FreeCalypso > hg > freecalypso-reveng
comparison bootrom.disasm @ 8:a06573cacb6e
boot ROM re: trying to understand the code that runs after '<' received
author | Michael Spacefalcon <msokolov@ivan.Harhan.ORG> |
---|---|
date | Wed, 17 Apr 2013 06:25:19 +0000 |
parents | 8c2621b2ed37 |
children | a51729642295 |
comparison
equal
deleted
inserted
replaced
7:a445735685ba | 8:a06573cacb6e |
---|---|
5 c: ea200004 b 0x800024 | 5 c: ea200004 b 0x800024 |
6 10: ea200004 b 0x800028 | 6 10: ea200004 b 0x800028 |
7 14: ea200004 b 0x80002c | 7 14: ea200004 b 0x80002c |
8 18: ea200004 b 0x800030 | 8 18: ea200004 b 0x800030 |
9 1c: ea200004 b 0x800034 | 9 1c: ea200004 b 0x800034 |
10 | |
11 ; The following routine (starting at 0x20) is used to transfer control | |
12 ; to nCS0 application images that are designed to work with no internal | |
13 ; boot ROM "in the way", i.e., images identified by a 1 in the 0x2000 word. | |
14 ; The present routine is copied to the internal RAM and executed there. | |
15 ; | |
16 ; The routine itself takes one argument in R0 and uses it to set the | |
17 ; nIBOOT override bits in the FFFF:FB10 register. If R0==1, bits <9:8> | |
18 ; of this register are set to 11, putting nCS0 at address 0. If R0==0, | |
19 ; the bits are set to 01, putting the internal ROM at 0. Otherwise, | |
20 ; the bits are set to 00, restoring the nIBOOT pin configuration. | |
21 ; (In actual operation the argument passed to this function is the word | |
22 ; from 0x2000, so it's equal to 1.) Then the routine causes the | |
23 ; watchdog timer to go off, resetting the ARM. | |
10 | 24 |
11 20: e24dd004 sub sp, sp, #4 ; 0x4 | 25 20: e24dd004 sub sp, sp, #4 ; 0x4 |
12 24: e59f20b8 ldr r2, =0xFFFFFB10 ; via 0xe4 | 26 24: e59f20b8 ldr r2, =0xFFFFFB10 ; via 0xe4 |
13 28: e1d2c0b0 ldrh r12, [r2] | 27 28: e1d2c0b0 ldrh r12, [r2] |
14 2c: e20c10ff and r1, r12, #255 ; 0xff | 28 2c: e20c10ff and r1, r12, #255 ; 0xff |
56 d4: e15c0000 cmp r12, r0 | 70 d4: e15c0000 cmp r12, r0 |
57 d8: bafffff7 blt 0xbc | 71 d8: bafffff7 blt 0xbc |
58 dc: e28dd004 add sp, sp, #4 ; 0x4 | 72 dc: e28dd004 add sp, sp, #4 ; 0x4 |
59 e0: e12fff1e bx lr | 73 e0: e12fff1e bx lr |
60 | 74 |
61 ; literal pool | 75 ; literal pool for the above routine |
62 e4: fffffb10 | 76 e4: fffffb10 |
63 e8: 000080f5 | 77 e8: 000080f5 |
78 ; end of the code copied to the internal RAM for booting type 1 images | |
64 | 79 |
65 ec: e92d4010 stmdb sp!, {r4, lr} | 80 ec: e92d4010 stmdb sp!, {r4, lr} |
66 f0: e59fcd0c ldr r12, [pc, #3340] ; 0xe04 | 81 f0: e59fcd0c ldr r12, [pc, #3340] ; 0xe04 |
67 f4: e59c4014 ldr r4, [r12, #20] | 82 f4: e59c4014 ldr r4, [r12, #20] |
68 f8: e59f0d08 ldr r0, [pc, #3336] ; 0xe08 | 83 f8: e59f0d08 ldr r0, [pc, #3336] ; 0xe08 |
70 100: e790c10c ldr r12, [r0, r12, lsl #2] | 85 100: e790c10c ldr r12, [r0, r12, lsl #2] |
