Proghq - User contributions [en]

XGecu Protocol

2025-04-06T14:20:36Z

Drh: Add OVC documentation to logic tests.

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|AUTO_FIND
|
|0x29
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_IC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 xx pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 1 to 0 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

xx is normally 00 if it is 01 then overcurrent protection was triggered when performing the test.

====== 0x29 AUTO_FIND (t48) ======
send 29 00 00 00 00 00 00 00
recv 29 00 pp 00 00 00 00 00 [pins]

Attempt to detect which pins are active in the ZIF socket. This is used by logic tests when the "Auto Find" button is clicked.
pp is the number of pins checked and is always 40 (0x28). '''[pins]''' is a list of pp pins one pin per byte. If the corresponding
byte is set to 1 then the pin is active, 0 otherwise.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 xx 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.
 
xx should be 00 if it is 01 then overcurrent protection has been triggered.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2025-04-06T12:15:38Z

Drh: Add OVC documentation to READ_PINS

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|AUTO_FIND
|
|0x29
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_IC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 1 to 0 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

====== 0x29 AUTO_FIND (t48) ======
send 29 00 00 00 00 00 00 00
recv 29 00 pp 00 00 00 00 00 [pins]

Attempt to detect which pins are active in the ZIF socket. This is used by logic tests when the "Auto Find" button is clicked.
pp is the number of pins checked and is always 40 (0x28). '''[pins]''' is a list of pp pins one pin per byte. If the corresponding
byte is set to 1 then the pin is active, 0 otherwise.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 xx 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.
 
xx should be 00 if it is 01 then overcurrent protection has been triggered.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2024-10-25T13:36:55Z

Drh: AUTO_FIND also supported by TL866II+

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|AUTO_FIND
|
|0x29
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_IC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 1 to 0 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

====== 0x29 AUTO_FIND (t48) ======
send 29 00 00 00 00 00 00 00
recv 29 00 pp 00 00 00 00 00 [pins]

Attempt to detect which pins are active in the ZIF socket. This is used by logic tests when the "Auto Find" button is clicked.
pp is the number of pins checked and is always 40 (0x28). '''[pins]''' is a list of pp pins one pin per byte. If the corresponding
byte is set to 1 then the pin is active, 0 otherwise.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2024-10-25T12:48:47Z

Drh:

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|AUTO_FIND
|
|
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_IC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 1 to 0 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

====== 0x29 AUTO_FIND (t48) ======
send 29 00 00 00 00 00 00 00
recv 29 00 pp 00 00 00 00 00 [pins]

Attempt to detect which pins are active in the ZIF socket. This is used by logic tests when the "Auto Find" button is clicked.
pp is the number of pins checked and is always 40 (0x28). '''[pins]''' is a list of pp pins one pin per byte. If the corresponding
byte is set to 1 then the pin is active, 0 otherwise.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2024-10-23T14:12:48Z

Drh: Typo

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|?? autofind ??
|
|
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_IC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 1 to 0 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

Talk:XGecu Protocol

2024-09-21T16:32:40Z

Drh: /* (0x34) Was SET_DIR */ new section

T48 0x24 command byte seems to be Adapter detection/DRM. 
Here are the queries to the T48 for some adapters: 
 
24 E0 28 00 00 00 00 00 01 00 00 00 .... F48_EX-1 
24 E0 28 00 00 00 00 00 02 00 00 00 .... S44_EX-1 
24 E0 28 00 00 00 00 00 08 00 00 00 .... F48_EX-2 
24 E0 28 00 00 00 00 00 0B 00 00 00 .... F56_EX-A 
24 E0 28 00 00 00 00 00 00 40 00 00 .... EMMC_ISP 
24 E0 28 00 00 00 00 00 00 00 00 E1 .... BGA48-E001 
24 E0 28 00 00 00 00 00 00 00 00 E2 .... BGA63_EX-1 
24 E0 28 00 00 00 00 00 00 00 00 E3 .... BGA64-EX-A 
24 E0 28 00 00 00 00 00 00 00 00 E4 .... BGA64-EX-B 
24 E0 28 00 00 00 00 00 00 00 00 E5 .... BGA169/BGA153 
24 E0 28 00 00 00 00 00 00 00 00 E6 .... BGA162 
24 E0 28 00 00 00 00 00 00 00 00 E7 .... BGA221 
24 E0 28 00 00 00 00 00 00 00 00 E8 .... BGA100_EX 
24 E0 28 00 00 00 00 00 00 00 00 EC .... EMMC_SD 
 
