FreeCalypso > hg > freecalypso-reveng

comparison pirelli/fw-disasm @ 252:2eae53bb4a4e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
pirelli/fw-disasm: Switch_ON() analysis complete
author Mychaela Falconia <falcon@freecalypso.org>
date Mon, 25 Dec 2017 20:50:30 +0000
parents 6d9a6627b085
children 6f9969cf55a1
comparison
equal deleted inserted replaced
251:6d9a6627b085 252:2eae53bb4a4e
721 32db86: f0ad f855 bl 0x3dac34 721 32db86: f0ad f855 bl 0x3dac34
722 32db8a: 2000 mov r0, #0 722 32db8a: 2000 mov r0, #0
723 32db8c: b002 add sp, #8 723 32db8c: b002 add sp, #8
724 32db8e: bd10 pop {r4, pc} 724 32db8e: bd10 pop {r4, pc}
725 725
726 ; The following function computes the battery remaining % number
727 ; from the battery mV passed in R0. It first increases the mV value
728 ; by a factor that depends on the system current draw (it appears
729 ; that they are after the "true" battery voltage before the internal
730 ; resistance), and then does the table look-up for the % number.
726 32dfee: b510 push {r4, lr} 731 32dfee: b510 push {r4, lr}
727 32dff0: b082 sub sp, #8 732 32dff0: b082 sub sp, #8
728 32dff2: 1c04 add r4, r0, #0 733 32dff2: 1c04 add r4, r0, #0
729 32dff4: f000 f9a4 bl 0x32e340 734 32dff4: f000 f9a4 bl 0x32e340
730 32dff8: 4669 mov r1, sp 735 32dff8: 4669 mov r1, sp
812 32e09c: 1810 add r0, r2, r0 817 32e09c: 1810 add r0, r2, r0
813 32e09e: 7880 ldrb r0, [r0, #2] 818 32e09e: 7880 ldrb r0, [r0, #2]
814 32e0a0: b002 add sp, #8 819 32e0a0: b002 add sp, #8
815 32e0a2: bd10 pop {r4, pc} 820 32e0a2: bd10 pop {r4, pc}
816 821
822 ; The following function seems to compute the system's current draw.
823 ; It starts with the display backlight's current draw from 0x1775138,
824 ; converts it from ADC units to mA per the fixed *855/1000 formula,
825 ; and then throws in a ton of other factors which are impractical
826 ; to follow in this totally unknown fw.
817 32e340: b510 push {r4, lr} 827 32e340: b510 push {r4, lr}
818 32e342: b08c sub sp, #48 ; 0x30 828 32e342: b08c sub sp, #48 ; 0x30
829 ; function returns the value of 16-bit var in 0x1775138
819 32e344: f0b0 ffbd bl 0x3df2c2 830 32e344: f0b0 ffbd bl 0x3df2c2
820 32e348: 1c04 add r4, r0, #0 831 32e348: 1c04 add r4, r0, #0
821 32e34a: 484a ldr r0, =0x357 ; via 0x32e474 832 32e34a: 484a ldr r0, =0x357 ; via 0x32e474
822 32e34c: 4360 mul r0, r4 833 32e34c: 4360 mul r0, r4
823 32e34e: 217d mov r1, #125 ; 0x7d 834 32e34e: 217d mov r1, #125 ; 0x7d
824 32e350: 00c9 lsl r1, r1, #3 835 32e350: 00c9 lsl r1, r1, #3
