Page 2 of 4
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 6:54 am
by MiikaS
Zombie47 wrote: Sun Nov 09, 2025 12:05 am
I'm still trying to figure out why your kernel ((ssmk_can_sh7055.bin) can't write to the FKEY FFFFE804, but my mini mod can. In to SH7055 180nm.
The kernel runs from RAM, and my mini mod runs from ROM.
I don't see yet anything in the SH7058 datasheet that could restrict with writing to the FKEY FFFFE804.
Actually it did write to that register, that's why it gives error as the silicon is 180nm, maybe I was little unclear in my msg.
Failing to write FKEY FFFFE804 = 350nm and no errorcode
Able to write SWE2 in FLMCR2 = 350nm and no errorcode
While kernel is able to write FKEY FFFFE804 and fails to write SWE2 in FLMCR2 it gives errorcode 0x06 (0x04 + 0x02) so it is 180nm silicon.
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 5:09 pm
by Zombie47
I made a big mistake. During testing, I was constantly patching the kernel from IDA. I thought that if I reverted the changes in IDA and patched the kernel, I would return the bin file to its original state, but the patches kept overlapping.
Yes, everything is fine. Your code works successfully on the TCU 4AT:
Failing to write SWE2 in FLMCR2 = 180nm and it gets errorcode 0x02
Able to write FKEY FFFFE804 = 180nm and it gets errorcode 0x04
it gives return errorcode 0x06 (0x04 + 0x02)
I disabled these errors and write to FKEY 0x5A instead of 0x33 to see what would happen next. Then I got this error:
"[2025-11-09 16:56:28.080] (II) Flash page erase addr: 0x00060000 len: 0x00010000"
"[2025-11-09 16:56:28.080] (II) Erasing flash page..."
"[2025-11-09 16:56:28.080] (DD) Sent: 00 00 07 e0 be ef 00 05 25 00 06 00 00 "
"[2025-11-09 16:56:29.097] (DD) Response: 00 00 07 e8 be ef 00 03 7f 25 8d "
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 6:56 pm
by MiikaS
Zombie47 wrote: Sun Nov 09, 2025 5:09 pm
I made a big mistake. During testing, I was constantly patching the kernel from IDA. I thought that if I reverted the changes in IDA and patched the kernel, I would return the bin file to its original state, but the patches kept overlapping.
Yes, everything is fine. Your code works successfully on the TCU 4AT:
Failing to write SWE2 in FLMCR2 = 180nm and it gets errorcode 0x02
Able to write FKEY FFFFE804 = 180nm and it gets errorcode 0x04
it gives return errorcode 0x06 (0x04 + 0x02)
I disabled these errors and write to FKEY 0x5A instead of 0x33 to see what would happen next. Then I got this error:
"[2025-11-09 16:56:28.080] (II) Flash page erase addr: 0x00060000 len: 0x00010000"
"[2025-11-09 16:56:28.080] (II) Erasing flash page..."
"[2025-11-09 16:56:28.080] (DD) Sent: 00 00 07 e0 be ef 00 05 25 00 06 00 00 "
"[2025-11-09 16:56:29.097] (DD) Response: 00 00 07 e8 be ef 00 03 7f 25 8d "
That
7f 25 8d is error in flash erase (0x8d = PFEB_VERIFAIL). 350nm flash operations won't work on 180nm silicon.
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 7:57 pm
by Zombie47
That 7f 25 8d is error in flash erase (0x8d = PFEB_VERIFAIL). 350nm flash operations won't work on 180nm silicon.
Yes, thank's i see. I just write down my steps here. I don't yet know the exact steps for how flash operations work in the 7055 - 350nm in the 7058.
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 8:29 pm
by Zombie47
Can you compile the kernel with pl_flash_705x_180nm.c configuration?
