IBX-100 - reading the NVRAM

IMPORTANT!

This is currently a Work-In-Progress. It is not complete.
If you can help - please get in touch...

 

JPEG; 26K

Introduction

You know, one thing that really bugged me was not knowing the internal organisation of the NVRAM within the BushBox.

Okay, President Bush and not having a constant supply of Big Mac™s and chocolate probably bugs me more, but since this is a web resource about the Bush Box - we'll keep it relevant. :-)

You see, people, those hooking in their own mice seem to have to keep re-configuring the thing or using some sort of boot media. Since a space is provided on the PCB for a double-PS2 socket, I would imagine that it would be an 'option'.

If you don't buy this, take a look at the content of the Tags file:

FileSystem:&05,,,&2E,L
Unplug0:&06,,,,L
Unplug1:&07,,,,L
Unplug2:&09,,,,L
TVInterlace:&0A,4,1,1,L
TVVerticalAdjust:&0A,5,3,,L
CapsMode:&0B,3,3,2,L
AutoRepeatDelay:&0C,,,32,L
AutoRepeatRate:&0D,,,8,L
PrinterColour:&0F,0,1,1
PrinterIgnoreState:&0F,1,1,1,L
BootState:&10,4,1,1,L
Unplug3:&12,,,,L
Unplug4:&13,,,,L
ExtUnplug:&14,0,16,,L
WimpDoubleClickMoveTime:&16,,,,L
WimpAutoSubMenuTime:&17,,,,L
Territory:&18,,,0,L
PrinterBufferSize:&19,,,,L
WimpMenuDragDelay:&1B,,,,L
FileSwitchTruncate:&1C,0,1,1,L
MouseType:&1D,,,5,L
LanManTransport:&6F,0,1,1,L
StaticIP:&1E,0,32
BootServerIPAddr:&22,0,32
GatewayIPAddr:&26,0,32
SubnetMask:&2A,0,32
ModeResolution:&2F,0,5,1,L
ModeDepth:&2F,5,2,,L
ModeFrameRate:&2F,7,1,,L
PaperSize:&30,0,2,0,L
StaticIPStatus:&30,2,1
PrinterOrientation:&30,3,1
PrinterPrintImages:&30,4,1,1,L
PrinterPrintBackgrounds:&30,5,1,L
BootMountPath:&50,0,216
PrinterID:&6B
CurrentYear:&80,,,99
CurrentCentury:&81,,,19
Unplug5:&82,,,,L
Unplug6:&83,,,,L
SoundControl:&84,5,3,5,L
MonitorInfo:&85,,,&7D,L
FontSize:&86,,,128,L
TimeZone:&8B,,,0,L
DesktopLook:&8C,0,1,1,L
DesktopFont:&8C,1,4,,L
DesktopTileStatus:&8C,7,1,,L
Unplug7:&8D,,,,L
Unplug8:&8E,,,,L
ScreenSize:&8F,,,,L
SystemHeapSize:&91,,,,L
RMASize:&92,,,,L
SpriteAreaSize:&93,,,,L
SoundParameters:&94,,,&F0,L
DNSIPAddr:&95,0,32
ModemPrefix:&99,0,32,&00A0
ModemDialTime:&9D,0,5
ModemDialTone:&9E,4,1
ModemDialType:&9E,5,2,0
ModemDialIgnore:&9E,7,1,0
LocalDialCode:&9F,0,24
ModemTimeout:&A2,0,6,10
ModemPrefixStatus:&A2,6,1,0
ModemCallWaitingStatus:&A2,7,1,0
ModemCallWaiting:&A3,0,16,&10B8
MACAddress:&A6,0,48,,P
MACAddressChecksum:&AC,,,,P
Unplug9:&AD,,,,L
Unplug10:&AE,,,,L
Unplug11:&AF,,,,L
Unplug12:&B0,,,,L
PoduleUnplug:&B1,0,64,,L
Country:&BA,,,1,L
NetUnplug:&BB,,,,L
ScreenBlankTime:&BC,3,3,0
ScreenBlankWRCH:&BC,6,1,,L
MouseMultiplier:&C2,,,4,L
ResetStatus:&C3,2,1,1
WimpModeStatus:&C3,4,1,1,L
ProcessorCacheStatus:&C3,5,1,,L
WimpMode:&C4,,,,L
WimpFlagsInstantDrag:&C5,0,4,&F,L
WimpFlagsErrorAction:&C5,4,1,,L
WimpFlagsConfinement:&C5,5,2,3,L
WimpFlagsSubMenus:&C5,7,1,1,L
FontCacheSize:&C8,,,16,L
FontMaxRescaled:&C9,,,,L
FontMaxAntiAliased:&CA,,,44,L
FontMaxCached:&CB,,,56,L
FontMaxSubPixelWidth:&CC,,,14,L
FontMaxSubPixelHeight:&CD,,,,L
Unplug13:&D9,,,,L
Unplug14:&DA,,,,L
Unplug15:&DB,,,,L
WimpDragTime:&DD,,,,L
WimpDragMoveLimit:&DE,,,,L
WimpDoubleClickTime:&DF,,,,L
IRDeviceID:&E8,0,4
IRDeviceStatus:&E8,4,1
NVRAMChecksum:&EF
UniqueID:&F0,0,128,,LP
MinutesInOperation:&100,0,24,,P
MinutesInOperationCheck:&103,,,,P
WarrantyClock:&104,0,16,,P
WarrantyClockCheck:&106,,,,P
FaultCodes:&107,0,256,,P
FaultCodesCheck:&127,,,,P
FaultCodesIndex:&128,0,2,,P
KeyboardFormat:&128,2,1
VideoClockRate:&128,4,4
IRTVCode:&129,0,10
TVSource:&12A,2,2,1
TVChannel:&12A,4,3
IRVCRCode:&12B,0,10
IRCableCode:&12D,0,10
CableChannel:&12E,2,2,1
PrinterCode:&12F,0,10,0
BrowserFontSize:&131,0,2,1
BrowserMusicStatus:&131,2,1,0
BrowserBeepStatus:&131,3,1,0
BrowserScaling:&131,4,1,1
BrowserDisplayImages:&131,5,1,1,L
BrowserDisplayBackgrounds:&131,6,1,1,L
BrowserSoundStatus:&131,7,1,0
IRPulseOffsetFirst:&132,,,&CA,L
IRPulseOffsetAll:&133,,,&D8,L
BrowserEncoding:&134,0,15,2252,L
BrowserEncodingOverride:&135,7,1,0,L
SystemTime:&136,0,40
InactivityTimeout:&13B,0,16,600
BrowserFavorites:&13D,0,15896
BootBlock:&900,0,6144
# Protected region
ISPCAccessPassword:&C00,0,88
NCMAHiddenPhoneNumber:&C0B,0,120
NCMAStartHiddenDialPassword:&C1A,0,88
BootBlockDefault:&D00,0,6144
At the bottom, you'll see the entry for the ISPCAccessPassword used to gain access to the hidden configuration stuff.
Likewise, you'll also see (maybe disturbingly):
   MinutesInOperation
   MinutesInOperationCheck
   WarrantyClock
   WarrantyClockCheck

