Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B

[suj]

...
pSOS being so old it's hard to find DOC on as well

I have also Anritsu MS4623B and it use pSOS. I have some DOC's for pSOS.

[analogRF]

maybe it just means capital C

[suj]

Part 2

[smgvbest]

Code: [Select]

->dbyte
00000000  00 00 00 00 00 00 ad 34 4e 56 00 00 4e 41 00 00   .......4NV..NA..
->dbyte 1024
00001024  53 49 53 00 6a fa 20 49 72 ff b2 90 67 04 4a 90   SIS.j. Ir...g.J.


These are exactly the bytes of bootrom at 0x00 and 0x1024. 

Cool, and that would make sense.  the boot rom would exist at 0x00000000
if I recall the 1024 bytes on the M68K is the vector table
of course that command dbyte 1024 is dump 0x1024 not dec 1024  :O

[tv84]

Be carefull, the address is 0x0401 1000. Not 0x0040 1100!

For now, just get me this region:

0x048B9200 -> 0x048B9500

[smgvbest]

maybe it just means capital C

Tried, does not accept it either

[smgvbest]

Be carefull, the address is 0x0401 1000. Not 0x0040 1100!

For now, just get me this region:

0x048B9200 -> 0x048B9500

Here ya go

Code: [Select]

**** Mosquito Bootrom ***** 00 00 00 00 00 00 00 00 00 00   ................
Copyright 1988-1997,
Hewlett-Packard Company, all rights reserved.

@(#)HEWLETT-PACKARD, E4401 Bootrom, 3.10
@(#)LDS Rev: 3.02 - Module Incremental (Feb 18 1999)
@(#)Linked: Feb 18 1999 11:46:22

Bootrom Checksum ...
Bootrom DRAM:     Testing 69632 bytes at 0x04000000
Non Destructive SRAM Test ...
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000
Main FW Checksum ...
    ROM Checksum Failure.  Bad Checksum.  01, 0
Self-tests complete.SRAM selftest results:
        Start  = 0xa000000
        End    = 0xa007fa3
        Errors = 0x0
DRAM selftest results:
        Start  = 0x4011000
        End    = 0x6000000
        Errors = 0x0
hpibPort = 0x8005000
hpibPort = 0x8005000, bus Address = 19

Unexpected exception at VBR offset 0x8
  Access Fault (bus error)
  format = 7, frame is at 0x400473c
  PC = 0x4e410000
  SR = 0x2700
  Registers = 0x0a007fa4 thru 0x0a007fef
  Access Address = 0x4e410000
ROM Monitor
Enter ? for help.
-> ?
bc      [<hex boot config>] - set the bootrom configuration (see bchelp)
bootvars- display bootrom variables
bs      - force a breakpoint when starting
dbyte   [<hex start address> [num bytes]] - display memory using bytes
dlong   [<hex start address> [num bytes]] - display memory using longs
dmem    [<hex start address> [num bytes]] - display memory using bytes
dword   [<hex start address> [num bytes]] - display memory using words
gbreak  - force a gdb breakpoint
gdb     - enable gdb trapping of exceptions
gu      [<hex start addr>]      - go to start address
hmon    [device] - download into memory
rty test routine
sbyte   <hex start address> <hexchars> - set memory using bytes
slong   <hex start address> <hexchars> - set memory using longs
smem    <hex start address> <hexchars> - set memory using bytes
sword   <hex start address> <hexchars> - set memory using words
version - display bootrom version