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 9:03 pm
by MiikaS
Zombie47 wrote: Sun Nov 09, 2025 8:29 pm
Can you compile the kernel with pl_flash_705x_180nm.c configuration?
https://drive.google.com/file/d/1k-wuCa ... drive_link
As a warning, if you test this, make sure you can use FDT Reneasas to flash it back
Basicly "read" and "test write"
should work without any danger but everything is possible...
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 11:05 pm
by Zombie47
If I understand correctly, the 180nm SH7055 is the SH7055S, or the closest thing to it.
The 350nm SH7055 uses FFFF6000-FFFF67FF as its bootloader area, and its kernel is written from FFFF6004. The kernel can write data directly to flash memory.
The SH7058 has six addresses: FFFF0000, FFFF0800, FFFF1000, FFFF1800, FFFF2000, and FFFF2800, for loading its own mini-kernel from its internal hidden memory. Your kernel is written from FFFF3000. Your kernel can't write data directly to flash memory, but it can download and run this mini-kernel from the addresses above. Your kernel can then communicate with the internal kernel to write to flash.
The SH7055 180nm, as you mentioned, is similar to the SH7058 in terms of bootloader.
But it has less memory. It also has six different addresses (FFFF6000, FFFF6800, FFFF7000, FFFF7800, FFFF8000, FFFF8800) for loading its own mini-kernel from its internal hidden memory.
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 11:09 pm
by Zombie47
MiikaS wrote: Sun Nov 09, 2025 9:03 pm
Zombie47 wrote: Sun Nov 09, 2025 8:29 pm
Can you compile the kernel with pl_flash_705x_180nm.c configuration?
https://drive.google.com/file/d/1k-wuCa ... drive_link
As a warning, if you test this, make sure you can use FDT Reneasas to flash it back
Basicly "read" and "test write"
should work without any danger but everything is possible...
I never use "test wtire", only hardcore
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 11:18 pm
by Zombie47
MiikaS wrote: Sun Nov 09, 2025 9:03 pm
Zombie47 wrote: Sun Nov 09, 2025 8:29 pm
Can you compile the kernel with pl_flash_705x_180nm.c configuration?
https://drive.google.com/file/d/1k-wuCa ... drive_link
As a warning, if you test this, make sure you can use FDT Reneasas to flash it back
Basicly "read" and "test write"
should work without any danger but everything is possible...
Thanks, it doesn't work. I think you're using the wrong address:
"[2025-11-10 00:09:45.006] (DD) Start address to upload kernel: ffff6004"
"[2025-11-10 00:09:45.006] (II) Set kernel upload address"
"[2025-11-10 00:09:45.007] (DD) Sent: 00 0f ff fe 7a 9c ff ff 60 04 00 00 "
Because in the SH7055S, these addresses are for its own kernel:
But it has less memory. It also has six different addresses (FFFF6000, FFFF6800, FFFF7000, FFFF7800, FFFF8000, FFFF8800) for loading its own mini-kernel from its internal hidden memory.
There is full log:
Code: Select all
"[2025-11-10 00:09:48.660] (II) Kernel ID: FastECU Subaru SH7055 CAN Kernel v1.00"
"[2025-11-10 00:09:48.661] (DD) void MainWindow::external_logger(QString)"
" Writing ROM, please wait..."
"[2025-11-10 00:09:48.661] (II) Writing ROM to Subaru 02+ 32-bit Denso using DensoCAN"
"[2025-11-10 00:09:48.661] (DD) void MainWindow::external_logger_set_progressbar_value(int)"
" 0"
"[2025-11-10 00:09:48.672] (II) --- Comparing ECU flash memory pages to image file ---"
"[2025-11-10 00:09:48.672] (II) blk\tstart\tlen\tecu crc\timg crc\tsame?"
