Pages: 1 ... 128 129 [130] 131 132 ... 182
Author Topic: The Volvo ME7 thread:  (Read 1076077 times)
daniel2345
Full Member
***

Karma: +11/-7
Offline Offline

Posts: 197


« Reply #1935 on: November 27, 2022, 02:28:47 PM »

Difficult to say. Just honest brainstorming:

Read alot about OSI Layer Model.

You are mixing physical layer, transport layer, protocol, sessions, diagnostic, swdl and so on.

Some ISO documents can cover one or more layers,different sessions, etc.


For Volvo not much is public, so reading everything about that stuff on VAG could help.


Then read stuff about microcontroller software updates in general. Try to find automotive specific informations then. What is a primary Bootloader, why is there a secondary? What is CPU Boot mode, what is customer boot mode? Does it need different stages?

What is internal memory, how external can be addressed in memory space? What is memory space, what are memory segments? What is linear adress space, what is paging and windowing? What is software, what is application data?

I think someone mentioned already, that for volvo secondary Bootloaders will be needed. Prepare yourself for the cpu and ecu specific development of it. Your CPU is a Renesas SH7055.
Get familiar with assembly programming and the SH2 Instruction set. User MAT concept is to be understood. Ram, Rom...etc.

Or, as everyone else is doing here obviously: steal it from someone / some tool developer rather then think yourself Cheesy

« Last Edit: November 27, 2022, 02:33:28 PM by daniel2345 » Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #1936 on: November 27, 2022, 02:48:59 PM »

Maybe you were referring to my TCP/IP implementation. The RPI has no native way to communicate with Windows via USB or anything else. I decided to change this by using TCP sockets and using a shared network between the Raspberry Pi and Windows, as Sardine was written to work with Arduino and COM ports. And obviously Linux has native support for pretty much anything I could think of. So it's working nicely.
Anyway, thanks for the pointers. The VAG group are all Bosch. And, at least in my case, my S60 is Denso. And yes, I understood early on that there are less open source tools for Denso than there are for Bosch, but luckily the Subie guys have done the hard part(arguably the hardest out of all of this)

Here is the link in case anyone ever needs a base start on the kernel aka bootloader. https://github.com/fenugrec/npkern . As-is, it's currently not compatible with Volvo for a variety of reasons, but I will get to it in the near future.
« Last Edit: November 27, 2022, 02:55:21 PM by dikidera » Logged
daniel2345
Full Member
***

Karma: +11/-7
Offline Offline

Posts: 197


« Reply #1937 on: November 27, 2022, 02:54:56 PM »

Maybe you were referring to my TCP/IP implementation. The RPI has no native way to communicate with Windows via USB or anything else. I decided to change this by using TCP sockets and using a shared network, as Sardine was written to work with Arduino and COM ports.

Nope. That's yust communication with your tool choice. Im talking only about "ecu side".
My text are hints, things i came across. Must admit took me some years to understand everything. My impression was, you haven't so far. Sorry if im wrong. Smiley

When you have understood everything above, you will know why someone's subaru boot loader will not help you much. Start from scratch.
« Last Edit: November 27, 2022, 02:57:25 PM by daniel2345 » Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #1938 on: November 27, 2022, 02:59:18 PM »

Nope. That's yust communication with your tool choice. Im talking only about "ecu side".
My text are hints, things i came across. Must admit took me some years to understand everything. My impression was, you haven't so far. Sorry if im wrong. Smiley
I do not believe you are truly wrong. It has been only like 2 months since I started from scratch when it comes to car ECUs and Tuning. I truly had no idea how people did tunes, what maps were nor the software. It was very very difficult to build context between all the information(that is again, very fragmented). It took me a while afterwards to find dumps for my specific vehicle, to compare tunes and see what was changed, guess it's factors. As soon as I had some semblance of understanding I wanted to try and tune myself, I needed to flash my changes(to a test ECU I bought online, I wouldn't dare change anything on my running car), which is where all this lead me. Obviously, all the while reverse engineering the SH2 dumps I have, the SH2 arch is...unusual to say the least. But at least I was able to easily see what was data and what was code, as the architecture is such, that IDA produces almost sensible code from the data.