 
<pre>
weird
-- with the emmc_isp un-plugged:, reading an IS21ES04G-JCLI(ISP)_1Bit
1 <-- UNKNOWN 24 F0 00 00 01 00 00 00
1 <-- UNKNOWN 24 E0 28 00 00 00 00 00 00 40 00 00
1 --> RETURNS 24 D0 30 00 14 01 07 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1 <-- UNKNOWN 24 F1 00 00 00 00 00 00
1 <-- TRAN_END 04 01 00 00 00 00 00 00

-- With the emmc_isp plugged-in and reading an IS21ES04G-JCLI(ISP)_1Bit
1 <-- UNKNOWN 24 F0 00 00 01 00 00 00
1 <-- UNKNOWN 24 E0 28 00 00 00 00 00 00 40 00 00
1 --> RETURNS 24 00 30 00 14 01 07 FF 58 47 65 63 75 20 44 69 72 65 63 74 6C 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 A0 AD
1 <-- UNKNOWN 24 F1 00 00 00 00 00 00
1 <-- TRAN_START 03 31 00 81 01 05 A1 00 20 00 00 00 41 00 20 00 00 02 00 00 00 01 00 FF 03 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 08 20 00 00 00 00 41
1 <-- GET_STATUS 39 31 00 81 01 05 A1 00
1 --> RETURNS 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1 <-- ERROR 21 04 00 00 00 00 00 00
1 --> RETURNS
1 <-- TRAN_END 04 01 00 00

-- with the emmc_isp un-plugged again, transaction is starting:
1 <-- UNKNOWN 24 F0 00 00 01 00 00 00
1 <-- UNKNOWN 24 E0 28 00 00 00 00 00 00 40 00 00
1 --> RETURNS 24 00 00 00 00 00 00 00
1 <-- UNKNOWN 24 F1 00 00 00 00 00 00
1 <-- TRAN_START 03 31 00 81 01 05 A1 00 20 00 00 00 41 00 20 00 00 02 00 00 00 01 00 FF 03 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 08 20 00 00 00 00 41
1 <-- GET_STATUS 39 31 00 81 01 05 A1 00
1 --> RETURNS 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1 <-- ERROR 21 04 00 00 00 00 00 00
1 --> RETURNS 21 2A 00 00 00 00 00 00
1 <-- TRAN_END 04 01 00 00

</pre>

== 0x3E (pin detect) ==

<pre>
pin detect response in the form 3E00xxxx000000XXXXXXYYYYYY0000, where XXXXXX seems to be one row of pin state, and YYYYYY the other.

x x x x x x x x x x x x x x x x - - - -

U FFFF00 FFFF00

x x x x x x x x x x x x x x x x - - - -

x x x x x x x x x x x x x x x x x - - -

U FFFF80 FFFF00

x x x x x x x x x x x x x x x x - - - -

x x x x x x x x x x x x x x x x - - - -

U FFFF0C FFFF00

x x x x x x x x x x x x x x x x - - x x

x x x x x x x x x x x x x x x x - - x x

U FFFF30 FFFF00

x x x x x x x x x x x x x x x x - - - -

x x - - - - - - - - - - - - - - - - - -

U 000000 00C000

- - - - - - - - - - - - - - - - - - - -

- - x x - - - - - - - - - - - - - - - -

U 000000 003000

- - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - -

U 030000 000000

x x - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - -

U 060000 000000

- x x - - - - - - - - - - - - - - - - -
</pre>

== (0x34) Was SET_DIR ==

The old SET_DIR command (0x34) on the T48 responds with 12 bytes:

34 00 18 00 00 00 00 00 00 00 00 00

Anyone any idea what this represents? Assigning some of ISP to GND/VCC/VPP does produce some non-zero values for the last 4 bytes but can't find a pattern. Calling pin reset or even end transaction doesn't reset the values in the reponse.

