Sender: eric@ruckus.brouhaha.comFrom: Eric Smith Newsgroups: comp.sys.hp48Subject: HP 49G memory map (was Re: 49g mem scanner and other)References: X-Disclaimer: Everything I write is false.Organization: Eric Conspiracy Secret LabsX-Eric-Conspiracy: There is no conspiracy.Date: 25 Aug 1999 17:41:40 -0700Message-ID: Lines: 149X-Newsreader: Gnus v5.5/Emacs 20.3NNTP-Posting-Host: ruckus.brouhaha.comX-Trace: 25 Aug 1999 09:43:20 -0800, ruckus.brouhaha.comXref: news-master.service.talkway.com comp.sys.hp48:93114Al Arduengo writes:> To any of you privvy to some of the internals of the 49, I have the > following questions:> > 1. Are the keys for the 49 mapped the same as the 48S for purposes of > using the builtin mem scanner?I'm not privy to anything special, but I did learn a lot from the recent 1999HHUC in Vancover, WA, and figured out a tiny amount on my own. Any errorsbelow are my fault, not HP's.The memory viewer is accessed by pressing On-D (AKA On-F4), then A (F1).(On-D displays a menu which does not list "A". Several other unlistedkeys will display various pictures of the developers, some of which can bescrolled with the arrow keys.)This starts you at address 40000. The left and right arrow keys move byone nibble (00001), the up and down keys by sixteen (00010), the add andsubtract by 01000, and the multiply and divide by 10000.However, the 0-9 and A-F keys do not modify memory (as far as I can tell;perhaps there's a modify mode that I haven't found). Rather, they selectwhich bank of the flash memory is visible from 40000..7ffff.There are two megabytes of flash, which are divided into sixteen banksof 128K each. Any one of the first four banks can be mapped to 00000..3ffff,and any of the sixteen can be mapped to 40000..7ffff.[Note that the most significant address line from the Saturn is not used bythe Flash memory, so the same banks selected for 00000..3ffff and 40000..7ffffwill also appear at 80000..bffff and c0000..fffff if you unconfigure theRAM that normally covers that area.]Of the sixteen banks, the first eight contain the HP 49G operating system,and the last eight contain the user Flash (used as port 2). There are hooksin place to handle the case that a future version of the operating systemmight take more than eight banks, in which case the user Flash would getfewer banks.The first half (64 Kbytes) of bank 0 of the Flash is the boot sector. Thisarea is write-protected such that there is no way to overwrite it withoutmodifying the hardware. This sector contains the boot code which validatesthe contents of the remaining system banks. If there is a problem, perhapsbecause of a failed upgrade attempt, the boot code allows the user to downloadthe OS again. On reset, bank 0 is mapped to 00000..3ffff. After boot, adifferent bank is normally mapped there. (I'm not sure which one, but it canonly be 1, 2, or 3.)The second half of bank 0 is not write-protected, and is apparently partof the port 2 user Flash (along with banks 8..f).The range from 40000..7ffff can be mapped to any of the Flash banks, includingthe user banks. This is also where the "ERAM" (port 1 user RAM) is configuredwhen needed. Since there is 256K of ERAM, only half of it can be configuredthere at a given time.Since the memory configuration of the Yorke chip is very flexible, it ispossible for future software or alternative operating systems to map thememory in different ways. For instance, an all-RAM configuration or aconfiguration with RAM at low addresses and Flash at high addresses isapparently possible.The "internal" serial number of the HP 49G (which is NOT the same as the"external" serial number stamped on the bottom of the case) is at address00108 of Flash bank zero. Immediately after entering the memory viewer, thiscan be seen at 40108 by hitting the down arrow about 12 times. Note that eventhough the memory viewer maps bank zero to 00000..3ffff, it can't be seen at00108 because the Yorke chip maps hardware registers at 00100 & up.Note that there is no way from User RPL to get the Flash serial number.According to the developers, this was a deliberate decision because ifsoftware depends on that serial number, an unscrupulous person couldrewrite the flash with a modified version of the hypothetical serial numbercommand that returned any desired value. But because the serial number isin the boot sector, it can't be changed in such a simple manner. HP saidto expect that serial number reading code would be provided to softwaredevelopers in the future.The boot sector version string may similarly be found in bank zero at 40214.Reportedly out of the remaining sectors of the system Flash, one is the systembank, two are used for the bulk of the HP 48 code, two for Metakernel, and one(or was it two) for the Computer Algebra System.The second half of Bill Wickes' adage "Life is short and ROM is full" is nolonger true, as there is apparently still quite a bit of system Flash leftover and available for future growth. Let's hope that the HP 49G is asuccessful product, so that HP will release new and improved software toput that Flash memory to good use. :-)The Metakernel and CAS splash screens can be seen briefly during boot. Ifyou press "ON" at the right time, it will stay on screen for inspection.The CAS version number can be obtained by the "VER" command, and the overallOS version from the "VERSION" command. I haven't found a command to displaythe MK version, so I've only gotten it via the splash screen. Presumablythe memory viewer could also be used to find it.If you want to go spelunking for interesting text messages, view the regionfrom 40000..7ffff, and don't forget that there are 8 banks worth trying(0..7). Also, remember that some messages start at an odd address.My HP 49G has OS version 1.05; HP said that 1.10 has been released tomanufacturing, and that it should soon show up as a downloadable upgrade onthe HP web site.Cheers,Eric-----------------------------------------------------------------------------| 00000 3ffff | 40000 7ffff | 80000 bffff | c0000 fffff |-----------------------------------------------------------------------------\ can be mapped / \can be mapped to/ \ normally always configured / \ to first four / \any flash, or / \ as user IRAM / \ banks / \ user ERAM / \ (HOME and port 0) / \ / \ (port 1) | \ / |----------/ \----------| -----------------------------| | | | | | | | | | | Flash - 16 banks of 128 KB | RAM - 3 areas | | -------------------- | -------------------- | | | bank 0 64K boot | | | 0-256K | / |\ | sector | /| | IRAM || -------- || 256-384K ERAM | | --->| bank 1 || 384-512K | | --->| bank 2 || bank 3 |