EDIT:
The subaru bootloader cannot work for me as-is, I know this, because it relies on the Subaru specific semantics, the guy's code will hopefully at least get me started in some direction. I just haven't had time to look at it properly. I am very focused on having VIDA communicate with my RPI.

As soon as I progress further will I have time to look at the next objective. Yes I have split everything into smaller tasks.
« Last Edit: November 27, 2022, 03:52:46 PM by dikidera » Logged
keichi
Full Member
***

Karma: +10/-2
Offline Offline

Posts: 73


« Reply #1939 on: November 28, 2022, 04:40:55 AM »

Does anyone have an Tune with Antilag/NLS Inside which works in every Mode?  Softwareversion could be GPHJ/GSJH something 05>

With Best Regards

Some time ago I asked about your MAF readings because i do exactly the same 100-200 time (12,3s?) and i am trying to estimate my HP (no dyno yet) but no answer form you Smiley

As for NLS i have it implemented on my 02 2.3 T5 and it is working well (perfectly flat boost between gear changes) Smiley I belive you need to dissasemple your bin to do it on your car. At least i can't imagine it be done on bare bin by just patching "random" things Smiley
Logged
V70_T5
Jr. Member
**

Karma: +1/-1
Offline Offline

Posts: 28


« Reply #1940 on: November 28, 2022, 02:11:00 PM »

Some time ago I asked about your MAF readings because i do exactly the same 100-200 time (12,3s?) and i am trying to estimate my HP (no dyno yet) but no answer form you Smiley

As for NLS i have it implemented on my 02 2.3 T5 and it is working well (perfectly flat boost between gear changes) Smiley I belive you need to dissasemple your bin to do it on your car. At least i can't imagine it be done on bare bin by just patching "random" things Smiley


Did you asked me over PM or in this Thread, maybe i overread it... my MAF Readings would be actually useless because i have 10% Airleak Somewhere...

Answered you with an PM Smiley
« Last Edit: November 28, 2022, 02:14:47 PM by V70_T5 » Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #1941 on: November 28, 2022, 02:16:25 PM »


Did you asked me over PM or in this Thread, maybe i overread it... my MAF Readings would be actually useless because i have 10% Airleak Somewhere...

Answered you with an PM Smiley
Check your brake booster seal from within the cabin. It's a common failure point on the S60s. Replacement can be in-car but difficult if a manual due to the clutch pedal.
Logged
keichi
Full Member
***

Karma: +10/-2
Offline Offline

Posts: 73


« Reply #1942 on: November 29, 2022, 03:26:24 AM »

Brake booster leak shouldn't be related with boost leak because vacuum hose from engine to BB has one way valve - at least if it's working Smiley
Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #1943 on: November 29, 2022, 03:55:00 AM »

Brake booster leak shouldn't be related with boost leak because vacuum hose from engine to BB has one way valve - at least if it's working Smiley
Both should be checked out then. Not unlikely failure point. Then all the rest of the hoses, the PCV(on the old S40s a failed PCV diaphragm caused vacuum leaks for me)
Logged
Vollmer
Full Member
***

Karma: +14/-256
Offline Offline

Posts: 78

Professional Cat Herder


« Reply #1944 on: November 29, 2022, 04:33:49 PM »

"I got my transceiver (NXP TJA1040) from an old XC70 Rear Electronic Module.
There is poetic pleasure in using a Volvo component to recover what was taken from you by Volvo Smiley
I'm alluding here to your right to customize or repair your car.
This PIN business or being locked out of using spare parts is really sleazy."
« Last Edit: November 29, 2022, 08:43:56 PM by Vollmer » Logged

Volvo HALL of SHAME:

Guitar24t aka Robert Hilton
SparkyR aka Brandon Halme
Prometey1982 aka Artem Vasiliev
MAXX ECU - Brett Willet
VIDA Leach - David Leech

Useless Twats:
PRJ - Dmitri from Estonia
BaxtR
Full Member
***

Karma: +17/-25
Offline Offline

Posts: 64


« Reply #1945 on: November 30, 2022, 05:43:42 PM »

"I got my transceiver (NXP TJA1040) from an old XC70 Rear Electronic Module.
There is poetic pleasure in using a Volvo component to recover what was taken from you by Volvo Smiley
I'm alluding here to your right to customize or repair your car.
This PIN business or being locked out of using spare parts is really sleazy."


