Sooo i have no background in DQ operations and also hw for reading ram so im intuitive here
I want to manage input torque limiter, as i read somewhere its limited at 450 in code and also 410nm diagnostic limit? Thats all input
So i start with the ida/ghidra and a bit stuck in addressing mode
Lets take 02E300051C as fully defined and mmr_MMaxGetriebeschutz_ko limiter as example @80031744
Ive got no xrefs so dealing with the pointers
copyMotormomentMapsToRam: ; CODE XREF: copyMapsToRam+C2↓p
PFLASH:80069648 movh.a a4, #@HIS(unk_D0005D2C)
PFLASH:8006964C movh.a a15, #@HIS(qword_8003164C)
PFLASH:80069650 mov32 d4, #0x110
PFLASH:80069654 lea a4, [a4]@LOS(unk_D0005D2C)
PFLASH:80069658 lea a15, [a15]@LOS(qword_8003164C)
PFLASH:8006965C st16.a [a4], a15
PFLASH:8006965E j32 subb_mapPtrToRam
This code make pointer(?) to 8003164C (start of section) to D0005D2C with length of section = 0x110
void FUN_80069648(void)
{
DAT_d0005d2c = 0x8003164c;
FUN_800aaa9c(&DAT_d0005d2c, 0x110);
return;
}
void FUN_800aaa9c(undefined4 *param_1,undefined4 param_2)
{
undefined4 *puVar1;
int iVar2;
int iVar3;
puVar1 = (undefined4 *)DAT_d0005fa0;
iVar3 = DAT_d0005fa4;
if (12 < (uint)(iVar3 - (int)puVar1)) {
*puVar1 = param_1;
puVar1[1] = param_2;
puVar1[2] = *param_1;
DAT_d0005fa0 = puVar1 + 3;
}
iVar2 = DAT_d0005fa0;
DAT_d0005bd8 = iVar3 - iVar2;
return;
}
Doesnt look like copy code so i think its pointer but duno why it uses array length
0x80031A3A(start of section) - 0x8003164c (map address) gives 0xF8 or [7C] index in array
it brings me to this routine
sVar5 = DAT_d0002d8c;
local_c = (short **)&DAT_d0005d2c;
psVar16 = (short *)DAT_d0005d2c;
sVar9 = psVar16[0x77];
local_4 = (int)(short)(sVar5 + sVar9);
....
....
local_8 = &ram_getriebeschutzMoment;
ram_getriebeschutzMoment = psVar16[0x7c];
if (((psVar16[0x7f] & 0b1000000000000000U) == 0) || (local_4 <= psVar16[0x7c])) {
if ((short)(sVar9 + sVar5 + 300) < psVar16[0x7c]) {
uVar8 = DAT_d0005d50;
DAT_d0005d50 = uVar8 & 0x7fff;
}
}
else {
uVar8 = DAT_d0005d50;
DAT_d0005d50 = uVar8 | 0x8000;
}
the psVar16[0x77] is the mmr_MVorhaltGetriebeschutz_ko if im not mistaken
psVar16[0x7f] is the mmr_freigabe_ko_Befuellfunktion which is 0xEF in this file
so i can translate this into:
if ( !mmr_freigabe_ko_Befuellfunktion.15 || (mmr_MVorhaltGetriebeschutz_ko + inputTorque(?)) <= mmr_MMaxGetriebeschutz_ko)
{
if mmr_MVorhaltGetriebeschutz_ko + inputTorque(?) + 300 < mmr_MMaxGetriebeschutz_ko
{
uVar8 = DAT_d0005d50; //filtered input torque?
DAT_d0005d50 = uVar8 & 0x7fff // limited to 32767?
}
}
else {
uVar8 = DAT_d0005d50;
DAT_d0005d50 = uVar8 | 0x8000; //
}
i believe this routine convert value to signed
Could someone confirm im on the right way and wtf is that +300 offset
Or maybe some input? I was try to find can-bus messages as the input to my research but no luck here
