Sender: eric@ruckus.brouhaha.

com
From: Eric Smith <eric@brouhaha.com>
Newsgroups: comp.sys.hp48
Subject: HP 49G memory map (was Re: 49g mem scanner and other)
References: <87aerhyno0.fsf@tcnet04-20.austin.texas.net>
X-Disclaimer: Everything I write is false.
Organization: Eric Conspiracy Secret Labs
X-Eric-Conspiracy: There is no conspiracy.
Date: 25 Aug 1999 17:41:40 -0700
Message-ID: <qhn1vfz83f.fsf@ruckus.brouhaha.com>
Lines: 149
X-Newsreader: Gnus v5.5/Emacs 20.3
NNTP-Posting-Host: ruckus.brouhaha.com
X-Trace: 25 Aug 1999 09:43:20 -0800, ruckus.brouhaha.com
Xref: news-master.service.talkway.com comp.sys.hp48:93114
Al Arduengo <exal@texas.net> writes:
> To any of you privvy to some of the internals of the 49, I have the
> following questions:
>
> 1. Are the keys for the 49 mapped the same as the 48S for purposes of
> using the builtin mem scanner?
I'm not privy to anything special, but I did learn a lot from the recent 1999
HHUC in Vancover, WA, and figured out a tiny amount on my own. Any errors
below are my fault, not HP's.
The memory viewer is accessed by pressing On-D (AKA On-F4), then A (F1).
(On-D displays a menu which does not list "A". Several other unlisted
keys will display various pictures of the developers, some of which can be
scrolled with the arrow keys.)
This starts you at address 40000. The left and right arrow keys move by
one nibble (00001), the up and down keys by sixteen (00010), the add and
subtract by 01000, and the multiply and divide by 10000.
However, the 0-9 and A-F keys do not modify memory (as far as I can tell;
perhaps there's a modify mode that I haven't found). Rather, they select
which bank of the flash memory is visible from 40000..7ffff.
There are two megabytes of flash, which are divided into sixteen banks
of 128K each. Any one of the first four banks can be mapped to 00000..3ffff,
and any of the sixteen can be mapped to 40000..7ffff.
[Note that the most significant address line from the Saturn is not used by
the Flash memory, so the same banks selected for 00000..3ffff and 40000..7ffff
will also appear at 80000..bffff and c0000..fffff if you unconfigure the
RAM that normally covers that area.]
Of the sixteen banks, the first eight contain the HP 49G operating system,
and the last eight contain the user Flash (used as port 2). There are hooks
in place to handle the case that a future version of the operating system
might take more than eight banks, in which case the user Flash would get
fewer banks.
The first half (64 Kbytes) of bank 0 of the Flash is the boot sector. This
area is write-protected such that there is no way to overwrite it without
modifying the hardware. This sector contains the boot code which validates
the contents of the remaining system banks. If there is a problem, perhaps
because of a failed upgrade attempt, the boot code allows the user to download

the OS again. On reset, bank 0 is mapped to 00000..3ffff. After boot, a

different bank is normally mapped there. (I'm not sure which one, but it can
only be 1, 2, or 3.)
The second half of bank 0 is not write-protected, and is apparently part
of the port 2 user Flash (along with banks 8..f).
The range from 40000..7ffff can be mapped to any of the Flash banks, including
the user banks. This is also where the "ERAM" (port 1 user RAM) is configured
when needed. Since there is 256K of ERAM, only half of it can be configured
there at a given time.
Since the memory configuration of the Yorke
possible for future software or alternative
memory in different ways. For instance, an
configuration with RAM at low addresses and
apparently possible.

chip is very flexible, it is

operating systems to map the
all-RAM configuration or a
Flash at high addresses is

The "internal" serial number of the HP 49G (which is NOT the same as the
"external" serial number stamped on the bottom of the case) is at address
00108 of Flash bank zero. Immediately after entering the memory viewer, this
can be seen at 40108 by hitting the down arrow about 12 times. Note that even
though the memory viewer maps bank zero to 00000..3ffff, it can't be seen at
00108 because the Yorke chip maps hardware registers at 00100 & up.
Note that there is no way from User RPL to get the Flash serial number.
According to the developers, this was a deliberate decision because if
software depends on that serial number, an unscrupulous person could
rewrite the flash with a modified version of the hypothetical serial number
command that returned any desired value. But because the serial number is
in the boot sector, it can't be changed in such a simple manner. HP said
to expect that serial number reading code would be provided to software
developers in the future.
The boot sector version string may similarly be found in bank zero at 40214.
Reportedly out of the remaining sectors of the system Flash, one is the system
bank, two are used for the bulk of the HP 48 code, two for Metakernel, and one
(or was it two) for the Computer Algebra System.
The second half of Bill Wickes' adage "Life is short and ROM is full" is no
longer true, as there is apparently still quite a bit of system Flash left
over and available for future growth. Let's hope that the HP 49G is a
successful product, so that HP will release new and improved software to
put that Flash memory to good use. :-)
The Metakernel and CAS splash screens can be seen briefly during boot. If
you press "ON" at the right time, it will stay on screen for inspection.
The CAS version number can be obtained by the "VER" command, and the overall
OS version from the "VERSION" command. I haven't found a command to display
the MK version, so I've only gotten it via the splash screen. Presumably
the memory viewer could also be used to find it.
If you want to go spelunking for interesting text messages, view the region
from 40000..7ffff, and don't forget that there are 8 banks worth trying
(0..7). Also, remember that some messages start at an odd address.
My HP 49G has OS version 1.05; HP said that 1.10 has been released to
manufacturing, and that it should soon show up as a downloadable upgrade on
the HP web site.

Cheers,
Eric
----------------------------------------------------------------------------| 00000
3ffff | 40000
7ffff | 80000
bffff | c0000
fffff |
----------------------------------------------------------------------------\ can be mapped / \can be mapped to/ \
normally always configured
/
\ to first four / \any flash, or / \
as user IRAM
/
\
banks
/
\ user ERAM /
\
(HOME and port 0)
/
\
/
\ (port 1) |
\
/
|----------/
\----------|
-----------------------------|
|
|
|
|
|
|
|
|
|
| Flash - 16 banks of 128 KB |
RAM - 3 areas
|
|
-------------------|
-------------------|
|
| bank 0 64K boot |
|
| 0-256K
|
/
|\
|
sector |
/|
| IRAM
|<--| --->|
-------- |<---- |
| (HOME & port 0)|
|
|
64K normal |
|\
-------------------|\
-------------------/| --------->| 256-384K
ERAM |
| --->| bank 1
|<---- |\
---------- (port 1)|
|\
-------------------/| --------->| 384-512K
|
| --->| bank 2
|<---- |
-------------------\
-------------------/|
--->| bank 3
|<---- |
-------------------/|
| bank 4
|<---- |
-------------------/|
| bank 5
|<---- |
-------------------/|
| bank 6
|<---- |
-------------------/|
| bank 7
|<---- |
-------------------/|
| bank 8
|<---- |
-------------------|
.
|
.
|
.
|
-------------------/
| bank f
|<-----------------------