71 104: e28c0005 add r0, r12, #5 ; 0x5 | 86 104: e28c0005 add r0, r12, #5 ; 0x5 |
72 108: e5d0c000 ldrb r12, [r0] | 87 108: e5d0c000 ldrb r12, [r0] |
73 10c: e31c0040 tst r12, #64 ; 0x40 | 88 10c: e31c0040 tst r12, #64 ; 0x40 |
74 110: 0afffffc beq 0x108 | 89 110: 0afffffc beq 0x108 |
75 114: eb000513 bl 0x1568 | 90 114: eb000513 bl 0x1568 ; IND_CALL |
76 118: eafffffe b 0x118 | 91 118: eafffffe b 0x118 |
77 | 92 |
78 11c: e3a0c004 mov r12, #4 ; 0x4 | 93 11c: e3a0c004 mov r12, #4 ; 0x4 |
79 120: e5c0c000 strb r12, [r0] | 94 120: e5c0c000 strb r12, [r0] |
80 124: e3a0c000 mov r12, #0 ; 0x0 | 95 124: e3a0c000 mov r12, #0 ; 0x0 |
1000 ee4: e1830205 orr r0, r3, r5, lsl #4 | 1015 ee4: e1830205 orr r0, r3, r5, lsl #4 |
1001 ee8: e3800cff orr r0, r0, #65280 ; 0xff00 | 1016 ee8: e3800cff orr r0, r0, #65280 ; 0xff00 |
1002 eec: e10600bc strh r0, [r6, -r12] | 1017 eec: e10600bc strh r0, [r6, -r12] |
1003 ef0: e8bd8070 ldmia sp!, {r4, r5, r6, pc} | 1018 ef0: e8bd8070 ldmia sp!, {r4, r5, r6, pc} |
1004 | 1019 |
1020 ; The routine at 0xef4 gets called from main() after a '<' character | |
1021 ; has been received and autoboot thereby interrupted in the | |
1022 ; autoboot-enabled flash state. | |
1023 | |
1005 ef4: e92d4070 stmdb sp!, {r4, r5, r6, lr} | 1024 ef4: e92d4070 stmdb sp!, {r4, r5, r6, lr} |
1006 ef8: e59fc3e4 ldr r12, [pc, #996] ; 0x12e4 | 1025 ef8: e59fc3e4 ldr r12, =0xFFFFF900 ; via 0x12e4 |
1007 efc: e1dc40b0 ldrh r4, [r12] | 1026 efc: e1dc40b0 ldrh r4, [r12] |
1008 f00: e59f33d0 ldr r3, [pc, #976] ; 0x12d8 | 1027 ; original value of FFFF:F900 saved in R4 |
1028 ; now set it to FF22, just like the 0xe2c init routine did | |
1029 f00: e59f33d0 ldr r3, =0xFFFFFD00 ; via 0x12d8 | |
1009 f04: e3a05b01 mov r5, #1024 ; 0x400 | 1030 f04: e3a05b01 mov r5, #1024 ; 0x400 |
1010 f08: e3a0c801 mov r12, #65536 ; 0x10000 | 1031 f08: e3a0c801 mov r12, #65536 ; 0x10000 |
1011 f0c: e24cc0de sub r12, r12, #222 ; 0xde | 1032 f0c: e24cc0de sub r12, r12, #222 ; 0xde |
1012 f10: e103c0b5 strh r12, [r3, -r5] | 1033 f10: e103c0b5 strh r12, [r3, -r5] |
1013 f14: e59f63c0 ldr r6, [pc, #960] ; 0x12dc | 1034 ; write 0x2002 to FFFF:9800, again just like 0xe2c did |
1014 f18: e59fc3c0 ldr r12, [pc, #960] ; 0x12e0 | 1035 f14: e59f63c0 ldr r6, =0xFFFF9800 ; via 0x12dc |
1036 f18: e59fc3c0 ldr r12, =0x2002 ; via 0x12e0 | |
1015 f1c: e1c6c0b0 strh r12, [r6] | 1037 f1c: e1c6c0b0 strh r12, [r6] |
1016 f20: e1b05f8c movs r5, r12, lsl #31 | 1038 f20: e1b05f8c movs r5, r12, lsl #31 |
1017 f24: 1afffffd bne 0xf20 | 1039 f24: 1afffffd bne 0xf20 |
1018 f28: e181c102 orr r12, r1, r2, lsl #2 | 1040 f28: e181c102 orr r12, r1, r2, lsl #2 |
1019 f2c: e1a0c28c mov r12, r12, lsl #5 | 1041 f2c: e1a0c28c mov r12, r12, lsl #5 |
