Low-cost boot ROM programmer

Spotted on ebay:  a USB i2c EEPROM programmer for just $8.

Irresistible!

Eight dollar EEPROM programmer

The plan is to use the programmer to burn new boot ROMs for the 2Wire.

The boot ROM on the 2Wire board is a 32Kbit device from the 24Cxx family of i2c serial CMOS EEPROM.

These devices have three address pins A0, A1 and A2. The pins can be asserted (or not) to configure the physical address of the ROM. Up to eight ROMs can be connected in series on the same i2c bus and addressed individually. [1]

24Cxx pinout - A0, A1 and A2 are address pins

We can use this addressing feature to ‘piggyback’ our clone ROM onto the 2Wire board.

If pin A0 of the board boot ROM is pulled up, its address is changed from a default of 0xA0/A1 to 0xA2/A3.

If we pin strap our ROM to assign it the original address (0xA0/A1) of the board ROM, then the Trimedia CPU will boot from our ROM instead.

Device Addressing of the 24Cxx

The contents of our piggyback ROM can hold new code, such as a JTAG debug monitor. This would leverage access to the flash device on the 2Wire PCB.

Back to that five quid programmer, though..

EEPROM programmer based on CH341A

The programmer is only supplied with software for Microsoft Windows®, and it’s Chinese language software at that. An English translation of the programmer manual is here. [2]

Some naughty soul has also been busy with the sandpaper, trying to erase the identifying marks from the programmer’s controller chip.

All in vain because the Linux tool lsusb reveals all..

The USB device controller on the programmer has a vid:pid of 1a86:5512. That Vendor ID is assigned to Nanjing QinHeng Electronics Co.,Ltd. [3]

And the controller identifies as the company’s WinChipHead CH341A in i2c mode. [4]

$ sudo lsusb -d 1a86:5512
Bus 002 Device 017: ID 1a86:5512 QinHeng Electronics

It seems that the Linux kernel already contains driver code for the CH341A, and has done for some while.[5]

The CH341 is a USB peripheral controller and multi-protocol line driver.  The IC supports the IEEE-1284 parallel printer interface as well as several two, three, four and five wire serial communication protocols, including i2c.

The Linux kernel supports RS232 comms using the CH341A but doesn’t currently include an i2c driver for the IC, which is a shame.

With no driver for the CH341A, this is one of those thankfully rare occasions when Microsoft Windows® has to be used.

HINT: here is a great project for someone – writing the i2c Linux kernel driver code for the CH341A.

  • An incomplete userspace USB driver to program EEPROMs with the CH341A has been developed and it is here.[11]
  • The IC datasheet for the CH341A is here [4].
  • The GPL’ed source code for a project by Relavak Labs draws on the userspace libUSB library to talk with the IC.[6] 
  • Another project is by Roaring Penguin Software Inc. [7]   Both the Relavak and the Roaring Penguin projects concern an i2c-based thermometer known as a TEMPer. The device communicates over a USB bus via a CH341A.   In both projects, the CH341 is used in serial mode to twiddle the RTS, DTR and DTS lines to drive an i2c peripheral.
  • Python code shared by Panda Xiong, however, drives the CH341A in its native i2c mode  [8].
  • A tiny bit of ‘official’ source code for the CH341a and what passes for a programming manual is here [9].
  • And for those who don’t have it, a RAR containing the original Windows software for the programmer is here [10].

But we digress.

Back to our task..

A low-cost source of 24Cxx EEPROMs was found. These ROMs are conveniently soldered to a prototyping board with header pins already attached for programming and pin jumpers for configuring the device address. The ROMs are actually 24C64 (8KByte) whereas the 2Wire board only uses the 24C32 (4KByte). But that hopefully won’t matter. The extra capacity might even be useful.

24C64 EEPROM for prototyping and 'piggybacking'

The EEPROM Programmer software runs fine in Windows XP Pro which was running as a guest OS in VirtualBox.

A boot ROM image was lifted from the PCB of a 2701HGV-C using a BusPirate and this image was successfully burnt into one of the virgin 24C64 devices:

PC -> USB -> CH341A -> I2C -> 24Cxx

Burning a 2Wire boot ROM clone

UPDATE:

A basic Linux tool has been coded to read and write 32kBit and 64kBit EEPROMs with this programmer.  See [11]

[1] https://docs.google.com/open?id=0B6wW18mYskvBNjhiMGM0NDQtYWY5Zi00YzBmLWEzNTktNTc2N2Y0ZjgwNzJh
[2] http://hackingbtbusinesshub.files.wordpress.com/2012/01/usbprogrammer_24cxxseries_version22.pdf
[3] http://wch-ic.com/
[4] http://wch-ic.com/download/list.asp?id=114
[5] http://lwn.net/Articles/246334/
[6] http://relavak.wordpress.com/2009/10/17/temper-temperature-sensor-linux-driver/
[7] http://www.roaringpenguin.com/products/temper-tools
[8] http://code.google.com/p/common-codebase/source/browse/#svn%2Ftrunk%2Fothers%2Fpython_test%2Fi2c
[9] https://docs.google.com/open?id=0B6wW18mYskvBMDQ2MDBjMWMtMzhjNS00MTM1LTk4OGUtODYxZDdjNjg5MTFj
[10] https://docs.google.com/open?id=0B6wW18mYskvBMmIwMGJjOTQtZDMxNS00MzNiLThkYzgtMGE4N2ZiNTEwMGM3
[11] http://hackingbtbusinesshub.wordpress.com/2011/12/08/eeprom-programmer-based-on-the-winchiphead-ch341a/

About these ads

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s