Author Topic: EEVblog #1144 - Padauk Programmer Reverse Engineering  (Read 55139 times)

0 Members and 4 Guests are viewing this topic.

Offline spth

  • Regular Contributor
  • *
  • Posts: 75
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #525 on: February 28, 2019, 10:36:49 am »
Evaluation boards (design on https://github.com/free-pdk/f-eval-boards), hand-soldered prototypes (well the PFS232 is not yet available from Padauk, so for that one Ihave the pcb only).

Left: PFS173
Middle: PFS154
Right: PFS232

One can't see it very well in the image, but the bottom header (for programming) has pin names below.
 
The following users thanked this post: js_12345678_55AA

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #526 on: February 28, 2019, 10:42:10 pm »
Evaluation boards (design on https://github.com/free-pdk/f-eval-boards), hand-soldered prototypes).

Nice timing. I just got PCB1.2 revision of Easy PDK Programmer and soldered a small batch. No problems found so far. Everything working as expected.

Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

I will upload all schematics + firmware + software right after I'm sure everything is working as expected.
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline ali_asadzadeh

  • Frequent Contributor
  • **
  • Posts: 853
  • Country: ir
    • ASiD Designer
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #527 on: March 01, 2019, 08:03:31 am »
Quote
Nice timing. I just got PCB1.2 revision of Easy PDK Programmer and soldered a small batch. No problems found so far. Everything working as expected.

Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

I will upload all schematics + firmware + software right after I'm sure everything is working as expected.
That's great, because Also I have ordered some PFS173-S14, I hope they become useful in my projects! Also I found it weird, I can not find these puppies from my other Chinese suppliers! I have at list tried 10 different suppliers, I only got them from lcsc :(
You can order parts from www.ASiDesigner.com
we are a wire-based company
 

Offline spth

  • Regular Contributor
  • *
  • Posts: 75
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #528 on: March 01, 2019, 10:38:32 am »
Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

Which Padauk devices are currently supported?

Philipp
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #529 on: March 01, 2019, 12:18:40 pm »
Firmware for the STM32 is almost complete (I think next weekend I can finish last part of calibration).
Initial host software is also working (command line utility which supports Linux/Mac/Windows for reading/writing/executing + serial output debugging).

Which Padauk devices are currently supported?

Philipp

The firmware for STM32 is generic and should support any IC.
All parameters are defined and sent from the host software.

I focused on testing everything with PFS154 but support for other ICs can be added easily.

Here an example of one entry of the IC definition table in host software:

static const FPDKICDATA fpdk_ic_table[] =
{
  { .name               = "PFS154",
    .otpid              = 0x2AA1,
    .type               = FPDK_IC_FLASH,
    .addressbits        = 13,
    .codebits           = 14,
    .codewords          = 0x800,
    .ramsize            = 64,
    .exclude_code_start = 0x7ED, //use 0xFFFF to disable
    .exclude_code_end   = 0x7F0, //use 0xFFFF to disable
    .vdd_cmd            = 3.0,
    .vpp_cmd            = 5.6,
    .vdd_write          = 5.8,
    .vpp_write          = 8.5,
    .vdd_erase          = 5.8,
    .vpp_erase          = 8.5,
    .default_ihrcr      = 0x80,
    .default_bgtr       = 0x5A,
  },
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #530 on: March 06, 2019, 03:03:15 pm »
Hi,

today I was very excited when I finally got the following output:

bash-3.2$ sdcc -mpdk14 hellopfs154noprintf.c


bash-3.2$ ./easypdkprog write hellopfs154noprintf.ihx --icname PFS154 --fuse 31FD
Erasing IC... done.
Writing IC... done.
Writing IC Fuse... done.


bash-3.2$ ./easypdkprog start
Running IC (5.00V)... IC started, press [Esc] to stop.
Hello World!
Hello World!
Hello World!
Hello World!


Explanation:
1. SDCC compiler development branch which supports PADAUK (MANY MANY thanks to SPTH and Nicolas Lesser) is used to compile a small test program

2. easypdkprog is used to send the compiled program to PFS154 sitting in a socket on top of the Easy PDK programmer

3. the PFS154 IC is started while still in the socket on top of the programmer. All serial output on PA.7 is captured and shown on the screen


So real development can start now  :)



I will cleanup the sources and release all of them on https://free-pdk.github.io during the next few days:
- Easy PDK programmer schematic and PCB design files
- STL files for 3D printable housing (housing not required)
- Easy PDK programmer firmware + source code
- easypdkprog source code

Right now only PFS154 is supported but other types will get added quickly now.

