FreeCalypso > hg > freecalypso-reveng

comparison bootrom.disasm @ 8:a06573cacb6e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
boot ROM re: trying to understand the code that runs after '<' received
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Wed, 17 Apr 2013 06:25:19 +0000
parents 8c2621b2ed37
children a51729642295
comparison
equal deleted inserted replaced
7:a445735685ba 8:a06573cacb6e
5 c: ea200004 b 0x800024 5 c: ea200004 b 0x800024
6 10: ea200004 b 0x800028 6 10: ea200004 b 0x800028
7 14: ea200004 b 0x80002c 7 14: ea200004 b 0x80002c
8 18: ea200004 b 0x800030 8 18: ea200004 b 0x800030
9 1c: ea200004 b 0x800034 9 1c: ea200004 b 0x800034
10
11 ; The following routine (starting at 0x20) is used to transfer control
12 ; to nCS0 application images that are designed to work with no internal
13 ; boot ROM "in the way", i.e., images identified by a 1 in the 0x2000 word.
14 ; The present routine is copied to the internal RAM and executed there.
15 ;
16 ; The routine itself takes one argument in R0 and uses it to set the
17 ; nIBOOT override bits in the FFFF:FB10 register. If R0==1, bits <9:8>
18 ; of this register are set to 11, putting nCS0 at address 0. If R0==0,
19 ; the bits are set to 01, putting the internal ROM at 0. Otherwise,
20 ; the bits are set to 00, restoring the nIBOOT pin configuration.
21 ; (In actual operation the argument passed to this function is the word
22 ; from 0x2000, so it's equal to 1.) Then the routine causes the
23 ; watchdog timer to go off, resetting the ARM.
10 24
11 20: e24dd004 sub sp, sp, #4 ; 0x4 25 20: e24dd004 sub sp, sp, #4 ; 0x4
12 24: e59f20b8 ldr r2, =0xFFFFFB10 ; via 0xe4 26 24: e59f20b8 ldr r2, =0xFFFFFB10 ; via 0xe4
13 28: e1d2c0b0 ldrh r12, [r2] 27 28: e1d2c0b0 ldrh r12, [r2]
14 2c: e20c10ff and r1, r12, #255 ; 0xff 28 2c: e20c10ff and r1, r12, #255 ; 0xff
56 d4: e15c0000 cmp r12, r0 70 d4: e15c0000 cmp r12, r0
57 d8: bafffff7 blt 0xbc 71 d8: bafffff7 blt 0xbc
58 dc: e28dd004 add sp, sp, #4 ; 0x4 72 dc: e28dd004 add sp, sp, #4 ; 0x4
59 e0: e12fff1e bx lr 73 e0: e12fff1e bx lr
60 74
61 ; literal pool 75 ; literal pool for the above routine
62 e4: fffffb10 76 e4: fffffb10
63 e8: 000080f5 77 e8: 000080f5
78 ; end of the code copied to the internal RAM for booting type 1 images
64 79
65 ec: e92d4010 stmdb sp!, {r4, lr} 80 ec: e92d4010 stmdb sp!, {r4, lr}
66 f0: e59fcd0c ldr r12, [pc, #3340] ; 0xe04 81 f0: e59fcd0c ldr r12, [pc, #3340] ; 0xe04
67 f4: e59c4014 ldr r4, [r12, #20] 82 f4: e59c4014 ldr r4, [r12, #20]
68 f8: e59f0d08 ldr r0, [pc, #3336] ; 0xe08 83 f8: e59f0d08 ldr r0, [pc, #3336] ; 0xe08
70 100: e790c10c ldr r12, [r0, r12, lsl #2] 85 100: e790c10c ldr r12, [r0, r12, lsl #2]
71 104: e28c0005 add r0, r12, #5 ; 0x5 86 104: e28c0005 add r0, r12, #5 ; 0x5
72 108: e5d0c000 ldrb r12, [r0] 87 108: e5d0c000 ldrb r12, [r0]
73 10c: e31c0040 tst r12, #64 ; 0x40 88 10c: e31c0040 tst r12, #64 ; 0x40
