daniel2345
Full Member
Karma: +11/-7
 Offline
Posts: 197
|
 |
« Reply #1935 on: November 27, 2022, 02:28:47 PM »
|
|
|
Difficult to say. Just honest brainstorming: Read alot about OSI Layer Model. You are mixing physical layer, transport layer, protocol, sessions, diagnostic, swdl and so on. Some ISO documents can cover one or more layers,different sessions, etc. For Volvo not much is public, so reading everything about that stuff on VAG could help. Then read stuff about microcontroller software updates in general. Try to find automotive specific informations then. What is a primary Bootloader, why is there a secondary? What is CPU Boot mode, what is customer boot mode? Does it need different stages? What is internal memory, how external can be addressed in memory space? What is memory space, what are memory segments? What is linear adress space, what is paging and windowing? What is software, what is application data? I think someone mentioned already, that for volvo secondary Bootloaders will be needed. Prepare yourself for the cpu and ecu specific development of it. Your CPU is a Renesas SH7055. Get familiar with assembly programming and the SH2 Instruction set. User MAT concept is to be understood. Ram, Rom...etc. Or, as everyone else is doing here obviously: steal it from someone / some tool developer rather then think yourself  |
|
|
|
« Last Edit: November 27, 2022, 02:33:28 PM by daniel2345 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1936 on: November 27, 2022, 02:48:59 PM »
|
|
|
Maybe you were referring to my TCP/IP implementation. The RPI has no native way to communicate with Windows via USB or anything else. I decided to change this by using TCP sockets and using a shared network between the Raspberry Pi and Windows, as Sardine was written to work with Arduino and COM ports. And obviously Linux has native support for pretty much anything I could think of. So it's working nicely. Anyway, thanks for the pointers. The VAG group are all Bosch. And, at least in my case, my S60 is Denso. And yes, I understood early on that there are less open source tools for Denso than there are for Bosch, but luckily the Subie guys have done the hard part(arguably the hardest out of all of this) Here is the link in case anyone ever needs a base start on the kernel aka bootloader. https://github.com/fenugrec/npkern . As-is, it's currently not compatible with Volvo for a variety of reasons, but I will get to it in the near future. |
|
|
|
« Last Edit: November 27, 2022, 02:55:21 PM by dikidera »
|
Logged
|
|
|
|
daniel2345
Full Member
Karma: +11/-7
Offline
Posts: 197
|
|
« Reply #1937 on: November 27, 2022, 02:54:56 PM »
|
|
|
Maybe you were referring to my TCP/IP implementation. The RPI has no native way to communicate with Windows via USB or anything else. I decided to change this by using TCP sockets and using a shared network, as Sardine was written to work with Arduino and COM ports.
Nope. That's yust communication with your tool choice. Im talking only about "ecu side". My text are hints, things i came across. Must admit took me some years to understand everything. My impression was, you haven't so far. Sorry if im wrong.  When you have understood everything above, you will know why someone's subaru boot loader will not help you much. Start from scratch. |
|
|
|
« Last Edit: November 27, 2022, 02:57:25 PM by daniel2345 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1938 on: November 27, 2022, 02:59:18 PM »
|
|
|
Nope. That's yust communication with your tool choice. Im talking only about "ecu side". My text are hints, things i came across. Must admit took me some years to understand everything. My impression was, you haven't so far. Sorry if im wrong. I do not believe you are truly wrong. It has been only like 2 months since I started from scratch when it comes to car ECUs and Tuning. I truly had no idea how people did tunes, what maps were nor the software. It was very very difficult to build context between all the information(that is again, very fragmented). It took me a while afterwards to find dumps for my specific vehicle, to compare tunes and see what was changed, guess it's factors. As soon as I had some semblance of understanding I wanted to try and tune myself, I needed to flash my changes(to a test ECU I bought online, I wouldn't dare change anything on my running car), which is where all this lead me. Obviously, all the while reverse engineering the SH2 dumps I have, the SH2 arch is...unusual to say the least. But at least I was able to easily see what was data and what was code, as the architecture is such, that IDA produces almost sensible code from the data. EDIT: The subaru bootloader cannot work for me as-is, I know this, because it relies on the Subaru specific semantics, the guy's code will hopefully at least get me started in some direction. I just haven't had time to look at it properly. I am very focused on having VIDA communicate with my RPI. As soon as I progress further will I have time to look at the next objective. Yes I have split everything into smaller tasks. |
