HP49G+ Emulation Project

This project will reach its goal when these pages will provide enough informations to build an emulator of this powerful calculator.

• IRC : irc.efnet.net #hp48
• Newsgroup : comp.sys.hp48
• E-mail : mwyann.remove@spam.hotmail.com (please delete "remove" and "spam")

1. Status
2. News
3. Running the ROM
4. Hardware specifications
5. Memory map
6. LCD Controller
7. S3C2410X Processor
8. Tools
9. Programming the HP49G+

Status

We have more and more informations. I have began an Emulator, actually just the ARM emulator. See this page for more informations.

News

• Someone sent me some interesting informations : Mail from Claudio Lapilli
• Memory map : Good work Al ! :) He has read the ROM disassembly : hp49-arm-rom-1.23.txt.gz (358 Ko)
• I PASSED MY EXAMS SUCCESSFULLY :))) well I can have nice holidays now :))) and release more news about the HP :))
• Wednesday, i'm going to have my oral exams. I'll tell you the result. News : Memory map "multi-mappage"; ARM 920T official manual; "Running the ROM" section
• I've made a small program that takes a screenshot and place it on the stack, as a 160x80 grob. "Headman" can do it too. Download : SCREENSHOT.txt
• I have dumped some memory, from 0x7000000 to 0x7FFFFFF. For the dump : hp49gp_dump_70_7F.tar.gz (14 Ko). Here is screen data in this dump : see this screenshot :
  
  See the memory map table for more informations.
• 2004, July 3rd : I must pass oral exams. :(((  I had 13/20 in English and 14/20 in Maths. :))
• 14:00 2004, July 2nd : Last update. And I wait for my exams results... :))))
• I have a dump of the RAM memory too !!! :) You can download it here : hp49gp_dump_RAM.bin.gz (219 Ko GZipped). Note that is MY RAM, so you'll can see parts of my files. I have written off the confidential parts.
• I finally have a dump of the flash memory :))) You can download it here : hp49gp_dump_flash.bin.gz (1.2 Mo GZipped). You can also download the program I used to dump the memory : DUMPIT.txt . Assemble it on the calc. Usage : place a value like #4000h on the stack and launch the program. It will dump 128 Kbytes and place it on the stack as a string. You can then save it into the SD card, or store it into the memory. Becareful : Don't enter anything else than "#" values and don't try to dump unknown memory : your HP will freeze. If you do so, if you don't listen to me,  remove and replace a battery and it will work again.
• 2004, July 1st : We add a first memory map
• 2004, June 30th : First version

Running the ROM

• You can run the ROM by using the Lauterbach ARM Emulator (see Tools)
• The ROM starts, and I fall into a loop :
  
  0x08001E28 ldr r1,[r11,#0x64]
  0x08001E2C and r1,r1,#0xff00
  0x08001E30 cmp r1,#0xff00
  0x08001E34 bne #0x08001E28
  
  R11 = 0x56000000, so it points into the RAM (see the memory map). In my dump, [r11,#0x64] = 0x000087E4. So it should loop infinitely.

Hardware specifications

• LCD Screen : 131x80
• RAM : 512 kB BS616LV410 chip, organized as 256k x 16 - BS616LV4010 Specifications (PDF)
• Flash : 2 MB SST39VF160 chip, organized as 1M x 16 - SST39VF160 Specifications (PDF)
• CPU : S3C2410X (an ARM920T implementation, which add some controllers)

Memory map

WARNING : THESE INFORMATIONS ARE HERE FROM OBSERVATIONS. Perhaps mistakes, but not too much :)

Memory can be mapped in several positions. I do not have all absolute positions... Here is a good post from Al Borowski : remapping.txt and a Mail from Claudio Lapilli

Which memory ?	Absolute positions	Relative positions	Size	Description
Flash memory	0x00000000 0x00200000 0x00400000 0x00600000	0x00000000	16 Kb	"Non-system OS" and exception handlers
		0x00003FEF
		0x00003FF0	9 b	Calculator serial number
		0x00003FF9
		0x00004000	23 b	ROM Header
		0x00004017
		0x00004018	240 Kb	ARM ROM Code (Saturn emulator)
		0x0003FFFF
		0x00040000	1 Mb	Saturn ROM Code
		0x0013FFFF
		0x00140000	768 Kb	User Flash (port 2)
		0x001FFFFF
Unknown	0x07F00000	0x00000260	1600 b	Screen data (1 bit/pixel, monochrome)
		0x0000089F
RAM	0x08000000 0x08080000 0x56000000 0x56080000	0x00000000	128 Kb	Reserved for the system (see the Note)
		0x0001FFFF
		0x00020000	128 Kb	ERAM (Port 1)
		0x0003FFFF
		0x00040000	256 Kb	Home/IRAM (Port 0)
		0x0007FFFF