->dbyte 0x048b9200 2048
048b9200  cc dd 4c cc d4 cc cd dc 4c 8c 8c ee c8 cc c4 cc   ..L.....L.......
048b9210  33 33 33 b1 75 b7 33 13 10 b6 32 33 23 a2 33 37   333.u.3...23#.37
048b9220  33 33 33 31 71 b7 33 93 10 b6 32 32 3b a2 33 33   3331q.3...22;.33
048b9230  dc dc 4c cd d5 ec ce dc 4c 8c 8c ce c8 ce c4 cc   ..L.....L.......
048b9240  dc dd 4c cd d4 ec cc ce 4c 8c 8c ee c9 cc c4 dc   ..L.....L.......
048b9250  33 33 33 b3 71 b7 33 93 10 36 36 33 3b a2 33 33   333.q.3..663;.33
048b9260  37 33 33 b3 75 b7 33 13 10 b6 32 32 3b 22 33 33   733.u.3...22;"33
048b9270  cc dd 4c cd d4 ec cf dc 4c 8c 8c ce c8 ce c6 cc   ..L.....L.......
048b9280  5c c4 9c 80 dc ec 6c c5 cc 40 86 c1 cc cd cc cc   \.....l..@......
048b9290  13 33 b3 33 33 bf 33 33 33 33 33 51 32 27 35 b7   .3.33.33333Q2'5.
048b92a0  13 33 b3 33 33 b7 33 33 33 31 33 11 32 27 35 37   .3.33.33313.2'57
048b92b0  5e c4 9c 84 fc ec 6c e5 cd 48 86 c1 cc cd cc cc   ^.....l..H......
048b92c0  5e c4 9c 84 cc ec 6c c4 cc 40 84 c1 cc cd cd ce   ^.....l..@......
048b92d0  13 33 b3 33 33 b3 33 b3 33 33 33 51 32 27 31 b7   .3.33.3.333Q2'1.
048b92e0  13 33 b3 33 33 bf 33 b3 33 31 33 11 32 27 31 b7   .3.33.3.313.2'1.
048b92f0  5e c4 9c 84 dc ec 6e c5 cc 48 84 c1 cc cd cc cc   ^.....n..H......
048b9300  dc dd 4e cd c4 cc cd de 4c 8c 8c ce c9 cc c4 8c   ..N.....L.......
048b9310  37 33 33 33 75 b7 33 13 10 b6 36 b2 33 a2 33 37   7333u.3...6.3.37
048b9320  37 33 33 31 75 b7 33 13 10 b6 36 b2 3b a6 33 33   7331u.3...6.;.33
048b9330  cc dc 4c cd d4 cc cd cc 4c 8c 8c ce c9 ce c6 cc   ..L.....L.......
048b9340  cc dd 4c cd d4 cc ce ce 4c 8c 8c cc c9 cc c4 8c   ..L.....L.......
048b9350  33 33 33 b1 71 b3 33 13 10 b6 32 32 3b a2 33 37   333.q.3...22;.37
048b9360  37 31 33 b1 35 b3 33 93 10 b6 36 32 23 a2 33 37   713.5.3...62#.37
048b9370  cc dc 4c cd d4 cc cc dc 4c 8c 8c ce c8 ce c6 cc   ..L.....L.......
