pcmhacking.net

Posted: **Tue Jan 14, 2020 2:16 pm**

I dont know. We didnt get any of these in my country (AU), instead we had the Delco ECMs and PCMs which run ALDL and are based on the the older P4 and turned in to IPCM6 https://www.whichcar.com.au/features/39 ... ssie-byter

I get the impression the P04 family started in 1993 and went through several generations as it evolved see below) but Im not sure at which point they technically became P04. I suspect were talking the 98-05 PCMs but I cant say for sure. This is uncharted territory for me.

I have been told:
93-95=64KB
94-96=128KB-256KB
97=256KB
98-05=512KB
04-06=1MB

Posted: **Wed Jan 15, 2020 1:09 pm**

OK, I've started searching for microprocessor pins I can ignore on the P08 PCM (for the 4 bangers) simply because it has a 160 Pin processor and a 90 pin header on the board, similar to the P01 and P59.

As of this moment, I have eliminated 142 out of 160 pins. 18 pins to look at closer. Patterns are starting to show up.

Something interesting I discovered:

EDIT

It seems most of the 512K flash pins are accessible from the P08 PCM 90 pin header. If I add VPP, VCC, and Ground, it totals 42 pins. The package is only 44. Did the factory by any chance program the flash on the assembly floor bypassing the processor? I'm going to investigate if the flash chip can be programmed directly via the 90 pin header, bypassing the need for the BDM...

But right now my head is going to explode. So I'm going to step away from this for a couple of days...

Posted: **Mon Jan 20, 2020 5:37 am**

Down to 11 pins out of 160 on the P08 PCM (4 too many). These are microprocessor pins that go directly to the 90 pin header and no where else on the circuit board (to the best of my hunting skills). They are microprocessor pins:

68, 75, 81, 91, 92, 93, 94, 99, 129, 130, and 131. I fee strongly that the 7 BDM pins are in this group. Some of the patterns found on the P01/P59 are there.

I've looked at the datasheets for the:

MC68302, MC68303, MC68304, MC68306, MC68330, MC68331, MC683322, MC68333, MC68334, MC68336, MC68375, MC68376, MC68340, and MC68341. I'll keep looking for different flavors.

None of these datasheets so far show any of the BDM pins at the correct locations for both the known P01/P59 BDM locations and the 11 pins I've found on the P08. This supports what I've read about big manufactures getting their silicon made with different pin assignments. At this point, I don't feel comfortable experimenting with random connections on the P08 between the microprocessor and the BDM. I need to think about how to proceed with this P08 PCM...

I'm also reading that you can? and can't? (unable to find a definitive answer) program a parallel flash eeprom directly, like you would with an eeprom programmer, while it's pins are connected to a microprocessor. If anyone on this forum knows the answer, please chime in. I'm still very curious why the flash pins are accessible from the 90 pin header.

What I'm going to do now is see if I can find a similar "ONLY" 11 pins between the microprocessor and the 90 pin header on the P01 PCM, and no where else on it's circuit board. Maybe that would expose some more patterns that would help me find the BDM pins on the P08 PCM. I'm also going to see if the needed flash eeprom pins for programming are also accessible from the P01 90 pin header.

Sorry for the length, and I hope most of this made sense...

Posted: **Mon Jan 20, 2020 6:31 am**

stepping away for a few days is always a good thing to process. Ive stepped away a few myself from the p04 to figure out how to integrate all the ctsv dash electronics into my fiero

Posted: **Thu Feb 20, 2020 10:11 pm**

What BDM config is used for writing an Intel 1m chip??

ID'ing the chip always reports Unknown flash type, report these values to <bla bla bla> 89,889D.

Posted: **Fri Feb 21, 2020 7:24 am**

I think you should be able to do the intel 1mb using a method similar to what was done with the amd. That is load the 512kbyte config and then configure the 1mbyte chip id and bank offsets by hand.

I think the flash pins are also the bus pins, so they could have been used for monitoring the bus and accessing any device on the bus in development.

I think this zip file contains the information for the SOC package that was used on the PCMs. If you want to search datasheets, its probably worth a look. https://www.nxp.com/products/processors ... eet&fpsp=1

Also the pinsouts here might be worth a check. Not sure if its the same as one you have already checked. https://www.nxp.com/docs/en/data-sheet/MC68331UM.pdf

Posted: **Mon Mar 16, 2020 12:14 am**

Has anyone tried any of the really cheap BDM tools out of china like the Freescale USBDM Emulator? I've had some success with tools like that in past like the old Segger knock offs but I've also got some that don't work. Anyone get a cheap one that worked?

Posted: **Mon Mar 16, 2020 5:27 am**

With other products you might need to create the configuration yourself. That was the missing piece that made AMD P59 support so hard, even though we had the Intel P01 configuration to give us a head start.

You could probably copy the info from the existing XML files, but it looks like it would be hard to troubleshoot if you don't get it right the first time.

Posted: **Mon Mar 16, 2020 6:37 am**

NSFW wrote:With other products you might need to create the configuration yourself. That was the missing piece that made AMD P59 support so hard, even though we had the Intel P01 configuration to give us a head start.

You could probably copy the info from the existing XML files, but it looks like it would be hard to troubleshoot if you don't get it right the first time.

