P89C669FA boot vector

[John]

Hello Friends,

I am cross posting this, from the 8052.com site, after not getting a quick reply.

I have implemented Erik's back door for P89C51RD2BN a few weeks ago and it works neatly, I should have done this months ago and saved a lot of headaches!

I am now trying to implement it for the P89C669FA which is slightly different.

I have pasted the following from the Philips user manual for the 89C669:

PROGRAM SPECIAL CELL
Input Parameters:

R1 = 06h

EPL = 00h = program status byte
01h = program boot vector 0
02h = program boot vector 1
03h = reserved
04h = program config

ACC = byte to program


Could someone please tell me which is the BVH (boot vector high) and which is the BVM (boot vector middle),that is whether boot vector 0 (01h) is BVH or BVM.


Regards,
John.

[erikm]

John,

I make NoTouch and 'the backdoor' as I need them and then publish them as a public service.  I am sorry, but I do not have the time (or test setup) to do it for devices I do not use.  Try working through it on your own and, when it works, publish it here.

Erik

[John]

Erik,
I tried for a couple of days before posting on the the 8052 forum, hoping that some one would have already done that.

After a lot of downloading from the Philips site ( they have different versions with the same application note number AN461 and different extensions) I have concluded that :

BVM (boot vector middle byte) = 01h = program boot vector 0 = FC  
BVH (boot vector high byte)=02h = program boot vector 1 = 00

Although I would like this to be confirmed by someone who has already programed  this device.

Regards,
John.

[Andy Ayre]

Here is the routine from our free 669 IAP library (you can get it in the technical library section) that programms the boot vector. Passed is an unsigned int corresponding to the 16-bit boot vector (so you have high and low bytes combined).

; **********************************************************************
; function:    iap_program_boot_vector
; prototype:   void iap_program_boot_vector(unsigned int boot_vector);
; description: programs the boot vector
; returns zero for success, non-zero for failure
; **********************************************************************
        RSEG  ?PR?_iap_program_boot_vector?P669IAPLIB
_iap_program_boot_vector:
        PUSH    IE                       ; disable interrupts
        CLR     EA
        MOV     A,CMOD
        MOV     R2,A                     ; store copy of CMOD
        JNB     ACC.6,?IAPTAG18          ; if watchdog enabled then disable
        ANL     CMOD,#0BFH
?IAPTAG18:
        ORL     AUXR1,#020H              ; enable bootrom
        MOV     R1,#06H
   MOV     EPL,#01H
        MOV     A,R7                     ; new value to program
        LCALL   00FFF0H                  ; call iap routine
        MOV     R1,#06H
   MOV     EPL,#02H
        MOV     A,R6                     ; new value to program
        LCALL   00FFF0H                  ; call iap routine
        MOV     R7,A                     ; result returned in R7
        ANL     AUXR1,#0DFH              ; disable bootrom
        MOV     CMOD,R2                  ; restore CMOD (restore watchdog state)
        POP     IE                       ; restore interrupts to initial state
        ERET    
; end of iap_program_boot_vector

[John]

Thank you very much Andrew,

I had actually gone through your code earlier, and the above piece of code is called from a 'C' function, where the parameters are passed through R7 and R6, but I what to know which (whether BVH or BVM ) is passed through which register R7 or R6, that is,  in the below code cut from your above code:

MOV R1,#06H
MOV EPL,#01H
MOV A,R7 ; new value to program
LCALL 00FFF0H ; call iap routine
MOV R1,#06H
MOV EPL,#02H
MOV A,R6 ; new value to program


MOV A,R7 ; new value to program  - is this BVH or BVM ??


I am trying to put this piece of code in the Startup.a51 file as a back door for the P89C669FA chip and not calling this code from 'C'

Regards,
John.

[Andy Ayre]

That code is written for the Keil and Raisonance compilers, which have the same parameter passing conventions. In the Keil C51 manual they are listed and arranged as follows:

MSB in R6
LSB in R7

so R6 = BVH, R7 = BVL

[John]

Thanks once again Andrew,

"so R6 = BVH, R7 = BVL"

Did you mean R7=BVM ??

Remember this the P89C669FA we are discussing, where the BVL is assumed to be 00.

Regards,
John.

[Andy Ayre]

Sorry, yes. R7 = BVM.

[John]

Thanks a lot, you have cleared my doubts on the BVH and BVM!

According to Philips BVH=00; BVM=FC; and BVM=00; does this mean that the boot vector for the P89C669FA is 0x00FC00; (000FC00H) which means the following:

LJMP 000FC00 ; should jump to the boot vector

this does not seem to work.

if

LCALL 00FFF0H ; call iap routine

is correct, then I think the boot vector should be 00FFFCH;

I am still confused,

John.

[Andy Ayre]

The Boot Vector points to the entry point for ISP. So after reset, if the conditions are met, the Program Counter is set to the Boot Vector.

IAP requires different routines and therefore has a different entry point somewhere inside the bootloader code.

[John]

Thanks for all the help Andrew,

I finally got it, the boot vector is 0x00FC00;

I had not enabled the boot flash before jumping to this location.

Now my code works.

Thanks once again.

Regards,
John.