M3i Zero-GMPZ003 notes

notes.txt

(word = 32-bit)

-----

Write and read commands

C5 oooooo xx 00 00 => ROM write, FIFO read 0     words write 0x200 words
C9 oooooo xx 00 00 => ROM read,  FIFO read 0x200 words write 0     word

oooooo => offset in number of words (?), MSB first
xx => type,
  0xE0: "SW" header, used with offset = 0, after that offset += 0x10000 (in number of words)
  0xF0: "SW" regular sector (0x200 bytes)
  0xA0: "HW" sector. One sector (header ?) is at 0x80000000 then the others start at offset 0.

C600000000000000, get write status, read 1 word (= 0 when finished) 
CA00000000000000, get read status, read 1 word (= 0 when finished) 

Funcs:

Use C5 then C6 (writing), with ROMCTRL = 0xE1586000 then 0xA7586000. Unaligned data is ORRed with 0x04000000
Use C9 then CA (reading), with ROMCTRL = 0xA7586000 for both

-----

Protocol

B800000000000000 (reply of 1 word ignored)
B4AA55A00A000000 (reply of 1 word ignored)
B4AA55A00A000000 (reply of 1 word ignored)

B000000000000000: read model (32-bit), check if == 0x5AA5 otherwise panic

// "SW"
write offset=0, type=0xE0, data=<unintialized stack buffer, supposedly 0>
offset += 0x10000 // pointless

loop:
  write offset=0+0x200*i, type=0xF0, data=...
verify "SW": do nothing

// "HW"
write offset=0x80000000, type=0xA0, data=(u32 *)0x02000000
loop:
  write offset=0+0x200*i, type=0xA0, data=...

two loops?/sections: 
  read offset=0+? type=0xF0 data=?

verifies hardcoded max lengths and CRCs