Reversing a PCI interface without blowing up my LA - Page 1
Forum section: electronics / testgear

author: keitheevblog
author_rank: Regular Contributor
timestamp: January 16, 2020, 08:33:56 pm
content: I'm reverse engineering a 32-bit 5v PCI interface from a proprietary industrial-motherboard-like computer from the circa-late 90s. It has a non-standard connector Hirose FX2 on it. I'm planning on using a custom PCB of my design to wire that interface to connectors appropriate for my logic analyzer, so that I can confirm pinouts, observe the PCI data/transactions, and just generally mess around.How can I avoid accidentally blowing up my logic analyzer and/or the DUT, due to improper wiring on the conversion PCB? What's my biggest risk here?I've got a pretty good idea about the majority of the mapping of the pins, from proprietary to standard PCI names. This has been quite a bit of work so far, in the absence of proper schematics of my computer and the single compatible card that I have.Using a scope, I've broken the pins down into a few different categories:Static voltage +3.6v to +3.8v: This seems too high to be 3.3v, even unloaded. I don't intend on using these pins in the final application, but do want to wire them to the LA for further scrutiny.Static voltage +5.3v to +5.5v: Appears to be 5v supply lines, I'm a little bit surprised to see them quite that high?Data/control pins: visible transitions happening during a transferGround pins: Always observed at 0v.Since there's no voltages beyond ~5.5v, I don't think there's a risk to connecting any pins to data-input-pins on the logic analyzer.My largest worry is that I'll accidentally connect an output-from-mobo data pin to ground, thereby shorting out the DUT.If I can confirm at least one ground pin, and then verify that all the other pins I've identified as ground have low-resistance paths to that pin, is that sufficient? With both the DUT and the card, done separately, ensure that all supposed ground pins are connected together? What's the maximum resistance I should be seeing between directly connected grounds?Can I employ some type of protection between the FX2 port and the logic analyzer in terms of port protection? The LA configuration does include a 100k ohm termination adapter, which is a 100k and 250 ohm in-line resistor with 4pf and 8pf capacitors on either side of the 250ohm one for each pin.What other risks am I not seeing?Thanks

author: nctnico
author_rank: Super Contributor
timestamp: January 16, 2020, 09:37:54 pm
content: I wouldn't worry too much. As long as you don't connect 3.3V I/O lines to 5V you can't really break anything.

author: RoGeorge
author_rank: Super Contributor
timestamp: January 16, 2020, 09:56:08 pm
content: With those Hirose FX2 connectors, are you sure it's a PCI and not a SCSI interface?

author: keitheevblog
author_rank: Regular Contributor
timestamp: January 16, 2020, 10:21:42 pm
content: Quote from: RoGeorge on January 16, 2020, 09:56:08 pmThanks for the reply!Yes, the only compatible card I have has a PCI MatchMaker S5933QE chip wired directly to that FX2 interface. The motherboard, which is loosely based on an HP Visualize B132/B160L workstation, has a GSC-bus to PCI-bus converter chip called DINO very close in proximity(nearby underneath) of the FX2's. There are other compatible cards, including a fast ethernet card. It has a Intel 21143PD chip --- which also only speaks PCI.By using the datasheet of both chips, some physical RE'ing of determining which FX2 pin connects to which pin on the S5933QE, I'm able to determine which pin is which.

author: thm_w
author_rank: Super Contributor
timestamp: January 16, 2020, 11:52:30 pm
content: Quote from: keitheevblog on January 16, 2020, 08:33:56 pmSometimes thats normal so when the supply rail is heavily loaded when operating, it will drop to ~5V at the chip.QuoteCorrect, should be <1 ohm.Look for large capacitors on the card, negative would almost certainly be ground. Then you can continuity check those to the pins to ground.

