PCM Hammer P12 development

[Gampy]

I just sent darkman5001 the following ...

Go ahead, hit that Test Write button, I know you're waiting to ...

Send me both logs ...

[Gampy]

Oh-boy, Oh-boy, Oh-boy ...

Getting interesting looking!

[06:08:32:882] PCM Hammer - P12 ONLY TEST Build 824.9.1.E darkman5001 (3/5/2022, 10:39 AM)
[06:08:32:892] Initializing J2534 Device
[06:08:32:911] Loaded DLL
[06:08:33:034] Connected to the device.
[06:08:33:038] Battery Voltage is: 13.159
[06:08:51:677] M:\GM IMMO Testing\VPWExplorer\P12-Test 3.bin
[06:08:51:712] Validating 1024k file.
[06:08:51:715] Requesting operating system ID...
[06:08:51:783] PCM and file are both operating system 12606400
[06:08:51:907] Unlock succeeded.
[06:08:51:926] Attempting switch to VPW 4x
[06:08:51:970] Module 0x10 (engine controller) has agreed to enter high-speed mode.
[06:08:56:168] Requesting permission to upload kernel.
[06:08:56:192] Upload permission granted.
[06:08:56:616] Kernel upload 21% complete.
[06:08:57:110] Kernel upload 47% complete.
[06:08:57:603] Kernel upload 73% complete.
[06:08:58:099] Kernel upload 100% complete.
[06:09:00:234] Kernel Version: 8240AABB
[06:09:00:237] Kernel uploaded to PCM succesfully.
[06:09:00:253] PCM and image file are different operating systems.
[06:09:00:256] But we'll ignore that because this is just a test write.
[06:09:00:275] Flash chip: AMD AM29BL802C, 1mb
[06:09:00:282] Calculating CRCs from file.
[06:09:00:292] Initializing CRC algorithm on PCM, this will take a minute...
[06:09:00:328] Requesting CRCs from PCM.
[06:09:00:332] Range File CRC PCM CRC Verdict Purpose
[06:09:00:337] 0C0000-0FFFFF not needed not needed n/a OperatingSystem
[06:09:00:342] 080000-0BFFFF not needed not needed n/a OperatingSystem
[06:09:00:347] 060000-07FFFF not needed not needed n/a OperatingSystem
[06:09:00:354] 040000-05FFFF not needed not needed n/a OperatingSystem
[06:09:02:247] 020000-03FFFF C80F2468 C80F2468 Same Calibration
[06:09:03:792] 008000-01FFFF BD4C3D8E BD4C3D8E Same Calibration
[06:09:03:800] 006000-007FFF not needed not needed n/a Parameter
[06:09:03:809] 004000-005FFF not needed not needed n/a Parameter
[06:09:03:819] 000000-003FFF not needed not needed n/a Boot
[06:09:03:829] Beginning test.
[06:09:03:840] Processing range 020000-03FFFF
[06:09:03:851] Pretending to erase.
[06:09:03:861] Pretending to write...
[06:09:40:832] Processing range 008000-01FFFF
[06:09:40:843] Pretending to erase.
[06:09:40:852] Pretending to write...
[06:10:08:675] Calculating CRCs from file.
[06:10:08:693] Initializing CRC algorithm on PCM, this will take a minute...
[06:10:08:733] Requesting CRCs from PCM.
[06:10:08:742] Range File CRC PCM CRC Verdict Purpose
[06:10:08:753] 0C0000-0FFFFF not needed not needed n/a OperatingSystem
[06:10:08:765] 080000-0BFFFF not needed not needed n/a OperatingSystem
[06:10:08:777] 060000-07FFFF not needed not needed n/a OperatingSystem
[06:10:08:789] 040000-05FFFF not needed not needed n/a OperatingSystem
[06:10:10:612] 020000-03FFFF C80F2468 C80F2468 Same Calibration
[06:10:11:988] 008000-01FFFF BD4C3D8E BD4C3D8E Same Calibration
[06:10:12:001] 006000-007FFF not needed not needed n/a Parameter
[06:10:12:017] 004000-005FFF not needed not needed n/a Parameter
[06:10:12:032] 000000-003FFF not needed not needed n/a Boot
[06:10:12:047] Test write complete.
[06:10:12:064] All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[06:10:12:079] We're not sure how much retrying is normal for a write operation on a 1024kb PCM.
[06:10:12:094] Please help by sharing your results in the PCM Hammer thread at pcmhacking.net.
[06:10:12:158] Clearing trouble codes.
[06:10:13:232] Elapsed time 00:01:21.3214165

Hmm ... What's next!

[Gampy]

darkman5001,

Your last PM to me was: I have Antus's bin. What you thinking?

This is what I'm thinking ...

It's up to you, but I gave you an Easter Egg!

I am not going to tell you to do this, only tell you the capability is there, and that it is UNTESTED.

In that test version of PcmHammer, if you put the point of your mouse on the 'e' in Operations and click ... The Write Calibration button will come alive!