74 110: 0afffffc beq 0x108 89 110: 0afffffc beq 0x108
75 114: eb000513 bl 0x1568 90 114: eb000513 bl 0x1568 ; IND_CALL
76 118: eafffffe b 0x118 91 118: eafffffe b 0x118
77 92
78 11c: e3a0c004 mov r12, #4 ; 0x4 93 11c: e3a0c004 mov r12, #4 ; 0x4
79 120: e5c0c000 strb r12, [r0] 94 120: e5c0c000 strb r12, [r0]
80 124: e3a0c000 mov r12, #0 ; 0x0 95 124: e3a0c000 mov r12, #0 ; 0x0
1000 ee4: e1830205 orr r0, r3, r5, lsl #4 1015 ee4: e1830205 orr r0, r3, r5, lsl #4
1001 ee8: e3800cff orr r0, r0, #65280 ; 0xff00 1016 ee8: e3800cff orr r0, r0, #65280 ; 0xff00
1002 eec: e10600bc strh r0, [r6, -r12] 1017 eec: e10600bc strh r0, [r6, -r12]
1003 ef0: e8bd8070 ldmia sp!, {r4, r5, r6, pc} 1018 ef0: e8bd8070 ldmia sp!, {r4, r5, r6, pc}
1004 1019
1020 ; The routine at 0xef4 gets called from main() after a '<' character
1021 ; has been received and autoboot thereby interrupted in the
1022 ; autoboot-enabled flash state.
1023
1005 ef4: e92d4070 stmdb sp!, {r4, r5, r6, lr} 1024 ef4: e92d4070 stmdb sp!, {r4, r5, r6, lr}
1006 ef8: e59fc3e4 ldr r12, [pc, #996] ; 0x12e4 1025 ef8: e59fc3e4 ldr r12, =0xFFFFF900 ; via 0x12e4
1007 efc: e1dc40b0 ldrh r4, [r12] 1026 efc: e1dc40b0 ldrh r4, [r12]
1008 f00: e59f33d0 ldr r3, [pc, #976] ; 0x12d8 1027 ; original value of FFFF:F900 saved in R4
1028 ; now set it to FF22, just like the 0xe2c init routine did
1029 f00: e59f33d0 ldr r3, =0xFFFFFD00 ; via 0x12d8
1009 f04: e3a05b01 mov r5, #1024 ; 0x400 1030 f04: e3a05b01 mov r5, #1024 ; 0x400
1010 f08: e3a0c801 mov r12, #65536 ; 0x10000 1031 f08: e3a0c801 mov r12, #65536 ; 0x10000
1011 f0c: e24cc0de sub r12, r12, #222 ; 0xde 1032 f0c: e24cc0de sub r12, r12, #222 ; 0xde
1012 f10: e103c0b5 strh r12, [r3, -r5] 1033 f10: e103c0b5 strh r12, [r3, -r5]
1013 f14: e59f63c0 ldr r6, [pc, #960] ; 0x12dc 1034 ; write 0x2002 to FFFF:9800, again just like 0xe2c did
1014 f18: e59fc3c0 ldr r12, [pc, #960] ; 0x12e0 1035 f14: e59f63c0 ldr r6, =0xFFFF9800 ; via 0x12dc
1036 f18: e59fc3c0 ldr r12, =0x2002 ; via 0x12e0
1015 f1c: e1c6c0b0 strh r12, [r6] 1037 f1c: e1c6c0b0 strh r12, [r6]
1016 f20: e1b05f8c movs r5, r12, lsl #31 1038 f20: e1b05f8c movs r5, r12, lsl #31
1017 f24: 1afffffd bne 0xf20 1039 f24: 1afffffd bne 0xf20
1018 f28: e181c102 orr r12, r1, r2, lsl #2 1040 f28: e181c102 orr r12, r1, r2, lsl #2
1019 f2c: e1a0c28c mov r12, r12, lsl #5 1041 f2c: e1a0c28c mov r12, r12, lsl #5
1049 fa4: 1afffffd bne 0xfa0 1071 fa4: 1afffffd bne 0xfa0
1050 fa8: e3a0cb01 mov r12, #1024 ; 0x400 1072 fa8: e3a0cb01 mov r12, #1024 ; 0x400
1051 fac: e10340bc strh r4, [r3, -r12] 1073 fac: e10340bc strh r4, [r3, -r12]
1052 fb0: e8bd8070 ldmia sp!, {r4, r5, r6, pc} 1074 fb0: e8bd8070 ldmia sp!, {r4, r5, r6, pc}
1053 1075
1076 ; Routine 0xfb4 gets called from main() where the boot code is giving
1077 ; the UARTs a chance to interrupt the autoboot process before transferring
1078 ; control to the nCS0 image.