1049 fa4: 1afffffd bne 0xfa0 | 1071 fa4: 1afffffd bne 0xfa0 |
1050 fa8: e3a0cb01 mov r12, #1024 ; 0x400 | 1072 fa8: e3a0cb01 mov r12, #1024 ; 0x400 |
1051 fac: e10340bc strh r4, [r3, -r12] | 1073 fac: e10340bc strh r4, [r3, -r12] |
1052 fb0: e8bd8070 ldmia sp!, {r4, r5, r6, pc} | 1074 fb0: e8bd8070 ldmia sp!, {r4, r5, r6, pc} |
1053 | 1075 |
1076 ; Routine 0xfb4 gets called from main() where the boot code is giving | |
1077 ; the UARTs a chance to interrupt the autoboot process before transferring | |
1078 ; control to the nCS0 image. | |
1079 ; | |
1080 ; Arguments: both R0 and R1 point to byte variables acting as additional | |
1081 ; function outputs. | |
1082 ; | |
1083 ; If a '<' character is received on either UART, the function returns | |
1084 ; without further fuss. If nothing was received on either UART, it | |
1085 ; also returns without further fuss. However, if the "wrong" byte value | |
1086 ; was received on either UART, the function flips the VCLKOUT_DIV2 bit | |
1087 ; in the FFFF:FD02 register - it is the boot code's way of figuring out | |
1088 ; whether the input clock is 13 or 26 MHz. | |
1089 ; | |
1090 ; Return values: | |
1091 ; In R0: 1 if '<' received, 0 otherwise | |
1092 ; In *R0: UART ID if '<' received, FF otherwise | |
1093 ; In *R1: final state of the 800534 byte variable | |
1094 ; | |
1095 ; The latter variable records the state of the divide-by-2. On the first | |
1096 ; try, the divide-by-2 is enabled, and the variable contains 0. When this | |
1097 ; function disables the /2, the variable is set to 1. It keeps toggling | |
1098 ; back and forth as wrong bytes come in. | |
1099 | |
1054 fb4: e3a0c0ff mov r12, #255 ; 0xff | 1100 fb4: e3a0c0ff mov r12, #255 ; 0xff |
1055 fb8: e5c0c000 strb r12, [r0] | 1101 fb8: e5c0c000 strb r12, [r0] |
1056 fbc: e59fc324 ldr r12, [pc, #804] ; 0x12e8 | 1102 ; check the MODEM UART first |
1103 fbc: e59fc324 ldr r12, =0xFFFF5000 ; via 0x12e8 | |
1057 fc0: e5dc2805 ldrb r2, [r12, #2053] | 1104 fc0: e5dc2805 ldrb r2, [r12, #2053] |
1058 fc4: e1b02f82 movs r2, r2, lsl #31 | 1105 fc4: e1b02f82 movs r2, r2, lsl #31 |
1059 fc8: 1a000001 bne 0xfd4 | 1106 fc8: 1a000001 bne 0xfd4 |
1060 fcc: e3a02000 mov r2, #0 ; 0x0 | 1107 fcc: e3a02000 mov r2, #0 ; 0x0 |
1061 fd0: ea000003 b 0xfe4 | 1108 fd0: ea000003 b 0xfe4 |
1062 fd4: e5dc2800 ldrb r2, [r12, #2048] | 1109 fd4: e5dc2800 ldrb r2, [r12, #2048] |
1063 fd8: e352003c cmp r2, #60 ; 0x3c | 1110 fd8: e352003c cmp r2, #60 ; 0x3c |
1064 fdc: 0a000024 beq 0x1074 | 1111 fdc: 0a000024 beq 0x1074 |
1065 fe0: e3a02001 mov r2, #1 ; 0x1 | 1112 fe0: e3a02001 mov r2, #1 ; 0x1 |
1113 ; Control gets here if no '<' was received on the MODEM UART. | |
1114 ; R2 contains 1 if some other byte value was received, or 0 if nothing. | |
1115 ; Now check the IrDA UART. | |
