EEVblog Electronics Community Forum

Electronics => FPGA => Topic started by: migry on September 23, 2020, 08:04:47 pm

Title: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 23, 2020, 08:04:47 pm
Gutted, hit some key combo and lost all my text!!!!  >:(  >:(  >:(   :palm: Now to start over again.

Quite some time ago just as RoHS was coming into force, some bright spark had the idea to throw out all leaded components from the lab (where I worked at the time) into the skip, where it would go straight to landfill. Sort of ironic really. The whole point of RoHS was to prevent this kind of hazardous waste going to landfill!

Luckily I got wind of this and managed to rescue some rails of ICs before they were thrown away. I also got my hands on a couple of EPROM/PAL programmers and an EPROM eraser.

Recently I have got into retro compuiter projects. I have been playing with different FPGAs. I recently designed some 68000 CPU boards and used GALs for the first time. As mentioned in other threads I used WinCUPL without too much bother, and one of my (rescued) programmers supports GALs.

At that time some of the devices rescued were MAX7000 devices. These are older devices that DO NOT support programming via JTAG. These are 5V devices and it would be really useful to use them in some future projects. I have 8 EPM7128s, and lots of EPM7064 and EPM7032's. See attached picture.

Unfortunately my programmer only supports the JTAG version of these devices, and even then requires an adapter board, which I do not have and cannot find any information about.

Now I am sure some of you will be telling me to sell these devices and buy some JTAG compliant versions and use the Altera Byte Blaster. Good advice, but since these devices were FOC I really would like to use them.

I have searched the internet and cannot find any programming information for these (non-JTAG) devices. I realise it is quite common for manufacturers to keep this information confidential, perhaps they make money by selling the algoritms to programmer manufacturers? I did tweet Intel, but they didn't bite, and I got no reply.

What to do?

I could buy a new programmer, but these cost around $1000, so this is of no interest, not for a few devices....perhaps if I didn't already have a programmer.

I did have a crazy idea, but perhaps someone can suggest a better way...

There is an excellent site http://matthieu.benoit.free.fr/ (http://matthieu.benoit.free.fr/) which has loads of information about various EPROM/FLASH/PAL/GAL/MICRO programmers. There is even a few hints about the pins used for programming the MAX7000 devices.

So if I could run some old Win95 or DOS software for one of these old programmers which supports the non-JTAG MAX7000 devices under Linux Wine (?), then perhaps I could trace the I/O writes to whatever parallel ports and use it to figure out which pins of the programmer are been driven. Forgot to mention that for at least for one programmer there are reverse engineered schematics. Does anyone think that this can be made to work? Can you trace I/O writes in some way using Wine?

Anyway time to post before I accidently delete it again
--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: BrianHG on September 24, 2020, 07:23:51 pm
Now I am sure some of you will be telling me to sell these devices and buy some JTAG compliant versions and use the Altera Byte Blaster. Good advice, but since these devices were FOC I really would like to use them.

I thought the ByteBlaster, ByteBlaster II, and ByteBlaster MV did support all versions of the MAX7000, as well as the even older MAX3000 series.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: bingo600 on September 24, 2020, 07:42:14 pm
Wasn't there something about , if jtag was disabled and protection set on a 7000.
Then you'd need a special (expensive) programmer to reset it.

/Bingo
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 24, 2020, 08:40:59 pm
I just googled and found an Intel(Altera) document.

https://www.thailand.intel.com/content/dam/www/programmable/us/en/pdfs/literature/ug/ug_bbii.pdf (https://www.thailand.intel.com/content/dam/www/programmable/us/en/pdfs/literature/ug/ug_bbii.pdf)

In a table of supported devices:-

MAX 7000S devices - 5V (this has a JTAG port)
MAX 7000AE (this has a JTAG port) and MAX 3000A (not familiar with this device) devices - 3.3V

The Byte Blaster has only a few pins so cannot do the "parallel" programming, but it does have enough pins for JTAG connections.

Quote
Wasn't there something about , if jtag was disabled and protection set on a 7000.
Then you'd need a special (expensive) programmer to reset it.

Apparently if some kind a security fuse is programmed on the JTAG devices, then the devices cannot be erased by means of the JTAG connector.

I am looking to build in  some way a cheap version of the "expensive" programmer.

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: joeqsmith on September 24, 2020, 08:42:23 pm
They support JTAG and could be programmed with the bit blaster, byte blaster and master blaster.

See the following data sheet:
https://www.intel.com/content/dam/www/programmable/us/en/pdfs/literature/ds/archives/m7000.pdf (https://www.intel.com/content/dam/www/programmable/us/en/pdfs/literature/ds/archives/m7000.pdf)
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: joeqsmith on September 24, 2020, 08:48:05 pm
The security bit doesn't prevent reprogramming.  Actually, that's how you clear it.   I started out making my own programmer.  I think they published the design for one of their early programmers.     
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: joeqsmith on September 24, 2020, 08:49:53 pm
A quick search.
https://www.min.at/prinz/o/oe1rib/FPGA/ (https://www.min.at/prinz/o/oe1rib/FPGA/)
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 24, 2020, 10:02:20 pm
My devices are NOT the "S" (5V) or "AE" (3.3V) types.

My devices are older MAX7000 which do NOT have JTAG.

