ufpb_commands: Universal Flash Programming Board Commands

This file describes the protocol between a host and a ufpb.
The information here was gathered by listening to 
FlashSIMPLE talking to the ufpb.
The UPB1_cmd.PDF document from hitachi clarified a bit,
but does not fully document the protocol.
BTW: The processor mounted on the ufpb is a h8/3217.

request: Host asks the ufpb.
reply:   The ufpb answers the host.

request format: 0xaa 0x0t 0xnn { request-data } 0x55
reply format:   0xet { reply-data } 0x00


request - detailed description

0xaa: start of command
0x0t: type: 0x00 = initialize
                   request-data = { } (none)
                   reply-data = { 0x00 }
	    0x01 = get_status
            0x02 = reset
                   request-data = { } (none)
                   reply-data = { 0x00 }
            0x03 = enable 12V
                   request-data = { 0x00 }
                   reply-data = { 0x00 }
            0x04 = enable vpp
                   request-data = { 0x00 }
                   reply-data = { 0x00 }
            0x05 = enable mdx
                   request-data = { 0x00 }
                   reply-data = { 0x00 }
            0x06 = boot fztat
                   request-data = { } (none)
                   reply-data = { 0x01, 0xb3 }
            0x07 = download ukernel
                   request-data = { 0x00, 0x00, <size-hi8>, <size-lo8> }
                   reply-data = { 0x02, 0x44 <data transfer> 0x4b }
            0x08 = transparent
                   request-data = { } (none)
                   reply-data = { 0x00 }
            0x09 = set bps 
                   115200: request-data = { 0x00, 0x07, 0x01, 0x00, 0x00 }
                           reply-data = { 0x02, 0x55 } + { 0x59 }
                   9600:   request-data = { 0x00, 0x03, 0x01, 0x00, 0x00 }
                           reply-data = { 0x02, 0x55  } + { 0x59 }
                   9600x:  request-data = { 0x01, 0x03, 0x01, 0x00, 0x00 }
                           reply-data = { 0x01, 0x56, 0x00 }
             0x0a = read byte
		    request-data = { <address-hi8>, <address-lo8> }
                    reply-data = { 0x01, <data> }

                    FlashSIMPLE seems to read address 0x00ff and 0x00fe
                    to figure out the version. ([0x00ff] = 0x03, [0x00fe] = 0)
                    Register at 0xffe4 is also read. ([0xffe4] = 0x84)
             0x0b = write data: ???
		    enable mdy / negotiate interface / pmodex
                    enable_mdy: request-data = { 0xff, 0xb3, 0xdf, 0x01 } 
                                reply-data = { 0x01, 0x00 }
                    neg_if:     request-data = { 0xff, 0x7e, 0x00, 0x00 } 
                                reply-data = { 0x01, 0x00 }
                    pmode2:     request-data = { 0xff, 0xe3, 0x55, 0x00 } 
                                reply-data = { 0x01, 0x55 }
                    pmode3:     request-data = { 0xff, 0xe4, 0x04, 0x00 } 
                                reply-data = { 0x01, 0x80 }
             0x0e = reset low
                    request-data = { } (none)
                    reply-data = { 0x00 }
             0x0f = reset high
                    request-data = { } (none)
                    reply-data = { 0x00 }


0xet
 NN: number of data bytes
 55: end of command