1066 fe4: e5dc3005 ldrb r3, [r12, #5] | 1116 fe4: e5dc3005 ldrb r3, [r12, #5] |
1067 fe8: e1b03f83 movs r3, r3, lsl #31 | 1117 fe8: e1b03f83 movs r3, r3, lsl #31 |
1068 fec: 1a000002 bne 0xffc | 1118 fec: 1a000002 bne 0xffc |
1069 ff0: e3520001 cmp r2, #1 ; 0x1 | 1119 ff0: e3520001 cmp r2, #1 ; 0x1 |
1070 ff4: 0a000003 beq 0x1008 | 1120 ff4: 0a000003 beq 0x1008 |
1071 ff8: ea000015 b 0x1054 | 1121 ff8: ea000015 b 0x1054 |
1072 ffc: e5dcc000 ldrb r12, [r12] | 1122 ffc: e5dcc000 ldrb r12, [r12] |
1073 1000: e35c003c cmp r12, #60 ; 0x3c | 1123 1000: e35c003c cmp r12, #60 ; 0x3c |
1074 1004: 0a000017 beq 0x1068 | 1124 1004: 0a000017 beq 0x1068 |
1075 1008: e59fc2dc ldr r12, [pc, #732] ; 0x12ec | 1125 ; control gets here if the "wrong" byte value was received on either UART |
1126 1008: e59fc2dc ldr r12, =0x800534 ; via 0x12ec | |
1076 100c: e5dc0000 ldrb r0, [r12] | 1127 100c: e5dc0000 ldrb r0, [r12] |
1077 1010: e3500000 cmp r0, #0 ; 0x0 | 1128 1010: e3500000 cmp r0, #0 ; 0x0 |
1078 1014: 1a000008 bne 0x103c | 1129 1014: 1a000008 bne 0x103c |
1079 1018: e3a00001 mov r0, #1 ; 0x1 | 1130 1018: e3a00001 mov r0, #1 ; 0x1 |
1080 101c: e5cc0000 strb r0, [r12] | 1131 101c: e5cc0000 strb r0, [r12] |
1081 1020: e59f02c8 ldr r0, [pc, #712] ; 0x12f0 | 1132 1020: e59f02c8 ldr r0, =0xFFFFFD02 ; via 0x12f0 |
1082 1024: e1d0c0b0 ldrh r12, [r0] | 1133 1024: e1d0c0b0 ldrh r12, [r0] |
1083 1028: e20c20bf and r2, r12, #191 ; 0xbf | 1134 1028: e20c20bf and r2, r12, #191 ; 0xbf |
1084 102c: e20cccff and r12, r12, #65280 ; 0xff00 | 1135 102c: e20cccff and r12, r12, #65280 ; 0xff00 |
1085 1030: e182c00c orr r12, r2, r12 | 1136 1030: e182c00c orr r12, r2, r12 |
1086 1034: e1c0c0b0 strh r12, [r0] | 1137 1034: e1c0c0b0 strh r12, [r0] |
1087 1038: ea000005 b 0x1054 | 1138 1038: ea000005 b 0x1054 |
1088 103c: e3a00000 mov r0, #0 ; 0x0 | 1139 103c: e3a00000 mov r0, #0 ; 0x0 |
1089 1040: e5cc0000 strb r0, [r12] | 1140 1040: e5cc0000 strb r0, [r12] |
1090 1044: e59fc2a4 ldr r12, [pc, #676] ; 0x12f0 | 1141 1044: e59fc2a4 ldr r12, =0xFFFFFD02 ; via 0x12f0 |
1091 1048: e1dc00b0 ldrh r0, [r12] | 1142 1048: e1dc00b0 ldrh r0, [r12] |
1092 104c: e3800040 orr r0, r0, #64 ; 0x40 | 1143 104c: e3800040 orr r0, r0, #64 ; 0x40 |
1093 1050: e1cc00b0 strh r0, [r12] | 1144 1050: e1cc00b0 strh r0, [r12] |
1094 1054: e59fc290 ldr r12, [pc, #656] ; 0x12ec | 1145 1054: e59fc290 ldr r12, =0x800534 ; via 0x12ec |
1095 1058: e5dcc000 ldrb r12, [r12] | 1146 1058: e5dcc000 ldrb r12, [r12] |
1096 105c: e5c1c000 strb r12, [r1] | 1147 105c: e5c1c000 strb r12, [r1] |
1097 1060: e3a00000 mov r0, #0 ; 0x0 | 1148 1060: e3a00000 mov r0, #0 ; 0x0 |
1098 1064: e12fff1e bx lr | 1149 1064: e12fff1e bx lr |
1099 | 1150 ; control gets here if a '<' character was received on the IrDA UART |
1100 1068: e3a0c001 mov r12, #1 ; 0x1 | 1151 1068: e3a0c001 mov r12, #1 ; 0x1 |