In front of me I have an EPM7032LC44-10 and a EPM7032VLC44-12 (I think that this is a 3.3V device - but can't recall).

Quote
The security bit doesn't prevent reprogramming.  Actually, that's how you clear it.   I started out making my own programmer.  I think they published the design for one of their early programmers.

While googling I found several postings saying that JTAG parts which had the security bit set could not be re-programmed using JTAG, because the security bit had to be reset using a "parallel" type programmer. I took this are read. In any case my parts are not JTAG so I need to make some kind of parallel programmer.

I discovered that my devices did not have JTAG having built a board and hooked up a USB Blaster clone, and found that it did nothing. The datasheet revealed to my disappointment that my devices did not have JTAG.

You design and references will be helpful for those who already have or who buy the JTAG compatiable MAX7000 devices.

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: joeqsmith on September 24, 2020, 10:22:00 pm
I'll check my stash of old parts and databooks and get back with you. 
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: NivagSwerdna on September 24, 2020, 10:54:33 pm
Not long ago I was planning to use some of these devices and bought an UP2 board and ByteBlaster.  Worked fine.

https://mil.ufl.edu/4712/altera_UP_board_info.html

In the end I don't think I will use this part because all the ones I got from China seem to be fake.   :(
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 24, 2020, 11:30:17 pm
Not long ago I was planning to use some of these devices and bought an UP2 board and ByteBlaster.  Worked fine.

In the end I don't think I will use this part because all the ones I got from China seem to be fake.    :(

I followed the link and found information about the JTAG programmers, which I am already familiar with. They unfortunately DO NOT program the parts which I have :-(

Are you aware that the MAX7000 devices come in several different flavours?
Some are 5V and some are 3.3V
The newer ones can be programmed over JTAG (a simple industry standard interface and protocol widely used to program and test ICs) using a Byte Blaster.

BTW I use JTAG a lot in my work, so have a deep understanding of this interface and its use.

The older ones CANNOT be programmed using JTAG as the internal circuity does not exist inside the older parts. They require a "parallel" programmer to control a number of pins and a high voltage must be applied to one pin, sort of like an EPROM programmer. From the information I have been able to find it appears that the parts have one or more shift registers and some other miscellaneous pins whose purpose I do not understand. Intel/Altera are keeping this information confidential.

Perhaps you bought the NON JTAG devices, which CANNOT be programmed using the ByteBlaster which you have. Could it be that the devices are not actualy fake, but are simply not the JTAG type? Can you post the full device ID or post a picture of the top of one of your devices? This will allow us to confirm - or not!

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: joeqsmith on September 25, 2020, 01:29:52 am
This is going way back.   It appears you need the Master Programming Unit PL-MPU with the LP6 ISA card.   I have not seen one of these in many years.   

http://www.ece.ualberta.ca/~elliott/ee552/AlteraDoc/maxplus2_getting_started.pdf (http://www.ece.ualberta.ca/~elliott/ee552/AlteraDoc/maxplus2_getting_started.pdf)

https://www.ebay.com/itm/ALTERA-MPU-MASTER-PROGRAMMING-UNIT-Full-PL-ASAP2-kit-LP6-programming-card/114416535210?hash=item1aa3c1c6aa:g:R5MAAOSwmcJd8Cvp (https://www.ebay.com/itm/ALTERA-MPU-MASTER-PROGRAMMING-UNIT-Full-PL-ASAP2-kit-LP6-programming-card/114416535210?hash=item1aa3c1c6aa:g:R5MAAOSwmcJd8Cvp)
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: NivagSwerdna on September 25, 2020, 09:55:34 am
I'm sure there are many variants... this is the combo that worked for me...

[attachimg=1]
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 25, 2020, 11:30:54 am
I'm sure there are many variants... this is the combo that worked for me...


Just to highlight to any readers (and please read the SUBJECT text) that I know that MAX7000  "S" devices CAN be programmed with the USB blaster shown, however MY devices are not the "S" variant and DO NOT HAVE JTAG circuitry.

The device in the picture is marked EPM7128SLC84-S, so it is clearly a "S" device and is therefore capable of being programmed using the USB Blaster clone shown in the picture, because the "S" devices DO have JTAG internal circuitry.

My problem, for which I search a solution, is that I need to program devices which I have, which are NOT "S" devices and cannot be programmed in the way your picture shows.

Neverthess for anyone who has the "S" type parts, you have confirmed that the common and cheap USB Blaster clone can program these (the "S") devices.

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: joeqsmith on September 25, 2020, 11:44:45 am
Another option may be a generic programmer.  I have an old EETOOLS programmer that supports both devices.  It requires two adaptors which would cost about $250, if you could find them.  Have you checked to see if any of the new low cost programmers support it? 

Some of the older parts I used also did not use JTAG but rather the passive serial mode, which could still be programmed using their more common programmers. That doesn't help you except that the lack of JTAG isn't really a good indicator, so much at the part numbers.   
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 25, 2020, 11:47:09 am
This is going way back.   It appears you need the Master Programming Unit PL-MPU with the LP6 ISA card.   I have not seen one of these in many years.   

http://www.ece.ualberta.ca/~elliott/ee552/AlteraDoc/maxplus2_getting_started.pdf (http://www.ece.ualberta.ca/~elliott/ee552/AlteraDoc/maxplus2_getting_started.pdf)

https://www.ebay.com/itm/ALTERA-MPU-MASTER-PROGRAMMING-UNIT-Full-PL-ASAP2-kit-LP6-programming-card/114416535210?hash=item1aa3c1c6aa:g:R5MAAOSwmcJd8Cvp (https://www.ebay.com/itm/ALTERA-MPU-MASTER-PROGRAMMING-UNIT-Full-PL-ASAP2-kit-LP6-programming-card/114416535210?hash=item1aa3c1c6aa:g:R5MAAOSwmcJd8Cvp)

OK @joeqsmith, thank you for the pointers.

