Questions about Renesas SH7055. Crc and kernel

General discussion about FastECU

Moderator: Global Moderator

Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

can you confirm that if the page erase work?
I'm not sure. When I do a real write, it freezes without an error. I haven't powered down and checked reads and writes again, but the kernel doesn't respond. And after reset power cycle, the TCU doesn't work. The CAN bus doesn't work, there are no logs, and no responses to kernel queries. But I'm guessing the page was erased, and something else in the kernel. :D
I'll disassemble the kernel now, see where the problem is occurring, set a breakpoint there, and find out what registers are currently being processed. Which registers should I check first?
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »


Zombie47 wrote:
can you confirm that if the page erase work?
I'm not sure. When I do a real write, it freezes without an error. I haven't powered down and checked reads and writes again, but the kernel doesn't respond. And after reset power cycle, the TCU doesn't work. The CAN bus doesn't work, there are no logs, and no responses to kernel queries. But I'm guessing the page was erased, and something else in the kernel. :D
I'll disassemble the kernel now, see where the problem is occurring, set a breakpoint there, and find out what registers are currently being processed. Which registers should I check first?
Well, I'm not sure what happened and what registers to check. Page erase looks succesful because kernel responds after that and flash buffer write also is succesful but when it tries to commit buffer to flash, it freezes.

Erase and write microcodes are transferred to RAM in platf_flash_init before any erase or write actions, same function right after where it checks 180nm/350nm silicon.
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

I disassembled the entire 180nm kernel you sent me. I might be wrong, but I write about it.
I see this:

Code: Select all

Kernel180nm:FFFF6008                 mov.l   #0xFFFF9ABC, r1    ; End BSS
Kernel180nm:FFFF600A                 mov.l   #0xFFFF7978, r0    ; Start BSS  
In the linker you specify the BSS addresses: 0xFFFF7978 - 0xFFFF9ABC

Ultimately you have:
0xFFFF6004 - 0xFFFF7978 - kernel
0xFFFF7978 - 0xFFFF9ABC - BSS adresses (OVERLAP with FL_ERASE_BASE and FL_WRITE_BASE???)
0xFFFF8000 - 0xFFFF8800 - #define FL_ERASE_BASE 0xFFFF8000 (OVERLAP with BSS???)
0xFFFF8800 - 0xFFFF9000 - #define FL_WRITE_BASE 0xFFFF8800
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »

Zombie47 wrote: Tue Nov 11, 2025 12:32 am I disassembled the entire 180nm kernel you sent me. I might be wrong, but I write about it.
I see this:

Code: Select all

Kernel180nm:FFFF6008                 mov.l   #0xFFFF9ABC, r1    ; End BSS
Kernel180nm:FFFF600A                 mov.l   #0xFFFF7978, r0    ; Start BSS  
In the linker you specify the BSS addresses: 0xFFFF7978 - 0xFFFF9ABC

Ultimately you have:
0xFFFF6004 - 0xFFFF7978 - kernel
0xFFFF7978 - 0xFFFF9ABC - BSS adresses (OVERLAP with FL_ERASE_BASE and FL_WRITE_BASE???)
0xFFFF8000 - 0xFFFF8800 - #define FL_ERASE_BASE 0xFFFF8000 (OVERLAP with BSS???)
0xFFFF8800 - 0xFFFF9000 - #define FL_WRITE_BASE 0xFFFF8800
This was something I also suspected. I'm not familiar with sh linker script details (these are partly npkern) to see what the actual problem with the code is, but I built new kernel with BSS moved to 0xFFFF9000-0xFFFFB144 so that should atleast avoid microcodes.

https://drive.google.com/file/d/1k2wHQ_ ... drive_link
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

I guess you've got something mixed up. Old error (0x06) about 350nm (180nm):

Code: Select all

"[2025-11-11 16:06:42.608] (DD) Sent: 00 00 07 e0 be ef 00 01 20 "
"[2025-11-11 16:06:42.609] (DD) Response: 00 00 07 e8 be ef 00 03 7f 20 06 "
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »

Zombie47 wrote: Tue Nov 11, 2025 3:09 pm
I guess you've got something mixed up. Old error (0x06) about 350nm (180nm):

Code: Select all

"[2025-11-11 16:06:42.608] (DD) Sent: 00 00 07 e0 be ef 00 01 20 "
"[2025-11-11 16:06:42.609] (DD) Response: 00 00 07 e8 be ef 00 03 7f 20 06 "
Are you sure you used right kernel? I just compared old and new 180nm kernels and only differences is some addresses/offsets that changed after I moved some RAM part to 0xFFFF9000... when I compared it to 350nm kernel there is area in the end that is missing from 180nm kernels (600 bytes smaller smaller size).
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