825 32e352: f0c8 ff6b bl 0x3f722c 836 32e352: f0c8 ff6b bl 0x3f722c ; I$DIV
826 32e356: 0408 lsl r0, r1, #16 837 32e356: 0408 lsl r0, r1, #16
827 32e358: 1404 asr r4, r0, #16 838 32e358: 1404 asr r4, r0, #16
828 32e35a: f085 fea4 bl 0x3b40a6 839 32e35a: f085 fea4 bl 0x3b40a6
829 32e35e: 2800 cmp r0, #0 840 32e35e: 2800 cmp r0, #0
830 32e360: d002 beq 0x32e368 841 32e360: d002 beq 0x32e368
1407 39f04a: 2119 mov r1, #25 ; 0x19 1418 39f04a: 2119 mov r1, #25 ; 0x19
1408 39f04c: 2200 mov r2, #0 1419 39f04c: 2200 mov r2, #0
1409 39f04e: 43d2 mvn r2, r2 1420 39f04e: 43d2 mvn r2, r2
1410 39f050: 2305 mov r3, #5 1421 39f050: 2305 mov r3, #5
1411 39f052: f03b fdef bl 0x3dac34 1422 39f052: f03b fdef bl 0x3dac34
1412 39f056: f002 f9f1 bl 0x3a143c 1423 39f056: f002 f9f1 bl 0x3a143c ; $Power_OFF_Button
1413 39f05a: e125 b 0x39f2a8 1424 39f05a: e125 b 0x39f2a8
1414 ; end of PUSHOFF_IT_STS handling 1425 ; end of PUSHOFF_IT_STS handling
1415 39f05c: 9802 ldr r0, [sp, #8] 1426 39f05c: 9802 ldr r0, [sp, #8]
1416 39f05e: 8800 ldrh r0, [r0, #0] 1427 39f05e: 8800 ldrh r0, [r0, #0]
1417 39f060: 0880 lsr r0, r0, #2 1428 39f060: 0880 lsr r0, r0, #2
1422 39f06a: 2120 mov r1, #32 ; 0x20 1433 39f06a: 2120 mov r1, #32 ; 0x20
1423 39f06c: 2200 mov r2, #0 1434 39f06c: 2200 mov r2, #0
1424 39f06e: 43d2 mvn r2, r2 1435 39f06e: 43d2 mvn r2, r2
1425 39f070: 2305 mov r3, #5 1436 39f070: 2305 mov r3, #5
1426 39f072: f03b fddf bl 0x3dac34 1437 39f072: f03b fddf bl 0x3dac34
1427 39f076: f002 fa9c bl 0x3a15b2 1438 39f076: f002 fa9c bl 0x3a15b2 ; $Power_OFF_Remote
1428 39f07a: e115 b 0x39f2a8 1439 39f07a: e115 b 0x39f2a8
1429 ; end of REMOT_IT_STS handling 1440 ; end of REMOT_IT_STS handling
1430 39f07c: 9802 ldr r0, [sp, #8] 1441 39f07c: 9802 ldr r0, [sp, #8]
1431 39f07e: 8800 ldrh r0, [r0, #0] 1442 39f07e: 8800 ldrh r0, [r0, #0]
1432 39f080: 0980 lsr r0, r0, #6 1443 39f080: 0980 lsr r0, r0, #6
1695 39f2aa: f040 fd00 bl 0x3dfcae 1706 39f2aa: f040 fd00 bl 0x3dfcae
1696 39f2ae: b009 add sp, #36 ; 0x24 1707 39f2ae: b009 add sp, #36 ; 0x24
1697 39f2b0: bd10 pop {r4, pc} 1708 39f2b0: bd10 pop {r4, pc}
1698 39f2b2: 46c0 nop (mov r8, r8) 1709 39f2b2: 46c0 nop (mov r8, r8)
1699 1710
1711 $Power_ON_Button:
1712 3a13dc: b570 push {r4, r5, r6, lr}
1713 3a13de: 1c05 add r5, r0, #0
1714 ; set is_gsm_on
1715 3a13e0: 2232 mov r2, #50 ; 0x32
1716 3a13e2: 48ee ldr r0, =0x1774e38 ; via 0x3a179c
1717 3a13e4: 6801 ldr r1, [r0, #0]
1718 3a13e6: 2001 mov r0, #1
1719 3a13e8: 5450 strb r0, [r2, r1]
1720 ; Kp pointers: are they set?