I do have the physical MAX7000 databooks (remember them?), but I do not have the MAX-PLUS II databook, now downloaded from your link to the PDF.

I actually intend to use Quartus to generate the code for the MAX7000 devices (if I can solve the programming problem) using a POF compiled from Verilog.

I was also aware of the old programmer type shown in the Ebay link, however I do not want to spend $2000 to buy an old ISA card. H-ll I don't even have any old ISA motherboards anymore, they were all thrown out long ago (and ironically and nowe worth lots of $$$).

There are still (multi device) programmers which can be bought new and which do support these MAX7000 devices (JTAG and non-JTAG modes of programming), but they cost at least $1000.  As I mentioned, if I didn't already have a flexible EPROM/FLASH/EEPROM/MICRO programmer (FYI - LV48 Speedmaster), then I would have considered buying such an expensive programmer. I have been using the LV48 quite often recently to program EPROMS and GALs. It connects to the parallel port of my old XP machine and the DOS based GUI runs under Win-XP without problems.

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: NivagSwerdna on September 25, 2020, 01:05:31 pm
I have 8 EPM7128s
Apologies I read s as S.  8)
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 25, 2020, 01:46:32 pm
I have 8 EPM7128s
Apologies I read s as S.  8)

Sorry! My bad! The "EPM7218s" was a plural. I didn't even think that this might be mis-read! I should have written "I have 8 EPM7128's".

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: westfw on September 27, 2020, 09:36:24 am
Did you find any modern development software for these?  I also have a bunch, as a result of dumpster-diving.(mine were in a proper w-waste bin, at least.)
You can find the old Quartus v9.1 Altera software that is supposedly the last official release that supports these, but ... it look painfully ancient :-(
See also  https://hackaday.com/2016/02/04/a-better-way-to-plug-a-cpld-into-a-breadboard/
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 27, 2020, 01:50:05 pm
Did you find any modern development software for these?  I also have a bunch, as a result of dumpster-diving.(mine were in a proper w-waste bin, at least.)
You can find the old Quartus v9.1 Altera software that is supposedly the last official release that supports these, but ... it look painfully ancient :-(

Thank you for this information.

I have Quartus 13.0sp1 loaded on my Win10 machine, so I tried to create a simple counter design project. I found that there were several MAX7000 EPM7032 devices which could be selected, but I noted that these were all the JTAG types. I was able to create a POF, but I am now guessing that this POF uses the JTAG serial mode of programming, so will be of no use to me.

So I then tried to find the old Quartus v9.1 on the Intel site. Well guess what - you can select it, but cannot download it. Thanks Intel! Thanks for NOT supporting thje maker community or anyone using old parts!

I tried googling, but I was unable to find an this old version anywhere else.

So @westfw (and any others) do you still have the install .EXE for this old version of Quartus?

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 27, 2020, 02:16:46 pm
So I initially mentioned a possible method to find a way to program these old non-JTAG devices.

So I was intrigued by the amazing information on the http://matthieu.benoit.free.fr  (http://matthieu.benoit.free.fr) website.

There is a page dedicated to an old Hi-Lo programmer called the ALL03, which appears to be able to program the  non-JTAG EPM7032 (and similar) devices. It even shows the schematic of the adapter which is needed, but amazingly it gives pin names of what appear to be the programming pins for this device (SDINA, SDOUTA, BE, BEM, SCK, SK, ...etc...). I can find no reference to these names elsewhere. It also shows which ALL03 channels each pin of the EPM7032 connects to. There is also the specific .EXE which is needed to program these devices. It is a very straight forward design of programmer. It needs an ISA card which uses only 2 addresses. Inside the programmer lots of 74LS273 8-bit latches are used to latch the data from the PC ISA card which in turn allow pins to be driven and read back and voltages such as Vcc and Vpp to be connected to appropriate pins. There are 3 DACs which generate 3 sets of high voltages (Vcc, Vpp and other).

So since I had DOSBOX on my PC I tried running the software. It ran! The GUI was the old DOS type character graphics, which to be honest allowed really nice (low res) GUIs to be constructed, thanks to the IBM PC character set.

So I wondered if I could modify DOSBOX to allow me to trace writes to and reads from the two I/O addresses.

To cut a long story short, I downloaded the sources for DOSBOX-X onto my Ubuntu Linux VM, and was able to compile and run DOSBOX-X under Linux with relatively few problems. For other software you download, configure and compile under Linux I have had lots of problems. So kudos to the DOSBOX-X team.