author: gslick
author_rank: Frequent Contributor
timestamp: January 17, 2020, 01:28:16 am
content: Quote from: keitheevblog on January 16, 2020, 10:21:42 pmThis is what I have so far on the PCI board J5 FX2 connector. Compare this against what you have found. If there are any differences I can go back and check again. From a quick look it appears that the PCI board draws power from the J6 FX2 connector, although I am not sure about that (the J9 FX2 connector is not populated on the 16600A version of the PCI board so power isn't coming from there).Code:1 512 52CLK 3 53Ground 4 54 Ground5 55RST# 6 56 INTA#7 57 LOCK#REQ# 8 58Ground 9 59 GNT#FRAME# 10 60 PERR#11 61 TRDY#PAR 12 62 GroundC/BE0# 13 63 C/BE1#Ground 14 64 C/BE2#C/BE3# 15 65AD31 16 66 AD3017 67 AD29AD28 18 68 GroundAD27 19 69 AD26Ground 20 70 AD25AD24 21 71AD23 22 72 AD2223 73 AD21AD20 24 74 GroundAD19 25 75 AD18Ground 26 76 AD17AD16 27 77AD15 28 78 AD1429 79 AD13AD12 30 80 GroundAD11 31 81 AD10Ground 32 82 AD09AD08 33 83AD07 34 84 AD0635 85 AD05AD04 36 86 GroundAD03 37 87 AD02Ground 38 88 AD01AD00 39 89STOP# 40 90 SERR#41 91IRDY# 42 92 DEVSEL#Ground 43 93 Ground44 9445 95Ground 46 9647 97IDSEL 48 9849 9950 100

author: keitheevblog
author_rank: Regular Contributor
timestamp: January 17, 2020, 03:28:02 am
content: Thanks for doing this.I agree about power coming from somewhere else. I also traced FX2-95 to U32, that inverter. I think that might feed some other master reset controller that then in turn feeds S5933-139.Your pinout matches mine bang on!! Perfect, except for these two, which I'm still undecided, but this is how I'm leaning.I think FX2-95 is RST# and FX2-6 is a PCI-PRSNT# because:* My FX2-6 tied to ground through a 21.5kohm resistor to FX2-4, which is a ground pin. (see attached photo) If RST# is an active low signal, shouldn't it be pulled up to +5v?* The PCI standard for PRSNT# signals is active low so being permanently tied to ground makes sense.* Pin FX2-95 on the fast ethernet card gets routed across the board, and then on the other side makes its way very close to LXT970A-16, which is an active low reset signal(!!)* Pin FX2-95 is held high to +5.5v normal active use. With FX2-6 being ground, ofc.Is your pin FX2-4 and FX-6 strapped together like that? Wouldn't that config keep the PCI interface in permanent reset if RST# was pin 6?Thanks againKeithP.S. Sorry lots of edits.....

author: gslick
author_rank: Frequent Contributor
timestamp: January 17, 2020, 04:49:37 am
content: On the 16600A version of the PCI board that I have pulled out for probing I measure around 0.2 Ohm between the S5933 RST# Pin 139 (if I have counted the pins correctly) and the J5 FX2 connector Pin 6 using my handheld DMM.On that 16600A (1997) version of the PCI board, and on one 16700A (1998) and one 16700B (2000) version for which I took photos in the past there is no resistor added between the J5 FX2 connector Pins 4 and 6.On another 16700A (1999) version of the PCI board I do see a resistor added between J5 FX2 connector Pins 4 and 6 now that I took a look at the photo I have for that one. From the straight on angle of that photo I can't see the markings on the side of that component.Curious, I wonder what might be going on there.----------Another unrelated thing I noticed while looking at the PCI board photos is that there appears to be a set of configuration resistors connecting two pins of the Altera EPM7032 CPLD U14 (the part with the 16600-89006 sticker) to either ground or +5V. Those two pins are set differently between the 16600A, the 16700A, and the 16700B versions. That isn't surprising to see something like that as the three versions are populated differently.The 16600A version is missing the U5 AMI 1821-0482 and U6 AMCC 1820-0020A gate arrays / ASICs, and the U9 Xilinx XC4010E FPGA. It is also missing the J9 FX2 connector, but the J8 connector is populated, that is where the PS/2 ports are connected to the rear panel in the 16600A.The 16700B version is missing the J4 10B2 Ethernet BNC connector, the U4 1820-7730 PHY, and the U3 S553-1006-AE isolation transformer.

