nisprog reflash utility

Sasha_A80 · **Posted:** Wed Feb 10, 2021 11:59 am

Hope this helps..

void loadEraseWriteProgram ( unsigned char mode )
{
// FLASH.RAMER.WORD = 0; // disable emulation
FLASH.FKEY = 0xA5; // Flash Key enable download
FLASH.FTDAR.BYTE = 0;
// SH7055SF download to 0xFFFF6000
// SH7058/SH7058S download to 0xFFFF0000
// SH7059 download to 0xFFFE8000
set_vbr(0); // according to Chapter 24.5.2 7058S FHM
if ( mode == 0 ) // Erase mode
{
FLASH.FECS.BYTE = 1; // download EraseProgram
}
else // Write mode
{
FLASH.FPCS.BYTE =1; // download WriteProgram
}
loader(); // run download program

#if defined(Aisin7055S_Volvo)||defined(Aisin7055S_Volvo_Protect)\
||defined(Aisin7055S_VAG)||defined(Aisin7055S_VAG_Protect)\
||defined(Denso7055S)

eraseWriteFunc( // SH7058 40 MHz CPU, Wdt branch
4000, ( unsigned long )WdtClr, 0xFFFF6020);
#endif
#if defined(Aisin7058_Volvo)||defined(Aisin7058_VAG)\
||defined(Aisin7058_VAG_Protect)||defined(Denso7058)

eraseWriteFunc( // SH7058 40 MHz CPU, Wdt branch

4000, ( unsigned long )WdtClr, 0xFFFF0020);
#endif
#if defined(Aisin7058S_VAG)||defined(Aisin7058S_VAG_Protect)\
||defined(Denso7058S)

eraseWriteFunc( // SH7058S 80 MHz CPU, Wdt branch

8000, ( unsigned long )WdtClr, 0xFFFF0020);
#endif

FLASH.FKEY = 0; // Flash Key eraseWrite disable
}

And assembler insertion

**************************************************************
; Set applicable platform HERE or in shc assembler source build options
.CPU SH2
.export _eraseWriteFunc
.export _loader

.SECTION P_ASM,CODE,ALIGN = 4

; ***************************************************************
; * MODULE NAME / loader *
; * FUNCTION / invoke SH7058 EraseWrite program *
; * INPUT / R4,R5 passed to callee, R6 callee start address *
; ***************************************************************
.ALIGN 4
_loader ; FLASH.FCCS.BIT.SCO = 1;
; request EraseWriteProgram download
MOV.L R14,@-R15
MOV.L R13,@-R15
MOV.L L1,R14 ; FLASH.FCCS H'FFFFE800
MOV #1,R13 ; H'00000001
MOV.B R13,@R14
NOP ; 8 NOPs according to Chapter 24.4.2 7058S FHM
NOP
NOP
NOP
NOP
NOP
NOP
NOP
MOV.L @R15+,R13
RTS
MOV.L @R15+,R14
.ALIGN 4
L1:
.DATA.L H'FFFFE800 ;FLASH.FCCS

; ***************************************************************
; * MODULE NAME / eraseWriteFunc *
; * FUNCTION / starts ecu program *
; * INPUT / R4,R5 passed to callee, R6 callee start address *
; ***************************************************************
.ALIGN 4
_eraseWriteFunc
STS.L PR,@-R15
NOP
JSR @R6 ; call program loaded
NOP
LDS.L @R15+,PR
RTS
NOP

.END

MaRS_R · **Posted:** Wed Feb 10, 2021 3:01 pm

fenugrec wrote:

- debug l1 0x8c
- flrom practice mode (just need the last part with the error code)
- debug l1 0 (reduces debug output)
- watch ffff6800 once
- watch ffff6804 once

Code:

> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 00
diag_l1.c:155:  _send: len=3 P4=0 l0flags=0x1011; 0x01 0x34 0x35
diag_l1.c:253:  _recv request len=1024, timeout=60;got 5 bytes; 0x03 0x7F 0x34 0
xAF 0x65
diag_l1.c:253:  _recv request len=1019, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;got bad RequestDownload response : General_Error, Requeste
d_SID_requestDownload Error_Unknown Response code