1721 3a13ea: 4eed ldr r6, =0x1774e98 ; via 0x3a17a0
1722 3a13ec: 6834 ldr r4, [r6, #0]
1723 3a13ee: 6830 ldr r0, [r6, #0]
1724 3a13f0: 2800 cmp r0, #0
1725 3a13f2: d002 beq 0x3a13fa
1726 3a13f4: 6870 ldr r0, [r6, #4]
1727 3a13f6: 2800 cmp r0, #0
1728 3a13f8: d106 bne 0x3a1408
1729 3a13fa: 2001 mov r0, #1
1730 3a13fc: f710 fa4f bl 0x2b189e ; rvf_delay()
1731 3a1400: 6834 ldr r4, [r6, #0]
1732 3a1402: 2c00 cmp r4, #0
1733 3a1404: d1f6 bne 0x3a13f4
1734 3a1406: e7f8 b 0x3a13fa
1735 ; end of the wait for Kp pointers to be initialized
1736 ; different boot causes result in different key codes being sent
1737 3a1408: 2d01 cmp r5, #1
1738 3a140a: d00d beq 0x3a1428
1739 3a140c: 2d04 cmp r5, #4
1740 3a140e: d009 beq 0x3a1424
1741 3a1410: 2d08 cmp r5, #8
1742 3a1412: d005 beq 0x3a1420
1743 3a1414: 2d02 cmp r5, #2
1744 3a1416: d001 beq 0x3a141c
1745 3a1418: 2036 mov r0, #54 ; 0x36
1746 3a141a: e006 b 0x3a142a
1747 3a141c: 2035 mov r0, #53 ; 0x35
1748 3a141e: e004 b 0x3a142a
1749 3a1420: 2034 mov r0, #52 ; 0x34
1750 3a1422: e002 b 0x3a142a
1751 3a1424: 2033 mov r0, #51 ; 0x33
1752 3a1426: e000 b 0x3a142a
1753 3a1428: 2019 mov r0, #25 ; 0x19
1754 3a142a: f055 feef bl 0x3f720c ; $IND_CALL
1755 3a142e: 2005 mov r0, #5
1756 3a1430: f710 fa35 bl 0x2b189e ; rvf_delay()
1757 3a1434: 6874 ldr r4, [r6, #4]
1758 3a1436: f055 fee9 bl 0x3f720c ; $IND_CALL
1759 3a143a: bd70 pop {r4, r5, r6, pc}
1760
1761 $Power_OFF_Button:
1762 3a143c: b530 push {r4, r5, lr}
1763 3a143e: b082 sub sp, #8
1764 3a1440: f707 f84e bl 0x2a84e0
1765 3a1444: 48d7 ldr r0, =0xa0020 ; via 0x3a17a4
1766 3a1446: 9000 str r0, [sp, #0]
1767 3a1448: a0b9 add r0, pc, #740 ; 0x2e4
1768 3a144a: 2110 mov r1, #16 ; 0x10
1769 3a144c: 2200 mov r2, #0
1770 3a144e: 43d2 mvn r2, r2
1771 3a1450: 2302 mov r3, #2
1772 3a1452: f039 fbef bl 0x3dac34
1773 3a1456: 4dd2 ldr r5, =0x1774e98 ; via 0x3a17a0
1774 3a1458: 2019 mov r0, #25 ; 0x19
1775 3a145a: 682c ldr r4, [r5, #0]
1776 3a145c: f055 fed6 bl 0x3f720c ; $IND_CALL
1777 3a1460: 2005 mov r0, #5
1778 3a1462: f710 fa1c bl 0x2b189e ; rvf_delay()
1779 3a1466: 686c ldr r4, [r5, #4]
1780 3a1468: f055 fed0 bl 0x3f720c ; $IND_CALL
1781 3a146c: b002 add sp, #8
1782 3a146e: bd30 pop {r4, r5, pc}
1783
1784 $Set_Switch_ON_Cause:
1785 3a1470: b500 push {lr}
1786 3a1472: f7a7 ff4b bl 0x34930c
1787 3a1476: 49cc ldr r1, =0x1774cd0 ; via 0x3a17a8
1788 3a1478: 8008 strh r0, [r1, #0]
1789 3a147a: bd00 pop {pc}
1790
1700 $Switch_ON: 1791 $Switch_ON:
1701 3a147c: b5f0 push {r4, r5, r6, r7, lr} 1792 3a147c: b5f0 push {r4, r5, r6, r7, lr}
1702 3a147e: b082 sub sp, #8 1793 3a147e: b082 sub sp, #8
1703 3a1480: f7a7 ff44 bl 0x34930c ; $ABB_Read_Status 1794 3a1480: f7a7 ff44 bl 0x34930c ; $ABB_Read_Status