XGecu Protocol

2024-09-21T16:20:53Z

Drh: Typo

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|?? autofind ??
|
|
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_IC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 0 to 1 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2024-09-21T16:14:13Z

Drh:

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|?? autofind ??
|
|
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x28 LOGIC_TEST_VECTOR (t48) ======
send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.
voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };
If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40,
corresponding to the number of pins of the chip under test. Setting
a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each
test. If N is zero the logic test sets voltages and assigns VCC and GND
according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored,
VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

'''[test vector]''' consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to
a pin, lowest nyble first. That is low nyble of the initial byte is pin 1
and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

'''[test reply]''' contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or
1.


A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time
with pulldown. If the pin changes from 0 to 1 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2024-09-21T15:18:19Z

Drh: Document RESET_PIN_DRIVERS

based on minipro, list of commands:
{| class="wikitable"
|+
|'''command'''
|'''TL866a/cs'''
|'''TL866II+'''
|'''T48'''
|'''T56'''
|-
|GET_SYSTEM_INFO
|0x00
|0x00
|0x00
|0x00
|-
|NAND_INIT
| -
|0x02
|0x02
|0x02
|-
|START_TRANSACTION
|0x03
|0x03
|0x03
|0x03
|-
|END_TRANSACTION
|0x04
|0x04
|0x04
|0x04
|-
|GET_CHIP_ID
|0x05
|0x05
|0x05
|0x05
|-
|READ_USER
|0x10
|0x06
|0x06
|0x06
|-
|WRITE_USER
|0x11
|0x07
|0x07
|0x07
|-
|READ_CFG
|0x12
|0x08
|0x08
|0x08
|-
|WRITE_CFG
|0x13
|0x09
|0x09
|0x09
|-
|WRITE_USER_DATA
|0x14
|0x0a
|0x0a
|0x0a
|-
|READ_USER_DATA
|0x15
|0x0b
|0x0b
|0x0b
|-
|WRITE_CODE
|0x20
|0x0c
|0x0c
|0x0c
|-
|READ_CODE
|0x21
|0x0d
|0x0d
|0x0d
|-
|ERASE
|0x22
|0x0e
|0x0e
|0x0e
|-
|READ_DATA
|0x30
|0x10
|0x10
|0x10
|-
|WRITE_DATA
|0x31
|0x11
|0x11
|0x11
|-
|WRITE_LOCK
|0x40
|0x14
|0x14
|0x14
|-
|READ_LOCK
|0x41
|0x15
|0x15
|0x15
|-
|READ_CALIBRATION
|0x42
|0x16
|0x16
|0x16
|-
|PROTECT_OFF
|0x44
|0x18
|0x18
|0x18
|-
|PROTECT_ON
|0x45
|0x19
|0x19
|0x19
|-
|AUTODETECT
|0xfc
|0x37
|0x37
|0x37
|-
|BOOTLOADER_WRITE
|0xaa
|0x3b
|0x3b
|0x3b
|-
|BOOTLOADER_ERASE
|0xcc
|0x3c
|0x3c
|0x3c
|-
|UNLOCK_TSOP48
|0xfd
|0x38
|
|
|-
|GET_STATUS
|0xfe
|0x39
|0x39
|0x39
|-
|READ_JEDEC
| -
|0x1d
|0x1d
|0x1d
|-
|WRITE_JEDEC
| -
|0x1e
|0x1e
|0x1e
|-
|WRITE_BITSTREAM
| -
| -
| -
|0x26
|-
|LOGIC_IC_TEST_VECTOR
|
|0x28
|0x28
|0x28
|-
|WRITE_BITSTREAM2
| -
| -
| -
|0x2a
|-
|SWITCH
| -
|0x3d
|0x3d
|0x3d
|-
|SET_LATCH
|0xd1
| -
| -
| -
|-
|RESET_PIN_DRIVERS
|0xd0
|0x2d
|0x2d
|0x2d
|-
|READ_ZIF_PINS
|0xd2
|0x35
|
|0x35
|-
|SET_DIR
|0xd4
|0x34
|
|
|-
|SET_OUT
|0xd5
|0x36
|
|0x36
|-
|SET_VCC_VOLTAGE
|
|0x1b
|0x1b
|
|-
|SET_VCC_PIN
|
|0x2e
|0x2e
|0x2e
|-
|SET_VPP_VOLTAGE
|
|0x1c
|0x1c
|
|-
|SET_VPP_PIN
|0x2f
|0x2f
|0x2f
|0x2f
|-
|SET_GND_PIN
|
|0x30
|0x30
|0x30
|-
|SET_PULLDOWNS
|
|0x31
|0x32
|
|-
|SET_PULLUPS
|
|0x32
|0x31
|
|-
|RESET
|0xff
|0x3f
|0x3f
|0x3f
|-
|? pin detect
|
|
|0x3e
|0x3e
|-
|?? autofind ??
|
|
|0x29
|
|-
|detect_drm_adapter
|
|
|0x24
| -
|-
|??? set / read / pin (imax?)
|
|
|0x33
|
|-
|??? after read cfg
|
|
|0x22
|
|}

