Notices
991 2012-2019
Sponsored by:
Sponsored by:

Retrofitting PCM4 in a 991.1

Thread Tools
 
Search this Thread
 
Old 07-13-2019, 03:38 PM
  #46  
mobista
8th Gear
 
mobista's Avatar
 
Join Date: Jul 2019
Posts: 8
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by chris2011
Hi Chris, can you maybe tell me how it is possible to update fw from audi to Porsche?

I always get variant conflict when I am trying to update the fw via sd card.

I also tried to change train Nr. In eeprom but nothing works.
If U will get advanced engineering menu U will be able to do this with proper eeprom values editted.

Originally Posted by b3drock
@chris2 Hi, interesting thread, did some very similar research trying to enable CarPlay in a Audi Q7 4M. Quick question, have you verified that replacing the public key files generated with your script actually works? There is a SO thread that suggests the keys are signed by some data stored in OTP flash area https://reverseengineering.stackexch...fication/12287 which I had assumed would stop the public keys from being replaced as the chain of trust would be broken?

-Nic
CarPlay activation is simple
Old 07-13-2019, 06:13 PM
  #47  
chris2
Instructor
Thread Starter
 
chris2's Avatar
 
Join Date: Sep 2017
Location: San Diego
Posts: 187
Received 109 Likes on 38 Posts
Default

Originally Posted by chris2011
Hi Chris, can you maybe tell me how it is possible to update fw from audi to Porsche?

I always get variant conflict when I am trying to update the fw via sd card.

I also tried to change train Nr. In eeprom but nothing works.
Actually, ignore my post from above, I think you just have to correct your EEPROM edit to convert your unit to PCM. There might be other variant related info stored in storage*.raw and sysetbackup, so go ahead and remove those anyway since you can recreate them later. You also might need to change /mnt/efs-persist/SWDL/variant.txt to the following (line 1 = variant, line 2 = crc32b of variant string)

Code:
FM2-P-TNSL-US-PO-MLP
e0dd4567
Somebody else asked for a copy of my EEPROM, so here is the backup I took before messing with adaptations. You can not flash this via E2PModify since FAZIT ID and a couple other values are write-protected via that application (at least on my unit).
https://github.com/ibreakifix/Porsch...2_SNE2PROM.bin

Once you change those, you can possibly reflash your unit with user-defined SWDL enabled in GEM, then update via SWDL menu. Please let me know if this helps.
Old 07-13-2019, 06:57 PM
  #48  
mobista
8th Gear
 
mobista's Avatar
 
Join Date: Jul 2019
Posts: 8
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by chris2
Actually, ignore my post from above, I think you just have to correct your EEPROM edit to convert your unit to PCM. There might be other variant related info stored in storage*.raw and sysetbackup, so go ahead and remove those anyway since you can recreate them later. You also might need to change /mnt/efs-persist/SWDL/variant.txt to the following (line 1 = variant, line 2 = crc32b of variant string)

Code:
FM2-P-TNSL-US-PO-MLP
e0dd4567
Somebody else asked for a copy of my EEPROM, so here is the backup I took before messing with adaptations. You can not flash this via E2PModify since FAZIT ID and a couple other values are write-protected via that application (at least on my unit).
https://github.com/ibreakifix/Porsch...2_SNE2PROM.bin

Once you change those, you can possibly reflash your unit with user-defined SWDL enabled in GEM, then update via SWDL menu. Please let me know if this helps.
Thanks for eeprom! "
Code:
FM2-P-TNSL-US-PO-MLP" -> may work, but there is small possibility to break unit (some time ago I broke CAN communication on Audi unit playing with unit HW info)
Old 07-14-2019, 08:27 AM
  #49  
chris2011
AutoX
 
chris2011's Avatar
 
Join Date: Jul 2019
Posts: 12
Received 0 Likes on 0 Posts
Default

As I know eeprom change not works, ee contains cp data and unit will not boot.
EE has also encrypted area the Aes key is in the Nec.

I already change the variant. Txt and the eeprom train. But variant conflict is still there.

There must be something in Rcc which must be changed....
Old 07-14-2019, 09:08 AM
  #50  
chris2011
AutoX
 
chris2011's Avatar
 
Join Date: Jul 2019
Posts: 12
Received 0 Likes on 0 Posts
Default

[QUOTE=mobista;15971061]If U will get advanced engineering menu U will be able to do this with proper eeprom values editted.