1101 106c: e5c0c000 strb r12, [r0] | 1152 106c: e5c0c000 strb r12, [r0] |
1102 1070: ea000001 b 0x107c | 1153 1070: ea000001 b 0x107c |
1154 ; control gets here if a '<' character was received on the MODEM UART | |
1103 1074: e3a0c000 mov r12, #0 ; 0x0 | 1155 1074: e3a0c000 mov r12, #0 ; 0x0 |
1104 1078: e5c0c000 strb r12, [r0] | 1156 1078: e5c0c000 strb r12, [r0] |
1105 107c: e59fc268 ldr r12, [pc, #616] ; 0x12ec | 1157 107c: e59fc268 ldr r12, =0x800534 ; via 0x12ec |
1106 1080: e5dcc000 ldrb r12, [r12] | 1158 1080: e5dcc000 ldrb r12, [r12] |
1107 1084: e5c1c000 strb r12, [r1] | 1159 1084: e5c1c000 strb r12, [r1] |
1108 1088: e3a00001 mov r0, #1 ; 0x1 | 1160 1088: e3a00001 mov r0, #1 ; 0x1 |
1109 108c: e12fff1e bx lr | 1161 108c: e12fff1e bx lr |
1110 | 1162 |
1246 1238: e38cc040 orr r12, r12, #64 ; 0x40 | 1298 1238: e38cc040 orr r12, r12, #64 ; 0x40 |
1247 123c: e1c6c0b0 strh r12, [r6] | 1299 123c: e1c6c0b0 strh r12, [r6] |
1248 1240: e59f10b0 ldr r1, =0x800524 ; via 0x12f8 | 1300 1240: e59f10b0 ldr r1, =0x800524 ; via 0x12f8 |
1249 1244: e2415004 sub r5, r1, #4 ; 0x4 | 1301 1244: e2415004 sub r5, r1, #4 ; 0x4 |
1250 1248: e59f40b0 ldr r4, =0x373C ; via 0x1300 | 1302 1248: e59f40b0 ldr r4, =0x373C ; via 0x1300 |
1303 ; the retry count loaded into R4 is 14140 in decimal | |
1251 124c: e1a00005 mov r0, r5 | 1304 124c: e1a00005 mov r0, r5 |
1305 ; call made with R0=0x800520, R1=0x800524 | |
1252 1250: ebffff57 bl 0xfb4 | 1306 1250: ebffff57 bl 0xfb4 |
1253 1254: e3500000 cmp r0, #0 ; 0x0 | 1307 1254: e3500000 cmp r0, #0 ; 0x0 |
1254 1258: 1a000001 bne 0x1264 | 1308 1258: 1a000001 bne 0x1264 |
1255 125c: e2544001 subs r4, r4, #1 ; 0x1 | 1309 125c: e2544001 subs r4, r4, #1 ; 0x1 |
1256 1260: 1afffff9 bne 0x124c | 1310 1260: 1afffff9 bne 0x124c |
1298 12f4: 00800518 | 1352 12f4: 00800518 |
1299 12f8: 00800524 | 1353 12f8: 00800524 |
1300 12fc: 00800104 | 1354 12fc: 00800104 |
1301 1300: 0000373c | 1355 1300: 0000373c |
1302 | 1356 |
1357 ; Routine 0x1304: emit a character string through a UART | |
1358 ; | |
1359 ; Arguments: | |
1360 : R0: pointer to the string | |
1361 ; R1: number of characters (bytes) to transmit | |
1362 ; R2: UART ID (0=MODEM, 1=IrDA) | |
1363 | |
1303 1304: e3510000 cmp r1, #0 ; 0x0 | 1364 1304: e3510000 cmp r1, #0 ; 0x0 |
1304 1308: 012fff1e bxeq lr | 1365 1308: 012fff1e bxeq lr |
1305 130c: e59fc178 ldr r12, [pc, #376] ; 0x148c | 1366 130c: e59fc178 ldr r12, =0x1FCC ; via 0x148c |
1306 1310: e79cc102 ldr r12, [r12, r2, lsl #2] | 1367 1310: e79cc102 ldr r12, [r12, r2, lsl #2] |
1307 1314: e28c3005 add r3, r12, #5 ; 0x5 | 1368 1314: e28c3005 add r3, r12, #5 ; 0x5 |
1308 1318: e5d32000 ldrb r2, [r3] | 1369 1318: e5d32000 ldrb r2, [r3] |
1309 131c: e3120020 tst r2, #32 ; 0x20 | 1370 131c: e3120020 tst r2, #32 ; 0x20 |
