hc11 variant with bank switching for > 64K ?

[skip]

'm starting a RE project on a Motorola radio based on the MC68hc11fl0 processor. Unfortunately I've been unable to find
a spec sheet for this chip. I'm afraid it was an in-house only design when Motorola still make semiconductors.

The design includes 512K bytes of flash and 32K bytes of RAM externally:



Initial disassembly leads me to think that this HC11 variant supports bank switching or perhaps far/long calls and returns.



So finally my question: has anyone seen ANY documentation of an HC11 variant which includes support bank switching or whatever to support more than 64K of RAM/FLASH ?

[Andy Chee]

So finally my question: has anyone seen ANY documentation of an HC11 variant which includes support bank switching or whatever to support more than 64K of RAM/FLASH ?

The 68HC11F1 does indeed have some extra chip select lines which can be utilised for bank switching.

Take a look at the 'F1 datasheet Port G.  CSPROG and CSGEN can be used to select between "program" memory and "general" memory.

Take a look at your schematic diagram.  The larger 'FL0 variant has even more select lines.  CSPROG, CSGP1 & CSGP2 are on Port H.  CSGP3 & CSGP4 are on Port J.  Add to that the extended address space by using Port G (the normal 16-bit address space is Port F & Port B the same as the 'F1).

[BradC]

We used to do bank switching on the A8 using a port pin. It was a feature of the compiler, but that was 25 years ago and for the life of me I can't remember what it was. I do recall it was expensive at the time. I had written all the original code in asm and when I handed it over to another engineer she wanted to re-write it in C. Of course it wouldn't fit, so she found a compiler that could do bank switching. Just needed a green wire on the board to make it work.

I had used a 128k flash chip (because it was cheap and easy) and we were using a 32/32 split of flash and ram. Plenty of code space to switch out.

[amyk]

Does the MCU have a mask set ID? That can be used to find the closest publicly-documented variant.

[skip]

Does the MCU have a mask set ID? That can be used to find the closest publicly-documented variant.

I don't know, I haven't taken the radio apart physically yet. I'm currently working from the service
manual and firmware update image.  I'm traveling currently and don't have the radio at the moment.

I'll look around the net and see if I can find some pictures.

Thanks, Skip

[skip]

So finally my question: has anyone seen ANY documentation of an HC11 variant which includes support bank switching or whatever to support more than 64K of RAM/FLASH ?

The 68HC11F1 does indeed have some extra chip select lines which can be utilised for bank switching.

Take a look at the 'F1 datasheet Port G.  CSPROG and CSGEN can be used to select between "program" memory and "general" memory.

Take a look at your schematic diagram.  The larger 'FL0 variant has even more select lines.  CSPROG, CSGP1 & CSGP2 are on Port H.  CSGP3 & CSGP4 are on Port J.  Add to that the extended address space by using Port G (the normal 16-bit address space is Port F & Port B the same as the 'F1).

I have been looking at the F1 datasheet and it does give me a flavor but there's no port H. 
I can also see from the disassembly several of the reserved interrupt vectors are used so
there are quite a few differences.

My aim is to understand the factory code enough to unlock some features.
For example the frequencies appears to be programmamble via the front panel, but no one has figured out how to
get them to work.  The handitalky version of this radio was hacked a number of years ago.

Yes I'm a HAM and only intend on using the radio in the HAM band.

Skip

[Andy Chee]

So finally my question: has anyone seen ANY documentation of an HC11 variant which includes support bank switching or whatever to support more than 64K of RAM/FLASH ?

The 68HC11F1 does indeed have some extra chip select lines which can be utilised for bank switching.

Take a look at the 'F1 datasheet Port G.  CSPROG and CSGEN can be used to select between "program" memory and "general" memory.

Take a look at your schematic diagram.  The larger 'FL0 variant has even more select lines.  CSPROG, CSGP1 & CSGP2 are on Port H.  CSGP3 & CSGP4 are on Port J.  Add to that the extended address space by using Port G (the normal 16-bit address space is Port F & Port B the same as the 'F1).

I have been looking at the F1 datasheet and it does give me a flavor but there's no port H. 
I can also see from the disassembly several of the reserved interrupt vectors are used so
there are quite a few differences.

Oh yes the F1 only goes up to port G, I didn’t mean to imply it had port H, I and J.

What I was suggesting was that you could take a look at the F1’s port G usage and implementation, in order to gain insight into how port H chip selects potentially work on the FL0.

For example, the F1’s port G chip selects are configured in addresses $105C thru $105F. Notice how $1040 thru $105B are reserved? I’ll bet that they’re utilised on the FL0.

Ultimately yes, a datasheet for the FL0 would be ideal. But inferring register usage should be possible. You may need to burn your own test ROM and locate it in the lowest part of memory. Alternatively, how about using the ancient PCBUG11 to run the FL0 in bootstrap mode? Then you can view the configuration registers to see how the memory map is setup.

