--- a/bootrom.notes	Thu Apr 25 04:07:10 2013 +0000
+++ b/bootrom.notes	Thu Apr 25 05:47:59 2013 +0000
@@ -58,6 +58,12 @@
 
 <c
 
+Checksum verification command.  The <c characters need to be followed by a
+single binary byte, which need to equal the one's complement of the low byte
+of the 800528 accumulator.
+
+Response: >c if good, >C if bad.  Both are followed by the low byte of 800528.
+
 <i
 
 Calls the 0x11c routine, then responds with '>i'.
@@ -101,9 +107,13 @@
 	4 bytes: load address for this block (MSB first)
 	data
 
-for a single block (both bytes after <w set to 01), the maximum allowed
+For a single block (both bytes after <w set to 01), the maximum allowed
 payload length is 1015 (0x3F7) bytes.
 
+No alignment required on the address or length - the copying from the
+intermediate buffer at 80010C to the specified load address is done
+with a loop that does one byte at a time with ldrb and strb instructions.
+
 The checksum of each block is computed as a simple ripple-carry sum
 (in a 32-bit ARM register) of:
 	+ the word-sized payload byte count from the command
@@ -136,7 +146,8 @@
 	state variable for the serial command interface
 	in the initial state of 01, only <i and <p are accepted
 	state 02: after successful <p, <w is allowed
-	state 03: after first successful <w?
+	state 03: after first successful <w, and subsequent successful <w's
+	state 04: after <c with matching checksum
 80010C: all bytes of a '<w' command after these two command chars
 	are stored starting here
 	this buffer is also used for other scratchpad functions: <p
@@ -168,7 +179,7 @@
 	checksum accum?
 
 80052C:	32-bit var init to 0 by 0x11c ('<i' handler)
-	word holds the argument of the '<b' command
+	word holds the argument of the '<b' command, i.e., the branch address
 800530: byte indicates validity of the received '<w' command:
 	0 means valid, 1 means something bad
 	init to 0 by 0x11c