1704 3a1484: 49c8 ldr r1, =0x1774cd0 ; via 0x3a17a8 1795 3a1484: 49c8 ldr r1, =0x1774cd0 ; via 0x3a17a8
1784 3a1522: 1c20 add r0, r4, #0 1875 3a1522: 1c20 add r0, r4, #0
1785 3a1524: f78c fd63 bl 0x32dfee 1876 3a1524: f78c fd63 bl 0x32dfee
1786 3a1528: 1c02 add r2, r0, #0 1877 3a1528: 1c02 add r2, r0, #0
1787 3a152a: 48a3 ldr r0, =0x1774ccc ; via 0x3a17b8 1878 3a152a: 48a3 ldr r0, =0x1774ccc ; via 0x3a17b8
1788 3a152c: 8002 strh r2, [r0, #0] 1879 3a152c: 8002 strh r2, [r0, #0]
1880 ; "First capacity (%):" trace
1789 3a152e: 489d ldr r0, =0xa0020 ; via 0x3a17a4 1881 3a152e: 489d ldr r0, =0xa0020 ; via 0x3a17a4
1790 3a1530: 9000 str r0, [sp, #0] 1882 3a1530: 9000 str r0, [sp, #0]
1791 3a1532: a090 add r0, pc, #576 ; 0x240 1883 3a1532: a090 add r0, pc, #576 ; 0x240
1792 3a1534: 2114 mov r1, #20 ; 0x14 1884 3a1534: 2114 mov r1, #20 ; 0x14
1793 3a1536: 2305 mov r3, #5 1885 3a1536: 2305 mov r3, #5
1797 3a1540: da03 bge 0x3a154a 1889 3a1540: da03 bge 0x3a154a
1798 3a1542: 2002 mov r0, #2 1890 3a1542: 2002 mov r0, #2
1799 3a1544: 4328 orr r0, r5 1891 3a1544: 4328 orr r0, r5
1800 3a1546: 0600 lsl r0, r0, #24 1892 3a1546: 0600 lsl r0, r0, #24
1801 3a1548: 0e05 lsr r5, r0, #24 1893 3a1548: 0e05 lsr r5, r0, #24
1894 ; bit 1 is set in R5 if the battery is critically low
1802 3a154a: 0928 lsr r0, r5, #4 1895 3a154a: 0928 lsr r0, r5, #4
1803 3a154c: d309 bcc 0x3a1562 1896 3a154c: d309 bcc 0x3a1562
1804 3a154e: 489b ldr r0, =0xd2a ; via 0x3a17bc 1897 3a154e: 489b ldr r0, =0xd2a ; via 0x3a17bc
1805 3a1550: 4284 cmp r4, r0 1898 3a1550: 4284 cmp r4, r0
1806 3a1552: da06 bge 0x3a1562 1899 3a1552: da06 bge 0x3a1562
1807 3a1554: 20f7 mov r0, #247 ; 0xf7 1900 3a1554: 20f7 mov r0, #247 ; 0xf7
1808 3a1556: 7871 ldrb r1, [r6, #1] 1901 3a1556: 7871 ldrb r1, [r6, #1]
1809 3a1558: 4008 and r0, r1 1902 3a1558: 4008 and r0, r1
1810 3a155a: 7070 strb r0, [r6, #1] 1903 3a155a: 7070 strb r0, [r6, #1]
1811 3a155c: f7a8 f98c bl 0x349878 1904 3a155c: f7a8 f98c bl 0x349878 ; $ABB_Power_Off
1812 3a1560: e024 b 0x3a15ac 1905 3a1560: e024 b 0x3a15ac
1906 ; end of RTC alarm low battery check
1907 ; set display backlight to max
1813 3a1562: 2040 mov r0, #64 ; 0x40 1908 3a1562: 2040 mov r0, #64 ; 0x40
1814 3a1564: f03d fe5f bl 0x3df226 1909 3a1564: f03d fe5f bl 0x3df226
1910 ; find the highest set bit in R5
1815 3a1568: 2107 mov r1, #7 1911 3a1568: 2107 mov r1, #7
1816 3a156a: 2001 mov r0, #1 1912 3a156a: 2001 mov r0, #1
1817 3a156c: 4088 lsl r0, r1 1913 3a156c: 4088 lsl r0, r1
1818 3a156e: 4028 and r0, r5 1914 3a156e: 4028 and r0, r5
1819 3a1570: 0600 lsl r0, r0, #24 1915 3a1570: 0600 lsl r0, r0, #24
1823 3a1578: 1e49 sub r1, r1, #1 1919 3a1578: 1e49 sub r1, r1, #1
