Skip to content

Programming the CY27C256

November 9, 2017

The address lines going to narrow memory slot on the Membership Card (U8 which is under U2). Are scrambled a bit. To compensate for that I wrote a little python script to read the assembler output and scramble the data so that the 1802 will see the correct code.

So the sequence is:

  • assemble and scramble the code using the a02boot.bat file
  • program the CY27C256 using the TL866CS programmer (skip the blank check)

As it happens, the first try at programming the chip failed verify at location 4000 expecting 00 it found 7B.  This is kind of suspicious since 0000 is 7B but I’m ignoring it for now.

I’m attempting to load the xmodem bootloader which is now under 256 bytes and should run from RAM or ROM.  It will load code to 0x200 and branch to it. I’m compiling it for 9600 baud at 2MHz which will be easy to test and will scale up to a delightful 57600 baud at 12MHz.

Echo this will prepare a boot image for the narrow ROM on a REV J membership card
@c:\lcc42\bin\asw -cpu 1802 -quiet -x -i ..\..\include -L  %1.asm
@c:\lcc42\bin\p2hex -r $-$ %1 %1.hex
C:\Users\bill\Documents\olduinoz\asmx\hex2bin %1.hex
python scramble2.py %1.bin
import sys
fi = open(sys.argv[1], 'rb')
inp = bytearray(fi.read())
fi.close()
n=len(inp)
outp=bytearray(n+16) # allows for address bit 0 going to A4 i.e 1>17
print n
for a in range(0,n):
    a2=a&0xFFE2|((a&0x10)>>1)|((a&0x08)>>1)|((a&0x04)>>2)|((a&0x01)<<4)
    outp[a2]=inp[a]
fo = open(sys.argv[1]+'.scrambled', 'wb')
fo.write(outp)
fo.close()
;17-07-19 Standalone xmodem boot loader xmboot.asm
;	receives to fixed address APPADDR
;17-10-04 includes dummy program at 0x200
;17-11-07 adapting for ROM use. 
	relaxed on
NAK:	EQU 0x15
SOH:	EQU 0x01
EOT:	EQU 0x04
ACK:	EQU 0x06
Rrcv:	EQU 8
Rsnd:	EQU 9
R14:	EQU 14
R12:	EQU 12
R11:	EQU 11
R3:	EQU 3
R0:	EQU 0
APPADDR: EQU 0x200
blksize:	EQU 128
ldAD:	macro	reg1,directaddress	;load an absolute address or a constant into a register
	ldi	(directaddress)&255
	plo	reg1
	ldi	(directaddress)>>8; was/256
	phi	reg1
	endm

	seq			;prep Q for serial output
; XMODEM receiver based on xr.asm by Michael H Riley and serial routines by Josh Bensadon   
	ldaD	R12,APPADDR

here:
	ghi	R0		;get our page address
	phi	Rsnd		;use for receive routine
	phi	Rrcv		; and send routine
	ldi	serout&255
	plo	Rsnd		;bottom of send address
	ldi    serinT&255	
	plo	Rrcv		;bottom of receive address

	ldi     NAK             ; need to send NAK to start
        sep     Rsnd
        sep     Rrcv          	; test for incoming character or timeout
        bnf     ckeot		;continue if no timeout
	ldaD    Rrcv,serinT	;reload address of serial routine with timeout
	ldi     NAK             ; retry NAK to start
        sep     Rsnd
        sep     Rrcv          	; test for incoming character or timeout
        bnf     ckeot		;continue if no timeout
	br 	launchapp		;timeout - launch already loaded application

filelp:    ;receive address is in R12, length goes in R11
;begining of block read. returns to filelp or exits to filedn   				
        sep     Rrcv          	; wait for incoming character
ckeot:	smi     EOT              ; check for EOT
        bz     filedn           ; jump if so

	sep     Rrcv               ; read block number
	sep     Rrcv               ; read inverted block number

	ldi     blksize             ; 128 bytes to receive
	plo     r11

readlp: sep     Rrcv               ; read data byte
        str     r12                  ; store into output buffer
        inc     r12                  ; point to next position
        dec     r11                  ; decrement block count
        glo     r11                  ; see if done
        bnz     readlp              ; loop back if not
;end of block read
        sep     Rrcv               ; read checksum byte


        ldi     ACK                  ; send an ACK
        sep     Rsnd
       	lbr     filelp              ; loop back for more
filedn:    
        ldi     ACK                  ; acknowledge end of transmission
        sep     Rsnd

launchapp:				;dispatch code newly loaded or previously left 
	sex	0		;X=0
	lbr	Appaddr		;go to loaded application


; *******************************************************************
; *** This software is copyright 2005 by Michael H Riley          ***
; *** You have permission to use, modify, copy, and distribute    ***
; *** this software so long as this copyright notice is retained. ***
; *** This software may not be used in commercial applications    ***
; *** without express written permission from the author.         ***
; *******************************************************************
	db	"17-10-04 10:00"

