default power-on write value = 11xx xxxx
|| ||
|| |+- MMC5.97 (CL3) Output Data (0 = output $5208.6 value written, 1 = output 1)
|| +-- MMC5.98 (SL3) Output Data (0 = output $5208.7 value written, 1 = output 1)
|+-------- MMC5.97 (CL3) Data Direction (0 = output, 1 = input)
+--------- MMC5.98 (SL3) Data Direction (0 = output, 1 = input)
Write
Code: Select all
7 bit 0
---- ----
ABxx xxxx MMC5A default power-on write value = 00xx xxxx
||
|+-------- Value to be output on MMC5.97 pin (CL3) if/when $5207.0 = 0 and $5207.6 = 0
+--------- Value to be output on MMC5.98 pin (SL3) if/when $5207.1 = 0 and $5207.7 = 0
Code: Select all
7 bit 0
---- ----
ABxx xxxx
||
|+-------- Input value of MMC5.97 pin (CL3)
+--------- Input value of MMC5.98 pin (SL3)