|
|
|
« Last Edit: November 27, 2022, 03:52:46 PM by dikidera »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #1939 on: November 28, 2022, 04:40:55 AM »
|
|
|
Does anyone have an Tune with Antilag/NLS Inside which works in every Mode? Softwareversion could be GPHJ/GSJH something 05>
With Best Regards
Some time ago I asked about your MAF readings because i do exactly the same 100-200 time (12,3s?) and i am trying to estimate my HP (no dyno yet) but no answer form you As for NLS i have it implemented on my 02 2.3 T5 and it is working well (perfectly flat boost between gear changes) I belive you need to dissasemple your bin to do it on your car. At least i can't imagine it be done on bare bin by just patching "random" things |
|
|
|
|
Logged
|
|
|
|
V70_T5
Jr. Member
Karma: +1/-1
Offline
Posts: 28
|
|
« Reply #1940 on: November 28, 2022, 02:11:00 PM »
|
|
|
Some time ago I asked about your MAF readings because i do exactly the same 100-200 time (12,3s?) and i am trying to estimate my HP (no dyno yet) but no answer form you As for NLS i have it implemented on my 02 2.3 T5 and it is working well (perfectly flat boost between gear changes) I belive you need to dissasemple your bin to do it on your car. At least i can't imagine it be done on bare bin by just patching "random" things Did you asked me over PM or in this Thread, maybe i overread it... my MAF Readings would be actually useless because i have 10% Airleak Somewhere... Answered you with an PM |
|
|
|
« Last Edit: November 28, 2022, 02:14:47 PM by V70_T5 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1941 on: November 28, 2022, 02:16:25 PM »
|
|
|
Did you asked me over PM or in this Thread, maybe i overread it... my MAF Readings would be actually useless because i have 10% Airleak Somewhere... Answered you with an PM Check your brake booster seal from within the cabin. It's a common failure point on the S60s. Replacement can be in-car but difficult if a manual due to the clutch pedal. |
|
|
|
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #1942 on: November 29, 2022, 03:26:24 AM »
|
|
|
Brake booster leak shouldn't be related with boost leak because vacuum hose from engine to BB has one way valve - at least if it's working |
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1943 on: November 29, 2022, 03:55:00 AM »
|
|
|
Brake booster leak shouldn't be related with boost leak because vacuum hose from engine to BB has one way valve - at least if it's working Both should be checked out then. Not unlikely failure point. Then all the rest of the hoses, the PCV(on the old S40s a failed PCV diaphragm caused vacuum leaks for me) |
|
|
|
|
Logged
|
|
|
|
Vollmer
Full Member
Karma: +14/-256
Offline
Posts: 78
Professional Cat Herder
|
|
« Reply #1944 on: November 29, 2022, 04:33:49 PM »
|
|
|
"I got my transceiver (NXP TJA1040) from an old XC70 Rear Electronic Module. There is poetic pleasure in using a Volvo component to recover what was taken from you by Volvo I'm alluding here to your right to customize or repair your car. This PIN business or being locked out of using spare parts is really sleazy." |
|
|
|
« Last Edit: November 29, 2022, 08:43:56 PM by Vollmer »
|
Logged
|
Volvo HALL of SHAME:
Guitar24t aka Robert Hilton
SparkyR aka Brandon Halme
Prometey1982 aka Artem Vasiliev
MAXX ECU - Brett Willet
VIDA Leach - David Leech
Useless Twats:
PRJ - Dmitri from Estonia
|
|
|
BaxtR
Full Member
Karma: +17/-25
Offline
Posts: 64
|
|
« Reply #1945 on: November 30, 2022, 05:43:42 PM »
|
|
|
"I got my transceiver (NXP TJA1040) from an old XC70 Rear Electronic Module. There is poetic pleasure in using a Volvo component to recover what was taken from you by Volvo I'm alluding here to your right to customize or repair your car. This PIN business or being locked out of using spare parts is really sleazy." Dude can you just like, stop? no one cares and youre just making a fool out of yourself. go ahead and "bring the ship down" "turn everything to ashes" youre literally a moron filling up useful threads with nonsense. |
|
|
|
|
Logged
|
2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
|
|
|
SparkyR
Full Member
Karma: +18/-21
Offline
Posts: 77
|
|
« Reply #1946 on: November 30, 2022, 05:54:42 PM »
|
|
|
He’s just seeking attention. The more you acknowledge him he’s just getting what he wants.