Dude can you just like, stop? no one cares and youre just making a fool out of yourself. go ahead and "bring the ship down" "turn everything to ashes"

youre literally a moron filling up useful threads with nonsense.
Logged

2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
SparkyR
Full Member
***

Karma: +18/-21
Offline Offline

Posts: 77



« Reply #1946 on: November 30, 2022, 05:54:42 PM »

He’s just seeking attention. The more you acknowledge him he’s just getting what he wants.
Logged

2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, id1700cc injectors
BaxtR
Full Member
***

Karma: +17/-25
Offline Offline

Posts: 64


« Reply #1947 on: November 30, 2022, 06:28:10 PM »

He’s just seeking attention. The more you acknowledge him he’s just getting what he wants.

Just trying to ease the tension here my friend.. Hope you can understand. Miss you around these parts
Logged

2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #1948 on: December 01, 2022, 04:41:07 PM »

So I experimented like so:
I sent 4 byte code via 7A9CFFFF0000 (jump to address).
Then I wrote the 4 bytes which were AFFB0009 which corrsponds to an empty while(1) { }, with the command 7AAEAFFB0009.
Then I did 7AA8(to set SBL bootloader end)
And then did 7A9CFFFF0000 and finally jump to code via 7AA0

This caused the ECU to reset. I am unsure if the command ran or not, but I can only hope and assume it did.

Next step to complete my fw upload to write more complex code. In this case, disabling the watchdog timer.

Something like

Code:
void main(void) {
    volatile short i = 0xA5EF;
    WDT.WRITE.TCSR &= i;
    while (1)
    {
        
    }
}

as per the docs



Oh yes, if the above code does not work, I will try and disable interrupts.
« Last Edit: December 02, 2022, 03:00:16 AM by dikidera » Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #1949 on: December 07, 2022, 11:13:20 AM »

After a week, I've finally managed to run my own little kernel on the SH7055 chip, it was possible thanks to npkern and a SBL I was provided for my specific ECU to help me decipher the conditions which are required to keep the ECU from being reset.

I have verified that I am indeed in control by toggling different measurable states of the ECU. Now it's time to write the flashing procedure for the 29LV200BC chip. The docs were difficult to find, but I have found common code on Github that also handles this. The chip I have is either an AMD AM29LV200BC chip or an MBM29LV200, the procedure is relatively the same for flashing it.

Common code is here https://github.com/junghanChoi/osMaking/blob/d4786ac49dcad968bb58962855695af94496852b/source/ezboot/main/flash_29lvx.c
And here https://github.com/stayinyourmemorylane/AM29F040B

These libraries were very helpful in deciphering what the hell the docs meant by unlock cycles

Code:
// SEND THE 5 Unlock commands 	
AMD_Send_Command(AMD_DATA_MASK_AA, AMD_ADDR_MASK_555);
AMD_Send_Command(AMD_DATA_MASK_55, AMD_ADDR_MASK_2AA);
AMD_Send_Command(AMD_DATA_MASK_80, AMD_ADDR_MASK_555);
AMD_Send_Command(AMD_DATA_MASK_AA, AMD_ADDR_MASK_555);
AMD_Send_Command(AMD_DATA_MASK_55, AMD_ADDR_MASK_2AA);

Implementing CAN commands to send the map file is possible, but there is also a faster and potentially less cumbersome way. Upload the map in a region after the code of the program(as well as stack pointers) and flash directly off RAM. But, since the on-chip RAM is relatively small at 32Kilobytes and smaller due to program and stack(and the map is 256Kilobytes), I could upload only parts of the map I actually intend to flash. The data I want to flash is relatively small. In fact it's less than 100 bytes change as of right now. Since I've never read much about flash storage chips, I am unsure if it's possible to write only in specific memory locations or is it per sector memory. So thats my next goal.
« Last Edit: December 07, 2022, 11:24:09 AM by dikidera » Logged
Pages: 1 ... 128 129 [130] 131 132 ... 182
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.084 seconds with 17 queries. (Pretty URLs adds 0s, 0q)