Determining Baud Rate of Data

[mojobojo]

I procured a printer that no longer printed (Lexmark Pro 805). Interested in the insides I decided to strip it down to its motherboard and muck around with it. Near the JTAG points I came across what seems to be a serial transmit pad. I hooked it up to a serial to USB converter, tried all the baud rates I could think of, also tried a few uncommon combinations, nothing seemed to work so I hooked up my saleae logic analyzer and captured it. After messing around an hour or two trying to figure it out I kinda ran out of ideas. I think its either a bizarre baud rate or its not serial at all.

The session file is right here if somebody could maybe take a look and try to help me figure this out. I am fairly new to this. My other option was trying to find it in the firmware files.
https://www.dropbox.com/s/5fiqjsync0myepd/printer.logicdata

Screenshot, just because.

[JoeyP]

It doesn't look like async data. It's probably SPI or similar. There's probably a clock signal around there somewhere that goes with it.

[mojobojo]

It doesn't look like async data. It's probably SPI or similar. There's probably a clock signal around there somewhere that goes with it.

I see, I will poke around the board some more when I get up tomorrow and see what I can find. The pad connects to a 25l6405dmi-126, upon googling said chip I could not find a datasheet, but apparently leads me to the DD-WRT forum which is a site for hacking wireless modems, that may be a place I need to look some more at.

[AndreasF]

I think the "6" in "...-126" is actually a "G" in which case this is a serial Flash chip with what looks to be an SPI interface.

http://www.ebay.com/itm/1-MX25L6405-25L6405DMI-12G-25L6405-64M-BIT-IC-A98-/180652487295

[amyk]

MX25L6405 64Mbit SPI flash.

If you're interested in further investigation, it might be fun to dump the flash and inspect its contents.

[mojobojo]

MX25L6405 64Mbit SPI flash.

If you're interested in further investigation, it might be fun to dump the flash and inspect its contents.

Ah thank you. I am going to hack around with it today, like I said this is new to me but I will post my progress. I am interested in repurposing this printer board, every other part of the printer was deemed unrepairable when I opened it up to fix it and found that the printhead had leaked ink onto everything. I found after looking at the firmware images that it is running a version of 2.6.18.5 linux running on an ARM processor and it actually uses flash to display its images.

EDIT: Did another go around connected to all the right pins.

https://www.dropbox.com/s/ux3b7vr2izzuink/printer2.zip

Another cap at slower speeds
https://www.dropbox.com/s/zg1rmebxb2i7xp7/printer3.zip

[mojobojo]

Wired up an Arduino to the SPI. Wrote up a bit of code to read the chip ID however I am getting a different ID than what the datasheet says I should be getting 3 bytes C2 20 17 but instead am getting 40 00 03. I am going to tinker around with this a bit more.

EDIT: I cannot get any speed or consistency out of reading. I assume the speed issue is do to me printing the data out through the serial, but after a few small dumps compared its showing them as different in some places, my wiring is secure so I am unsure

Code so far.

Code: [Select]

// MX25L6405 SPI
// Datasheet http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/$defaultview/3F21BAC2E121E17848257639003A3146/$File/MX25L6405,%203V,%2064Mb,%20v1.3.pdf?OpenElement
// Some code from http://arduino.cc/en/Tutorial/SPIEEPROM

// Pin Definitions
#define DATAOUT 11//MOSI
#define DATAIN 12//MISO
#define SPICLOCK 13//sck
#define SLAVESELECT 10//ss

// Command Definitions
#define WREN 0x06 // Sets the (WEL) write enable latch bit
#define WRDI 0x04 // Reset the (WEL) write enable latch bit
#define RDID 0x9F // Output the manufacturer ID and 2-byte device ID (outputs 3 bytes)
#define RDSR 0x05 // To read out the status register (outputs 1 byte)
#define WRSR 0x01 // To write new values to the status register
#define READ 0x03 // N bytes read out until CS# goes high (requires input address of 3 bytes) (outputs ? bytes)
#define FAST_READ 0x0B // (requires input address of 3 bytes, optional fourth?) (outputs ? bytes)
#define PARALLEL_MODE 0x55 // Enter and stay in parallel mode until power off
#define SE 0x20 // Sector erase (input 3 bytes address)
#define SE_ALT 0xD8
#define CE 0x60 // Chip erase
#define CE_ALT 0xC7
#define PP 0x02 // Page Program (input 3 byte address)
#define DP 0xB9 // Deep Power Down
#define EN4K 0xB5 // Enter 4Kb sector
#define EX4K 0xB5 // Exit 4Kb sector
#define RDP 0xAB // Release from deep power down
#define RES 0xAB // Read electronic id (optional 3 byte input?)
#define REMS 0x90 // Read electronic manufacturer & device id (2 byte optional? third byte if 0 will
                   // output manufacturer id first, 1 will output device id first)


