Milksop by andy@warmcat.com  A device to reprogram TSOP flash chips  without requiring device removal or any soldering.
Note   This project is successfully completed and  I have now flashed my system over a  100 times without problems.

Scope 

Milksop is a small (2.25" x 3") device designed to:

• read and reprogram a generic 40-pin TSOP flash chip (such as that used by the Microsoft X-Box¹) without requiring any soldering or, in the case of the X-Box, removal of the motherboard. 

• be able to communicate with the X-Box LPC Bus and to be able to make flash memory (programmable from a PC) appear there

The intention is to facilitate rapid and repeatable changes to the content of the flash to allow new code to be tried easily.  It is hoped it will be of some use to people looking to boot linux on an X-Box.

The design schematics, gerbers and C & VHDL sources are being released under the GPL, others are encouraged to duplicate our design when it is proven.  However, as with all GPL projects, no warrenty at all is given about the performance of this design.

Overview

As you can see Milksop has three main interfaces:

•  a PC Printer Port, 

•  a TSOP test adapter clipped over the flash (in the case of the X-Box,  if you cannot afford ~$300 and a four-week wait for one of these, a set of wires to the X-box testpads well documented elsewhere.), 

•  and an LPC header.
  

There are in turn three main modes it is expected to find a use:

1) The printer port can be used to program the flash on the Milksop (top arrow) (working 2002-06-16)
2) The printer port can be used to program the flash on a host motherboard via the TSOP header (middle arrow) (working 2002-06-16)
3) The flash on the Milksop can be read and written by the LPC port  (up-down arrow) (working 2002-06-17)

In addition there are some handy features like automatic X-Box power cycling after updating the flash, useful for software developers.

Principles

In-system flash programming

For generic devices using TSOP flash, it is usually possible to get the rest of the devices on the bus to float their IO, either during reset or by applying appropriate levels to test pins or output enables.  Milksop is generally useful in cases where there is no provision to allow flashing via the normal bus master (ie, you can't get the device CPU to do the flashing for you).

Milksop is powered entirely from the TSOP device being programmed, not only is Milksop intended to be used without removing the device, but it is intended that the device is powered. 

Important note:  Milksop must not be removed from the device it is programming while power is applied. 

Flash device endurance

A typical modern flash device is rated for at least 100,000 erase/write cycles.  That's probably more edits than you have time to test :-)  For practical purposes you can send edited code to your device as many times as you like.

See the X-Box specific page for information on that platform.

Implementation

Physcial hardware

Milksop uses a Xilinx XC95108 CPLD in a PQ100 package.  This contains all of the logic.  The other devices are there for signal conditioning of the printer port communications.

Partslist

PCB

The PCB is plated through hole and measures 2.25" x 3".

• Here is a PDF showing the individual layers <-- UPDATED 2002-06-11
• Here is a ZIP of the gerber files and drill files suitable for manufacture <---- UPDATED 2002-06-11

Post Prototype 1 ECN (Engineering Change Notices)

CPLD Logic

The logic to communicate with the flash using the flash protocol is contained within the CPLD.  The reasoning behind this is that the alternative, operating the flash protocol from the PC, would be extremely slow given the relatively slow maximum safe operating speed of the parallel port and the relative complexity of the protocol.  With the protocol managed by the CPLD, it requires only one printer port byte transfer to write each byte.  The total chip erase/program and readback/verify time is 45Sec for a 1Mbit chip.

Forcing/PC interface mode logic 

• The state machines to manage the flash read, write and erase protocols are written in VHDL.   <---- UPDATED 2002-06-16 
• There is also a UCF associated with this that contains the fixed pinouts.   <---- UPDATED 2002-06-16
• Here is the compiled JEDEC file ready to program into the CPLD.  <---- UPDATED 2002-06-16

LPC mode logic

• VHDL
• UCF
• JEDEC
  

The CPLD Jtag connector has the following pinouts:

Programming app

A small commandline application performs the read, erase and write actions.

Linux version

Binary RPM (installs linuxmilk to /usr/bin) <--- UPDATED 2002-06-25
Sources <--- UPDATED 2002-06-25

If you wish to compile the sources, you will also need to download and install the latest linux wxwindows library from http://www.wxwindows.org

Windows version

Milk.exe  <--- UPDATED 2002-06-25
NTIOSUPP.DLL (needed for milk.exe)

Here is the VC++ project, note it requires Microsoft Visual C++ 6 to compile. <--- UPDATED 2002-06-25

If you wish to compile the sources, you will also need to download and install the latest win32 wxwindows library from http://www.wxwindows.org

Recommended build and test sequence

Sequence of operations to program in-system flash

1) Make sure the host  0V has a low impedence path to Earth Ground.  If your host has a floating ground, like the X-Box, then you will destroy the milksop and/or your PC if you do not connect the host chassis to earth ground first.  Your PC chassis, or the Earth pin of your power plug are good sources of true Earth ground.  If you will be doing more than one host with this problem, I recommend connecting a sprung-loaded clip up to a mains plug Earth so you can easily ensure safety.  If the above does not make any sense to you, stop what you are doing and find someone knowledgeable who can explain it to you.  If you have access to an Oscilloscope, you can observe the problem by touching your scope probe to the ungrounded chassis of an X-Box and looking at the 50V p-p sine wave you see in front of you.

2) For the X-Box host, hold D0 of the flash databus to 0V and power up the X-Box.  It will reset twice and on the third time stay up.  You must then release D0 from ground.  You can access the D0 pin from the connector that goes out to the TSOP clip.

3) Run milk.exe, something like this:  milk --program myfile.bin  This will first test that the flash can be communicated with by getting its manufacturer ID and device type, and if successful will erase, program and read back the contents of the device.  If milk.exe cannot detect the manufacturer ID then you have a wiring or power problem.

4) Power down the machine, remove the TSOP clip, leave the Earth Ground connection if any for safety.  Repower the host and it will be executing the new code.

Progress 2002-06-17

Credit

The amazing work of Bunnie, and folks like visor gives me encouragement with this project.  Also the paid-for hackers (I believe it is Raptor and hdl) deserve a mention for their sheer hacking skills when they were the only people toiling up the mountain.  Paul Bartholomew's emails have been a great help too.  I salute all you people who do not give up, and make your hopes reality through sheer persistence.

¹X-Box is a registered trademark of Microsoft Corporation, nothing to do with us.