As an aside, I am also a ham and also operate a Motorola GM339 as my daily driver for 2m VHF, re-programmed with local amateur repeater and simplex frequencies. I’d be curious as to what you come up with.

[skip]

For example, the F1’s port G chip selects are configured in addresses $105C thru $105F. Notice how $1040 thru $105B are reserved? I’ll bet that they’re utilised on the FL0.

Yup, exactly. I had no problem finding the initialization code using Ghidra.

Code: [Select]

                             ResetHandler                                    XREF[3]:     fffa(*), fffc(*), fffe(*) 
            ff40 0f              SEI
            ff41 86 01           LDAA       #0x1
            ff43 97 3d           STAA       DAT_003d                                         = FFh
            ff45 ce 10 00        LDX        #0x1000
            ff48 c6 bb           LDAB       #0xbb
            ff4a e7 39           STAB       0x39,IX=>DAT_1039                                = FFh
            ff4c 86 19           LDAA       #0x19
            ff4e a7 3f           STAA       0x3f,IX=>DAT_103f                                = FFh
            ff50 cc 80 0e        LDD        #0x800e
            ff53 a7 38           STAA       0x38,IX=>DAT_1038                                = FFh
            ff55 e7 3c           STAB       0x3c,IX=>DAT_103c                                = FFh
            ff57 1d 36 01        BCLR       0x36,IX=>DAT_1036,0x1                            = FFh
            ff5a cc 7f 80        LDD        #0x7f80
            ff5d ed 00           STD        0x0,IX=>DAT_1000                                 = FFFFh
            ff5f cc 38 f8        LDD        #0x38f8
            ff62 ed 08           STD        0x8,IX=>DAT_1008                                 = FFFFh
            ff64 cc ff 80        LDD        #0xff80
            ff67 ed 7e           STD        0x7e,IX=>DAT_107e                                = FFFFh
            ff69 cc 50 f7        LDD        #0x50f7
            ff6c ed 7c           STD        0x7c,IX=>DAT_107c                                = FFFFh
            ff6e cc 00 28        LDD        #0x28
            ff71 ed 78           STD        0x78,IX=>DAT_1078                                = FFh
            ff73 cc 07 07        LDD        #0x707
            ff76 ed 7a           STD        0x7a,IX=>DAT_107a                                = FFh
            ff78 cc 00 18        LDD        #0x18
            ff7b ed 70           STD        0x70,IX=>DAT_1070                                = FFFFh
            ff7d cc 3e 62        LDD        #0x3e62
            ff80 a7 2d           STAA       0x2d,IX=>DAT_102d                                = FFh
            ff82 e7 56           STAB       0x56,IX=>DAT_1056                                = FFh
            ff84 86 06           LDAA       #0x6
            ff86 a7 57           STAA       0x57,IX=>DAT_1057                                = FFh
            ff88 4f              CLRA
            ff89 a7 5a           STAA       0x5a,IX=>DAT_105a                                = FFh
            ff8b 86 80           LDAA       #0x80
            ff8d a7 51           STAA       0x51,IX=>DAT_1051                                = FFh
            ff8f cc 65 4a        LDD        #0x654a
            ff92 a7 5b           STAA       0x5b,IX=>DAT_105b                                = FFh
            ff94 e7 5d           STAB       0x5d,IX=>DAT_105d                                = FFh
            ff96 cc 04 03        LDD        #0x403
            ff99 a7 5e           STAA       0x5e,IX=>DAT_105e                                = FFh
            ff9b e7 5f           STAB       0x5f,IX=>DAT_105f                                = FFh
            ff9d c6 2f           LDAB       #0x2f
            ff9f e7 2c           STAB       0x2c,IX=>DAT_102c                                = FFh
            ffa1 86 00           LDAA       #0x0
            ffa3 a7 3b           STAA       0x3b,IX=>DAT_103b                                = FFh
            ffa5 86 04           LDAA       #0x4
            ffa7 a7 72           STAA       0x72,IX=>DAT_1072                                = FFh
            ffa9 c6 50           LDAB       #0x50
            ffab e7 28           STAB       0x28,IX=>DAT_1028                                = FFh
            ffad 1c 26 04        BSET       0x26,IX=>DAT_1026,0x4                            = FFh
            ffb0 1d 7a 07        BCLR       0x7a,IX=>DAT_107a,0x7                            = FFh
            ffb3 1c 7a 07        BSET       0x7a,IX=>DAT_107a,0x7                            = FFh
            ffb6 7e bc 55        JMP        FUN_bc55

Beyond the extra ports and configuration registers I suspect there are also far/long calls and jumps
like a HC12.