"[2025-11-10 00:09:48.672] (II) FB00\t0x00000000\t0x00001000"
"[2025-11-10 00:09:48.672] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 00 00 00 00 10 00 "
"[2025-11-10 00:09:48.675] (DD) Response: 00 00 07 e8 be ef 00 05 42 a1 17 80 6b "
"[2025-11-10 00:09:48.676] (DD) ROM CRC: 0xa117806b IMG CRC: 0xa117806b"
"\tA117806B\tA117806B"
"\tYES"
"[2025-11-10 00:09:48.891] (DD) Response: "
"[2025-11-10 00:09:48.896] (II) FB01\t0x00001000\t0x00001000"
"[2025-11-10 00:09:48.897] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 10 00 00 00 10 00 "
"[2025-11-10 00:09:48.900] (DD) Response: 00 00 07 e8 be ef 00 05 42 ed 54 eb 5a "
"[2025-11-10 00:09:48.900] (DD) ROM CRC: 0xed54eb5a IMG CRC: 0xed54eb5a"
"\tED54EB5A\tED54EB5A"
"\tYES"
"[2025-11-10 00:09:49.108] (DD) Response: "
"[2025-11-10 00:09:49.113] (II) FB02\t0x00002000\t0x00001000"
"[2025-11-10 00:09:49.113] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 20 00 00 00 10 00 "
"[2025-11-10 00:09:49.116] (DD) Response: 00 00 07 e8 be ef 00 05 42 d4 22 87 64 "
"[2025-11-10 00:09:49.116] (DD) ROM CRC: 0xd4228764 IMG CRC: 0xd4228764"
"\tD4228764\tD4228764"
"\tYES"
"[2025-11-10 00:09:49.325] (DD) Response: "
"[2025-11-10 00:09:49.330] (II) FB03\t0x00003000\t0x00001000"
"[2025-11-10 00:09:49.330] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 30 00 00 00 10 00 "
"[2025-11-10 00:09:49.333] (DD) Response: 00 00 07 e8 be ef 00 05 42 86 c6 3a 5a "
"[2025-11-10 00:09:49.333] (DD) ROM CRC: 0x86c63a5a IMG CRC: 0x86c63a5a"
"\t86C63A5A\t86C63A5A"
"\tYES"
"[2025-11-10 00:09:49.541] (DD) Response: "
"[2025-11-10 00:09:49.546] (II) FB04\t0x00004000\t0x00001000"
"[2025-11-10 00:09:49.546] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 40 00 00 00 10 00 "
"[2025-11-10 00:09:49.549] (DD) Response: 00 00 07 e8 be ef 00 05 42 88 86 11 fa "
"[2025-11-10 00:09:49.549] (DD) ROM CRC: 0x888611fa IMG CRC: 0x888611fa"
"\t888611FA\t888611FA"
"\tYES"
"[2025-11-10 00:09:49.757] (DD) Response: "
"[2025-11-10 00:09:49.762] (II) FB05\t0x00005000\t0x00001000"
"[2025-11-10 00:09:49.762] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 50 00 00 00 10 00 "
"[2025-11-10 00:09:49.765] (DD) Response: 00 00 07 e8 be ef 00 05 42 e5 36 c9 d6 "
"[2025-11-10 00:09:49.765] (DD) ROM CRC: 0xe536c9d6 IMG CRC: 0xe536c9d6"
"\tE536C9D6\tE536C9D6"
"\tYES"
"[2025-11-10 00:09:49.973] (DD) Response: "
"[2025-11-10 00:09:49.978] (II) FB06\t0x00006000\t0x00001000"
"[2025-11-10 00:09:49.978] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 60 00 00 00 10 00 "
