PCM Hammer P12 development

[darkman5001]

@Gampy - I appreciate the clarity. Thank you.

@NSFW - I also appreciate the info. I will see what I can come up with this weekend and try to figure out what chips the P10 and P12 PCMs have and report back. I will also try to capture some photos with my digital microscope to share.

Again I sincerely appreciate the information and clarity, and I hope I can contribute some helpful information.

[Gampy]

The processor is believed to be m68k based.
Flash is said to be a 512k AMD AM29BL802C.
edit: I do not know the age of the P10 or P12, however it stands to reason that if they were around before 2004, then they likely had the Intel chip then, 2004 and beyond would be AMD ...

The P12 also appears to be one of them that needs a mini loader kernel, it appears mode 36 does not have a submode 80.

However, it (and possibly others like the P04) may use something other then 80 for the Jump to location submode, that is something for those deep into the disassembly to find ...

Anyone have a P12 bin ??
Anyone disassembled it ??

A nice clear hires image of the board would be awesome ...

edit2: I (and I'm sure others) would appreciate the connector color code word for both the P10 and P12.

[kur4o]

Inside of a 2003 l6 4.2 pcm.

Uses 1mb chip but bin is 512kb, There is also some slave file $C000 size.
It looks like the second part of chip [upper 512kb bytes] are referenced in code, but can`t be read from memory. Maybe shared with other cpu or bankswitched somehow. The slave is also loaded somewhere. Starting at $10000 but again couldn`t figure yet where it is in memory layout.

A real dump of full chip will help alot how memory is organized.

SLave ram is at 80 00 00 address.

It can take multipart flash routines if they are between ffa000 and ffe000.
main cpu ID is 10
slave ID is 17
It also can take some slave flash routine that is loaded at ff8xxx and is max $600 bytes long. But seems unused with factory tools. Maybe some underground equipment ready.

Reading of 512kb bin part is easy. The main difference between ls1 reading is the COP, needs to keep slave quiet.
bset #7 at ff800806
bclr #7 at ff800806

[Gampy]

AWESOME!

Thank you very much kur4o, the community really appreciates your efforts!

So they are physically very different as well ...

[Tazzi]

What a funky looking little ECU!
What is the CPU number? if its identifiable?

[antus]

Im going to guess a 68k variant like all of the other VPW platforms. Would be good to confirm, though.

[B52Bombardier1]

And so much potting compound sprinkled around the board - it can only mean that this board runs hot in all of those places. They must be buying the stuff in railroad tank car amounts.

Rick

[Gampy]

IMO it's Thermal Paste and I agree they sure do pour it on when a little dab will do!

WatchDog is different I'm wondering if the DLC addresses are different as well ...
edit; Strike the following, don't know what I was thinking ... duh!

However the secret to that is you really do not need to setup the DLC for a test kernel, it is already done and you can just take it over.

Actually, I know what I was thinking, you do not need to initialize them, you still need them for access!

Sorry, we still need DLC addresses, there should also be another address for the WatchDog.
/edit

Wouldn't take much to do a test build and try, I don't have the hardware test on ...

[Gampy]

Have a test ready if anyone with a P12 on the bench is willing ...

[kur4o]

Before anyone testing.
Algo is $42 if you don`t already found it. And it uses non standard mode 34 requests.



request
6c 10 f0 34
response
6C F0 10 74 44

It checks later if the upload address is in range[ffa000-ffe000] and denies upload.