Page 2 of 2
Re: 2004 Baja MT
Posted: Sun Apr 06, 2025 10:56 am
by MiikaS
Well that's odd. Need to check with my bench ECU what's going on... It was not long ago when I fixed sh7055 kernels as they was somehow reverted to older version.
Re: 2004 Baja MT
Posted: Mon Apr 07, 2025 2:01 pm
by MiikaS
Cortin wrote: Sun Apr 06, 2025 10:42 am
MiikaS wrote: Sun Apr 06, 2025 9:01 am
Yes
no changes.
At the same time ecuflesh and ecuedit write without problems
Tested with 2003 Legacy GT A2ZJ601A ECU. My local repo kernels worked (K-Line and CAN) and then I downloaded kernels from development branch and they worked too... so maybe you copied kernels to wrong place or something else is wrong. When you start read/write it shows path to kernel, make sure you copy kernel to that folder.
Re: 2004 Baja MT
Posted: Mon Apr 07, 2025 11:03 pm
by Cortin
I checked the kernel. Everything is correct.
What else can I check?
I deleted the kernel from the folder to check - it says not found
Re: 2004 Baja MT
Posted: Mon Apr 07, 2025 11:41 pm
by MiikaS
Looking at the error code, I think this could be related to silicon version on sh7055. If it is, this would be the first sh7055 180nm version in Subaru that I'm aware of... need to check more tomorrow.
Re: 2004 Baja MT
Posted: Tue Apr 08, 2025 12:21 am
by Cortin
if needed, I can connect FastECU-client
Re: 2004 Baja MT
Posted: Wed Apr 09, 2025 6:33 pm
by MiikaS
Cortin wrote: Mon Apr 07, 2025 11:03 pm
I checked the kernel. Everything is correct.
What else can I check?
I deleted the kernel from the folder to check - it says not found
Please test kernels from link below. They now have 180nm flash routines and gives error (0x8e) on 350nm MCU when initialising flash mode. Change names by removing "_180" or change kernel names in protocols.cfg to use them. Also prepare to unbrick ECU
Combining these two versions would take some time, so I did quick and dirty fix for testing by building separate kernels.
https://drive.google.com/file/d/15_39jV ... sp=sharing
Re: 2004 Baja MT
Posted: Wed Apr 09, 2025 11:40 pm
by Cortin
write k-line
Code: Select all
[2025-04-10 03:33:13.300] (DD) Response:
[2025-04-10 03:33:13.308] (II) Different blocks : 10, 15, (total: 2)
[2025-04-10 03:33:13.308] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-10 03:33:13.308] (II) Check max message length[2025-04-10 03:33:13.308] (DD) Sent: be ef 00 01 05 b3
[2025-04-10 03:33:13.312] (DD) Response: be ef 00 05 45 00 00 02 00 f9
: 0x0200
[2025-04-10 03:33:13.312] (II) Check flashblock size[2025-04-10 03:33:13.312] (DD) Sent: be ef 00 01 06 b4
[2025-04-10 03:33:13.317] (DD) Response: be ef 00 05 46 00 00 10 00 08
: 0x1000
[2025-04-10 03:33:13.317] (II) Test write mode off, perform actual flash write
[2025-04-10 03:33:13.317] (DD) Sent: be ef 00 01 20 ce
[2025-04-10 03:33:13.321] (DD) Response: be ef 00 01 60 0e
[2025-04-10 03:33:13.321] (EE) Flash mode succesfully set
[2025-04-10 03:33:13.321] (II) Flash block addr: 0x00020000 len: 0x00010000
[2025-04-10 03:33:13.322] (II) Check flash voltage[2025-04-10 03:33:13.322] (DD) Sent: be ef 00 01 04 b2
[2025-04-10 03:33:13.326] (DD) Response: be ef 00 05 44 02 30 02 30 5a
: 11.2V
[2025-04-10 03:33:13.326] (II) Flash page erase addr: 0x00020000 len: 0x00010000
[2025-04-10 03:33:13.326] (II) Erasing flash page...[2025-04-10 03:33:13.326] (DD) Sent: be ef 00 05 25 00 02 00 00 d9
[2025-04-10 03:33:16.332] (DD) Response:
[2025-04-10 03:33:16.333] (EE) No valid response from ECU
[2025-04-10 03:33:16.333] (EE) Reflash error! Do not panic, do not reset the ECU immediately. The kernel is most likely still running and receiving commands!
[2025-04-10 03:33:16.333] (II) Block 10 reflash failed.