1824 3a157a: 0409 lsl r1, r1, #16 1920 3a157a: 0409 lsl r1, r1, #16
1825 3a157c: 1409 asr r1, r1, #16 1921 3a157c: 1409 asr r1, r1, #16
1826 3a157e: 2900 cmp r1, #0 1922 3a157e: 2900 cmp r1, #0
1827 3a1580: d5f3 bpl 0x3a156a 1923 3a1580: d5f3 bpl 0x3a156a
1924 ; end of the find-highest-bit loop
1828 3a1582: 2200 mov r2, #0 1925 3a1582: 2200 mov r2, #0
1829 3a1584: 2802 cmp r0, #2 1926 3a1584: 2802 cmp r0, #2
1830 3a1586: d000 beq 0x3a158a 1927 3a1586: d000 beq 0x3a158a
1831 3a1588: 2201 mov r2, #1 1928 3a1588: 2201 mov r2, #1
1832 3a158a: 07e9 lsl r1, r5, #31 1929 3a158a: 07e9 lsl r1, r5, #31
1835 3a1590: 2900 cmp r1, #0 1932 3a1590: 2900 cmp r1, #0
1836 3a1592: d100 bne 0x3a1596 1933 3a1592: d100 bne 0x3a1596
1837 3a1594: 2000 mov r0, #0 1934 3a1594: 2000 mov r0, #0
1838 3a1596: 08e9 lsr r1, r5, #3 1935 3a1596: 08e9 lsr r1, r5, #3
1839 3a1598: d204 bcs 0x3a15a4 1936 3a1598: d204 bcs 0x3a15a4
1840 3a159a: f7ff ff1f bl 0x3a13dc 1937 ; boot path w/o charging power
1841 3a159e: f012 fa73 bl 0x3b3a88 1938 3a159a: f7ff ff1f bl 0x3a13dc ; $Power_ON_Button
1939 3a159e: f012 fa73 bl 0x3b3a88 ; $pwr_handle_discharge
1842 3a15a2: e003 b 0x3a15ac 1940 3a15a2: e003 b 0x3a15ac
1843 3a15a4: f7ff ff1a bl 0x3a13dc 1941 ; boot path with charging power
1844 3a15a8: f000 f805 bl 0x3a15b6 1942 3a15a4: f7ff ff1a bl 0x3a13dc ; $Power_ON_Button
1943 3a15a8: f000 f805 bl 0x3a15b6 ; $PWR_Charger_Plug
1845 3a15ac: b002 add sp, #8 1944 3a15ac: b002 add sp, #8
1846 3a15ae: bdf0 pop {r4, r5, r6, r7, pc} 1945 3a15ae: bdf0 pop {r4, r5, r6, r7, pc}
1847 1946
1848 $Power_ON_Remote: 1947 $Power_ON_Remote:
1849 3a15b0: 4770 bx lr 1948 3a15b0: 4770 bx lr
1864 3a15c2: d103 bne 0x3a15cc 1963 3a15c2: d103 bne 0x3a15cc
1865 3a15c4: 20ff mov r0, #255 ; 0xff 1964 3a15c4: 20ff mov r0, #255 ; 0xff
1866 3a15c6: 30b2 add r0, #178 ; 0xb2 1965 3a15c6: 30b2 add r0, #178 ; 0xb2
1867 3a15c8: f710 f969 bl 0x2b189e ; rvf_delay() 1966 3a15c8: f710 f969 bl 0x2b189e ; rvf_delay()
1868 3a15cc: 2003 mov r0, #3 1967 3a15cc: 2003 mov r0, #3
1869 3a15ce: f789 fcc9 bl 0x32af64 1968 3a15ce: f789 fcc9 bl 0x32af64 ; $rvf_stop_timer ?
1870 3a15d2: f7f3 fb5d bl 0x394c90 1969 3a15d2: f7f3 fb5d bl 0x394c90 ; $pwr_send_charger_plug_event ?
1871 3a15d6: f78c fc1b bl 0x32de10 1970 3a15d6: f78c fc1b bl 0x32de10 ; $pwr_get_battery_type ?
1872 3a15da: bd00 pop {pc} 1971 3a15da: bd00 pop {pc}
1873 1972
1874 $PWR_Charger_Unplug: 1973 $PWR_Charger_Unplug:
1875 3a15dc: b500 push {lr} 1974 3a15dc: b500 push {lr}
1876 3a15de: b082 sub sp, #8 1975 3a15de: b082 sub sp, #8
1877 3a15e0: f7f3 fb8f bl 0x394d02 1976 3a15e0: f7f3 fb8f bl 0x394d02 ; $pwr_send_charger_unplug_event ?