 :) :) :)


In case you are curious here the output of:

bash-3.2$ ./easypdkprog --help
Usage: easypdkprog [OPTION...] probe|read|write|erase|start [FILE]
easypdkprog -- read, write and execute programs on PADAUK microcontroller
https://free-pdk.github.io

  -b, --bin                  Binary file output. Default: ihex8
  -c, --calibrate            Calibrate IC after writing
  -f, --fuse=FUSE            FUSE value, e.g. 0x31FD
  -n, --icname=NAME          IC name, e.g. PFS154
      --noblankchk           Skip blank check before write
      --noerase              Skip erase before write
      --noverify             Skip verify after write
  -o, --otpid=ID             OTP ID, e.g. 0x2AA1
  -p, --port=PORT            COM port of programmer. Default: Auto search
  -r, --runvdd=VDD           VDD voltage for running IC (e.g. 3.3). Default: 5.0
  -v, --verbose              Verbose output
  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options.
« Last Edit: March 06, 2019, 03:06:51 pm by js_12345678_55AA »
Easy PDK programmer and more: https://free-pdk.github.io
 
The following users thanked this post: electronic_eel, thm_w, spth

Offline spth

  • Regular Contributor
  • *
  • Posts: 75
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #531 on: March 07, 2019, 10:21:26 am »
1. SDCC compiler development branch which supports PADAUK (MANY MANY thanks to SPTH and Nicolas Lesser) is used to compile a small test program

We've made quite some progress recently. It seems, there now is only one remaining bug to be fixed (related to arrays that are not const) to get the first of the SDCC regression tests (it tests abs() and labs() from the standard library) to pass.

I assume we can fix enough bugs to make four fifths or so of the tests pass sometime next week, which should be good enough to merge to trunk, so the pdk14 backend would make it into the next SDCC release (3.9.0).

Philipp
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #532 on: March 08, 2019, 03:28:16 pm »
Where can we download latest SDCC?

Right now you have to go to the "pdk" branch of sdcc in their svn, check it out and compile it.

https://sourceforge.net/p/sdcc/code/HEAD/tree/branches/pdk/

But remember, it is an experimental branch which might or might not work from day to day (lot of activity right now).

JS
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline piotr_go

  • Contributor
  • Posts: 7
  • Country: pl
    • My Projects
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #533 on: March 08, 2019, 07:10:45 pm »
Quote from: js_12345678_55AA
...check it out and compile it.
Thank You. It's working.
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #534 on: March 10, 2019, 11:34:22 pm »
Quote from: js_12345678_55AA
...check it out and compile it.
Thank You. It's working.

Do you plan to share your project / source / ... ?
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline piotr_go

  • Contributor
  • Posts: 7
  • Country: pl
    • My Projects
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #535 on: March 11, 2019, 12:12:59 pm »
https://github.com/piotr-go/PADAUK

PFS154-S08 POV display: :)

« Last Edit: March 11, 2019, 02:32:32 pm by piotr_go »
 
The following users thanked this post: thm_w, js_12345678_55AA

Offline spth

  • Regular Contributor
  • *
  • Posts: 75
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #536 on: March 12, 2019, 01:37:34 pm »
Yes really need the +1 for PCADD. Otherwise my program was jumping into nowhere, crashing (I think it adds 256 in the case of A=0, will need to investigate)

Any news on zero a?

Philipp
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #537 on: March 13, 2019, 12:10:37 am »
Yes really need the +1 for PCADD. Otherwise my program was jumping into nowhere, crashing (I think it adds 256 in the case of A=0, will need to investigate)

Any news on zero a?

Philipp

I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).

PCADD A   with A=0:

Possibility 1:
The IC will do the equation mentioned in reference manual: "PC <- PC + A" which results in an endless loop.

Possibility 2:
PC is incremented by 1 automatically after each instruction. So maybe IC is subtracting 1 from operand and then adds this to the already advanced PC.
In case A=0 this subtraction would result in 0xFF which is added to the advanced PC which would be same as "PCADD 0x100"
This would match the behavior I observed when I tried it with ICE (I found program execution somewhere in code memory after "pcadd 0")... but this also could be an ICE bug.

In order to try this we would need to create and run a small test assembly program like this:


TEST_PCADD:
MOV A,0
PCADD A
RET 0x01
RET 0x02
...
RET 0xFE
RET 0xFF
RET 0x00

MAIN:
CALL TEST_PCADD
==> A holds result
if 0 then is variant 2
if not coming back then variant 1
if anything else then ??


JS
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline ali_asadzadeh

  • Frequent Contributor
  • **
  • Posts: 853
  • Country: ir
    • ASiD Designer
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #538 on: March 13, 2019, 06:35:55 am »
Quote
I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).
Thanks, I have orders some of these ;) :-[
You can order parts from www.ASiDesigner.com
we are a wire-based company
 

Offline piotr_go

  • Contributor
  • Posts: 7
  • Country: pl
    • My Projects
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #539 on: March 14, 2019, 09:17:51 am »
Quote
I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).
I have similar results with my programmer.
Different write command?
 

Offline spth

  • Regular Contributor
  • *
  • Posts: 75
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #540 on: March 14, 2019, 05:50:57 pm »
The pdk branch of SDCC has been merged to trunk today. Further development will happen there.

From tomorrow, the nightly snapshots (http://sdcc.sourceforge.net/snap.php) should include support for pdk14 and pdk15.

