Kernal serial protocol:

All data is sent in 8-bit binary format:

SFR transactions:
-----------------
Reading and writing SFR's is done as simply and as quickly as possible
to insure that EMILY will operate as fast as possible when using hardware
emulation mode (read/write SFR's on the target system). Each transaction
requires only two bytes to be transferred.

SFR's are read by sending the SFR address (80-FF) to the kernal as a
single byte, and receiving a byte sent back. For example, to read P0,
send $80, and wait for a single data byte to be returned.

SFR's are written by sending the SFR address with the high bit zeroed
(00-7F) to the kernal, followed immediately by the data value to write.
For example, to write $55 to P0, send $00, $55. No response is generated
by the kernal (other than to write the SFR).

Emulator commands:
------------------
The main emulator commands are implemented by using SFR addresses $E0-$E6,
which correspond to the accumulator (ACC). Since the ACC is maintained
on the PC by EMILY52, and uploaded/downloaded to/from the PC when the
kernal is active while debugging with MONICA52, we can be assured that
these SFR addresses will never be required for actual SFR transactions.

The implemented emulator commands are:

SET BREAKPOINT: E0 <addrL> <addrH>

 This command sets a breakpoint at the given address (addrH:addrL), by
 stuffing in a long CALL to the kernal breakpoint handler. NOTE that this
 command DOES NOT preserve the content of the memory at this address. Prior
 to setting a breakpoint, the program using this function should use the
 READ PROGRAM MEMORY function to save the contents of three bytes of memory
 starting at this address.

 When a breakpoint is encountered, the kernal sends the flag bytes $A5,$5A,
 $99 followed by 40 bytes of data, containing (in this order): PSW, ACC, B,
 PCH, PCL, DPH, DPL, SP, and the contents of internal memory from [00-1F].
 After receiving and storing this data, the program controlling the kernal
 should use the WRITE PROGRAM MEMORY function to restore the contents of
 active breakpoints. NOTE that the PC (PCH:PCL) value returned at a break-
 point is the address of the first instruction AFTER the LCALL inserted by
 the E0 command. 

GO: E1 <[00-1F]> <SP> <PCL> <PCH> <A> <B> <DPL> <DPH> <PSW>

 This command begins execution of the 8051 program memory. A total of 40
 bytes must be sent after the $E1 command, including the contents of
 internal memory from $00-$1F (this is 32 bytes and includes all four R0-7
 register banks), the SP, PC, ACC, B, DPTR and PSW registers. Immediately
 after receiving the PSW, the program begins execution at the PC (PCH:PCL)
 address.

STEP: E2 <[00-1F]> <SP> <PCL> <PCH> <A> <B> <DPL> <DPH> <PSW>

 This command executes a single 8051 instruction. It accepts the same
 40 bytes of data as the GO (E1) command, then executes a single 8051
 instruction at the PC (PCH:PCL) address. After the instruction has
 completed, the flags $A5,$5A,$99 are sent, followed by the 40 bytes
 of data as described under the SET BREAKPOINT (E0) command.

READ INTERNAL: 60 <length> <addess>

 This command reads and transmits <length> bytes of internal memory
 beginning at the specified <address>.

WRITE INTERNAL: 61 <length> <address> <data ...>

 This commands reads <length> data bytes from the serial port and
 stores them in internal memory beginning at the specified <address>.

READ EXTERNAL: 62 <length> <adrL> <adrH>

 This command reads and transmits <length> bytes of external DATA
 memory beginning at the specified address (adrH:adrL).

WRITE EXTERNAL: 63 <length> <adrL> <adrH> <data ...>

 This commands reads <length> data bytes from the serial port and
 stores them in external DATA memory beginning at the specified
 address (adrH:adrL).

READ PROGRAM: 64 <length> <adrL> <adrH>

 This command reads and transmits <length> bytes of program CODE
 memory beginning at the specified address (adrH:adrL).

WRITE PROGRAM: 65 <length> <adrL> <adrH> <data ...>

 This commands reads <length> data bytes from the serial port and
 stores them in program CODE memory beginning at the specified
 address (adrH:adrL).

 NOTE: In the standard release of the kernal this is the same as the
 WRITE EXTERNAL command, and the actual DATA/CODE selection is done
 via the DTR line from the PC, however a separate command code is used
 in order to allow the kernal to be modified to perform such switching
 under control of the 8051.

SETUP DS5000: 66 <value>

 This command performs a timed-access write to the DS5000 MCON control
 register, which allows memory re-mapping under control of the kernal
 when this type of processor device is used (See MONICA52 documentation).

INITIALIZE: FE

 This command resets all SFR's to their default values, and transmits
 an ID byte ($55). It is used by EMILY52 and MONICA52 to reset and
 identify the presence of the kernal.

IDLE: FF

 This command byte is thrown away by the kernal, and ignored. It is
 used by the emulator to clear out any pending commands, and insure
 that the kernal is in a known state (awaiting a command).
