understanding data sheets on memory

[pcrider]

sti5500 schematic

I'm looking at a data sheet for a hy29f400bt bottom boot sector 4 meg flash memory chip. Trying to figure out the absolute address at the begining of memory and all I've figured out is I don't know what I'm looking at.
Actually I'm looking at this data sheet because I know the beggining of memory for one device using this chip is 7ff80000.
What I need to figure out is what is the absolute address for the start of memory for the 29f800tt top boot sector 8 meg flash memory chip.
I know it uses the same processor so I'm asuming that I only need to allow for the difference in the memory chips themselves.

Looking at the data sheets I see:
device | sector | size | sector address | byte mode | word mode |
S0 64/32 A[17]....A[12] adr. range adr. range

adress range is given something like 0x00000 - 0x0ffff

I see this as 5 digits, how can I get adress 7ff80000 with only 5 digits?
Also at the bottom of the memory array organization table I see somthing like: 3. address in byte mode is A[17:-1]

I have been studying on 68hc11 mcu but I have never seen anything like this.

If someone could explain some of the terminology used, and maybe a pointer or two it would help.

Thanks in advance,
Mike Brooksher

 

[echo47]

program 29f400 datasheet

Are you talking about a 29F400 or a 29F800?

The 29F400 is 4 megabit chip arranged as 512Kx8 or 256Kx16 depending on your configuration choice. That means it has 19 or 18 address bits, which means it understands 0x00000-0x7FFFF or 0x00000-0x3FFFF.

That 7FF80000 value sounds like an offset into your computer's 32-bit address space. The flash chip and data sheet don't know anything about your computer.

Add those numbers together, and your flash chip probably appears in your computer address space at 7FF80000-7FFFFFFF or 7FF80000-7FFBFFFF.

That A[17:-1] nomenclature is just a goofy way of writing A[17:0] with one more least-significant bit.

 

[pcrider]

1m x 8 top boot flash chip

I agree its probably an offset from the cpu. I still don't understand what numbers your are adding together to get your results. I'll look at it more after I've answered your questions.

The unit I'm trying to repair using jtag uses a sti5500mvb-x cpu, with the 29f800tt-90 (top boot) flash chip. Because I haven't been able to get my hands on a data sheet for the sti5500 I am trying to figure out what the starting address for this flash ram chip is, by comparing it to another known device using an sti5500 and a 29f400bt (bottom boot) flash chip and a known starting address for the flash.

The unit I'm working on is an FTA receiver P*ns*t 300a. (its perfectly legal, and can not descramble anything). After trying to load the wrong firmware the thing locked up. It looks like the only way to get it going again is by using a jtag conection. I have installed the jtag. Now I need to figure out how to address the flash chip in order to use the only software I've been able to get my hands on - jke*s.

(I'm very aware of pirates, and if you think thats the case, consider that it - j*eys is already set up to do that, and I wouldn't have to ask thats what I was doing)

So again,
Theres is a sti5500 with the 29f400bt and a known starting address of 0x7ff80000
Mine is a sti5500 with the 29f800tt and a starting address of ?

I would like to be able to read and understand the data sheets better, not just for this case, but because MCU's are a hobby of mine. I've got an old MIT mini board that I still play with and a couple of motorola evaluation boards- the evb, and the evbu. So its an ongoing thing.

Perhaps you could show me the math your talking about? and where you got the numbers?

Thanks again
Mike Brooksher

 

[echo47]

processador sti5500

Uh-oh. If you don't know of the starting address of the flash in your processor's memory space, then you are searching for a needle in a haystack!

You said it started at 7FF80000, so I simply added the flash size 00000-7FFFF to get 7FF80000-7FFFFFFF.

I don't know anything about sti5500 or FTA. Try searching the 'net for those keywords, and you may find friends who have already reverse engineered this gadget.

