{"id":555,"date":"2026-06-26T20:44:56","date_gmt":"2026-06-26T20:44:56","guid":{"rendered":"https:\/\/www.r3tr0.net\/?p=555"},"modified":"2026-06-26T20:44:56","modified_gmt":"2026-06-26T20:44:56","slug":"dma-single-player-always-wins","status":"publish","type":"post","link":"https:\/\/www.r3tr0.net\/index.php\/2026\/06\/26\/dma-single-player-always-wins\/","title":{"rendered":"DMA \/ Single player always wins\u2026"},"content":{"rendered":"\n

A bet you can’t lose \u2014 and somehow did<\/h2>\n\n\n\n

Micro Channel arbitration is a tournament. Any device that wants the bus \u2014 a DMA controller, a bus-master card, the refresh logic \u2014 drops its 4\u2011bit arbitration level<\/em> onto the shared ARB[3:0]<\/code> lines during the arbitration window, and the lowest level wins<\/strong>. The lines are open\u2011collector and active\u2011low: you pull down the bits that are 0<\/code> in your level, you release the bits that are 1<\/code>, and the wired\u2011AND of everyone’s drive settles to the winner. Lose a bit to someone with higher priority, and you drop out of all the lower bits too.<\/p>\n\n\n\n

Here’s the thing about a tournament with one entrant: the single player always wins.<\/strong> When WonderMCA is the only card asking for the bus, its arbitration is a formality \u2014 present level 0001<\/code> (DMA channel 1), nobody contests it, the planar grants it the bus, and the CDMA pushes a byte into our test port. That’s the whole game.<\/p>\n\n\n\n

If you remember the previous episode, Sound Blaster emulation was working , unstable, but working on Model 50Z and model 70. As part of my larger validation, I tested the WonderMCA on the Model 57 & 56 SLC2 and it was a complete disaster, Model 56 & 57 have something in common, the chassis has zero tolerance.<\/p>\n\n\n\n

Prince of Persia was rebooting as soon as Digital Audio was starting…<\/p>\n\n\n\n

So when I armed SBDIAG, expecting the Sound Blaster “TADA” to loop forever off chassis DMA, and instead got one<\/strong> TADA and then a frozen POST<\/strong>, I had a card that was losing a tournament it was the only player in. That should be impossible. It took most of a day, three independent bugs, and a trip through the chip’s own silicon manual to understand how<\/em> you lose a race you can’t lose.<\/p>\n\n\n\n

Layer 0: the firmware that quietly killed Core 1<\/h2>\n\n\n\n

Before the arbitration even mattered, the first symptom was blunter: CHRDY never released, and the bus hung.<\/strong> The MCA bus master asserts a cycle, our CPLD stretches it with CHRDY (a wait\u2011state), and the RP2350 firmware is supposed to pulse RP_REL<\/code> to tear the latch down. CHRDY staying asserted means nobody is pulsing RP_REL<\/em> \u2014 i.e. Core 1, which runs the whole bus handler, is dead.<\/p>\n\n\n\n

The give\u2011away was a regression I’d caused that morning. I’d “optimised” main_core1()<\/code> by splitting its one\u2011time init out into a separate __not_in_flash_func(core1_init)<\/code> to reclaim ~700 bytes of the 4 KB SCRATCH_X budget. Clean idea, green build, scratch_x shrank 2024 \u2192 1312 bytes. And it bricked Core 1: the GPIO coprocessor (CP0) enable, and the fragile single\u2011translation\u2011unit assumptions of that hand\u2011tuned loop, do not survive being chopped into two functions across two memory regions. Pull the card, POST completes; card in, frozen.<\/p>\n\n\n\n

Lesson, logged:<\/strong> keep main_core1<\/code> a single __scratch_x<\/code> function. I reverted the split. You don’t refactor the load\u2011bearing wall to save a picture frame’s worth of bytes. CHRDY released again, and the real<\/em> DMA debugging could start.<\/p>\n\n\n\n