The pdk14 port is working quite well now; while many regression tests had to be disabled ofr pdk14 due to lack of memory, the large number of tests passing still indicate that pdk14 is quite stable now:

Summary for 'pdk14': 10 failures, 2997 tests, 2101 test cases, 1463033 bytes, 17333727 ticks

Philipp
 
The following users thanked this post: js_12345678_55AA, notanick

Offline electronic_eel

  • Regular Contributor
  • *
  • Posts: 186
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #541 on: March 14, 2019, 10:12:16 pm »
Hi,

I will cleanup the sources and release all of them on https://free-pdk.github.io during the next few days:
- Easy PDK programmer schematic and PCB design files
Thanks for posting the hardware files of the programmer.

I was about to order the pcb and had a look at the Gerber_EASYPDKPROG_PCB12_Panel4x_NoSilk.zip file in a gerber viewer (gerbv from the gEDA project). I have attached a screenshot.

It looks like only one of the programmers is in the gerbers and not a panel of 4, 3 are empty. Also the plated slot for the usb connector looks just like a hole. So I'm a bit in doubt if these gerbers are correct. But there also might be some advanced gerber functions at play that gerbv doesn't understand.

Did you use these gerber files to order at JLCPCB or did you use a direct order link from easyeda into JLCPCB?
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #542 on: March 15, 2019, 12:06:57 pm »
Did you use these gerber files to order at JLCPCB or did you use a direct order link from easyeda into JLCPCB?

The exact same Gerber ZIP file was uploaded to JLCPCB using the upload Gerber function. The production went smoothly and the received PCB panels did not have any error (also the USB port fits nicely).

The multiple copy of the outline without having the same PCB inside is an industry standard for PCB factories used to indicate to panelize the PCB.


In case you plan to build the programmer please consider clicking on the AFFILIATE link when you start to order parts of the BOM on lcsc web site: LCSC.com

JS
« Last Edit: March 15, 2019, 12:12:35 pm by js_12345678_55AA »
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline electronic_eel

  • Regular Contributor
  • *
  • Posts: 186
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #543 on: March 15, 2019, 01:47:14 pm »
The exact same Gerber ZIP file was uploaded to JLCPCB using the upload Gerber function. The production went smoothly and the received PCB panels did not have any error (also the USB port fits nicely).
Good to know, thanks.

The multiple copy of the outline without having the same PCB inside is an industry standard for PCB factories used to indicate to panelize the PCB.
I never heard of that one. All the tutorials regarding panelization I've seen copy the actual content. Do you happen to have a link or document explaining the details of this process?
 

Offline anxzhu

  • Newbie
  • Posts: 3
  • Country: cn
 
The following users thanked this post: js_12345678_55AA

Offline spth

  • Regular Contributor
  • *
  • Posts: 75
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #545 on: March 15, 2019, 04:48:53 pm »
Do we have any idea which devices support ldsptl or ldspth, and which ones don't?
 

Offline oPossum

  • Frequent Contributor
  • **
  • Posts: 790
  • Country: us
  • The other white meat
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #547 on: March 15, 2019, 05:53:45 pm »
Only supported by the 14 bit parts.

https://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering/msg2010509/#msg2010509

More correct: PADAUK IDE generates opcodes only for 14 bit parts.

However they might be in all processor variants.

Another example for this assumption: 15 bit devices reference 4 opcodes in manual which IDE also does not compile:

NMOV A, M
NMOV M, A
SWAP M
XOR A, IO

But there is space inside of the instruction set to support exact this opcodes.
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline piotr_go

  • Contributor
  • Posts: 7
  • Country: pl
    • My Projects
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #548 on: March 19, 2019, 05:50:26 pm »
Quote
I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).
Any progress?

I think i found a new command.
0xA5A5A5AB, with B like BRICKED at the end ;D
When executed µC looks like locked, but FW does not work and cannot be erased.
Tested on pfs154 and pfs173, vpp 10V, vcc 5V/6V.
« Last Edit: March 19, 2019, 05:59:40 pm by piotr_go »
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 162
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #549 on: March 19, 2019, 07:59:56 pm »
Quote
I'm working on PFS173 support (read/erase is working, somehow write does not write a single bit yet).
Any progress?

I think i found a new command.
0xA5A5A5AB, with B like BRICKED at the end ;D
When executed µC looks like locked, but FW does not work and cannot be erased.
Tested on pfs154 and pfs173, vpp 10V, vcc 5V/6V.

I got PFS154 and PFS173 working, now focusing on OTP like PMS154 / B / C.

./easypdkprog list
Supported ICs:
 PMS154   (0xA06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PFS154   (0xAA1): FLASH: 2048 (14 bit), RAM: 128 bytes
 PMS154B  (0xC06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PMS154C  (0xE06): OTP  : 2048 (14 bit), RAM: 128 bytes
 PFS173   (0xEA2): FLASH: 3072 (15 bit), RAM: 256 bytes


After this only internal high/low speed osc (IHRCR / ILRCR) and bandgap (BGTR) tuning is left to do.

So release of firmware / host software is coming soon :-)

JS
Easy PDK programmer and more: https://free-pdk.github.io
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf