;************************************************************************
;*        	   SST FlashFlex51 Boot-Strap Loader     		*
;*			(F51MBLE2.A51) 					*
;*			 Version 1.1D					*
;*									*
;* NOTE:								*
;* 1. This firmware code is for SST89C5x MCU with an external crystal 	*
;*    of 11.0592 MHz and a 38.4 Kbps baud setting for serial port.  	*
;* 2. This code is referred as the "Internal Memory Mode" by the PC.	*
;*									*
;************************************************************************
;* Developer: 	Frank Cirimele						*
;*		SST Embedded Controller Application Engineering		*
;*									*
;* Contact:	Silicon Storage Technology Inc.				*
;*		1171 Sonora Court					*
;*		Sunnyvale, CA 94086					*
;*		phone: 	(408)522-7352					*
;*		fax:	(408)749-9658					*
;*		email: 	cirimele@ssti.com				*
;*									*
;* Original Code Release Date: 5-15-00					*
;* Update Code Release Date: 9-12-2000                                  *
;*     Instruction that changes the re-mapping should be in the portion *
;*   of memory that is not affected by the re-mapping change.           *  
;*									*
;************************************************************************

$INCLUDE	(F51MBLE2.INC)
$INCLUDE	(REG52A.inc)

;
; (SECTOR 0 in BLOCK 1) Reset and interrupt vectors


bsl_main_pgm:

        org 0F000h       	; reset vector entered on bootup
				;  or system reset
        ajmp bsl_cold_start  	; jump to cold-boot code

        org 0F003h       	; external interrupt 0 vector
        reti		      	; disable interrupt

        org 0F00Bh       	; timer 0 overflow vector
        reti		      	; disable interrupt

        org 0F013h       	; external interrupt 1 vector
        reti		      	; disable interrupt

        org 0F01Bh       	; timer 1 overflow vector
        reti		      	; disable interrupt
        
        org 0F023h       	; serial I/O interrupt vector
        ljmp bsl_rs232		; jump to block 1 rs232 ISR for bootcode

	org 0F02Bh		; timer 2 overflow vector
	reti		      	; disable interrupt

;
;
	org 0F030h              ; Instruction that changes the re-mapping 
				; should be in the portion of memory that 
				; is not affected by the re-mapping change.

bsl_cold_start:
	orl  SFCF, #0C0h	; Enable BLOCK 1 flash, IAP operation and
				;  set MAP_EN[1:0]=01b to enable the 
				;  remapping of 1 KByte flash memory.
                                ; The memory-remapping affects only the 
				;  program counter.
;************************************************************************									
;*		      	 BOOT CODE OR USER CODE?			*								*
;************************************************************************
;
; Check the logic level at port 1 bit 0 (P1.0)
;  If P1.0 = LOW, then Continue with Boot Code
;  Else Go to User Code: enable block 1 flash but disable IAP operation,   
;   turn off re-mapping to allow program memory in normal configuration.
        
