﻿  There are four 

.: Addressing & Interface :.
  Base addresses
B0800000	FLASH 1
B0A00000	FLASH 2
B0C00000	FLASH 3
B0E00000	FLASH 4

 Jtag port on top; 16bit, so mirror data in both HWs when writing
B2000000	r/w register
	*commands
	0003 0003	w: state? read word from register in next frame
		8000	r: busy? not ready to read?
		2000	r: not ready?  rereads until not set (not set is the "erase signal")
	0005 0005	w: disconnect?  sent when error occurs
	0007 0007	w: read
		8000	r: ready; loops while clear
		4000	r: data remaining?
		00FF	r: next byte from stream

  Flash control registers
B4800000	FLASH 1 cmd register
B4A00000	FLASH 2 cmd register
B4C00000	FLASH 3 cmd register
B4E00000	FLASH 4 cmd register


.: Erase and Program :.
  You'll find this in the reflasher at 80000CAC.
  Assume at least one frame (at ~60Hz) is consumed between each read or write operation unless otherwise specified.
*) Wait for erase signal:
  Write 00030003 to B2000000.
  Read from B2000000 each frame.  Proceed when value & 0x2000 not set.
*) Erase all unlocked flash blocks:
  Write 00070007 to B2000000.
  In the same frame:
    Write 00A70000, then 00D00000 to each of the flash command registers (B4800000, B4A00000, B4C00000, B4E00000)
    This send each flash unit a "erase unlocked blocks" and confirmation command.
*) Check CSR Status for each erased chip:
  In the same frame:
    Write 00700000 to each flash command register.
    Read from flash command register.  Erase is complete when value & 0x80 set on all units.
*) Check if erase successful:
  In the same frame:
    Write 00700000 to each flash command register.
    Read from flash command register.  Erase failed if value & 0x20 set.  On failure, abort.
*) Initialize data read/write:
  Write 00030003 to B2000000.  Initialize a checksum to 0.
  Set ADDR to the first unit (B0800000).  Set a semiphore to 0.
*) For each word in the file's length:
**) Wait until port ready:
   Read word from B2000000.
   If value & 0x8000 set, repeat the test next frame.
   Else, in the same frame write 00070007 to B2000000.
**) Read next byte from port (upper):
   Read word from B2000000.
   If value & 0x8000 not set, repeat the test next frame.
   If value & 0x4000, add (value & 0xFF) to checksum.  (0x4000 is set for the file's length, not in the two checksum bytes at the end.)
   WORD = (value & 0xFF) << 8
   Write 00030003 to B2000000.
**) Wait until port ready:
   Read word from B2000000.
   If value & 0x8000 set, repeat the test next frame.
   Else, in the same frame write 00070007 to B2000000.
**) Read next byte from port (lower):
   Read word from B2000000.
   If value & 0x8000 not set, repeat the test next frame.
   If value & 0x4000, add (value & 0xFF) to checksum.  (0x4000 is set for the file's length, not in the two checksum bytes at the end.)
   WORD += value & 0xFF
   Write 00030003 to B2000000.
**) Write word to flash:
   Convert ADDR to a flash command register by ORing with 0x4000000.
   In the same frame:
     Write 00400000 to ADDR | 0x4000000.  (word write command)
     (When writing a word to flash, duplicate the same value in the upper and lower 16bits.)
     value = (WORD << 16) | WORD
     Write value to ADDR.
**) Check CSR Status for errors:
   In the same frame:
     Write 00700000 to ADDR | 0x4000000.  (word write command)
     Read value from ADDR | 0x4000000.
     If value & 0x80 not set, repeat the test next frame.  (ready flag)
     Write failed if value & 0x10 set.  On an error, write 00050005 to B2000000 and abort.
     Write 00030003 to B2000000.
   ! Important !
   Semiphore ^= 1
   If Semiphore == 0, add 4 to ADDR.  You write and read from the same address twice for 32bit IO.  You cannot access the upper 16bits directly!
*) For the checksum stored in the last word:
**) Wait until port ready: (as above)
**) Read next byte from port (upper):
**) Wait until port ready:
**) Read next byte from port (lower):
**) Verify checksum:
   If WORD != checksum, write 00050005 to B2000000 and abort.
*) Set read array mode:
  In the same frame:
    Write 00FF0000 to each flash command register.
*) Success!


.: Flash Command Reference :.
read array		0xFF	R	array addr	array data
intelligent ID		0x90	R	ID address	ID, mnfr
compatible status reg	0x70	R	{not appl.}	CSR data {auto. available during write, erase, and suspend ops}
clear status register	0x50	{Clears CSR.3, CSR.4, and CSR.5. Also clears GSR.5 an all BSR.5 and BSR.2 bits.}
word write		0x40	W	write addr.	write data
word/byte write		0x10	W	write addr.	write data
block erase/confirm	0x20	W	block addr.	D0
erase un/pause		0xB0	W	{not appl.}	D0
*Extended Commands:
extended status		0x71	R	reg addr	GSR data  BSR data
page buffer swap	0x72
read page buffer	0x75	R	page addr	page data
single load -> page buf	0x74	W	page addr	page data
seq. load -> page buf.	0xE0	W	byte count L/word count L
				W	{not appl.}	byte count H/word count H
page buffer W -> flash	0x0C	W	A0/{N/A}	byte count L+H/word count L
				W	write addr.	byte count H+L/word count L
2-byte write		0xFB	W	A0		write data L+H
				W	write addr.	write data H+L
block erase/confirm	0x20	W	block addr.	D0
lock block/confirm	0x77	W	block addr.	D0
upload status bits/conf	0x97	W	{not appl.}	D0
upload device info	0x99	W	{not appl.}	D0
erase unlocked blocks	0xA7	W	{not appl.}	D0
sleep			0xF0
abort			0x80
*RY/BY settings
enable to level-mode	0x96	W	{not appl.}	01
pulse-on-write		0x96	W	{not appl.}	02
pulse-on-erase		0x96	W	{not appl.}	03
disable			0x96	W	{not appl.}	04

*Compatible Status Register:
80	write state machine status
	1	ready
	0	busy
40	erase suspend status
	1	suspended
	0	in progress / complete
20	erase status
	1	error in block erasure
	0	success
10	data write status
	1	error in data write
	0	success
08	Vpp status
	1	Vpp low detect, aborting operation
	0	Vpp okay
07	RESERVED
*Global Status Register
80	write state machine status
	1	ready
	0	busy
40	operation suspend status
	1	suspended
	0	in progress / complete
20	operation status
	1	error
	0	success
10	device sleep status
	1	sleeping
	0	awake
08	queue status
	1	full
	0	available
04	page buffer available status
	1	one or two page buffers available
	0	unavailable
02	page buffer status
	1	selected page buffer ready
	0	selected page buffer busy
01	page buffer select status
	1	page buffer 1 selected
	0	page buffer 0 selected
*Block status register:
80	block status
	1	ready
	0	busy
40	block lock status
	1	unlocked
	0	read-only
20	block operation status
	1	error
	0	success or running
10	block operation abort status
	1	aborted
	0	ok
08	queue status
	1	full
	0	available
04	Vpp status
	1	Vpp low detect, aborting operation
	0	Vpp okay
03	RESERVED
