Description of the SAM-BA USB Bootloader Protocol for AT91SAM7S Chip

The SAM-BA software is described on the AT91 site. Unfortunately, the protocol of the boot loader is not documented.

This is a result of the analysis of a protocol trace with a naked eye. I have used the HHD Software USB Monitor to obtain the trace. Many thanks to Vadim Sinitsyn for filling in the blanks.

All exchange is going through bulk endpoint 1. All non-data command frames are #-terminated ASCII strings. Transfer to device is designated with >, transfer from device - with <. LFCR indicates a hex sequence 0A 0D. Bold characters are ASCII literals; italics indicate hexadecimal digits.

Direction String Comment
> N# Initialization
< LFCR Initialization response
> WADDRESS0,VALUE000# Word (32-bit) write
> wADDRESS0,4# Word (32-bit) read; 4 indicates the length of data in bytes; data are shipped in the next frame from the device
> HADDRESS0,VALU# Halfword write
> hADDRESS0,2# Halfword read, 2 indicates the length of data in bytes; data are shipped in the next frame from the device
> OADDRESS0,VA# Byte (octet?) write
> oADDRESS0,1# Byte (octet?) read, 1 indicates the length of data in bytes; data are shipped in the next frame from the device
> SADDRESS0,LENGTH00# Send data to device; actual data are in the next frame
> GADDRESS0# Execute a program
> RADDRESS0,LENGTH00# Read data from device; actual data are sent in the next frame