--- a/bootrom.notes	Thu Apr 25 00:08:51 2013 +0000
+++ b/bootrom.notes	Thu Apr 25 03:16:17 2013 +0000
@@ -39,6 +39,11 @@
 alternately, with the UART baud rate registers set to /42 in both cases,
 until a clean '<' is received.
 
+Once the initial '<' has been received on either UART, the boot ROM only
+listens on that port from there onward.  There is a timeout between the
+successive bytes of a single command, but the ROM will wait forever
+for another '<'.
+
 Commands:
 
 <a
@@ -46,20 +51,43 @@
 <b
 
 Followed by 4 bytes, giving a 32-bit value in MSB-first order.  The value is
-written to 800538, and the 0x2c8 function returns code 6.
+written to 80052C, and the 0x2c8 function returns code 6.
 
 <c
 
 <i
 
+Calls the 0x11c routine, then responds with '>i'.
+
 <p
 
 Followed by 9 bytes:
-	1 byte: goes into var at 800518
-	1 byte: goes into var at 800521
+	1 byte: goes into var at 800518, selects the baud rate:
+		0: 115200
+		1:  57600
+		2:  38400
+		3:  28800
+		4:  19200
+	1 byte: goes into var at 800521, controls the 0xef4 routine:
+		bits <6:2>: R2 arg (PLL_MULT field)
+		bits <1:0>: R1 arg (PLL_DIV field)
 	2 bytes: 16-bit MSB-first value goes into var at 800522
+		word gives arguments to 0xe2c routine, breaks down as follows:
+			bit 15: unused
+			<14:10> arg3
+			<9:5>	arg2
+			<4:0>	arg1
 	1 byte: goes into var at 800525
+		remaining arguments to 0xe2c:
+			<7:4>	arg5
+			<3:0>	arg4
 	4 bytes: 32-bit MSG-first value goes into var at 80051C
+		reloads the UART timeout variable 800104
+
+Good response: >p 00 04 (4 bytes total)
+The baud rate is switched after the above response is sent.
+
+Error response: >P
 
 <w
 
@@ -88,6 +116,10 @@
 800104: word initialized to 0x0001D4C0 - tells the 0x2c8 routine
 	how long to wait for a character
 800108: byte initialized to 0x01
+	state variable for the serial command interface
+	in the initial state of 01, only <i and <p are accepted
+	state 02: after successful <p, <w is allowed
+	state 03: after first successful <w?
 80010C: all bytes of a '<w' command after these two command chars
 	are stored starting here
 	this buffer is also used for other scratchpad functions: <p
@@ -98,19 +130,25 @@
 as a struct - see the routine at 0x11c:
 
 800518:	byte variable receives the first parameter byte after '<p'
+	baud rate code ([0,4] range)
 	init to 04 by '<i'
 80051C: 32-bit var set by the '<p' command
+	reloads the UART timeout variable 800104
 800520: byte variable filled every time the 0xfb4 routine is called
 	holds the ID of the UART on which '<' came in, or FF if none
 800521:	byte variable receives the 2nd parameter byte after '<p'
+	PLL config
 800522:	16-bit var set by the '<p' command
+	chip select wait state config
 800524: byte variable filled every time the 0xfb4 routine is called
 	filled with a copy of 800534
 800525:	byte var set by the '<p' command
+	config for the FFFF:F900 register (0xe2c routine)
 800526: 16-bit var init to 0 by 0x11c ('<i' handler)
 	byte following the '<c' command is extended to a half-word and
 	written here
 800528: 16-bit var init to 0 by 0x11c ('<i' handler)
+	checksum accum?
 
 80052C:	32-bit var init to 0 by 0x11c ('<i' handler)
 	word holds the argument of the '<b' command