PCM Hammer P12 development

[antus]

the pcmhammer read here passes checksum tests and we know where it came from so I think it'd be a good bin to work from. viewtopic.php?f=42&t=7742&start=210#p114734

[Gampy]

Getting close, doing pre write testing ...

Read test just failed CRC and I'm a little lost with that, it's already worked multiple times!

So I've ask for a Verify Entire PCM ... Against the "P12 test 2.bin" pulled with PCMhammer, waiting on it now.

[antus]

heres a vats disabled bin I made from that file.

[Gampy]

Edit;
delete, bad choice of words ...

Ruh Row, another brick in the wall!

For a better choice of words,

Ruh Row, a bump in the road ...

[06:19:27:380] PCM Hammer - P12 ONLY TEST Build 824.9.1.A darkman5001 (3/3/2022, 4:39 PM)
[06:19:27:380] Initializing J2534 Device
[06:19:27:395] Loaded DLL
[06:19:27:818] Connected to the device.
[06:19:27:833] Battery Voltage is: 13.144
[06:19:27:849] Protocol Set
[06:19:27:864] Device initialization complete.
[06:19:42:911] M:\GM IMMO Testing\VPWExplorer\PCM Hammer Test\P12 test 2.bin
[06:19:42:958] Validating 1024k file.
[06:19:42:958] This file does not contain the expected signature at 0x1FFFE.
[06:19:42:958] Start End Stored Needed Verdict Segment Name
[06:19:43:020] Checksum table is corrupt.
[06:19:43:036] This file is corrupt. It would render your PCM unusable.

[antus]

how is that a brick? file damage on the pc yes, maybe on the pcm, but if it has a boot sector on the flash it should not be a brick? and pcmhammer writes top down so it has to be working before it gets to the boot sector. and your only doing cal write at the moment while your getting it stable? even better dont include the flash OS segments in the chip definition in pcmhammer at this stage, just have one single segment enabled and do your testing there.

[Gampy]

My bad ... That's not what I meant!

Bad choice of words without thinking ... I was thinking like a hurdle.

Edit;
There is no write capability enabled yet ...

[Gampy]

So the latest tests are failing the CRC testing after reading now that there is a Sector Layout Map.

Yea, I could skip this and move on with the Write testing ... NOT GONNA HAPPEN!

One step at a time, if it's broke, FIX IT, then move on ...

So, the long log short of it is,

[05:21:48:334] Unable to get CRC for memory range 000C0000 / 00040000
[05:21:50:497] Unable to get CRC for memory range 00080000 / 00040000
[05:21:52:294] 060000-07FFFF 15D1575A 15D1575A Same OperatingSystem
[05:21:54:097] 040000-05FFFF A2DFACB0 A2DFACB0 Same OperatingSystem
[05:21:55:894] 020000-03FFFF C80F2468 C80F2468 Same Calibration
[05:21:57:254] 008000-01FFFF BD4C3D8E BD4C3D8E Same Calibration
[05:21:57:410] 006000-007FFF C08B1F1F C08B1F1F Same Parameter
[05:21:57:567] 004000-005FFF 85B5BB36 85B5BB36 Same Parameter
[05:21:57:817] 000000-003FFF 7EBCD52C 7EBCD52C Same Boot

Hmm, can't do the 256kb sectors, so either the kernel is choking on them or PCMHammer gets tired of waiting ...
Ultimately it gets the others, so I suspect PCMHammer gets tired of waiting ...

Maybe I'll pull out my trusty Colonel.c, adjust it to P12, and see what happens ... It does the CRC different and is much faster.

[Gampy]

These PCM Hammer reads do not have 4A FC at 0x01FFFE as expected ... Causing PCM Hammer to fail with,

[05:45:17:500] This file does not contain the expected signature at 0x1FFFE.
[05:45:17:516] Start End Stored Needed Verdict Segment Name
[05:45:17:516] Checksum table is corrupt.
[05:45:17:516] This file is corrupt. It would render your PCM unusable.

I suspect this is a design difference ...

[antus]

Yep I cant see anything in the file that looks equivalent. I suspect GM stopped using that method to mark segments as programmed, perhaps they moved to using the checksums instead, something else, or they just dont do it at all anymore. Which makes me wonder how it would recover from a bad flash. Perhaps it doesnt? I guess the test would be to disassemble the boot code and see what it checks for to make the decision about sending programming prompts or jumping to the main OS.

[antus]

annotations are mine, and may not be correct, but it looks like it checks these early in the boot process before jumping to the main OS, or not.

I think its looking for AA55 or FFFF to return success. Not sure why both. More investigation required. For now perhaps looks for the AA55 at FFFF8 for a good file? It does look like its intended as a canary in the file, and if we find files where that is not true we can keep digging.

Code: Select all

ROM:00003284                                         ; =============== S U B R O U T I N E =======================================
ROM:00003284
ROM:00003284
ROM:00003284                                                         global check_programmed ; weak
ROM:00003284                                         check_programmed:                       ; CODE XREF: sub_34E8↓p
ROM:00003284 4EB9 0000 3640                                          jsr     (check_AA55_at_FFFF8).l ; magic number AA55 at FFFF8
ROM:0000328A 4A40                                                    tst.w   d0
ROM:0000328C 670E                                                    beq.s   loc_329C
ROM:0000328E 4EB9 0000 3654                                          jsr     (check_FFFF_at_FFFFA).l ; check FFFF at FFFFA
ROM:00003294 4A40                                                    tst.w   d0
ROM:00003296 6704                                                    beq.s   loc_329C
ROM:00003298 7001                                                    moveq   #1,d0
ROM:0000329A 6002                                                    bra.s   locret_329E
ROM:0000329C                                         ; ---------------------------------------------------------------------------
ROM:0000329C
ROM:0000329C                                         loc_329C:                               ; CODE XREF: check_programmed+8↑j
ROM:0000329C                                                                                 ; check_programmed+12↑j
ROM:0000329C 7000                                                    moveq   #0,d0
ROM:0000329E
ROM:0000329E                                         locret_329E:                            ; CODE XREF: check_programmed+16↑j
ROM:0000329E 4E75                                                    rts
ROM:0000329E                                         ; End of function check_programmed