Home | Telephony | Computers | CRTs | About | Contact | Files Section | Links | Change Log | RSS
Nortel | Lucent | Cisco ISRs | General
Documentation | DMS-100/SL-100/CS-2000/CS-2100 | Meridian 1
Story | EDRAM | Blog | Files | Wanted

SL-100 Web Log

Imaging The NTSX06BA PRL Card

September 15th, 2024-October 7th, 2024

The LTC in my SL-100 takes something on the order of 45 minutes to boot every time I turn on the switch. Generally this is the single largest delay between when I power on the switch to when I can get dialtone from a line card. The reason it takes so long is because the LTC is connected through the ENET to the message switches with a single pair of 64kbps message link, used for control plane communications with the rest of the switch. The software load for the LTC using the NTSX05 processor cards is something like 5 or 6MB. Once you factor in the overhead, it takes about 45 minutes to just transfer the software into the LTC.

Nortel did have a solution for this: the Peripheral/Remote Loader (PRL) card. The PRL card is essentially a flash card which holds the software for the peripheral locally to reduce the boot times associated with loading from the DMS core over message link.

For the NTSX05, the PRL card is a PCMCIA flash card of some variety. The size was purportedly 64 or 128MB (depending on whether it's the NTSX06BA or the NTSX06CA) which meant it was most likely an ATA flash PCMCIA card of some description. I tried playing around with some ATA flash cards and CF cards in PCMCIA adapters, but I was ultimately unsuccessful. My hunch was that either 1) there was something unique about the card itself (possibly vendor information) or 2) the card needed to be preformatted in some manner which did not seem like it could be done from the switch itself.

I had a look on ebay a few times and was able to find an actual new NTSX06BA for sale, but it was a bit more than I wanted to pay. I sat on this for a while while I worked on preparing for VCFMW.

After VCFMW, I finally decided to buy one of the cards. Once I had the card in hand, I was able to validate that the LTC recognized it, which was already more than I had gotten it to do before with off the shelf cards. I could also tell that it was definitely just an ATA flash card, because it said as much on the face of it. It is a Mitsubishi flash card, with a model number similar to, but not the same as, an off the shelf card.

Before I did anything with the card, my intention was to dump the contents. I wanted a clean image of a factory fresh card.

Unfortunately, I was unable to read the card using normal processes on a laptop with PCMCIA. The card just showed up as an unknown device under linux and windows 95 no matter what I did. I even went so far as to set up windows XP with a special tool used for dealing with odd cards and it still didn't recognize it.

I had a suspicion that the issue wasn't that the card wasn't an ATA flash device, and more that the card just didn't say that it was. If only I had some kind of tool that didn't care what the card said it was, and could just send ATA commands anyway.

When I finally found some time, I sat down with my Compaq 5/50CX 486 laptop in Windows 95 DOS mode writing a mess of a QBASIC program that did exactly that. I had a datasheet for the wrong PCMCIA controller in hand, but it was close enough because apparently the register map became some kind of standard.

My initial attempts at poking the ATA registers directly were failing, but seemed promising since I could tell I was in fact making it to the card. I had to read up on PCMCIA somewhat to realize what I was doing wrong.

PCMCIA cards have up to 3 different address spaces: attribute memory, common memory, and I/O space. The Attribute memory normally contains some registers that allow configuring the way the card appears to the system and the card information structure (CIS) which defines various aspects about the card and it's memory spaces.

I had, wrongly, assumed that the card would just show up as an ATA device with registers located where I expected for an ATA device. I had not realized that the registers could be configured to show up in multiple different optional locations, and the default was for them to show up in the common memory space.

I changed my software to configure the attribute memory to be mapped into a region of the x86 address space that I figured I could count on being unused and read out the CIS area. After reviewing it, I was able to determine what Nortel had done to the card to prevent it from working in normal computers.

The CIS information table is normally supposed to start at offset 0. The Nortel NTSX06BA CIS began at offset 0x10.

This effectively prevents any normal PCMCIA standards compliant system from knowing how to interact with the card. At the same time, it was probably a very simple modification to make to the software that Nortel uses on the NTSX05 processor card to recognize the card.

Once I realized how the I/O mapping was done, I decided the path of least resistance was to just use the default mode, memory mapped I/O, to interface to the card. I changed my software to do that and before long I had the attribute memory containing the oddball CIS dumped along with all of the sectors from the ATA side, and also the data returned by the ATA IDENTIRY command (which contains various information describing the ATA device, and could also be important for duplicating a card if it was ever needed).

I've compiled the resources I've used in the process of doing all this in one place for anybody who may need to reference it in the future. I've got a datasheet for a PCMCIA controller, information on PCMCIA and CIS, and a datasheet for the closest Mitsubishi ATA flash card I could find (which was helpful to know the register mapping). I've also got, of course, the dumped sectors, ATA IDENTIFY info, and attribute memory from the card, in case I ever need to create a new card somehow.

Lastly, I've included my horrible QBASIC program, which probably only works on a system using PCMCIA controllers and NOT CardBus controllers (which are PCI and need plug and play stuff to get done). It should be noted that I've take a lot of dirty shortcuts since this is use-once software for me. I have a lot of hardcoded stuff and I take advantage of the fact that the flash card seems to support 8 bit transfers unlike most actual ATA harddrives.

All of this is in the NTSX06BA directory in the files area of my website.

And in case you were wondering, the virgin NTSX06BA just contains a FAT filesystem with some empty directory structure created. In order to actually put the software onto the card, it's loaded from the DMS-core using the MAPCI interface. I'll cover that in the next post.


Part of the Shadytel Web Ring: previous | next | random
This page was last modified 2025-01-12 18:05:15.206237306 -0600