Layer 1: a clock that “needs patching”<\/h2>\n\n\n\n

With the bus alive, the DMA still didn’t arbitrate. Time for the CPLD. WonderMCA’s arbitration is an ATF1508 design that mirrors a known\u2011good Verilog reference (mcsb.v<\/code>). I opened the fitter report \u2014 and the fitter was telling me it was unhappy<\/em>:<\/p>\n\n\n\n

## Warning : Placement fail        (fitter pass 1)\n## Warning : Placement fail        (fitter pass 2)\nRP_DMA_GRANT.C equation needs patching.\nMCA_PREEMPT.OE equation needs patching.\n3 control equations need patching\n<\/code><\/pre>\n\n\n\n
RP_DMA_GRANT.C<\/code> is the clock<\/strong> of the grant flip\u2011flop \u2014 the FF the firmware reads to know it’s been granted the bus. A clock<\/em> getting “patched” onto a feedback node instead of a clean global\u2011clock net is exactly the kind of fragile that makes a grant latch unreliable. The source said RP_DMA_GRANT.CK = valid_io;<\/code> \u2014 a combinational product term, not a clock pin. The design comment even confessed it: “Easy revert: change CK back to plain ADL.”<\/em> So I did \u2014 RP_DMA_GRANT.CK = ADL<\/code>, which sits on GCLK2 (PIN 2). The patch on the grant clock vanished. 3 \u2192 1.<\/p>\n\n\n\n
One down. But the boot still froze, and now I could see why on the logic analyzer.<\/p>\n\n\n\n
Layer 2: ARB0 held low, forever<\/h2>\n\n\n\n
The LA told a strange story. With DMA channel 1<\/strong> selected, the card should present 0001<\/code>: drive ARB3\/2\/1 low, release ARB0<\/strong>. Instead:<\/p>\n\n\n\n
    \n
  • ARB1 = 1<\/strong>\u00a0(not driven \u2014 it should be 0 for DMA1), and<\/li>\n\n\n\n
  • ARB0 = 0<\/strong>,\u00a0all the time<\/em>\u00a0\u2014 even at idle, even with nothing arbitrating.<\/li>\n<\/ul>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    ARB0 stuck low is catastrophic, and the arbitration math says exactly why. For DMA1 the card’s win condition reduces to a single term:<\/p>\n\n\n\n
    drop_cum = !MCA_ARB_0          \/* card_arb0 = 1, no higher-bit dropout *\/\narb_won  = !drop_cum & DMA_SESSION = MCA_ARB_0 & DMA_SESSION\n<\/code><\/pre>\n\n\n\n
    The card can only win if ARB0 reads HIGH.<\/strong> It releases ARB0 and trusts the bus terminator to pull it up; a level\u20110 contender pulling it low is the only<\/em> legitimate reason to lose there. With ARB0 nailed low by something, arb_won<\/code> is 0<\/code> on every cycle. The single player loses every hand because the table is rigged.<\/p>\n\n\n\n
    So who’s rigging it? The CPLD declares MCA_ARB_0<\/code> as a pure input<\/strong> \u2014 it shouldn’t be driving anything. The card\u2011out test settled it instantly: pull WonderMCA, POST completes.<\/strong> It was us. Our own CPLD was holding ARB0 low and freezing the whole planar’s arbitration.<\/p>\n\n\n\n
    The cross-check: what the reference actually does<\/h2>\n\n\n\n
    Before “fixing” anything I read the Verilog reference in detail, because the LA and the source disagreed about whether ARB0 should ever be driven. mcsb.v<\/code> is unambiguous:<\/p>\n\n\n\n
    inout  [3:0] arb;                                   <em>\/\/ bidirectional, all 4<\/em>\nassign arb[i] = (~arb_en | arb_out[i]) ? 1'bZ : 1'b0;   <em>\/\/ open-drain<\/em>\nassign arb_out[0] = card_arb[0] | ~arb_match[1] | ~arb_match[2] | ~arb_match[3];\ncard_arb (DMA1) = 0001;                             <em>\/\/ card_arb[0] = 1<\/em>\n<\/code><\/pre>\n\n\n\n