Re: 2004 Baja MT
Posted: Wed Apr 09, 2025 11:53 pm
by Cortin
wrtite can.
brick ECU
erased area 20000-30000
But didn't record anything
Code: Select all
2025-04-10 03:42:17.596] (DD) Response:
[2025-04-10 03:42:17.601] (II) Different blocks : 10, (total: 1)
[2025-04-10 03:42:17.602] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-10 03:42:17.602] (II) Check max message length[2025-04-10 03:42:17.602] (DD) Sent: 00 00 07 e0 be ef 00 01 05
[2025-04-10 03:42:17.602] (DD) Response: 00 00 07 e8 be ef 00 05 45 00 00 02 00
: 0x0200
[2025-04-10 03:42:17.602] (II) Check flashblock size[2025-04-10 03:42:17.602] (DD) Sent: 00 00 07 e0 be ef 00 01 06
[2025-04-10 03:42:17.603] (DD) Response: 00 00 07 e8 be ef 00 05 46 00 00 10 00
: 0x1000
[2025-04-10 03:42:17.603] (II) Test write mode off, perform actual flash write
[2025-04-10 03:42:17.603] (DD) Sent: 00 00 07 e0 be ef 00 01 20
[2025-04-10 03:42:17.604] (DD) Response: 00 00 07 e8 be ef 00 01 60
[2025-04-10 03:42:17.604] (EE) Flash mode succesfully set
[2025-04-10 03:42:17.604] (II) Flash block addr: 0x00020000 len: 0x00010000
[2025-04-10 03:42:17.604] (II) Check flash voltage[2025-04-10 03:42:17.604] (DD) Sent: 00 00 07 e0 be ef 00 01 04
[2025-04-10 03:42:17.606] (DD) Response: 00 00 07 e8 be ef 00 05 44 02 30 02 30
: 11.2V
[2025-04-10 03:42:17.606] (II) Flash page erase addr: 0x00020000 len: 0x00010000
[2025-04-10 03:42:17.606] (II) Erasing flash page...[2025-04-10 03:42:17.606] (DD) Sent: 00 00 07 e0 be ef 00 05 25 00 02 00 00
[2025-04-10 03:42:17.871] (DD) Response: 00 00 07 e8 be ef 00 01 65
erased
[2025-04-10 03:42:17.872] (II) Start flash write addr: 0x00020000 len: 0x00010000
[2025-04-10 03:42:17.872] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 00 00 d2 16 f1 28 f1 f5 8d
[2025-04-10 03:42:17.891] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:17.891] (DD) Data written to flash buffer
[2025-04-10 03:42:17.891] (II) Write flash buffer: 0x00020000 (0% - 14665176 B/s, ~ 14664412 s)
[2025-04-10 03:42:17.897] (DD) Battery: 11.894 V
[2025-04-10 03:42:17.899] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 02 00 93 38 f3 38 92 37 f2
[2025-04-10 03:42:17.920] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:17.920] (DD) Data written to flash buffer
[2025-04-10 03:42:17.920] (II) Write flash buffer: 0x00020200 (0% - 25600 B/s, ~ 3 s)
[2025-04-10 03:42:17.920] (DD) void MainWindow::external_logger_set_progressbar_value(int) 1
[2025-04-10 03:42:17.921] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 04 00 92 6b f2 0a d4 3f d1
[2025-04-10 03:42:17.941] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:17.941] (DD) Data written to flash buffer
[2025-04-10 03:42:17.941] (II) Write flash buffer: 0x00020400 (1% - 18285 B/s, ~ 4 s)
[2025-04-10 03:42:17.942] (DD) void MainWindow::external_logger_set_progressbar_value(int) 2
[2025-04-10 03:42:17.943] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 06 00 c8 80 00 29 70 ff 60
[2025-04-10 03:42:17.963] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:17.963] (DD) Data written to flash buffer
[2025-04-10 03:42:17.963] (II) Write flash buffer: 0x00020600 (2% - 24380 B/s, ~ 3 s)
[2025-04-10 03:42:17.963] (DD) void MainWindow::external_logger_set_progressbar_value(int) 3
[2025-04-10 03:42:17.964] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 08 00 63 51 22 31 61 51 d0
[2025-04-10 03:42:17.986] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:17.986] (DD) Data written to flash buffer
[2025-04-10 03:42:17.986] (II) Write flash buffer: 0x00020800 (3% - 24380 B/s, ~ 3 s)
[2025-04-10 03:42:17.986] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 0a 00 b5 c8 b4 27 00 06 42
[2025-04-10 03:42:18.006] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:18.006] (DD) Data written to flash buffer
[2025-04-10 03:42:18.006] (II) Write flash buffer: 0x00020A00 (3% - 23272 B/s, ~ 3 s)
[2025-04-10 03:42:18.006] (DD) void MainWindow::external_logger_set_progressbar_value(int) 4
[2025-04-10 03:42:18.009] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 0c 00 88 01 8d 02 00 09 a0
[2025-04-10 03:42:18.029] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:18.029] (DD) Data written to flash buffer
[2025-04-10 03:42:18.029] (II) Write flash buffer: 0x00020C00 (4% - 25600 B/s, ~ 3 s)
[2025-04-10 03:42:18.029] (DD) void MainWindow::external_logger_set_progressbar_value(int) 5
[2025-04-10 03:42:18.031] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 0e 00 c8 08 8f 29 fd 8d d1
[2025-04-10 03:42:18.052] (DD) Response: 00 00 07 e8 be ef 00 01 62
[2025-04-10 03:42:18.052] (DD) Data written to flash buffer
[2025-04-10 03:42:18.052] (II) Write flash buffer: 0x00020E00 (5% - 22260 B/s, ~ 3 s)
[2025-04-10 03:42:18.052] (DD) void MainWindow::external_logger_set_progressbar_value(int) 6
[2025-04-10 03:42:18.053] (II) Flash buffer write complete...