	jnb  P1.0, run_code	; continue run_code if P1.0=LOW
	ljmp usercode
				 
;************************************************************************
;*									*
;*		      	     DO FOREVER LOOP				*
;*									*
;************************************************************************
;*									*
;* The Do Forever Loop software has the task of interacting with the PC *
;* over the UART serial communication link.  It has the capability to 	*
;* respond to the pseudo commands sent from the host PC and issues one 	*
;* of eight IAP commands used by the code:				*
;*									*
;*	(1) Erase Flash Memory (Sector Erase)- PC issues sector by 	*
;*	    sector.							*
;*		INPUTS:  Starting Sector Address			*
;*		RETURNS: Send FLAGS byte to PC				*
;*		INPUT CMD FORMAT:					*
;*			Byte 1: IAP Cmd ID = 0Bh			*
;*			Byte 2: Starting Address High Byte		*
;*			Byte 3: Starting Address Low Byte		*
;*			Byte 4: Count of sector				*
;*									*
;*	(2) Program Flash Memory (Program Byte)				*
;*		INPUTS:	(1) Starting Address				*
;*			(2) Sector Byte Count				*
;*			(3) String of Sector Data Bytes			*
;*		RETURNS: (1) Send FLAGS byte to PC after each byte	*
;*			       been programmed				*
;*			 (2) Send FLAGS byte to PC after count of	*
;*				sector byte completed			*
;*		INPUT CMD FORMAT:					*
;*			Byte 1: IAP Cmd ID = 0Eh			*
;*			Byte 2: Starting Address High Byte		*
;*			Byte 3: Starting Address Low Byte		*
;*			Byte 4: No. of Sector Bytes 			*
;*			Byte 5: Data 1					*
;*			Byte 6: Data 2					*
;*			Byte 7: Data 3					*
;*				o					*
;*				o					*
;*				o					*
;*			Byte N: Data N - 4				*
;*									*
;*	(3) Read Byte (Verify Byte)					*
;*		INPUTS:  Starting Address, Byte Length to Read		*
;*		RETURNS: Data Bytes Requested				*	
;*		INPUT CMD FORMAT:					*
;*			Byte 1:	IAP Cmd ID = 0Ch	 		*
;*			Byte 2: Starting Address High Byte		*
;*			Byte 3: Starting Address Low Byte		*
;*			Byte 4: No. of Sector Bytes			*
;*									*
;*		RESPONSE FORMAT:					*
;*			Byte 1: Data byte 1				*
;*			Byte 2: Data byte 2				*
;*				   o					*
;*				   o					*
;*				   o					*
;*			Byte N: Data byte N				*
;*									*
;*	(4) Block Erase - Erase block 0 of flash memory			*
;*		INPUTS: Starting Address High Byte of block 0  		*
;*		RETURNS: Send FLAGS byte to PC				*
;*		INPUT CMD FORMAT:					*
;*			Byte 1: IAP Cmd ID = 0Dh			*
;*			Byte 2: Starting Address High Byte of block 0	*
;*			Byte 3: 00h or Don't care			*
;*			Byte 4: 01h or Don't care			*
;*									*
;*	(5) Program Flash Memory (Burst program)			*
;*		INPUTS:	(1) Starting Address				*
;*			(2) Row(one-half of a sector) Byte Count 	*
;*			(3) String of Sector Data Bytes			*
;*		RETURNS: Send FLAGS byte to PC after each row		*
;*			 been programmed				*
;*		INPUT CMD FORMAT:					*
;*			Byte 1: IAP Cmd ID = 06h			*
;*			Byte 2: Starting Address High Byte		*
;*			Byte 3: Starting Address Low Byte		*
;*			Byte 4: No. of Row Bytes 			*
;*			Byte 5: Data 1					*
;*			Byte 6: Data 2					*
;*			Byte 7: Data 3					*
;*				o					*
;*				o					*
;*				o					*
;*			Byte N: Data N - 4				*
;*									*
;*	(6) Security Lock - This cmd sets the security bit to one of   	*
;*	    lock states on the next system reset:                       *
;*		INPUTS: Security bit selection				*
;*		RETURNS: Nothing                                        *
;*		INPUT CMD FORMAT:					*
;*			Byte 1: Pseudo Cmd ID = 04h			*
;*			Byte 2: Security bit selection			*
;*				00h: MCU executes IAP CMD 0Fh to 	*
;*				     program SB1                        *
;*				01h: MCU executes IAP CMD 03h to 	*
;*				     program SB2                        *
;*				02h: MCU executes IAP CMD 05h to 	*
;*				     program SB3                        *
;*		                                                        *
;*  For the Boot code, which follows, the MCU register assignments are	*
;*  the following:  							*
;*									*
;*	ro =	temporary reg #1					*
;*	r1 =	temporary reg #2					*
;*	r2 =	PC command						*
;*	r3 =	PC data							*
;*	r4 =	address high						*
;*	r5 =	address low						*
;*	r6 =	byte count						*
;*	r7 =	running counter						*
;*									*
;* Use of r7 for other than as the default stack pointer means that 	*
;* the stack pointer has to be assigned to a new location higher up 	*
;* in RAM early in this code.						*
;*									*
;************************************************************************