How can I get this advanced engineering menu?
Is this a script? What is the name of it

I heard it is possible with it to skip variant check

Old 07-15-2019, 07:02 PM
  #51  
chris2
Instructor
Thread Starter
 
chris2's Avatar
 
Join Date: Sep 2017
Location: San Diego
Posts: 187
Received 109 Likes on 38 Posts
Default

Originally Posted by chris2011
As I know eeprom change not works, ee contains cp data and unit will not boot.
EE has also encrypted area the Aes key is in the Nec.

I already change the variant. Txt and the eeprom train. But variant conflict is still there.

There must be something in Rcc which must be changed....
I think the V850 controls variant information, what if you flash the Porsche app and bootloader to the IOC with mib2_ioc_flash, then clone eeprom and reboot?

mib2_ioc_flash updateAppNow /net/mmx/fs/{your_sd_path}/V850app_MLBPO.bin
mib2_ioc_flash updateBoloNow /net/mmx/fs/{your_sd_path}/V850bolo_MLBPO.bin

Last edited by chris2; 07-15-2019 at 11:31 PM.
Old 07-16-2019, 02:37 AM
  #52  
herr_frei
3rd Gear
 
herr_frei's Avatar
 
Join Date: Jul 2019
Posts: 3
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by mobista
If U will get advanced engineering menu U will be able to do this with proper eeprom values editted.

CarPlay activation is simple
mobista, would you tell me how is it done?
Old 07-16-2019, 07:23 AM
  #53  
chris2011
AutoX
 
chris2011's Avatar
 
Join Date: Jul 2019
Posts: 12
Received 0 Likes on 0 Posts
Default

Originally Posted by chris2
I think the V850 controls variant information, what if you flash the Porsche app and bootloader to the IOC with mib2_ioc_flash, then clone eeprom and reboot?

mib2_ioc_flash updateAppNow /net/mmx/fs/{your_sd_path}/V850app_MLBPO.bin
mib2_ioc_flash updateBoloNow /net/mmx/fs/{your_sd_path}/V850bolo_MLBPO.bin
i will try!

btw do you know does the MMX NOR load the scipts,and greenmenü into the EMMC ? or is this stored in the EMMC over SW updates ?
Old 07-16-2019, 01:27 PM
  #54  
iflywoe
Advanced
 
iflywoe's Avatar
 
Join Date: May 2015
Posts: 54
Likes: 0
Received 3 Likes on 3 Posts
Default

Great work, I been wondering how to myself, would you post links to your suppliers or the part numbers please?
Old 07-16-2019, 04:51 PM
  #55  
chris2
Instructor
Thread Starter
 
chris2's Avatar
 
Join Date: Sep 2017
Location: San Diego
Posts: 187
Received 109 Likes on 38 Posts
Default

Originally Posted by chris2011
i will try!

btw do you know does the MMX NOR load the scipts,and greenmenü into the EMMC ? or is this stored in the EMMC over SW updates ?
GEM is part of the MIBRoot application (I think) but you can enable it through adaptation or by forcing the application into dev mode

Run on MMX
Code:
mount -u /mnt/app
mkdir -p /eso/hmi/lsd/jars

#file location choosen to preserve consistency after flashing /mnt/app
touch /eso/hmi/lsd/development_activated

cp -vRf /eso/hmi/lsd/lastmode_gemmi_enabled.properties.devel /eso/hmi/lsd/lastmode.properties

if [ ! -d /eso/hmi/lsd/jre ]; then
mkdir /eso/hmi/lsd/jre
cp -vRf /ifs/jre/* /eso/hmi/lsd/jre
cp -vRf /ifs/lsd.jxe /eso/hmi/lsd/lsd.jxe
fi
commenting out this line in lsd.sh may get you some additional GEM options, but it has no effect on my system.
Code:
VMOPTIONS="$VMOPTIONS -DIS_PRODUCTION_MODE=true"
Additionally I think the persistence client or IOC is checking the e2p for production mode, so you may have to properly enable production mode via adaptations in order to change your train through the engineering menu. The production mode key is a 3 byte hex value, and I'm not sure how it is calculated. Production mode boolean appears to be stored in the e2p at address 0x3B but it is write locked by the V850, so that is a job for a eprom programmer.


Originally Posted by iflywoe
Great work, I been wondering how to myself, would you post links to your suppliers or the part numbers please?
Here's some part numbers I've found. There's probably more, but it's hard to find them. I've been buying off of eBay, but parts availability is limited.

-> PCM4 Head Unit (Known PNs Listed, Pick One)
- 9P1-035-891 NAR, No Telephone Module
- 9P1-035-880 NAR, Telephone Module Installed, Satellite Radio Installed
- 9P1-035-036 NAR, Telephone Module Installed, No Satellite Radio
- 9P1-035-038 NAR, No Telephone, No Satellite Radio
- 9P1-035-868 AUS, No Telephone Module
- MIB2 Can be converted from other VAG brand if green LVDS connector is present.

