XGecu Protocol

based on minipro, list of commands:

command	TL866a/cs	TL866II+	T48	T56
GET_SYSTEM_INFO	0x00	0x00	0x00	0x00
NAND_INIT	-	0x02	0x02	0x02
START_TRANSACTION	0x03	0x03	0x03	0x03
END_TRANSACTION	0x04	0x04	0x04	0x04
GET_CHIP_ID	0x05	0x05	0x05	0x05
READ_USER	0x10	0x06	0x06	0x06
WRITE_USER	0x11	0x07	0x07	0x07
READ_CFG	0x12	0x08	0x08	0x08
WRITE_CFG	0x13	0x09	0x09	0x09
WRITE_USER_DATA	0x14	0x0a	0x0a	0x0a
READ_USER_DATA	0x15	0x0b	0x0b	0x0b
WRITE_CODE	0x20	0x0c	0x0c	0x0c
READ_CODE	0x21	0x0d	0x0d	0x0d
ERASE	0x22	0x0e	0x0e	0x0e
READ_DATA	0x30	0x10	0x10	0x10
WRITE_DATA	0x31	0x11	0x11	0x11
WRITE_LOCK	0x40	0x14	0x14	0x14
READ_LOCK	0x41	0x15	0x15	0x15
READ_CALIBRATION	0x42	0x16	0x16	0x16
PROTECT_OFF	0x44	0x18	0x18	0x18
PROTECT_ON	0x45	0x19	0x19	0x19
AUTODETECT	0xfc	0x37	0x37	0x37
BOOTLOADER_WRITE	0xaa	0x3b	0x3b	0x3b
BOOTLOADER_ERASE	0xcc	0x3c	0x3c	0x3c
UNLOCK_TSOP48	0xfd	0x38
GET_STATUS	0xfe	0x39	0x39	0x39
READ_JEDEC	-	0x1d	0x1d	0x1d
WRITE_JEDEC	-	0x1e	0x1e	0x1e
WRITE_BITSTREAM	-	-	-	0x26
LOGIC_IC_TEST_VECTOR		0x28	0x28	0x28
WRITE_BITSTREAM2	-	-	-	0x2a
SWITCH	-	0x3d	0x3d	0x3d
SET_LATCH	0xd1	-	-	-
RESET_PIN_DRIVERS	0xd0	0x2d	0x2d	0x2d
READ_ZIF_PINS	0xd2	0x35		0x35
SET_DIR	0xd4	0x34
SET_OUT	0xd5	0x36		0x36
SET_VCC_VOLTAGE		0x1b	0x1b
SET_VCC_PIN		0x2e	0x2e	0x2e
SET_VPP_VOLTAGE		0x1c	0x1c
SET_VPP_PIN	0x2f	0x2f	0x2f	0x2f
SET_GND_PIN		0x30	0x30	0x30
SET_PULLDOWNS		0x31	0x32
SET_PULLUPS		0x32	0x31
RESET	0xff	0x3f	0x3f	0x3f
? pin detect			0x3e	0x3e
?? autofind ??			0x29
detect_drm_adapter			0x24	-
??? set / read / pin (imax?)			0x33
??? after read cfg			0x22

0x28 LOGIC_IC_TEST_VECTOR (t48)

send 28 vv pp 00 n1 n2 n3 n4 [test vector]
recv 28 00 pp 00 00 00 00 00 [test reply]

Performs a logic test.
vv&0x7F sets VCC voltage.

voltagemap_logic_vcc[4]={ 5, 3.3, 2.5, 1.8 };

If vv&0x80 is true set pulldowns otherwise pullups.
pp is the number of pins which must be an even number from 2 to 40, corresponding to the number of pins of the chip under test. Setting a value higher than 40 will lock up the T48.
n1 n2 n3 n4 is a 32 bit sequence number N which is typically incremented for each test. If N is zero the logic test sets voltages and assigns VCC and GND according to the test vector, it also resets all ISP pins to input. If N is non-zero the VCC voltage setting is ignored, VCC and GND are not reassigned, ISP values are unchanged. Pullups or pulldowns are still set according to vv&0x80.

[test vector] consists of 24 bytes of which only the first pp/2 are significant. Each nyble corresponds to a pin, lowest nyble first. That is low nyble of the initial byte is pin 1 and the high nyble pin2. The nyble can take values 0 through 8 representing 0, 1, L, H, C, Z, X, G, and V respectively.

[test reply] contains the logic state of each pin in the same format as the test vector. Each nyble will be 0 or 1.

A pin can be tested for high impedance (tri-state) by performing the same test twice: once with pullup and the second time with pulldown. If the pin changes from 0 to 1 it is tri-state otherwise the pin is driving it.

The test vector will silently allow VCC and GND assignments to pins which do not support it.
By keeping the sequence number non-zero VCC voltages can be set to values not normally supported by logic test. ISP settings can also be retained.
The pin numbers in the test vector and response are the pins of the inserted IC: not the pin numbers of the ZIF socket.

0x2d RESET_PIN_DRIVERS (t48)

send 2d 00 00 00 00 00 00 00 

Reset all pins state: set all pins to input, remove any GCC/VCC/VPP assignment, remove pullups and set VPP/VPP/VCCIO voltages to defaults.

