Supported hmon devices:
DOWNLOAD - this is wrong, no such device in device table
HPIB - HP's GPIB ?
RS232BINARY - self-explanatory
this command invokes a dedicated protocol handler supporting commands like "jump to address", "write to RAM", "write to flash", "start fw from flash", so nothing new there.
Baudrate:
there are 4 baud rate generators (each can be assigned to one of 4 ports independently), all of them are initialized to the same value corresponding to 19200 @25MHz source. I didn't searched for BRG->port assignment, it looks faster to try writing to divider regs one by one until we loose the communication (that will mean that speed is changed, time to reconfigure the PC port and try the new speed).
Divider register addresses:
815F0
815F4
815F8
815FC
- all are 32-bit, so use slong cmd to write to them
Values for different baud rates:
100A0 - 19200 (current setting)
10050 - 38400
10034 - 57600
1001A - 115200
I'll try. This is the serial port which we use.
So the correct register is 815F4
- write new value with slong
- check if communication is lost
- change the baudrate of PC to the new value
- check if communication is back
- do dumps at high speed
...
- profit!
Supported hmon devices:
DOWNLOAD - this is wrong, no such device in device table
HPIB - HP's GPIB ?
RS232BINARY - self-explanatory
this command invokes a dedicated protocol handler supporting commands like "jump to address", "write to RAM", "write to flash", "start fw from flash", so nothing new there.
Baudrate:
there are 4 baud rate generators (each can be assigned to one of 4 ports independently), all of them are initialized to the same value corresponding to 19200 @25MHz source. I didn't searched for BRG->port assignment, it looks faster to try writing to divider regs one by one until we loose the communication (that will mean that speed is changed, time to reconfigure the PC port and try the new speed).
Divider register addresses:
815F0
815F4
815F8
815FC
- all are 32-bit, so use slong cmd to write to them
Values for different baud rates:
100A0 - 19200 (current setting)
10050 - 38400
10034 - 57600
1001A - 115200
BINGO
dlong 815F4 1001A
wrote, disconnect, reconnect at 115200
btw:
dlong 815f0 1001a loose connect and can not reconnect
Great!
Looks like 815F0 controls some internal module-to-module port, so the CPU looses the communication with some essential part of hw.
Do you want the same dump we've had before or a different one?
To start let's do:
A memdump from 0x045A 0000 up to 0x0490 0000.
Before doing it, try to license 1 or 2 options, as you did before.
My memory dump with real licences.
Do you want the same dump we've had before or a different one?
To start let's do:
A memdump from 0x045A 0000 up to 0x0490 0000.
Before doing it, try to license 1 or 2 options, as you did before.
Order is important on this
follow the steps from @suj
dump started @ 115Kb
dbyte 045a0000 3538944
lincenses entered
AYZ 888888888888
IDS 999999999999
My memory dump with real licences.
What options/keys did you have installed? might help searching for them
FWIW , according the sanatazation guide. Options/Licenses are stored in FLASH.
the FLASH on the BOARD is for FW, the FLASH SIMM is where your c: drive is an likely where options are stored permamently
My E4407B came to me with the following licensed options:
1D5 Hi Stability Freq Ref
1DR Narrow Resolution BW
AYZ External Mixing
My E4407B came to me with the following licensed options:
1D5 Hi Stability Freq Ref
1DR Narrow Resolution BW
AYZ External Mixing
1DR Narrow Resolution BW
this is where I think we should start. most by not all SA's have the hardware for this built in
Mine has no licensed options installed, but hardware options that do not require licenses I have
1D5 Hi Stability Freq Ref
1DN TG 3.0Ghz
IDN
BTW, with modern serial ports supporting fractional baud rates (i.e. FTDI-based) and terminal sw supporting arbitrary baudrate numbers (not a dropdown list of fixed values) it should be possible to achieve speeds higher than 115200. The relation is: baudrate=25000000/(16*(((BRG & FFFF)>>1)+1), so the theoretical maximum is 1.56mbps. With 25MHz base frequency higher speeds deviate too much from the standard values, but fractional-capable ports should handle it. The only question is ESA’s hardware limit (i.e. some slow buffers in the signal path).
