Pages: [1]
Author Topic: DEFAULT ROMEN bit status for ME7.5  (Read 2862 times)
ottosan
Full Member
***

Karma: +5/-5
Offline Offline

Posts: 92


« on: February 13, 2021, 05:24:16 AM »

Dear Members,

I have boot read with K-tag S3 8L  018BJ box it dumped .MPC(ROM), .FLS(Flash Content),EEP(95040 eeprom).
After I have created IDA Project and mapped MPC to address 0x0000.
The code in the ROM is as follows:

ROM:00006470 RESET_handler:                          ; CODE XREF: ROM:RESET↑J
ROM:00006470                                         ; seg010:j_RESET_handler↓J
ROM:00006470                 mov     CP, #0F740h
ROM:00006474                 mov     BUSCON0, #4ADh
ROM:00006478                 jnb     ROMEN, loc_6482
ROM:0000647C                 mov     SYSCON, #1110011000000100b
ROM:00006480                 jmpr    cc_UC, loc_6486
ROM:00006482 ; ---------------------------------------------------------------------------
ROM:00006482
ROM:00006482 loc_6482:                               ; CODE XREF: RESET_handler+8↑j
ROM:00006482                 mov     SYSCON, #1110001000000100b
ROM:00006486
ROM:00006486 loc_6486:                               ; CODE XREF: RESET_handler+10↑j
........

It looks like if SYSCON ROMEN bit is enabled the ECU is booting from the internal ROM(MPC in My case) if ROMEN bit is not set than the CPU boots from external Flash(FLS) so I have to map the first 32k from flash to 0x0000 address.

My question is what is usually the ROMEN bit status for ME7.5?
Should I map the internal ROM dump to 0x0000 or first 32k of external Flash to address 0x0000.

Thank you in Advance,



Logged
gremlin
Hero Member
*****

Karma: +194/-9
Offline Offline

Posts: 650


« Reply #1 on: February 13, 2021, 06:02:13 AM »

My question is what is usually the ROMEN bit status for ME7.5?

Depends of board HW release.
RTFM.
ROMEN bit is set according to pin EA state during reset
Logged
ottosan
Full Member
***

Karma: +5/-5
Offline Offline

Posts: 92


« Reply #2 on: February 13, 2021, 06:17:00 AM »

Depends of board HW release.
RTFM.
ROMEN bit is set according to pin EA state during reset

Thank you for fast reply. This is a standard s3 8L me7.5 my 2001. 225 ph.
Could you please tell how I can find the HW release information?

Regards,
Logged
ottosan
Full Member
***

Karma: +5/-5
Offline Offline

Posts: 92


« Reply #3 on: February 13, 2021, 10:17:28 AM »

Depends of board HW release.
RTFM.
ROMEN bit is set according to pin EA state during reset

I didn't knew what RTFM means. Smiley Now I know.
IHRFM! Wink
I'm asking because it's not Clear in The FM.


« Last Edit: February 13, 2021, 10:30:51 AM by ottosan » Logged
gremlin
Hero Member
*****

Karma: +194/-9
Offline Offline

Posts: 650


« Reply #4 on: February 14, 2021, 03:19:22 AM »

Could you please tell how I can find the HW release information?
Open ecu and check mcu pin 99 connection.
If connect to Vcc than ROMEN=1, else ROMEN=0
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.016 seconds with 17 queries. (Pretty URLs adds 0s, 0q)