-> Display Module (Pick based on your MIB2 having a SIM card slot or not)
- 9P1-919-607 991 / 982 / 981 Compatible (ABTHigh 2 slot - Units w/o tel module)
- 9P1-919-606 991 / 982 / 981 Compatible (ABTHigh 3 slot - Units w/ tel module)

-> Display Module Wiring
- 8L0-971-883 Display CAN + Power Connector (requires crimp tool + TE pins, pinout below) Can be sourced pre-wired from junkyard 05-14 VW dashboard light switches (ex: 1K0 941 334)
- 9P1 970 349 Display LVDS Cable

Sound:
-> Bose Cars
- Must be changed to 4G0-035-220 if Bose is fitted
- MOST wiring must be removed from PCM3.1 harness, and transferred into its own connector:
- TE Connectivity 1-1355531-1 - MOST fiber optic connector inner housing
- TE Connectivity 1-1355426-1 - MOST fiber optic connector outer housing
-> ASK Cars
- Remove ASK amplifier. Amplifier is now part of PCM4, so jumper the wires from one harness to the other. Run additional wires from PCM4 to this location for the additional speakers, depending on sound package.
Old 07-17-2019, 04:57 PM
  #56  
chris2011
AutoX
 
chris2011's Avatar
 
Join Date: Jul 2019
Posts: 12
Received 0 Likes on 0 Posts
Default

It seems there exists different mmx boards in the pcm, here is my board does maybe someone have for it the emmc connections?
Old 07-17-2019, 05:03 PM
  #57  
chris2
Instructor
Thread Starter
 
chris2's Avatar
 
Join Date: Sep 2017
Location: San Diego
Posts: 187
Received 109 Likes on 38 Posts
Default

Originally Posted by chris2011
It seems there exists different mmx boards in the pcm, here is my board does maybe someone have for it the emmc connections?
Same pinout as in the first post. Look at the bottom of the board underneath U1 for the EMMC pinouts. If you are reading the EMMC while installed on the MMX PCB, you need to remove the resistors to the CMD and CLK lines, then replace them when done. One is 0 Ohms, the other (CLK) is 21k ohm IIRC.

Your MMX SKU is the same as my PCM4's MMX SKU - 900-61852-3902-210 L, so there should be no differences in hardware.
What is the VAG part number of your MIB2?
Old 07-17-2019, 05:19 PM
  #58  
chris2011
AutoX
 
chris2011's Avatar
 
Join Date: Jul 2019
Posts: 12
Received 0 Likes on 0 Posts
Default

Originally Posted by chris2
Same pinout as in the first post. Look at the bottom of the board underneath U1 for the EMMC pinouts. If you are reading the EMMC while installed on the MMX PCB, you need to remove the resistors to the CMD and CLK lines, then replace them when done. One is 0 Ohms, the other (CLK) is 21k ohm IIRC.

Your MMX SKU is the same as my PCM4's MMX SKU - 900-61852-3902-210 L, so there should be no differences in hardware.
What is the VAG part number of your MIB2?
Yes you are right sorry, but there exist older boards too

which are different here for eg mib2
Old 07-17-2019, 05:49 PM
  #59  
chris2
Instructor
Thread Starter
 
chris2's Avatar
 
Join Date: Sep 2017
Location: San Diego
Posts: 187
Received 109 Likes on 38 Posts
Default

Originally Posted by chris2011
Yes you are right sorry, but there exist older boards too

which are different here for eg mib2
Yeah you are missing the secondary LVDS deserializer chip, I'm guessing your unit does not have the green HSD connector for an attached display. You can probably add U504 and required passives, I'm assuming the chip is TFP401A(1), but not sure since you do not have any pads for the CY2305 buffer
https://www.digikey.com/product-deta...157-ND/2043052

The correct rev board is 180-61852-BAAC-DC1 for PCM4. Also, I could not help but notice you ignored the question I asked you about the MIB2 part number you have
Old 07-17-2019, 06:58 PM
  #60  
Noah Fect
Rennlist Member
 
Noah Fect's Avatar
 
Join Date: Aug 2012
Location: Pac NW
Posts: 6,243
Received 1,298 Likes on 886 Posts
Default

Well, we can call off the search for the missing MLCC production capacity...


Quick Reply: Retrofitting PCM4 in a 991.1



All times are GMT -3. The time now is 05:43 PM.