Code:

nisprog> watch ffff6800

Monitoring 0x0; press Enter to interrupt.
diag_l1.c:155:  _send: len=7 P4=0 l0flags=0x1011; 0x05 0x23 0x00 0x00 0x00 0x04
0x2C
diag_l1.c:253:  _recv request len=1024, timeout=60;got 10 bytes; 0x08 0x63 0x00
0x00 0x01 0x04 0x00 0x00 0x00 0x70
diag_l1.c:253:  _recv request len=1014, timeout=23;diag_l1.c:253:  _recv request
0x0: 00 00 01 04diag_l1.c:155:  _send: len=7 P4=0 l0flags=0x1011; 0x05 0x23 0x00
 0x00 0x00 0x04 0x2C
diag_l1.c:253:  _recv request len=1024, timeout=60;got 10 bytes; 0x08 0x63 0x00
0x00 0x01 0x04 0x00 0x00 0x00 0x70
diag_l1.c:253:  _recv request len=1014, timeout=23;diag_l1.c:253:  _recv request
0x0: 00 00 01 04ut=50;

Code:

nisprog> watch ffff6804

Monitoring 0x0; press Enter to interrupt.
diag_l1.c:155:  _send: len=7 P4=0 l0flags=0x1011; 0x05 0x23 0x00 0x00 0x00 0x04
0x2C
diag_l1.c:253:  _recv request len=1024, timeout=60;got 10 bytes; 0x08 0x63 0x00
0x00 0x01 0x04 0x00 0x00 0x00 0x70
diag_l1.c:253:  _recv request len=1014, timeout=23;diag_l1.c:253:  _recv request
0x0: 00 00 01 04diag_l1.c:155:  _send: len=7 P4=0 l0flags=0x1011; 0x05 0x23 0x00
 0x00 0x00 0x04 0x2C
diag_l1.c:253:  _recv request len=1024, timeout=60;got 10 bytes; 0x08 0x63 0x00
0x00 0x01 0x04 0x00 0x00 0x00 0x70
diag_l1.c:253:  _recv request len=1014, timeout=23;diag_l1.c:253:  _recv request
0x0: 00 00 01 04ut=50;

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Code:

- watch ffff6800 once
- watch ffff6804 once

note, those need the 0x , e.g. watch 0xffff6804

@Sasha

Sasha_A80 wrote:

There are a lot of 'nop's required after FCCS bit 0 set high.
Some code activity is not welcome just after download requested.

Yes, I already do that :
https://github.com/fenugrec/npkern/blob ... 0nm.c#L184

Don't forget, npkern has worked very well on 7058 (non-'s') for many people. But 7055s for some reason is doing something weird.

Thanks for your code example, I'll take a close look. Already I see you have 8 NOPs after SCO=1 ...

You're right, the 7058s datasheet (REJ09B0177-0500) 24.4.2 has

Quote:

SCO: ....Eight NOP instructions must be executed immediately after setting this bit to 1.

But my DS for 7055s ( REJ09B0045-0200H ) , 22.4.2 says

Quote:

Four NOP instructions must be executed immediately after setting this bit to 1.

I wonder if the -s suffix parts need 8 nops and they just didn't fix the datasheet for 7055s ?

For sure I'll try 8 nop's next... other than that it seems our code is mostly identical.

Sasha_A80 · **Posted:** Thu Feb 11, 2021 1:06 am

Is this key sequence not interrupted by some code inserted by a compiler ?

FLASH.FKEY = 0xA5; // Flash Key enable download
FLASH.FTDAR.BYTE = 0;

and FLASH.FTDAR.BYTE is written just after FLASH.KEY in my code.

Historically I have used 4 nop's for 7058, then used 8 nop's for 7058/7058S and after that 7055SF support was added.
I can't say for sure that 8 nop's is really needed for 7055SF.

