Yea,
. I couldn't get to sleep Friday night and just started wandering around the internet.
Oops, I spoke too soon. The 7791 is using peripherals the 7790 doesn't have. Its got two UARTs, but its only using one. It does have the same length interrupt vector table as the 7790 though. I wonder if its just the commercial grade 7700? Ever found a datasheet or pinout of the 7791? I'll re-disassemble trying it as a 7700 and see what that coughs out.
On the port speed: it depends on how they setup the UART. Its a little old school, you can actually supply an external clock to set the speed of the UART (Nissans do that), or use the internal clock. The Subaru is a little odd. Check out the code initializing the serial port:
Code:
0094B1 AD2980 lda al, 0x8029
0094B4 D011 bne 0x94c7
0094B6 8DCF12 sta al, 0x12cf
0094B9 643065 ldm #0x65, dp + 0x30 ; Write to UART tx/rx mode register
0094BC 64317F ldm #0x7f, dp + 0x31 ; Write to Baud rate generator
0094BF 643404 ldm #0x04, dp + 0x34 ; Write to Control register
0094C2 643505 ldm #0x05, dp + 0x35 ; Write to Control register high byte
0094C5 800F bra 0x94d6
Code block address: 94C7 Length: 145 M:1 X:0 called by: 94B4
0094C7 8DCF12 sta al, 0x12cf ; Branch target from 94B4
0094CA 643005 ldm #0x05, dp + 0x30 ; Write to UART tx/rx mode register
0094CD 643133 ldm #0x33, dp + 0x31 ; Write to Baud rate generator
0094D0 643404 ldm #0x04, dp + 0x34 ; Write to Control register
0094D3 643505 ldm #0x05, dp + 0x35 ; Write to Control register high byte
0094D6 643801 ldm #0x01, dp + 0x38 ; Branch target from 94C5, Write to unknown peripheral [38]
0094D9 643907 ldm #0x07, dp + 0x39 ; Write to unknown peripheral [39]
0094DC 643C04 ldm #0x04, dp + 0x3c ; Write to unknown peripheral [3C]
0094DF 643D05 ldm #0x05, dp + 0x3d ; Write to unknown peripheral [3D]
The unknown peripheral writes is I think a second UART. But check out how the primary UART (this is the one used for the SSM) is setup: its got two modes, depending on a variable set in the ROM-
65h - even parity, 1 stop bit, internal clock (8Mhz/2), 8 data bits, 1953.125 baud
or
05h - no parity, 1 stop bit, internal clock (8MHz/2), 8 data bits, 4807.69 baud
It looks like it can also swap between the two modes in software (it sets the UART registers later in the code), maybe. This matches the two SSM data transmission modes Kaele (Kashima) documented:
http://kaele.com/~kashima/car/gc8.html
The
Japanese to English translation isn't great, but it looks like Kashima at least though about upping the speed to 9600 baud. I don't know how that would work in a car like the SVX with multiple ecus sharing the same diagnostic port. You might have to separate the engine ecu from the rest. to try it just change the line in the '65h mode:
ldm #0x7f, dp + 0x31 ; Write to Baud rate generator
to 19h istead of 7Fh. That should set it to 9600 baud instead of 1953.