"[2025-11-10 00:09:49.981] (DD) Response: 00 00 07 e8 be ef 00 05 42 f1 5d 4d a3 "
"[2025-11-10 00:09:49.981] (DD) ROM CRC: 0xf15d4da3 IMG CRC: 0xf15d4da3"
"\tF15D4DA3\tF15D4DA3"
"\tYES"
"[2025-11-10 00:09:50.187] (DD) Response: "
"[2025-11-10 00:09:50.192] (II) FB07\t0x00007000\t0x00001000"
"[2025-11-10 00:09:50.192] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 70 00 00 00 10 00 "
"[2025-11-10 00:09:50.195] (DD) Response: 00 00 07 e8 be ef 00 05 42 b1 d3 9f 1d "
"[2025-11-10 00:09:50.195] (DD) ROM CRC: 0xb1d39f1d IMG CRC: 0xb1d39f1d"
"\tB1D39F1D\tB1D39F1D"
"\tYES"
"[2025-11-10 00:09:50.404] (DD) Response: "
"[2025-11-10 00:09:50.409] (II) FB08\t0x00008000\t0x00008000"
"[2025-11-10 00:09:50.409] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 00 80 00 00 00 80 00 "
"[2025-11-10 00:09:50.423] (DD) Response: 00 00 07 e8 be ef 00 05 42 99 43 16 c7 "
"[2025-11-10 00:09:50.423] (DD) ROM CRC: 0x994316c7 IMG CRC: 0x994316c7"
"\t994316C7\t994316C7"
"\tYES"
"[2025-11-10 00:09:50.636] (DD) Response: "
"[2025-11-10 00:09:50.641] (II) FB09\t0x00010000\t0x00010000"
"[2025-11-10 00:09:50.641] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 01 00 00 00 01 00 00 "
"[2025-11-10 00:09:50.667] (DD) Response: 00 00 07 e8 be ef 00 05 42 db 0f ad 0f "
"[2025-11-10 00:09:50.667] (DD) ROM CRC: 0xdb0fad0f IMG CRC: 0xdb0fad0f"
"\tDB0FAD0F\tDB0FAD0F"
"\tYES"
"[2025-11-10 00:09:50.868] (DD) Response: "
"[2025-11-10 00:09:50.873] (II) FB10\t0x00020000\t0x00010000"
"[2025-11-10 00:09:50.873] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 02 00 00 00 01 00 00 "
"[2025-11-10 00:09:50.899] (DD) Response: 00 00 07 e8 be ef 00 05 42 b8 53 ea 03 "
"[2025-11-10 00:09:50.900] (DD) ROM CRC: 0xb853ea03 IMG CRC: 0xb853ea03"
"\tB853EA03\tB853EA03"
"\tYES"
"[2025-11-10 00:09:51.102] (DD) Response: "
"[2025-11-10 00:09:51.107] (II) FB11\t0x00030000\t0x00010000"
"[2025-11-10 00:09:51.107] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 03 00 00 00 01 00 00 "
"[2025-11-10 00:09:51.133] (DD) Response: 00 00 07 e8 be ef 00 05 42 fa 25 47 89 "
"[2025-11-10 00:09:51.133] (DD) ROM CRC: 0xfa254789 IMG CRC: 0xfa254789"
"\tFA254789\tFA254789"
"\tYES"
"[2025-11-10 00:09:51.349] (DD) Response: "
"[2025-11-10 00:09:51.354] (II) FB12\t0x00040000\t0x00010000"
"[2025-11-10 00:09:51.354] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 04 00 00 00 01 00 00 "
"[2025-11-10 00:09:51.380] (DD) Response: 00 00 07 e8 be ef 00 05 42 99 cb 27 47 "
"[2025-11-10 00:09:51.381] (DD) ROM CRC: 0x99cb2747 IMG CRC: 0x99cb2747"
"\t99CB2747\t99CB2747"
