Upgrading to 128M continued-2
We search for the text
DRAM_BUF_REG4
And we find in the file
mvDramIf
/* calc SDRAM_ADDR_CTRL_REG and save it to temp register */
temp = sdramAddrCtrlRegCalc(&bankInfo[0]);
if(-1 == temp)
{
mvOsPrintf("Dram: ERR. sdramAddrCtrlRegCalc failed !!!\n");
return MV_ERROR;
}
MV_REG_WRITE(DRAM_BUF_REG4, temp);
The comment at the start of this file says
/*******************************************************************************
* mvDramIfDetect - Prepare DRAM interface configuration values.
*
* DESCRIPTION:
* This function implements the full DRAM detection and timing
* configuration for best system performance.
* Since this routine runs from a ROM device (Boot Flash), its stack
* resides on RAM, that might be the system DRAM. Changing DRAM
* configuration values while keeping vital data in DRAM is risky. That
* is why the function does not preform the configuration setting but
* prepare those in predefined 32bit registers (in this case IDMA
* registers are used) for other routine to perform the settings.
* The function will call for board DRAM SPD information for each DRAM
* chip select. The function will then analyze those SPD parameters of
* all DRAM banks in order to decide on DRAM configuration compatible
* for all DRAM banks.
* The function will set the CPU DRAM address decode registers.
* Note: This routine prepares values that will overide configuration of
* mvDramBasicAsmInit().
*
* INPUT:
* forcedCl - Forced CAL Latency. If equal to zero, do not force.
*
* OUTPUT:
* None.
*
* RETURN:
* None.
*
*******************************************************************************/
So we have confirmation that the SDRAM_ADDR_CTRL_REG is definitly being loaded into a temp register. However this file is looking for I2C SPD eeproms again
So look or other instances of DRAM_BUF_REG4
and we find it in the file
mvDramIfBasicInit
#define DRAM_BUF_REG4 0x20404 /* sdram address control */
So we now have an address of the IDMA? register being used for DRAM_BUF_REG4. That info will be usefull when we are looking through the DISASSEMBLED file
It also appears in the file
mvDramIfConfig
_mvDramIfConfig:
/* 3) Write SDRAM address control register */
ldr r1, =(INTER_REGS_BASE + DRAM_BUF_REG4)
ldr r4, [r1]
ldr r1, =(INTER_REGS_BASE + SDRAM_ADDR_CTRL_REG)
str r4, [r1]
Which is the part that writes to the SDRAM control register
This is in the dissaembled file
00003240: e59f13b4 ldr r1,#0x35fc ; = #0xf1020404
00003244: e5914000 ldr r4,[r1,#0]
00003248: e59f13b0 ldr r1,#0x3600 ; = #0xf1001410
0000324c: e5814000 str r4,[r1,#0]
So now we just have to find all the parts in the disassembled file that put info INTO location f1020404 and work out which one coresponds to the static load of 0x00
We search for #0xF1020404 in the Disassembled file and fine three likely candidates
00002ac4: e3a06000 mov r6,#0
00002ac8: e59f56a8 ldr r5,#0x3178 ; = #0xf1020404
00002acc: e5856000 str r6,[r5,#0]
00002b84: e3a06020 mov r6,#0x20
00002b88: e59f55e8 ldr r5,#0x3178 ; = #0xf1020404
00002b8c: e5856000 str r6,[r5,#0]
00003588: e3a04000 mov r4,#0
0000358c: e59f1068 ldr r1,#0x35fc ; = #0xf1020404
00003590: e5814000 str r4,[r1,#0]
My bet would be candidate 1
remeber code that we first found to load the static value in was
_mvDramIfStatic1Init:
ldr r6, = STATIC1_SDRAM_ADDR_CTRL
MV_REG_WRITE_ASM(r6, r5, DRAM_BUF_REG4)
(note mov and ldr are similar instructions. I am not an ARM expert but from a quick read mov is like ldr for an 8 bit literal)
othe other two options are precluded due to
option 2 is loading the literal 0x20 into the temp register (we are looking for the value 0x00)
option 3 is using the register r4 (the code we are looking for is using r6)
SO we have a new location to try modify
00002ac4: e3a06000
must become
00002ac4: e3a06030
So in your favorite Hex-Editor (I used Notepad++ with HEX plugin) you have to modify your bin file so that
Address 0000315f changes from 0x01 to 0x07
Address 00002ac4 changes from 0x00 to 0x30
Save the file to the USB stick.
Go back to the Linux Prompt on the router and use the DD command to write the two updated bytes (315F = 12639 decimal, 2AC4 = 10948 decimal)
dd if=/home/usb/mtd5.bin of=/dev/mtdblock5 bs=1 skip=12639 seek=12639 count=1
dd if=/home/usb/mtd5.bin of=/dev/mtdblock5 bs=1 skip=10948 seek=10948 count=1
Reboot and Robert is your aunties husband.
<Continued Next Post>
(Last edited by andrewm1973 on 9 Sep 2009, 06:31)
