P04 Custom Code

ProfessWRX · Post by **ProfessWRX** » Thu Nov 30, 2023 11:08 am

Got it all figured out except what Urban is and what triggers it.

There is NO triggering the 11th mystery table set in 12588500. 50E3C is the subroutine.

ProfessWRX · Post by **ProfessWRX** » Thu Nov 30, 2023 1:10 pm

Same for the 2000 GTP bin I have. No use of the 11th table set. 532FE is the Subroutine that chooses the table set to use.

ProfessWRX · Post by **ProfessWRX** » Thu Nov 30, 2023 1:32 pm

The 11th table set is also set up as a single MPH value just like the WOT tables are. So it seems like it was never intended as the 2nd gear start.

I also realized what the URBAN tables are. I don't know why they're called urban and I still don't know how to activate them but they are just gears that hold the gear indefinitely and don't upshift until the max MPH in stock setup.

For those that like to read assembly this is the subroutine that picks the shift tables. Anywhere you see a value loaded to d0, that's the table set offset (offset x 18 bytes = address of tables used > Then 6 more bytes are added for each gear for the final lookup table).

Code: Select all

ROM:00050E3C     sGearShiftTypeSelection:                ; CODE XREF: sFindGearSetup+2p
ROM:00050E3C 000                 move.b  (byte_FFFF919E).w,d3 ; In Drive Low?
ROM:00050E40 000                 bne.s   loc_50E52       ; Branch if Not Equal
ROM:00050E42 000                 btst    #2,(byte_FFFF9804).w ; Test a Bit
ROM:00050E48 000                 beq.s   loc_50E4E       ; Branch if Equal
ROM:00050E4A 000                 moveq   #9,d0           ; Urban?                                                            9th table set
ROM:00050E4C 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050E4E     ; ---------------------------------------------------------------------------
ROM:00050E4E
ROM:00050E4E     loc_50E4E:                              ; CODE XREF: sGearShiftTypeSelection+Cj
ROM:00050E4E 000                 clr.b   d0              ; Drive Low Normal?                                                   0 table set (first)
ROM:00050E50 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050E52     ; ---------------------------------------------------------------------------
ROM:00050E52
ROM:00050E52     loc_50E52:                              ; CODE XREF: sGearShiftTypeSelection+4j
ROM:00050E52 000                 moveq   #1,d4           ; Move Quick
ROM:00050E54 000                 cmp.b   d3,d4           ; Compare
ROM:00050E56 000                 bne.s   loc_50E70       ; Branch if Not Equal
ROM:00050E58 000                 cmpi.b  #3,(pTransmissionShiftPattern).w ; Compare Immediate
ROM:00050E5E 000                 bne.s   loc_50E6C       ; Branch if Not Equal
ROM:00050E60 000                 btst    #7,(byte_FFFFA918).w ; In Drive 2?
ROM:00050E66 000                 bne.s   loc_50E6C       ; Branch if Not Equal
ROM:00050E68
ROM:00050E68     loc_50E68:                              ; CODE XREF: sGearShiftTypeSelection+82j
ROM:00050E68                                             ; sGearShiftTypeSelection+86j
ROM:00050E68 000                 moveq   #7,d0           ; Performance?                                                                     7th table set
ROM:00050E6A 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050E6C     ; ---------------------------------------------------------------------------
ROM:00050E6C
ROM:00050E6C     loc_50E6C:                              ; CODE XREF: sGearShiftTypeSelection+22j
ROM:00050E6C                                             ; sGearShiftTypeSelection+2Aj
ROM:00050E6C 000                 move.l  d4,d0           ; Drive 2?                                                                                 1st table set (second)
ROM:00050E6E 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050E70     ; ---------------------------------------------------------------------------
ROM:00050E70
ROM:00050E70     loc_50E70:                              ; CODE XREF: sGearShiftTypeSelection+1Aj
ROM:00050E70 000                 btst    #7,(byte_FFFFA918).w ; Test a Bit
ROM:00050E76 000                 beq.s   loc_50E88       ; Trans Oil Temp HOT?
ROM:00050E78 000                 btst    #7,(byte_FFFF9199).w ; Test for WOT
ROM:00050E7E 000                 beq.s   loc_50E84       ; Branch if Equal
ROM:00050E80 000                 moveq   #2,d0           ; HOT WOT?                                                                               2nd table set
ROM:00050E82 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050E84     ; ---------------------------------------------------------------------------
ROM:00050E84
ROM:00050E84     loc_50E84:                              ; CODE XREF: sGearShiftTypeSelection+42j
ROM:00050E84 000                 moveq   #3,d0           ; HOT Normal                                                                           3rd table set
ROM:00050E86 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050E88     ; ---------------------------------------------------------------------------
ROM:00050E88
ROM:00050E88     loc_50E88:                              ; CODE XREF: sGearShiftTypeSelection+3Aj
ROM:00050E88 000                 btst    #7,(byte_FFFF9199).w ; Test for WOT
ROM:00050E8E 000                 beq.s   loc_50EA6       ; Branch if Equal
ROM:00050E90 000                 move.b  (pTransmissionShiftPattern).w,d3 ; Move Data from Source to Destination
ROM:00050E94 000                 cmpi.b  #3,d3           ; Compare Immediate
ROM:00050E98 000                 beq.s   loc_50E9E       ; Branch if Equal
ROM:00050E9A 000                 cmp.b   d3,d4           ; Compare
ROM:00050E9C 000                 bne.s   loc_50EA2       ; Branch if Not Equal
ROM:00050E9E
ROM:00050E9E     loc_50E9E:                              ; CODE XREF: sGearShiftTypeSelection+5Cj
ROM:00050E9E 000                 moveq   #8,d0           ; Performance WOT?                                                                     8th table set
ROM:00050EA0 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050EA2     ; ---------------------------------------------------------------------------
ROM:00050EA2
ROM:00050EA2     loc_50EA2:                              ; CODE XREF: sGearShiftTypeSelection+60j
ROM:00050EA2 000                 moveq   #4,d0           ; Normal WOT?                                                                             4th table set
ROM:00050EA4 000                 bra.s   locret_50EC6    ; Branch Always
ROM:00050EA6     ; ---------------------------------------------------------------------------
ROM:00050EA6
ROM:00050EA6     loc_50EA6:                              ; CODE XREF: sGearShiftTypeSelection+52j
ROM:00050EA6 000                 move.b  (pTransmissionShiftPattern).w,d3 ; Move Data from Source to Destination
ROM:00050EAA 000                 moveq   #3,d5           ; Move Quick
ROM:00050EAC 000                 cmp.b   d3,d5           ; Compare
ROM:00050EAE 000                 beq.s   loc_50EBC       ; Branch if Equal
ROM:00050EB0 000                 btst    #5,(byte_FFFF9196).w ; Test a Bit
ROM:00050EB6 000                 beq.s   loc_50EBC       ; Branch if Equal
ROM:00050EB8 000                 moveq   #5,d0           ; Move Quick                                                                              5th table set
ROM:00050EBA 000                 bra.s   locret_50EC6    ; Cruise?
ROM:00050EBC     ; ---------------------------------------------------------------------------
ROM:00050EBC
ROM:00050EBC     loc_50EBC:                              ; CODE XREF: sGearShiftTypeSelection+72j
ROM:00050EBC                                             ; sGearShiftTypeSelection+7Aj
ROM:00050EBC 000                 cmp.b   d3,d5           ; Compare
ROM:00050EBE 000                 beq.s   loc_50E68       ; Branch if Equal
ROM:00050EC0 000                 cmp.b   d3,d4           ; Compare
ROM:00050EC2 000                 beq.s   loc_50E68       ; Branch if Equal
ROM:00050EC4 000                 moveq   #6,d0           ; Normal?                                                                                     6th table set
ROM:00050EC6
ROM:00050EC6     locret_50EC6:                           ; CODE XREF: sGearShiftTypeSelection+10j
ROM:00050EC6                                             ; sGearShiftTypeSelection+14j ...
ROM:00050EC6 000                 rts                     ; Return from Subroutine
ROM:00050EC6     ; End of function sGearShiftTypeSelection
ROM:00050EC6