"\tYES"
"[2025-11-10 00:09:51.582] (DD) Response: "
"[2025-11-10 00:09:51.587] (II) FB13\t0x00050000\t0x00010000"
"[2025-11-10 00:09:51.587] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 05 00 00 00 01 00 00 "
"[2025-11-10 00:09:51.613] (DD) Response: 00 00 07 e8 be ef 00 05 42 a0 3f dd fe "
"[2025-11-10 00:09:51.614] (DD) ROM CRC: 0xa03fddfe IMG CRC: 0xa03fddfe"
"\tA03FDDFE\tA03FDDFE"
"\tYES"
"[2025-11-10 00:09:51.816] (DD) Response: "
"[2025-11-10 00:09:51.821] (II) FB14\t0x00060000\t0x00010000"
"[2025-11-10 00:09:51.821] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 06 00 00 00 01 00 00 "
"[2025-11-10 00:09:51.847] (DD) Response: 00 00 07 e8 be ef 00 05 42 86 b0 5e 8e "
"[2025-11-10 00:09:51.848] (DD) ROM CRC: 0x86b05e8e IMG CRC: 0xfd1b4637"
"\t86B05E8E\tFD1B4637"
"\tNO"
"[2025-11-10 00:09:52.049] (DD) Response: "
"[2025-11-10 00:09:52.054] (II) FB15\t0x00070000\t0x00010000"
"[2025-11-10 00:09:52.054] (DD) Sent: 00 00 07 e0 be ef 00 09 02 00 07 00 00 00 01 00 00 "
"[2025-11-10 00:09:52.080] (DD) Response: 00 00 07 e8 be ef 00 05 42 9c 34 53 be "
"[2025-11-10 00:09:52.081] (DD) ROM CRC: 0x9c3453be IMG CRC: 0x999c8552"
"\t9C3453BE\t999C8552"
"\tNO"
"[2025-11-10 00:09:52.296] (DD) Response: "
"[2025-11-10 00:09:52.301] (II) Different blocks : "
"14, "
"15, "
" (total: 2)"
"[2025-11-10 00:09:52.301] (II) --- Start writing ROM file to ECU flash memory ---"
"[2025-11-10 00:09:52.301] (II) Check max message length"
"[2025-11-10 00:09:52.301] (DD) Sent: 00 00 07 e0 be ef 00 01 05 "
"[2025-11-10 00:09:52.302] (DD) Response: 00 00 07 e8 be ef 00 05 45 00 00 02 00 "
": 0x0200"
"[2025-11-10 00:09:52.302] (II) Check flashblock size"
"[2025-11-10 00:09:52.302] (DD) Sent: 00 00 07 e0 be ef 00 01 06 "
"[2025-11-10 00:09:52.303] (DD) Response: 00 00 07 e8 be ef 00 05 46 00 00 10 00 "
": 0x1000"
"[2025-11-10 00:09:52.303] (II) Test write mode off, perform actual flash write"
"[2025-11-10 00:09:52.303] (DD) Sent: 00 00 07 e0 be ef 00 01 20 "
"[2025-11-10 00:09:52.304] (DD) Response: 00 00 07 e8 be ef 00 01 60 "
"[2025-11-10 00:09:52.305] (EE) Flash mode succesfully set"
"[2025-11-10 00:09:52.305] (II) Flash block addr: 0x00060000 len: 0x00010000"
"[2025-11-10 00:09:52.305] (II) Check flash voltage"
"[2025-11-10 00:09:52.305] (DD) Sent: 00 00 07 e0 be ef 00 01 04 "
"[2025-11-10 00:09:52.306] (DD) Response: 00 00 07 e8 be ef 00 05 44 02 30 02 30 "
": 11.2V"
"[2025-11-10 00:09:52.306] (II) Flash page erase addr: 0x00060000 len: 0x00010000"
"[2025-11-10 00:09:52.306] (II) Erasing flash page..."
