PCM Hammer P10 development

[kur4o]

SInce p12 is mostly done, we can move on to next target P10.

I looked at some of the code and p10 have too much similarities with ls1 layout.

1.size of chip is 1mb- 512kb are used. Upper range is not accessible for reading through pcm.
2.Chip is amd Id 2258 same chip as ls1 1mb amd pcm.
3.Data layout:
0-3fff, 20000-7ffff Main OS first part is boot block. It have some recovery mode but needs confirmation.
4000-7fff EEprom area
8000-1ffff calibration data separated on segments.
4. Checksums and ranges same format as ls1.


It have some slave cpu but that doesn`t affect main cpu flashing, it needs a simple cop to keep it quiet.

The changes needed are

revised upload range address.
fixing COP
Fixing voltage reading.
Some registers update.

MOre details later.

[kur4o]

Upload range is ffa000-ffe000

Cop

move.b #$55,(byte_FFFFFA27).w
move.b #$AA,(byte_FFFFFA27).w
bclr #7,($FF800806).l
bset #7,($FF800806).l

DLC registers are the same as ls1 pcm

Initial setup
ori #$700,sr
movea.w #$E000,sp

move.w #$55,($FF8002FC).l
move.w #$29A,d0 [nop cycles*6]
jsr NOP_sub_FF8300 [$29a*6 nops]
move.w #$4314,($FF8002FE).l
ori.w #$8000,($FF8002FE).l


Chip unlocking

move.w #$6820,(word_FFFFFA4A).w
move.w #$7060,(word_FFFFFA4E).w
move.w #6,(word_FFFFFA4C).w
move.w #6,(word_FFFFFA48).w


To read voltage set
move.w #$A,(word_FFFFF230).w
move.w #$3F,(word_FFFFF232).w
move.w #$8082,(word_FFFFF20A).w
move.w #$A8,(word_FFFFF20E).w
move.w #$2100,(word_FFFFF20C).w

wait
loc_FF975A:
btst #7,(word_FFFFF210).w
beq.s loc_FF975A

read voltage
move.w (word_FFFFF2B0).w,d1

Should be between $190-$284 in hex

[antus]

who has one to test? what service numbers are p10?

[kur4o]

darkman5001 have couple ready for tests.

I have one Service number 12574976

[Gampy]

P10-Read.png (24.19 KiB) Viewed 2281 times

2004 Chevrolet TrailBlazer 4.2L(I6)LL8 Os12584594.bin

(512 KiB) Downloaded 100 times

[kur4o]

That is great progress.

Some more info on checksums

Os checksum is at $52a
Os p/n $52e Int
Os range at 546 [0-529,52c-3fff,20000-7fffc]
4 cal ranges at $54e

Recovery mode identifiers
OS segment last 4 bytes must be A5 5A A5 A5
Calibration segment - 17ffe must be 55 55

[Gampy]

P10-CKernel.png (24.68 KiB) Viewed 2273 times

Based at 0xFFC000.

[ScarabEpic22]

I've got a few P10s and would be happy to test. Send me a link to a version of PCM Hammer (or Github link?) with the changes and I can test!

[Gampy]

P10-Write.png (44.08 KiB) Viewed 2201 times

[Gampy]

P10-Write1.png (44.43 KiB) Viewed 2188 times

Loaded to 0xFFB800 ... No changes, not even the COPs!
0xFFA000 -> 0xFFB000 is to low and crashes on upload, 0xFFC000 is to high and crashes processing CRC.

Delicate fit!

PcmHammer diff ...

P10-PcmHacks.diff.txt

(7.96 KiB) Downloaded 91 times