1079 ;
1080 ; Arguments: both R0 and R1 point to byte variables acting as additional
1081 ; function outputs.
1082 ;
1083 ; If a '<' character is received on either UART, the function returns
1084 ; without further fuss. If nothing was received on either UART, it
1085 ; also returns without further fuss. However, if the "wrong" byte value
1086 ; was received on either UART, the function flips the VCLKOUT_DIV2 bit
1087 ; in the FFFF:FD02 register - it is the boot code's way of figuring out
1088 ; whether the input clock is 13 or 26 MHz.
1089 ;
1090 ; Return values:
1091 ; In R0: 1 if '<' received, 0 otherwise
1092 ; In *R0: UART ID if '<' received, FF otherwise
1093 ; In *R1: final state of the 800534 byte variable
1094 ;
1095 ; The latter variable records the state of the divide-by-2. On the first
1096 ; try, the divide-by-2 is enabled, and the variable contains 0. When this
1097 ; function disables the /2, the variable is set to 1. It keeps toggling
1098 ; back and forth as wrong bytes come in.
1099
1054 fb4: e3a0c0ff mov r12, #255 ; 0xff 1100 fb4: e3a0c0ff mov r12, #255 ; 0xff
1055 fb8: e5c0c000 strb r12, [r0] 1101 fb8: e5c0c000 strb r12, [r0]
1056 fbc: e59fc324 ldr r12, [pc, #804] ; 0x12e8 1102 ; check the MODEM UART first
1103 fbc: e59fc324 ldr r12, =0xFFFF5000 ; via 0x12e8
1057 fc0: e5dc2805 ldrb r2, [r12, #2053] 1104 fc0: e5dc2805 ldrb r2, [r12, #2053]
1058 fc4: e1b02f82 movs r2, r2, lsl #31 1105 fc4: e1b02f82 movs r2, r2, lsl #31
1059 fc8: 1a000001 bne 0xfd4 1106 fc8: 1a000001 bne 0xfd4
1060 fcc: e3a02000 mov r2, #0 ; 0x0 1107 fcc: e3a02000 mov r2, #0 ; 0x0
1061 fd0: ea000003 b 0xfe4 1108 fd0: ea000003 b 0xfe4
1062 fd4: e5dc2800 ldrb r2, [r12, #2048] 1109 fd4: e5dc2800 ldrb r2, [r12, #2048]
1063 fd8: e352003c cmp r2, #60 ; 0x3c 1110 fd8: e352003c cmp r2, #60 ; 0x3c
1064 fdc: 0a000024 beq 0x1074 1111 fdc: 0a000024 beq 0x1074
1065 fe0: e3a02001 mov r2, #1 ; 0x1 1112 fe0: e3a02001 mov r2, #1 ; 0x1
1113 ; Control gets here if no '<' was received on the MODEM UART.
1114 ; R2 contains 1 if some other byte value was received, or 0 if nothing.
1115 ; Now check the IrDA UART.