048b9380  5c c4 9c 84 fc ec 6c c5 cc 40 85 c1 cc cc cc ce   \.....l..@......
048b9390  53 33 b3 33 3b bf 33 b3 33 33 33 51 32 23 31 b7   S3.3;.3.333Q2#1.
048b93a0  53 33 b3 33 33 bb 33 33 33 33 33 51 36 23 35 33   S3.33.33333Q6#53
048b93b0  5e c4 9c 84 fc ec 6c c7 cd 48 87 c0 cc cd cc cc   ^.....l..H......
048b93c0  5c c4 9c 80 fc ec 6e c5 cd 40 84 c1 cc cc cc ce   \.....n..@......
048b93d0  13 33 b3 33 33 bb 33 33 33 33 33 51 32 27 31 b7   .3.33.33333Q2'1.
048b93e0  13 33 b3 33 3b bf 33 b3 33 33 33 51 32 27 35 b3   .3.3;.3.333Q2'5.
048b93f0  5c c4 9c 84 fc ec 6c c4 cd 48 84 c1 cc cd cd ce   \.....l..H......
048b9400  aa aa ec 4c c8 8c ec c0 4c c4 cc cc de c5 ce 4c   ...L....L......L
048b9410  73 13 23 5b 39 b3 33 11 23 33 3a 2f 73 e7 b3 73   s.#[9.3.#3:/s..s
048b9420  73 13 a3 5b 71 b3 37 10 03 33 3a 2f 73 e3 bb 73   s..[q.7..3:/s..s
048b9430  dc cc ee 4c c8 8c ec c4 4e c4 cc cc de cd cc 4c   ...L....N......L
048b9440  dc cc ee 4c c8 9d ec c0 4c c4 cc cc de cd cc 6c   ...L....L......l
048b9450  33 13 23 5b 39 b3 33 11 23 33 32 2b 73 e3 bb 33   3.#[9.3.#32+s..3
048b9460  73 13 a3 1b 39 bb 37 11 03 33 32 af 73 e3 b3 73   s...9.7..32.s..s
048b9470  dc cc ec 4c c8 8c ec c4 4e c4 ce cc dc cc cc 4c   ...L....N......L
048b9480  ce 4c 8d e4 c8 cc ce cc 4c ec ef 8c 9d dd cc 08   .L......L.......
048b9490  22 3b 33 23 33 33 b3 83 33 33 77 3b 97 33 f3 12   ";3#33..33w;.3..
048b94a0  22 3b b3 67 33 33 b3 03 73 3b 67 3f 93 33 f3 12   ";.g33..s;g?.3..
048b94b0  ce 4c 8c e4 c8 cc ee cc 4c cc ec 8c 9d dd cd 08   .L......L.......
048b94c0  4c 4c 8c c4 c8 cc ee cc 4c cd ec 8c 9d dc cc 08   LL......L.......
048b94d0  26 3b b3 23 33 33 b3 63 33 3b 63 37 17 33 f7 12   &;.#33.c3;c7.3..
048b94e0  22 3f b3 63 33 33 b3 03 33 3b 67 3f 9f 33 b3 12   "?.c33..3;g?.3..
048b94f0  cc 4d 8c e4 c8 cc ec cc 4c ec ee 8c 9c df cc 08   .M......L.......
048b9500  de cc ec 4c c8 9d ec c0 4e c4 ce cc dc cc cc 6c   ...L....N......l

