ROM
Introduction
Overview
Definition of Terms
Term |
Definition |
CRC |
Cyclic Redundancy Check |
IMAGE |
Binary File |
MAC |
Medium Access Control |
QFLASH |
Quad-SPI Flash |
RAM |
Read-Write Memory |
ROM |
Read-Only Memory |
SECBOOT |
Second Boot |
UART |
Universal asynchronous receiver-transmitter |
Literature Index
Basic functions of ROM
ROM flowchart
figure 2-1
Bootloader program
QFLASH self-test
Complete QFLASH work status check
QFLASH mode switching
After ROM startup, QFLASH defaults to 1-wire mode. To enable the program to run on QFLASH, ROM needs to switch QFLASH to 4-wire mode.
IMAGE verification
Complete IMAGE header verification and IMAGE content verification
Vector table redirection
The redirection address rule: (exception vector+interrupt) There are a total of 64 words, and according to the VBR register requirements, the vector table address must be an integer multiple of 0x400.
Upgrade Program
Using the Xmodem protocol to upgrade IMAGE to QFLASH or memory area, the upgraded Image will jump to memory execution after the upgrade is completed, and the upgraded FLASH will need to be restarted before jumping to execution.
Upgrade IMAGE format:
figure 2-2
The ROM program determines whether the img_type of the first header is sec boot based on the upgrade_area_addr parameter. If it is, it verifies the CRC and signature of the header and image, compares the version number, and if the verification passes and the version is updated, it moves the header to the address of img_header_addr and the image and signature to the address of img_addr.
The ROM program finds the img header of the SECBOOT program based on the img_header_addr parameter. After successfully verifying the CRC and signature of the img header and image, it jumps to img_addr to execute SECBOOT.
The SECBOOT program traverses the headers one by one according to the upgrade_area_addr parameter until it finds the img header of the img. It then moves the header to the address of next_img_addr and the image and signature to the address of img_addr, similar to the ROM program.
The upgrade area can support multiple img upgrades, including SECBOOT, by placing the programs to be upgraded end-to-end at the address of upgrade_area_addr.
For img with zip_type=1, the img part is the compressed result of the original img header, img, and signature. It is decompressed before moving. SECBOOT does not support compression.
OTP Parameter Area
Test Program
Operational Commands
Command List
Function |
Sub-Command |
Data Segment |
Description |
Baud rate switching |
0x31 |
≤2000000 |
Baud rate can be set up to 2M. Setting above 2M returns S (command parameter error) |
QFlash erase |
0x32 |
4bytes |
struct {
}; index: start position (index highest bit is 1 for block erase, 0 for sector erase) count: number of blocks to erase |
Set BT MAC address |
0x33 |
6bytes~8bytes |
|
Get BT MAC address |
0x34 |
None |
|
Set GAIN parameters |
0x35 |
84bytes |
Gain parameters used during Wi-Fi transmission ( |
Get GAIN parameters |
0x36 |
None |
Read the length set gain value. |
Set MAC address |
0x37 |
6bytes~8bytes |
|
Get MAC address |
0x38 |
None |
|
Get the last error |
0x3B |
None |
Get the last error information until the next operation clears it. |
Get QFLASH ID and capacity |
0x3C |
None |
For example, GD 32MB returns: FID:C8,19 PUYA 8MB returns: FID:85,17 |
Get ROM version |
0x3E |
None |
|
System reboot |
0x3F |
None |
Common Command Set
Baud Rate Change:
2M setting command: 21 0a 00 ef 2a 31 00 00 00 80 84 1e 00
1M setting command: 21 0a 00 5e 3d 31 00 00 00 40 42 0f 00
921600 setting command: 21 0a 00 5d 50 31 00 00 00 00 10 0e 00
460800 setting command: 21 0a 00 07 00 31 00 00 00 00 08 07 00
115200 setting command: 21 0a 00 97 4b 31 00 00 00 00 c2 01 00
Get BT MAC address: 21 06 00 D8 62 34 00 00 00
Get WiFi MAC address: 21 06 00 ea 2d 38 00 00 00
Get the last error: 21 06 00 36 B6 3B 00 00 00
Get QFLASH ID and capacity: 21 06 00 1b e7 3c 00 00 00
Get ROM version: 21 06 00 73 0a 3e 00 00 00
System reboot: 21 06 00 c7 7c 3f 00 00 00
QFlash erase (1M): 21 0a 00 e2 25 32 00 00 00 02 00 fe 00
QFlash erase (2M): 21 0a 00 c3 35 32 00 00 00 02 00 fe 01
ROM Error Codes
During the ROM startup process, if an exception is encountered, it will enter the dead loop program on the right side of the ROM, and then print an error code indicating the current error message encountered, for the user to analyze the problem encountered.
The definition of error codes is as follows:
Error codes |
Description |
|---|---|
C |
Normal |
Upgrade process (XMODEM protocol) |
|
D |
Host cancellation |
F |
No data received after timeout |
G |
Package number incorrect |
I |
IMAGE too large |
J |
IMAGE burning address is illegal |
K |
IMAGE page is not aligned |
L |
IMAGE head verification error |
M |
IMAGE content verification error |
P |
IMAGE incomplete or missing |
Start up process |
|
N |
FLASH ID self check failed |
Q |
Firmware type error |
L |
SECBOOT head verification error |
M |
SECBOOT verification error |
Y |
Decryption reading SECBOOT failed |
Z |
Signature verification failed |
Functional module |
|
R |
Command verification error |
S |
Command parameter error |
T |
Failed to obtain FT parameters |
U |
Failed to set gain |
V |
Setting MAC failed |