I spent a good part of one day in the src/hardware folder looking at the various I/O devices (mainly sound cards) which arre supported. I started to get an idea of how to intercept I/O writes and reads. I then copied the MPU401.cpp module and hacked it around to give a skeleton to log writes and reads to the two ALL03 ISA card ports. I needed to modify the Makefile and create a .Po file (no idea what this is - I just copied the mpu401.Po file!). Several hours of debugging later... I run the modified DOSBOX-X, fire up the MAX7000 .EXE (A70X.EXE), do some commands and look at the log. First problem was that the software was not seeing the programmer, however it was still apparently writing to the various registers. The programmer implements a PAL to decode the addresses of the various registers, but also contains a 4 bit state machine, the output of which can be read by the software, and this is seen in the logs. So again thanks to the same website, I found the PAL equations and added emulation of the PAL into the software. Finally no more complaints by the programming software. I am now emulating the SAC-201 PC ISA interface card, the various programmer I/O control registers, and the programmer PAL. Apparently the PAL is used to identify the prrogrammer hardware type, but might also have been some crude form of protection.

So now I can run the A70X.EXE software for the MAX7000 and generate a log. Unfortunately the pins used did not match those expected from the EPM7032 adapter pinout. I was aware that this version of software, while allowing different members of the family to be selected, did not have a choice for the EPM7032. More googling later and I found a website suggesting a different .EXE program name. More googling and I could not find it, until I looked in the folder of software downloaded from the above site and I found AMAX70.EXE . I now loaded the DOSBOX-X (with SAC-201 and ALL03 emulation) software and generated some new trace logs. This time the Vcc and Vpp pins mapped perfectly, and I was able to see toggling on the SCK pin and changes on the SDINA and SDINB pins (presumably serial data in). The software then tries to read back a serial value, which of course fails.

I have attached the log file with annotated EPM7032 pins.

More soon...

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: abyrvalg on September 27, 2020, 05:26:27 pm
What if you “just” route (in software) the pin accesses to some kind of GPIOs attached to a real MAX7k now?
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 27, 2020, 10:14:55 pm
What if you “just” route (in software) the pin accesses to some kind of GPIOs attached to a real MAX7k now?

Aha! I also had a similar idea. Bear in mind that DOSBOX-X is already emulating not only software but hardware too. having said that it can read joysticks, so has a way to speak to the outside world. Otherwise I don't know how I would get DOSBOX-X to speak to real physical hardware (parallel port?).

For the time being I intend to simply record the stimulus as text (as shown) and then replay on an Arduino. There's stilla long way to go!

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 28, 2020, 09:15:05 pm
Just to confirm that I am getting the expected values out of the DOSBOX-X emulator in the log file (as previously attached), I have written an emulator for a simple EPROM device. I chose the AMD Am2716. At (simulated) reset, the contents of the EPROM, defined as a byte array, are all set to 0xFF, i.e. the normal EPROM erased value.

After a few iterations I managed to get it to work.

This time in DOSBOX-X I run the main ALL03 programmer software, ACCESS.EXE (there might be other versions and names). I then select EPROM, then AMD, then Am2716 device, and the software loads and runs another module (called EPP512.EXE) which appears to be the EPROM specific software (just like AMAX70.EXE is the Altera EPM7032 specific module). I examine the buffer (start only) and see all zeroes. I then load the buffer from the emulated 2716. I then check the buffer and see that the values are now all 0xff. I then edit the first 16 bytes to 0x55. I then select program and ... success! What this means is that the value being programmed is used to update the array so when the EPROM is read back it has the new programmed value. I was able to examine the programmer pin log file to confirm what had happened. First good thing is that all the pins which toggle map correctly to the EPROM pins, i.e. pins 9 to 20 of the programmer (which correspond to pins 1 to 12 of the EPROM) are the ones which toggle, and I can see the address count. I note that when programming the whole EPROM is read and only the bytes which are not 0xff, are programmed (I don't know if this check is more intellegent - as long as an EPROM bit needed to be  zero is one, it can be changed, but 0 cannot be changed to a 1). I thought that Vpp was pulsed for each address, but actually it remains high during programming and readback of all locations. From earlier work I know that after applying the programming conditions (CE and OE) the EPROM is read back, and if the wanted value is not found, another attempt is made. Now after only the first attempt, the emulated EPROM has the right value, but interestingly, the programming software gives it one more "write" at the same address (just to be certain that this EPROM address is "firmly" programmed and not just marginal).

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 28, 2020, 09:36:01 pm
So I have a log of the EPM7032 sequence which the ALL03 programmer applies to the device to confirm its ID, which of course it fails to do.

So I have wired up a perf board with a PLCC44 socket, where each pins comes to a row of 44 turned pin header for connection. I then found a 5V Arduino, a Nano, which has more or less the required number of pins.

Yesterday. I was able to code the data from the previously posted file into the Arduino sketch in order to generate the waveforms that would be applied by the ALL03 programmer. I then hooked all the programming pins (thanks once again to the site http://matthieu.benoit.free.fr/  (http://matthieu.benoit.free.fr/) ) to pins of the Arduino. Turns out that "analogue" pins named A0 to A5 can be used as digital, but not A6 and A7 - guess which pin I used for a critical signal! I was able to confirm that when the Vpp pin was taken over about 11V the chip went into test mode and previously clamped shift in data now had no contention and was the right level. I scoped the 2 suspected shift out pins: SDOUTA and SDOUTB, and they had identical waveforms which were defintely the EPM7032 responding to the stimulus.