0x2E SET_VCC_PIN (and voltage) (t48)

send 2e 00 00 00  00 00 00 00  aa bb cc dd  00 00 00 00  xx 00 00 00  yy 00 zz 00 

Set which pins are VCC in aa bb cc dd according to vcc pin map, lsb of aa first:

vccmap = 
[1,2,3,4,5,6,7,8,16,15,14,13,12,11,10,9,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]

xx is 00 or 01 where 01 enables VCC on ISP-connector
yy is written straight to DAC hold register R32_DAC_R12BDHR2. Some code writes it to 0x96, writing 0x01 e.g. breaks reading voltages with cmd 0x33 but with 0x00 it still works.
xx bits 0 and 1 enables VCC on ISP-connector J13/J14.
zz is VCC voltage 01 to 3F. 00 means don't set VCC. Default is 15.

voltagemap_vcc[64]={  0.0, 1.74, 1.83, 1.89, 2.00, 2.07, 2.18, 2.23,
                     2.32, 2.41, 2.45, 2.56, 2.65, 2.73, 2.79, 2.90,
                     3.02, 3.08, 3.16, 3.28, 3.33, 3.42, 3.48, 3.57,
                     3.65, 3.75, 3.84, 3.89, 3.97, 4.08, 4.16, 4.23,
                     4.31, 4.40, 4.48, 4.55, 4.65, 4.71, 4.80, 4.88,
                     4.97, 5.05, 5.14, 5.18, 5.29, 5.37, 5.45, 5.54,
                     5.64, 5.76, 5.81, 5.91, 5.99, 6.06, 6.18, 6.23,
                     6.33, 6.37, 6.45, 6.54, 6.62, 6.72, 6.80, 6.86 };

0x2F SET_VPP_PIN (and vpp and vccio voltage) (t48)

send 2f 00 00 00  00 00 00 00  aa bb 00 00  xx 00 00 00

Set which pins are VPP in aa bb according to vpp pin map, lsb of aa first:

vppmap = 
[ 31,30,10,9,4,3,2,1,32,33,34,36,37,38,39,40]

xx is 00 or 01 where 01 enables VPP on ISP-connector J1.

send 2f 01 00 00  00 00 00 00  xx 00 00 00 

Sets vpp voltage xx 00 to 3f from 9.31 to 25.16 volts, ca 0.25V per step. Default is 07.

voltagemap_vpp[64]={  9.31,  9.56,  9.83, 10.11, 10.32, 10.60, 10.87, 11.14,
                     11.32, 11.61, 11.86, 12.15, 12.35, 12.63, 12.90, 13.18,
                     13.35, 13.62, 13.88, 14.16, 14.38, 14.66, 14.92, 15.19,
                     15.39, 15.65, 15.93, 16.19, 16.43, 16.70, 16.95, 17.23,
                     17.22, 17.48, 17.76, 18.04, 18.26, 18.53, 18.80, 19.07,
                     19.25, 19.52, 19.80, 20.07, 20.30, 20.56, 20.85, 21.10,
                     21.27, 21.56, 21.82, 22.10, 22.31, 22.59, 22.86, 23.13,
                     23.32, 23.58, 23.86, 24.13, 24.37, 24.63, 24.90, 25.16 };

send 2f 02 00 00  00 00 00 00  xx 00 00 00

Sets vccio voltage 00 to 04, default is 03.

voltagemap_vccio[5]={ 2.35, 2.47, 2.93, 3.23, 3.45 };

0x30 SET_GND_PIN (t48)

send 30 00 00 00  00 00 00 00  aa bb cc dd  00 00 00 00  xx 00 00 00

Set which pins are gnd in aa bb cc dd according to gnd pin map, lsb of aa first:

gndmap = 
[8,7,6,5,4,3,2,1,16,15,14,13,12,11,10,9,32,31,30,29,27,25,20,18,40,39,38,37,36,35,34,33]

xx bits 0 through 2 enable EGND on J6/J8/J16 on ISP-connector.

0x31 SET_PULLUPS (t48)

send 31 00 00 00 00 00 00 00 

Enable pull up for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

0x32 SET_PULLDOWNS (t48)

send 32 00 00 00 00 00 00 00 

Enable pull down for all pins and set all pins to input. Any pins assigned to VPP/VCC/GND are unchanged.

0x33 MEASURE_VOLTAGES (t48)

send 33 00 00 00 00 00 00 00
recv 33 00 00 00  00 00 00 00  pp pp pp pp  uu uu uu uu  vv vv vv vv  ii ii ii ii

Measures voltages.
pp is vpp voltage.vpp = (pp*0xf78/0x1000)/100.0
uu is usb voltage. vusb = (uu*0xccf6/0x27000)/100.0
vv is vcc voltage. vcc = ((vv*0xb32e/0x27000)-0x14)/100.0
ii is vccio voltage. vccio = (ii*0x294/0x1000)/100.0

0x35 READ_PINS (t48)

send 35 00 00 00 00 00 00 00
recv 35 00 00 00 00 00 00 00 aa bb cc dd ee ff gg 00

Reads pins and returns bits for all 56 pins on aa bb cc dd ee ff gg
first pin is lsb of aa. ff and gg correspond to the ISP with J1 being the LSB of ff.
Note: J12, J14 and J16 always read as 0: they are not connected to separate I/O pins.
J12 is internally connected to ZIF pin 21.

0x36 SET_OUT (t48)

send 36 xx 00 00 ii 00 00 00

Sets pin ii to value xx (00 or 01) AND sets the pin to output push-pull 50 MHz.
xx values 0 through 39 (decimal) correspond to pins 1 through 40 of the ZIF.
xx values 40 through 56 (decimal) correspond to J1 through J16 of the ISP.
Attempting to set J12, J14 or J16 has no effect.

0x3E PIN_DETECT

send 3E 00 aa bb 00 00 00 00
recv  3E 00 aa bb 00 00 00 00 b0 b1 b2 b3 b4 b5 b6 00

aa bb : chip ID
b0 : ZIF8-ZIF1
b1 : ZIF16-ZIF9
b2 : ZIF24-ZIF17
b3 : ZIF32-ZIF25
b4 : ZIF40-ZIF33
b5 : ISP8-ISP1
b6: ISP16-SIP9