From: "John R. Hogerhuis" <jhoger@...>
Apr 30, 2004
Took a few steps back from 1bc0... we're getting closer I think...
It looks like this is the last real branch point to decide if code at
8581 will be called.
But it is a test for good +6V. Could be trigger, but maybe just checking
if system is in top shape before trying to burn new firmware?
Anyway if someone has time they should take another step back to see how
we get to 85b6.
Almost there!
Hope this is not too convoluted:
It is in the page00 hex dump file.
; (there is a vector to here at 0A74)
1b92 db09 in a,(#09) ; read printer control/power
detect/status port
1b94 cb7f bit 7,a ; check for good +6V
1b96 2006 jr nz,#1b9e ; jump to non-zero return
1b98 210000 ld hl,#0000
1b9b 7c ld a,h
1b9c b5 or l ; set zero flag
1b9d c9 ret ; return zero.
1b9e 210100 ld hl,#0001
1ba1 7c ld a,h
1ba2 b5 or l
1ba3 c9 ret ; return with flag non-zero flag
set.
If this returns non-zero, then the firmware update process will begin,
as you can see here:
This subroutine is called by
85a1 210800 ld hl,#0008
85a4 39 add hl,sp
85a5 7e ld a,(hl)
85a6 fe10 cp #10
85a8 2008 jr nz,#85b2 ; (8)
85aa cdf745 call #45f7
85ad cd1345 call #4513
85b0 181a jr #85cc ; (26)
85b2 fe0a cp #0a
85b4 2016 jr nz,#85cc ; (22)
85b6 cd740a call #0a74 ; ***Perform +6V power check***
85b9 200e jr nz,#85c9 ; (14) If non-zero, attempt to
load firmare
85bb 210001 ld hl,#0100
85be e5 push hl
85bf 2e24 ld l,#24
85c1 e5 push hl
85c2 cdf107 call #07f1
85c5 d1 pop de
85c6 d1 pop de ;
85c7 1803 jr #85cc ; (3) skip load firmware
85c9 cdc01b call #1bc0 ; attempt to load firmware
85cc 3e00 ld a,#00
85ce 3253da ld (#da53),a
85d1 c9 ret
This code calls the firmware load routine:
1bc0 f3 di ; disable interrupts
1bc1 3aa1db ld a,(#dba1) ; fetch flags
1bc4 cbff set 7,a ; set LCD-ON flag
1bc6 32a1db ld (#dba1),a ; store flags
1bc9 d302 out (#02),a ; turn on LCD
1bcb cd850a call #0a85 ; Call "0a85"
1bce 3aa1db ld a,(#dba1) ; read cached copy of flags
1bd1 cbe7 set 4,a ; set you got mail
1bd3 32a1db ld (#dba1),a ; save cached flags
1bd6 d302 out (#02),a ; turn on you got mail
1bd8 3e01 ld a,#01 ; RAM bank dance
1bda d308 out (#08),a
1bdc 3e05 ld a,#05
1bde d307 out (#07),a
1be0 3e00 ld a,#00
1be2 d306 out (#06),a
1be4 3e01 ld a,#01 ; a <- 1
1be6 d305 out (#05),a ; Send 1 out IO port 5
1be8 21434f ld hl,#4f43 ; hl <- 0x4f43
1beb 010040 ld bc,#4000 ; bc <- 0x4000
1bee b7 or a ; set flags based on 'a' ??? a = 1?
1bef ed42 sbc hl,bc ; ???
1bf1 4d ld c,l ;
1bf2 44 ld b,h
1bf3 210040 ld hl,#4000
1bf6 110080 ld de,#8000
1bf9 edb0 ldir
1bfb c30080 jp #8000 ; call firmware load jump vector
(routine actually at 8581)
From: "John R. Hogerhuis" <jhoger@...>
Apr 30, 2004
Actually, I just realized what the +6V check is for: it is probably just
verifying that it is currently powered from the wall cube and not the
battery. This would make sense, since it reduces that chance of
interruption during programming due to battery dying in the middle of
the burn, and leaving the unit permanently hosed.
Well it's good to know anyhow. The unit won't permit firmware to be
updated via parallel port unless powered from the wall.
On Fri, 2004-04-30 at 04:30, John R. Hogerhuis wrote:
From: "Neil Morrison" <neilsmorr@...>
Apr 30, 2004
Makes sense. Have you found the test to see if the programmer is attached?
Neil
From: "John R. Hogerhuis" <jhoger@...>
From: "John R. Hogerhuis" <jhoger@...>
Apr 30, 2004
No I haven't found the "trigger" yet. I had a few minutes last night so
I made the notes I mentioned in prior mail. My guess is it will turn out
to be holding some key combination. That or a jumper somewhere. Or maybe
there is a window during power up that it listens to the port. Who
knows. I would think though they would want it to be fairly "hands free"
but anything is possible.
I was just looking again, and I'm actually not certain what the 6V are
for. If they wanted to check for wall cube I guess they would have
checked for 9.5V. So there's still room for speculation here.
On Fri, 2004-04-30 at 16:50, Neil Morrison wrote:
From: "Neil Morrison" <neilsmorr@...>
Apr 30, 2004
There's a test in there for FN+Shift+T or FN+Shift+Size during power up
which sets the machine into diagnostic mode. I suspect it's allied with
that.
Neil
From: "John R. Hogerhuis" <jhoger@...>
From: "John R. Hogerhuis" <jhoger@...>
May 1, 2004
Okay, I'm out of time on this for the moment, but there's good eatin'
around here somewhere...
More parallel I/O!
842d, 8459, and 848f, which actually run at 442d, 4459, 448f.
Trigger should be near by. Who has time to pull it?