1310 1320: 0afffffc beq 0x1318 | 1371 1320: 0afffffc beq 0x1318 |
1373 13c8: e5c35000 strb r5, [r3] | 1434 13c8: e5c35000 strb r5, [r3] |
1374 13cc: e2522001 subs r2, r2, #1 ; 0x1 | 1435 13cc: e2522001 subs r2, r2, #1 ; 0x1 |
1375 13d0: 1affffed bne 0x138c | 1436 13d0: 1affffed bne 0x138c |
1376 13d4: e8bd8ff0 ldmia sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc} | 1437 13d4: e8bd8ff0 ldmia sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc} |
1377 | 1438 |
1378 13d8: e59fc0ac ldr r12, [pc, #172] ; 0x148c | 1439 ; The following routine switches a UART to a different baud rate. |
1440 ; Arguments: | |
1441 ; R0: baud rate index from the table at 0x1FD4 | |
1442 ; R1: UART ID (0=MODEM, 1=IrDA) | |
1443 | |
1444 13d8: e59fc0ac ldr r12, =0x1FCC ; via 0x148c | |
1379 13dc: e79c2101 ldr r2, [r12, r1, lsl #2] | 1445 13dc: e79c2101 ldr r2, [r12, r1, lsl #2] |
1380 13e0: e282c005 add r12, r2, #5 ; 0x5 | 1446 13e0: e282c005 add r12, r2, #5 ; 0x5 |
1381 13e4: e5dc1000 ldrb r1, [r12] | 1447 13e4: e5dc1000 ldrb r1, [r12] |
1382 13e8: e3110040 tst r1, #64 ; 0x40 | 1448 13e8: e3110040 tst r1, #64 ; 0x40 |
1383 13ec: 0afffffc beq 0x13e4 | 1449 13ec: 0afffffc beq 0x13e4 |
1384 13f0: e282c003 add r12, r2, #3 ; 0x3 | 1450 13f0: e282c003 add r12, r2, #3 ; 0x3 |
1385 13f4: e5dc1000 ldrb r1, [r12] | 1451 13f4: e5dc1000 ldrb r1, [r12] |
1386 13f8: e3811080 orr r1, r1, #128 ; 0x80 | 1452 13f8: e3811080 orr r1, r1, #128 ; 0x80 |
1387 13fc: e5cc1000 strb r1, [r12] | 1453 13fc: e5cc1000 strb r1, [r12] |
1388 1400: e59f108c ldr r1, [pc, #140] ; 0x1494 | 1454 1400: e59f108c ldr r1, =0x1FD4 ; via 0x1494 |
1389 1404: e7d13080 ldrb r3, [r1, r0, lsl #1] | 1455 1404: e7d13080 ldrb r3, [r1, r0, lsl #1] |
1390 1408: e5c23001 strb r3, [r2, #1] | 1456 1408: e5c23001 strb r3, [r2, #1] |
1391 140c: e0810080 add r0, r1, r0, lsl #1 | 1457 140c: e0810080 add r0, r1, r0, lsl #1 |
1392 1410: e5d00001 ldrb r0, [r0, #1] | 1458 1410: e5d00001 ldrb r0, [r0, #1] |
1393 1414: e5c20000 strb r0, [r2] | 1459 1414: e5c20000 strb r0, [r2] |
1394 1418: e5dc0000 ldrb r0, [r12] | 1460 1418: e5dc0000 ldrb r0, [r12] |
1395 141c: e200007f and r0, r0, #127 ; 0x7f | 1461 141c: e200007f and r0, r0, #127 ; 0x7f |
1396 1420: e5cc0000 strb r0, [r12] | 1462 1420: e5cc0000 strb r0, [r12] |
1397 1424: e12fff1e bx lr | 1463 1424: e12fff1e bx lr |
1398 | 1464 |
1465 ; 0x1428 - UART read Rx character routine | |
1466 ; | |
1467 ; Arguments: | |
1468 ; R0: UART ID (0=MODEM, 1=IrDA) | |
1469 ; R1: poll repeat count, 0 means wait forever | |
1470 ; R2: pointer to buffer where the received booty is stored | |
1471 ; | |
1472 ; Return value: 1 if a character was received, 0 otherwise | |
1473 | |
1399 1428: e3510000 cmp r1, #0 ; 0x0 | 1474 1428: e3510000 cmp r1, #0 ; 0x0 |
