pureboot: the classic megas and the word-addressed 1284P groundwork

Device: boot-section detection probes SPMCR beside SPMCSR, the link
picks any hardware USART through the instance-aware lookups (URSEL
chips included), WDRF reads MCUSR-or-MCUCSR, and the >64 KiB shape
lands — word-addressed wire flash (info flag bit 1, page byte 0 means
256, base as a word address), far reads through flash_load_far, a
single 32-bit byte-cursor page walk (the 256-byte page wraps its low
byte exactly), and slot arithmetic in words (the return address
already is one). Host: addresses stay bytes internally and scale at
the wire, the boot-fuse decode becomes a per-signature table (byte
index + BOOTSZ ladder — the m168A's lives in EXTENDED), and the
planner tests pin every chip's ladder plus the word-addressed info
decode. Tests: the device runner serves every mega over the USART pty,
pbapp banners over the right link, the update rehearsal synthesizes
its assumed fuses from the tool's own table, and the PI lint tracks
the renamed info symbol. All six classic-mega/168A targets pass the
full suite (size, PI, planner, protocol, reloc, self-update) at
466–504 B; the 1284P builds await a libavr far-path slimming to make
its 512.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pureboot/README.md

@@ -23,7 +23,7 @@ trampoline (below).
 
 | Chip | Serial | Baud | Clock assumed |
 |---|---|---|---|
-| ATmega328P | USART0, RXD/TXD = PD0/PD1 | 115200 8N1 | 16 MHz crystal |
+| every ATmega (8/8A, 16, 32/32A, 168A, 328P, 1284P) | the hardware USART (USART0), RXD/TXD per pinout | 115200 8N1 | 16 MHz crystal |
 | ATtiny85 | software UART, RX = PB0, TX = PB1 | 57600 8N1 | 8 MHz internal RC |
 | ATtiny13A | software UART, RX = PB0, TX = PB1 | 57600 8N1 | 9.6 MHz internal RC |
 
@@ -55,6 +55,10 @@ write to finish and sends the prompt `+` (0x2b) — the prompt is therefore
 also the completion ack of the previous command. A session is: await `+`,
 send a command, read its reply, repeat.
 
+On chips whose flash exceeds 64 KiB (the 1284P — info-block flag bit 1) the
+`R`/`W` flash addresses are **word** addresses; everywhere else they are byte
+addresses. EEPROM addresses are always bytes, counts always bytes.
+
 | Cmd | Arguments | Reply |
 |---|---|---|
 | `b` | — | the 12-byte info block |
@@ -88,18 +92,29 @@ The info block (`b`):
 |---|---|
 | 0–2 | `'P'`, `'B'`, protocol version (1) |
 | 3–5 | device signature |
-| 6 | SPM page size in bytes |
-| 7–8 | loader base — application flash ends here |
+| 6 | SPM page size in bytes (0 means 256) |
+| 7–8 | loader base — application flash ends here (a word address when bit 1 is set) |
 | 9–10 | EEPROM size |
-| 11 | bit 0 set: host must patch the reset vector (no hardware boot section) |
+| 11 | bit 0: host must patch the reset vector (no hardware boot section); bit 1: flash wire addresses are word addresses |
 
 Composites are the host's job: verify = read back and compare, erase =
 write `0xff` (per page for flash, per byte for EEPROM).
 
 ## Deployment
 
-**ATmega328P**: program the loader at 0x7e00 with an external programmer.
-Two fuse profiles, same binary:
+**Megas**: program the loader at `flash − 512` with an external programmer.
+Every mega's smallest-but-one BOOTSZ puts the boot-section start exactly at
+the loader base (512 B — the m8/16/168A reach it at their second-smallest
+step, the m32/328P at their smallest), so the ATmega328P profiles below
+apply to all of them with their own addresses; the per-chip BOOTSZ ladders
+live in the host tool (`BOOT_FUSE`). The **ATmega1284P** is the exception:
+its smallest boot section is 1 KB, so the standalone profile does not exist
+— BOOTSZ = 512 words always, and with BOOTRST programmed reset lands at
+0x1f800, one erased slot below the loader (the loader-first walk behavior
+below, built in). Its staging slot sits inside that same 1 KB section, so
+self-update needs no fuse change.
+
+ATmega328P profiles (addresses for its 32 KiB):
 
 | BOOTSZ | BOOTRST | Behavior |
 |---|---|---|