====== 0x2d RESET_PIN_DRIVERS (t48) ======
send 2d 00 00 00 00 00 00 00
Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment,
remove pullups and set VPP/VPP/VCCIO voltages to defaults.

====== 0x2E SET_VCC_PIN (and voltage) (t48) ======
send 2e 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00 yy 00 zz 00
Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:
vccmap =
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VCC on ISP-connector
 
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96,
writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
 
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
 
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.
voltagemap_vcc[64]={ 0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

====== 0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48) ======
send 2f 00 00 00 00 00 00 00 aa bb 00 00 xx 00 00 00
Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:
vppmap =
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]
 
xx is 00 or 01 where 01 enables VPP on ISP-connector J1.
 
send 2f 01 00 00 00 00 00 00 xx 00 00 00
Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.
voltagemap_vpp[64]={ 9.31, 9.56, 9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

 
send 2f 02 00 00 00 00 00 00 xx 00 00 00
Sets vccio voltage 00 to 04, default is 03.
voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

====== 0x30 SET_GND_PIN (t48) ======
send 30 00 00 00 00 00 00 00 aa bb cc dd 00 00 00 00 xx 00 00 00
Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:
gndmap =
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]
 
xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

====== 0x31 SET_PULLUPS (t48) ======
send 31 00 00 00 00 00 00 00
Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x32 SET_PULLDOWNS (t48) ======
send 32 00 00 00 00 00 00 00
Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

====== 0x33 MEASURE_VOLTAGES (t48) ======
send 33 00 00 00 00 00 00 00
recv 33 00 00 00 00 00 00 00 pp pp pp pp uu uu uu uu vv vv vv vv ii ii ii ii
Measures voltages.
 
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
 
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
 
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
 
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

====== 0x35 READ_PINS (t48) ======
send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00
Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
 
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
 
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
 
J12 is internally connected to ZIF pin 21.

====== 0x36 SET_OUT (t48) ======
send 36 xx 00 00 ii 00 00 00
Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
 
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
 
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
 
Attempting to set J12, J14 or J16 has no effect.

====== 0x3E PIN_DETECT ======
send 3E 00 aa bb 00 00 00 00
recv 3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00
 
aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9

XGecu Protocol

2024-09-21T14:48:33Z

Drh: Add VCC/VPP/VCCIO defaults and not pullup/pulldown doesn't reset some VCC/VPP/GND assignment.

XGecu Protocol

2024-09-21T14:35:53Z

Drh:

XGecu Protocol

2024-09-21T13:52:09Z

Drh: Document J12, J14 and J16 oddities.

XGecu Protocol

2024-09-21T13:34:57Z

Drh: Correct typo: pullups and pulldowns changed places on T48. This was correct in main body of text.