1400 142c: 1a000006 bne 0x144c | 1475 142c: 1a000006 bne 0x144c |
1401 1430: e59fc054 ldr r12, [pc, #84] ; 0x148c | 1476 1430: e59fc054 ldr r12, =0x1FCC ; via 0x148c |
1402 1434: e79cc100 ldr r12, [r12, r0, lsl #2] | 1477 1434: e79cc100 ldr r12, [r12, r0, lsl #2] |
1403 1438: e28c1005 add r1, r12, #5 ; 0x5 | 1478 1438: e28c1005 add r1, r12, #5 ; 0x5 |
1404 143c: e5d10000 ldrb r0, [r1] | 1479 143c: e5d10000 ldrb r0, [r1] |
1405 1440: e1b00f80 movs r0, r0, lsl #31 | 1480 1440: e1b00f80 movs r0, r0, lsl #31 |
1406 1444: 0afffffc beq 0x143c | 1481 1444: 0afffffc beq 0x143c |
1407 1448: ea000009 b 0x1474 | 1482 1448: ea000009 b 0x1474 |
1408 144c: e59fc038 ldr r12, [pc, #56] ; 0x148c | 1483 144c: e59fc038 ldr r12, =0x1FCC ; via 0x148c |
1409 1450: e79cc100 ldr r12, [r12, r0, lsl #2] | 1484 1450: e79cc100 ldr r12, [r12, r0, lsl #2] |
1410 1454: e28c3005 add r3, r12, #5 ; 0x5 | 1485 1454: e28c3005 add r3, r12, #5 ; 0x5 |
1411 1458: e5d30000 ldrb r0, [r3] | 1486 1458: e5d30000 ldrb r0, [r3] |
1412 145c: e1b00f80 movs r0, r0, lsl #31 | 1487 145c: e1b00f80 movs r0, r0, lsl #31 |
1413 1460: 1a000001 bne 0x146c | 1488 1460: 1a000001 bne 0x146c |
1519 1584: 4720 bx r4 | 1594 1584: 4720 bx r4 |
1520 1586: 46c0 nop (mov r8, r8) | 1595 1586: 46c0 nop (mov r8, r8) |
1521 | 1596 |
1522 1588: eafffffe b 0x1588 | 1597 1588: eafffffe b 0x1588 |
1523 | 1598 |
1599 ; This routine effects the transfer of control to the flash (nCS0) | |
1600 ; application image of the type indicated by the argument in R0. | |
1601 ; The latter argument is the word read from 0x2000. | |
1602 ; R1 contains the word read from 0x2004. | |
1603 | |
1524 158c: e92d4010 stmdb sp!, {r4, lr} | 1604 158c: e92d4010 stmdb sp!, {r4, lr} |
1525 1590: e1a04000 mov r4, r0 | 1605 1590: e1a04000 mov r4, r0 |
1526 1594: e1b0c0a4 movs r12, r4, lsr #1 | 1606 1594: e1b0c0a4 movs r12, r4, lsr #1 |
1527 1598: 0a000001 beq 0x15a4 | 1607 1598: 0a000001 beq 0x15a4 |
1528 159c: e3a00001 mov r0, #1 ; 0x1 | 1608 159c: e3a00001 mov r0, #1 ; 0x1 |
1537 15c0: e3540000 cmp r4, #0 ; 0x0 | 1617 15c0: e3540000 cmp r4, #0 ; 0x0 |
1538 15c4: 1a000004 bne 0x15dc | 1618 15c4: 1a000004 bne 0x15dc |
1539 15c8: e38ccc01 orr r12, r12, #256 ; 0x100 | 1619 15c8: e38ccc01 orr r12, r12, #256 ; 0x100 |
1540 15cc: e1c0c0b0 strh r12, [r0] | 1620 15cc: e1c0c0b0 strh r12, [r0] |
1541 15d0: e1a04001 mov r4, r1 | 1621 15d0: e1a04001 mov r4, r1 |
1542 15d4: ebffffe3 bl 0x1568 | 1622 15d4: ebffffe3 bl 0x1568 ; IND_CALL |
1543 15d8: e8bd8010 ldmia sp!, {r4, pc} | 1623 15d8: e8bd8010 ldmia sp!, {r4, pc} |
1544 15dc: e3540001 cmp r4, #1 ; 0x1 | 1624 15dc: e3540001 cmp r4, #1 ; 0x1 |
1545 15e0: 18bd8010 ldmneia sp!, {r4, pc} | 1625 15e0: 18bd8010 ldmneia sp!, {r4, pc} |
1546 15e4: e3a00020 mov r0, #32 ; 0x20 | 1626 15e4: e3a00020 mov r0, #32 ; 0x20 |