;************************************************************************
;*									*
;*		      	   INITIALIZATION CODE				*
;*									*
;************************************************************************

run_code:
	mov  PSW, #ZEROB	; initialize registers 
        mov  a, #ZEROB
        mov  SP, #60h		; move the stack 

        mov  IE, #ZEROB
        mov  IP, #ZEROB
        clr  RX			; clear software flags
        clr  TX
        
; Initialize serial port as 8-bits, 1 stop bit, NO parity check.
; For both 12.0 and 11.0592 MHz OSC, use Timer 2 for baud rate generator,
; which can generate 9.6K, 19.2K & 38.4K Baud.

 	anl  SCON, #00001100b
        orl  SCON, #01010000b 	; serial port mode 1 (8-bit UART), 
				;  enable receiver

       	mov  T2CON, #00110100b	; baud rate generator for 12.0/11.0592 MHz OSC, 
				; receive & transmit have the same baud rate, 
				; use timer 2, mode 34H

	;mov  RCAP2H, #11111111b ; 12.0 MHz OSC, for 9.6K bps use FFH
        ;mov  RCAP2L, #11011001b ; 12.0 MHz OSC, for 9.6K bps use D9H

	;mov  RCAP2H, #11111111b ; 11.0592 MHz OSC, for 9.6K bps use FFH
        ;mov  RCAP2L, #11011100b ; 11.0592 MHz OSC, for 9.6K bps use DCH
	;mov  RCAP2H, #11111111b ; 11.0592 MHz OSC, for 19.2K bps use FFH
        ;mov  RCAP2L, #11101110b ; 11.0592 MHz OSC, for 19.2K bps use EEH

	mov  RCAP2H, #11111111b ; 11.0592 MHz OSC, for 38.4K bps use FFH
        mov  RCAP2L, #11110111b ; 11.0592 MHz OSC, for 38.4K bps use F7H

        mov  PCON, #ZEROB	; SMOD (PCON.7) = 0 (single baud rate)
      
        setb ES			; enable serial port interrupt
        setb EA			; enable all unmasked interrupts
   
        clr  TI			; clear transmit flag
	clr  RI			; clear receive flag

        ljmp loop               ; continue the forever loop
               
;************************************************************************
;*									*
;*     	 WAITING FOR PC COMMANDS IF SYSTEM IS UNLOCKED OR SOFTLOCKED	*
;*									*
;************************************************************************
;*									*
;* IMPORTANT NOTE:  Beginning here, only ACALL and AJMP instructions 	*
;* can be used for the remainder of the bootcode, which allows it to 	*
;* be copied to and executed from another 2K memory space within the 	*
;* overall flash memory address	space.  THAT IS, NO LCALL AND LJMP	*
;* INSTRUCTIONS FROM HERE ON!!!!!!!!					*
;*									*
;************************************************************************

	org  0F080h
 
loop:
       	jnb  RX, $		; wait for command from PC
        clr  RX			; clear receive flag
        mov  a, B		; get command from B register
        mov  CMD, a

hand_shaking:

	cjne a, #05h, cmd1	; jump to cmd1 if status cmd sent from PC
                                ; start of hand_shaking routine
	mov  a, SFCF		; read SFCF to check status of MAP_EN(bit 1,0)
	anl  a, #00000011b	
	mov  r0, a
	mov  a, SFST		; read SFST to check status of SecByte        
	orl  a, r0		; combine SECD(bit 7,6,5) & MAP_EN(bit 1,0)
				;  into one byte and send to host PC
	jnb  TX, $		
	clr  TX
 	mov  SBUF, a          	; send content of SFST & MAP_EN to PC
                                ; end of hand_shaking routine

