Skip to main content
Topic: Bus Pirate PIC 24F Programmer Dev Thread (Read 44352 times) previous topic - next topic

Bus Pirate PIC 24F Programmer Dev Thread

Since there isn't a thread (that I could find) about the recent blog posts I started this one.

Attached is a script to read the configuration words, you will have to remove the .txt extension and add a .scrp24 extension.

One thing to note is that the Programming Spec says that we should load CW2Address15:0 into W6 with the SIX instruction 2xxxx7 (2ABFC7 for the bus pirate's pic). This does not work and looking at the openprog source code the line should be 2xxxx6 (2ABFC6), which is logical since it's safe to assume that the last nibble defines the target register.

edit: WOOT! I have a script to write the configuration words up and running. You will need to modify lines 29 and 99 to suit your own purposes though and if bit 15 of the REGOUT doesn't clear by the end of step 8 add some duplicate step 8s to pad out the wait.

edit2: I did a couple more short scripts. One to demonstrate writing code memory and one to read code memory, but, due to the fact that my code that reads the scripts (I don't have a functioning bus pirate so I can't use the one in the dangerous prototypes repo), it just writes and reads the first 48 bytes of a table page.

So if you erase your chip with 7's script in the repo then run the attached ReadCodeMemory script you should read out 48 Fs. Then run the WriteCodeMemory script it will be programmed with 0123456789ABCDEF13579BDFFDB97531FEDCBA9876543210 starting at memory address 0x000200 which is the beginning of user flash program memory. Running the Read script again will read out the newly programmed code.

edit3: I just realized that to get this to work with the program in the repo you'll need to play with the timings. My programmer clocks the data in and out at 10ms per bit, which is really slow, but it works and rules out timing as a factor if any issues come up.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #1
I`m working on a Bus Pirate programmer for the 18F26J50, but having problems getting it to write to the chip.

I can read from any area of the chip, and also do a bulk erase fine, but can't get it to write at the moment.

I`ve looked at the released script for the 18F24J50, and tried running the one that writes to the chip, but thats not writing to the chip either.

Has anyone got any ideas? I wonder whether it's hardware related and if theres any special setup required for writing?

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #2
Hmm, I don't have any first hand experience with the 18f24j50's, but I can give you a couple of general pointers. Put NOPs between everything, seriously it's just easier to put NOPs everywhere than figure out what, exactly, does need a NOP or two. Also look at the source code of the OpenProg project, that also helped me a lot.

Having a 1 minute look at the programming spec vs the OpenProg code I can see that in their write function they use:
0x8EA6;
0x9CA6;

Instead of the:
0x84A6

From the data sheet, don't ask me why but it might help :P

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #3
When I did the 24j50 write test with the write script (had to remove the \ comments, the current version of the app seems to report errors about them) I ran the erase script immediately before it. I don't know if that's key, but it was the procedure I used.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #4
Considering the latest development in the OLS project (PICF24J50 based), this project deserves special attention because:

1. A considerable number of OLS boards shipped without a bootloader
2. Users need to upgrade the PIC18F24J50 firmware (at least they will have to install the bootlader) to be able to use recently released updates of the FPGA bitstream(s) - in particular because the latest releases fix bugs that made the OLS almost if not completely useless for a few users.
    Essentially, there is no way of msking use of any of the SUMP engine improvements since the interface between the PIC and the FPGA was changed and the firmware that shipped with the boards does not support the new interface
3. Some users seem to have no access to a PIC programmer with an ICSP interface but quite a few seem to have a Bus Pirate

I will take a look at the code now ... unfortunately I don't have the time to do any coding but I will test it on one of my OLS boards and provide feedback.

This appears to be an interesting project in general since it will be rather easy to support all MCUs of the PIC18F2XJXX/4XJXX family.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #5
I was about to post an update, and noticed Jim's recommendation. We figured that out the hard way (logic analyzer), and kept the 0x84A6 too.  I eliminated that command and it gave me some limited success, but no luck yet.