In any case my CDM1550 is programmed and working GREAT in the HAM band for both for analog FM
as intended and for DMR using an MMDVM interface. 

The whole RE effort is just because I'm curious, nosy and retired. Figuring out how to enable the front panel
programming feature seemed like it would be a fun challenge.  Now I'm thinking it's a much bigger
project that I expected.

73's Skip

[Andy Chee]

Beyond the extra ports and configuration registers I suspect there are also far/long calls and jumps
like a HC12.

I'm actually inclined to think otherwise, only because as a member of the 68HC11 family, it should still retain architecture compatibility across all variants (more than just instruction set compatibility).

In the case of the 'FL0 and its extended address bus, I wouldn't be surprised if the reset vector (and the rest of the vector table) is still located at $0FFFE, $0FFFF rather than the actual top of memory $7FFFE, $7FFFF.  Again, this is for architecture compatibility as other 'HC11 variants only have 16-bit wide address.  This may imply that there may be code mirrored in ROM at these locations, so that could be something to look for.

In summary, I don't believe the 'FL0's extended address bus is a true address bus.  The extended address bus port G seems to behave more like a general purpose I/O peripheral.  Indeed, looking at the schematic PG0_XA13 is connected to the power switch, which I suspect has something to do with the bootstrapping process (i.e. firmware upgrades can only be performed with the radio powered off, though still connected to 12V for standby power).

P.S. just in case, check the boostrap reset vector at $BFFE, $BFFF to see if anything is there.  Normally there shouldn't be, as the normal bootstrap process accesses a bootloader in on-chip ROM, not external ROM.  But maybe they did something different on the radio?  Check the mirrored locations as well.

https://www.nxp.com/docs/en/application-note/AN1060.pdf

[skip]

In the case of the 'FL0 and its extended address bus, I wouldn't be surprised if the reset vector (and the rest of the vector table) is still located at $0FFFE, $0FFFF rather than the actual top of memory $7FFFE, $7FFFF.  Again, this is for architecture compatibility as other 'HC11 variants only have 16-bit wide address.  This may imply that there may be code mirrored in ROM at these locations, so that could be something to look for.

It's not.  The only place I found a vector table was at $7FFxx. 

Here's what's in the 512k in the vector area:

Code: [Select]

0000ffe0  04 3f c5 10 27 04 14 e0  01 39 7e 44 79 12 e2 10  |.?..'....9~Dy...|
0000fff0  04 14 e0 01 39 7e 44 79  ff ff ff ff ff ff ff ff  |....9~Dy........|
...
0007ffe0  c3 b8 c3 b4 c3 b0 c3 ac  c3 a8 c3 c4 c3 5d c3 5d  |.............].]|
0007fff0  e0 93 f9 dc c3 63 c3 5d  c3 5d ff 40 ff 40 ff 40  |.....c.].].[member=123300].[/member][member=123300].[/member]@|

This is also interesting:

Code: [Select]

0001fa80  47 45 00 ff ff ff ff ff  ff ff ff ff ff ff ff ff  |GE..............|
0001fa90  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00078000  c3 d3 08 52 30 35 2e 31  30 2e 30 34 00 08 4b c4  |...R05.10.04..K.|
00078010  08 4b ce 08 4b d8 08 4b  ca 08 4b d4 08 4b de ff  |.K..K..K..K..K..|

So there's a huge amount of empty flash... perhaps used for voice storage?

It looks like there are a bunch of 16k code blocks from $00000 to $1c000, then ASCII text from
$1c000 to $1fa83

Code: [Select]

00003f70  00 02 39 ff ff ff ff ff  ff ff ff ff ff ff ff ff  |..9.............|
00003f80  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00004000  86 01 b7 05 d6 39 b7 03  7c 39 b7 03 7d 39 36 b6  |.....9..|9..}96.|
...
00007ba0  39 39 39 39 39 39 39 39  39 39 39 39 39 ff ff ff  |9999999999999...|
00007bb0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00008000  cc 00 00 b7 01 d3 fd 01  d5 39 b6 01 d3 85 01 26  |.........9.....&|
...
0000bfc0  39 ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |9...............|
0000bfd0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
0000c000  00 79 9a 0a 67 01 00 00  01 79 cc 0a 67 01 8a 08  |.y..g....y..g...|
...
00011070  be 1d 00 04 39 ff ff ff  ff ff ff ff ff ff ff ff  |....9...........|
00011080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00014000  b6 07 2a 85 40 27 03 7e  40 aa b6 07 2c 85 01 27  |..*.@'.~[member=123300].[/member]..,..'|
...
00017960  32 07 32 17 32 27 32 37  ff ff ff ff ff ff ff ff  |2.2.2'27........|
00017970  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00018000  36 c6 00 bd df f6 32 ce  43 9d bd 41 e4 27 2a ee  |6.....2.C..A.'*.|
...