BTW, with modern serial ports supporting fractional baud rates (i.e. FTDI-based) and terminal sw supporting arbitrary baudrate numbers (not a dropdown list of fixed values) it should be possible to achieve speeds higher than 115200. The relation is: baudrate=25000000/(16*(((BRG & FFFF)>>1)+1), so the theoretical maximum is 1.56mbps. With 25MHz base frequency higher speeds deviate too much from the standard values, but fractional-capable ports should handle it. The only question is ESA’s hardware limit (i.e. some slow buffers in the signal path).
The RXD_RP and TXD_RP go direct to U63/MAX232ACWE
From DS MAX232ACWE
High Data Rates
These transceivers maintain the RS-232 ±5.0V minimum
driver output voltages at data rates of over
120kbps. For data rates above 120kbps, refer to the
Transmitter Output Voltage vs. Load Capacitance
graphs in the Typical Operating Characteristics.
Communication at these high rates is easier if the
capacitive loads on the transmitters are small; i.e.,
short cables are best.
@suj
Do you by chance have a XGecu T56 Universal programmer by chance?
I just got my PCB to try to read the FLASH SIMM
assuming it works I could send a board to you to read out yours.
unless we know the address for that FLASH SIMM and we can read out thru the monitor now?
I don't have this programmer. I have an older SEPROG programmer that supports some FLASH but I have to check. I doubt if such large memories. I finished using the programmer and EPROM emulator with the end of the 8051 and EPROM with a UV window era. Maybe send me your PCB gerbers? I will order from JLCPCB or locally and I will have it in a week. I would also have to order a 72 pin SIMM socket from Mouser. I haven't seen a SIMM anymore at the local main supplier, but I will check with smaller sellers.
I can also locally look for a more modern programmer. Any suggestion of type of the programmer?
I don't have this programmer. I have an older SEPROG programmer that supports some FLASH but I have to check. I doubt if such large memories. I finished using the programmer and EPROM emulator with the end of the 8051 and EPROM with a UV window era. Maybe send me your PCB gerbers? I will order from JLCPCB or locally and I will have it in a week. I would also have to order a 72 pin SIMM socket from Mouser. I haven't seen a SIMM anymore at the local main supplier, but I will check with smaller sellers.
I can also locally look for a more modern programmer. Any suggestion of type of the programmer?
I'm making some changes to the PCB to fix some minor issues I encountered. happy to share the gerbers though
this could be used with any programmer that supports the FLASH Memory but is designed for the T56
the T56 is the TL866II Plus (very popular unit) bigger brother and the direction they are going. supports 25K+ memorys and logic IC's
My quick research favors TL866II+. Over 3x cheaper in my country than the T56.
My quick research favors TL866II+. Over 3x cheaper in my country than the T56.
But it can’t read the flash on the simm module
T56 has extra I/O to do it
If you want a unit for general use the TL866II+
Is a great unit
I performed a memory dump after a reset. It's different
I can derive a rough memory map from QUICC's BRx/ORx regs initialization:
0: 00000000 [20000] SRAM-like, slow timing - this is BootROM as we already know
1: 04000000 [400000] DRAM-like, fast timing - this is DRAM bank 0
2: 04400000 [400000] DRAM-like, fast timing - this is DRAM bank 1
3: 02000000 [20000] SRAM-like, external timing - FPGA ? DIP switches regs are here, flash size reg, DRAM size reg
4: 08000000 [100000] SRAM-like, external timing - ??
5: 0A000000 [80000] SRAM-like, external timing - this is SRAM
6: 0C000000 [400000] SRAM-like, external timing - this is firmware flash
7: 0E000000 [20000] SRAM-like, external timing - ??
Try dumping a small piece from each of the two unknown regions (08000000, 0E000000), maybe the content will provide some ideas.
->dbyte 08000000 256
08000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000030 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000050 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000080 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
08000090 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
080000a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
080000b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
080000c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
080000d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
080000e0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
080000f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
->dbyte 0E000000 256
0e000000 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 ................
0e000010 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000020 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000030 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000040 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000050 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000060 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000070 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000080 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e000090 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e0000a0 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e0000b0 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e0000c0 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e0000d0 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e0000e0 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
0e0000f0 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 bc 00 ................
Maybe this memory map is related to CS signals from QICC?