7u83/stcgal
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restructure documentation

Browse Source 
Move all extra documentation files into doc/ and move reverse
engineering related notes to a separate directory, to keep things tidy.
This commit is contained in:
Grigori Goronzy
2018-09-04 00:31:43 +02:00
parent 71d7257422
commit ccd4b1e26b
29 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

141
doc/reverse-engineering/stc15-options.txt Normal file
View File

@ -0,0 +1,141 @@
STC15 series MCS bytes
======================
MCS3 is like early STC15 MCS1.
MCS2 is like early STC15 MCS2.
MCS4 is like early STC15 MCS0 but with additions.
MCSX is like early STC15 MCS12.
MCSY is new in STC15W4 series
baseline
B5 FF F7 BB 9F
long por disabled
B6 FF F7 BB 1F
--> MCS4 bit 7 controls POR delay. low => short, high => long
reset pin as io disabled
B8 FF F7 BB 8F
--> MCS4 bit 4 controls reset pin. low => reset is normal, high => reset is io
low voltage reset disabled
B6 FF F7 FB 9F
--> MCS3 bit 6 controls low voltage reset. low => lv reset enabled, high => disabled
lvd threshold 2.61v
B8 FF F7 BA 9F
lvd threshold 2.82v
B5 FF F7 B9 9F
lvd threshold 3.08v
B6 FF F7 B8 9F
--> MCS3 bits 0-2 control LVD threshold setting. exact mapping not yet clear.
eeprom lv inhibit disabled
B7 FF F7 3B 9F
--> MCS3 bit 7 controls eeprom lv inhibit. high => eeprom lv inhibit enabled, low => disabled
watchdog after reset enabled
B6 FF D7 BB 9F
--> MCS2 bit 5 controls watchdog after reset. high => disabled, low => enabled
watchdog prescaler 128
B4 FF F6 BB 9F
watchdog prescaler 64
B5 FF F5 BB 9F
watchdog prescaler 32
B5 FF F4 BB 9F
watchdog prescaler 2
B6 FF F0 BB 9F
--> MCS2 bits 0-2 control watchdog prescaler. mapping is similar to early STC15.
wdt stop in idle disabled
B7 FF FF BB 9F
erase eeprom next programming
B4 FF F7 BB 9F
--> it's somewhere else! it's bit 1 of the extra MCSX byte that is typically 0xfd. low => erase eeprom disabled, high => erase eeprom enabled
p3.3 por state enabled
B9 FF F7 BB 97
--> MCS4 bit 3 controls the p3.3 state. high => p3.3 high, low => p3.3 low
p3.1 passthrough from p3.0 enabled
B5 FF F7 BB DF
--> MCS4 bit 2 controls the p3.1 passthrough. low => passthrough disabled, high => passthrough enabled
p3.1 push pull enabled
B5 FF F7 BB BF
--> MCS4 bit 1 controls p3.1 push pull. low => quasi-bidi, high => push-pull
bsl pindetect enabled
B5 FF F7 BB BF
--> somewhere else, MCSX bit 0. low => pindetect enabled, high => pindetect disabled.
external oscillator enabled (IAP15F2K61S2)
9C 7F F7 BB 9E
--> MCS4 bit 0 controls external oscillator. low => use external crystal, high => use RC.
external oscillator enabled + clock gain low (IAP15F2K61S2)
9C 7F F7 BB 9C
--> MCS 4 bit controls clock gain. high => high clock gain, low => low clock gain.
cpu core supply level (MCSY)
in status packet:
2.68v
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 7A C0 FD 27 ED 00 00 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 EA 92 FF FF FF 15 09 25 60 14 BD 16
3.33v
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 92 30 FD 25 EA 00 FC 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 F7 92 FF FF FF 15 09 25 60 15 49 16
3.63v
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 7A C0 FD 25 EF 00 00 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 FD 92 FF FF FF 15 09 25 60 14 D0 16
3.73v
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 92 30 FD 25 EA 00 00 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 FF 92 FF FF FF 15 09 25 60 14 55 16
^^
MCSY
voltage: ff -> 3.73v
fd -> 3.63v
f7 -> 3.33v
ea -> 2.68v
in set options packet:
46 B9 6A 00 4B 04 00 00 5A A5 FF FF FF 00 FF FF
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00 00 FF A8 FF EE FF E0 FF FD 03 FF FF FF FF FF
^^
MCSP
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FD FF FF FF 75 BF F7 BC 9F 3A 80 16
^^
MCSY
password setting
the password is sent with packet type 0x07 and checked before erase with packet type 0x05. setting the password uses two fields.
index 22 of the option block encodes the password length in bytes (MCSP, see above). bit 3 in MCS3 decides whether the password
will be checked. if the bit is set, no password check occurs. if it is reset, a password check occurs.
quick dump from USB-ISP packets:
set: foobar
0000 ff ff ff 00 ff ff 00 05 ff ff ff ff ff ff ff 07 ................
0010 ff ff ff ff ff ff ff 07 ff 06 01 ff 6e ff 36 58 ............n.6X
0020 ff 00 ff f5 03 ff ff 0c ff ff ff ff ff ff ff 07 ................
0030 ff ff ff ff ff ff ff 07 ff ff ff ff ff ff ec 1a ................
0040 ff ff ff 99 7f f7 bc 38 9f 61 .......8.a
reset:
0000 ff ff ff 00 ff ff 00 05 ff ff ff ff ff ff ff 07 ................
0010 ff ff ff ff ff ff ff 07 ff 00 01 ff 6e ff 36 5e ............n.6^
0020 ff 00 ff fd 03 ff ff 04 ff ff ff ff ff ff ff 07 ................
0030 ff ff ff ff ff ff ff 07 ff ff ff ff ff ff ec 1a ................
0040 ff ff ff 99 7f f7 bc 38 9f 61 .......8.a