    For DMA1, card_arb[0]=1<\/code> \u2192 arb_out[0]=1<\/code> \u2192 arb[0]<\/code> is always released (Hi\u2011Z)<\/strong>. The reference never drives ARB0 on our channels. It also<\/em> declares the line inout<\/code> \u2014 a real bidirectional open\u2011drain pin. The .pld<\/code> matched the logic<\/em> (ARB0 released) but had quietly made the pin input\u2011only<\/strong> to dodge a WinCUPL quirk. That mismatch was the thread to pull.<\/p>\n\n\n\n
    Layer 3: the trap \u2014 when “off” means “always on”<\/h2>\n\n\n\n
    Here’s the part that cost the most hours. On this ATF1508 \/ WinCUPL flow, the open\u2011drain emulation<\/em> everyone uses \u2014<\/p>\n\n\n\n
    MCA_ARB_0     = 'b'0;\nMCA_ARB_0.OE  = participate & !card_arb0 & !drop_1;   \/* the OE controls drive *\/\n<\/code><\/pre>\n\n\n\n
    \u2014 traps when the OE folds to a compile\u2011time constant 0.<\/strong> Because card_arb0 = 1<\/code>, !card_arb0 = 0<\/code>, the whole OE simplifies to 0<\/code>, and the fitter then “optimises” “output\u2011enable always 0”<\/em> into “no OE term, output always on”<\/em> \u2014 and drives the pin to its value, 0<\/code>, low, forever.<\/strong> The cure the design had reached for \u2014 removing the equation entirely so the pin is input\u2011only \u2014 looked<\/em> right in the fitter report (MC88 57 -- MCA_ARB_0 INPUT<\/code>) but a stale JED on the part still carried the old driving build, and even MCA_CD_DS16.OE = 'b'0<\/code> (my attempt to “disable” DS16) hit the same trap: the fit showed that macrocell on<\/strong>, driving \/CD-DS16<\/code> low = 16\u2011bit forced on<\/em>. Three different ways to say “don’t drive this pin,” three ways the fitter said “fine, I’ll drive it low.”<\/p>\n\n\n\n
    This is the moment the whole bug clicked: you cannot disable an ATF1508 output by giving it a constant\u20110 enable.<\/strong> The OE trick is a footgun the fitter loads for you.<\/p>\n\n\n\n
    The fix: use the silicon’s real open-collector mode<\/h2>\n\n\n\n
    The ATF150x macrocells have a hardware<\/em> open\u2011collector output \u2014 drive low or release, in the buffer itself, no OE product term to collapse. It’s not in the WinCUPL language<\/em> manual (that only documents .OE<\/code>); it lives in the ATF15xx Device Fitter User’s Guide<\/strong>, as a fitter strategy you select from CUPL source:<\/p>\n\n\n\n
    PROPERTY ATMEL { open_collector = MCA_ARB_0, MCA_ARB_1, MCA_ARB_2, MCA_ARB_3, MCA_PREEMPT };\n<\/code><\/pre>\n\n\n\n
    With the pin in real OC mode you stop emulating and just write the bus value<\/strong> \u2014 0<\/code> drives low, 1<\/code> releases \u2014 which is exactly<\/em> the Verilog:<\/p>\n\n\n\n
    MCA_ARB_0   = !participate # card_arb0 # drop_1;   \/* folds to 1 -> always released, no jam *\/\nMCA_ARB_1   = !participate # card_arb1 # drop_2;\nMCA_ARB_2   = !participate # card_arb2 # drop_3;\nMCA_ARB_3   = !participate # card_arb3;\nMCA_PREEMPT = !preempt_drive;\n<\/code><\/pre>\n\n\n\n
    No .OE<\/code> anywhere on these pins, so there is no constant\u20110 OE for the fitter to invert into a permanent low<\/strong>. ARB0’s equation folds to 1<\/code> \u2014 and in OC mode 1<\/code> means release<\/em>, not drive high<\/em> \u2014 so it sits Hi\u2011Z, exactly as the single\u2011player tournament requires. \/CD-DS16<\/code>, by contrast, is genuinely a totem\u2011pole<\/strong> output (it must actively drive both 8\u2011 and 16\u2011bit states for a fast early sample), so it stays push\u2011pull and out<\/em> of the open\u2011collector list: MCA_CD_DS16 = !ds16_drive;<\/code>.<\/p>\n\n\n\n