 

[pcrider]

al7bar upload firmwares

Thanks for the reply anyway, actually I have searched and searched, and searched. I'll keep trying untill I figure this out or fry the thing. I'm sure theres an answer I just don't know enough to figure it out yet. But I wouldn't be doing it if I didn't enjoy learning it. It has certainly proved to be a challenge, for someone who is just learning on 8 bit mcu's. If hacking the pay boxes wasn't so popular I'm sure the info would be easier to get, but thats life.
The irony is I could replace it for next to nothing. At one time they were expensive, but newer models do so much more etc... On the other hand theres other people out there in the same boat that would like to see a fix for this problem.
Although they have 2 versions of the software, one for dram, and one for sdram. The manufacturer put the new firmware out there with no warning that this could happen, and no literature on how to know the difference. So its a common problem, you only have a fifty-fifty chance without that info.
I have run across a freeware program called jtools on the gnu sites. I don't supose you know anything about that?

Thanks again,
Mike Brooksher

 

[tanuki]

negative jump in rom

try h**p://www.al7bar.tk/

 

[pcrider]

flah rom memory data sheet

Thanks for the replies and the links.

I finally got the data sheet for the 5500. Now I have a couple new questions. The data sheet says:

The STi5500 has a 32-bit signed (twos complement) address space where the address ranges from MinInt (#80000000) at the bottom to MaxInt (#7FFFFFFF) at the top. 32-bit (four-byte) words are addressed by 30-bit word addresses, and a 2-bit byte-selector identifies the bytes in the word.
Memory is divided into areas with different memory characteristics and intended purposes. Some areas are dedicated to a specific purpose either because they contain memory-mapped devices or because they are reserved by the system.

external memory addressing (EMI) is from
#40000000-#4FFFFFFF
#50000000-#5FFFFFFF
#60000000-#6FFFFFFF
#70000000-#7FFFFFFD
from there boot entry byte0 is 7FFFFFFE
and boot entry byte1 is #7FFFFFFF

When I put these numbers into a calculator each area is FFFFFFF this is
268435455 in decimal. That doesn't make any sense to me. I realise it memory addressing not actual memory, but the numbers still seem strange. Can someone explain this addressing to me?

Thanks Mike B. aka PcRider

 

[tanuki]

29f800-s0

Try the STi5518 datasheet, it's more clear on the memory space. The memory space description starts from zero.

Datasheets and reference code can be found at
https://dvb-upload.com/

 

[the tran]

memory address 7fffffff

Thanks for the replies and the links.

I finally got the data sheet for the 5500. Now I have a couple new questions. The data sheet says:

The STi5500 has a 32-bit signed (twos complement) address space where the address ranges from MinInt (#80000000) at the bottom to MaxInt (#7FFFFFFF) at the top. 32-bit (four-byte) words are addressed by 30-bit word addresses, and a 2-bit byte-selector identifies the bytes in the word.
Memory is divided into areas with different memory characteristics and intended purposes. Some areas are dedicated to a specific purpose either because they contain memory-mapped devices or because they are reserved by the system.

external memory addressing (EMI) is from
#40000000-#4FFFFFFF
#50000000-#5FFFFFFF
#60000000-#6FFFFFFF
#70000000-#7FFFFFFD
from there boot entry byte0 is 7FFFFFFE
and boot entry byte1 is #7FFFFFFF

When I put these numbers into a calculator each area is FFFFFFF this is
268435455 in decimal. That doesn't make any sense to me. I realise it memory addressing not actual memory, but the numbers still seem strange. Can someone explain this addressing to me?

Thanks Mike B. aka PcRider

Hello pcrider,
I've been searching and searching for long the data sheet of the Sti5500 chip with no luck. Could you kindly share the data sheet with me. How did you get it? I try to find it from St website, but they don't have it any more. If you can up load in the forum that would be nice, otherwise please email me at thetran29@yahoo.com. Greatly appreciated. Have a nice day.

 

[pcrider]

sti5500mvb-x

Try the STi5518 datasheet, it's more clear on the memory space. The memory space description starts from zero.

Datasheets and reference code can be found at
h**p://dvb-upload.com/

I looked at the 5518 sheets, actually there almost identical. Theres no examples at all.

 

[tanuki]

boot from rom sti5500

The critical details you're missing is the flash memory address space decoder circuit. It's most likely a PAL/GAL type device that logically AND's the higher order STi5500 address lines to create the OE# signal (and possilbly others signals too). These extra circuits are shown only on the Pansat 300A schematics.