1066 fe4: e5dc3005 ldrb r3, [r12, #5] 1116 fe4: e5dc3005 ldrb r3, [r12, #5]
1067 fe8: e1b03f83 movs r3, r3, lsl #31 1117 fe8: e1b03f83 movs r3, r3, lsl #31
1068 fec: 1a000002 bne 0xffc 1118 fec: 1a000002 bne 0xffc
1069 ff0: e3520001 cmp r2, #1 ; 0x1 1119 ff0: e3520001 cmp r2, #1 ; 0x1
1070 ff4: 0a000003 beq 0x1008 1120 ff4: 0a000003 beq 0x1008
1071 ff8: ea000015 b 0x1054 1121 ff8: ea000015 b 0x1054
1072 ffc: e5dcc000 ldrb r12, [r12] 1122 ffc: e5dcc000 ldrb r12, [r12]
1073 1000: e35c003c cmp r12, #60 ; 0x3c 1123 1000: e35c003c cmp r12, #60 ; 0x3c
1074 1004: 0a000017 beq 0x1068 1124 1004: 0a000017 beq 0x1068
1075 1008: e59fc2dc ldr r12, [pc, #732] ; 0x12ec 1125 ; control gets here if the "wrong" byte value was received on either UART
1126 1008: e59fc2dc ldr r12, =0x800534 ; via 0x12ec
1076 100c: e5dc0000 ldrb r0, [r12] 1127 100c: e5dc0000 ldrb r0, [r12]
1077 1010: e3500000 cmp r0, #0 ; 0x0 1128 1010: e3500000 cmp r0, #0 ; 0x0
1078 1014: 1a000008 bne 0x103c 1129 1014: 1a000008 bne 0x103c
1079 1018: e3a00001 mov r0, #1 ; 0x1 1130 1018: e3a00001 mov r0, #1 ; 0x1
1080 101c: e5cc0000 strb r0, [r12] 1131 101c: e5cc0000 strb r0, [r12]
1081 1020: e59f02c8 ldr r0, [pc, #712] ; 0x12f0 1132 1020: e59f02c8 ldr r0, =0xFFFFFD02 ; via 0x12f0
1082 1024: e1d0c0b0 ldrh r12, [r0] 1133 1024: e1d0c0b0 ldrh r12, [r0]
1083 1028: e20c20bf and r2, r12, #191 ; 0xbf 1134 1028: e20c20bf and r2, r12, #191 ; 0xbf
1084 102c: e20cccff and r12, r12, #65280 ; 0xff00 1135 102c: e20cccff and r12, r12, #65280 ; 0xff00
1085 1030: e182c00c orr r12, r2, r12 1136 1030: e182c00c orr r12, r2, r12
1086 1034: e1c0c0b0 strh r12, [r0] 1137 1034: e1c0c0b0 strh r12, [r0]
1087 1038: ea000005 b 0x1054 1138 1038: ea000005 b 0x1054
1088 103c: e3a00000 mov r0, #0 ; 0x0 1139 103c: e3a00000 mov r0, #0 ; 0x0
1089 1040: e5cc0000 strb r0, [r12] 1140 1040: e5cc0000 strb r0, [r12]
1090 1044: e59fc2a4 ldr r12, [pc, #676] ; 0x12f0 1141 1044: e59fc2a4 ldr r12, =0xFFFFFD02 ; via 0x12f0
1091 1048: e1dc00b0 ldrh r0, [r12] 1142 1048: e1dc00b0 ldrh r0, [r12]
1092 104c: e3800040 orr r0, r0, #64 ; 0x40 1143 104c: e3800040 orr r0, r0, #64 ; 0x40
1093 1050: e1cc00b0 strh r0, [r12] 1144 1050: e1cc00b0 strh r0, [r12]
1094 1054: e59fc290 ldr r12, [pc, #656] ; 0x12ec 1145 1054: e59fc290 ldr r12, =0x800534 ; via 0x12ec
1095 1058: e5dcc000 ldrb r12, [r12] 1146 1058: e5dcc000 ldrb r12, [r12]
1096 105c: e5c1c000 strb r12, [r1] 1147 105c: e5c1c000 strb r12, [r1]
1097 1060: e3a00000 mov r0, #0 ; 0x0 1148 1060: e3a00000 mov r0, #0 ; 0x0
1098 1064: e12fff1e bx lr 1149 1064: e12fff1e bx lr
1099 1150 ; control gets here if a '<' character was received on the IrDA UART
1100 1068: e3a0c001 mov r12, #1 ; 0x1 1151 1068: e3a0c001 mov r12, #1 ; 0x1
1101 106c: e5c0c000 strb r12, [r0] 1152 106c: e5c0c000 strb r12, [r0]
1102 1070: ea000001 b 0x107c 1153 1070: ea000001 b 0x107c
1154 ; control gets here if a '<' character was received on the MODEM UART