|
|
|
|
|
Logged
|
2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, id1700cc injectors
|
|
|
BaxtR
Full Member
Karma: +17/-25
Offline
Posts: 64
|
|
« Reply #1947 on: November 30, 2022, 06:28:10 PM »
|
|
|
He’s just seeking attention. The more you acknowledge him he’s just getting what he wants.
Just trying to ease the tension here my friend.. Hope you can understand. Miss you around these parts |
|
|
|
|
Logged
|
2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1948 on: December 01, 2022, 04:41:07 PM »
|
|
|
So I experimented like so: I sent 4 byte code via 7A9CFFFF0000 (jump to address). Then I wrote the 4 bytes which were AFFB0009 which corrsponds to an empty while(1) { }, with the command 7AAEAFFB0009. Then I did 7AA8(to set SBL bootloader end) And then did 7A9CFFFF0000 and finally jump to code via 7AA0 This caused the ECU to reset. I am unsure if the command ran or not, but I can only hope and assume it did. Next step to complete my fw upload to write more complex code. In this case, disabling the watchdog timer. Something like void main(void) {
volatile short i = 0xA5EF;
WDT.WRITE.TCSR &= i;
while (1)
{
}
}as per the docs  Oh yes, if the above code does not work, I will try and disable interrupts. |
|
|
|
« Last Edit: December 02, 2022, 03:00:16 AM by dikidera »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1949 on: December 07, 2022, 11:13:20 AM »
|
|
|
After a week, I've finally managed to run my own little kernel on the SH7055 chip, it was possible thanks to npkern and a SBL I was provided for my specific ECU to help me decipher the conditions which are required to keep the ECU from being reset. I have verified that I am indeed in control by toggling different measurable states of the ECU. Now it's time to write the flashing procedure for the 29LV200BC chip. The docs were difficult to find, but I have found common code on Github that also handles this. The chip I have is either an AMD AM29LV200BC chip or an MBM29LV200, the procedure is relatively the same for flashing it. Common code is here https://github.com/junghanChoi/osMaking/blob/d4786ac49dcad968bb58962855695af94496852b/source/ezboot/main/flash_29lvx.cAnd here https://github.com/stayinyourmemorylane/AM29F040BThese libraries were very helpful in deciphering what the hell the docs meant by unlock cycles // SEND THE 5 Unlock commands
AMD_Send_Command(AMD_DATA_MASK_AA, AMD_ADDR_MASK_555);
AMD_Send_Command(AMD_DATA_MASK_55, AMD_ADDR_MASK_2AA);
AMD_Send_Command(AMD_DATA_MASK_80, AMD_ADDR_MASK_555);
AMD_Send_Command(AMD_DATA_MASK_AA, AMD_ADDR_MASK_555);
AMD_Send_Command(AMD_DATA_MASK_55, AMD_ADDR_MASK_2AA); Implementing CAN commands to send the map file is possible, but there is also a faster and potentially less cumbersome way. Upload the map in a region after the code of the program(as well as stack pointers) and flash directly off RAM. But, since the on-chip RAM is relatively small at 32Kilobytes and smaller due to program and stack(and the map is 256Kilobytes), I could upload only parts of the map I actually intend to flash. The data I want to flash is relatively small. In fact it's less than 100 bytes change as of right now. Since I've never read much about flash storage chips, I am unsure if it's possible to write only in specific memory locations or is it per sector memory. So thats my next goal. |
|
|
|
« Last Edit: December 07, 2022, 11:24:09 AM by dikidera »
|
Logged
|
|
|
|
|