048b9510  33 13 23 13 31 b3 33 11 23 33 3a 2f 33 e7 b3 73   3.#.1.3.#3:/3..s
048b9520  33 13 a3 53 79 bb 37 11 03 33 32 2f 33 e3 b3 73   3..Sy.7..32/3..s
048b9530  df cc ee 4c c8 8c cc c4 4c c4 ce cc dc cd ce 4c   ...L....L......L
048b9540  de cc ee 4c c9 9d ec c0 4c c4 cc cc dc cd ce 6c   ...L....L......l
048b9550  73 13 23 1b 31 bb 37 11 23 33 3a 2f 33 a3 bb 73   s.#.1.7.#3:/3..s
048b9560  73 13 a3 1b 79 b3 37 11 23 33 32 bf 7b e3 bb 73   s...y.7.#32.{..s
048b9570  cc cc ec 4c c8 8d ec c4 4e c4 ce cc dc cc ce 4c   ...L....N......L
048b9580  ce 4c 8d e4 c8 cc ec cc 4c cc ee 8c 8c df cd 08   .L......L.......
048b9590  22 3b b3 23 33 33 b3 03 33 3b 63 3f 9b 33 f3 12   ";.#33..3;c?.3..
048b95a0  26 33 b3 67 33 33 b3 03 33 3b 77 3f 17 33 d7 12   &3.g33..3;w?.3..
048b95b0  ec 4c 8d c4 c8 cc ee cc 4c ec ee 8c 9c df cc 88   .L......L.......
048b95c0  4c 4c 8d c4 c8 cc ec cd 4c ed ec 8c 9c df cd 08   LL......L.......
048b95d0  22 3b b3 23 33 33 b3 03 33 3b 77 3f 97 33 f7 12   ";.#33..3;w?.3..
048b95e0  22 3b b3 23 33 33 b3 83 33 33 6b 3f 17 33 f7 12   ";.#33..33k?.3..
048b95f0  cc 4c 8c e4 c8 cc ec cc 4c ec ec 8c 9c df cd 08   .L......L.......
048b9600  dc dd 4c cd d4 cc cd ce 4c 8c 8e ce c9 ce c4 8c   ..L.....L.......
048b9610  37 33 33 b3 71 33 33 93 10 b6 32 33 2b a2 33 37   733.q33...23+.37
048b9620  33 33 33 b1 71 b3 33 93 10 b6 32 b2 3b a6 33 37   333.q.3...2.;.37
048b9630  dc dc 4c cc d4 cc cf ce 4c 8c 8c ce c9 ce c6 dc   ..L.....L.......
048b9640  dc 5d 4c cd c5 cc cf dc 4c 8c 8c ee c8 ce c6 cc   .]L.....L.......
048b9650  37 33 33 b3 75 b3 33 13 10 b6 32 32 2b a2 33 33   733.u.3...22+.33
048b9660  37 33 33 b1 35 b3 33 93 10 b6 36 b2 2b a6 33 37   733.5.3...6.+.37
048b9670  dc 4c 4c cd d4 cc cf cc 5c 8c 8c ce c8 cc c6 dc   .LL.....\.......
048b9680  4c c4 9c 84 ec ec 6c c5 cc 40 84 c1 cc cc cc ce   L.....l..@......
048b9690  53 33 b3 33 33 bb 33 b3 33 33 33 51 32 23 35 33   S3.33.3.333Q2#53
048b96a0  13 33 b3 33 3b b3 33 b3 33 31 33 51 32 27 31 b7   .3.3;.3.313Q2'1.
048b96b0  5c c4 9c 84 fc ec 6c c5 cc 48 86 c1 cc cc cc cc   \.....l..H......
048b96c0  5c c4 9c 84 fc ec 6e c4 cf 40 96 c1 cc cc cc ce   \.....n..@......
048b96d0  53 33 b3 33 33 bf 33 33 33 33 33 51 32 27 31 37   S3.33.33333Q2'17
048b96e0  53 33 b3 33 33 bb 33 b3 33 33 33 11 32 27 35 37   S3.33.3.333.2'57
048b96f0  4c c4 9c 84 fc ec 6e c5 cd 48 84 c1 cc cd cc cc   L.....n..H......
048b9700  dc dd 4c cd d4 ec cc de 4c 8c 8c ce c8 cc c6 8c   ..L.....L.......
048b9710  37 33 33 31 75 b3 33 93 10 b2 32 b3 23 a6 33 37   7331u.3...2.#.37
048b9720  37 33 33 31 75 b3 33 13 10 b2 32 b2 2b a2 33 33   7331u.3...2.+.33
048b9730  dc dc 4c cd c4 cc cf de 4c 8c 8c cc c9 cc c4 cc   ..L.....L.......
048b9740  dc 5c 4c cd d4 cc ce cc 4c 8c 8c ce c9 ce c4 cc   .\L.....L.......
048b9750  33 33 33 b3 75 b3 33 13 10 b6 32 b2 2b a6 33 37   333.u.3...2.+.37
048b9760  33 31 33 b1 31 b7 33 93 10 b2 36 b2 2b a6 33 37   313.1.3...6.+.37
048b9770  dc 5c 4c cd d4 cc cf cc 4c 8c 8c ce c9 cc c4 dc   .\L.....L.......
048b9780  5c c4 9c 84 fc ec 6e c5 cd 48 86 c0 cc cd cd ce   \.....n..H......