The package attached has this stuff:
*Latest programmer executable
*v4.3 nightly firmware for PIC with new multi-bit command in rawwire
*scripts for read/write/erase
*hex dump from sametwice script

Here's where we're at:
Erase and read ID scripts work fine.
-firstokthentrash script programs 2 pages. It uses the commands mentioned by Jim + the datasheet command. It programs the first page OK, then programs trash to the second page. If you manually change the page address so the second and third pages are written, the second will be OK and the third will be trash, so it's not an addressing issue.

-sametwice script just uses the commands mentioned by Jim. It's a little more successful but programs the first page data to both pages, though the second page is a little off at the beginning and end. I included a dump of this in the script folder because this is the most successful so far.

7 has been working on this app, and I think at this point it should match the logic analyzer capture from the ICD2 pretty closely. I'll ask him to look at openprog and see if there's anything we can glean from there.

I have two questions at this point that require digging into a logic capture of the ICD2 -
1. Is only Jim's command used, or is 0x84A6 also used (seems more successful without).
2. In previous scripts we repeated step 1 (0x84A6) between every page write. The new script doesn't have it. Adding it just resulted in garbage.

These are fairly direct things to find out by looking at the logic capture, but it's tedious to count cycles. I'll see if I can at least answer 1 tonight.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #6
The answer to #1 is both are used. Now to see if there's anything in between besides setting the table address.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #7
The answer to #2 is no command but the table pointer setup is inbetween. The byte on the left is the last 0x0000 after the very-long delayed clock command. Then it immediately writes the 0x00 0x0E00 address setup command. Technically out script is doing everything right, now I need to check the output of Bus Pirate during programming to see what might be going wrong.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #8
The Bus Pirate output looks a right, but immediately you can tell how much different it is using a serial interface than a clean USB interface. Each segment of the command is spread out. I don;t think it need to be quire this bad (command about 30ms apart), there might be a simple delay in the C program we can decrease. Also, we can use the PIC's 4byte hardware UART buffer to fill it up with the 3bytes needed for a command all at once. This will make the command happen with less delay between the segments, and we get around some of the USB latency too.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #9
Here's the technically correct script.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #10
[quote author="ian"]
Here's the technically correct script.
[/quote]

You mean from the datasheet?

I love to see the final product!

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #11
haha :) No, the one that is from the logic capture of the ICD2 :) It has two commands that are undocumented in the spec :)
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #12
Haven't looked very much into programming pic24f and up, but isn't it basicly the same as just sending the same commands as you would when programming it from the pic itself?  That could explain things?

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #13
The PIC24F is that way, I'm not 100% sure about 18f24j50. 7 is writing the code, maybe he can comment on the programming algo.
Got a question? Please ask in the forum for the fastest answers.

Re: Bus Pirate PIC 24F Programmer Dev Thread

Reply #14
Here's a new version. It programs the main chunk of the bootloader with the p18write.script18 script. It doesn't do the whole thing yet, it needs to write the page with the jump instruction at 0x800, and the flash configuration bits in the last page.

We didn't really figure it out, this is more of a cheat. We could write a single page after entering ICSP, so we enter ICSP, write a page, exit ICSP, and then repeat, for each page. Maybe after an initial release someone will figure out how to make a better algo with the scripting abilities and we can update it for even better speed.

The app has these updates:
*Now sends 3bytes (full PIC command + data) to Bus Pirate at once for more efficient use of USB packets. Vast speed improvement.
*New Auto Mode tab will select PIC, load HEX, and program.
*New write script writes main bootloader chunk.
*Connect also inits the Bus Pirate for programming (power supplies enabled, etc)

If you just want to test it out, the readID from datasheet script will read the ID from the Bus Pirate chip without changing or erasing anything. The connection from the Bus Pirate to the OLS ICSP header is MOSI->PGD, CLK->PGC, CS->VPP, GND->GND. You can power the OLS from the USB cable, or connect the Bus Pirate 3.3volt supply to the OLS 3.3volt pin of the ICSP header.

This version requires the updated firmware I posted previously.
Got a question? Please ask in the forum for the fastest answers.