"[2025-11-10 00:09:52.306] (DD) Sent: 00 00 07 e0 be ef 00 05 25 00 06 00 00 "
"[2025-11-10 00:09:53.104] (DD) Response: 00 00 07 e8 be ef 00 01 65 "
" erased"
"[2025-11-10 00:09:53.104] (II) Start flash write addr: 0x00060000 len: 0x00010000"
"[2025-11-10 00:09:53.104] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 00 00 50 46 44 31 36 57 41 "
"[2025-11-10 00:09:53.124] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.125] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.125] (II) Write flash buffer: 0x00060000 (0% - 102025736 B/s, ~ 4294967040 s)"
"[2025-11-10 00:09:53.141] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 02 00 02 00 04 00 40 30 00 "
"[2025-11-10 00:09:53.161] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.161] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.161] (II) Write flash buffer: 0x00060200 (0% - 25600 B/s, ~ 6 s)"
"[2025-11-10 00:09:53.161] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 04 00 00 03 00 03 00 03 00 "
"[2025-11-10 00:09:53.182] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.182] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.182] (II) Write flash buffer: 0x00060400 (1% - 14222 B/s, ~ 10 s)"
"[2025-11-10 00:09:53.182] (DD) void MainWindow::external_logger_set_progressbar_value(int)"
" 1"
"[2025-11-10 00:09:53.184] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 06 00 76 55 74 94 0e 0a 00 "
"[2025-11-10 00:09:53.205] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.205] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.205] (II) Write flash buffer: 0x00060600 (2% - 25600 B/s, ~ 6 s)"
"[2025-11-10 00:09:53.207] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 08 00 46 50 03 e8 46 50 ff "
"[2025-11-10 00:09:53.227] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.228] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.228] (II) Write flash buffer: 0x00060800 (3% - 23272 B/s, ~ 6 s)"
"[2025-11-10 00:09:53.230] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 0a 00 ff ff 80 14 00 06 ad "
"[2025-11-10 00:09:53.251] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.251] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.251] (II) Write flash buffer: 0x00060A00 (3% - 23272 B/s, ~ 6 s)"
"[2025-11-10 00:09:53.252] (DD) void MainWindow::external_logger_set_progressbar_value(int)"
" 2"
"[2025-11-10 00:09:53.253] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 0c 00 ff ff 80 c0 00 06 6f "
"[2025-11-10 00:09:53.274] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.274] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.274] (II) Write flash buffer: 0x00060C00 (4% - 22260 B/s, ~ 6 s)"
"[2025-11-10 00:09:53.274] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 06 0e 00 00 06 08 95 00 06 08 "
"[2025-11-10 00:09:53.294] (DD) Response: 00 00 07 e8 be ef 00 01 62 "
"[2025-11-10 00:09:53.295] (DD) Data written to flash buffer"
"[2025-11-10 00:09:53.295] (II) Write flash buffer: 0x00060E00 (5% - 23272 B/s, ~ 6 s)"
"[2025-11-10 00:09:53.295] (DD) void MainWindow::external_logger_set_progressbar_value(int)"
" 3"
"[2025-11-10 00:09:53.298] (II) Flash buffer write complete... "
"[2025-11-10 00:09:53.298] (DD) Image CRC32: 0xbe5fe24a"
"[2025-11-10 00:09:53.298] (II) Committ flash addr: 0x60000"
" len: 0x1000"
" crc32: 0xbe5fe24a"
"[2025-11-10 00:09:53.298] (DD) Sent: 00 00 07 e0 be ef 00 0b 24 00 06 00 00 10 00 be 5f e2 4a "
"[2025-11-10 00:09:56.302] (DD) Response: "
"[2025-11-10 00:09:56.302] (EE) No valid response from ECU"
"[2025-11-10 00:09:56.302] (EE) Reflash error! Do not panic, do not reset the ECU immediately. The kernel is most likely still running and receiving commands!"
"[2025-11-10 00:09:56.302] (II) Block 14 reflash failed."
"[2025-11-10 00:09:56.302] (DD) void MainWindow::external_logger(QString)"
" Finished"
And its own kernel rewrites your kernel
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 11:46 pm
by MiikaS
These are the addresses set to load the microcodes/microkernels:
Code: Select all
#define FL_ERASE_BASE 0xFFFF8000
#define FL_WRITE_BASE 0xFFFF8800
And as I have no sh7055 180nm ECUs lying around, I had no chance to do any tests...