048b9790  13 33 b3 33 3b b7 33 b3 33 33 33 51 32 27 31 37   .3.3;.3.333Q2'17
048b97a0  53 33 b3 33 33 bf 33 b3 33 31 33 11 32 23 35 37   S3.33.3.313.2#57
048b97b0  5e c4 9c 84 dc ec 4c c5 cd 48 86 c0 cc cd cc ce   ^.....L..H......
048b97c0  5e c4 9c 84 fc ec 6e e5 cd 48 84 c1 cc cd cc ce   ^.....n..H......
048b97d0  53 33 b3 33 33 b3 33 b3 33 33 33 11 32 23 35 33   S3.33.3.333.2#53
048b97e0  53 33 b3 33 33 bf 33 b3 33 31 33 11 32 27 31 37   S3.33.3.313.2'17
048b97f0  5e c4 9c 84 ec ec 6e c5 ce 48 86 c1 cc cc cc ce   ^.....n..H......
048b9800  aa aa cc cc c5 1c ac ec ec 48 84 c4 cc f5 cc cd   .........H......
048b9810  33 f3 62 3b 73 12 33 fb a0 12 13 31 17 b7 3a 69   3.b;s.3....1..:i
048b9820  33 b3 20 3b 37 12 33 3b a0 12 13 b1 17 b7 3e 61   3. ;7.3;......>a
048b9830  c5 c5 cc cc c4 1c af ec ec 48 85 c4 dd f5 cc cc   .........H......
048b9840  d5 c4 c4 cc c4 1c ae ec cc 48 8e c4 cc f5 cc cc   .........H......
048b9850  b3 b3 62 3b 73 12 33 33 a0 12 13 33 13 b3 3e 21   ..b;s.33...3..>!
048b9860  b3 f3 60 33 73 12 37 2b 20 12 17 b1 17 b7 be e1   ..`3s.7+ .......
048b9870  d5 c4 cc ec c4 1c af ec ec 48 85 c4 cd f5 cc cc   .........H......
048b9880  88 c4 9c ce 45 cc 4c ce ec ec cd 0c c0 cc c6 ac   ....E.L.........
048b9890  a3 a3 36 37 27 93 13 ab 73 37 b7 33 73 53 e3 3e   ..67'...s7.3sS.>
048b98a0  a3 a3 32 37 27 93 13 ab 33 37 b7 3b 33 5b e3 2a   ..27'...37.;3[.*
048b98b0  88 c4 9c cc 44 cc 4e cc ec ec cc 0c c0 cc c4 ac   ....D.N.........
048b98c0  89 c4 9c 8e 44 cc 4f cc 6c ec cc 0c c2 cc c5 8c   ....D.O.l.......
048b98d0  23 a3 32 37 23 93 17 2b 33 33 b7 3b 73 53 e3 2e   #.27#..+33.;sS..
048b98e0  23 a3 36 37 27 93 17 ab 73 33 b3 33 b3 5b e3 3e   #.67'...s3.3.[.>
048b98f0  89 c4 9c ec 44 cc 4d ce 6c ec cc 8c d2 cc c5 ac   ....D.M.l.......
048b9900  d5 c4 c4 ec c4 1c ae ec cc 48 84 c4 cd f4 cc cd   .........H......
048b9910  b7 f3 62 3b 73 12 33 73 a0 12 13 b3 17 b7 be 69   ..b;s.3s.......i
048b9920  b7 b7 60 3b 73 12 33 bb a0 12 13 31 17 b7 36 69   ..`;s.3....1..6i
048b9930  d5 c4 cc cc c4 1c ad ce cc 48 85 c4 cd f4 cc cd   .........H......
048b9940  d4 c4 c4 ec c4 1c ac ec ec 48 8c c4 dd f5 cc cd   .........H......
048b9950  b7 f7 60 3b 73 32 33 3b b0 12 17 31 17 b7 32 29   ..`;s23;...1..2)
048b9960  17 f3 62 3b 73 12 33 2b a0 12 13 31 17 b7 b6 69   ..b;s.3+...1...i
048b9970  c5 c4 cc cc c6 1c af ec ec 48 84 c4 cd f4 cc cc   .........H......
048b9980  89 c4 9c ec 65 cc 4f ce ec ec cc 0c d2 cc c6 8c   ....e.O.........
048b9990  a3 a3 32 37 23 93 17 ab 73 33 b7 33 b3 5b e3 3a   ..27#...s3.3.[.:
048b99a0  a3 a3 32 37 27 93 1f a3 73 37 b7 33 f3 5b e3 2e   ..27'...s7.3.[..
048b99b0  88 c4 9c ec 44 cc 4d cc ec ec cc 0d d0 cc c4 8c   ....D.M.........
048b99c0  89 c4 8c ec 44 cc 4f ce ec ec cd 0c d2 cc c6 8c   ....D.O.........
048b99d0  23 a3 36 37 27 93 17 ab 73 33 27 3b f3 5f e3 2e   #.67'...s3';._..
048b99e0  a3 a3 32 37 23 93 17 2b 73 37 b7 33 b3 57 e3 3e   ..27#..+s7.3.W.>
048b99f0  88 c4 8c ec 44 cc 4f ce ec ec cc 8c d0 cc c6 8c   ....D.O.........