author: gslick
author_rank: Frequent Contributor
timestamp: January 17, 2020, 09:45:48 pm
content: Here is an updated list of the FX2 connector pins with the +5V pins added. This list of +5V pins was determined by checking continuity between the +5V rail on the CPU board and the pins of one of the FX2 connectors on the CPU board. The CPU board was removed from the analyzer and not connected to anything else at the time.From a quick look at the PCI board none of these +5V pins appear to be connected to each other or anything else on the PCI board, it is powered from a different connector.Code:1 51+5V 2 52 +5VCLK 3 53Ground 4 54 Ground5 55RST# 6 56 INTA#+5V 7 57 LOCK#REQ# 8 58 +5VGround 9 59 GNT#FRAME# 10 60 PERR#+5V 11 61 TRDY#PAR 12 62 GroundC/BE0# 13 63 C/BE1#Ground 14 64 C/BE2#C/BE3# 15 65 +5VAD31 16 66 AD30+5V 17 67 AD29AD28 18 68 GroundAD27 19 69 AD26Ground 20 70 AD25AD24 21 71 +5VAD23 22 72 AD22+5V 23 73 AD21AD20 24 74 GroundAD19 25 75 AD18Ground 26 76 AD17AD16 27 77 +5VAD15 28 78 AD14+5V 29 79 AD13AD12 30 80 GroundAD11 31 81 AD10Ground 32 82 AD09AD08 33 83 +5VAD07 34 84 AD06+5V 35 85 AD05AD04 36 86 GroundAD03 37 87 AD02Ground 38 88 AD01AD00 39 89 +5VSTOP# 40 90 SERR#+5V 41 91IRDY# 42 92 DEVSEL#Ground 43 93 Ground44 9445 95Ground 46 9647 97IDSEL 48 9849 9950 100

author: keitheevblog
author_rank: Regular Contributor
timestamp: January 17, 2020, 10:27:44 pm
content: Thanks for the update.I'm guessing you didn't see +5v on 1, 51, or 53? I'm measuring +5.5V on those during active use......I'm also seeing +3.6-3.8v on 5, 44, 47, 94, and 97. Many of your missing pins is this lower voltage (rail?)Perhaps it's the closet romantic in me coming out in old age, but isn't the layout of this FX2 pinning absolutely beautiful? So perfectly ordered? Especially the section of pins between 11 and 89 on both sides of the connector?You get groups of 6+5v, data, data, gnd, data, data.+5v, data, data, gnd, data, data...... and so on....like 10 or 12 groups like thatand the data/address bus going in order from AD31 down to AD0, alternating sides. 30,29, other side 28,27, other side 26,25, other side 24,23.So cool!@!@#The layout almost is in itself built in documentation, like XML almost, that the form of it ensures the correctness. I know there are rules about evenly laying out grounds to prevent "charge dumping" (just heard this term) and similar ideas for the power rails.It only gets messy at the ends of the connector, where there's more variability and less grouping/structure.

author: gslick
author_rank: Frequent Contributor
timestamp: January 17, 2020, 11:39:26 pm
content: Quote from: keitheevblog on January 17, 2020, 10:27:44 pmI should have checked for the +3.4V rail (as labeled on the 16600A power supply, not measured) before you asked. I went back and did that. Again this was checking for continuity from the power supply output to the FX2 pins. I first traced from the power supply outputs to the power supply connector on the 16600A acquisition board, then through the acquisition board to the connectors where the CPU board plugs into the acquisition board. The +5.1V rail feeds through connector J3 and inductor L4 on the CPU board, the +3.4V rail feeds through connector J3 and inductor L3 on the CPU board. Note that this was on the layout of the CPU board with L1, L2, L3, L4 in a single row. I didn't check on the version of the CPU board with L1, L2, L3, L4 in a 2x2 layout.With the CPU board not connected to anything else I found continuity between the +3.4V rail at inductor L3 on the CPU board and pins 5, 55, 44, 94, 47, 97, 49, 99 of the FX2 connector on the CPU board.I also found continuity between ground and pins 50 and 100 of the FX2 connector on the CPU board but not on the PCI board.I haven't checked any of the FX2 pins while the analyzer was powered up and don't know anything about pins 1, 51, 53 yet.Code:1 51+5V 2 52 +5VCLK 3 53Ground 4 54 Ground+3.4V 5 55 +3.4VRST# 6 56 INTA#+5V 7 57 LOCK#REQ# 8 58 +5VGround 9 59 GNT#FRAME# 10 60 PERR#+5V 11 61 TRDY#PAR 12 62 GroundC/BE0# 13 63 C/BE1#Ground 14 64 C/BE2#C/BE3# 15 65 +5VAD31 16 66 AD30+5V 17 67 AD29AD28 18 68 GroundAD27 19 69 AD26Ground 20 70 AD25AD24 21 71 +5VAD23 22 72 AD22+5V 23 73 AD21AD20 24 74 GroundAD19 25 75 AD18Ground 26 76 AD17AD16 27 77 +5VAD15 28 78 AD14+5V 29 79 AD13AD12 30 80 GroundAD11 31 81 AD10Ground 32 82 AD09AD08 33 83 +5VAD07 34 84 AD06+5V 35 85 AD05AD04 36 86 GroundAD03 37 87 AD02Ground 38 88 AD01AD00 39 89 +5VSTOP# 40 90 SERR#+5V 41 91IRDY# 42 92 DEVSEL#Ground 43 93 Ground+3.4V 44 94 +3.4V45 95Ground 46 96+3.4V 47 97 +3.4VIDSEL 48 98+3.4V 49 99 +3.4VGround 50 100 Ground