Writing Calibrations are the safest Write, if it goes bad there is likely a recovery technique ... We just don't know much about this unit ATM as you well know!

You know it's untested, it's your risk ... It's completely up to you to use it!

If it were me, and it was mine, and it was not my get me to work in the morning car ... I wouldn't hesitate.
It's not mine, it's yours, I have to respect that!

If you do chose to take the risk,
1. use Antus's 'no vats' bin file, PcmHammer will not write a no change file.
. . If it's NOT successful DO NOT REMOVE POWER FROM THE PCM, immediately send me logs / screen shots, or whatever captures the error.
. . And wait for me to respond ... I'll be available.
If you get here it must of been successful so,
2. Save both logs.
3. Exit PcmHammer
4. Disconnect All Power from PCM
5. Allow to sit for at least 30 seconds
6. Hook up and Power up
7. Open Pcm Hammer
8. Do a Read Entire PCM

Save both logs

Send all logs and bin ...

Open the Jack Daniels and take a BIG SWIG of relief!

Obviously, got any questions, feel free to ask!

[darkman5001]

First let me say thank you for the chance to try this. I did not hesitate to try this at all as the PCM is still a test PCM sitting on my toolbox. I am happy to be able to do something to help the PCMhacking.net community, plus do something really cool that I have wanted to be involved in for quite some time.

I tried to write Antus's bin file to the PCM, however it was not successful. The error said it was unable to perform the erase. I do not think that anything was damaged with the PCM.

I am sure we will get it figured out and then we will give it another try.

Once we get this all worked out, it is my hope that we can get the Universal Patcher guys in this and get another GM PCM supported. I have already tried using it with these bin files, however I think their software needs to know the map layout of this flash chip in order to work with this PCM.

Ready for the next test...

[DavidBraley]

This has been one of the best threads I have followed on this form in a long time. It never ceases to amaze me the talent on this forum!

[Gampy]

I tried to write Antus's bin file to the PCM, however it was not successful. The error said it was unable to perform the erase. I do not think that anything was damaged with the PCM.

Well that sure is a mood killer ...

I'm concerned ... Have you rebooted this unit since, not sure I want you too.

I'm going to have to find the erase code in the disassembly and have a look see.

[darkman5001]

I haven't rebooted it yet. I have it setup at work, and I am home. It's funny I literally live right next door from work. My wife's uncle owns the shop next to my house. Actually, once I am home, I am running these tests over TeamViewer. But I will not power down the PCM until to have a look at the logs.

[antus]

unable to erase does not sound dangerous. it means either the pcm voltage was too low for the flash chip to operate (more common on intel) or the sim register part is not correct and the erase command did not trigger. I cant see the logs, or the source code for the test, but I would not worry and would do more reverse engineering of the factory bin to try and find a better example of a segment erase and compare to the kernel source.

[Gampy]

Antus,

Nothing to hide, don't think it would help!

Want more, just ask ...

The log,
[11:28:53:622] Processing range 020000-03FFFF
[11:28:53:640] Erasing.
[11:28:53:658] TX: 6C 10 F0 3D 05 02 00 00
[11:28:53:666] RX: 6C F0 10 7F 3D 05 FF FF
[11:28:53:668] Received an unexpected response. Attempt #1, status Refused.

The Code,

Code: Select all

uint8_t Amd_EraseBlock(uint32_t address)
{
	// Return zero if successful, anything else is an error code.
	unsigned short status = 0;

	uint16_t volatile * flashBase = (uint16_t*)address;

	// Tell the chip to erase the given block.
#if defined P12
	SIM_CSOR0 = 0xF322;
#else
	SIM_CSOR0 = 0x7060;
#endif
	COMMAND_REG_AAA = 0xAAAA;
	COMMAND_REG_554 = 0x5555;
	COMMAND_REG_AAA = 0x8080;
	COMMAND_REG_AAA = 0xAAAA;
	COMMAND_REG_554 = 0x5555;

	*flashBase = 0x3030;

	uint16_t read1 = 0;
	uint16_t read2 = 0;

	for (int iterations = 0; iterations < 0x640000; iterations++)
	{
		read1 = *flashBase & 0x40;

		ScratchWatchdog();

		read2 = *flashBase & 0x40;

		if (read1 == read2)
		{
			// Success!
			break;
		}

		uint16_t read3 = *flashBase & 0x20;
		if (read3 == 0)
		{
			continue;
		}

		status = 0xA0;
		break;
	}

	if (status == 0xA0)
	{
		read1 = *flashBase & 0x40;
		read2 = *flashBase & 0x40;
		if (read1 != read2)
		{
			status = 0xB0;
		}
		else
		{
			// Success!
			status = 0;
		}
	}

	// Return to array mode.
	*flashBase = 0xF0F0;
	*flashBase = 0xF0F0;
#if defined P12
	SIM_CSOR0 = 0xA332;
#else
	SIM_CSOR0 = 0x1060;
#endif

	return status;
}

[antus]

how are the sim #defines set in flash.h ?