1103 1074: e3a0c000 mov r12, #0 ; 0x0 1155 1074: e3a0c000 mov r12, #0 ; 0x0
1104 1078: e5c0c000 strb r12, [r0] 1156 1078: e5c0c000 strb r12, [r0]
1105 107c: e59fc268 ldr r12, [pc, #616] ; 0x12ec 1157 107c: e59fc268 ldr r12, =0x800534 ; via 0x12ec
1106 1080: e5dcc000 ldrb r12, [r12] 1158 1080: e5dcc000 ldrb r12, [r12]
1107 1084: e5c1c000 strb r12, [r1] 1159 1084: e5c1c000 strb r12, [r1]
1108 1088: e3a00001 mov r0, #1 ; 0x1 1160 1088: e3a00001 mov r0, #1 ; 0x1
1109 108c: e12fff1e bx lr 1161 108c: e12fff1e bx lr
1110 1162
1246 1238: e38cc040 orr r12, r12, #64 ; 0x40 1298 1238: e38cc040 orr r12, r12, #64 ; 0x40
1247 123c: e1c6c0b0 strh r12, [r6] 1299 123c: e1c6c0b0 strh r12, [r6]
1248 1240: e59f10b0 ldr r1, =0x800524 ; via 0x12f8 1300 1240: e59f10b0 ldr r1, =0x800524 ; via 0x12f8
1249 1244: e2415004 sub r5, r1, #4 ; 0x4 1301 1244: e2415004 sub r5, r1, #4 ; 0x4
1250 1248: e59f40b0 ldr r4, =0x373C ; via 0x1300 1302 1248: e59f40b0 ldr r4, =0x373C ; via 0x1300
1303 ; the retry count loaded into R4 is 14140 in decimal
1251 124c: e1a00005 mov r0, r5 1304 124c: e1a00005 mov r0, r5
1305 ; call made with R0=0x800520, R1=0x800524
1252 1250: ebffff57 bl 0xfb4 1306 1250: ebffff57 bl 0xfb4
1253 1254: e3500000 cmp r0, #0 ; 0x0 1307 1254: e3500000 cmp r0, #0 ; 0x0
1254 1258: 1a000001 bne 0x1264 1308 1258: 1a000001 bne 0x1264
1255 125c: e2544001 subs r4, r4, #1 ; 0x1 1309 125c: e2544001 subs r4, r4, #1 ; 0x1
1256 1260: 1afffff9 bne 0x124c 1310 1260: 1afffff9 bne 0x124c
1298 12f4: 00800518 1352 12f4: 00800518
1299 12f8: 00800524 1353 12f8: 00800524
1300 12fc: 00800104 1354 12fc: 00800104
1301 1300: 0000373c 1355 1300: 0000373c
1302 1356
1357 ; Routine 0x1304: emit a character string through a UART
1358 ;
1359 ; Arguments:
1360 : R0: pointer to the string
1361 ; R1: number of characters (bytes) to transmit
1362 ; R2: UART ID (0=MODEM, 1=IrDA)
1363
1303 1304: e3510000 cmp r1, #0 ; 0x0 1364 1304: e3510000 cmp r1, #0 ; 0x0
1304 1308: 012fff1e bxeq lr 1365 1308: 012fff1e bxeq lr
1305 130c: e59fc178 ldr r12, [pc, #376] ; 0x148c 1366 130c: e59fc178 ldr r12, =0x1FCC ; via 0x148c
1306 1310: e79cc102 ldr r12, [r12, r2, lsl #2] 1367 1310: e79cc102 ldr r12, [r12, r2, lsl #2]
1307 1314: e28c3005 add r3, r12, #5 ; 0x5 1368 1314: e28c3005 add r3, r12, #5 ; 0x5
1308 1318: e5d32000 ldrb r2, [r3] 1369 1318: e5d32000 ldrb r2, [r3]
1309 131c: e3120020 tst r2, #32 ; 0x20 1370 131c: e3120020 tst r2, #32 ; 0x20
1310 1320: 0afffffc beq 0x1318 1371 1320: 0afffffc beq 0x1318
1373 13c8: e5c35000 strb r5, [r3] 1434 13c8: e5c35000 strb r5, [r3]
1374 13cc: e2522001 subs r2, r2, #1 ; 0x1 1435 13cc: e2522001 subs r2, r2, #1 ; 0x1
1375 13d0: 1affffed bne 0x138c 1436 13d0: 1affffed bne 0x138c
1376 13d4: e8bd8ff0 ldmia sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc} 1437 13d4: e8bd8ff0 ldmia sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc}
1377 1438
1378 13d8: e59fc0ac ldr r12, [pc, #172] ; 0x148c 1439 ; The following routine switches a UART to a different baud rate.