 

IIC?

The NVRAM device is an ATMEL AT24C32 32K (4096 x 8) 2-wire serial EEPROM. The serial format is remarkably similar to a cut-down version of IIC.

JPEG; 22K

The first task, therefore, is to attach some flying leads to the NVRAM, and wire it into my RiscPC's IIC bus...
...to no avail.

The protocol may seem similar, but it is suitably different that the RiscPC doesn't get a response when scanning the connected IIC devices.
I have written, in ARM code, a driver to provide IIC over a parallel port. I may use this as the basis of a comparison between the NVRAM module and something we already have.

 

The interface

The NVRAM SDA line is connected to OD1 of the ARM7500FE. The SCL line is connected to OD0 of the processor. Both of these are controlled by the IOCR register, bit 0 controlling OD0 (SCL) and bit 1 controlling CD1 (SDA).
The hardware access registers are located at &03200000 (it is pretending to be an IOC/IOMD-alike device), with the IOCR based at offset +&000. Note that there should be pull-up resistors someplace, as the ARM7500 does not contain them internally for OD[0:1] - and you'll find them next to the NVRAM as R82 and R83, which appear to be '472'.

A0 and A2 are taken to ground, while A1 is pulled high. Thus, the device appears to be addressable as %1010010 (device 82; or 164 when shifted).

The WP (Write Protect) on the NVRAM is taken to IOP1 on the ARM7500. This pin, when low allows normal write operations. When high, all write operations to the upper quadrant (8K) are inhibited. The value of the eight open drain output/input pins (of which WR is connected to pin 1) may be altered by writing/reading to address &320000C.
When a '1' is written to the bit corresponding to the desired I/O line, the output enable for that line is switched off so the line can be driven as an input. Since the ARM7500 contains pull-up resistors internally for these pins, it appears that this also has the effect of taking the line high (as it floats high). Writing a '0' to the bit drives the data line low.
The I/O data lines can also generate interrupts (IRQC). Refer to the CL-PS7500FE datasheet (by Cirrus Logic) for further details.

Here is a diagram that I have drawn to represent the NVRAM connections. Note that this ignores everything else (for example, the NVRAM is beside the processor, not above it!).

GIF; 6K

I will look into writing some code to bang the hardware directly. Indeed, I can probably pinch quite a bit from my PtrIIC module. But...not now.

 

Dude! Don't hold out on us!

For now, try using the following to read from NVRAM:
  DIM buffy% 255
  SYS "NVRAM_Read", "< NVRAM key goes here! >", buffy%, 255 TO ,mycode$
  PRINT mycode$
And, obviously, the inverse for writing:
  DIM buffy% 255
  REM I am *assuming* null termination below...
  $buffy% = "< your data goes in here >" + CHR$(0);
  SYS "NVRAM_Write", "< NVRAM key goes here! >, buffy%, 255
  PRINT mycode$
You'll probably need to modify the blanket '255' length byte.
Additionally, I imagine bytes and words would be written by the ? and ! methods (as usual), with the length being 1 and 4, again as is usual.

 


Return to the index
Copyright © 2004 Richard Murray