• We have data at [0x0-0x407F] - raw : nonsys - source : nonsys.asm (becareful with "b" instructions) . These data are the beginning of the flash ROM, also available.
• Note : I've emulated the flash memory with the Lauterbach ARM Emulator (see above). When booting, the code from [00000330-00003F7F] is copied to [08001300-08004F4F]. This code is the "Non-System OS".
• R1 and [08001300-08004F4F] are in "my system zone" of the RAM. That's why I supposed it. The dump has confirmed.
• Thanks to Robert Hildinger for these ARM->Saturn register mappings. 0x08002F54 is the R1 base for accessing Saturn Emulator informations.
  
  

  ; Base (R1) offset Description, ie, [r1, #0x92C] is R0lo ; A Saturn register is 64bit, so a 32bit ARM register ; can only hold 1/2 a saturn register. ;--------------------------------------- ;0x90C Saturn register Alo (low order 8 nibbles) ;0x910 Saturn register Ahi (high order 8 nibbles) ;0x914 Saturn register Blo (low order 8 nibbles) ;0x918 Saturn register Bhi (high order 8 nibbles) ;0x91C Saturn register Clo (low order 8 nibbles) ;0x920 Saturn register Chi (high order 8 nibbles) ;0x924 Saturn register Dlo (low order 8 nibbles) ;0x928 Saturn register Dhi (high order 8 nibbles) ;0x92C Saturn register R0lo (low order 8 nibbles) ;0x930 Saturn register R0hi (high order 8 nibbles) ;0x934 Saturn register R1lo (low order 8 nibbles) ;0x938 Saturn register R1hi (high order 8 nibbles) ;0x93C Saturn register R2lo (low order 8 nibbles) ;0x940 Saturn register R2hi (high order 8 nibbles) ;0x944 Saturn register R3lo (low order 8 nibbles) ;0x948 Saturn register R3hi (high order 8 nibbles) ;0x94C Saturn register R4lo (low order 8 nibbles) ;0x950 Saturn register R4hi (high order 8 nibbles) ;0x954 Saturn register d0 ;0x958 Saturn register d1 ;0x95C Saturn register P ;0x968 Saturn register ST ;0x96C Saturn register HST ;0x970 Saturn CARRY flag ;0x974 Saturn DECIMAL_MODE flag

LCD Controller

• grayscale.txt allowed us to determine LCD informations
• You can now download my screen viewer : screenviewer.exe.gz (150 Ko, run under Windows). Just place a memory dump as "dump.bin" in the same directory as the executable and run. Choose if you want Binary screen or 16 color, and choose the offset. The programis preconfigured for the screen 0x7F00000 dump.
• Here is screen data : see this screenshot (token when I was dumping :)) :
  
  
  Here is only >> << garbage data !
  
  
• See some screen data in my RAM dump (these screen data are stored in my example programs) :
  

S3C2410X Processor

• Other emulator and docs : http://sources.redhat.com/sid/? and http://gnuarm.org/resources.html
• [PDF] Samsung official S3C2410X manual
• [PDF] ARM 920T official manual
• exception handlers :

00000000    b  #0x20  ; Reset
00000004    b  #0x108 ; Undefined instruction
00000008    b  #0x124 ; Software interrupt
0000000c    b  #0x140 ; Abort (prefetch)
00000010    b  #0x15c ; Abort (data)
00000014    b  #0x14  ; Reserved (seems to lock the calc)
00000018    b  #0x178 ; IRQ
0000001c    b  #0x190 ; FIQ

Tools

• ARM Development IDE [ http://eies.njit.edu/~baltrush/ARM_Information.htm ] - Run under Windows
• Lauterbach ARM Emulator [http://www.lauterbach.com/frames.html ] - Run under Windows

Programming the HP49G+

• ARM Programming on the HP49G+ [http://www.alpage.ath.cx/hptute/arm.htm]