    The one caveat I left in the source in bold: verify the .fit<\/code> echoes Open_collector = MCA_ARB_0, \u2026<\/code>.<\/strong> If WinCUPL silently ignores the directive, those value\u2011equations become push\u2011pull<\/em> outputs driving the open\u2011drain bus high \u2014 bus contention, worse than the bug. The fitter’s own echo is the ground truth.<\/p>\n\n\n\n
    The single player wins again<\/h2>\n\n\n\n
    Rev 72 burned to the CPLD. ARB0 released to the terminator’s HIGH, the card presented 0001<\/code>, the planar granted it the bus, the CDMA streamed bytes into the SB port \u2014 and the TADA looped<\/strong>, continuously, the way a 22 kHz auto\u2011init DMA transfer is supposed to. The tournament has one entrant again, and the one entrant wins.<\/p>\n\n\n\n
    What this one taught me<\/h2>\n\n\n\n
      \n
    • A tool’s optimiser is part of your circuit.<\/strong>\u00a0The bug wasn’t in my logic \u2014\u00a0drop_cum<\/code>,\u00a0arb_out<\/code>, the levels all matched the reference. It was WinCUPL turning “never drive” into “always drive low.” Read the fitter report like it’s a teammate; it was warning me in plain English for hours.<\/li>\n\n\n\n
    • Use the device’s real feature, not an emulation of it.<\/strong>\u00a0Hardware open\u2011collector existed the whole time. The\u00a0='b'0; .OE=cond<\/code>\u00a0pattern is a decades\u2011old habit that happens to detonate on this part when the condition is constant.<\/li>\n\n\n\n
    • The manual you grabbed might be the wrong manual.<\/strong>\u00a0The open\u2011collector syntax wasn’t in the WinCUPL\u00a0language<\/em>\u00a0reference at all \u2014 it was a\u00a0fitter<\/em>\u00a0strategy in a separate Microchip guide. An afternoon of “it’s not documented” was really “it’s documented elsewhere.”<\/li>\n\n\n\n
    • Bisect across layers, not just lines.<\/strong>\u00a0Three unrelated bugs stacked \u2014 a firmware regression, a clock placement, and the OE trap \u2014 each masking the next. Card\u2011out tests, the fitter echo, and the LA each isolated one layer. Guessing would never have peeled them apart.<\/li>\n<\/ul>\n\n\n\n
      Different MCA chassis, different fitter quirks, the same lesson WonderMCA keeps teaching: the bus is honest, the silicon is honest, the tools have opinions \u2014 and you don’t really understand a system until you understand how it can lose a game it can’t lose.<\/p>\n","protected":false},"excerpt":{"rendered":"
      A bet you can’t lose \u2014 and somehow did Micro Channel arbitration is a tournament. Any device that wants the bus \u2014 a DMA controller, a bus-master card, the refresh logic \u2014 drops its 4\u2011bit arbitration level onto the shared ARB[3:0] lines during the arbitration window, and the lowest level wins. The lines are open\u2011collector and active\u2011low: you pull down […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-555","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/posts\/555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/comments?post=555"}],"version-history":[{"count":1,"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/posts\/555\/revisions"}],"predecessor-version":[{"id":557,"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/posts\/555\/revisions\/557"}],"wp:attachment":[{"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/media?parent=555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/categories?post=555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.r3tr0.net\/index.php\/wp-json\/wp\/v2\/tags?post=555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}