Note to self:

Pull original flash from the /proc/flash* device.

http://empegbbs.com/ubbthreads/showflat.php/Cat/0/Number/50465/page/0/fpart/2/vc/1
There are 2 paths for the boot; if the boot is a normal one then it jumps to 0xe000 (which *is* writable) with r0=hwrev, r1=ram (MB), r2=rom (MB). Early mk1s didn't set up registers like this though, I think (if r0 is >9 then assume it's rev3).

SA-1110 Developer's Manual:

7. In systems containing DRAM or SDRAM, enable banks by setting MDCNFG:DE[3:0]. For
each SDRAM bank pair that has one or both banks enabled, this will force a pass through the
"MRS" (mode register set) state and back to "idle". The MRS commands will program
SDRAM device(s) with the CAS latencies indicated by MDCNFG:TDL2x and
MDCNFG:TDL0x. The burst type and length will always be programmed to sequential and
one (1), respectively.

8. In systems containing SDRAM or SMROM, optionally enable auto-power-down by setting
MDREFR:EAPD and MDREFR:KAPD.

Per page 10-7 in the SA1110 Developer's Guide:

MDCNFG:DE[0] and MDCNFG:DE[1] should be set to 1 to enable memory banks 0 and 1.

MDCNFG:DRAC[1:0] should be set to b10. This will enable 11 row address bits for the ram. (2^11) * 16 = 32,768

Tweaked code from blob bootloader set to my specs:
/* ENABLE SDRAM BANKS */
ldr r2, [r0, #MDCNFG ]
orr r2, r2, #0x00000003
orr r2, r2, #0x00020000
str r2, [r0, #MDCNFG]

Now, I either have to compile this or translate to object code by hand. Then insert the 4 lines before the code taken from 0xe000 and cross my fingers.

Does anyone have an ARM toolchain available and can translate my 4 lines?