Today. I wanted to properly capture the response. I didn't quite have enough pins, so I moved some stuff around. Mistake  :( . When I raised Vpp from 5V to 12V (which was OK yesterday) I was getting current clamping on my PSU, and a burning smell  :-DD . After some messing around the lights (of  the Arduino went out). Oops! Turns out the min hub (to which the Nano was plugged on) no longer was lit. When tested elsewhere the min hub appeared to light up, and the Nano too. The hub connected to the back of my Dell monitor. The EPM7032 was very hot, and clearly I had blown it up. I eventually figured out that you must ONLY connect Vpp when a number of other inputs are grounded, and appear to put the device into a state where Vpp does not destroy the chip, however I am not 100% sure which pins are the critical ones.

So I ripped out all the wires from the Nano to the EPM7032 board connector and started again. After the usual debugging and discovery of swapped wires, I got the same waveforms on SDOUTA and SDOUTB as yesterday. I used my Rigol scope logic analyser to capture the waveforms (attached).

I also confrmed which pins become outputs and which inputs when Vpp puts the EPM7032 into "programming" mode.

NTPW - input
MTIN - input
SCK - input
SDINA - input
BE - input
BEM - input
SS - input
SBI - input
TM - input
A0 to A6 - input
SDINB - input
SK - input

Vpp - needs around 12V to put the device into test mode (but ONLY do this if the other pins have been set!)

SDOUTA - output
SDOUTB - output
SCOA - output
SCOB - output

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 28, 2020, 09:45:21 pm
Question.

Can the JTAG type "S"/"AE" devices (e.g. EPM7032S) be programmed in "parallel" mode, i.e. not using the JTAG? In other words did Altera make the newer "S" devices backwards compatible with the older devices?

Actually it is sort of ironic. To implement JTAG you need quite a few flip-flops (for state machine, instruction register, data registers), however the main EPM7032 device only has 16 macrocells, therefore with only 16 flip-flops (as far as I understand).

@bingo wrote
Quote
Wasn't there something about , if jtag was disabled and protection set on a 7000.
Then you'd need a special (expensive) programmer to reset it.

@joeqsmith wrote
Quote
The security bit doesn't prevent reprogramming.  Actually, that's how you clear it.   I started out making my own programmer.  I think they published the design for one of their early programmers.     

I wonder if someone who knows for sure can confirm that - if the security bit of a "S" type device has been set, can the device be erased by means of JTAG only, or as @bingo beleves, do you need a "parallel" mode type programmer to clear the security bit and erase the device?

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: abyrvalg on September 29, 2020, 04:42:38 pm
My idea was to make DOSBOX controlling the pins of a real MAX7k. I.e. you connect an Arduino between the PC’s serial port and the MAX, write a sketch that listens to commands like "set pin X to Y state", "get pin X state" and send these commands from DOSBOX’s IO port handler, bridging the programmer exe to your MAX and letting it doing it’s job directly.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on September 30, 2020, 01:20:25 am
My idea was to make DOSBOX controlling the pins of a real MAX7k. I.e. you connect an Arduino between the PC’s serial port and the MAX, write a sketch that listens to commands like "set pin X to Y state", "get pin X state" and send these commands from DOSBOX’s IO port handler, bridging the programmer exe to your MAX and letting it doing it’s job directly.

Hi @abyrvalg, I did understand what you were suggesting, and I did briefly consider this. I was incorrect in my previous reply, in that of course it is possible from the DOSBOX-X (modified) source code to write to real hardware (I just got confused), if I can figure out the correct library calls. Since DOSBOX-X is compiled under Linux with gcc, then I guess it should be possible to write to the serial port. I have an old Maplin kit for a ISA I/O card (un-built) which uses a INS8255. This would have been perfect. No good for my modern PC with PCIe ! Certainly I could devise a protocol and send serial data to a hardware COM port, then use an Arduino to capture this data and re-assemble the parallel packets. The ALL03 programmer is built from 8 bit chunks, so that maps nicely. I would need a couple of DACs for Vcc and Vpp, however I possibly could get away with simply switching these supllies on and off. I do see in the programmer I/O logs that Vpp is ramped slowly up and (later) down again using the DAC. Vcc is simply enabled on or off, having been previously programmed to the right level. The ALL03 can route 3 different high voltage supplies to nearly all pins (they didn't connect to all pins to save some costs I assume). If I use the "serial" Arduino method or the "parallel" stand-alone method, Vcc and Vpp will be handled the same way. The benefit of the way you suggest is that the timing information is at least "maintained" from the original software. With my method of logging I have no idea (currently) how long between writes to the programmer registers, and I think that some "pulses" may have minimum or critial lengths.

--migry
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on October 26, 2020, 03:57:56 pm
Did you get further with your efforts ?
I ask because I have a stack of EPM7128S that have the security fuse programmed.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: MadTux on October 26, 2020, 05:07:43 pm
Actually it is sort of ironic. To implement JTAG you need quite a few flip-flops (for state machine, instruction register, data registers), however the main EPM7032 device only has 16 macrocells, therefore with only 16 flip-flops (as far as I understand).
As fas as I know, EPM7032 should have 32Flipflops, just like as with XC95xx, xx is the number of flipflops available. 32FFs are very few for anything with clock, the small CPLDs are IMO better suited to replace lots of 74xx AND/OR.... combinatorial logic.