LCC1802CPUSPEED EQU 2000000
__BAUDRATE EQU 	9600
	include "serwjrT1.inc"	
;bit-bang Serial routines adapted from Josh Bensadon's VELFbios-v3.1.asm
;https://groups.yahoo.com/neo/groups/cosmacelf/files/Member-JoshBensadon/
;Transmit Byte via Q connected to RS232 driver
;call via sep, returns via sep R3
;Byte to send in D
;Destroys r14
;17-09-02 this version times out on the first call only - approx 1.5 sec at 4MHz
;----------------------------------------------------------------------
 	IFNDEF 	LCC1802CPUSPEED
LCC1802CPUSPEED EQU 4000000
 	ENDIF
 	MACEXP ON
bitdelay: MACRO baudrate,cpuspeed,baseline,xreg
	rept ((cpuspeed/(baudrate*8)-baseline))/3
	NOP
	endm
	rept (((cpuspeed/(baudrate*8)-baseline)#3))>=1
	sex xreg
	endm
	ENDM
 	IFNDEF 	__BAUDRATE
__BAUDRATE EQU 	9600
	ENDIF
	align 64
serout:			;entry from assembly with char in D
	phi R14		;save char in R14.1
	ldi 9		;9 bits to transmit (1 start + 8 data)
	plo r14
	ghi R14
	shl		;set start bit
	rshr		;DF=0

.txcloop:
	bdf $+5		;10.5   jump to seq to send a 1 bit
	req		;11.5   send a 0 bit
	br $+5		;1      jump +5 to next shift
	seq		;11.5   send a 1 bit
	br $+2		;1      jump +2 to next shift (NOP for timing)
	rshr		;2      shift next bit to DF flag
	phi r14		;3      save D in r14.1
	DEC r14		;4      dec bit count
	glo r14		;5      get bit count
	bz .txcret	;6      if 0 then all 9 bits (start and data) sent
	ghi r14		;7      restore D
	bitdelay __BAUDRATE,LCC1802CPUSPEED,20,2,{EXPAND}
	br .txcloop	;9.5    loop back to send next bit
.txcret: ghi r14		;7
	bitdelay __BAUDRATE,LCC1802CPUSPEED,16,2
	seq		;11.5 stop bit
	bitdelay __BAUDRATE,LCC1802CPUSPEED,4,2
	sep R3		;return 
	br serout	;reset for next time
;**********************************************************************
;serinT
;Receive Byte via EF3 connected to RS232 receiver
;Receives 8 bits
;call via sep
;Returns with Byte received in D, DF is set if the start bit is never seen
;Destroys r14
;----------------------------------------------------------------------
	align 64
serinT:			;serial input with timeout of 65535*6*16 machine cycles - approx 1.5 sec at 4MHZ
	ldaD R14,0x4000	;R14 is timeout loop counter
.rxcw:	b3 .okgo	;check for start bit after each instruction
	dec 14
	b3 .okgo	;check for start bit after each instruction
	ghi 14
	b3 .okgo	;check for start bit after each instruction
	bnz .rxcw
;here we've had a timeout - set DF and return
	ldi 1
	shr
	sep R3		;return
	br  serinT	;for next time
.serinN:	bn3 .serinN	;serial input without timeout	
.okgo:			;here we know the start bit is present
 	ldi 8		;start bit +7 bits from loop, last bit on returning
	plo r14
	ldi 0
	NOP		;delay to center samples

.rxcloop:
	bitdelay __BAUDRATE,LCC1802CPUSPEED,20,2
	b3 $+6		;11.5 sample rx input bit
	ori 80h		;1
	br $+4		;2
	phi r14		;1
	phi r14		;2
	shr		;3
	phi r14		;4
	DEC r14		;5
	glo r14		;6
	bz .rxcret	;7
	ghi r14		;8
	br  .rxcloop	;9
.rxcret: ghi r14	;8
	ghi r14		;9
	bitdelay __BAUDRATE,LCC1802CPUSPEED,20,2
	b3 $+4		;11.5 sample last rx input bit
	ori 80h		; for a 1 bit
	adi 0		;clear the DF flag because no timeout
	sep R3		;return
	br  .serinN	;for next time - only timeout on first call
	

UPDATE:
17-11-10 descrambled
The good news is that the scrambling/descrambling works. The ROM is addessed at 8000 and a little dump program shows the correct code.
Testing is a bit of a bugger though. I need a “trampoline” at location 0 to jump to the ROM. The ROM should load code over top of it. Using the logic analyzer I can see that the ROM is sending the NAK twice as designed then dispatching the code at location 0 which branches back to it and NAKs some more. promising anyway.

Advertisements

From → Uncategorized

Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

%d bloggers like this: