Dumping 93LC66B (3wire mode)

That looks like an weird one. You’ll need to check a pin level to see if it is in 8 or 16 bit mode

When the ORG* pin is connected to VCC, the (x16)
organization is selected. When it is connected to
ground, the (x8) organization is selected.

The Start bit is detected by the device if CS and DI are
both high with respect to the positive edge of CLK for
the first time.

DI must be high start

So it has a special start condition, and non divide by 8 word lengths

My recommendation is to use 2wire mode. It is high impedance, so use pull-ups. Then tie DO and DI together with a resistor as mentioned on datasheet section 2.2. Generate the start and op-code with bitwise commands, then read the bytes out with r:256 or whatever. It would be super similar to the SLE4442 tutorial.

I probably missed a LOT of nuance, just skimmed the datasheet.

We need to add a 3wire mode with bitwise operators as well. I’ve started hacking the 2wire PIO program.

I believe this should do it:

Summary
;
; Copyright (c) 2020 Raspberry Pi (Trading) Ltd.
;
; SPDX-License-Identifier: BSD-3-Clause
;
; Based on the PIO I2C example
.program hw3wire
.side_set 1 opt 
; TX Encoding:
; | 15:10 | 9     | 7:0  | 
; | Instr | X | Data | 
;
; If Instr has a value n > 0, then this FIFO word has no
; data payload, and the next n + 1 words will be executed as instructions.
; Otherwise, shift out the 8 data bits
;
; The Instr mechanism allows individual pin sequences to be programmed
; by the processor, and then carried out by the state machine at defined points
; in the datastream.
;
do_byte:
    set x, 7            side 0b0; Loop 8 times
bitloop:
    out pins, 1         [7] ; Serialise write data (all-ones if reading)
    nop             side 0b1 [6] ; SCL rising edge (was 2)
    in pins, 1             [7] ; Sample read data in middle of SCL pulse
    jmp x-- bitloop side 0b0 [7] ; SCL falling edge
    mov isr, null              ; Reset the input bit counter
public entry_point:
.wrap_target
    out x, 6                   ; Unpack Instr count
    jmp !x do_byte             ; Instr == 0, this is a data record.
    out null, 32               ; Instr > 0, remainder of this OSR is invalid
do_exec:
    out exec, 16               ; Execute one instruction per FIFO word
    jmp x-- do_exec            ; Repeat n + 1 times
.wrap

% c-sdk {
#include "hardware/clocks.h"
#include "hardware/gpio.h"
#include "pirate.h"

static inline void hw3wire_program_init(PIO pio, uint sm, uint offset, uint mosi, uint sclk, uint miso, uint32_t freq) {
    pio_sm_config c = hw3wire_program_get_default_config(offset);

    // IO mapping
    sm_config_set_out_pins(&c, mosi, 1);
    sm_config_set_in_pins(&c, miso);
    sm_config_set_sideset_pins(&c, sclk);

    sm_config_set_out_shift(&c, false, true, 16);
    sm_config_set_in_shift(&c, false, true, 8);

    //with delays, there are 32 instructions per bit IO
    //we should maybe reduce this to have more accuracy around 1MHz
	float div = clock_get_hz(clk_sys) / (32 * 1000 * (float)freq); 
	sm_config_set_clkdiv(&c, div);

    uint32_t pins = (1u << mosi) | (1u<<sclk) | (1u<<miso);
    uint32_t dir = (1u << mosi) | (1u<<sclk);

    //io pins to inputs
    //bus pirate buffers should already be configured
    pio_sm_set_pindirs_with_mask(pio, sm, dir, pins); //read pins to input (0, mask)    
    pio_gpio_init(pio, mosi);
    pio_gpio_init(pio, sclk);
    pio_gpio_init(pio, miso);

    // Configure and start SM
    pio_sm_init(pio, sm, offset + hw3wire_offset_entry_point, &c);
    pio_sm_set_enabled(pio, sm, true);
}

%}

1 Like

I pushed the basic install of the 3wire mode to a new branch 3wire. It is not working as of this moment.

2 Likes

This is awesome. I am hoping to use my new BP5 on a 93LC66B right now for a project.

I believe only the ‘C’ models (Ie. 93xx66C) requires checking the ORG pin. The non-‘C’ models are always 8-bit or 16-bit and can’t be changed.

If I recall correctly, the goofy thing about the Microwire chips is that the SI pin is sampled on the rising edge and the SO sampled on the falling. That and the CS is high versus low.

2 Likes

What are these odd chips used in that so many people encounter them?

Thanks for the tip about CS, I missed that yesterday.

@AreYouLoco figured this one out in the live chat yesterday, he has the B chip.

Mine is in APC Smart-UPS SMT750i. I just want to verify that EEPROM is ok. Which is most likely 90% chance.

1 Like

A new build with 3WIRE mode should be posted shortly. Please let me know if you need any help with the chip.

1 Like

So I’ve tried the command you mentioned in chat:

>-[^^^_^ 0x00]

And here is capture as screenshot:

Ok, I’m sorry, that wasn’t intended as an actual command. I did not read the datasheet, I just looked at the timing diagram. If that was successful you have erased the first byte of data :frowning:

Let me see how the chip works.

The 93XX66A/B/C powers up in the ERASE/WRITE
Disable (EWDS) state. All Programming modes must be
preceded by an ERASE/WRITE Enable (EWEN) instruc-
tion. Once the EWEN instruction is executed, program-
ming remains enabled until an EWDS instruction is
executed or Vcc is removed from the device.

Yeah, it has a safety latch.

So first op code for read and then what bits? Or something

  • -[^ (START BIT: data high -, cs high [, one clock ^)
  • ^_^ (OPCODE: another 1 bit ^, data low _, a 0 bit ^)

This should get it into read mode, now we need to send the address to start reading from.

You have the B chip with 16bit words, so the address is actually just a byte.

  • 0x00 Send the read start address.
  • r:512 the datasheet say this is 256x16 eeprom, so we need to read 512 8 bit bytes to get it all.
  • ] Lower CS again.

-[^^_^ 0x00 r:512]

This should be the full sequence to dump the chip.

All zeros. I am not sure if I hook it up correctly now…

Let’s see the logic analyzer output to confirm the commands.


And the rest of the output is just zeros. Let’s hope again it was not OPcode to ERAL :smiley:

CS isn’t moving. Trace 4 should show CS move from low to high [ and then low ] at the end (which will happen after the LA buffer is full is dumping the full chip).

  • Check CS setting for 3wire mode, for my syntax above it should be CS active HIGH
Mode > 8

Use previous settings?
 Speed: 2048 kHz
 Chip select: Active HIGH (CS) 

y/n, x to exit (Y) > 

Logic analyzer speed: 16384000Hz (8x oversampling)
Use the 'logic' command to change capture settings

Better screenshot of the begining:

Ah, ok, thank you.

Drop the frequency to 100khz.

I would also verify the pin connections at this point, especially the DI and DO pins which might be swapped.

Enable the pull-up resistor, then watch for the DO line to go low during the last address bit. This seems to be an ACK of sorts.

It looks like you have pull-ups enabled though, and MISO is stuck low. That might suggest a hook-up issue. Try to run without the MISO wire attached to confirm the pin pull-up is working (MISO should be high).

MISO high without connecting. I double checked and DI was MOSI and DO was MISO. Now without MISO connected I just get all the way 0xFF’s

1 Like

Looks like there is also a rotated package version.

1 Like

Right now its hooked up PDIP/SOIC not rotated. Rewiring…

1 Like