[suj]

OK, I prepared the hardware to handle the serial port, set up 19200 8n1. After start, E4407B sends information.

Code: [Select]

***** Mosquito Bootrom *****                                                   
Copyright 1988-1997,                                                           
Hewlett-Packard Company, all rights reserved.                                   
                                                                               
@(#)HEWLETT-PACKARD, E4401 Bootrom, 5.00                                       
@(#)LDS Rev: 3.02 - Module Incremental (Sep  9 2003)                           
@(#)Linked: Sep  9 2003 14:46:44                                               
                                                                               
Bootrom Checksum ...                                                           
Bootrom DRAM:     Testing 69632 bytes at 0x04000000                             
Non Destructive SRAM Test ...                                                   
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000                   
Main FW Checksum ...                                                           
Self-tests complete.SRAM selftest results:                                     
        Start  = 0xa000000                                                     
        End    = 0xa007fa3                                                     
        Errors = 0x0                                                           
DRAM selftest results:                                                         
        Start  = 0x4011000                                                     
        End    = 0x6000000                                                     
        Errors = 0x0                                                           
hpibPort = 0x8005000                                                           
hpibPort = 0x8005000, bus Address = 19                                         
                                                                               
Cache Enabled                                                                   
16MBytes of FLASH                                                               
                                                                               
Download to Flash Selected                                                     
>>> mainMain()                                                                 
text segment:           0x4011000 thru 0x4435674 ( 424674 bytes)               
data segment:           0x4600000 thru 0x476dd88 ( 16dd88 bytes)               
bss  segment:           0x476dd88 thru 0x48bcce8 ( 14ef60 bytes)               
                                                                               
ROM size:               0x005923fc ( 5923fc bytes of 4194304 max.)             
                                                                               
memory pool (all):      0x048bcce8 thru 0x05ffffff (24392472 bytes)             
Calling start_psos() ...                                                       
FLOPPY_Media::read: Could not read sector 1 on track 0 on side 0               
>>>> debug() process starting                                                   
DLP Loaded - Power Suite Utilities, A.06.05, Nov 21 2003 15:45:40               
----- System/pSOS Debug commands: -----                                         
    '?' - this help message.                                                   
    'j' - drop into breakpoint.                                                 
   '^C' - Abort to monitor.                                                     
   '^P' - Process status info, and LOTS of it.                                 
 '[dD]' - Print DLP debug information.                                         
 '[bB]' - Big memory hog report.                                               
 '[pP]' - Process ONLY status info.                                             
                                                                               
 '[eE]' - Exchange info.                                                       
 '[gG]' - toggle breakpoint exception handlers on/off                           
 '[tT]' - Time log.                                                             
 '[hH]' - History log.                                                         
 '[oO]' - Memory segment ownership.                                             
 '[mM]' - Memory segment summary.                                               
 '[sS]' - Semaphore ownership, etc.                                             
 '[uU]' - maximum process stack Usage.                                         
 '[vV]' - memory Validity check.                                               
 '[iI]' - Show psosSystemData.                                                 
 '[1]' -  Show NVRAM contents.                                                 
 '[wW] <process name>' - Show process stack trace.


How do I enter the monitor? Sandra, you wrote about a planned error. How to do it?

I am ready to deliver information from my device with the options installed, please just keep in mind that I am not an experienced hacker
I will also point out that my SA has the A.14.01 firmware installed. Can't install the latest firmware yet, FDD can't read floppy disks reliably. It crashes on 2nd or 3rd disk when trying to update. I have to look for a new FDD.

EDIT

I'm now motivated to solve the FDD problem in my SA. I ordered 2 used SLIM FDD from the local auction site. One type NEC FD3238T and the other Teac FD-05HG. The FDD Teac FD-05HF was originally installed in my E4407B, but I haven't found one. Hope one of them will work well, both have a 26 pin connector. If they work, I will update the firmware to version A.14.06.

[smgvbest]

I've had a setback
That FLASH SIMM I used to cause an error that got me into the monitor program.   well, it blew the board.  fortunately it's my spare processor board I've been using to experiment on but its DEAD 
At least it wasn't my actual board I normally use.
DS1-DS7 all on, no boot at all. Likely and hopefully blew a buffer chip (data or address) and not the FPGA.

[smgvbest]

How do I enter the monitor? Sandra, you wrote about a planned error. How to do it?

Cause a error.
I was playing with this before I had the issue om the Processor Board and i think if you put in the ESALOADER disc you can get the Monitor Program that way.
of course this might be a problem for you with the FD issue your having

[analogRF]

can you connect a keyboard and keep slapping it during boot up. maybe that will cause the boot loader to redirect to a console monitor
i dont see any message saying this in the boot log you posted but still it might work

[andrew9875]

Looks like Sandra is correct, you can easily enter the monitor program by booting from the ESALOADR floppy. Just tried it on my E4402B.

When the SA completes booting from the floppy, press 'j' at the serial console then CTRL+C and you're in the monitor program.

