Creating 1g DSM ECU Flash Chips
(with cheap hardware and Linux)

I assume the reader is already familiar with Linux. If you're not, this HOWTO is probably not for you. I also assume you're at least moderately familiar with the PC hardware architecture; ie. you feel comfortable working with PCI cards, replacing socketed chips, etc. This is not the most convenient way to create new chips for your ECU; you'll need to power off and power on the machine to put a new chip in place for flashing, then power the machine off again to take the chip out. But if you don't want (or need) an EPROM burner for anything else, this is probably the most cost-effective way to do it.

I accept no responsibility if you fry something important with this, such as a few flash chips, your network card, your PC motherboard, or your ECU. No warranty; if this causes something to break, you get to keep both pieces. Yadda yadda yadda. ;-)

Materials Needed:

• A PCI-based PC running some relatively recent version of Linux. I did this with Red Hat Linux 8.0, which is truly ancient at the time of this writing.
• A 3Com 3c905b (or related) network card. The important thing to note is the model number stamped on the card: a 3c509 is a completely different card. You want something from the "Vortex" family of cards; see http://www.scyld.com/ for more information on finding a flash-capable Vortex card (quick hint: look for a 32-pin socket mounted vertically at the back of the card).
• "vortex-diag", available in source form from ftp://ftp.scyld.com/pub/diag/. You need vortex-diag.c, along with libmii.c and libflash.c.
• An Atmel 29C256 (or similar) flash chip. You can find these for sale at DigiKey. They're about $6 each, unless you're buying large quantities. I picked up a few of them, so I can have a chip in the car, one ready to re-flash, and one with a "known-good" firmware image on it.
• A firmware image that you want to put on the chip. Creating new images is definitely beyond the scope of this document; I'd suggest taking a look at both Kyle Tarry's excellent introduction to ECU ROM editing, and this nifty web-based ECU firmware generator for quickly generating an image with basic changes already applied to it.

Instructions:

First, set up your PC with the 3c905b (or other flash-capable Vortex 3Com NIC). Load Linux if necessary. Get everything working as you'd expect it, including making sure that the card has a loaded module for it, or a compiled-in driver, and that the card is accessable and basically functional. Shut the machine down, and insert the AT29C256 (or other 29-series chip) in the socket, with the arrow at the top of the chip oriented toward the top of the card, and the pins of the chip inserted toward the bottom. In other words, there should be a little arrow or triangle pointing up when the card is in the PC, and there should be an empty couple of rows in the socket just above the chip. (The socket is designed for 32-pin chips, but the Atmel chip is a 28-pin chip. Don't worry, this really does work. ;-)

Next, build vortex-diag. In the same directory that you downloaded the three source files above to, type:

cc -O -Wall -o vortex-diag vortex-diag.c -DLIBMII libmii.c -DLIBFLASH libflash.c

That shouldn't produce any output; if it does, you'll need to track down the problem. Working out debugging of compilation errors is beyond the scope of this document; there are many excellent resources for you to call on for this kind of problem. For the sake of simplicity, I have a binary (built on Fedora Core 3) available if you're unable to get this working yourself; I make no claims about it's applicability to other systems or kernels.

Once you have a working vortex-diag, you're set to write your firmware image. First, make sure that the card is working correctly, and that the manufacturer information for the chip is accessable, by typing:

./vortex-diag -B | less

You should get an output that looks something like:

vortex-diag.c:v2.16 1/12/2004 Donald Becker (becker@scyld.com)
 http://www.scyld.com/diag/index.html
Index #1: Found a 3c905B Cyclone 100baseTx adapter at 0xe000.
 Station address 00:50:04:6d:c8:77.
  Receive mode is 0x07: Normal unicast and all multicast.
BIOS ROM ID 7F 7F, vendor Atmel AT29C256:
0x000: 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f 7f ...
...

BIOS ROM dump done.
 Use '-a' or '-aa' to show device registers,
     '-e' to show EEPROM contents, -ee for parsed contents,
  or '-m' or '-mm' to show MII management registers.

If you get something different (such as "unknown vendor" or a similar error), MAKE SURE YOU ORIENTED THE CHIP CORRECTLY IN THE SOCKET. This is the most likely error.

Assuming everything checks out okay, load your ECU firmware image:

./vortex-diag -L E931C6F5

(Where E931C6F5 is the filename you've given your firmware.)

You should be presented with a status message that gives you a running count of bytes being written to the flash chip. At this point, you're all set; shut the system down, pop the chip out and put it (correctly oriented!) into your EPROM ECU. Connect your logger, turn the key to the ON position, and verify that various sensors are updating (TPS is an easy one; just push the gas pedal, and watch the throttle position sensor reading change). Assuming all goes well with that test, fire your car up and go for a spin, keeping an eye on the logger to make sure that nothing odd is happening.

From here, you're on your own. Have fun reprogramming your 1g ECU!