Are you sure you used right kernel?
You're right, I got it mixed up. Could you add the version number here so I don't get confused? That's how I do it myself, but I still get confused with the files.
kernelv.jpg
kernelv.jpg (160.25 KiB) Viewed 2180571 times
So far I have the same error. I'm still investigating. Or maybe I've mixed something up again. :D

Code: Select all

"[2025-11-11 17:33:22.891] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 0c 00 ff ff 80 c0 00 06 6f "
"[2025-11-11 17:33:22.912] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-11 17:33:22.912] (DD) Data written to flash buffer"
"[2025-11-11 17:33:22.912] (II) Write flash buffer: 0x00060C00 (4% - 23272 B/s, ~ 6 s)"
"[2025-11-11 17:33:22.912] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 0e 00 00 06 08 95 00 06 08 "
"[2025-11-11 17:33:22.932] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-11 17:33:22.932] (DD) Data written to flash buffer"
"[2025-11-11 17:33:22.932] (II) Write flash buffer: 0x00060E00 (5% - 23272 B/s, ~ 6 s)"
"[2025-11-11 17:33:22.933] (DD) void MainWindow::external_logger_set_progressbar_value(int)"
" 3"
"[2025-11-11 17:33:22.935] (II) Flash buffer write complete... "
"[2025-11-11 17:33:22.935] (DD) Image CRC32: 0xbe5fe24a"
"[2025-11-11 17:33:22.935] (II) Validate flash addr: 0x60000"
" len: 0x1000"
" crc32: 0xbe5fe24a"
"[2025-11-11 17:33:22.935] (DD) Sent: 00 00 07 e0 be ef 00 0b 23 00 06 00 00 10 00 be 5f e2 4a "
"[2025-11-11 17:33:22.939] (DD) Response: 00 00 07 e8 be ef 00 06 7f 23 bb 08 35 8f "
"[2025-11-11 17:33:22.939] (EE) Wrong response from ECU: Unknown error code"
"[2025-11-11 17:33:22.939] (EE) Reflash error! Do not panic, do not reset the ECU immediately. The kernel is most likely still running and receiving commands!"
"[2025-11-11 17:33:22.939] (II) Block 14 reflash failed."
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

There's an old file here! I don't see the new file.
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »

Ok, well, my bad also :oops:

I downloaded that kernel from drive and it still had old addresses... uploaded just new one, should be updated. But confirm please first that in your kernel what you just used, addresses in 0x24 on are FF FF 90 00 FF FF B1 44... if not, download it again from same link.
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

Yahoooo we did it!)) All it works!
180nm.jpg
180nm.jpg (208.98 KiB) Viewed 2180566 times
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »

Oh yeah! :geek:

No I just need to combine those two kernels :D
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

Or add a new line SH7055S
Zombie47
Newbie
Posts: 33
Joined: Thu Oct 30, 2025 12:02 am

Re: Questions about Renesas SH7055. Crc and kernel

Post by Zombie47 »

And regarding the second point of my "CRC" topic.
I haven't yet figured out how it works in FastEcu. But the Subaru SH7055 has three types of software for calculating CRC.
1. ECU
2. TCU 1 type
3. TCU 2 type
I know how to calculate them. When I figure out how it's done in your program, I'll write about it in detail.
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »

There is ECU and one TCU (sh7055 350nm) calculation already. TCU is here:
https://github.com/miikasyvanen/FastECU ... sh7055.cpp

It is easy to add code for another. Lookup is done in software if definition file tells there is checksum calculation for it and it calculates it when saved or flashed.
MiikaS
Administrator
Posts: 973
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: Questions about Renesas SH7055. Crc and kernel

Post by MiikaS »

Zombie47 wrote: Tue Nov 11, 2025 6:13 pm Or add a new line SH7055S
I just want one kernel to work for all SH7055 ECUs if possible :mrgreen:

BTW, did you write ECU or TCU with that kernel? Just wonder, is it possible to write TCU also with it. Because there's SH7055 350nm TCU module and it has kernel start address 0xFFFF9000. It's not written by me and wonder, is it possible to use 0xFFFF6004 for that too... If yes, then we could have both ECU and TCU modules, 4 versions, using one kernel.
Post Reply