PCM Hammer P12 development

[antus]

There is a register that controls voltage to an address pin which is required to put the intel chip in to command mode. Check that register first. Even if the system is AMD perhaps stripping the intel code will get past it for now, if it is intel, then you'll probably need to find the right register for this PCM.

[Gampy]

I've got a test ready that does exactly that ... Skips Intel and goes straight to AMD Id code.

However, looking at the data sheet, it looks like it has to be put into Word mode to get the ID, unlike the others which can be in Byte or Word mode.
I very much would appreciate thoughts and opinions from others interpretation of the data sheet and the chip id technique, especially in comparison to the AM29F800B commands.

At least I'm getting lots of sleep, there are lots of paragraphs in this data sheet!

We are currently just trying to read, so I am working on trimming back PCM Hammers loading routine to get past things like Flash chip ID, etc... We really don't need it just to read.

[antus]

Just skip the datasheet and look for immediate arguments in the asm code in the disassembler that align with the magic numbers in the data sheet and copy what the example does. It takes specific timing to get it right - a couple of the right opcodes with the right arguments in the right order are what you need.

[Gampy]

I cannot find what I believe is Chip ID'ing code in the disassembly, I see the writing technique and others, but no ID'ing technique, at least that I recognize.

We are so darn close my mouth is salty ... You know that salty taste you get just before you puke!

[antus]

the harder part is getting it in to command mode which is required to do anything - erase, flash, id.. so if you use the same code and change the command after entering command mode you should have it.

[Gampy]

The chip is a different beast ... It is word mode only, no byte mode.
I believe that will require some pretty heavy changes for writing.

[antus]

is it? I am not sure, but just from memory I remember a lot about word mode writing the ls1flash kernel. Thats why the flash program commands are like 5050 8080 etc (hex). I think word mode is more to do with the physical bus, not the software implementation. not completely sure, though its always been a bit black magic.

[antus]

these commands look really similar. to do it you have to hit the right pins with the right bytes at the right times to trigger the sequence though. and you need to be running in ram, since when the chip is in command mode you wont be able to read data.

[antus]

Note this. I think the P59 is in word mode, and in order to hit the right locations were writing 5555 to address 554 on the second bus cycle. I think this is because we want 55 to land in 555, so the first byte of the 5555 is wasted, and the next 55 hits the right location. I think what you need is the same. The two chips have the same commands in word mode.

The unwritten bit here is that a write of AAAA to AAA works, 5555 to 555 does not whereas 5555 to 554 does even if 554 is not mentioned in the data sheet anywhere. Hardware fun, hey.

I think what your missing therefore is setting up the SIM registers correctly. And the address baked in to the silicon for those registers wont be in the AMD datasheet, and likely not the freescale one either. To find them you'll need to find the flash routines in the original bin and see what data is being written there to put the chip in the right mode. The rest of the process should be the same.

.. and for anyone who has no idea what im talking about but wants to learn, have a go at the game shenzen.io. This game had me at the part where you get your first datasheet that's not available in your language, yet you need to develop against it. A crazy but potentially real world curveball you just wouldn't expect until you try to do this stuff. Then you learn that the bits that take the time are not the bits you expect to be up against! https://store.steampowered.com/app/504210/SHENZHEN_IO/

Edit: having said all that I notice we are not using address 2AA on the P59 so we must be in byte mode. datasheet: AA to AAA with code AAAA to AAA. datasheet 5555 to 55 with code 5555 to 554, datasheet 90 to AAA with code 9090 to AAA. In byte mode.

[Gampy]

Edit; Both the P04 (AM29F400BB) and P59 (AM29F800BB) are Byte mode capable ...

This is <bleeping> embarrassing as all get out ...

I sure could use some help with the math.
Lifelong problem unfortunately and the reason I gave up trying to be a professional programmer ~35 years ago, my kids like to eat!

I get all confused between Kbytes and Kwords and ... and ... and ... Yes, I know the difference between them!

A note about doing them, and an example,

Code: Select all

                // This is only here as a warning to anyone adding ranges for another chip.
                // Please read the comments carefully. See case 0x00894471 for the real data.
                case 0xFFFF4471:
                    var unused = new MemoryRange[]
                    {
                        // These numbers and descriptions are straight from the intel 28F400B data sheet.
                        // Notice that if you convert the 16 bit word sizes to decimal, they're all
                        // half as big as the description here, in bytes, indicates.
                        new MemoryRange(0x30000, 0x10000, BlockType.OperatingSystem), // 128kb main block
                        new MemoryRange(0x20000, 0x10000, BlockType.OperatingSystem), // 128kb main block
                        new MemoryRange(0x10000, 0x10000, BlockType.OperatingSystem), // 128kb main block
                        new MemoryRange(0x04000, 0x0C000, BlockType.Calibration), //  96kb main block
                        new MemoryRange(0x03000, 0x01000, BlockType.Parameter), //   8kb parameter block
                        new MemoryRange(0x02000, 0x01000, BlockType.Parameter), //   8kb parameter block
                        new MemoryRange(0x00000, 0x02000, BlockType.Boot), //  16kb boot block
                    };
                    throw new InvalidOperationException("This flash chip ID was not supposed to exist in the wild.");

The following is the real working example for the above ...

Code: Select all

                case 0x00894471:
                    size = 512 * 1024;
                    description = "Intel 28F400B, 512kb";
                    memoryRanges = new MemoryRange[]
                    {
                        // These addresses are for a bottom fill chip (B) in byte mode (not word)
                        new MemoryRange(0x60000, 0x20000, BlockType.OperatingSystem), // 128kb main block
                        new MemoryRange(0x40000, 0x20000, BlockType.OperatingSystem), // 128kb main block
                        new MemoryRange(0x20000, 0x20000, BlockType.OperatingSystem), // 128kb main block
                        new MemoryRange(0x08000, 0x18000, BlockType.Calibration), //  96kb main block 
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter), //   8kb parameter block
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter), //   8kb parameter block
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot), //  16kb boot block
                    };
                    break;

Here is the AM29F400BB PCMHammer FlashID sector layout which I think it would be close

Code: Select all

                // AM29F400BB   
                case 0x000122AB:
                    size = 512 * 1024;
                    description = "AMD AM29F400BB, 512kb";
                    memoryRanges = new MemoryRange[]
                    {
                        new MemoryRange(0x70000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x60000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x50000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x40000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x30000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x20000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x10000, 0x10000, BlockType.Calibration), //  64kb calibration block
                        new MemoryRange(0x08000, 0x08000, BlockType.Calibration), //  32kb calibration block
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot), //  16kb boot block
                    };
                    break;

A start for the AM29BL802C (id 0x00012281).

Code: Select all

                // AM29BL802C
                case 0x00012281:
                    size = 512 * 1024;
                    description = "AMD AM29BL802C, 512kb";
                    memoryRanges = new MemoryRange[]
                    {
                        // I believe the following are the same as the AMD AM29F400BB above ...
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot), //  16kb boot block
                    };
                    break;

The AM29F400BB datasheet sector layout section,

AMD-AM29F400BB-SectorAddressTable.png (34.29 KiB) Viewed 2105 times

The AM29BL802C datasheet sector layout section,

AMD-AM29BL802C-SectorAddressTable.png (28.56 KiB) Viewed 2105 times

I know, this is not needed to just read ...