I just went with both 1 cheap one from china and one of the usbjtag ones coming out of Canada. Can't hurt to have 2 right? haha

Posted: **Mon Mar 16, 2020 1:30 pm**

The problem isnt the hardware interface, its the software. The USBBDMNT XML files and software define data thats send to the processor which sets up the hardware external to the processor so that it can be stopped. if you look in the XML you'll see addresses and data bytes. You need to write that data to those addresses to intialise the PCM so no on board hardware trips up the flash process. You can look at the software you are planning to use with the other interfaces and see if it allows you to setup an equivalent. If it does, you should be able to transfer the data from the usbbdm nt files.

This is the normal file for the AMD flash - nothing new here. But Im posting it in a code block so you can see what I'm talking about with the addresses and data in it. I dont exactly understand if this is code that runs on the cpu, or writes to registers, or I think it could be a bit of both. I dont recognise the flash process magic numbers in here but it could be an AMD specific routine, not using the intel style compatibility we and GM used in their flash kernels and which I am familiar with. The INIT commands looks like they are writing to hardware registers, probably disabling the watchdog.

Code: Select all

<Test>
	<Name>ECU4111M</Name>
	<Cat>Other</Cat>
	<Protocol>BDM</Protocol>
	<Endian>Big</Endian>
	<Programram>0xE90000</Programram>
	<Speed>1</Speed>
	<sprogram>1</sprogram>
	<Memorys>
			<Memory>
				<Name>Code</Name>
				<Type>1</Type>
				<Address>0x0</Address>
				<Size>0x100000</Size>
			</Memory>
	</Memorys>
	<Inits>
			<Init>
				<Address>0xFFFB04</Address>
				<Value>0xFC00</Value>
				<Bytes>2</Bytes>
			</Init>
			<Init>
				<Address>0xFFFB44</Address>
				<Value>0xFFFFF800</Value>
				<Bytes>4</Bytes>
			</Init>
      <Init>
        <Address>0xFFFB84</Address>
        <Value>0xFFFFF900</Value>
        <Bytes>4</Bytes>
      </Init>
    <Init>
      <Address>0xFFFA84</Address>
      <Value>0xFFFFFA00</Value>
      <Bytes>4</Bytes>
    </Init>
    <Init>
      <Address>0xFFFAC4</Address>
      <Value>0xFFFFFB00</Value>
      <Bytes>4</Bytes>
    </Init>
    <Init>
				<Address>0xFFFB40</Address>
				<Value>0x0200</Value>
				<Bytes>2</Bytes>
			</Init>
    <Init>
      <Address>0xFFFB80</Address>
      <Value>0x0200</Value>
      <Bytes>2</Bytes>
    </Init>
    <Init>
      <Address>0xFFFA80</Address>
      <Value>0x0200</Value>
      <Bytes>2</Bytes>
    </Init>
    <Init>
      <Address>0xFFFAC0</Address>
      <Value>0x0200</Value>
      <Bytes>2</Bytes>
    </Init>
<Init><Address>0xFFFA00</Address><Value>0xC1C1</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA04</Address><Value>0x400C</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA11</Address><Value>0x30</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA15</Address><Value>0xFC</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA17</Address><Value>0xF3</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA19</Address><Value>0xE0</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA1D</Address><Value>0xF6</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA1F</Address><Value>0x08</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA21</Address><Value>0x84</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA38</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA41</Address><Value>0x27</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFA44</Address><Value>0x00AF</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA48</Address><Value>0x0007</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA4A</Address><Value>0x6820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA4C</Address><Value>0x0007</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA4E</Address><Value>0x7060</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA50</Address><Value>0xFFE0</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA52</Address><Value>0x3BE0</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA54</Address><Value>0xFFD0</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA56</Address><Value>0xD820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA58</Address><Value>0xFFE8</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA5A</Address><Value>0xD820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA5C</Address><Value>0xFFB3</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA5E</Address><Value>0x7BC1</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA60</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA62</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA64</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA66</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA68</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA6A</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA6C</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA6E</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA74</Address><Value>0x8000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA76</Address><Value>0x0820</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA70</Address><Value>0x4004</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA72</Address><Value>0x7870</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA70</Address><Value>0x4003</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA72</Address><Value>0x7830</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA46</Address><Value>0x00C1</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB00</Address><Value>0x0100</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB40</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB44</Address><Value>0xFFFF8000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFB40</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB80</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFB84</Address><Value>0xFFFF9000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFB80</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA80</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFA84</Address><Value>0xFFFFA000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFA80</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFAC0</Address><Value>0x8200</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFAC4</Address><Value>0xFFFFB000</Value><Bytes>4</Bytes></Init>
<Init><Address>0xFFFAC0</Address><Value>0x0A00</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC00</Address><Value>0x0082</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC04</Address><Value>0x00</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC05</Address><Value>0x40</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC08</Address><Value>0x005C</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC0A</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC15</Address><Value>0xF8</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC16</Address><Value>0x7F</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC17</Address><Value>0xFE</Value><Bytes>1</Bytes></Init>
<Init><Address>0xFFFC18</Address><Value>0x8005</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC1A</Address><Value>0x0602</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC1C</Address><Value>0x0000</Value><Bytes>2</Bytes></Init>
<Init><Address>0xFFFC1E</Address><Value>0x00</Value><Bytes>1</Bytes></Init>
  </Inits>
</Test>

pcmhacking.net

USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT

Re: USB BDM NT