BTW anyone who has downloaded Quartus II 9.0 for linux, before it was taken offline?
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on October 28, 2020, 04:32:32 pm
Yes I did make a little more progress, but then decided to move onto something else, as a form of break, but intending to re-visit later. I do have 10 EPM7032S JTAG devices on order from China, and assuming that they are not fake  ;D I will be able to program them using my Altera USB Blaster clone, in order to try various actions on my hardware.

My new hardware now has two DAC channels, one of which is required for Vpp. 12V on this pin puts the device into test mode and reconfigures all the special pins.

My new hardware is based around an Arduino MEGA2560. I have a script, into which I hard code sequences which have been learnt by reverse engineering the DOSBOX + ALL03 programmer hardware and software. The EPM7032 programming software (for the ALL03) gives me traces of certain commands. I see common sequences on groups of pins. Certain commands do not work as the software does not see the expected response from the emulated ALL03 programmer and emulated EPM7032 device. Blank check for example is still reporting a failure even though I applied the waveforms using my hardware to a blank device. Probably my emulated "blank" EPM7032 needs some minor tweaks.

Some commands such as erase seem to have simpler sequences, but need more pins to be toggled.

I finally found the special test pin names for the 44 pins EPM7064. There are more pins used for programming on this device, some with new names as compared to the 44 pin EPM7032. I do not know the pinout of the test pins for the EPM7128. This would need someone with an adapter for the ALL03 programmer to reverse engineer the adapter to 40 pin socket. With this information I could use the MAX7000 version of the ALL03 programmer to work out which waveforms to apply to which pins.

I have added a JPG of the list of test pin names for the EPM7032 and EPM7064.

If I or someone can find the same list for the EPM7128 then I might be able to help (in the longer term).
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on October 28, 2020, 04:38:54 pm
As fas as I know, EPM7032 should have 32Flipflops, just like as with XC95xx, xx is the number of flipflops available. 32FFs are very few for anything with clock, the small CPLDs are IMO better suited to replace lots of 74xx AND/OR.... combinatorial logic.

My point was that adding the extra circuitry to convert the non-JTAG device to the new JTAG equivalent would add many more extra flops, as compared to the 32 which form the basis of the device as "seen" by the end user.
 
To implement JTAG you need at least 4 flops for the state machine, one for the re-timing of TDO, at least 4 for the instruction register, 32 flops if you implement the Device ID register, plus any addition flops to tie into the old programming circuitry.

From my experiments on the non-JTAG EPM7032 there are at least two shift registers each 10 bits long (so this requires 20 flops). So even in the non-JTAG design there are more "hidden" flops needed for programming, than the 32 which are used by the end user.

[Edit: I originally said 16 user flops and not 32!]
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: bingo600 on October 28, 2020, 05:18:42 pm
@migry

That is some serious effort, put into reviving some old devices.
I hope you have quite a few.

Interesting read.

Thanx for sharing  :-+

/Bingo
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on October 29, 2020, 02:21:50 pm
Quote
I do have 10 EPM7032S JTAG devices on order from China

Mine also come from China, fuse locked :(, (because I cannot read/program them with a USB Blaster, nothing found on JTAG). Maybe one of the pins is a JTAG enable pin...
Firstly I saw that they came packaged in a reel and I thought maybe they are NOS or so (very naive from my part). After closer inspection... all chips have different date codes !
I also bought several XC9572XL-vq64, those work great though.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on October 29, 2020, 03:03:13 pm
Mine also come from China, fuse locked :(, (because I cannot read/program them with a USB Blaster, nothing found on JTAG). Maybe one of the pins is a JTAG enable pin...

My limited understanding, with assumptions, is that for the JTAG devices, if you utilise the I/O's shared with the JTAG pins as user I/O, then of course the JTAG has to be disabled using some fuse. These parts cannot therefore be re-programmed using JTAG. If you do not use the JTAG shared I/O as user pins, then the JTAG remains enabled, allowing re-programisation. Perhaps the 12V on the Vpp re-enables the JTAG I/O. This is something which I will investigate in the future.

In IC design, particularly for low pin count chips, where JTAG is used internally for chip scan test, do you dedicate 4 (or 5) pins to JTAG, so making less pins available for user I/O, or do you share pins and add some mechanism (normally a single TEST pin) to enable JTAG and allow chip scan test? Altera have given maximum flexibility here, and we might assume that the fuse to enable/disable JTAG is "new", i.e. it is not on the non-JTAG devices. We can select to use fewer I/O and have JTAG always enabled, or use maximum I/O but lose JTAG programmability once the chip is programmed.

Having ordered cheap parts from China in the past: Flash ROMs and MC68000 DIL and PLCC, I am now aware of the problem of chip recovery and re-marking.

The MC68000 DILs were 8MHz devices, remarked as 16MHz devices. I found out simply by removing the fake marking with IPA, which clearly revealed the original markings.

The MC68000 PLCC did not work at all. Suspiciously they all had the same date-code markings, but the packages all differed slightly with respect to markings on the bottom and dimples. They were obviously remarked, possibly not even MC68000s. I got a full refund from the seller, who I will avoid in future.

Of the 4 Flash ROMs, 2 worked and 2 did not program. All had identical markings and date code, so obviously re-marked, but the markings did not come off with IPA. My programmer essentially rejected the devices saying that the manufacturer ID was not Intel. I wondered whether the 2 devices which did not program were from another manufacturer, but I could not get them to program when I tried to select different chip vendors. I got a refund for the 2 "broken" devices. Whether I can trust the speed rating of the 2 "good" (and remarked) devices is unclear.

