HP49G+ Non-system OS and exception handlers
Matt R.
+? If not, at what absolute address is flashing possible? I'm a bit
skeptical as I think HP would make this portion unwritable. Also, is
there a separate BIOS outside of the flash ROM?
Thanks! ~Matt
Al Borowski
As far as I know, it's possible to write to the entire flash ROM - I
haven't tried it though! The flash ROM used in the 49g+ doesn't have
the ability to block writes to certain locations. I don't think
there's any external logic to prevent writes like there is in the TI
series. There is only 1 flash chip.
Do you just want to adjust the exception handlers? The existing ROM
moves the vectors into RAM anyway. If you're interested:
Address Exception Mode in Entry HP's
Vector
0x00000000 Reset Supervisor NA
0x00000004 Undefined instruction Undefined
0x8000004
0x00000008 Software Interrupt Supervisor
0x8000008
0x0000000C Abort (prefetch) Abort
0x800000C
0x00000010 Abort (data) Abort
0x8000010
0x00000014 Reserved Reserved NA
(Endless Loop)
0x00000018 IRQ IRQ
0x8000018
0x0000001C FIQ FIQ
0x800001C
It's pretty easy to enter supervisor mode for instance, by poking the
address to your function into 0x8000008 and running an SWI
instruction.
Have fun,
Al
Matt R.
Thanks for the info. Though, I'm still not sure if this portion is
updated when a new revision of the ROM is flashed. Also, it'd be good
to know if there is a separate BIOS/ROM whatever that contains the
code to re-flash the chip. If I'm screwing around in the first 16Kb
and it contains the vital re-flash code... well, that's rather
important. I'd really have a brick then. :)
Matt
Matt Rohloff
OK, I tried flashing u-boot (sourceforge) to the HP, but after restart
of the calc, it said it was invalid. The first 16KB apparently
*cannot* be flashed via regular methodology. If I'm not mistaken, the
Kinpo OS starts flashing at 0x00004018. If there is an app available
to flash from 0x0, the calc CAN be bricked.
Has anyone written one? :)
~Matt
Claudio Lapilli
<...>
> If there is an app available
> to flash from 0x0, the calc CAN be bricked.
Yes, that's one good reason why you shouldn't mess with it.
>
> Has anyone written one? :)
What exactly are you trying to achieve, other than trashing your
calculator?
If you change the rom and flash it, once you get past the boot you can
take complete control, all you lose is 16 kbytes.
Now, what is it that you think you can do in 2MBytes of flash that you
can't do in (2MB-16KB)?
Claudio
Matt Rohloff
Hey, no, I'm not trying to brick my calc, that's why I have this:
http://www.littlechips.com/LN2410SBC_LP35.htm
One possible reason could be to make a locking mechanism...
The Reset exception handler resides in this 16KB area.
Matt
Claudio Lapilli
> On Jun 21, 7:49 pm, Claudio Lapilli <pleasedonts...@isp.com> wrote:
>
>
>
>
>
> > On Jun 19, 9:06 pm, Matt Rohloff <matthew.rohl...@gmail.com> wrote:
>
> > <...>
>
> > > If there is an app available
> > > to flash from 0x0, the calc CAN be bricked.
>
> > Yes, that's one good reason why you shouldn't mess with it.
>
> > > Has anyone written one? :)
>
> > What exactly are you trying to achieve, other than trashing your
> > calculator?
> > If you change the rom and flash it, once you get past the boot you can
> > take complete control, all you lose is 16 kbytes.
> > Now, what is it that you think you can do in 2MBytes of flash that you
> > can't do in (2MB-16KB)?
>
> > Claudio
>
> Hey, no, I'm not trying to brick my calc, that's why I have this:http://www.littlechips.com/LN2410SBC_LP35.htm
That's a very interesting toy!
That board properly connected to a calculator keyboard could be the
device everybody has been dreaming here for a while. Flash is large
enough to store the entire calculator flash + enough space for some
hacks (to handle the new screen) + perhaps Linux, so you could run in
Linux mode or HP50G mode. Too bad it takes a lot of money just to
start playing with it.
>
> One possible reason could be to make a locking mechanism...
> The Reset exception handler resides in this 16KB area.
But once you get past the initial moments, the reset procedure
continues in the flashable rom, so it could be replaced. The only
thing you won't be able to avoid is that someone pressing + and -
while resetting the calc could flash a different rom and unlock the
calc.
Claudio