Pages: [1]
Author Topic: ME7 Relocating KFZW outside of 810000-81FFFF  (Read 8254 times)
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« on: April 06, 2017, 01:08:21 AM »

Hey all, for a project I have been trying to relocate the KFZW maps to the end of the file (mapswitching alternative tables).
One problem that I encountered was, that while most lookup routines in the ecu use an offset-multiplier lookup routine (that allows you to put the maps everywhere you like without further modifications), KFZW is using a different lookup routine that only takes the offset and therefore limits your locations to 810000 through 81FFFF. In some ecu's, I have found enough space in this area to put 4 extra tables, but in others it is not possible.
For this example, the KFZW map starting adress is put in r12
Here is what I did last night to solve this:
- I have copied the whole lookup routine first.
- I added extp r11, #1 (insert custom multiplier in this register of choice somewhere in the code) in every line BEFORE anything that is related to "[r12]"
- fix relative jumps accordingly
- produce binary and insert in free space. I chose to keep the offset the same, but at the end of the file (example: from original ROM adress 0078B8 I located this new routine at 8F78B8 in the flash.
This is a very small change in the original code call, to keep things clean.

the result I intended with this is:
You can add switching conditions in the new subroutine, to have the correct multiplier inside of r11 that suits your map location. (or when you use switched ram like me, just insert ram adress and include the multiplier in your switch code)
You can therefore relocate your KFZW maps at the same offset but different multiplier to have minimal code changes.

Example: KFZW1 is at 812850. This is multiplier 204h offset 2850. Alternative multipliers are 228h (KFZW1_2 @ 8A2850) and 229h (KFZW1_3 @ 8A6850)

Any thoughts, comments or feedback on this approach is welcome. I have tested this on the bench and it worked, will test in my car later.

Code:
KFZW MODIFIED lookup routine // Add r11 multiplier in code.
>>>>                      extp #0E1h, 1
>>>>                      mov  r11, "SWITCHED MULTIPLIER IN RAM" (add this in your switch routine)
ROM:78B8                 movb    rl2, [r13]
ROM:78BA                 movbz   r13, rl2
ROM:78BC                 mov     r1, r14
ROM:78BE                 movbz   r1, rh1
ROM:78C0                 mulu    r1, r13
ROM:78C2                 mov     r1, word_FE0E
ROM:78C6                 add     r12, r1
ROM:78C8                 mov     r1, r15
ROM:78CA                 movbz   r1, rh1
ROM:78CC                 add     r12, r1
>>>>        extp r11, #1
ROM:78CE                 movb    rl2, [r12]
ROM:78D0                 movbs   r2, rl2
ROM:78D2                 shl     r15, #8
ROM:78D4                 shr     r15, #1
ROM:78D6                 jmpr    cc_Z, loc_78EA
>>>>        extp r11, #1
ROM:78D8                 movb    rl3, [r12+1]
ROM:78DC                 movbs   r3, rl3
ROM:78DE                 sub     r3, r2
ROM:78E0                 shl     r3, #1
ROM:78E2                 mul     r3, r15
ROM:78E4                 mov     r3, word_FE0C
ROM:78E8                 add     r2, r3
ROM:78EA                 mov     r4, r2
ROM:78EC                 shl     r14, #8
ROM:78EE                 shr     r14, #1
ROM:78F0                 jmpr    cc_Z, locret_7918
ROM:78F2                 add     r12, r13
>>>>       extp r11, #1
ROM:78F4                 movb    rl2, [r12+]
ROM:78F6                 movbs   r2, rl2
ROM:78F8                 or      r15, #0
ROM:78FA                 jmpr    cc_Z, loc_790C
>>>>       extp r11, #1
ROM:78FC                 movb    rl3, [r12]
ROM:78FE                 movbs   r3, rl3
ROM:7900                 sub     r3, r2
ROM:7902                 shl     r3, #1
ROM:7904                 mul     r3, r15
ROM:7906                 mov     r3, word_FE0C
ROM:790A                 add     r2, r3
ROM:790C                 sub     r2, r4
ROM:790E                 shl     r2, #1
ROM:7910                 mul     r2, r14
ROM:7912                 mov     r2, word_FE0C
ROM:7916                 add     r4, r2
ROM:7918                 rets
« Last Edit: April 06, 2017, 03:00:45 AM by TijnCU » Logged

fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #1 on: April 06, 2017, 04:24:48 AM »

you can move all kfzw maps into the new segment with new lookup routine
no need to change extp (or exts) value everytime in that case
Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #2 on: April 06, 2017, 04:32:01 AM »

True, but then you need to modify the offset if you have multiple maps. It comes down to the same thing, or do you mean something else?
Logged

fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #3 on: April 06, 2017, 05:19:37 AM »

something like that
sorry for syntax, last time i do that a year ago Smiley
lets imagine we have only one kfzw
and with multimap routine we call it kfzw1 and kfzw2

*stock kfzw
mov r12, .. ; stock values irrelevant now
mov r13, ..
calls <new routine>