From the STi datasheet:

8.1.4 Boot ROM
When the processor boots from ROM, it jumps to a boot program held in ROM with an entry point 2 bytes from the top of memory at #7FFFFFFE. These 2 bytes are used to encode a negative jump of up to 256 bytes down in the ROM program. For large ROM programs it may then be necessary to encode a longer negative jump to reach the start of the routine.

The flash memory is decoded such that the last Flash Memory address (#3FFFFF or #7FFFFF) aligns with the top of the STi5500 memory address (#7FFFFFFF). The STi5500 begins execution using the last two bytes as a pointer

Assuming the decoder enables the entire flash memory as only one segment.

Start of Flash memory address in STi5500 address space:

Case 1: 4 Megabyte flash: #7FFFFFFF - #3FFFFF = #7FC00000
Case 2: 8 Megabyte flash: #7FFFFFFF - #7FFFFF = #7F800000

 

[the tran]

pansat 300a schematic

The critical details you're missing is the flash memory address space decoder circuit. It's most likely a PAL/GAL type device that logically AND's the higher order STi5500 address lines to create the OE# signal (and possilbly others signals too). These extra circuits are shown only on the Pansat 300A schematics.

From the STi datasheet:

8.1.4 Boot ROM
When the processor boots from ROM, it jumps to a boot program held in ROM with an entry point 2 bytes from the top of memory at #7FFFFFFE. These 2 bytes are used to encode a negative jump of up to 256 bytes down in the ROM program. For large ROM programs it may then be necessary to encode a longer negative jump to reach the start of the routine.

The flash memory is decoded such that the last Flash Memory address (#3FFFFF or #7FFFFF) aligns with the top of the STi5500 memory address (#7FFFFFFF). The STi5500 begins execution using the last two bytes as a pointer

Assuming the decoder enables the entire flash memory as only one segment.

Start of Flash memory address in STi5500 address space:

Case 1: 4 Megabyte flash: #7FFFFFFF - #3FFFFF = #7FC00000
Case 2: 8 Megabyte flash: #7FFFFFFF - #7FFFFF = #7F800000

Thank you my friend, even though I didn't start the thread, but I learn alot as I run cross this seeking for the answer. It's clear now. This is great forums, please keep it alive and share your knowledge to the other newbies like me. Thanks again. Have a great day all.
Regard,

 

[pcrider]

29f400 29f800 programer

The critical details you're missing is the flash memory address space decoder circuit. It's most likely a PAL/GAL type device that logically AND's the higher order STi5500 address lines to create the OE# signal (and possilbly others signals too). These extra circuits are shown only on the Pansat 300A schematics.

From the STi datasheet:

8.1.4 Boot ROM
When the processor boots from ROM, it jumps to a boot program held in ROM with an entry point 2 bytes from the top of memory at #7FFFFFFE. These 2 bytes are used to encode a negative jump of up to 256 bytes down in the ROM program. For large ROM programs it may then be necessary to encode a longer negative jump to reach the start of the routine.

The flash memory is decoded such that the last Flash Memory address (#3FFFFF or #7FFFFF) aligns with the top of the STi5500 memory address (#7FFFFFFF). The STi5500 begins execution using the last two bytes as a pointer

Assuming the decoder enables the entire flash memory as only one segment.

Start of Flash memory address in STi5500 address space:

Case 1: 4 Megabyte flash: #7FFFFFFF - #3FFFFF = #7FC00000
Case 2: 8 Megabyte flash: #7FFFFFFF - #7FFFFF = #7F800000

What external device? The only one I see is an i2c bus chip that apears to be a sound decoder.
I'm not sure what you mean as far as decoding memory, I thought thats what the EMI does. If theres another chip onboard I don't know what it could be.
I agree with you on the point that program rom is accessed via a "pointer"(used loosely) 2 bytes from the top of memory. Those locations would be 7fffffffe, and 7fffffff. Since I have a 1m byte flash ROM, ROM memory starts a 7ff00000.
All that being said I admitedly still have no clue, I've learned a lot in the past weeks, but not enough. I can see how an external device might cause the problems I'm having. Being that further attempts to upgrade firmware via the serial port fail. There are about 3 small chips on board that I couldn't get any information on.