From my undestanding, in Subaru, in both sh7055 versions (180nm/350nm) external kernel is loaded to 0xFFFF6004 and ECU jumps to 0xFFFF6000 when it runs kernel. I haven't get very deep in this, because as I said, I have no ECUs with 180nm sh7055 and also when this issue came up, my time was already very limited to do any tests and I just forget whole thing
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Sun Nov 09, 2025 11:55 pm
by Zombie47
Ok, now I'll have something to work with.
I can write flash on the table via FDT, and I can also write flash in the car via PCM Flash, but I want FastEcu to be able to do this.
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Mon Nov 10, 2025 12:01 am
by MiikaS
Nice!
If you come up with something you want to test, let me now, I can always build new kernel to test for.
Now I need some sleep
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Mon Nov 10, 2025 2:13 am
by Zombie47
I'll be writing about things I see in datashets that seem insignificant to me. But just in case, I'll be writing about them, in case they play a role or spark an idea:
SH7058:
1.
The operating frequency at programming/erasing is a maximum of 40 MHz.
2.
Store general registers R8 to R15 and the control register GBR. General registers R0 to R7 are
available without storing them.
SH7055S:
1. There is no this string.
2.
The general registers R8 to R15 are stored. The general registers R0 to R7 can be used without
being stored.
On the SH7055S board, there is a high level on pins MD0, MD1, MD2.
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Mon Nov 10, 2025 2:42 am
by Zombie47
And I didn't notice when I was writing in flash, I didn't get the error code and didn't send it to you. But when I tried to test write, I got the error code:
Code: Select all
"[2025-11-10 01:24:59.604] (II) Flash buffer write complete... "
"[2025-11-10 01:24:59.604] (DD) Image CRC32: 0xbe5fe24a"
"[2025-11-10 01:24:59.604] (II) Validate flash addr: 0x60000"
" len: 0x1000"
" crc32: 0xbe5fe24a"
"[2025-11-10 01:24:59.604] (DD) Sent: 00 00 07 e0 be ef 00 0b 23 00 06 00 00 10 00 be 5f e2 4a "
"[2025-11-10 01:24:59.607] (DD) Response: 00 00 07 e8 be ef 00 06 7f 23 bb 08 35 8f "
"[2025-11-10 01:24:59.607] (EE) Wrong response from ECU: Unknown error code"
What about this error code?
Re: Questions about Renesas SH7055. Crc and kernel
Posted: Mon Nov 10, 2025 9:28 am
by MiikaS
Zombie47 wrote: Mon Nov 10, 2025 2:42 am
And I didn't notice when I was writing in flash, I didn't get the error code and didn't send it to you. But when I tried to test write, I got the error code:
Code: Select all
"[2025-11-10 01:24:59.604] (II) Flash buffer write complete... "
"[2025-11-10 01:24:59.604] (DD) Image CRC32: 0xbe5fe24a"
"[2025-11-10 01:24:59.604] (II) Validate flash addr: 0x60000"
" len: 0x1000"
" crc32: 0xbe5fe24a"
"[2025-11-10 01:24:59.604] (DD) Sent: 00 00 07 e0 be ef 00 0b 23 00 06 00 00 10 00 be 5f e2 4a "
"[2025-11-10 01:24:59.607] (DD) Response: 00 00 07 e8 be ef 00 06 7f 23 bb 08 35 8f "
"[2025-11-10 01:24:59.607] (EE) Wrong response from ECU: Unknown error code"
What about this error code?
That error comes when in test write mode it validates CRC32 of flash buffer (in real write it writes flash and then validates CRC32 of written flash), but somehow the sent data does not match to data in flash buffer. Image CRC32 is 0xbe5fe24a and flash buffer CRC32 is 0xbb08358f.
EDIT: Also looking at real write log, it looks that page erase is succesfull but when writing to buffer/commit flash, it overflows or something and then corrupts/freezes kernel... can you confirm that if the page erase work? Maybe by comparing CRC32's between write attempts?
