PCM Hammer P12 development

They go by many names, P01, P10, P12, P59, E38, VPW, '0411 etc.
User avatar
NSFW
Posts: 746
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer P12 development

Post by NSFW »

Gampy wrote:Awesome, Good luck with the job, Thank you for the input.
Is it necessary for testing ??
Not necessary at all, it should generate exactly the same code either way. It's just more readable (IMO).
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
antus
Site Admin
Posts: 9009
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer P12 development

Post by antus »

kur4o wrote:I think I figured Fa50 meaning. It looks to be interrupt register.

From ls1 code

Code: Select all

ori     #$700,sr

Code: Select all

andi    #$F8FF,sr
SO it is safe to use

Code: Select all

ori     #$700,ffffFa50
code at the very start of flash routine and dismiss any other code related to fa50, since factory flash needs interrupts, they are disabled on demand while writing to chip.
I think this is incorrect. Perhaps I dont follow your angle but SR is the stack register (pointer) and FFFFA50 is a SIM register (System Integration Module - external hardware interfaces, number $20 unused in P01/P59). They are not the same thing. The left hand side has a similar but different value, but even if the same the right hand side destination is different address, different purpose so not comparable.

A guess about what we do know is different and might be a new challenge here is the presence of the slave cpu. So I'm feeling a vibe that this is related to telling the 68F375 identified here not to interfere. viewtopic.php?f=11&t=7768
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Gampy
Posts: 2332
Joined: Sat Dec 15, 2018 7:38 am

Re: PCM Hammer P12 development

Post by Gampy »

Seems logical to me that if the second mcu is interfering it would have also interfered for erase.
Why would it allow erasure but not program ... No logic to that, IMO.
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
User avatar
antus
Site Admin
Posts: 9009
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer P12 development

Post by antus »

We dont even know what the slave cpu does, if anything. Just saying its possible. Almost certainly its on the same bus. I find with this kind of RE you cant get all the answers and you have take some guesses as you move forward and continue to learn. But slave CPU or not doesn't change anything at this point. It's just something to keep in mind so that if we discover something that supports the theory later on we can give it an extra point towards credibility. I still think we need to update SIM register $20, and being able to put a name on it eventually would be great.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: PCM Hammer P12 development

Post by Tazzi »

A way to test is have some probes on the WE and other important pins of the flash. Add a custom command to the kernel that PCM hammer (or whatever tool) can send which then does 1 of those commands.

Monitor the probes/scope for changes to see if they are directly related to the flash.
I believe popping probes on the following would do it: WE (Write Enable), CE (Chip Enable), OE (Output Enable) and A9 (Used for auto detect - gets 12v).

For normal operations to just read from the flash, we have: CE =LOW, OE= LOW, WE = HIGH
Write requires CE =LOW, OE= HIGH, WE = LOW
These obviously toggle as they go along, But Write Enable toggles LOW when sending the address/data byte, and "Output Enable" is HIGH the entire time.

Erase require same thing.

Next, 12v is applied to A9 on AMD chips to enter the autoselect command sequence, this is where the chip ID information comes from. it does not appear 12v is needed for erase or writing.

With that in mind. If you have erase working, then writing bytes SHOULD also be working. Only difference I can think of is maybe not toggling the OE or WE back?

Technically "Chip Enable" could be held permanently low. This means we can communicate to it.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 9009
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer P12 development

Post by antus »

Agree that someone with the tools could watch WE and run a kernel that just loops and toggles the bit we suspect in SIM $20 very slowly to make it easy to see. That could verify operation. Also could possibly probe other pins to try and find what it is if its not WE.

The 12v isn't required on AMD, but I believe it is 12v tolerant for compatibility with intel designs.
amd.png
amd.png (90.15 KiB) Viewed 2063 times
It shouldn't be much different from the existing code as its the same family but that SIM $20 / FFFFA50 stands out precisely because it is different. I have validated that SIM $20 is not used in P01/P59 anywhere.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Gampy
Posts: 2332
Joined: Sat Dec 15, 2018 7:38 am

Re: PCM Hammer P12 development

Post by Gampy »

I guess it takes a pic to make it stick!

What is this SIM $20 :? :?:

A problem with probing, as I understand it it is next to impossible to get these units open without damaging them.
However I personally don't know, I am one of them that believes, if there is a will there is a way ... Maybe a milling machine would be a good choice for opening them up!
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: PCM Hammer P12 development

Post by Tazzi »

Required for our command mode. :)
AutoSelectMode.PNG
AutoSelectMode.PNG (253.99 KiB) Viewed 2046 times
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 9009
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer P12 development

Post by antus »

you're reading that wrong. thats "in a programmer". Because the programmer is too dumb to do it through the command register. In system the command register sequence is fine.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Gampy
Posts: 2332
Joined: Sat Dec 15, 2018 7:38 am

Re: PCM Hammer P12 development

Post by Gampy »

Tazzi,

We are doing In System programming, look straight to the right of your (When using programming equipment) highlight, you will see the In System paragraph clearly stating it does not require Vid.
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
Post Reply