More progress to report with the BDM using the Abatron BDI2000. See also attached .txt files, one for what I got via the BDI2000 Telnet port, one for the config file that ftp's into the BDI2000 when it boots up, and one from the TDS3000 diagnostics port on pins 13 and 14, a FTDI-TTL cable, Putty at 38400,n,8,1.
The config file is basically totally empty now. Because my TDS3000 has working flash roms, and from there it boots up and gets its proper configuration for the memory map and what is CS0 ... CS7 etc.
All I need to type into the BDI2000 Telnet console is 'reset run', then within a few seconds I must type 'halt' and then 'go'. Without the halt and go, it does not decently boot up, but with these two extra commands it does a full boot and allows me to halt, single step trace, inspect ram, registers, upload code, edit code, download code the whole lot. And I assume that includes erase and reflash as well, but I'm cautious for now.
So that map is:
CS0: boot ron = flash on mainboard. At 0xffc00000..0xffffffff.
CS1: DRAM - but that gets mapped differently. I think it sits at 0x00000000..0x0x007fffff.
CS2: the DS1742W RTC/NVRAM, mapped at 0x02800000..0x028007ff. You can see the seconds ticking, and the time/date in BCD at the top at 0x028007f0..0x028007ff
CS3 - don't know yet - likely i/o to the scope ADCs
CS4 - don't know yet - likely i/o to the scope ADCs
CS5 - don't know yet - likely i/o to the scope ADCs
CS6 - the CE1 signal on the expansion port, pin 78.
CS7 - the CE2 signal on the expansion port, pin 79. That's the one byte module identifier. The high 4 bits indicate what module is plugged in. 0x0*=TDS3VM, serial RS232+VGA, 0x1*=TDS3GM, serial+GPIB, 0x2*=TDS3EM, Ethernet+serial, 0x3*=G01 DIGITAL VIDEO, 0x4*= TDS3GV, higher numbers gets me 'incompatible firmware' - so future expansion i guess.
Now, I remade a TDS3EM on my super plugin with DS1744 RTC, and that now gets recognized as a TDS3EM, and the scope even sees that my flash rom on the module is still blank. So looks like the final step is to get that flash code as a binary or hex file, and then my BDI2000 will be able to flash it! But who is willing to share me taht code? Or lend my an original TDS3EM so that I can read it out. Maybe it's just the MAC address, maybe it's the full Ethernet stack. Any help appreciated.
Just reflashing TDS3000 firmware with the 4 floppy disks (i went back from 3.41 to 3.39) did not do the trick of also flashing the TDS3EM plugin module flash chip.
Bedtime now in Holland.