1878 3a15e4: 486f ldr r0, =0xa0020 ; via 0x3a17a4 1977 3a15e4: 486f ldr r0, =0xa0020 ; via 0x3a17a4
1879 3a15e6: 9000 str r0, [sp, #0] 1978 3a15e6: 9000 str r0, [sp, #0]
1880 3a15e8: a068 add r0, pc, #416 ; 0x1a0 1979 3a15e8: a068 add r0, pc, #416 ; 0x1a0
1881 3a15ea: 210e mov r1, #14 ; 0xe 1980 3a15ea: 210e mov r1, #14 ; 0xe
1882 3a15ec: 2200 mov r2, #0 1981 3a15ec: 2200 mov r2, #0
1899 3a1612: d103 bne 0x3a161c 1998 3a1612: d103 bne 0x3a161c
1900 3a1614: 486c ldr r0, =0x1774cd2 ; via 0x3a17c8 1999 3a1614: 486c ldr r0, =0x1774cd2 ; via 0x3a17c8
1901 3a1616: 7800 ldrb r0, [r0, #0] 2000 3a1616: 7800 ldrb r0, [r0, #0]
1902 3a1618: 2800 cmp r0, #0 2001 3a1618: 2800 cmp r0, #0
1903 3a161a: d102 bne 0x3a1622 2002 3a161a: d102 bne 0x3a1622
1904 3a161c: f012 fa34 bl 0x3b3a88 2003 3a161c: f012 fa34 bl 0x3b3a88 ; $pwr_handle_discharge
1905 3a1620: e004 b 0x3a162c 2004 3a1620: e004 b 0x3a162c
1906 3a1622: 2001 mov r0, #1 2005 3a1622: 2001 mov r0, #1
1907 3a1624: 213c mov r1, #60 ; 0x3c 2006 3a1624: 213c mov r1, #60 ; 0x3c
1908 3a1626: 2201 mov r2, #1 2007 3a1626: 2201 mov r2, #1
1909 3a1628: f7a7 fdf0 bl 0x34920c 2008 3a1628: f7a7 fdf0 bl 0x34920c ; $ABB_Write_Register_on_page
1910 3a162c: b002 add sp, #8 2009 3a162c: b002 add sp, #8
1911 3a162e: bd00 pop {pc} 2010 3a162e: bd00 pop {pc}
1912 2011
1913 3a1630: 4965 ldr r1, =0x1774cd2 ; via 0x3a17c8 2012 3a1630: 4965 ldr r1, =0x1774cd2 ; via 0x3a17c8
1914 3a1632: 2001 mov r0, #1 2013 3a1632: 2001 mov r0, #1
1935 3a1658: 203d mov r0, #61 ; 0x3d 2034 3a1658: 203d mov r0, #61 ; 0x3d
1936 3a165a: e000 b 0x3a165e 2035 3a165a: e000 b 0x3a165e
1937 3a165c: 203c mov r0, #60 ; 0x3c 2036 3a165c: 203c mov r0, #60 ; 0x3c
1938 3a165e: 4d50 ldr r5, =0x1774e98 ; via 0x3a17a0 2037 3a165e: 4d50 ldr r5, =0x1774e98 ; via 0x3a17a0
1939 3a1660: 682c ldr r4, [r5, #0] 2038 3a1660: 682c ldr r4, [r5, #0]
1940 3a1662: f055 fdd3 bl 0x3f720c 2039 3a1662: f055 fdd3 bl 0x3f720c ; $IND_CALL
1941 3a1666: 2005 mov r0, #5 2040 3a1666: 2005 mov r0, #5
1942 3a1668: f710 f919 bl 0x2b189e 2041 3a1668: f710 f919 bl 0x2b189e ; rvf_delay()
1943 3a166c: 686c ldr r4, [r5, #4] 2042 3a166c: 686c ldr r4, [r5, #4]
1944 3a166e: f055 fdcd bl 0x3f720c 2043 3a166e: f055 fdcd bl 0x3f720c ; $IND_CALL
1945 3a1672: bd30 pop {r4, r5, pc} 2044 3a1672: bd30 pop {r4, r5, pc}
1946 2045
1947 3a1674: b500 push {lr} 2046 3a1674: b500 push {lr}
1948 3a1676: f7a7 fe49 bl 0x34930c 2047 3a1676: f7a7 fe49 bl 0x34930c
1949 3a167a: 4a4c ldr r2, =0xfffe1811 ; via 0x3a17ac 2048 3a167a: 4a4c ldr r2, =0xfffe1811 ; via 0x3a17ac
2027 2126
2028 3a1728: 4821 ldr r0, =0x1774cd4 ; via 0x3a17b0 2127 3a1728: 4821 ldr r0, =0x1774cd4 ; via 0x3a17b0
2029 3a172a: 6800 ldr r0, [r0, #0] 2128 3a172a: 6800 ldr r0, [r0, #0]