[2025-04-10 03:42:18.053] (DD) Image CRC32: 0xe2eba374
[2025-04-10 03:42:18.053] (II) Committ flash addr: 0x20000 len: 0x1000 crc32: 0xe2eba374
[2025-04-10 03:42:18.053] (DD) Sent: 00 00 07 e0 be ef 00 0b 24 00 02 00 00 10 00 e2 eb a3 74
[2025-04-10 03:42:21.057] (DD) Response:
[2025-04-10 03:42:21.059] (EE) No valid response from ECU
Re: 2004 Baja MT
Posted: Thu Apr 10, 2025 3:05 pm
by MiikaS
I think I need to source similar ECU from somewhere for testing. I have now checked registers and all I can think of to make sure it should work. These 180nm and newer chips (sh7055s/sh7058/sh7059) share the same flash erase/write method and I haven't yet found what is the problem
also what is strange, that the K-Line and CAN shares same base code, only difference is communication, so they should also act the same...
Re: 2004 Baja MT
Posted: Sun Apr 13, 2025 9:30 pm
by Cortin
another block sh7055
K-line and can - read without problems
Re: 2004 Baja MT
Posted: Mon Apr 14, 2025 9:45 am
by MiikaS
Cortin wrote: Sun Apr 13, 2025 9:30 pm
another block sh7055
K-line and can - read without problems
What is ECU and CAL IDs of this ECU?
Re: 2004 Baja MT
Posted: Mon Apr 14, 2025 9:41 pm
by Cortin
I can't say exactly what ecu id was there. I rewrote it many times.
Experimentally I found out - newer units 22611-AK22X - are not flashed. Their CAL ID is A2WDXXXX.
22611-AH110, 111, 112, 121, 122, 123, 124 - CAL ID - A2ZJXXXX - are flashed.
PS In this case, it doesn't matter what CAL ID is flashed. Everything depends on the unit.
Re: 2004 Baja MT
Posted: Mon Apr 14, 2025 10:06 pm
by MiikaS
Cortin wrote: Mon Apr 14, 2025 9:41 pm
I can't say exactly what ecu id was there. I rewrote it many times.
Experimentally I found out - newer units 22611-AK22
X - are not flashed. Their CAL ID is A2WD
XXXX.
22611-AH110, 111, 112, 121, 122, 123, 124 - CAL ID - A2ZJ
XXXX - are flashed.
PS In this case, it doesn't matter what CAL ID is flashed. Everything depends on the unit.
I was looking for connection between CAL ID and failed flash. So it seems that when stock CAL ID starts with A2W are with newer 180nm chip. Just to look for ECU to test with.
Re: 2004 Baja MT
Posted: Tue Apr 15, 2025 12:53 pm
by Cortin
if needed, I can connect FastECU-client?
Re: 2004 Baja MT
Posted: Sun Jul 06, 2025 8:12 am
by johnxx
I have a JDM 2005 Legacy GT ECU (Subaru: 22611AK223, XML ID: A2WD012B). When I try a write or test write with FastECU 0.1.0-beta4 (AppImage on Elementary OS 8 (Ubuntu 24.04)), I get this:
- Screenshot from 2025-07-05 19.09.34.jpg (241.88 KiB) Viewed 3789 times
Is this the same issue? If so, is there any useful information I could add grab? And if someone needs an AK22X ECU to play with, I'd be willing to pitch in!