Clearly all the above devices were re-claimed and were not NOS.

BTW I have absolutely no issue with chip recovery, but I simply want the sellers to be honest. Some sellers might buy chips from the recovery companies in good faith, and there will be good and bad recovery companies. What really p*****s me off is when the chips are re-marked. What a waste of time. Given the low selling cost of the chips, why bother?

So I will be interested to find out if the EPM7032S devices are genuine parts and if so, are they locked.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: westfw on October 30, 2020, 12:50:54 am
Quote
the extra circuitry to convert the non-JTAG device to the new JTAG equivalent would add many more extra flops
flip-flops in general are not "expensive", and the flipflops to make up the shift registers for basic JTAG access can be especially trivial (and may in fact be very similar to what is already there for the non-JTAG versions.)It's the fully-connected, fully-configurable flip-flops and their associated control logic and routing that make up one of the "Macrocells" that make them costly.(an SRAM is essentially flipflops, and you can get a million of them on a very cheap chip.  REAL old-timers will remember that shift registers were used for microprocessor storage back when SRAM was "too expensive.")

Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on October 30, 2020, 01:25:49 pm
My EPM7032S parts arrived. 10 off. All have identical markings on the top, i.e. same date code. However on the bottom almost all parts are different, which absolutely confirms that they are NOT from the same lot, and therefore must have been remarked.  >:(  >:(  >:(

Note: manufacturers use lot numbers and date codes to track "sets" of devices throughout the manufacturing process. Parts marked with the same date code are very likely to have come from the same wafers. They would have gone through assembly as a group and would have been processed by the same machines. I am unfamiliar with the machines which put the die in the plastic packages, but you should expect all devices with the same lot code to have used the same machine and therefore any package markings (top and bottom) and dimples should be identical.


I will now test them to see if they are even EPM7032S devices.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: TomS_ on October 30, 2020, 09:06:48 pm
Altera EPM devices and Atmel ATF devices are very similar it seems, so much so that Atmel released a tool to convert Altera .pof files to .jed so you can program a design into one of their own parts.

If you use the JTAG pins as IOs, they can be re-enabled for programming by applying 12V to the OE pin.

Presumably it would be similar on the Altera parts.

How to clear the security bit is still to be discovered.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: Rasz on November 02, 2020, 03:38:25 pm
This https://hackaday.com/2020/10/16/isastm-runs-vintage-cards-over-usb/ (https://hackaday.com/2020/10/16/isastm-runs-vintage-cards-over-usb/) might give you ideas about linking emulator with real world. Manawyrm used PCem and USB CDC-ACM serial connection to STM32. https://www.vogons.org/viewtopic.php?p=902486#p902486 (https://www.vogons.org/viewtopic.php?p=902486#p902486)
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on November 03, 2020, 02:09:29 pm
Hi @Rasz thanks for the pointer to an interesting read.

I might just re-visit the idea of sending register writes from DosboxX via serial to the Arduino. I think that it might speed things up.

My only concern is that using serial comms under Linux appears to be unnecessarily complicated, what with all these IOCTLs and function calls. On the Arduino (and small development systems) serial comms is a piece of p--s, but under Windows and Linux all the additional wrapping seems to overcomplicate things (IMO). Over the years I've written lots of serial comms code for microcontroller and uPs in machine code, without much of a problem. As soon as I even try to find example code for Windows and Linux I can't find something nice and easy to understand.
 
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on November 04, 2020, 03:21:47 pm
Update.

Using my homebrew perf board set-up shown below, I can connect up a cheap Chinese USB Blaster clone to the EPM7032S devices  in PLCC 44 pin.

| was pleasantly surprised to find out that all devices respond to JTAG and are blank. I must admit this was somewhat of a surprise, as I am still in no doubt that all 10 parts have been remarked. Some parts have a lighter colour of plastic and you can see where very black paint has been painted on top.

Next I tried to program a part with a simple 24 bit counter. I was using Quartus 13.1
I had the usual issue that it selects pin assignments for you first time around, and moved them to known adjacent pin positions. The strange this is that I see square waves on some pins, but not the ones which I chose. I have re-compiled several times in case something was out of date. The part programs and verifies correctly. I tried a second part and it behaved in the same way. I see the xtal divided output from the counter, but 1) on the wrong pins 2) lower frequencies on pins which I have not assigned (perhaps this is side effect of using macrocells?).

Now scratching my head.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on November 04, 2020, 03:42:06 pm
Update #2.

Silly me  :palm: . It's all OK!