2030 3a172c: 4770 bx lr 2129 3a172c: 4770 bx lr
2031 3a172e: 46c0 nop (mov r8, r8) 2130 3a172e: 46c0 nop (mov r8, r8)
2131
2132 3b40a6: 488c ldr r0, =0x1774db0 ; via 0x3b42d8
2133 3b40a8: 6800 ldr r0, [r0, #0]
2134 3b40aa: 4770 bx lr
2032 2135
2033 $Init_Target: 2136 $Init_Target:
2034 3bb7d4: b570 push {r4, r5, r6, lr} 2137 3bb7d4: b570 push {r4, r5, r6, lr}
2035 3bb7d6: b081 sub sp, #4 2138 3bb7d6: b081 sub sp, #4
2036 3bb7d8: 4c96 ldr r4, =0xfffef008 ; via 0x3bba34 2139 3bb7d8: 4c96 ldr r4, =0xfffef008 ; via 0x3bba34
2816 3dc9da: 200c mov r0, #12 ; 0xc 2919 3dc9da: 200c mov r0, #12 ; 0xc
2817 3dc9dc: f003 f967 bl 0x3dfcae 2920 3dc9dc: f003 f967 bl 0x3dfcae
2818 3dc9e0: b003 add sp, #12 ; 0xc 2921 3dc9e0: b003 add sp, #12 ; 0xc
2819 3dc9e2: bd00 pop {pc} 2922 3dc9e2: bd00 pop {pc}
2820 2923
2924 ; A higher-level display backlight control function: takes a backlight
2925 ; level index as input (0 means off, 1-4 are defined levels, anything >=5
2926 ; means maximum), calls the lower-level function with the corresponding
2927 ; PWL value, and sets the 0x1775138 var to a number that seems to be
2928 ; the backlight's expected current draw.
2929 3df226: b500 push {lr}
2930 3df228: 2800 cmp r0, #0
2931 3df22a: d105 bne 0x3df238
2932 3df22c: f000 f827 bl 0x3df27e
2933 3df230: 492a ldr r1, =0x1775138 ; via 0x3df2dc
2934 3df232: 2000 mov r0, #0
2935 3df234: 8008 strh r0, [r1, #0]
2936 3df236: bd00 pop {pc}
2937 3df238: 2801 cmp r0, #1
2938 3df23a: d019 beq 0x3df270
2939 3df23c: 2802 cmp r0, #2
2940 3df23e: d012 beq 0x3df266
2941 3df240: 2803 cmp r0, #3
2942 3df242: d00b beq 0x3df25c
2943 3df244: 2804 cmp r0, #4
2944 3df246: d004 beq 0x3df252
2945 3df248: 20ff mov r0, #255 ; 0xff
2946 3df24a: f000 f818 bl 0x3df27e
2947 3df24e: 2162 mov r1, #98 ; 0x62
2948 3df250: e012 b 0x3df278
2949 3df252: 20c0 mov r0, #192 ; 0xc0
2950 3df254: f000 f813 bl 0x3df27e
2951 3df258: 2157 mov r1, #87 ; 0x57
2952 3df25a: e00d b 0x3df278
2953 3df25c: 2080 mov r0, #128 ; 0x80
2954 3df25e: f000 f80e bl 0x3df27e
2955 3df262: 214c mov r1, #76 ; 0x4c
2956 3df264: e008 b 0x3df278
2957 3df266: 2040 mov r0, #64 ; 0x40
2958 3df268: f000 f809 bl 0x3df27e
2959 3df26c: 2141 mov r1, #65 ; 0x41
2960 3df26e: e003 b 0x3df278
2961 3df270: 2001 mov r0, #1
2962 3df272: f000 f804 bl 0x3df27e
2963 3df276: 2108 mov r1, #8
2964 3df278: 4818 ldr r0, =0x1775138 ; via 0x3df2dc
2965 3df27a: 8001 strh r1, [r0, #0]
2966 3df27c: bd00 pop {pc}
2967
2968 ; The following 0x3df27e function controls the display backlight.
2969 ; 0 argument means fully off, otherwise the master on/off control is on
2970 ; and the argument is the value for PWL control before the inversion.