*new routine at 0xB0000 or something like

movbz r4, current_map ;
cmpb rl4, #1
jmpr cc_z, loc_kfzw1
cmpb rl4, #2
jmpr cc_z, loc_kfzw2
jmpr cc_uc, loc_kfzw1 ; just for safety

loc_kfzw1:

mov r12, <kfzw1>
mov r13, <kfzw1 axis>
...
calls loc_kfzwMATH
jmpr cc_uc,  loc_end

loc_kfzw2:
<all the same with different r12, r13 values for kfzw2 location>
...

loc_kfzwMATH:
<from your post>
extp #22C, #1  ; now we always at 22C
ROM:78B8                 movb    rl2, [r13]
ROM:78BA                 movbz   r13, rl2
ROM:78BC                 mov     r1, r14
ROM:78BE                 movbz   r1, rh1   
ROM:78C0                 mulu    r1, r13
ROM:78C2                 mov     r1, word_FE0E
ROM:78C6                 add     r12, r1
ROM:78C8                 mov     r1, r15
ROM:78CA                 movbz   r1, rh1
ROM:78CC                 add     r12, r1
       extp #22C, #1   
ROM:78CE                 movb    rl2, [r12]
etc
...
rets

loc_end:
<some stuff or just>
rets
« Last Edit: April 06, 2017, 05:22:11 AM by fukenbroken » Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #4 on: April 06, 2017, 06:44:20 AM »

Yes, I understand. My multimap function creates an array of ram variables containing the adresses, so I call the switch routine once in the binary and there all changed maps get put in ram adresses according to the mapset. These ram adresses are then placed instead of the original offset adresses (for example kfzw was mov r12, #2850h but in my file it says mov r12, word_381234. It is very compact code and you have all of he mapset in 1 place. In my own file I use only kfzw1 and 2 because I have no vvt and no need for more timing maps, but with vvt and 3 mapsets space gets scarce  Smiley
Maybe that clarifies why I chose to work with a variable in this routine, but I agree with you for only kfzw change a fixed routine is simpler.
Logged

TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #5 on: April 14, 2017, 11:49:19 AM »

Just for feedback, this custom lookup routine works perfect. I have been driving around with relocated kfzw maps for my lpg fueling the past week. Hope it is of use for somebody else  Smiley
Logged

fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #6 on: April 14, 2017, 04:40:05 PM »

next step - cruise control switching and tacho indication via can-bus  Smiley
Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #7 on: April 15, 2017, 01:08:46 PM »

Hehe already have cruise map switching next to automatic switching from rear o2 signal for lpg  Wink next step replace turbo for bigger version Cheesy
Logged

rogerius
Full Member
***

Karma: +61/-6
Offline Offline

Posts: 114


« Reply #8 on: January 02, 2020, 05:54:18 AM »

next step - cruise control switching and tacho indication via can-bus  Smiley
I do not want to scatter info, if provided...so I will ask here:
For the "tacho indication", is it possible to avoid getting the beeps for "alternator workshop", the message for "oil pressure low" and "AC compressor fan" ON?
I hate it to ask openly, but have no idea how/if possible at all, to achieve this.
Maybe somebody knowledgeable can say if it is at all possible and maybe a clue for "how" ?
Logged
prj
Hero Member
*****

Karma: +903/-420
Online Online

Posts: 5790


« Reply #9 on: January 02, 2020, 09:25:20 AM »

All these things have nothing to do with the ECU, it's based on the cluster.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
rogerius
Full Member
***

Karma: +61/-6
Offline Offline

Posts: 114


« Reply #10 on: January 02, 2020, 10:10:49 AM »

All these things have nothing to do with the ECU, it's based on the cluster.
So has it been done via the cluster? I hope it is not a dead end!
Logged
prj
Hero Member
*****

Karma: +903/-420
Online Online

Posts: 5790


« Reply #11 on: January 02, 2020, 10:15:01 AM »

Via cluster as much as possible and via maybe simulating some signals or something.

All those notifications you are talking about - ECU does not know anything about it. It's 100% in the cluster.
I don't know enough about clusters to tell you if it's possible to do some eeprom hackery there to switch the alerts on or off, and either way it has nothing to do with topic at hand.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
rogerius
Full Member
***

Karma: +61/-6
Offline Offline

Posts: 114


« Reply #12 on: January 02, 2020, 10:38:23 AM »

Via cluster as much as possible and via maybe simulating some signals or something.

All those notifications you are talking about - ECU does not know anything about it. It's 100% in the cluster.
I don't know enough about clusters to tell you if it's possible to do some eeprom hackery there to switch the alerts on or off, and either way it has nothing to do with topic at hand.
Thank you!
I will not clutter this topic anymore.
Logged
fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #13 on: January 02, 2020, 10:15:51 PM »

I do not want to scatter info, if provided...so I will ask here:
For the "tacho indication", is it possible to avoid getting the beeps for "alternator workshop", the message for "oil pressure low" and "AC compressor fan" ON?
I hate it to ask openly, but have no idea how/if possible at all, to achieve this.
Maybe somebody knowledgeable can say if it is at all possible and maybe a clue for "how" ?

Do your thing when engine is running
Logged
rogerius
Full Member
***

Karma: +61/-6
Offline Offline

Posts: 114


« Reply #14 on: January 03, 2020, 12:11:01 AM »

Do your thing when engine is running
I have PMd you a video. Have u seen it? Do you mean to change the mapswitching conditions from "key on engine off' to "engine idle, speed <3km/h" ?
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.024 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)