1440 ; Arguments:
1441 ; R0: baud rate index from the table at 0x1FD4
1442 ; R1: UART ID (0=MODEM, 1=IrDA)
1443
1444 13d8: e59fc0ac ldr r12, =0x1FCC ; via 0x148c
1379 13dc: e79c2101 ldr r2, [r12, r1, lsl #2] 1445 13dc: e79c2101 ldr r2, [r12, r1, lsl #2]
1380 13e0: e282c005 add r12, r2, #5 ; 0x5 1446 13e0: e282c005 add r12, r2, #5 ; 0x5
1381 13e4: e5dc1000 ldrb r1, [r12] 1447 13e4: e5dc1000 ldrb r1, [r12]
1382 13e8: e3110040 tst r1, #64 ; 0x40 1448 13e8: e3110040 tst r1, #64 ; 0x40
1383 13ec: 0afffffc beq 0x13e4 1449 13ec: 0afffffc beq 0x13e4
1384 13f0: e282c003 add r12, r2, #3 ; 0x3 1450 13f0: e282c003 add r12, r2, #3 ; 0x3
1385 13f4: e5dc1000 ldrb r1, [r12] 1451 13f4: e5dc1000 ldrb r1, [r12]
1386 13f8: e3811080 orr r1, r1, #128 ; 0x80 1452 13f8: e3811080 orr r1, r1, #128 ; 0x80
1387 13fc: e5cc1000 strb r1, [r12] 1453 13fc: e5cc1000 strb r1, [r12]
1388 1400: e59f108c ldr r1, [pc, #140] ; 0x1494 1454 1400: e59f108c ldr r1, =0x1FD4 ; via 0x1494
1389 1404: e7d13080 ldrb r3, [r1, r0, lsl #1] 1455 1404: e7d13080 ldrb r3, [r1, r0, lsl #1]
1390 1408: e5c23001 strb r3, [r2, #1] 1456 1408: e5c23001 strb r3, [r2, #1]
1391 140c: e0810080 add r0, r1, r0, lsl #1 1457 140c: e0810080 add r0, r1, r0, lsl #1
1392 1410: e5d00001 ldrb r0, [r0, #1] 1458 1410: e5d00001 ldrb r0, [r0, #1]
1393 1414: e5c20000 strb r0, [r2] 1459 1414: e5c20000 strb r0, [r2]
1394 1418: e5dc0000 ldrb r0, [r12] 1460 1418: e5dc0000 ldrb r0, [r12]
1395 141c: e200007f and r0, r0, #127 ; 0x7f 1461 141c: e200007f and r0, r0, #127 ; 0x7f
1396 1420: e5cc0000 strb r0, [r12] 1462 1420: e5cc0000 strb r0, [r12]
1397 1424: e12fff1e bx lr 1463 1424: e12fff1e bx lr
1398 1464
1465 ; 0x1428 - UART read Rx character routine
1466 ;
1467 ; Arguments:
1468 ; R0: UART ID (0=MODEM, 1=IrDA)
1469 ; R1: poll repeat count, 0 means wait forever
1470 ; R2: pointer to buffer where the received booty is stored
1471 ;
1472 ; Return value: 1 if a character was received, 0 otherwise
1473
1399 1428: e3510000 cmp r1, #0 ; 0x0 1474 1428: e3510000 cmp r1, #0 ; 0x0
1400 142c: 1a000006 bne 0x144c 1475 142c: 1a000006 bne 0x144c
1401 1430: e59fc054 ldr r12, [pc, #84] ; 0x148c 1476 1430: e59fc054 ldr r12, =0x1FCC ; via 0x148c
1402 1434: e79cc100 ldr r12, [r12, r0, lsl #2] 1477 1434: e79cc100 ldr r12, [r12, r0, lsl #2]
1403 1438: e28c1005 add r1, r12, #5 ; 0x5 1478 1438: e28c1005 add r1, r12, #5 ; 0x5
1404 143c: e5d10000 ldrb r0, [r1] 1479 143c: e5d10000 ldrb r0, [r1]
1405 1440: e1b00f80 movs r0, r0, lsl #31 1480 1440: e1b00f80 movs r0, r0, lsl #31
1406 1444: 0afffffc beq 0x143c 1481 1444: 0afffffc beq 0x143c