Code: [Select]

***** Mosquito Bootrom *****
Copyright 1988-1997,
Hewlett-Packard Company, all rights reserved.

@(#)HEWLETT-PACKARD, E4401 Bootrom, 3.10
@(#)LDS Rev: 3.02 - Module Incremental (Feb 18 1999)
@(#)Linked: Feb 18 1999 11:46:22

Bootrom Checksum ...
Bootrom DRAM:     Testing 69632 bytes at 0x04000000
Non Destructive SRAM Test ...
Main Firmware DRAM:     Testing 33484800 bytes at 0x04011000
Main FW Checksum ...
Self-tests complete.SRAM selftest results:
        Start  = 0xa000000
        End    = 0xa007fa3
        Errors = 0x0
DRAM selftest results:
        Start  = 0x4011000
        End    = 0x6000000
        Errors = 0x0
hpibPort = 0x8005000
hpibPort = 0x8005000, bus Address = 19

Cache Enabled
16MBytes of FLASH

Download to Flash Selected
Downloading from floppy
>>> mainMain()
text segment:           0x4011000 thru 0x40c0c80 (  afc80 bytes)
data segment:           0x4400000 thru 0x4405ec8 (   5ec8 bytes)
bss  segment:           0x4405ec8 thru 0x4424710 (  1e848 bytes)

ROM size:               0x000b5b48 (  b5b48 bytes of 4194304 max.)

memory pool (all):      0x04424710 thru 0x05ffffff (29210864 bytes)
Calling start_psos() ...
>>>> debug() process starting
Unknown debug char: '' (0x03).  Press '?' for help.
Unknown debug char: '' (0x03).  Press '?' for help.
Unknown debug char: 'c' (0x63).  Press '?' for help.
Unknown debug char: '' (0x03).  Press '?' for help.
Unknown debug char: 'c' (0x63).  Press '?' for help.
Unknown debug char: '' (0x03).  Press '?' for help.
----- System/pSOS Debug commands: -----
    '?' - this help message.
    'j' - drop into breakpoint.
   '^C' - Abort to monitor.
   '^P' - Process status info, and LOTS of it.
 '[dD]' - Print DLP debug information.
 '[bB]' - Big memory hog report.
 '[pP]' - Process ONLY status info.

 '[eE]' - Exchange info.
 '[tT]' - Time log.
 '[hH]' - History log.
 '[oO]' - Memory segment ownership.
 '[mM]' - Memory segment summary.
 '[sS]' - Semaphore ownership, etc.
 '[uU]' - maximum process stack Usage.
 '[vV]' - memory Validity check.
 '[iI]' - Show psosSystemData.
 '[1]' -  Show NVRAM contents.
 '[wW] <process name>' - Show process stack trace.

⸤�Ӱ����Unknown debug char: '' (0x03).  Press '?' for help.

Unexpected exception at VBR offset 0x80
  Trap #0
  format = 0, frame is at 0x4423a50
  PC = 0x40b8648
  SR = 0x2704
  Registers = 0x0a007fa4 thru 0x0a007fef
ROM Monitor
Enter ? for help.
->

I will attempt a memory dump later today. I have a few options installed (B72, 1DN, B7B, A4H, BAA, AYX, B7D, B7E), so hopefully this will be useful.

[suj]

This procedure works for me. Tomorrow I should have a fully functional FDD, then I will upgrade the firmware to the last one. In the older firmware version, from 0x048B9200, they are all zeros.

[tv84]

Guys, feel bad for Sandra but great news from the others.

Try to make a dump from 0x0401 1000 up to 0x0490 0000. Those that don't have any license should try to insert a random license before the dump. Just insert "0123456789AB".

[tv84]

This procedure works for me. Tomorrow I should have a fully functional FDD, then I will upgrade the firmware to the last one. In the older firmware version, from 0x048B9200, they are all zeros.

  That's why it's important to normalize versions. My analysis was done with the A.14.06 ESAFW shared by Sandra.

[smgvbest]

Looks like Sandra is correct, you can easily enter the monitor program by booting from the ESALOADR floppy. Just tried it on my E4402B.
I will attempt a memory dump later today. I have a few options installed (B72, 1DN, B7B, A4H, BAA, AYX, B7D, B7E), so hopefully this will be useful.

If that is the menu you see that is the debug menu not the monitor menu where you can dump memory
the dump command is
dbyte start(in hex),len(in bytes)

[suj]

It's working for monitor menu
1. Connect serial to the J1 (19200, 8/N/1)
2. boot from bootloader floppy disk
3. press "j" then "ctrl+c"

After next power cycle (the front power button not working), SA needs full aligment.