1547 15e8: e3a010cc mov r1, #204 ; 0xcc | 1627 15e8: e3a010cc mov r1, #204 ; 0xcc |
1553 | 1633 |
1554 ; literal pool | 1634 ; literal pool |
1555 1600: fffffb10 | 1635 1600: fffffb10 |
1556 1604: 00800038 | 1636 1604: 00800038 |
1557 | 1637 |
1638 ; This routine computes a simple word-wise (16 bits at a time) sum of | |
1639 ; the present internal boot ROM code (ignoring carry-outs), and returns | |
1640 ; it in R0. The upper 16 bits of the R0 return value will always be 0. | |
1641 ; | |
1642 ; If the argument in R0 equals 1, a call to the 0xe2c memmap/clock init | |
1643 ; function is made first, with the same arguments as at the beginning | |
1644 ; of main(). | |
1645 | |
1558 1608: e92d4000 stmdb sp!, {lr} | 1646 1608: e92d4000 stmdb sp!, {lr} |
1559 160c: e24dd008 sub sp, sp, #8 ; 0x8 | 1647 160c: e24dd008 sub sp, sp, #8 ; 0x8 |
1560 1610: e3500001 cmp r0, #1 ; 0x1 | 1648 1610: e3500001 cmp r0, #1 ; 0x1 |
1561 1614: 1a000006 bne 0x1634 | 1649 1614: 1a000006 bne 0x1634 |
1650 ; 0xe2c routine is called with the same arguments as at the beginning | |
1651 ; of main() | |
1562 1618: e3a0c002 mov r12, #2 ; 0x2 | 1652 1618: e3a0c002 mov r12, #2 ; 0x2 |
1563 161c: e5cdc000 strb r12, [sp] | 1653 161c: e5cdc000 strb r12, [sp] |
1564 1620: e3a00004 mov r0, #4 ; 0x4 | 1654 1620: e3a00004 mov r0, #4 ; 0x4 |
1565 1624: e3a01000 mov r1, #0 ; 0x0 | 1655 1624: e3a01000 mov r1, #0 ; 0x0 |
1566 1628: e3a02000 mov r2, #0 ; 0x0 | 1656 1628: e3a02000 mov r2, #0 ; 0x0 |
1787 ; The filler ends at 0x1FCC. Then we've got some data words: | 1877 ; The filler ends at 0x1FCC. Then we've got some data words: |
1788 | 1878 |
1789 ; base addresses of the two UARTs | 1879 ; base addresses of the two UARTs |
1790 1fcc: ffff5800 | 1880 1fcc: ffff5800 |
1791 1fd0: ffff5000 | 1881 1fd0: ffff5000 |
1792 ; ??? | 1882 ; UART baud rates |
1793 1fd4: 0e000700 cdpeq 7, 0, cr0, cr0, cr0, {0} | 1883 1fd4: 0700 ; /7 (115200?) |
1794 1fd8: 1c001500 cfstr32ne mvfx1, [r0] | 1884 1fd6: 0e00 ; /14 (57600?) |
1795 1fdc: 00002a00 andeq r2, r0, r0, lsl #20 | 1885 1fd8: 1500 ; /21 (38400?) |
1886 1fda: 1c00 ; /28 (28800?) | |
1887 1fdc: 2a00 ; /42 (19200?) | |
1888 1fde: 0000 | |
1796 | 1889 |
1797 ; These ldr-jump instructions get copied to the 7 internal RAM words | 1890 ; These ldr-jump instructions get copied to the 7 internal RAM words |
1798 ; starting at 0x80001C. They have the effect of defining the preceding | 1891 ; starting at 0x80001C. They have the effect of defining the preceding |
1799 ; 7 words (0x800000-0x800018 inclusive) as address-type vectors for the | 1892 ; 7 words (0x800000-0x800018 inclusive) as address-type vectors for the |
1800 ; exceptions, such that one can hook an exception either by replacing | 1893 ; exceptions, such that one can hook an exception either by replacing |