1407 1448: ea000009 b 0x1474 1482 1448: ea000009 b 0x1474
1408 144c: e59fc038 ldr r12, [pc, #56] ; 0x148c 1483 144c: e59fc038 ldr r12, =0x1FCC ; via 0x148c
1409 1450: e79cc100 ldr r12, [r12, r0, lsl #2] 1484 1450: e79cc100 ldr r12, [r12, r0, lsl #2]
1410 1454: e28c3005 add r3, r12, #5 ; 0x5 1485 1454: e28c3005 add r3, r12, #5 ; 0x5
1411 1458: e5d30000 ldrb r0, [r3] 1486 1458: e5d30000 ldrb r0, [r3]
1412 145c: e1b00f80 movs r0, r0, lsl #31 1487 145c: e1b00f80 movs r0, r0, lsl #31
1413 1460: 1a000001 bne 0x146c 1488 1460: 1a000001 bne 0x146c
1519 1584: 4720 bx r4 1594 1584: 4720 bx r4
1520 1586: 46c0 nop (mov r8, r8) 1595 1586: 46c0 nop (mov r8, r8)
1521 1596
1522 1588: eafffffe b 0x1588 1597 1588: eafffffe b 0x1588
1523 1598
1599 ; This routine effects the transfer of control to the flash (nCS0)
1600 ; application image of the type indicated by the argument in R0.
1601 ; The latter argument is the word read from 0x2000.
1602 ; R1 contains the word read from 0x2004.
1603
1524 158c: e92d4010 stmdb sp!, {r4, lr} 1604 158c: e92d4010 stmdb sp!, {r4, lr}
1525 1590: e1a04000 mov r4, r0 1605 1590: e1a04000 mov r4, r0
1526 1594: e1b0c0a4 movs r12, r4, lsr #1 1606 1594: e1b0c0a4 movs r12, r4, lsr #1
1527 1598: 0a000001 beq 0x15a4 1607 1598: 0a000001 beq 0x15a4
1528 159c: e3a00001 mov r0, #1 ; 0x1 1608 159c: e3a00001 mov r0, #1 ; 0x1
1537 15c0: e3540000 cmp r4, #0 ; 0x0 1617 15c0: e3540000 cmp r4, #0 ; 0x0
1538 15c4: 1a000004 bne 0x15dc 1618 15c4: 1a000004 bne 0x15dc
1539 15c8: e38ccc01 orr r12, r12, #256 ; 0x100 1619 15c8: e38ccc01 orr r12, r12, #256 ; 0x100
1540 15cc: e1c0c0b0 strh r12, [r0] 1620 15cc: e1c0c0b0 strh r12, [r0]
1541 15d0: e1a04001 mov r4, r1 1621 15d0: e1a04001 mov r4, r1
1542 15d4: ebffffe3 bl 0x1568 1622 15d4: ebffffe3 bl 0x1568 ; IND_CALL
1543 15d8: e8bd8010 ldmia sp!, {r4, pc} 1623 15d8: e8bd8010 ldmia sp!, {r4, pc}
1544 15dc: e3540001 cmp r4, #1 ; 0x1 1624 15dc: e3540001 cmp r4, #1 ; 0x1
1545 15e0: 18bd8010 ldmneia sp!, {r4, pc} 1625 15e0: 18bd8010 ldmneia sp!, {r4, pc}
1546 15e4: e3a00020 mov r0, #32 ; 0x20 1626 15e4: e3a00020 mov r0, #32 ; 0x20
1547 15e8: e3a010cc mov r1, #204 ; 0xcc 1627 15e8: e3a010cc mov r1, #204 ; 0xcc
1553 1633
1554 ; literal pool 1634 ; literal pool
1555 1600: fffffb10 1635 1600: fffffb10
1556 1604: 00800038 1636 1604: 00800038
1557 1637
1638 ; This routine computes a simple word-wise (16 bits at a time) sum of
1639 ; the present internal boot ROM code (ignoring carry-outs), and returns
1640 ; it in R0. The upper 16 bits of the R0 return value will always be 0.