I changed the "Unused Pins" option in "Device->Device and Pin Settings" from "As output driving and unspecified signal" to "As input tri-stated", and quickly saw that I had wired up the wrong part of the counter, so that I was outputting very low frequency square waves on the pins of interest.  |O

I updated the Verilog code, re-programmed, and the EPM7032S is now working as expected, outputting the correct square waves from dividing the xtal on the expected pins. Brilliant!
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: Rasz on November 04, 2020, 05:04:33 pm
under linux talking serial is just opening file descriptor and writing/reading to it

> cheap Chinese USB Blaster clone

fx2lp
https://www.newioit.com.au/archives/159 (https://www.newioit.com.au/archives/159)

https://github.com/Wei1234c/FX2LP (https://github.com/Wei1234c/FX2LP)
This sems to have already implemented firmware for random GPIO access + glue python code

Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on November 04, 2020, 05:58:42 pm
Oh, you had more luck than I had :+1:

The ATF parts look similar at least they have the same pinout for the PLCC84 variants.  I found a forum post on the forums.6502.org about applying 12 V to OE1 to enable JTAG, but no docu as of yet. I'll try anyways :).  Thanks for the tip !
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: TomS_ on November 05, 2020, 07:56:47 am
Pinout is also the same for the 44 pin PLCC package too.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on November 05, 2020, 01:15:52 pm
It seems that I have no luck with this device. (EPM7128SCL84)

1. I apply 12 V at OE1 (Pin 84).
2. Apply 5 V at VCCINT/VCCIOs.
3. Send JTAG command (blank check, verify, program). I see that the clock does not go to 0V (Transitions between 5 V and 4.5 V), as if the chip were driving high on TCK.
  I see No output on TDO.

See trace: CH1 TCK, CH2 : TDI

2nd test:

1. Apply 5 V at VCCINT/VCCIOs.
2. I apply 12 V at OE1 (Pin 84).
3. Send JTAG command (blank check, verify, program). I see that the clock does not go to 0V (Transitions between 5 V and 2.5 V), as if the chip were driving high on TCK.
  I see No output on TDO.

 :(

I tested the GND pins and they seem to be at the right locations: i.e. both internal GNDs are connected as well as the IO GND, so I assume it is a EPM7128.

Something is missing, some other pins may need to be grounded or so.
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: migry on November 05, 2020, 01:26:51 pm
@ale500 - where did you get your devices from?

During my many searches I have seen numerous messages from people wanting to clear the security fuse of the EPM7128S.

On the EPM7032 I apply 12V to the OE pin which is Vpp. I think it's a pretty fair guess that OE on the 7128 will also be Vpp, but... until we get someone who has an adapter for the ALL03 programmer, we can't be 100% sure.

Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on November 06, 2020, 05:34:10 am
I got them from aliexpress: shenzhenYida Store.... I'll try to buy another batch from some other store...

To which OE pin do you apply the 12 V ? OE1 or OE2 the 44 PLCC has both too. And how do you apply it ? could you please describe the sequence of steps ?
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on December 10, 2020, 02:58:42 pm
I got to test all my devices (EMP7128S according to the markings). They fall into two categories: they do not respond to any command, even in "jatg debug mode", and the ones that say something like EMP7128DD_UNKNOWN when the IDCODE iteration test is used. (but nothing else).
They do seem to use the JTAG pins as IOs. That would also prevent JATG from working...
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: CJay on December 10, 2020, 03:41:30 pm
FWIW, I have a programmer which seems to support these devices but I'd need to hack together an adapter, happy to do so if it's just a wiring job.

If you want to check the supported device list here:
https://www.dataman.com/mwdownloads/download/link/id/6/ (https://www.dataman.com/mwdownloads/download/link/id/6/)

I'm happy to erase a few chips if that helps?

Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on December 13, 2020, 06:47:03 am
Thanks for the offer !

I think, "just" knowing how the programming, erase works, or where and how the 12 V are applied may just be enough. Shipping the chips and getting them back would be more expensive than buying a bunch of XC9572xl and making adapters for them. The versions in VQ64 actually work :). The info could help some other folks too. What do you think ?
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: vvervvurm on December 16, 2020, 10:16:27 pm
Quote
I wonder if someone who knows for sure can confirm that - if the security bit of a "S" type device has been set, can the device be erased by means of JTAG only, or as @bingo beleves, do you need a "parallel" mode type programmer to clear the security bit and erase the device?

I have salvaged some EPM7064AE devices from old Cisco hardware. Although the security bit was not set - the JTAG was disabled. I could not access them with my USB Blaster. After reading this thread I mustered up the courage to apply 12.25 volts via 2.2k resistor to the OE1n pin (after the normal 3.3 volt VCC). Current draw on that pin was minute ( < 1mA ). Suddenly the JTAG worked and I was able to read and erase the device.

So I would give it a shot. It could also work on 7000S devices I would guess.

I hope this helps. :)
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: ale500 on December 17, 2020, 03:44:45 pm
@vvervvurm:

Did you keep the 12.5 V during the JTAG transaction or not ?
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: vvervvurm on December 18, 2020, 11:33:41 am
yes, VPP stayed on for the whole time ..
(of course after erasing it was not needed any longer as normal JTAG was enabled again)

I have only 2 samples .. so I was not brave enough to set the security flag and try to pull off the same trick again .. and as mentioned my parts are of the AE variety ..
Title: Re: Programming (non-JTAG) MAX7000 devices
Post by: vvervvurm on December 18, 2020, 12:30:15 pm
@ale500
You might have already seen this topic (near the end of the thread) https://www.eevblog.com/forum/fpga/atmel-atf150x-cpld-and-wincupl/ (https://www.eevblog.com/forum/fpga/atmel-atf150x-cpld-and-wincupl/)

So I think I was just lucky that my devices had no security bit set. Sorry for getting your hopes up.  :(

edit: The whole "100ms pulse" sounds very much like parallel programming mode as I can't think of a way for a timed pulse in JTAG protocol. (?)