summaryrefslogtreecommitdiffstats
path: root/reverse-engineering/top2049/mpc89-serial-bootloader
blob: bee11d561dc30ae18ff99d0a5a7c9ebf6f849960 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
Megawin MPC89x5x - serial bootloader protocol
---------------------------------------------


Serial parameters:
------------------

FIXME baud, 8bit, 1 stopbit, no parity


Initialization:
---------------

o  TX PATTERN / FIXME
o  RX byte: 0x5A
o  RX byte: retry count low
o  RX byte: retry count high
o  RX byte: 0x69
o  TX byte: 0x5A
   (If 0x80 is sent here, it is ignored.)
o  TX byte: 0x69
o  RX byte: SCMD value (with IFADRL = 0)
o  RX byte: SCMD value (with IFADRL = 1)
o  RX byte: 0x02
o  RX byte: 0x10
o  RX byte: OR1 value (or 0xFF on error)


Send command:
-------------

o  TX 8 byte command struct

struct boot_command {
	uint8_t magic;		/* Always 0x5A */
	uint8_t command;	/* 3 bit command ID. Upper 5 bit clear. */
	uint8_t command_payload[5];
	uint8_t end_magic;	/* Always 0x69 */
};


Command: SETUP (ID = 0)
-----------------------

struct setup_command_payload {
	uint8_t ispcr;		/* ISPCR value */
	uint8_t reg_BF_val;	/* FIXME */
	uint8_t val0;		/* th1 or rcap2l */
	uint8_t val1;		/* rcap2h */
	uint8_t reg_BF_ormask;	/* OR mask for register BF */
};


Command: AP FLASH ERASE (ID = 1)
--------------------------------

struct aperase_command_payload {
	uint8_t pagecount;	/* Number of pages to erase */
	uint8_t _unused[4];
};

o  On finished operation, a 0x00 byte is received.


Command: AP FLASH WRITE (ID = 2)
--------------------------------

struct apwrite_command_payload {
	uint8_t addrlo;		/* Start address, low */
	uint8_t addrhi;		/* Start address, high */
	uint8_t checksum;
	uint8_t _unused[2];
};

o  After the 'boot_command' packet, a 64 byte data payload is sent.
o  RX status byte:
	0 -> write ok
	1 -> write error

Throws an error, if the flash is not erased.


Command: MASKSET (ID = 3)
-------------------------

struct maskset_command_payload {
	union {
		struct or1 {
			uint8_t or1_set;
			uint8_t or1_mask0;
			uint8_t or1_mask1;
			uint8_t _or1_unused;
		};
		struct ap {
			uint8_t ap_addrlo;
			uint8_t ap_addrhi;
			uint8_t ap_mask;
			uint8_t ap_set;
		};
	};
	uint8_t select;		/* 0 -> OR1,  1 -> AP */
};

select = 0:
	o  OR1 is written as:
		OR1 = (OR1 & or1_mask1) | or1_set
	o  The modified OR1 is returned as:
		TX-byte = OR1 & or1_mask0

select != 0:
	o  The AP page(!) is erased.
	o  AP is written as:
		AP[addr] = (AP[addr] & ap_mask) | ap_set
	o  The modified byte is returned as:
		TX-byte = AP[addr] & ap_set
bues.ch cgit interface