1641 ;
1642 ; If the argument in R0 equals 1, a call to the 0xe2c memmap/clock init
1643 ; function is made first, with the same arguments as at the beginning
1644 ; of main().
1645
1558 1608: e92d4000 stmdb sp!, {lr} 1646 1608: e92d4000 stmdb sp!, {lr}
1559 160c: e24dd008 sub sp, sp, #8 ; 0x8 1647 160c: e24dd008 sub sp, sp, #8 ; 0x8
1560 1610: e3500001 cmp r0, #1 ; 0x1 1648 1610: e3500001 cmp r0, #1 ; 0x1
1561 1614: 1a000006 bne 0x1634 1649 1614: 1a000006 bne 0x1634
1650 ; 0xe2c routine is called with the same arguments as at the beginning
1651 ; of main()
1562 1618: e3a0c002 mov r12, #2 ; 0x2 1652 1618: e3a0c002 mov r12, #2 ; 0x2
1563 161c: e5cdc000 strb r12, [sp] 1653 161c: e5cdc000 strb r12, [sp]
1564 1620: e3a00004 mov r0, #4 ; 0x4 1654 1620: e3a00004 mov r0, #4 ; 0x4
1565 1624: e3a01000 mov r1, #0 ; 0x0 1655 1624: e3a01000 mov r1, #0 ; 0x0
1566 1628: e3a02000 mov r2, #0 ; 0x0 1656 1628: e3a02000 mov r2, #0 ; 0x0
1787 ; The filler ends at 0x1FCC. Then we've got some data words: 1877 ; The filler ends at 0x1FCC. Then we've got some data words:
1788 1878
1789 ; base addresses of the two UARTs 1879 ; base addresses of the two UARTs
1790 1fcc: ffff5800 1880 1fcc: ffff5800
1791 1fd0: ffff5000 1881 1fd0: ffff5000
1792 ; ??? 1882 ; UART baud rates
1793 1fd4: 0e000700 cdpeq 7, 0, cr0, cr0, cr0, {0} 1883 1fd4: 0700 ; /7 (115200?)
1794 1fd8: 1c001500 cfstr32ne mvfx1, [r0] 1884 1fd6: 0e00 ; /14 (57600?)
1795 1fdc: 00002a00 andeq r2, r0, r0, lsl #20 1885 1fd8: 1500 ; /21 (38400?)
1886 1fda: 1c00 ; /28 (28800?)
1887 1fdc: 2a00 ; /42 (19200?)
1888 1fde: 0000
1796 1889
1797 ; These ldr-jump instructions get copied to the 7 internal RAM words 1890 ; These ldr-jump instructions get copied to the 7 internal RAM words
1798 ; starting at 0x80001C. They have the effect of defining the preceding 1891 ; starting at 0x80001C. They have the effect of defining the preceding
1799 ; 7 words (0x800000-0x800018 inclusive) as address-type vectors for the 1892 ; 7 words (0x800000-0x800018 inclusive) as address-type vectors for the
1800 ; exceptions, such that one can hook an exception either by replacing 1893 ; exceptions, such that one can hook an exception either by replacing