char fmt[16]; // Some place to sprintf into
byte eeprom_output_data = 0;
byte eeprom_input_data = 0;
byte clr = 0;

byte spi_transfer(volatile byte data)
{
  SPDR = data;                    // Start the transmission
  while (!(SPSR & (1 << SPIF)))   // Wait the end of the transmission
  {
  };
  return SPDR;                    // return the received byte
}

void setup()
{
  Serial.begin(9600);

  pinMode(DATAOUT     , OUTPUT);
  pinMode(DATAIN      , INPUT);
  pinMode(SPICLOCK    , OUTPUT);
  pinMode(SLAVESELECT , OUTPUT);
 
  // Data sheet says this must be high
  digitalWrite(SLAVESELECT, HIGH);
 
  // SPCR = 01010000
  //interrupt disabled, spi enabled, msb 1st, master, clk low when idle,
  //sample on leading edge of clk, system clock/4 rate (fastest)
  SPCR = (1 << SPE)|(1 << MSTR);
  clr = SPSR;
  clr = SPDR;

  delay(1000);
}

void ReadID() {
  digitalWrite(SLAVESELECT, LOW);
  spi_transfer(RDID);
 
  int b1 = spi_transfer(0xFF);
  int b2 = spi_transfer(0xFF);
  int b3 = spi_transfer(0xFF);
 
  digitalWrite(SLAVESELECT, HIGH);
 
  sprintf(fmt, "%02X %02X %02X\n", b1, b2, b3);
  Serial.print(fmt);
}

void ReadElectronicId() {
  digitalWrite(SLAVESELECT, LOW);
  spi_transfer(RES);
 
  spi_transfer(0x00);
  spi_transfer(0x00);
  spi_transfer(0x00);
 
  int b1 = spi_transfer(0xFF);
 
  digitalWrite(SLAVESELECT, HIGH);
 
  sprintf(fmt, "%02X\n", b1);
  Serial.print(fmt);
}

void ReadManufactureId() {
  digitalWrite(SLAVESELECT, LOW);
  spi_transfer(REMS);
 
  spi_transfer(0x00);
  spi_transfer(0x00);
  spi_transfer(0x00);
 
  int b1 = spi_transfer(0xFF);
  int b2 = spi_transfer(0xFF);
  int b3 = spi_transfer(0xFF);
 
  digitalWrite(SLAVESELECT, HIGH);
 
  sprintf(fmt, "%02X %02X %02X\n", b1, b2, b3);
  Serial.print(fmt);
}

void ReadStatusReg() {
  digitalWrite(SLAVESELECT, LOW);
  spi_transfer(RDSR);
 
  int b1 = spi_transfer(0xFF);
 
  digitalWrite(SLAVESELECT, HIGH);
 
  sprintf(fmt, "%02X\n", b1);
  Serial.print(fmt);
}

void Dump() {
  int data;
  digitalWrite(SLAVESELECT, LOW);
  spi_transfer(READ); // Address auto increments so only need to do a read instruction once
 
  // Address 0x000000
  spi_transfer(0x00);
  spi_transfer(0x00);
  spi_transfer(0x00);
 
  for (int i = 0, x = 0; i < 0xFFFF; i++, x++) {
    if (x >= 16) {
      Serial.print('\n');
      x = 0;
    }
   
    sprintf(fmt, "%02X ", spi_transfer(0xFF));
    Serial.print(fmt);
  }
 
  digitalWrite(SLAVESELECT, HIGH);
}

void loop()
{
  //ReadID(); // RDID
  //ReadElectronicId(); // RES
  //ReadManufactureId(); // REMS
  Dump();
 
  while (1) {
    delay(1000);
  }
}