;************************************************************************
;*									*
;*	   SECURITY LOCKED OR OK TO RUN IAP COMMANDS?			*
;*									*
;************************************************************************
;
; Verify that the security lock is not 'HardLocked' before proceeding with 
; the bootcode, else set an error status flag bit for the PC indicating 
; "Unable to run IAP commands because system is HardLocked" and stay in 
; software trap indefinitely

lock_check:                       
	mov a, SFST		; read SFST to check status of SecByte 
	anl a, #M80		; mask for highest SECD bit
	cjne a, #M80, loop	; continue main loop if unLock/softLock
	setb ERR1		;  else set error bit1 in the FLAGS bit
	ajmp lock_check		;  and stay in software trap indefinitely

cmd1:
	mov  FLAGS, #0C0h	; re-initialize FLAGS byte....

	cjne a, #SFCM_SE, cmd2	; continue if sector erase command
				; else try next command				
	mov  r0, #01h
	ajmp cmd_proc		; go to command processing routine

cmd2: 	
	cjne a, #SFCM_PB, cmd3	; continue if program byte command
				;  else try next command
	mov  r0, #02h
	ajmp cmd_proc		; go to command processing routine

cmd3: 	
	cjne a, #SFCM_VB, cmd4  ; continue if verify byte command
				;  else try next command
	mov  r0, #03h
        ajmp cmd_proc		; go to command processing routine

cmd4: 	
	cjne a, #SFCM_BE, cmd5	; continue if block erase command
				;  else try next command
	mov  r0, #04h
	ajmp cmd_proc		; go to command processing routine

cmd5: 	
	cjne a, #SFCM_BP, cmd6	; continue if burst-program command
				;  else try next command
	mov  r0, #05h
	ajmp cmd_proc		; go to command processing routine


cmd6: 	
	cjne a, #SFCM_SL, cmd_err; continue if security-lock command
				;  else indicate an error
	mov  r0, #06h
	ajmp cmd_proc		; go to command processing routine

cmd_err:
	setb ERR3		; set err3 bit (FLAGS.5), which indicates
				;  an incorrect command number received
        ajmp loop	     	; return to run_code loop
        nop
        nop
        nop
        ajmp loop     		; software trap
       	nop
        nop
        nop
        ajmp loop	      	; software trap
        nop
        nop
        nop

;************************************************************************
;*									*
;*	     		   COMMAND PROCESSING			 	*
;*									*
;************************************************************************

cmd_proc:
	clr  c
	mov  a, r0		; verify that the input command number is 
	subb a, #07h		;  in the range 1 to 6, else exit
	jnc  cp_e

	cjne r0, #kmd6, cmd_in	; if security bit cmd - command 6 
	sjmp cp_6		; then skip remaining inputs

cmd_in:				; else command is in range 1 to 5
	jnb  RX, $		; get remaining(3 bytes) common inputs 
        clr  RX			;  for any of the commands 1 to 5:
        mov  a, B		;  1) input high address byte
        mov  ADRHI, a
	mov  DPH, a
      
	jnb  RX, $
        clr  RX
        mov  a, B		;  2) input low address byte
        mov  ADRLO, a
	mov  DPL, a
     
	jnb  RX, $
        clr  RX
        mov  a, B		;  3) input count
        mov  COUNT, a

	mov a, r0		; now decide which command to call
	cjne a, #kmd1, cp_2	; jump if not command 1
	acall sector_e		; go to sector erase routine
	sjmp cp_e

cp_2:	
	cjne a, #kmd2, cp_3	; jump if not command 2
	acall program_b		; go to program byte routine
	sjmp cp_e

cp_3:	
	cjne a, #kmd3, cp_4	; jump if not command 3
	acall verify_b		; go to verify byte routine
	sjmp cp_e

cp_4:	
	cjne a, #kmd4, cp_5	; jump if not command 4			
	acall block_e		; go to block erase rtn
        sjmp cp_e
              
cp_5:		                ; command = 5        
	acall burst_p		; go to burst program routine
	sjmp cp_e


cp_6:				; command = 6
	jnb  RX, $
        clr  RX
        mov  a, B		; input security bit selection 
        mov  PCDATA, a

	acall security_lock	; go to security lock routine

cp_e:	
	ajmp loop		; return to main loop