USB BDM NT

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
Post Reply
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: USB BDM NT

Post by antus »

I dont know. We didnt get any of these in my country (AU), instead we had the Delco ECMs and PCMs which run ALDL and are based on the the older P4 and turned in to IPCM6 https://www.whichcar.com.au/features/39 ... ssie-byter

I get the impression the P04 family started in 1993 and went through several generations as it evolved see below) but Im not sure at which point they technically became P04. I suspect were talking the 98-05 PCMs but I cant say for sure. This is uncharted territory for me.

I have been told:
93-95=64KB
94-96=128KB-256KB
97=256KB
98-05=512KB
04-06=1MB
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
DavidBraley
Posts: 172
Joined: Thu Jun 07, 2018 8:15 am
cars: 1948 GMC
Location: Fort Collins, Colorado

Re: USB BDM NT

Post by DavidBraley »

OK, I've started searching for microprocessor pins I can ignore on the P08 PCM (for the 4 bangers) simply because it has a 160 Pin processor and a 90 pin header on the board, similar to the P01 and P59.

As of this moment, I have eliminated 142 out of 160 pins. 18 pins to look at closer. Patterns are starting to show up.

Something interesting I discovered:

EDIT

It seems most of the 512K flash pins are accessible from the P08 PCM 90 pin header. If I add VPP, VCC, and Ground, it totals 42 pins. The package is only 44. Did the factory by any chance program the flash on the assembly floor bypassing the processor? I'm going to investigate if the flash chip can be programmed directly via the 90 pin header, bypassing the need for the BDM...

But right now my head is going to explode. So I'm going to step away from this for a couple of days...
-David

I'm a machinist... because engineers need heroes too.
User avatar
DavidBraley
Posts: 172
Joined: Thu Jun 07, 2018 8:15 am
cars: 1948 GMC
Location: Fort Collins, Colorado

Re: USB BDM NT

Post by DavidBraley »

Down to 11 pins out of 160 on the P08 PCM (4 too many). These are microprocessor pins that go directly to the 90 pin header and no where else on the circuit board (to the best of my hunting skills). They are microprocessor pins:

68, 75, 81, 91, 92, 93, 94, 99, 129, 130, and 131. I fee strongly that the 7 BDM pins are in this group. Some of the patterns found on the P01/P59 are there.

I've looked at the datasheets for the:

MC68302, MC68303, MC68304, MC68306, MC68330, MC68331, MC683322, MC68333, MC68334, MC68336, MC68375, MC68376, MC68340, and MC68341. I'll keep looking for different flavors.

None of these datasheets so far show any of the BDM pins at the correct locations for both the known P01/P59 BDM locations and the 11 pins I've found on the P08. This supports what I've read about big manufactures getting their silicon made with different pin assignments. At this point, I don't feel comfortable experimenting with random connections on the P08 between the microprocessor and the BDM. I need to think about how to proceed with this P08 PCM...

I'm also reading that you can? and can't? (unable to find a definitive answer) program a parallel flash eeprom directly, like you would with an eeprom programmer, while it's pins are connected to a microprocessor. If anyone on this forum knows the answer, please chime in. I'm still very curious why the flash pins are accessible from the 90 pin header.

What I'm going to do now is see if I can find a similar "ONLY" 11 pins between the microprocessor and the 90 pin header on the P01 PCM, and no where else on it's circuit board. Maybe that would expose some more patterns that would help me find the BDM pins on the P08 PCM. I'm also going to see if the needed flash eeprom pins for programming are also accessible from the P01 90 pin header.

Sorry for the length, and I hope most of this made sense...
Last edited by DavidBraley on Mon Jan 20, 2020 7:24 am, edited 1 time in total.
-David

I'm a machinist... because engineers need heroes too.
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: USB BDM NT

Post by Vampyre »

stepping away for a few days is always a good thing to process. Ive stepped away a few myself from the p04 to figure out how to integrate all the ctsv dash electronics into my fiero
User avatar
Gampy
Posts: 2331
Joined: Sat Dec 15, 2018 7:38 am

Re: USB BDM NT

Post by Gampy »

What BDM config is used for writing an Intel 1m chip??

ID'ing the chip always reports Unknown flash type, report these values to <bla bla bla> 89,889D.
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: USB BDM NT

Post by antus »

I think you should be able to do the intel 1mb using a method similar to what was done with the amd. That is load the 512kbyte config and then configure the 1mbyte chip id and bank offsets by hand.

I think the flash pins are also the bus pins, so they could have been used for monitoring the bus and accessing any device on the bus in development.

I think this zip file contains the information for the SOC package that was used on the PCMs. If you want to search datasheets, its probably worth a look. https://www.nxp.com/products/processors ... eet&fpsp=1

Also the pinsouts here might be worth a check. Not sure if its the same as one you have already checked. https://www.nxp.com/docs/en/data-sheet/MC68331UM.pdf
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Fixed until broken
Posts: 43
Joined: Fri Jan 24, 2020 12:44 pm
cars: 2002 GMC Sierra
Contact:

Re: USB BDM NT

Post by Fixed until broken »

Has anyone tried any of the really cheap BDM tools out of china like the Freescale USBDM Emulator? I've had some success with tools like that in past like the old Segger knock offs but I've also got some that don't work. Anyone get a cheap one that worked?
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: USB BDM NT

Post by NSFW »

With other products you might need to create the configuration yourself. That was the missing piece that made AMD P59 support so hard, even though we had the Intel P01 configuration to give us a head start.