*
0001c000  53 79 73 74 65 6d 20 53  63 61 6e 00 52 61 73 74  |System Scan.Rast|
0001c010  72 65 6f 20 53 69 73 74  2e 00 56 61 72 72 65 64  |reo Sist..Varred|
...
*
0001eae0  f1 6f 6c 00 50 6f 72 74  75 67 75 ea 73 00 50 6f  |.ol.Portugu.s.Po|
0001eaf0  72 74 75 67 75 ea 73 00  50 6f 72 74 75 67 75 ea  |rtugu.s.Portugu.|
0001eb00  73 00 50 6f 72 74 75 67  75 ea 73 00 50 6f 72 74  |s.Portugu.s.Port|
...
0001fa60  69 73 73 00 8d 85 20 84  8e 8f 93 91 92 88 92 00  |iss... .........|
0001fa70  49 4e 20 52 41 4e 47 45  00 4f 55 54 20 52 41 4e  |IN RANGE.OUT RAN|
0001fa80  47 45 00 ff ff ff ff ff  ff ff ff ff ff ff ff ff  |GE..............|
0001fa90  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|


n summary, I don't believe the 'FL0's extended address bus is a true address bus. 

I think I'm tending to agree.  I took a closer look at the routine at $7fb28 and I think it might
be playing some stack games to do a long jump or something.

Thanks for your thoughts!
73's Skip

[peter-h]

In the 1980s, IAR compilers supported a "large model" whereby

- you had to provide a function which switched-in Bank X
- Bank X would appear at a fixed address
- no C function was allowed to be bigger than the bank size (typically, Z180, we used a 4k bank located at the top 4k i.e. at 60k i.e. 0xF000)

You could have 256 banks i.e. loads of code.

It was pretty efficient, with a small overhead per function call.

No solution for loads of RAM (much more complicated to do).

[Andy Chee]

Have you established yet which control registers might be associated with the initialization of the 'FL0's extended address usage on port G, and chip selects on port H?

With regard to the latter chip selects, I attach some code for educational and comparative purposes.

buf34.asm contains Motorola's original BUFFALO monitor, used on Motorola's EVBU and similar variants which usually used the 'A0 or 'A1 variants, not the 'F1.
F1BUF34.asm contains a modified version of BUFFALO for use with the 'F1 on Pete Dunster's 'F1 controller.
f1v11doc.pdf contains a schematic and memory map of Pete Dunster's 'F1 controller.

The thing to focus on is the initialization of chip selects in the modified version.  Note that if one wants to use the external RAM for the stack, initialization of the chip selects (which entails programming the CONFIG register EEPROM) must be done prior to setting up the stack pointer, which should be evident when one reviews the modified code.

If you can establish where CSGSIZ, CSGADR and CSCTL are being initialized in your disassembled code, that would go a long way into untangling the memory usage on the radio.

[Andy Chee]

On reading some of the old hc11 literature I had, I discovered that the 'C0 has memory paging.  Personally I've never encountered this variant in the wild.  Nevertheless, the datasheet could be useful for your reverse engineering efforts.

https://www.nxp.com/docs/en/data-sheet/MC68HC11C0TS.pdf

[skip]

On reading some of the old hc11 literature I had, I discovered that the 'C0 has memory paging.  Personally I've never encountered this variant in the wild.  Nevertheless, the datasheet could be useful for your reverse engineering efforts.

https://www.nxp.com/docs/en/data-sheet/MC68HC11C0TS.pdf

THANK YOU!  This looks VERY useful and I bet the FL0 is very similar.

Looks like I'll be spending some quality time with Ghirda in the coming days, weeks, months...

73's Skip

[Andy Chee]

Looks like the K variants also have extended memory mapping;

https://www.nxp.com/docs/en/data-sheet/M68HC11K.pdf

[skip]

Looks like the K variants also have extended memory mapping;

https://www.nxp.com/docs/en/data-sheet/M68HC11K.pdf

And a port H plus examples of 512k for external code memory!

Closer yet.

Thank you again!

Skip

[skip]

Progress!

I think I've found the 2777 byte program that's downloaded in bootstrap mode to update the firmware.

I've started analyzing it and things are starting to make sense.

I'm going to try to modify it to serve as a simple hello world starting point for experimentation.

When/if I get that running I'll try to port the BUFFALO monitor.

Thanks again for all of the help guys, this is starting to get interesting!

Skip

[Andy Chee]

I found an archive of Motorola's FTP site on archive.org.  It appears several of the download links have been archived, so it might be worth mining for 68HC11 resources.

https://web.archive.org/web/19980208145523/http://freeware.aus.sps.mot.com/freeweb/areas.amcu.html

[skip]

Wow, .ARC files ... been a while since I saw/thought about those.

Thanks!
Skip