author: keitheevblog
author_rank: Regular Contributor
timestamp: February 09, 2020, 02:11:59 am
content: I wanted to provide everyone an update on how this is going!https://www.gerblook.org/pcb/ACqzxyHRrQxrpfGTqXF5MSHere is a prototype circuit board design that will allow the HP 40-pin logic analyzer connections to connect, through the 100k ohm termination adapter to 20-pin, to connect to the 100-pin TE/AMP CHAMP 050 series connectors.This will allow me to connect my 16900 to the PCI connectors of my 16700. So that I can logic analyze my logic analyzer! And eventually use off-the-shelf PCI cards in my 16700.....Ordering soon.....fingers crossed I don't blow anything up!If it's not obvious, Glen Slick has been super helpful during this process! Thanks Glen! If you're not getting my emails, please let me know!

author: gslick
author_rank: Frequent Contributor
timestamp: February 09, 2020, 02:50:40 am
content: How does your adapter board map the PCI bus signals to the 01650-63203 termination adapter signals?Are you mapping AD[15::0] to channels 15:0 of one pod, and AD[31:16] to channels 15:0 of another pod?How about the rest of the PCI bus signals? If the rest of the PCI bus signals could be mapped in the same order as the FuturePlus FS2000 PCI bus probe maps them for the STAT label maybe the IA for the FS2000 could be used for your adapter board.

author: keitheevblog
author_rank: Regular Contributor
timestamp: February 09, 2020, 03:20:19 am
content: Quote from: gslick on February 09, 2020, 02:50:40 amIn probably a much more simple way than you're imagining.I route some of the grounds to a large ground zone fill, and to pin 20 on those adapters.I route the clock signal to pin 3 on those adapters.I map all of the remaining signals, in order, from 1-100 (excluding the used ground pins) to the data pins on the adapters in order.QuoteI really didn't do any logical grouping. I can rename/relabel/regroup the pins in software after the fact.QuoteWhile using the FuturePlus sounds enticing, I was trying to keep this design simple and straight forward. If I have to do manual PCI bus decoding, maybe it's not the end of the world. I didn't want to start down the path of FuturePlus without information, an IA, software, and so on.....Did you see my previous emails?

author: gslick
author_rank: Frequent Contributor
timestamp: February 09, 2020, 03:47:31 am
content: As long as the PCI clock is routed to the Pin 3 - Clock pin of the 01650-63203 termination adapter I suppose everything else could be configured appropriately with label channel assignments in the logic analyzer configuration.Prior to the 16700 series I don't think there is a way to reorder the channels assigned to a label. The value of the label is always interpreted in binary from the least significant channel assigned from least significant pod up through most significant channel assigned from most significant pod.Without double checking, if I remember correctly on the 16700 and the 1680/1690/16800/16900 series the channels assigned to a label can be rearranged in any order. In that case you would be fine using either your 16700 or 16900 series.

author: keitheevblog
author_rank: Regular Contributor
timestamp: February 09, 2020, 04:09:44 am
content: Yeah the clock is routed to 3. Although I don't think that's even strictly necessary --- except for a couple "features" that can ignored or just not used. Most of my experience is on the 16700, and when you define a new label, you give it a set of signals, and those signals can be in any order, from any pod. I forget the exact verbiage/convention they use, but you can do cross-pod labeling where a bus shares signals from multiple pods, or even cross multiple cards. There are some limitations in terms of what you trigger on, and how complex those triggers can be when you cross like that, but overall I just get the signal into the LA, and deal with it later....Thanks again for the input!