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Sasha_A80 wrote:

Is this key sequence not interrupted by some code inserted by a compiler ?

No, with sh-gcc I never had any reordering problems like you mention (yet)... what did your compiler insert in there ?

Here's what the current test 05 looks like

- disable ints + set imask before everything
- early FKEY=A5
- 8 nops after SCO=1

Code:

.... trimmed vbr + imask part
D1 43       mov.l   dword_FFFF8D9C, r1 ; h'FFFF6801
EB A5       mov     #h'FFFFFFA5, r11
36       mov.b   @(6,r3), r0
E4 01       mov     #1, r4
00       mov.b   r0, @r1
B3       mov     r11, r0
34       mov.b   r0, @(4,r3)  ;FKEY=A5
73       mov     r7, r0
31       mov.b   r0, @(1,r3) ;FPCS=0
43       mov     r4, r0
32       mov.b   r0, @(2,r3) ;FECS=1
73       mov     r7, r0
36       mov.b   r0, @(6,r3) ;FTDAR=0
...... trimmed some diagnostic code
30       mov.b   @r3, r0
CB 01       or      #1, r0
00       mov.b   r0, @r3   ;FCCS.SCO=1
09       nop
09       nop
09       nop
09       nop
09       nop
09       nop
09       nop
09       nop

Quote:

and FLASH.FTDAR.BYTE is written just after FLASH.KEY in my code.

that shouldn't be necessary according to the DS, but I've changed it just in case anyway.

MaRS_R · **Posted:** Thu Feb 11, 2021 10:31 am

fenugrec wrote:

that shouldn't be necessary according to the DS, but I've changed it just in case anyway.

Code:

> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 00
diag_l1.c:155:  _send: len=3 P4=0 l0flags=0x1011; 0x01 0x34 0x35
diag_l1.c:253:  _recv request len=1024, timeout=60;got 5 bytes; 0x03 0x7F 0x34 0
xAF 0x65
diag_l1.c:253:  _recv request len=1019, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;got bad RequestDownload response : General_Error, Requeste
d_SID_requestDownload Error_Unknown Response code
nisprog> debug l1 0
L1 debug is 0x0:
nisprog> watch ffff6800

Monitoring 0x0; press Enter to interrupt.
0x0: 00 00 01 04
nisprog> watch ffff6804

Monitoring 0x0; press Enter to interrupt.
0x0: 00 00 01 04

Can I try to pour in 9W73B.bin (factory) via "f: to reflash the whole ROM"?

Sasha_A80 · **Posted:** Thu Feb 11, 2021 2:45 pm

Prepare the SHboot reflash setup and you will able to try anything.

MaRS_R · **Posted:** Thu Feb 11, 2021 3:30 pm

Sasha_A80 wrote:

Prepare the SHboot reflash setup and you will able to try anything.

How to do it?

Sasha_A80 · **Posted:** Thu Feb 11, 2021 3:44 pm

Make a slow dump if you still do not have the original ROM and follow this thread

viewtopic.php?f=65&t=12821

MaRS_R · **Posted:** Thu Feb 11, 2021 5:02 pm

Sasha_A80 wrote:

Make a slow dump if you still do not have the original ROM and follow this thread

viewtopic.php?f=65&t=12821

He did one on one as fast and the same as your 9W73B.

it was possible to read the firmware using nisprog, it is not possible to fill it through it. I know that renisas can do this directly via rx and tx. When I try to pour through nisprog and mark the letter "p", then it does not write errors, namely when I press "f" it does not work. This is what fenugrec is trying to figure out. And when you try to write firmware with the letter "A", nisprog gives an error even when trying to write it.

I ordered two more such ECUs (A56-X75, A56-U18) of different years of production, I will try to send them on them again.

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

MaRS_R wrote:

nisprog> watch ffff6800
nisprog> watch ffff6804

Like I said earlier you need the "0x" part. i.e. watch 0xffff...
was that with the most recent (t05) test ?

MaRS_R · **Posted:** Thu Feb 11, 2021 7:34 pm

fenugrec wrote:

Like I said earlier you need the "0x" part. i.e. watch 0xffff...
was that with the most recent (t05) test ?