[smgvbest]

Starting to fix what I broke.
I have noticed looking at the CLIP there is a Bus defined as DBS_D_T[15.0] that goes to all the FLASH memory but goes no where else.
DBS_D[15.0] goes from the Dynamic bus sizer to the IO buffers but there's no Data buffers.  Strange

Looking at what the FLASH SIMM was attached to is why I'm looking though I did remove all the FLASH Memory from the SIMM and tested it.   All 3 tested Good so thats a plus
I did identify that that 0 ohm is by the U2 Label.   if it's on the right side it connect VPP_FLASH_5V to the memory,  if on the left it connects VPP_FLASH_12V to the memory
that little resistor at the top of the SIMM pulls #BYTE High
PA0_DBS is not connected to the memory
PA1_DB2 is connected to the A1 ping on all the memory

LCS_FLASH4/5 are connected reverse of the other ones   BE1H/BE1L instead of BE1L/BE1H like the others
Only the FLASH OC0_RYBY/U1, FLASH OC1_RYBY/U2 and FLASH OC2_RYBY/U3 are connected the other are NC

Attaching Some Pic of the unpopulated SIMM module

For the Processor Board working with it is difficult while in the SA.   I'l going to see if I can supply 5v to it and troubleshoot on the bench
should let me use the scope much easier.




 

[andrew9875]

Try to make a dump from 0x0401 1000 up to 0x0490 0000.

My memory dump is attached.

FYI, my unit is running the latest A.14.06 firmware.

[tv84]

My memory dump is attached.

FYI, my unit is running the latest A.14.06 firmware.

Curious. It seems a correct dump BUT from a different memory bank (as if it was possible)...

I have to take a deeper look.

It's not the ESAFW. But I don't have here the rest of the package...

EDIT: It's the ESALOADR.

[smgvbest]

My memory dump is attached.

FYI, my unit is running the latest A.14.06 firmware.

Curious. It seems a correct dump BUT from a different memory bank (as if it was possible)...

I have to take a deeper look.

It's not the ESAFW. But I don't have here the rest of the package...

@tv84  Do you run anything to convert these dumps into a bin file or other format?
since they're ascii dumps I figured you might do something like that.

[andrew9875]

Curious. It seems a correct dump BUT from a different memory bank (as if it was possible)...

I have to take a deeper look.

It's not the ESAFW. But I don't have here the rest of the package...

Hmmm. I wonder if this is because ESALOADR is loaded and running.

I think I figured how to access the ROM monitor without ESALOADR running:

• Boot from ESALOADR floppy, drop into ROM monitor menu (j, CTRL+C)
• Retry test routine ('rty')
• Test routine will fail/hang, then remove floppy and power cycle the unit
• Boot from flash will fail and drop you back into ROM monitor

 So far the dump is at least slightly different, just need to wait several hours for it to complete.

[smgvbest]

Curious. It seems a correct dump BUT from a different memory bank (as if it was possible)...

I have to take a deeper look.

It's not the ESAFW. But I don't have here the rest of the package...

Hmmm. I wonder if this is because ESALOADR is loaded and running.

I think I figured how to access the ROM monitor without ESALOADR running:

• Boot from ESALOADR floppy, drop into ROM monitor menu (j, CTRL+C)
• Retry test routine ('rty')
• Test routine will fail/hang, then remove floppy and power cycle the unit
• Boot from flash will fail and drop you back into ROM monitor

 So far the dump is at least slightly different, just need to wait several hours for it to complete.

Have your tried the (J, CTRL+C) on a normal boot
that's what we're after, if it will work

anytime loading ESALOADER you won't get ESAFW loaded off flash and executed.
the ideal is
Boot Normally
Get into Monitor
then Dump Memory

probably should let TV84 know your HOSTID and be sure your running 14.06 of the firmware (I know you are, this is more for anyone else who tries int he future)

[smgvbest]

What do you think about this
1. we need the ESAFW loaded.  So far though we cant' get into the monitor to do the dbyte dump command
2. J14 is Reset on the Processor Card

what if we powered up normally.  once up and firmware loaded we insert the ESALOADER disc and reset
DRAM should still be loaded.

we can then break into monitor and try to dump memory?

another thought is would it be worth hacking the boot rom to enable the ^C to break into the monitor.
it lets you in the monitor when loading the ESALOADER but not the main firmware

[tv84]

another thought is would it be worth hacking the boot rom to enable the ^C to break into the monitor.
it lets you in the monitor when loading the ESALOADER but not the main firmware

Not so easy because the DEBUG MENU is in the ESALOADR, not the BOOTROM.