Hey y'all,
I've always been curious to peep at the firmware in my Tek scopes, so for
giggles I installed Ghidra and pointed it at the ROMs from my 2467.
Snooping around a bit, while reading the service manual shows that the MPU
bank switches the alternate halves of two 64k ROMs into the top 32k of
address space.
What threw me for a bit of a loop is that the 2K of RAM in the scope, in
addition to being mapped from 0x0000-0x07FFF, is also mapped into the 8k of
address space from 0x8000-0x9FFFF when anything but the default ROM bank is
selected. This effectively makes it impossible to address the lowest 8k of
three out of four ROM banks, or 24k of the total 128k.
I haven't dug very deep yet, but I do e.g. see the RESET routine testing
the RAM at the 0x0000 address. It then switches ROM banks, into a routine
that tests the RAM in this alternate mapping. I also see the ROMs contain
only a copyright message and SWI instructions in these locations.
As an aside it's pretty cool to walk through the initial steps in the RESET
routine, which is about as far as I'm in right now :).
I really don't understand the advantage to this secondary mapping, which at
best just complicates the address decoding involved. The address mapping is
performed by a PAL, so maybe the additional logic is "free". At first I was
wondering whether this might be for backwards compatibility with the 2465's
option boards, but the 2465 has the RAM mapped only at address 0x0000, so
that's not it.
Do you all have any idea why Tek might have done this?
Siggi