2971 3df27e: b530 push {r4, r5, lr}
2972 3df280: 2800 cmp r0, #0
2973 3df282: d10d bne 0x3df2a0
2974 3df284: 4c16 ldr r4, =0x177513a ; via 0x3df2e0
2975 3df286: 7820 ldrb r0, [r4, #0]
2976 3df288: 2800 cmp r0, #0
2977 3df28a: d016 beq 0x3df2ba
2978 ; 0x2785d0 must be the display backlight master on/off control function
2979 3df28c: 2000 mov r0, #0
2980 3df28e: f699 f99f bl 0x2785d0
2981 3df292: 2000 mov r0, #0
2982 3df294: 4913 ldr r1, =0xfffe8000 ; via 0x3df2e4
2983 3df296: 7008 strb r0, [r1, #0]
2984 3df298: 4913 ldr r1, =0xfffe8001 ; via 0x3df2e8
2985 3df29a: 7008 strb r0, [r1, #0]
2986 3df29c: 7020 strb r0, [r4, #0]
2987 3df29e: bd30 pop {r4, r5, pc}
2988 3df2a0: 4910 ldr r1, =0xfffe8000 ; via 0x3df2e4
2989 3df2a2: 4240 neg r0, r0
2990 3df2a4: 7008 strb r0, [r1, #0]
2991 3df2a6: 4c0e ldr r4, =0x177513a ; via 0x3df2e0
2992 3df2a8: 7820 ldrb r0, [r4, #0]
2993 3df2aa: 2800 cmp r0, #0
2994 3df2ac: d105 bne 0x3df2ba
2995 3df2ae: 2501 mov r5, #1
2996 3df2b0: 704d strb r5, [r1, #1]
2997 3df2b2: 2001 mov r0, #1
2998 3df2b4: f699 f98c bl 0x2785d0
2999 3df2b8: 7025 strb r5, [r4, #0]
3000 3df2ba: bd30 pop {r4, r5, pc}
3001
3002 3df2bc: 4808 ldr r0, =0x177513a ; via 0x3df2e0
3003 3df2be: 7800 ldrb r0, [r0, #0]
3004 3df2c0: 4770 bx lr
3005
3006 3df2c2: 4806 ldr r0, =0x1775138 ; via 0x3df2dc
3007 3df2c4: 8800 ldrh r0, [r0, #0]
3008 3df2c6: 4770 bx lr
3009
2821 $AI_EnableBit: 3010 $AI_EnableBit:
2822 3e300c: 4a44 ldr r2, =0xfffef00a ; via 0x3e3120 3011 3e300c: 4a44 ldr r2, =0xfffef00a ; via 0x3e3120
2823 3e300e: 2101 mov r1, #1 3012 3e300e: 2101 mov r1, #1
2824 3e3010: 4081 lsl r1, r0 3013 3e3010: 4081 lsl r1, r0
2825 3e3012: 8810 ldrh r0, [r2, #0] 3014 3e3012: 8810 ldrh r0, [r2, #0]
3484 XRAM data: 3673 XRAM data:
3485 3674
3486 0x17649b8: ABB_Hisr 3675 0x17649b8: ABB_Hisr
3487 0x1764a10: ABB_HisrStack 3676 0x1764a10: ABB_HisrStack
3488 3677
3678 0x17729d0: init data array that should have been const instead,
3679 mapping from system current draw to voltage drop
3680 that can be modeled as the battery's internal resistance:
3681 005A ( 90) 0017 (23)
3682 00AA (170) 002D (45)
3683 00FA (250) 0050 (80)
3684
3489 0x17741e0: abb_sem 3685 0x17741e0: abb_sem
3490 3686
3491 0x1774b7c: 16-bit var battery voltage in mV 3687 0x1774b7c: 16-bit var battery voltage in mV
3688
3689 0x1774ccc: 16-bit var initial battery % is stored here
3690
3691 0x1774cd0: 16-bit var, ABB_Read_Status() return value at the beginning
3692 of Switch_ON() is stored here
3492 3693
3493 0x1774cd4: 32-bit var BatOperationMode 3694 0x1774cd4: 32-bit var BatOperationMode
3494 3695
3495 0x1774e38: SPI_GBL_INFO_PTR 3696 0x1774e38: SPI_GBL_INFO_PTR
3496 0x1774e3c: spi_error_ft 3697 0x1774e3c: spi_error_ft
3498 0x1774e70: pwr_env_ctrl_blk 3699 0x1774e70: pwr_env_ctrl_blk
3499 0x1774e74: pwr_error_ft 3700 0x1774e74: pwr_error_ft
3500 3701
3501 0x1775041: byte var set to 0 in spi_abb_read_int_reg_callback() 3702 0x1775041: byte var set to 0 in spi_abb_read_int_reg_callback()
3502 in ADC end processing 3703 in ADC end processing
3704
3705 0x1775138: 16-bit var, stores a number that goes up as the display
3706 backlight intensity increases, probably the backlight's
3707 expected current draw
3708
3709 0x177513a: 8-bit var, flag indicating if the display backlight is on