Reading eeprom from delco PCM, MC68336 based

[j_ds_au]

The most common problem I've seen caused by static is increased threshold voltage of P-channel MOSFETs, so they no longer switch on with normal voltage levels. More drastic damage depends on how high the zap, the dV/dt and what series impedance is in the discharge path.

Anyway, two more thoughts :
- Keep your mobile phone, etc. well away.
- If you do multiple reads and get the same data, then the marginal Vih level isn't giving you garbled data.

Joe.

[iblackford]

So I got my USBDM today, I hooked it up...it cannot detect my type of flash. This is to be somewhat expected as I think others use a 28f400, instead of a 28f800. I can comfirm that something is happening, some registers like USP, RPC, etc, but it just can't detect the flash. I would appreciate any help folks can provide who have used this tool before. There is talk of a custom xml file, but I don't know how to start with it...yet. Here is what I know:

-When I read the FREEZE line goes high, which from what I have read indicates the device is in BDM mode.
-DSO, DSCLK, and DSI all toggle as they should.

[antus]

I dont think you can write the flash over BDM as the implementation is custom, but you should be able to read it on a booted and running system by reading address range 0->512kb (not flash chip specific). If you do that then post up the bin.

[iblackford]

Here goes nothing...I think I read more than is needed, but you can ignore the higher order addresses...

[VL400]

Read and write XML is here .. http://www.usbjtag.com/jtagnt/ecu411/index.php

[antus]

Good link, VL!

iblackford, that looks like a good read, but the pcms mapping or architecture looks more different to the '0411 than i'd hoped. There is no boot vectors at the bottom of the address space to begin with and some of it looks like junk data, but it does look like your calibration and code is in there.

edit: I think the flash might start at 0x00016A6E, with a boot vector of 0x81000. Though Im not sure of the alignment. But that string of similar 32 bit numbers DO like an vector table.

[iblackford]

Oh poop.

How to tell that my calibration data is there?

I'm looking through the 0411 XML right now, trying to figure it out. Can anyone enlighten me about the architecture of the 0411? 16bit data bus as well, or is it 8bit (from what I have read there is support an 8bit).

Ivan

[antus]

This looks like code after the vector table. These repeated opcodes are easy to spot and are often used for timing loops.

Code: Select all

                                                                          
0x00017460 | 00 11 00 00 28 7C 00 FF FA 00 4E 71 4E 71 4E 71 | ....(|....NqNqNq 
0x00017470 | 4E 71 4E 71 4E 71 4E 71 4E 71 4E 71 4E 71 4E 71 | NqNqNqNqNqNqNqNq 
0x00017480 | 4E 71 4E 71 4E 71 4E 71 4E 71 19 47 00 27 19 46 | NqNqNqNqNq.G.'.F 

some kind of ID here, may also be the passlock your looking for, or may just be a header and part number.

Code: Select all

                                                                          
0x0001A970 | 3F 5D 30 54 38 36 07 D1 16 18 03 03 A7 0D 31 33 | ?]0T86........13 
0x0001A980 | 31 30 41 36 39 48 01 40 D1 60 FF FF FF 30 FF FF | 10A69H.@.`...0.. 

some kind of header. release 2.0 code booz? maybe.

Code: Select all

                                                                          
0x0001AA60 | 52 32 2E 30 62 6F 6F 7A FF FF FF FF FF FF 4D 46 | R2.0booz......MF 

another R2.0 booz header (there are several more, too)

Code: Select all

                                                                          
0x00032460 | C6 87 52 32 2E 30 62 6F 6F 7A FF FF FF FF FF FF | ..R2.0booz...... 
0x00032470 | 4D 46 53 2A 00 3F FF FF FF FF FF FF 1F FF 00 01 | MFS*.?.......... 

This might or might not be calibration data. The runs of numbers look potentialy sequential, eg
AA AA AA AA 98 86 91 8D but its hard to say. This is just from a quick skim over.

Code: Select all

                                                             
0x0001AC90 | B7 3D 01 00 AB 22 00 00 00 03 B7 3D 16 01 00 ED | .=...".....=.... 
0x0001ACA0 | CF 6D 00 00 07 08 07 17 00 00 00 00 00 00 00 00 | .m.............. 
0x0001ACB0 | 00 00 00 00 00 00 00 00 00 00 09 C3 62 62 89 89 | ............bb.. 
0x0001ACC0 | 8F 88 90 88 77 92 7F 8E 75 95 80 80 AA AA AA AA | ....w...u....... 
0x0001ACD0 | AA AA AA AA 98 86 91 8D 90 90 00 00 10 D2 7E 89 | ..............~. 
0x0001ACE0 | 01 08 FF FF FF C4 01 00 00 02 00 00 00 00 00 00 | ................ 
0x0001ACF0 | 01 18 00 03 B7 3D 01 00 AB 22 00 00 00 03 B7 3D | .....=...".....= 
0x0001AD00 | 17 01 00 ED CF 6D 00 00 07 02 07 08 07 13 07 17 | .....m.......... 
0x0001AD10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 2B | ...............+ 
0x0001AD20 | 62 62 89 89 8F 88 90 88 77 92 7F 8E 75 95 80 80 | bb......w...u... 
0x0001AD30 | AA AA AA AA AA AA AA AA 98 86 91 8D 90 90 00 00 | ................ 
0x0001AD40 | 10 D2 7E 8B 01 0A FF FF FF C4 01 00 00 03 00 00 | ..~............. 
0x0001AD50 | 00 00 00 00 00 21 00 03 B7 3D 01 00 AB 22 00 00 | .....!...=...".. 
0x0001AD60 | 00 03 B7 3D 18 01 00 ED CF 6D 00 00 05 72 07 02 | ...=.....m...r.. 
0x0001AD70 | 07 08 07 13 07 17 00 00 00 00 00 00 00 00 00 00 | ................ 
0x0001AD80 | 00 00 09 AC 62 62 89 89 8F 88 90 88 77 92 7F 8E | ....bb......w... 
0x0001AD90 | 75 95 80 80 AA AA AA AA AA AA AA AA 98 86 91 8D | u............... 

I might pay to keep poking around in the address space and see what you can find. Maybe read up to 1mb.

[antus]

'0411 processor is a 32 bit data bus, but only 24 bits are connected (high byte ignored, which causes some annoyance when cross referencing in IDA). The flash is mapped to 0x00000000.

[iblackford]

Hmm...32bit databus but only 24 connected? Now I'm really confused..the EEPROM's have at most a 16bit databus I think, with an 8bit option if you hold the BYTE line low.

What external inputs does it use to know what the boot vector is? I know the ADDR0 pin is not connected to the EEPROM...I learned this in my ohming out...the ADDR1 and up are connected, and not swapped from what I could tell.

Ivan