ProfessWRX · Post by **ProfessWRX** » Thu Nov 30, 2023 2:10 pm

It’s also possible that 2nd gear start is utilized by a downshift subroutine bypass. I noticed a bypass that I think had a ram variable switch to skip it. That means if it’s switched by code it won’t even bother doing the downshift logic. It could even have a auto table select switch after bypassing. I don’t know didn’t look very long because I was assuming the selection logic would have it but that didn’t work out.
Something I’ll look into. /rambling

zack4200 · Post by **zack4200** » Thu Nov 30, 2023 2:14 pm

ProfessWRX wrote:I also realized what the URBAN tables are. I don't know why they're called urban and I still don't know how to activate them but they are just gears that hold the gear indefinitely and don't upshift until the max MPH in stock setup.

sounds like it could be related to paddle shifting? From what I'm seeing after a couple searches, Tap-Shift was only available in 04+ GTPs with a CompG package; so I'm not sure why code for it would already exist in the older bins unless maybe GM was planning to make the option available earlier?

actually that would be a p05 not p04 so I'm not sure that it would be the same code, maybe similar

ProfessWRX · Post by **ProfessWRX** » Thu Nov 30, 2023 2:30 pm

I don’t believe so. The logic for that would be very different I would think. It would have limits of when shifts are allowed as opposed to what they are. So it would all have to work a bit backwards from the logic I see.

But I could be completely wrong.

kur4o · Post by **kur4o** » Thu Nov 30, 2023 7:29 pm

The last set of tables are 4WD_Low_WOT. No wonder it is not used in fwd application. I think it is triggered by external switch.

ProfessWRX · Post by **ProfessWRX** » Fri Dec 01, 2023 12:45 am

Just figured out how the 11th tables would be used. There's that performance mode 3 I was talking about. Those lead to a branch that basically does nothing. If 4WD vehicles that branch is redirected to the 11th tables. Mode 3 = 4WD.

So to allow a custom Shift limiter, you could turn mode 3 on for that subroutine, then off after it exits (so you don't alter other subroutines) and fill those tables with your desired Max MPH for shifting. That's an easy anti-abuse mode (valet).

kur4o · Post by **kur4o** » Fri Dec 01, 2023 6:35 am

I am sure these performance modes are triggered by external switches. We need to locate the pins that are being used for this. 2nd gear start and performance might use the same pin, but 4wd low will be definitely another pin. Than we can manipulate the command logic. I think some might be mutually exclusive via software settings. There might be other input/output pins left on board, paired with AD channels and PWM channels. Some hardware tracing will be needed, to fully exploit the p04 pcm.

A good indicator is to measure each pin for resistance to ground. When pcm is powered to measure voltage to ground and voltage to B+. Some analysis after that can reveal similar channels, and matching that with existing data sheets can spot quickly some of the unused pins capabilities. Last some board tracing and finding patterns of RC networks.

ProfessWRX · Post by **ProfessWRX** » Fri Dec 01, 2023 8:08 am

Any chance you guys have a pinout for the 04 L67 Pcm? I haven’t seen one.

P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code

Re: P04 Custom Code