Code:

nisprog> debug l1 0
L1 debug is 0x0:
nisprog> watch ffff6800

Monitoring 0x0; press Enter to interrupt.
0x0: 00 00 01 04
nisprog> watch ffff6804

Monitoring 0x0; press Enter to interrupt.
0x0: 00 00 01 04

Yes. it was 05 test

Sasha_A80 · **Posted:** Fri Feb 12, 2021 1:21 am

2 fenugrec:

May this still be 0.35 silicon ?

Do you check in your kernel the processor family ?
SH7055F returns nothing useful, SH7055S\SH7058\SH7058S\SH7059 returns the family.
SDSR register 0xFFFFF7C2

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Sasha_A80 wrote:

SH7055F returns nothing useful, SH7055S\SH7058\SH7058S\SH7059 returns the family.
SDSR register 0xFFFFF7C2

Interesting... but how can that work ?

7055F (350nm) has SDSR = 0x0201 (or 0x0200 depending on TRST) ?
7055S has SDSR = 0x0201 (same)
7058 has SDSR = 0x0201 (same)
7058S has SDSR as 0x5001
7059 : SDSR = 0x0F01

7055F , 7055S and 7058 datasheets say exactly the same thing about SDSR...

Currently, I check for 350nm by doing this :

Code:

   //Check 180nm vs 350nm : on 350nm, FKEY is undefined; 180nm has an 8bit RW register
   FLASH.FKEY = 0x33;
   if (FLASH.FKEY != 0x33) {
      *err = PF_SILICON;
      return 0;
   }

Until now this worked OK : R/W to FKEY on 350nm doesn't hardfault, it's just not implemented. Earlier @Mars tried the 350nm kernel and it detected there was a register at FKEY and didn't proceed.

IIRC the PCB photo he posted seemed to show a datecode after 2005 (Renesas released the 7055S in ~2003. Not sure when they stopped producing the 7055F...)

AH, just found something maybe about the "FID CPU" record.
9W73A: has SH705513
9W73B: has SH705520

Almost certain that SH705513 normally is 350nm.
So why the f does this one react differently to the test FKEY ??
And then, maybe 9W73B isn't really compatible with 9W73A

@Mars, I said twice you need to add 0x to the watch command. Otherwise it reads at 0.

MaRS_R · **Posted:** Fri Feb 12, 2021 12:05 pm

fenugrec wrote:

@Mars, I said twice you need to add 0x to the watch command. Otherwise it reads at 0.

Code:

SID27:SUXXESS !!
SID 34 80 done.
SID36 block 0x006F/0x006F done
SID 36 done.
sid37: sending 0x37 0x57 0xA3
SID 37 done.
SID BF done.
ECU now running from RAM ! Disabling periodic keepalive;
Connected to kernel: SH7055_18-7055t05
You may now use kernel-specific commands.
        p3 set to 0 (0x0).
Connected to kernel: SH7055_18-7055t05
nisprog: Settings loaded from nisprog.ini

Code:

> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 00
diag_l1.c:155:  _send: len=3 P4=0 l0flags=0x1011; 0x01 0x34 0x35
diag_l1.c:253:  _recv request len=1024, timeout=60;got 5 bytes; 0x03 0x7F 0x34 0
xAF 0x65
diag_l1.c:253:  _recv request len=1019, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;got bad RequestDownload response : General_Error, Requeste
d_SID_requestDownload Error_Unknown Response code
nisprog> debug l1 0
L1 debug is 0x0:
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: 00 01 01 8B
nisprog> watch 0xffff6804

Monitoring 0xFFFF6804; press Enter to interrupt.
0xFFFF6804: FF FF BF 94
nisprog>

The year of release is most likely 2007 or 2008, but since I could not read the eeprom, I cannot see the VIN.

Sorry, I seem to be slowing down! Moreover, I use a translator. :oops:

RomRaider

Forum rules

nisprog reflash utility

Who is online