You could probably copy the info from the existing XML files, but it looks like it would be hard to troubleshoot if you don't get it right the first time.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
Fixed until broken
Posts: 43
Joined: Fri Jan 24, 2020 12:44 pm
cars: 2002 GMC Sierra
Contact:

Re: USB BDM NT

Post by Fixed until broken »

NSFW wrote:With other products you might need to create the configuration yourself. That was the missing piece that made AMD P59 support so hard, even though we had the Intel P01 configuration to give us a head start.

You could probably copy the info from the existing XML files, but it looks like it would be hard to troubleshoot if you don't get it right the first time.
I just went with both 1 cheap one from china and one of the usbjtag ones coming out of Canada. Can't hurt to have 2 right? haha
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: USB BDM NT

Post by antus »

The problem isnt the hardware interface, its the software. The USBBDMNT XML files and software define data thats send to the processor which sets up the hardware external to the processor so that it can be stopped. if you look in the XML you'll see addresses and data bytes. You need to write that data to those addresses to intialise the PCM so no on board hardware trips up the flash process. You can look at the software you are planning to use with the other interfaces and see if it allows you to setup an equivalent. If it does, you should be able to transfer the data from the usbbdm nt files.

This is the normal file for the AMD flash - nothing new here. But Im posting it in a code block so you can see what I'm talking about with the addresses and data in it. I dont exactly understand if this is code that runs on the cpu, or writes to registers, or I think it could be a bit of both. I dont recognise the flash process magic numbers in here but it could be an AMD specific routine, not using the intel style compatibility we and GM used in their flash kernels and which I am familiar with. The INIT commands looks like they are writing to hardware registers, probably disabling the watchdog.

Code: Select all

<Test>
	<Name>ECU4111M</Name>
	<Cat>Other</Cat>
	<Protocol>BDM</Protocol>
	<Endian>Big</Endian>
	<Programram>0xE90000</Programram>
	<Speed>1</Speed>
	<sprogram>1</sprogram>
	<Memorys>
			<Memory>
				<Name>Code</Name>
				<Type>1</Type>
				<Address>0x0</Address>
				<Size>0x100000</Size>
			</Memory>
	</Memorys>
	<Inits>
			<Init>
				<Address>0xFFFB04</Address>
				<Value>0xFC00</Value>
				<Bytes>2</Bytes>
			</Init>
			<Init>
				<Address>0xFFFB44</Address>
				<Value>0xFFFFF800</Value>
				<Bytes>4</Bytes>
			</Init>
      <Init>
        <Address>0xFFFB84</Address>
        <Value>0xFFFFF900</Value>
        <Bytes>4</Bytes>
      </Init>
    <Init>
      <Address>0xFFFA84</Address>
      <Value>0xFFFFFA00</Value>
      <Bytes>4</Bytes>
    </Init>
    <Init>
      <Address>0xFFFAC4</Address>
      <Value>0xFFFFFB00</Value>
      <Bytes>4</Bytes>
    </Init>
    <Init>
				<Address>0xFFFB40</Address>
				<Value>0x0200</Value>
				<Bytes>2</Bytes>
			</Init>
    <Init>
      <Address>0xFFFB80</Address>
      <Value>0x0200</Value>
      <Bytes>2</Bytes>
    </Init>
    <Init>
      <Address>0xFFFA80</Address>
      <Value>0x0200</Value>
      <Bytes>2</Bytes>
    </Init>
    <Init>
      <Address>0xFFFAC0</Address>
      <Value>0x0200</Value>
      <Bytes>2</Bytes>
    </Init>
<Init><Address>0xFFFA00</Address><Value>0xC1C1</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA04</Address><Value>0x400C</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA11</Address><Value>0x30</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA15</Address><Value>0xFC</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA17</Address><Value>0xF3</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA19</Address><Value>0xE0</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA1D</Address><Value>0xF6</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA1F</Address><Value>0x08</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA21</Address><Value>0x84</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA38</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA41</Address><Value>0x27</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA44</Address><Value>0x00AF</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA48</Address><Value>0x0007</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA4A</Address><Value>0x6820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA4C</Address><Value>0x0007</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA4E</Address><Value>0x7060</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA50</Address><Value>0xFFE0</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA52</Address><Value>0x3BE0</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA54</Address><Value>0xFFD0</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA56</Address><Value>0xD820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA58</Address><Value>0xFFE8</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA5A</Address><Value>0xD820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA5C</Address><Value>0xFFB3</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA5E</Address><Value>0x7BC1</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA60</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA62</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA64</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA66</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA68</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA6A</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA6C</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA6E</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA74</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA76</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA70</Address><Value>0x4004</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA72</Address><Value>0x7870</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA70</Address><Value>0x4003</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA72</Address><Value>0x7830</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA46</Address><Value>0x00C1</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB00</Address><Value>0x0100</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB40</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB44</Address><Value>0xFFFF8000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFB40</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB80</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB84</Address><Value>0xFFFF9000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFB80</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA80</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA84</Address><Value>0xFFFFA000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFA80</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFAC0</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFAC4</Address><Value>0xFFFFB000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFAC0</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC00</Address><Value>0x0082</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC04</Address><Value>0x00</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC05</Address><Value>0x40</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC08</Address><Value>0x005C</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC0A</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC15</Address><Value>0xF8</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC16</Address><Value>0x7F</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC17</Address><Value>0xFE</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC18</Address><Value>0x8005</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC1A</Address><Value>0x0602</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC1C</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC1E</Address><Value>0x00</Value><Bytes>1</Bytes></Init>
  </Inits>
</Test>
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Post Reply